1508 files changed, 20754 insertions, 12956 deletions
diff --git a/.mailmap b/.mailmap
index ada8ad696b2e..0d971cfb0772 100644
--- a/.mailmap
+++ b/.mailmap
@@ -51,6 +51,7 @@ Greg Kroah-Hartman <gregkh@suse.de>
 Greg Kroah-Hartman <greg@kroah.com>
 Henk Vergonet <Henk.Vergonet@gmail.com>
 Henrik Kretzschmar <henne@nachtwindheim.de>
+Henrik Rydberg <rydberg@bitmath.org>
 Herbert Xu <herbert@gondor.apana.org.au>
 Jacob Shin <Jacob.Shin@amd.com>
 James Bottomley <jejb@mulgrave.(none)>
@@ -72,6 +73,7 @@ Juha Yrjola <juha.yrjola@nokia.com>
 Juha Yrjola <juha.yrjola@solidboot.com>
 Kay Sievers <kay.sievers@vrfy.org>
 Kenneth W Chen <kenneth.w.chen@intel.com>
+Konstantin Khlebnikov <koct9i@gmail.com> <k.khlebnikov@samsung.com>
 Koushik <raghavendra.koushik@neterion.com>
 Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
 Leonid I Ananiev <leonid.i.ananiev@intel.com>
diff --git a/Documentation/ABI/testing/sysfs-bus-event_source-devices-events b/Documentation/ABI/testing/sysfs-bus-event_source-devices-events
index 20979f8b3edb..505f080d20a1 100644
--- a/Documentation/ABI/testing/sysfs-bus-event_source-devices-events
+++ b/Documentation/ABI/testing/sysfs-bus-event_source-devices-events
@@ -52,12 +52,18 @@ Description:	Per-pmu performance monitoring events specific to the running syste
                        event=0x2abc
                        event=0x423,inv,cmask=0x3
                        domain=0x1,offset=0x8,starting_index=0xffff
+                        domain=0x1,offset=0x8,core=?
                Each of the assignments indicates a value to be assigned to a
                particular set of bits (as defined by the format file
                corresponding to the <term>) in the perf_event structure passed
                to the perf_open syscall.
+                In the case of the last example, a value replacing "?" would
+                need to be provided by the user selecting the particular event.
+                This is referred to as "event parameterization". Event
+                parameters have the format 'param=?'.
 What: /sys/bus/event_source/devices/<pmu>/events/<event>.unit
 Date: 2014/02/24
 Contact:        Linux kernel mailing list <linux-kernel@vger.kernel.org>
diff --git a/Documentation/ABI/testing/sysfs-class-mei b/Documentation/ABI/testing/sysfs-class-mei
index 0ec8b8178c41..80d9888a8ece 100644
--- a/Documentation/ABI/testing/sysfs-class-mei
+++ b/Documentation/ABI/testing/sysfs-class-mei
@@ -14,3 +14,18 @@ Description:
                The /sys/class/mei/meiN directory is created for
                each probed mei device
+What:           /sys/class/mei/meiN/fw_status
+Date:           Nov 2014
+KernelVersion:  3.19
+Contact:        Tomas Winkler <tomas.winkler@intel.com>
+Description:    Display fw status registers content
+                The ME FW writes its status information into fw status
+                registers for BIOS and OS to monitor fw health.
+                The register contains running state, power management
+                state, error codes, and others. The way the registers
+                are decoded depends on PCH or SoC generation.
+                Also number of registers varies between 1 and 6
+                depending on generation.
diff --git a/Documentation/ABI/testing/sysfs-platform-dell-laptop b/Documentation/ABI/testing/sysfs-platform-dell-laptop
deleted file mode 100644
index 7969443ef0ef..000000000000
--- a/Documentation/ABI/testing/sysfs-platform-dell-laptop
+++ /dev/null
@@ -1,60 +0,0 @@
-What:           /sys/class/leds/dell::kbd_backlight/als_setting
-Date:           December 2014
-KernelVersion:  3.19
-Contact:        Gabriele Mazzotta <gabriele.mzt@gmail.com>,
-                Pali Rohár <pali.rohar@gmail.com>
-Description:
-                This file allows to control the automatic keyboard
-                illumination mode on some systems that have an ambient
-                light sensor. Write 1 to this file to enable the auto
-                mode, 0 to disable it.
-What:           /sys/class/leds/dell::kbd_backlight/start_triggers
-Date:           December 2014
-KernelVersion:  3.19
-Contact:        Gabriele Mazzotta <gabriele.mzt@gmail.com>,
-                Pali Rohár <pali.rohar@gmail.com>
-Description:
-                This file allows to control the input triggers that
-                turn on the keyboard backlight illumination that is
-                disabled because of inactivity.
-                Read the file to see the triggers available. The ones
-                enabled are preceded by '+', those disabled by '-'.
-                To enable a trigger, write its name preceded by '+' to
-                this file. To disable a trigger, write its name preceded
-                by '-' instead.
-                For example, to enable the keyboard as trigger run:
-                    echo +keyboard > /sys/class/leds/dell::kbd_backlight/start_triggers
-                To disable it:
-                    echo -keyboard > /sys/class/leds/dell::kbd_backlight/start_triggers
-                Note that not all the available triggers can be configured.
-What:           /sys/class/leds/dell::kbd_backlight/stop_timeout
-Date:           December 2014
-KernelVersion:  3.19
-Contact:        Gabriele Mazzotta <gabriele.mzt@gmail.com>,
-                Pali Rohár <pali.rohar@gmail.com>
-Description:
-                This file allows to specify the interval after which the
-                keyboard illumination is disabled because of inactivity.
-                The timeouts are expressed in seconds, minutes, hours and
-                days, for which the symbols are 's', 'm', 'h' and 'd'
-                respectively.
-                To configure the timeout, write to this file a value along
-                with any the above units. If no unit is specified, the value
-                is assumed to be expressed in seconds.
-                For example, to set the timeout to 10 minutes run:
-                    echo 10m > /sys/class/leds/dell::kbd_backlight/stop_timeout
-                Note that when this file is read, the returned value might be
-                expressed in a different unit than the one used when the timeout
-                was set.
-                Also note that only some timeouts are supported and that
-                some systems might fall back to a specific timeout in case
-                an invalid timeout is written to this file.
diff --git a/Documentation/RCU/stallwarn.txt b/Documentation/RCU/stallwarn.txt
index ed186a902d31..b57c0c1cdac6 100644
--- a/Documentation/RCU/stallwarn.txt
+++ b/Documentation/RCU/stallwarn.txt
@@ -15,7 +15,7 @@ CONFIG_RCU_CPU_STALL_TIMEOUT
        21 seconds.
        This configuration parameter may be changed at runtime via the
-        /sys/module/rcutree/parameters/rcu_cpu_stall_timeout, however
+        /sys/module/rcupdate/parameters/rcu_cpu_stall_timeout, however
        this parameter is checked only at the beginning of a cycle.
        So if you are 10 seconds into a 40-second stall, setting this
        sysfs parameter to (say) five will shorten the timeout for the
@@ -152,6 +152,15 @@ no non-lazy callbacks ("." is printed otherwise, as shown above) and
 "D" indicates that dyntick-idle processing is enabled ("." is printed
 otherwise, for example, if disabled via the "nohz=" kernel boot parameter).
+If the relevant grace-period kthread has been unable to run prior to
+the stall warning, the following additional line is printed:
+        rcu_preempt kthread starved for 2023 jiffies!
+Starving the grace-period kthreads of CPU time can of course result in
+RCU CPU stall warnings even when all CPUs and tasks have passed through
+the required quiescent states.
 Multiple Warnings From One Stall
@@ -187,6 +196,11 @@ o	For !CONFIG_PREEMPT kernels, a CPU looping anywhere in the
        behavior, you might need to replace some of the cond_resched()
        calls with calls to cond_resched_rcu_qs().
+o       Anything that prevents RCU's grace-period kthreads from running.
+        This can result in the "All QSes seen" console-log message.
+        This message will include information on when the kthread last
+        ran and how often it should be expected to run.
 o       A CPU-bound real-time task in a CONFIG_PREEMPT kernel, which might
        happen to preempt a low-priority task in the middle of an RCU
        read-side critical section.   This is especially damaging if
diff --git a/Documentation/RCU/trace.txt b/Documentation/RCU/trace.txt
index b63b9bb3bc0c..08651da15448 100644
--- a/Documentation/RCU/trace.txt
+++ b/Documentation/RCU/trace.txt
@@ -56,14 +56,14 @@ rcuboost:
 The output of "cat rcu/rcu_preempt/rcudata" looks as follows:
-  0!c=30455 g=30456 pq=1 qp=1 dt=126535/140000000000000/0 df=2002 of=4 ql=0/0 qs=N... b=10 ci=74572 nci=0 co=1131 ca=716
+  0!c=30455 g=30456 pq=1/0 qp=1 dt=126535/140000000000000/0 df=2002 of=4 ql=0/0 qs=N... b=10 ci=74572 nci=0 co=1131 ca=716
-  1!c=30719 g=30720 pq=1 qp=0 dt=132007/140000000000000/0 df=1874 of=10 ql=0/0 qs=N... b=10 ci=123209 nci=0 co=685 ca=982
+  1!c=30719 g=30720 pq=1/0 qp=0 dt=132007/140000000000000/0 df=1874 of=10 ql=0/0 qs=N... b=10 ci=123209 nci=0 co=685 ca=982
-  2!c=30150 g=30151 pq=1 qp=1 dt=138537/140000000000000/0 df=1707 of=8 ql=0/0 qs=N... b=10 ci=80132 nci=0 co=1328 ca=1458
+  2!c=30150 g=30151 pq=1/1 qp=1 dt=138537/140000000000000/0 df=1707 of=8 ql=0/0 qs=N... b=10 ci=80132 nci=0 co=1328 ca=1458
-  3 c=31249 g=31250 pq=1 qp=0 dt=107255/140000000000000/0 df=1749 of=6 ql=0/450 qs=NRW. b=10 ci=151700 nci=0 co=509 ca=622
+  3 c=31249 g=31250 pq=1/1 qp=0 dt=107255/140000000000000/0 df=1749 of=6 ql=0/450 qs=NRW. b=10 ci=151700 nci=0 co=509 ca=622
-  4!c=29502 g=29503 pq=1 qp=1 dt=83647/140000000000000/0 df=965 of=5 ql=0/0 qs=N... b=10 ci=65643 nci=0 co=1373 ca=1521
+  4!c=29502 g=29503 pq=1/0 qp=1 dt=83647/140000000000000/0 df=965 of=5 ql=0/0 qs=N... b=10 ci=65643 nci=0 co=1373 ca=1521
-  5 c=31201 g=31202 pq=1 qp=1 dt=70422/0/0 df=535 of=7 ql=0/0 qs=.... b=10 ci=58500 nci=0 co=764 ca=698
+  5 c=31201 g=31202 pq=1/0 qp=1 dt=70422/0/0 df=535 of=7 ql=0/0 qs=.... b=10 ci=58500 nci=0 co=764 ca=698
-  6!c=30253 g=30254 pq=1 qp=1 dt=95363/140000000000000/0 df=780 of=5 ql=0/0 qs=N... b=10 ci=100607 nci=0 co=1414 ca=1353
+  6!c=30253 g=30254 pq=1/0 qp=1 dt=95363/140000000000000/0 df=780 of=5 ql=0/0 qs=N... b=10 ci=100607 nci=0 co=1414 ca=1353
-  7 c=31178 g=31178 pq=1 qp=0 dt=91536/0/0 df=547 of=4 ql=0/0 qs=.... b=10 ci=109819 nci=0 co=1115 ca=969
+  7 c=31178 g=31178 pq=1/0 qp=0 dt=91536/0/0 df=547 of=4 ql=0/0 qs=.... b=10 ci=109819 nci=0 co=1115 ca=969
 This file has one line per CPU, or eight for this 8-CPU system.
 The fields are as follows:
@@ -188,14 +188,14 @@ o	"ca" is the number of RCU callbacks that have been adopted by this
 Kernels compiled with CONFIG_RCU_BOOST=y display the following from
 /debug/rcu/rcu_preempt/rcudata:
-  0!c=12865 g=12866 pq=1 qp=1 dt=83113/140000000000000/0 df=288 of=11 ql=0/0 qs=N... kt=0/O ktl=944 b=10 ci=60709 nci=0 co=748 ca=871
+  0!c=12865 g=12866 pq=1/0 qp=1 dt=83113/140000000000000/0 df=288 of=11 ql=0/0 qs=N... kt=0/O ktl=944 b=10 ci=60709 nci=0 co=748 ca=871
-  1 c=14407 g=14408 pq=1 qp=0 dt=100679/140000000000000/0 df=378 of=7 ql=0/119 qs=NRW. kt=0/W ktl=9b6 b=10 ci=109740 nci=0 co=589 ca=485
+  1 c=14407 g=14408 pq=1/0 qp=0 dt=100679/140000000000000/0 df=378 of=7 ql=0/119 qs=NRW. kt=0/W ktl=9b6 b=10 ci=109740 nci=0 co=589 ca=485
-  2 c=14407 g=14408 pq=1 qp=0 dt=105486/0/0 df=90 of=9 ql=0/89 qs=NRW. kt=0/W ktl=c0c b=10 ci=83113 nci=0 co=533 ca=490
+  2 c=14407 g=14408 pq=1/0 qp=0 dt=105486/0/0 df=90 of=9 ql=0/89 qs=NRW. kt=0/W ktl=c0c b=10 ci=83113 nci=0 co=533 ca=490
-  3 c=14407 g=14408 pq=1 qp=0 dt=107138/0/0 df=142 of=8 ql=0/188 qs=NRW. kt=0/W ktl=b96 b=10 ci=121114 nci=0 co=426 ca=290
+  3 c=14407 g=14408 pq=1/0 qp=0 dt=107138/0/0 df=142 of=8 ql=0/188 qs=NRW. kt=0/W ktl=b96 b=10 ci=121114 nci=0 co=426 ca=290
-  4 c=14405 g=14406 pq=1 qp=1 dt=50238/0/0 df=706 of=7 ql=0/0 qs=.... kt=0/W ktl=812 b=10 ci=34929 nci=0 co=643 ca=114
+  4 c=14405 g=14406 pq=1/0 qp=1 dt=50238/0/0 df=706 of=7 ql=0/0 qs=.... kt=0/W ktl=812 b=10 ci=34929 nci=0 co=643 ca=114
-  5!c=14168 g=14169 pq=1 qp=0 dt=45465/140000000000000/0 df=161 of=11 ql=0/0 qs=N... kt=0/O ktl=b4d b=10 ci=47712 nci=0 co=677 ca=722
+  5!c=14168 g=14169 pq=1/0 qp=0 dt=45465/140000000000000/0 df=161 of=11 ql=0/0 qs=N... kt=0/O ktl=b4d b=10 ci=47712 nci=0 co=677 ca=722
-  6 c=14404 g=14405 pq=1 qp=0 dt=59454/0/0 df=94 of=6 ql=0/0 qs=.... kt=0/W ktl=e57 b=10 ci=55597 nci=0 co=701 ca=811
+  6 c=14404 g=14405 pq=1/0 qp=0 dt=59454/0/0 df=94 of=6 ql=0/0 qs=.... kt=0/W ktl=e57 b=10 ci=55597 nci=0 co=701 ca=811
-  7 c=14407 g=14408 pq=1 qp=1 dt=68850/0/0 df=31 of=8 ql=0/0 qs=.... kt=0/W ktl=14bd b=10 ci=77475 nci=0 co=508 ca=1042
+  7 c=14407 g=14408 pq=1/0 qp=1 dt=68850/0/0 df=31 of=8 ql=0/0 qs=.... kt=0/W ktl=14bd b=10 ci=77475 nci=0 co=508 ca=1042
 This is similar to the output discussed above, but contains the following
 additional fields:
diff --git a/Documentation/devicetree/bindings/arm/arm-boards b/Documentation/devicetree/bindings/arm/arm-boards
index 556c8665fdbf..b78564b2b201 100644
--- a/Documentation/devicetree/bindings/arm/arm-boards
+++ b/Documentation/devicetree/bindings/arm/arm-boards
@@ -23,7 +23,7 @@ Required nodes:
    range of 0x200 bytes.
 - syscon: the root node of the Integrator platforms must have a
-  system controller node pointong to the control registers,
+  system controller node pointing to the control registers,
  with the compatible string
  "arm,integrator-ap-syscon"
  "arm,integrator-cp-syscon"
diff --git a/Documentation/devicetree/bindings/arm/fw-cfg.txt b/Documentation/devicetree/bindings/arm/fw-cfg.txt
new file mode 100644
index 000000000000..953fb640d9c4
--- /dev/null
+++ b/Documentation/devicetree/bindings/arm/fw-cfg.txt
@@ -0,0 +1,72 @@
+* QEMU Firmware Configuration bindings for ARM
+QEMU's arm-softmmu and aarch64-softmmu emulation / virtualization targets
+provide the following Firmware Configuration interface on the "virt" machine
+type:
+- A write-only, 16-bit wide selector (or control) register,
+- a read-write, 64-bit wide data register.
+QEMU exposes the control and data register to ARM guests as memory mapped
+registers; their location is communicated to the guest's UEFI firmware in the
+DTB that QEMU places at the bottom of the guest's DRAM.
+The guest writes a selector value (a key) to the selector register, and then
+can read the corresponding data (produced by QEMU) via the data register. If
+the selected entry is writable, the guest can rewrite it through the data
+register.
+The selector register takes keys in big endian byte order.
+The data register allows accesses with 8, 16, 32 and 64-bit width (only at
+offset 0 of the register). Accesses larger than a byte are interpreted as
+arrays, bundled together only for better performance. The bytes constituting
+such a word, in increasing address order, correspond to the bytes that would
+have been transferred by byte-wide accesses in chronological order.
+The interface allows guest firmware to download various parameters and blobs
+that affect how the firmware works and what tables it installs for the guest
+OS. For example, boot order of devices, ACPI tables, SMBIOS tables, kernel and
+initrd images for direct kernel booting, virtual machine UUID, SMP information,
+virtual NUMA topology, and so on.
+The authoritative registry of the valid selector values and their meanings is
+the QEMU source code; the structure of the data blobs corresponding to the
+individual key values is also defined in the QEMU source code.
+The presence of the registers can be verified by selecting the "signature" blob
+with key 0x0000, and reading four bytes from the data register. The returned
+signature is "QEMU".
+The outermost protocol (involving the write / read sequences of the control and
+data registers) is expected to be versioned, and/or described by feature bits.
+The interface revision / feature bitmap can be retrieved with key 0x0001. The
+blob to be read from the data register has size 4, and it is to be interpreted
+as a uint32_t value in little endian byte order. The current value
+(corresponding to the above outer protocol) is zero.
+The guest kernel is not expected to use these registers (although it is
+certainly allowed to); the device tree bindings are documented here because
+this is where device tree bindings reside in general.
+Required properties:
+- compatible: "qemu,fw-cfg-mmio".
+- reg: the MMIO region used by the device.
+  * Bytes 0x0 to 0x7 cover the data register.
+  * Bytes 0x8 to 0x9 cover the selector register.
+  * Further registers may be appended to the region in case of future interface
+    revisions / feature bits.
+Example:
+/ {
+        #size-cells = <0x2>;
+        #address-cells = <0x2>;
+        fw-cfg@9020000 {
+                compatible = "qemu,fw-cfg-mmio";
+                reg = <0x0 0x9020000 0x0 0xa>;
+        };
+};
diff --git a/Documentation/devicetree/bindings/graph.txt b/Documentation/devicetree/bindings/graph.txt
index 1a69c078adf2..fcb1c6a4787b 100644
--- a/Documentation/devicetree/bindings/graph.txt
+++ b/Documentation/devicetree/bindings/graph.txt
@@ -19,7 +19,7 @@ type of the connections, they just map their existence. Specific properties
 may be described by specialized bindings depending on the type of connection.
 To see how this binding applies to video pipelines, for example, see
-Documentation/device-tree/bindings/media/video-interfaces.txt.
+Documentation/devicetree/bindings/media/video-interfaces.txt.
 Here the ports describe data interfaces, and the links between them are
 the connecting data buses. A single port with multiple connections can
 correspond to multiple devices being connected to the same physical bus.
diff --git a/Documentation/devicetree/bindings/i2c/i2c-st.txt b/Documentation/devicetree/bindings/i2c/i2c-st.txt
index 437e0db3823c..4c26fda3844a 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-st.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-st.txt
@@ -31,7 +31,7 @@ i2c0: i2c@fed40000 {
        compatible      = "st,comms-ssc4-i2c";
        reg             = <0xfed40000 0x110>;
        interrupts      =  <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>;
-        clocks          = <&CLK_S_ICN_REG_0>;
+        clocks          = <&clk_s_a0_ls CLK_ICN_REG>;
        clock-names     = "ssc";
        clock-frequency = <400000>;
        pinctrl-names   = "default";
diff --git a/Documentation/devicetree/bindings/i2c/trivial-devices.txt b/Documentation/devicetree/bindings/i2c/trivial-devices.txt
index 9f4e3824e71e..9f41d05be3be 100644
--- a/Documentation/devicetree/bindings/i2c/trivial-devices.txt
+++ b/Documentation/devicetree/bindings/i2c/trivial-devices.txt
@@ -47,6 +47,7 @@ dallas,ds3232		Extremely Accurate I²C RTC with Integrated Crystal and SRAM
 dallas,ds4510           CPU Supervisor with Nonvolatile Memory and Programmable I/O
 dallas,ds75             Digital Thermometer and Thermostat
 dlg,da9053              DA9053: flexible system level PMIC with multicore support
+dlg,da9063              DA9063: system PMIC for quad-core application processors
 epson,rx8025            High-Stability. I2C-Bus INTERFACE REAL TIME CLOCK MODULE
 epson,rx8581            I2C-BUS INTERFACE REAL TIME CLOCK MODULE
 fsl,mag3110             MAG3110: Xtrinsic High Accuracy, 3D Magnetometer
diff --git a/Documentation/devicetree/bindings/input/gpio-keys.txt b/Documentation/devicetree/bindings/input/gpio-keys.txt
index a4a38fcf2ed6..44b705767aca 100644
--- a/Documentation/devicetree/bindings/input/gpio-keys.txt
+++ b/Documentation/devicetree/bindings/input/gpio-keys.txt
@@ -10,12 +10,13 @@ Optional properties:
 Each button (key) is represented as a sub-node of "gpio-keys":
 Subnode properties:
+        - gpios: OF device-tree gpio specification.
+        - interrupts: the interrupt line for that input.
        - label: Descriptive name of the key.
        - linux,code: Keycode to emit.
-Required mutual exclusive subnode-properties:
+Note that either "interrupts" or "gpios" properties can be omitted, but not
-        - gpios: OF device-tree gpio specification.
+both at the same time. Specifying both properties is allowed.
-        - interrupts: the interrupt line for that input
 Optional subnode-properties:
        - linux,input-type: Specify event type this button/key generates.
@@ -23,6 +24,9 @@ Optional subnode-properties:
        - debounce-interval: Debouncing interval time in milliseconds.
          If not specified defaults to 5.
        - gpio-key,wakeup: Boolean, button can wake-up the system.
+        - linux,can-disable: Boolean, indicates that button is connected
+          to dedicated (not shared) interrupt which can be disabled to
+          suppress events from the button.
 Example nodes:
diff --git a/Documentation/devicetree/bindings/input/stmpe-keypad.txt b/Documentation/devicetree/bindings/input/stmpe-keypad.txt
index 1b97222e8a0b..12bb771d66d4 100644
--- a/Documentation/devicetree/bindings/input/stmpe-keypad.txt
+++ b/Documentation/devicetree/bindings/input/stmpe-keypad.txt
@@ -8,6 +8,8 @@ Optional properties:
 - debounce-interval        : Debouncing interval time in milliseconds
 - st,scan-count            : Scanning cycles elapsed before key data is updated
 - st,no-autorepeat         : If specified device will not autorepeat
+ - keypad,num-rows          : See ./matrix-keymap.txt
+ - keypad,num-columns       : See ./matrix-keymap.txt
 Example:
diff --git a/Documentation/devicetree/bindings/mfd/max77686.txt b/Documentation/devicetree/bindings/mfd/max77686.txt
index 75fdfaf41831..e39f0bc1f55e 100644
--- a/Documentation/devicetree/bindings/mfd/max77686.txt
+++ b/Documentation/devicetree/bindings/mfd/max77686.txt
@@ -39,6 +39,12 @@ to get matched with their hardware counterparts as follow:
        -BUCKn  :       1-4.
  Use standard regulator bindings for it ('regulator-off-in-suspend').
+  LDO20, LDO21, LDO22, BUCK8 and BUCK9 can be configured to GPIO enable
+  control. To turn this feature on this property must be added to the regulator
+  sub-node:
+        - maxim,ena-gpios :     one GPIO specifier enable control (the gpio
+                                flags are actually ignored and always
+                                ACTIVE_HIGH is used)
 Example:
@@ -65,4 +71,12 @@ Example:
                                regulator-always-on;
                                regulator-boot-on;
                        };
+                        buck9_reg {
+                                regulator-compatible = "BUCK9";
+                                regulator-name = "CAM_ISP_CORE_1.2V";
+                                regulator-min-microvolt = <1000000>;
+                                regulator-max-microvolt = <1200000>;
+                                maxim,ena-gpios = <&gpm0 3 GPIO_ACTIVE_HIGH>;
+                        };
        }
diff --git a/Documentation/devicetree/bindings/net/davinci_emac.txt b/Documentation/devicetree/bindings/net/davinci_emac.txt
index 032808843f90..24c5cdaba8d2 100644
--- a/Documentation/devicetree/bindings/net/davinci_emac.txt
+++ b/Documentation/devicetree/bindings/net/davinci_emac.txt
@@ -4,7 +4,8 @@ This file provides information, what the device node
 for the davinci_emac interface contains.
 Required properties:
- compatible: "ti,davinci-dm6467-emac" or "ti,am3517-emac"
+- compatible: "ti,davinci-dm6467-emac", "ti,am3517-emac" or
+  "ti,dm816-emac"
 - reg: Offset and length of the register set for the device
 - ti,davinci-ctrl-reg-offset: offset to control register
 - ti,davinci-ctrl-mod-reg-offset: offset to control module register
diff --git a/Documentation/devicetree/bindings/regulator/da9211.txt b/Documentation/devicetree/bindings/regulator/da9211.txt
index 240019a82f9a..eb618907c7de 100644
--- a/Documentation/devicetree/bindings/regulator/da9211.txt
+++ b/Documentation/devicetree/bindings/regulator/da9211.txt
@@ -11,6 +11,7 @@ Required properties:
  BUCKA and BUCKB.
 Optional properties:
+- enable-gpios: platform gpio for control of BUCKA/BUCKB.
 - Any optional property defined in regulator.txt
 Example 1) DA9211
@@ -27,6 +28,7 @@ Example 1) DA9211
                                regulator-max-microvolt = <1570000>;
                                regulator-min-microamp  = <2000000>;
                                regulator-max-microamp  = <5000000>;
+                                enable-gpios = <&gpio 27 0>;
                        };
                        BUCKB {
                                regulator-name = "VBUCKB";
@@ -34,11 +36,12 @@ Example 1) DA9211
                                regulator-max-microvolt = <1570000>;
                                regulator-min-microamp  = <2000000>;
                                regulator-max-microamp  = <5000000>;
+                                enable-gpios = <&gpio 17 0>;
                        };
                };
        };
-Example 2) DA92113
+Example 2) DA9213
        pmic: da9213@68 {
                compatible = "dlg,da9213";
                reg = <0x68>;
@@ -51,6 +54,7 @@ Example 2) DA92113
                                regulator-max-microvolt = <1570000>;
                                regulator-min-microamp  = <3000000>;
                                regulator-max-microamp  = <6000000>;
+                                enable-gpios = <&gpio 27 0>;
                        };
                        BUCKB {
                                regulator-name = "VBUCKB";
@@ -58,6 +62,7 @@ Example 2) DA92113
                                regulator-max-microvolt = <1570000>;
                                regulator-min-microamp  = <3000000>;
                                regulator-max-microamp  = <6000000>;
+                                enable-gpios = <&gpio 17 0>;
                        };
                };
        };
diff --git a/Documentation/devicetree/bindings/regulator/isl9305.txt b/Documentation/devicetree/bindings/regulator/isl9305.txt
index a626fc1bbf0d..d6e7c9ec9413 100644
--- a/Documentation/devicetree/bindings/regulator/isl9305.txt
+++ b/Documentation/devicetree/bindings/regulator/isl9305.txt
@@ -2,7 +2,7 @@ Intersil ISL9305/ISL9305H voltage regulator
 Required properties:
- compatible: "isl,isl9305" or "isl,isl9305h"
+- compatible: "isil,isl9305" or "isil,isl9305h"
 - reg: I2C slave address, usually 0x68.
 - regulators: A node that houses a sub-node for each regulator within the
  device. Each sub-node is identified using the node's name, with valid
@@ -19,7 +19,7 @@ Optional properties:
 Example
        pmic: isl9305@68 {
-                compatible = "isl,isl9305";
+                compatible = "isil,isl9305";
                reg = <0x68>;
                VINDCD1-supply = <&system_power>;
diff --git a/Documentation/devicetree/bindings/regulator/mt6397-regulator.txt b/Documentation/devicetree/bindings/regulator/mt6397-regulator.txt
new file mode 100644
index 000000000000..a42b1d6e9863
--- /dev/null
+++ b/Documentation/devicetree/bindings/regulator/mt6397-regulator.txt
@@ -0,0 +1,217 @@
+Mediatek MT6397 Regulator Driver
+Required properties:
+- compatible: "mediatek,mt6397-regulator"
+- mt6397regulator: List of regulators provided by this controller. It is named
+  according to its regulator type, buck_<name> and ldo_<name>.
+  The definition for each of these nodes is defined using the standard binding
+  for regulators at Documentation/devicetree/bindings/regulator/regulator.txt.
+The valid names for regulators are::
+BUCK:
+  buck_vpca15, buck_vpca7, buck_vsramca15, buck_vsramca7, buck_vcore, buck_vgpu,
+  buck_vdrm, buck_vio18
+LDO:
+  ldo_vtcxo, ldo_va28, ldo_vcama, ldo_vio28, ldo_vusb, ldo_vmc, ldo_vmch,
+  ldo_vemc3v3, ldo_vgp1, ldo_vgp2, ldo_vgp3, ldo_vgp4, ldo_vgp5, ldo_vgp6,
+  ldo_vibr
+Example:
+        pmic {
+                compatible = "mediatek,mt6397";
+                mt6397regulator: mt6397regulator {
+                        compatible = "mediatek,mt6397-regulator";
+                        mt6397_vpca15_reg: buck_vpca15 {
+                                regulator-compatible = "buck_vpca15";
+                                regulator-name = "vpca15";
+                                regulator-min-microvolt = < 850000>;
+                                regulator-max-microvolt = <1350000>;
+                                regulator-ramp-delay = <12500>;
+                                regulator-enable-ramp-delay = <200>;
+                        };
+                        mt6397_vpca7_reg: buck_vpca7 {
+                                regulator-compatible = "buck_vpca7";
+                                regulator-name = "vpca7";
+                                regulator-min-microvolt = < 850000>;
+                                regulator-max-microvolt = <1350000>;
+                                regulator-ramp-delay = <12500>;
+                                regulator-enable-ramp-delay = <115>;
+                        };
+                        mt6397_vsramca15_reg: buck_vsramca15 {
+                                regulator-compatible = "buck_vsramca15";
+                                regulator-name = "vsramca15";
+                                regulator-min-microvolt = < 850000>;
+                                regulator-max-microvolt = <1350000>;
+                                regulator-ramp-delay = <12500>;
+                                regulator-enable-ramp-delay = <115>;
+                        };
+                        mt6397_vsramca7_reg: buck_vsramca7 {
+                                regulator-compatible = "buck_vsramca7";
+                                regulator-name = "vsramca7";
+                                regulator-min-microvolt = < 850000>;
+                                regulator-max-microvolt = <1350000>;
+                                regulator-ramp-delay = <12500>;
+                                regulator-enable-ramp-delay = <115>;
+                        };
+                        mt6397_vcore_reg: buck_vcore {
+                                regulator-compatible = "buck_vcore";
+                                regulator-name = "vcore";
+                                regulator-min-microvolt = < 850000>;
+                                regulator-max-microvolt = <1350000>;
+                                regulator-ramp-delay = <12500>;
+                                regulator-enable-ramp-delay = <115>;
+                        };
+                        mt6397_vgpu_reg: buck_vgpu {
+                                regulator-compatible = "buck_vgpu";
+                                regulator-name = "vgpu";
+                                regulator-min-microvolt = < 700000>;
+                                regulator-max-microvolt = <1350000>;
+                                regulator-ramp-delay = <12500>;
+                                regulator-enable-ramp-delay = <115>;
+                        };
+                        mt6397_vdrm_reg: buck_vdrm {
+                                regulator-compatible = "buck_vdrm";
+                                regulator-name = "vdrm";
+                                regulator-min-microvolt = < 800000>;
+                                regulator-max-microvolt = <1400000>;
+                                regulator-ramp-delay = <12500>;
+                                regulator-enable-ramp-delay = <500>;
+                        };
+                        mt6397_vio18_reg: buck_vio18 {
+                                regulator-compatible = "buck_vio18";
+                                regulator-name = "vio18";
+                                regulator-min-microvolt = <1500000>;
+                                regulator-max-microvolt = <2120000>;
+                                regulator-ramp-delay = <12500>;
+                                regulator-enable-ramp-delay = <500>;
+                        };
+                        mt6397_vtcxo_reg: ldo_vtcxo {
+                                regulator-compatible = "ldo_vtcxo";
+                                regulator-name = "vtcxo";
+                                regulator-min-microvolt = <2800000>;
+                                regulator-max-microvolt = <2800000>;
+                                regulator-enable-ramp-delay = <90>;
+                        };
+                        mt6397_va28_reg: ldo_va28 {
+                                regulator-compatible = "ldo_va28";
+                                regulator-name = "va28";
+                                /* fixed output 2.8 V */
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                        mt6397_vcama_reg: ldo_vcama {
+                                regulator-compatible = "ldo_vcama";
+                                regulator-name = "vcama";
+                                regulator-min-microvolt = <1500000>;
+                                regulator-max-microvolt = <2800000>;
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                        mt6397_vio28_reg: ldo_vio28 {
+                                regulator-compatible = "ldo_vio28";
+                                regulator-name = "vio28";
+                                /* fixed output 2.8 V */
+                                regulator-enable-ramp-delay = <240>;
+                        };
+                        mt6397_usb_reg: ldo_vusb {
+                                regulator-compatible = "ldo_vusb";
+                                regulator-name = "vusb";
+                                /* fixed output 3.3 V */
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                        mt6397_vmc_reg: ldo_vmc {
+                                regulator-compatible = "ldo_vmc";
+                                regulator-name = "vmc";
+                                regulator-min-microvolt = <1800000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                        mt6397_vmch_reg: ldo_vmch {
+                                regulator-compatible = "ldo_vmch";
+                                regulator-name = "vmch";
+                                regulator-min-microvolt = <3000000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                        mt6397_vemc_3v3_reg: ldo_vemc3v3 {
+                                regulator-compatible = "ldo_vemc3v3";
+                                regulator-name = "vemc_3v3";
+                                regulator-min-microvolt = <3000000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                        mt6397_vgp1_reg: ldo_vgp1 {
+                                regulator-compatible = "ldo_vgp1";
+                                regulator-name = "vcamd";
+                                regulator-min-microvolt = <1220000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-enable-ramp-delay = <240>;
+                        };
+                        mt6397_vgp2_reg: ldo_vgp2 {
+                                egulator-compatible = "ldo_vgp2";
+                                regulator-name = "vcamio";
+                                regulator-min-microvolt = <1000000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                        mt6397_vgp3_reg: ldo_vgp3 {
+                                regulator-compatible = "ldo_vgp3";
+                                regulator-name = "vcamaf";
+                                regulator-min-microvolt = <1200000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                        mt6397_vgp4_reg: ldo_vgp4 {
+                                regulator-compatible = "ldo_vgp4";
+                                regulator-name = "vgp4";
+                                regulator-min-microvolt = <1200000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                        mt6397_vgp5_reg: ldo_vgp5 {
+                                regulator-compatible = "ldo_vgp5";
+                                regulator-name = "vgp5";
+                                regulator-min-microvolt = <1200000>;
+                                regulator-max-microvolt = <3000000>;
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                        mt6397_vgp6_reg: ldo_vgp6 {
+                                regulator-compatible = "ldo_vgp6";
+                                regulator-name = "vgp6";
+                                regulator-min-microvolt = <1200000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                        mt6397_vibr_reg: ldo_vibr {
+                                regulator-compatible = "ldo_vibr";
+                                regulator-name = "vibr";
+                                regulator-min-microvolt = <1200000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-enable-ramp-delay = <218>;
+                        };
+                };
+        };
diff --git a/Documentation/devicetree/bindings/regulator/pfuze100.txt b/Documentation/devicetree/bindings/regulator/pfuze100.txt
index 34ef5d16d0f1..9b40db88f637 100644
--- a/Documentation/devicetree/bindings/regulator/pfuze100.txt
+++ b/Documentation/devicetree/bindings/regulator/pfuze100.txt
@@ -1,7 +1,7 @@
 PFUZE100 family of regulators
 Required properties:
- compatible: "fsl,pfuze100" or "fsl,pfuze200"
+- compatible: "fsl,pfuze100", "fsl,pfuze200", "fsl,pfuze3000"
 - reg: I2C slave address
 Required child node:
@@ -14,6 +14,8 @@ Required child node:
  sw1ab,sw1c,sw2,sw3a,sw3b,sw4,swbst,vsnvs,vrefddr,vgen1~vgen6
  --PFUZE200
  sw1ab,sw2,sw3a,sw3b,swbst,vsnvs,vrefddr,vgen1~vgen6
+  --PFUZE3000
+  sw1a,sw1b,sw2,sw3,swbst,vsnvs,vrefddr,vldo1,vldo2,vccsd,v33,vldo3,vldo4
 Each regulator is defined using the standard binding for regulators.
@@ -205,3 +207,93 @@ Example 2: PFUZE200
                        };
                };
        };
+Example 3: PFUZE3000
+        pmic: pfuze3000@08 {
+                compatible = "fsl,pfuze3000";
+                reg = <0x08>;
+                regulators {
+                        sw1a_reg: sw1a {
+                                regulator-min-microvolt = <700000>;
+                                regulator-max-microvolt = <1475000>;
+                                regulator-boot-on;
+                                regulator-always-on;
+                                regulator-ramp-delay = <6250>;
+                        };
+                        /* use sw1c_reg to align with pfuze100/pfuze200 */
+                        sw1c_reg: sw1b {
+                                regulator-min-microvolt = <700000>;
+                                regulator-max-microvolt = <1475000>;
+                                regulator-boot-on;
+                                regulator-always-on;
+                                regulator-ramp-delay = <6250>;
+                        };
+                        sw2_reg: sw2 {
+                                regulator-min-microvolt = <2500000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-boot-on;
+                                regulator-always-on;
+                        };
+                        sw3a_reg: sw3 {
+                                regulator-min-microvolt = <900000>;
+                                regulator-max-microvolt = <1650000>;
+                                regulator-boot-on;
+                                regulator-always-on;
+                        };
+                        swbst_reg: swbst {
+                                regulator-min-microvolt = <5000000>;
+                                regulator-max-microvolt = <5150000>;
+                        };
+                        snvs_reg: vsnvs {
+                                regulator-min-microvolt = <1000000>;
+                                regulator-max-microvolt = <3000000>;
+                                regulator-boot-on;
+                                regulator-always-on;
+                        };
+                        vref_reg: vrefddr {
+                                regulator-boot-on;
+                                regulator-always-on;
+                        };
+                        vgen1_reg: vldo1 {
+                                regulator-min-microvolt = <1800000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-always-on;
+                        };
+                        vgen2_reg: vldo2 {
+                                regulator-min-microvolt = <800000>;
+                                regulator-max-microvolt = <1550000>;
+                        };
+                        vgen3_reg: vccsd {
+                                regulator-min-microvolt = <2850000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-always-on;
+                        };
+                        vgen4_reg: v33 {
+                                regulator-min-microvolt = <2850000>;
+                                regulator-max-microvolt = <3300000>;
+                        };
+                        vgen5_reg: vldo3 {
+                                regulator-min-microvolt = <1800000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-always-on;
+                        };
+                        vgen6_reg: vldo4 {
+                                regulator-min-microvolt = <1800000>;
+                                regulator-max-microvolt = <3300000>;
+                                regulator-always-on;
+                        };
+                };
+        };
diff --git a/Documentation/devicetree/bindings/spi/sh-msiof.txt b/Documentation/devicetree/bindings/spi/sh-msiof.txt
index d11c3721e7cd..4c388bb2f0a2 100644
--- a/Documentation/devicetree/bindings/spi/sh-msiof.txt
+++ b/Documentation/devicetree/bindings/spi/sh-msiof.txt
@@ -30,6 +30,22 @@ Optional properties:
                         specifiers, one for transmission, and one for
                         reception.
 - dma-names            : Must contain a list of two DMA names, "tx" and "rx".
+- renesas,dtdl         : delay sync signal (setup) in transmit mode.
+                         Must contain one of the following values:
+                         0   (no bit delay)
+                         50  (0.5-clock-cycle delay)
+                         100 (1-clock-cycle delay)
+                         150 (1.5-clock-cycle delay)
+                         200 (2-clock-cycle delay)
+- renesas,syncdl       : delay sync signal (hold) in transmit mode.
+                         Must contain one of the following values:
+                         0   (no bit delay)
+                         50  (0.5-clock-cycle delay)
+                         100 (1-clock-cycle delay)
+                         150 (1.5-clock-cycle delay)
+                         200 (2-clock-cycle delay)
+                         300 (3-clock-cycle delay)
 Optional properties, deprecated for soctype-specific bindings:
 - renesas,tx-fifo-size : Overrides the default tx fifo size given in words
diff --git a/Documentation/devicetree/bindings/spi/spi-sirf.txt b/Documentation/devicetree/bindings/spi/spi-sirf.txt
new file mode 100644
index 000000000000..4c7adb8f777c
--- /dev/null
+++ b/Documentation/devicetree/bindings/spi/spi-sirf.txt
@@ -0,0 +1,41 @@
+* CSR SiRFprimaII Serial Peripheral Interface
+Required properties:
+- compatible : Should be "sirf,prima2-spi"
+- reg : Offset and length of the register set for the device
+- interrupts : Should contain SPI interrupt
+- resets: phandle to the reset controller asserting this device in
+          reset
+  See ../reset/reset.txt for details.
+- dmas : Must contain an entry for each entry in clock-names.
+  See ../dma/dma.txt for details.
+- dma-names : Must include the following entries:
+  - rx
+  - tx
+- clocks : Must contain an entry for each entry in clock-names.
+  See ../clocks/clock-bindings.txt for details.
+- #address-cells: Number of cells required to define a chip select
+                  address on the SPI bus. Should be set to 1.
+- #size-cells:    Should be zero.
+Optional properties:
+- spi-max-frequency: Specifies maximum SPI clock frequency,
+                     Units - Hz. Definition as per
+                     Documentation/devicetree/bindings/spi/spi-bus.txt
+- cs-gpios:     should specify GPIOs used for chipselects.
+Example:
+spi0: spi@b00d0000 {
+        compatible = "sirf,prima2-spi";
+        reg = <0xb00d0000 0x10000>;
+        interrupts = <15>;
+        dmas = <&dmac1 9>,
+                <&dmac1 4>;
+        dma-names = "rx", "tx";
+        #address-cells = <1>;
+        #size-cells = <0>;
+        clocks = <&clks 19>;
+        resets = <&rstc 26>;
+};
diff --git a/Documentation/devicetree/bindings/spi/spi-st-ssc.txt b/Documentation/devicetree/bindings/spi/spi-st-ssc.txt
new file mode 100644
index 000000000000..fe54959ec957
--- /dev/null
+++ b/Documentation/devicetree/bindings/spi/spi-st-ssc.txt
@@ -0,0 +1,40 @@
+STMicroelectronics SSC (SPI) Controller
+---------------------------------------
+Required properties:
+- compatible    : "st,comms-ssc4-spi"
+- reg           : Offset and length of the device's register set
+- interrupts    : The interrupt specifier
+- clock-names   : Must contain "ssc"
+- clocks        : Must contain an entry for each name in clock-names
+                    See ../clk/*
+- pinctrl-names : Uses "default", can use "sleep" if provided
+                    See ../pinctrl/pinctrl-binding.txt
+Optional properties:
+- cs-gpios      : List of GPIO chip selects
+                    See ../spi/spi-bus.txt
+Child nodes represent devices on the SPI bus
+  See ../spi/spi-bus.txt
+Example:
+        spi@9840000 {
+                compatible      = "st,comms-ssc4-spi";
+                reg             = <0x9840000 0x110>;
+                interrupts      = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
+                clocks          = <&clk_s_c0_flexgen CLK_EXT2F_A9>;
+                clock-names     = "ssc";
+                pinctrl-0       = <&pinctrl_spi0_default>;
+                pinctrl-names   = "default";
+                cs-gpios        = <&pio17 5 0>;
+                #address-cells  = <1>;
+                #size-cells     = <0>;
+                st95hf@0{
+                        compatible              = "st,st95hf";
+                        reg                     = <0>;
+                        spi-max-frequency       = <1000000>;
+                        interrupts              = <2 IRQ_TYPE_EDGE_FALLING>;
+                };
+        };
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index b1df0ad1306c..d443279c95dc 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -9,7 +9,6 @@ ad	Avionic Design GmbH
 adapteva        Adapteva, Inc.
 adi     Analog Devices, Inc.
 aeroflexgaisler Aeroflex Gaisler AB
-ak      Asahi Kasei Corp.
 allwinner       Allwinner Technology Co., Ltd.
 altr    Altera Corp.
 amcc    Applied Micro Circuits Corporation (APM, formally AMCC)
@@ -20,6 +19,7 @@ amstaos	AMS-Taos Inc.
 apm     Applied Micro Circuits Corporation (APM)
 arm     ARM Ltd.
 armadeus        ARMadeus Systems SARL
+asahi-kasei     Asahi Kasei Corp.
 atmel   Atmel Corporation
 auo     AU Optronics Corporation
 avago   Avago Technologies
@@ -127,6 +127,7 @@ pixcir  PIXCIR MICROELECTRONICS Co., Ltd
 powervr PowerVR (deprecated, use img)
 qca     Qualcomm Atheros, Inc.
 qcom    Qualcomm Technologies, Inc
+qemu    QEMU, a generic and open source machine emulator and virtualizer
 qnap    QNAP Systems, Inc.
 radxa   Radxa
 raidsonic       RaidSonic Technology GmbH
@@ -168,6 +169,7 @@ usi	Universal Scientific Industrial Co., Ltd.
 v3      V3 Semiconductor
 variscite       Variscite Ltd.
 via     VIA Technologies, Inc.
+virtio  Virtual I/O Device Specification, developed by the OASIS consortium
 voipac  Voipac Technologies s.r.o.
 winbond Winbond Electronics corp.
 wlf     Wolfson Microelectronics
diff --git a/Documentation/futex-requeue-pi.txt b/Documentation/futex-requeue-pi.txt
index 31b16610c416..77b36f59d16b 100644
--- a/Documentation/futex-requeue-pi.txt
+++ b/Documentation/futex-requeue-pi.txt
@@ -98,7 +98,7 @@ rt_mutex_start_proxy_lock() and rt_mutex_finish_proxy_lock(), which
 allow the requeue code to acquire an uncontended rt_mutex on behalf
 of the waiter and to enqueue the waiter on a contended rt_mutex.
 Two new system calls provide the kernel<->user interface to
-requeue_pi: FUTEX_WAIT_REQUEUE_PI and FUTEX_REQUEUE_CMP_PI.
+requeue_pi: FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI.
 FUTEX_WAIT_REQUEUE_PI is called by the waiter (pthread_cond_wait()
 and pthread_cond_timedwait()) to block on the initial futex and wait
@@ -107,7 +107,7 @@ result of a high-speed collision between futex_wait() and
 futex_lock_pi(), with some extra logic to check for the additional
 wake-up scenarios.
-FUTEX_REQUEUE_CMP_PI is called by the waker
+FUTEX_CMP_REQUEUE_PI is called by the waker
 (pthread_cond_broadcast() and pthread_cond_signal()) to requeue and
 possibly wake the waiting tasks. Internally, this system call is
 still handled by futex_requeue (by passing requeue_pi=1).  Before
@@ -120,12 +120,12 @@ task as a waiter on the underlying rt_mutex.  It is possible that
 the lock can be acquired at this stage as well, if so, the next
 waiter is woken to finish the acquisition of the lock.
-FUTEX_REQUEUE_PI accepts nr_wake and nr_requeue as arguments, but
+FUTEX_CMP_REQUEUE_PI accepts nr_wake and nr_requeue as arguments, but
 their sum is all that really matters.  futex_requeue() will wake or
 requeue up to nr_wake + nr_requeue tasks.  It will wake only as many
 tasks as it can acquire the lock for, which in the majority of cases
 should be 0 as good programming practice dictates that the caller of
 either pthread_cond_broadcast() or pthread_cond_signal() acquire the
-mutex prior to making the call. FUTEX_REQUEUE_PI requires that
+mutex prior to making the call. FUTEX_CMP_REQUEUE_PI requires that
 nr_wake=1.  nr_requeue should be INT_MAX for broadcast and 0 for
 signal.
diff --git a/Documentation/hwmon/ina2xx b/Documentation/hwmon/ina2xx
index 4223c2d3b508..cfd31d94c872 100644
--- a/Documentation/hwmon/ina2xx
+++ b/Documentation/hwmon/ina2xx
@@ -26,6 +26,12 @@ Supported chips:
    Datasheet: Publicly available at the Texas Instruments website
               http://www.ti.com/
+  * Texas Instruments INA231
+    Prefix: 'ina231'
+    Addresses: I2C 0x40 - 0x4f
+    Datasheet: Publicly available at the Texas Instruments website
+               http://www.ti.com/
 Author: Lothar Felten <l-felten@ti.com>
 Description
@@ -41,9 +47,18 @@ interface. The INA220 monitors both shunt drop and supply voltage.
 The INA226 is a current shunt and power monitor with an I2C interface.
 The INA226 monitors both a shunt voltage drop and bus supply voltage.
-The INA230 is a high or low side current shunt and power monitor with an I2C
+INA230 and INA231 are high or low side current shunt and power monitors
-interface. The INA230 monitors both a shunt voltage drop and bus supply voltage.
+with an I2C interface. The chips monitor both a shunt voltage drop and
+bus supply voltage.
-The shunt value in micro-ohms can be set via platform data or device tree.
+The shunt value in micro-ohms can be set via platform data or device tree at
-Please refer to the Documentation/devicetree/bindings/i2c/ina2xx.txt for bindings
+compile-time or via the shunt_resistor attribute in sysfs at run-time. Please
+refer to the Documentation/devicetree/bindings/i2c/ina2xx.txt for bindings
 if the device tree is used.
+Additionally ina226 supports update_interval attribute as described in
+Documentation/hwmon/sysfs-interface. Internally the interval is the sum of
+bus and shunt voltage conversion times multiplied by the averaging rate. We
+don't touch the conversion times and only modify the number of averages. The
+lower limit of the update_interval is 2 ms, the upper limit is 2253 ms.
+The actual programmed interval may vary from the desired value.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 4df73da11adc..176d4fe4f076 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1277,6 +1277,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        i8042.notimeout [HW] Ignore timeout condition signalled by controller
        i8042.reset     [HW] Reset the controller during init and cleanup
        i8042.unlock    [HW] Unlock (ignore) the keylock
+        i8042.kbdreset  [HW] Reset device connected to KBD port
        i810=           [HW,DRM]
diff --git a/Documentation/locking/lockdep-design.txt b/Documentation/locking/lockdep-design.txt
index 5dbc99c04f6e..5001280e9d82 100644
--- a/Documentation/locking/lockdep-design.txt
+++ b/Documentation/locking/lockdep-design.txt
@@ -34,7 +34,7 @@ The validator tracks lock-class usage history into 4n + 1 separate state bits:
 - 'ever held with STATE enabled'
 - 'ever held as readlock with STATE enabled'
-Where STATE can be either one of (kernel/lockdep_states.h)
+Where STATE can be either one of (kernel/locking/lockdep_states.h)
 - hardirq
 - softirq
 - reclaim_fs
diff --git a/Documentation/memory-barriers.txt b/Documentation/memory-barriers.txt
index 70a09f8a0383..ca2387ef27ab 100644
--- a/Documentation/memory-barriers.txt
+++ b/Documentation/memory-barriers.txt
@@ -269,6 +269,50 @@ And there are a number of things that _must_ or _must_not_ be assumed:
        STORE *(A + 4) = Y; STORE *A = X;
        STORE {*A, *(A + 4) } = {X, Y};
+And there are anti-guarantees:
+ (*) These guarantees do not apply to bitfields, because compilers often
+     generate code to modify these using non-atomic read-modify-write
+     sequences.  Do not attempt to use bitfields to synchronize parallel
+     algorithms.
+ (*) Even in cases where bitfields are protected by locks, all fields
+     in a given bitfield must be protected by one lock.  If two fields
+     in a given bitfield are protected by different locks, the compiler's
+     non-atomic read-modify-write sequences can cause an update to one
+     field to corrupt the value of an adjacent field.
+ (*) These guarantees apply only to properly aligned and sized scalar
+     variables.  "Properly sized" currently means variables that are
+     the same size as "char", "short", "int" and "long".  "Properly
+     aligned" means the natural alignment, thus no constraints for
+     "char", two-byte alignment for "short", four-byte alignment for
+     "int", and either four-byte or eight-byte alignment for "long",
+     on 32-bit and 64-bit systems, respectively.  Note that these
+     guarantees were introduced into the C11 standard, so beware when
+     using older pre-C11 compilers (for example, gcc 4.6).  The portion
+     of the standard containing this guarantee is Section 3.14, which
+     defines "memory location" as follows:
+        memory location
+                either an object of scalar type, or a maximal sequence
+                of adjacent bit-fields all having nonzero width
+                NOTE 1: Two threads of execution can update and access
+                separate memory locations without interfering with
+                each other.
+                NOTE 2: A bit-field and an adjacent non-bit-field member
+                are in separate memory locations. The same applies
+                to two bit-fields, if one is declared inside a nested
+                structure declaration and the other is not, or if the two
+                are separated by a zero-length bit-field declaration,
+                or if they are separated by a non-bit-field member
+                declaration. It is not safe to concurrently update two
+                bit-fields in the same structure if all members declared
+                between them are also bit-fields, no matter what the
+                sizes of those intervening bit-fields happen to be.
 =========================
 WHAT ARE MEMORY BARRIERS?
@@ -750,7 +794,7 @@ In summary:
      However, they do -not- guarantee any other sort of ordering:
      Not prior loads against later loads, nor prior stores against
      later anything.  If you need these other forms of ordering,
-      use smb_rmb(), smp_wmb(), or, in the case of prior stores and
+      use smp_rmb(), smp_wmb(), or, in the case of prior stores and
      later loads, smp_mb().
  (*) If both legs of the "if" statement begin with identical stores
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 9bffdfc648dc..85b022179104 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -66,6 +66,8 @@ fwmark_reflect - BOOLEAN
 route/max_size - INTEGER
        Maximum number of routes allowed in the kernel.  Increase
        this when using large numbers of interfaces and/or routes.
+        From linux kernel 3.6 onwards, this is deprecated for ipv4
+        as route cache is no longer used.
 neigh/default/gc_thresh1 - INTEGER
        Minimum number of entries to keep.  Garbage collector will not
diff --git a/Documentation/networking/netlink_mmap.txt b/Documentation/networking/netlink_mmap.txt
index c6af4bac5aa8..54f10478e8e3 100644
--- a/Documentation/networking/netlink_mmap.txt
+++ b/Documentation/networking/netlink_mmap.txt
@@ -199,16 +199,9 @@ frame header.
 TX limitations
 --------------
-Kernel processing usually involves validation of the message received by
+As of Jan 2015 the message is always copied from the ring frame to an
-user-space, then processing its contents. The kernel must assure that
+allocated buffer due to unresolved security concerns.
-userspace is not able to modify the message contents after they have been
+See commit 4682a0358639b29cf ("netlink: Always copy on mmap TX.").
-validated. In order to do so, the message is copied from the ring frame
-to an allocated buffer if either of these conditions is false:
- only a single mapping of the ring exists
- the file descriptor is not shared between processes
-This means that for threaded programs, the kernel will fall back to copying.
 Example
 -------
diff --git a/Documentation/target/tcm_mod_builder.py b/Documentation/target/tcm_mod_builder.py
index 230ce71f4d75..2b47704f75cb 100755
--- a/Documentation/target/tcm_mod_builder.py
+++ b/Documentation/target/tcm_mod_builder.py
@@ -389,9 +389,6 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
        buf += "        .release_cmd                    = " + fabric_mod_name + "_release_cmd,\n"
        buf += "        .shutdown_session               = " + fabric_mod_name + "_shutdown_session,\n"
        buf += "        .close_session                  = " + fabric_mod_name + "_close_session,\n"
-        buf += "        .stop_session                   = " + fabric_mod_name + "_stop_session,\n"
-        buf += "        .fall_back_to_erl0              = " + fabric_mod_name + "_reset_nexus,\n"
-        buf += "        .sess_logged_in                 = " + fabric_mod_name + "_sess_logged_in,\n"
        buf += "        .sess_get_index                 = " + fabric_mod_name + "_sess_get_index,\n"
        buf += "        .sess_get_initiator_sid         = NULL,\n"
        buf += "        .write_pending                  = " + fabric_mod_name + "_write_pending,\n"
@@ -402,7 +399,7 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
        buf += "        .queue_data_in                  = " + fabric_mod_name + "_queue_data_in,\n"
        buf += "        .queue_status                   = " + fabric_mod_name + "_queue_status,\n"
        buf += "        .queue_tm_rsp                   = " + fabric_mod_name + "_queue_tm_rsp,\n"
-        buf += "        .is_state_remove                = " + fabric_mod_name + "_is_state_remove,\n"
+        buf += "        .aborted_task                   = " + fabric_mod_name + "_aborted_task,\n"
        buf += "        /*\n"
        buf += "         * Setup function pointers for generic logic in target_core_fabric_configfs.c\n"
        buf += "         */\n"
@@ -428,7 +425,7 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
        buf += "        /*\n"
        buf += "         * Register the top level struct config_item_type with TCM core\n"
        buf += "         */\n"
-        buf += "        fabric = target_fabric_configfs_init(THIS_MODULE, \"" + fabric_mod_name[4:] + "\");\n"
+        buf += "        fabric = target_fabric_configfs_init(THIS_MODULE, \"" + fabric_mod_name + "\");\n"
        buf += "        if (IS_ERR(fabric)) {\n"
        buf += "                printk(KERN_ERR \"target_fabric_configfs_init() failed\\n\");\n"
        buf += "                return PTR_ERR(fabric);\n"
@@ -595,7 +592,7 @@ def tcm_mod_dump_fabric_ops(proto_ident, fabric_mod_dir_var, fabric_mod_name):
                if re.search('get_fabric_name', fo):
                        buf += "char *" + fabric_mod_name + "_get_fabric_name(void)\n"
                        buf += "{\n"
-                        buf += "        return \"" + fabric_mod_name[4:] + "\";\n"
+                        buf += "        return \"" + fabric_mod_name + "\";\n"
                        buf += "}\n\n"
                        bufi += "char *" + fabric_mod_name + "_get_fabric_name(void);\n"
                        continue
@@ -820,27 +817,6 @@ def tcm_mod_dump_fabric_ops(proto_ident, fabric_mod_dir_var, fabric_mod_name):
                        buf += "}\n\n"
                        bufi += "void " + fabric_mod_name + "_close_session(struct se_session *);\n"
-                if re.search('stop_session\)\(', fo):
-                        buf += "void " + fabric_mod_name + "_stop_session(struct se_session *se_sess, int sess_sleep , int conn_sleep)\n"
-                        buf += "{\n"
-                        buf += "        return;\n"
-                        buf += "}\n\n"
-                        bufi += "void " + fabric_mod_name + "_stop_session(struct se_session *, int, int);\n"
-                if re.search('fall_back_to_erl0\)\(', fo):
-                        buf += "void " + fabric_mod_name + "_reset_nexus(struct se_session *se_sess)\n"
-                        buf += "{\n"
-                        buf += "        return;\n"
-                        buf += "}\n\n"
-                        bufi += "void " + fabric_mod_name + "_reset_nexus(struct se_session *);\n"
-                if re.search('sess_logged_in\)\(', fo):
-                        buf += "int " + fabric_mod_name + "_sess_logged_in(struct se_session *se_sess)\n"
-                        buf += "{\n"
-                        buf += "        return 0;\n"
-                        buf += "}\n\n"
-                        bufi += "int " + fabric_mod_name + "_sess_logged_in(struct se_session *);\n"
                if re.search('sess_get_index\)\(', fo):
                        buf += "u32 " + fabric_mod_name + "_sess_get_index(struct se_session *se_sess)\n"
                        buf += "{\n"
@@ -898,19 +874,18 @@ def tcm_mod_dump_fabric_ops(proto_ident, fabric_mod_dir_var, fabric_mod_name):
                        bufi += "int " + fabric_mod_name + "_queue_status(struct se_cmd *);\n"
                if re.search('queue_tm_rsp\)\(', fo):
-                        buf += "int " + fabric_mod_name + "_queue_tm_rsp(struct se_cmd *se_cmd)\n"
+                        buf += "void " + fabric_mod_name + "_queue_tm_rsp(struct se_cmd *se_cmd)\n"
                        buf += "{\n"
-                        buf += "        return 0;\n"
+                        buf += "        return;\n"
                        buf += "}\n\n"
-                        bufi += "int " + fabric_mod_name + "_queue_tm_rsp(struct se_cmd *);\n"
+                        bufi += "void " + fabric_mod_name + "_queue_tm_rsp(struct se_cmd *);\n"
-                if re.search('is_state_remove\)\(', fo):
+                if re.search('aborted_task\)\(', fo):
-                        buf += "int " + fabric_mod_name + "_is_state_remove(struct se_cmd *se_cmd)\n"
+                        buf += "void " + fabric_mod_name + "_aborted_task(struct se_cmd *se_cmd)\n"
                        buf += "{\n"
-                        buf += "        return 0;\n"
+                        buf += "        return;\n"
                        buf += "}\n\n"
-                        bufi += "int " + fabric_mod_name + "_is_state_remove(struct se_cmd *);\n"
+                        bufi += "void " + fabric_mod_name + "_aborted_task(struct se_cmd *);\n"
        ret = p.write(buf)
        if ret:
@@ -1018,11 +993,11 @@ def main(modname, proto_ident):
        tcm_mod_build_kbuild(fabric_mod_dir, fabric_mod_name)
        tcm_mod_build_kconfig(fabric_mod_dir, fabric_mod_name)
-        input = raw_input("Would you like to add " + fabric_mod_name + "to drivers/target/Makefile..? [yes,no]: ")
+        input = raw_input("Would you like to add " + fabric_mod_name + " to drivers/target/Makefile..? [yes,no]: ")
        if input == "yes" or input == "y":
                tcm_mod_add_kbuild(tcm_dir, fabric_mod_name)
-        input = raw_input("Would you like to add " + fabric_mod_name + "to drivers/target/Kconfig..? [yes,no]: ")
+        input = raw_input("Would you like to add " + fabric_mod_name + " to drivers/target/Kconfig..? [yes,no]: ")
        if input == "yes" or input == "y":
                tcm_mod_add_kconfig(tcm_dir, fabric_mod_name)
diff --git a/Documentation/thermal/cpu-cooling-api.txt b/Documentation/thermal/cpu-cooling-api.txt
index fca24c931ec8..753e47cc2e20 100644
--- a/Documentation/thermal/cpu-cooling-api.txt
+++ b/Documentation/thermal/cpu-cooling-api.txt
@@ -3,7 +3,7 @@ CPU cooling APIs How To
 Written by Amit Daniel Kachhap <amit.kachhap@linaro.org>
-Updated: 12 May 2012
+Updated: 6 Jan 2015
 Copyright (c)  2012 Samsung Electronics Co., Ltd(http://www.samsung.com)
@@ -25,7 +25,18 @@ the user. The registration APIs returns the cooling device pointer.
   clip_cpus: cpumask of cpus where the frequency constraints will happen.
-1.1.2 void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
+1.1.2 struct thermal_cooling_device *of_cpufreq_cooling_register(
+        struct device_node *np, const struct cpumask *clip_cpus)
+    This interface function registers the cpufreq cooling device with
+    the name "thermal-cpufreq-%x" linking it with a device tree node, in
+    order to bind it via the thermal DT code. This api can support multiple
+    instances of cpufreq cooling devices.
+    np: pointer to the cooling device device tree node
+    clip_cpus: cpumask of cpus where the frequency constraints will happen.
+1.1.3 void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
    This interface function unregisters the "thermal-cpufreq-%x" cooling device.
diff --git a/Documentation/x86/entry_64.txt b/Documentation/x86/entry_64.txt
index 4a1c5c2dc5a9..9132b86176a3 100644
--- a/Documentation/x86/entry_64.txt
+++ b/Documentation/x86/entry_64.txt
@@ -78,9 +78,6 @@ The expensive (paranoid) way is to read back the MSR_GS_BASE value
        xorl %ebx,%ebx
 1:      ret
-and the whole paranoid non-paranoid macro complexity is about whether
-to suffer that RDMSR cost.
 If we are at an interrupt or user-trap/gate-alike boundary then we can
 use the faster check: the stack will be a reliable indicator of
 whether SWAPGS was already done: if we see that we are a secondary
@@ -93,6 +90,15 @@ which might have triggered right after a normal entry wrote CS to the
 stack but before we executed SWAPGS, then the only safe way to check
 for GS is the slower method: the RDMSR.
-So we try only to mark those entry methods 'paranoid' that absolutely
+Therefore, super-atomic entries (except NMI, which is handled separately)
-need the more expensive check for the GS base - and we generate all
+must use idtentry with paranoid=1 to handle gsbase correctly.  This
-'normal' entry points with the regular (faster) entry macros.
+triggers three main behavior changes:
+ - Interrupt entry will use the slower gsbase check.
+ - Interrupt entry from user mode will switch off the IST stack.
+ - Interrupt exit to kernel mode will not attempt to reschedule.
+We try to only use IST entries and the paranoid entry code for vectors
+that absolutely need the more expensive check for the GS base - and we
+generate all 'normal' entry points with the regular (faster) paranoid=0
+variant.
diff --git a/Documentation/x86/x86_64/kernel-stacks b/Documentation/x86/x86_64/kernel-stacks
index a01eec5d1d0b..e3c8a49d1a2f 100644
--- a/Documentation/x86/x86_64/kernel-stacks
+++ b/Documentation/x86/x86_64/kernel-stacks
@@ -40,9 +40,11 @@ An IST is selected by a non-zero value in the IST field of an
 interrupt-gate descriptor.  When an interrupt occurs and the hardware
 loads such a descriptor, the hardware automatically sets the new stack
 pointer based on the IST value, then invokes the interrupt handler.  If
-software wants to allow nested IST interrupts then the handler must
+the interrupt came from user mode, then the interrupt handler prologue
-adjust the IST values on entry to and exit from the interrupt handler.
+will switch back to the per-thread stack.  If software wants to allow
-(This is occasionally done, e.g. for debug exceptions.)
+nested IST interrupts then the handler must adjust the IST values on
+entry to and exit from the interrupt handler.  (This is occasionally
+done, e.g. for debug exceptions.)
 Events with different IST codes (i.e. with different stacks) can be
 nested.  For example, a debug interrupt can safely be interrupted by an
diff --git a/MAINTAINERS b/MAINTAINERS
index ddb9ac8d32b3..d66a97dd3a12 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -696,7 +696,7 @@ L:	alsa-devel@alsa-project.org (moderated for non-subscribers)
 W:      http://blackfin.uclinux.org/
 S:      Supported
 F:      sound/soc/blackfin/*
- 
 ANALOG DEVICES INC IIO DRIVERS
 M:      Lars-Peter Clausen <lars@metafoo.de>
 M:      Michael Hennerich <Michael.Hennerich@analog.com>
@@ -708,6 +708,16 @@ X:	drivers/iio/*/adjd*
 F:      drivers/staging/iio/*/ad*
 F:      staging/iio/trigger/iio-trig-bfin-timer.c
+ANDROID DRIVERS
+M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+M:      Arve Hj�nnev�g <arve@android.com>
+M:      Riley Andrews <riandrews@android.com>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/gregkh/staging.git
+L:      devel@driverdev.osuosl.org
+S:      Supported
+F:      drivers/android/
+F:      drivers/staging/android/
 AOA (Apple Onboard Audio) ALSA DRIVER
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linuxppc-dev@lists.ozlabs.org
@@ -724,15 +734,15 @@ F:	include/uapi/linux/apm_bios.h
 F:      drivers/char/apm-emulation.c
 APPLE BCM5974 MULTITOUCH DRIVER
-M:      Henrik Rydberg <rydberg@euromail.se>
+M:      Henrik Rydberg <rydberg@bitmath.org>
 L:      linux-input@vger.kernel.org
-S:      Maintained
+S:      Odd fixes
 F:      drivers/input/mouse/bcm5974.c
 APPLE SMC DRIVER
-M:      Henrik Rydberg <rydberg@euromail.se>
+M:      Henrik Rydberg <rydberg@bitmath.org>
 L:      lm-sensors@lm-sensors.org
-S:      Maintained
+S:      Odd fixes
 F:      drivers/hwmon/applesmc.c
 APPLETALK NETWORK LAYER
@@ -754,13 +764,6 @@ L:	linux-media@vger.kernel.org
 S:      Maintained
 F:      drivers/media/i2c/aptina-pll.*
-ARASAN COMPACT FLASH PATA CONTROLLER
-M:      Viresh Kumar <viresh.linux@gmail.com>
-L:      linux-ide@vger.kernel.org
-S:      Maintained
-F:      include/linux/pata_arasan_cf_data.h
-F:      drivers/ata/pata_arasan_cf.c
 ARC FRAMEBUFFER DRIVER
 M:      Jaya Kumar <jayalk@intworks.biz>
 S:      Maintained
@@ -2259,6 +2262,7 @@ F:	drivers/gpio/gpio-bt8xx.c
 BTRFS FILE SYSTEM
 M:      Chris Mason <clm@fb.com>
 M:      Josef Bacik <jbacik@fb.com>
+M:      David Sterba <dsterba@suse.cz>
 L:      linux-btrfs@vger.kernel.org
 W:      http://btrfs.wiki.kernel.org/
 Q:      http://patchwork.kernel.org/project/linux-btrfs/list/
@@ -2345,7 +2349,8 @@ CAN NETWORK LAYER
 M:      Oliver Hartkopp <socketcan@hartkopp.net>
 L:      linux-can@vger.kernel.org
 W:      http://gitorious.org/linux-can
-T:      git git://gitorious.org/linux-can/linux-can-next.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next.git
 S:      Maintained
 F:      Documentation/networking/can.txt
 F:      net/can/
@@ -2360,7 +2365,8 @@ M:	Wolfgang Grandegger <wg@grandegger.com>
 M:      Marc Kleine-Budde <mkl@pengutronix.de>
 L:      linux-can@vger.kernel.org
 W:      http://gitorious.org/linux-can
-T:      git git://gitorious.org/linux-can/linux-can-next.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next.git
 S:      Maintained
 F:      drivers/net/can/
 F:      include/linux/can/dev.h
@@ -3182,7 +3188,7 @@ L:	dmaengine@vger.kernel.org
 Q:      https://patchwork.kernel.org/project/linux-dmaengine/list/
 S:      Maintained
 F:      drivers/dma/
-F:      include/linux/dma*
+F:      include/linux/dmaengine.h
 F:      Documentation/dmaengine/
 T:      git git://git.infradead.org/users/vkoul/slave-dma.git
@@ -4748,20 +4754,20 @@ S:	Supported
 F:      drivers/scsi/ipr.*
 IBM Power Virtual Ethernet Device Driver
-M:      Santiago Leon <santil@linux.vnet.ibm.com>
+M:      Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/ibm/ibmveth.*
 IBM Power Virtual SCSI Device Drivers
-M:      Nathan Fontenot <nfont@linux.vnet.ibm.com>
+M:      Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
 L:      linux-scsi@vger.kernel.org
 S:      Supported
 F:      drivers/scsi/ibmvscsi/ibmvscsi*
 F:      drivers/scsi/ibmvscsi/viosrp.h
 IBM Power Virtual FC Device Drivers
-M:      Brian King <brking@linux.vnet.ibm.com>
+M:      Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
 L:      linux-scsi@vger.kernel.org
 S:      Supported
 F:      drivers/scsi/ibmvscsi/ibmvfc*
@@ -4929,7 +4935,6 @@ F:	include/uapi/linux/inotify.h
 INPUT (KEYBOARD, MOUSE, JOYSTICK, TOUCHSCREEN) DRIVERS
 M:      Dmitry Torokhov <dmitry.torokhov@gmail.com>
-M:      Dmitry Torokhov <dtor@mail.ru>
 L:      linux-input@vger.kernel.org
 Q:      http://patchwork.kernel.org/project/linux-input/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git
@@ -4940,18 +4945,27 @@ F:	include/uapi/linux/input.h
 F:      include/linux/input/
 INPUT MULTITOUCH (MT) PROTOCOL
-M:      Henrik Rydberg <rydberg@euromail.se>
+M:      Henrik Rydberg <rydberg@bitmath.org>
 L:      linux-input@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rydberg/input-mt.git
-S:      Maintained
+S:      Odd fixes
 F:      Documentation/input/multi-touch-protocol.txt
 F:      drivers/input/input-mt.c
 K:      \b(ABS|SYN)_MT_
+INTEL ASoC BDW/HSW DRIVERS
+M:      Jie Yang <yang.jie@linux.intel.com>
+L:      alsa-devel@alsa-project.org
+S:      Supported
+F:      sound/soc/intel/sst-haswell*
+F:      sound/soc/intel/sst-dsp*
+F:      sound/soc/intel/sst-firmware.c
+F:      sound/soc/intel/broadwell.c
+F:      sound/soc/intel/haswell.c
 INTEL C600 SERIES SAS CONTROLLER DRIVER
 M:      Intel SCU Linux support <intel-linux-scu@intel.com>
 M:      Artur Paszkiewicz <artur.paszkiewicz@intel.com>
-M:      Dave Jiang <dave.jiang@intel.com>
 L:      linux-scsi@vger.kernel.org
 T:      git git://git.code.sf.net/p/intel-sas/isci
 S:      Supported
@@ -5279,6 +5293,15 @@ W:	www.open-iscsi.org
 Q:      http://patchwork.kernel.org/project/linux-rdma/list/
 F:      drivers/infiniband/ulp/iser/
+ISCSI EXTENSIONS FOR RDMA (ISER) TARGET
+M:      Sagi Grimberg <sagig@mellanox.com>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending.git master
+L:      linux-rdma@vger.kernel.org
+L:      target-devel@vger.kernel.org
+S:      Supported
+W:      http://www.linux-iscsi.org
+F:      drivers/infiniband/ulp/isert
 ISDN SUBSYSTEM
 M:      Karsten Keil <isdn@linux-pingi.de>
 L:      isdn4linux@listserv.isdn4linux.de (subscribers-only)
@@ -5693,6 +5716,49 @@ F:	drivers/lguest/
 F:      include/linux/lguest*.h
 F:      tools/lguest/
+LIBATA SUBSYSTEM (Serial and Parallel ATA drivers)
+M:      Tejun Heo <tj@kernel.org>
+L:      linux-ide@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+S:      Maintained
+F:      drivers/ata/
+F:      include/linux/ata.h
+F:      include/linux/libata.h
+LIBATA PATA ARASAN COMPACT FLASH CONTROLLER
+M:      Viresh Kumar <viresh.linux@gmail.com>
+L:      linux-ide@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+S:      Maintained
+F:      include/linux/pata_arasan_cf_data.h
+F:      drivers/ata/pata_arasan_cf.c
+LIBATA PATA DRIVERS
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+M:      Tejun Heo <tj@kernel.org>
+L:      linux-ide@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+S:      Maintained
+F:      drivers/ata/pata_*.c
+F:      drivers/ata/ata_generic.c
+LIBATA SATA AHCI PLATFORM devices support
+M:      Hans de Goede <hdegoede@redhat.com>
+M:      Tejun Heo <tj@kernel.org>
+L:      linux-ide@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+S:      Maintained
+F:      drivers/ata/ahci_platform.c
+F:      drivers/ata/libahci_platform.c
+F:      include/linux/ahci_platform.h
+LIBATA SATA PROMISE TX2/TX4 CONTROLLER DRIVER
+M:      Mikael Pettersson <mikpelinux@gmail.com>
+L:      linux-ide@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+S:      Maintained
+F:      drivers/ata/sata_promise.*
 LIBLOCKDEP
 M:      Sasha Levin <sasha.levin@oracle.com>
 S:      Maintained
@@ -6977,14 +7043,12 @@ OPEN FIRMWARE AND FLATTENED DEVICE TREE
 M:      Grant Likely <grant.likely@linaro.org>
 M:      Rob Herring <robh+dt@kernel.org>
 L:      devicetree@vger.kernel.org
-W:      http://fdt.secretlab.ca
+W:      http://www.devicetree.org/
-T:      git git://git.secretlab.ca/git/linux-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux.git
 S:      Maintained
 F:      drivers/of/
 F:      include/linux/of*.h
 F:      scripts/dtc/
-K:      of_get_property
-K:      of_match_table
 OPEN FIRMWARE AND FLATTENED DEVICE TREE BINDINGS
 M:      Rob Herring <robh+dt@kernel.org>
@@ -7229,7 +7293,7 @@ S:	Maintained
 F:      drivers/pci/host/*layerscape*
 PCI DRIVER FOR IMX6
-M:      Richard Zhu <r65037@freescale.com>
+M:      Richard Zhu <Richard.Zhu@freescale.com>
 M:      Lucas Stach <l.stach@pengutronix.de>
 L:      linux-pci@vger.kernel.org
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -7399,6 +7463,7 @@ F:	drivers/crypto/picoxcell*
 PIN CONTROL SUBSYSTEM
 M:      Linus Walleij <linus.walleij@linaro.org>
 L:      linux-gpio@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl.git
 S:      Maintained
 F:      drivers/pinctrl/
 F:      include/linux/pinctrl/
@@ -7566,12 +7631,6 @@ W:	http://wireless.kernel.org/en/users/Drivers/p54
 S:      Obsolete
 F:      drivers/net/wireless/prism54/
-PROMISE SATA TX2/TX4 CONTROLLER LIBATA DRIVER
-M:      Mikael Pettersson <mikpelinux@gmail.com>
-L:      linux-ide@vger.kernel.org
-S:      Maintained
-F:      drivers/ata/sata_promise.*
 PS3 NETWORK SUPPORT
 M:      Geoff Levand <geoff@infradead.org>
 L:      netdev@vger.kernel.org
@@ -7737,8 +7796,7 @@ F:	Documentation/scsi/LICENSE.qla2xxx
 F:      drivers/scsi/qla2xxx/
 QLOGIC QLA4XXX iSCSI DRIVER
-M:      Vikas Chaudhary <vikas.chaudhary@qlogic.com>
+M:      QLogic-Storage-Upstream@qlogic.com
-M:      iscsi-driver@qlogic.com
 L:      linux-scsi@vger.kernel.org
 S:      Supported
 F:      Documentation/scsi/LICENSE.qla4xxx
@@ -8546,25 +8604,6 @@ S:	Maintained
 F:      drivers/misc/phantom.c
 F:      include/uapi/linux/phantom.h
-SERIAL ATA (SATA) SUBSYSTEM
-M:      Tejun Heo <tj@kernel.org>
-L:      linux-ide@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
-S:      Supported
-F:      drivers/ata/
-F:      include/linux/ata.h
-F:      include/linux/libata.h
-SERIAL ATA AHCI PLATFORM devices support
-M:      Hans de Goede <hdegoede@redhat.com>
-M:      Tejun Heo <tj@kernel.org>
-L:      linux-ide@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
-S:      Supported
-F:      drivers/ata/ahci_platform.c
-F:      drivers/ata/libahci_platform.c
-F:      include/linux/ahci_platform.h
 SERVER ENGINES 10Gbps iSCSI - BladeEngine 2 DRIVER
 M:      Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
 L:      linux-scsi@vger.kernel.org
@@ -9212,7 +9251,6 @@ F:	drivers/net/ethernet/dlink/sundance.c
 SUPERH
 L:      linux-sh@vger.kernel.org
-W:      http://www.linux-sh.org
 Q:      http://patchwork.kernel.org/project/linux-sh/list/
 S:      Orphan
 F:      Documentation/sh/
@@ -9533,7 +9571,8 @@ F:	drivers/platform/x86/thinkpad_acpi.c
 TI BANDGAP AND THERMAL DRIVER
 M:      Eduardo Valentin <edubezval@gmail.com>
 L:      linux-pm@vger.kernel.org
-S:      Supported
+L:      linux-omap@vger.kernel.org
+S:      Maintained
 F:      drivers/thermal/ti-soc-thermal/
 TI CLOCK DRIVER
@@ -10146,6 +10185,7 @@ USERSPACE I/O (UIO)
 M:      "Hans J. Koch" <hjk@hansjkoch.de>
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 F:      Documentation/DocBook/uio-howto.tmpl
 F:      drivers/uio/
 F:      include/linux/uio*.h
diff --git a/Makefile b/Makefile
index b1c3254441f3..b15036b1890c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 19
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION =
 NAME = Diseased Newt
 # *DOCUMENTATION*
@@ -391,6 +391,7 @@ USERINCLUDE    := \
 # Needed to be compatible with the O= option
 LINUXINCLUDE    := \
                -I$(srctree)/arch/$(hdr-arch)/include \
+                -Iarch/$(hdr-arch)/include/generated/uapi \
                -Iarch/$(hdr-arch)/include/generated \
                $(if $(KBUILD_SRC), -I$(srctree)/include) \
                -Iinclude \
diff --git a/arch/alpha/kernel/pci.c b/arch/alpha/kernel/pci.c
index 076c35cd6cde..98a1525fa164 100644
--- a/arch/alpha/kernel/pci.c
+++ b/arch/alpha/kernel/pci.c
@@ -285,8 +285,12 @@ pcibios_claim_one_bus(struct pci_bus *b)
                        if (r->parent || !r->start || !r->flags)
                                continue;
                        if (pci_has_flag(PCI_PROBE_ONLY) ||
-                            (r->flags & IORESOURCE_PCI_FIXED))
+                            (r->flags & IORESOURCE_PCI_FIXED)) {
-                                pci_claim_resource(dev, i);
+                                if (pci_claim_resource(dev, i) == 0)
+                                        continue;
+                                pci_claim_bridge_resource(dev, i);
+                        }
                }
        }
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index 98838a05ba6d..9d0ac091a52a 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -156,6 +156,8 @@ retry:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
index 6f7e3a68803a..563cb27e37f5 100644
--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -161,6 +161,8 @@ good_area:
        if (fault & VM_FAULT_OOM)
                goto out_of_memory;
+        else if (fault & VM_FAULT_SIGSEGV)
+                goto bad_area;
        else if (fault & VM_FAULT_SIGBUS)
                goto do_sigbus;
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 68be9017593d..132c70e2d2f1 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -263,16 +263,37 @@ restart:	adr	r0, LC0
                 * OK... Let's do some funky business here.
                 * If we do have a DTB appended to zImage, and we do have
                 * an ATAG list around, we want the later to be translated
-                 * and folded into the former here.  To be on the safe side,
+                 * and folded into the former here. No GOT fixup has occurred
-                 * let's temporarily move  the stack away into the malloc
+                 * yet, but none of the code we're about to call uses any
-                 * area.  No GOT fixup has occurred yet, but none of the
+                 * global variable.
-                 * code we're about to call uses any global variable.
                */
-                add     sp, sp, #0x10000
+                /* Get the initial DTB size */
+                ldr     r5, [r6, #4]
+#ifndef __ARMEB__
+                /* convert to little endian */
+                eor     r1, r5, r5, ror #16
+                bic     r1, r1, #0x00ff0000
+                mov     r5, r5, ror #8
+                eor     r5, r5, r1, lsr #8
+#endif
+                /* 50% DTB growth should be good enough */
+                add     r5, r5, r5, lsr #1
+                /* preserve 64-bit alignment */
+                add     r5, r5, #7
+                bic     r5, r5, #7
+                /* clamp to 32KB min and 1MB max */
+                cmp     r5, #(1 << 15)
+                movlo   r5, #(1 << 15)
+                cmp     r5, #(1 << 20)
+                movhi   r5, #(1 << 20)
+                /* temporarily relocate the stack past the DTB work space */
+                add     sp, sp, r5
                stmfd   sp!, {r0-r3, ip, lr}
                mov     r0, r8
                mov     r1, r6
-                sub     r2, sp, r6
+                mov     r2, r5
                bl      atags_to_fdt
                /*
@@ -285,11 +306,11 @@ restart:	adr	r0, LC0
                bic     r0, r0, #1
                add     r0, r0, #0x100
                mov     r1, r6
-                sub     r2, sp, r6
+                mov     r2, r5
                bleq    atags_to_fdt
                ldmfd   sp!, {r0-r3, ip, lr}
-                sub     sp, sp, #0x10000
+                sub     sp, sp, r5
 #endif
                mov     r8, r6                  @ use the appended device tree
@@ -306,7 +327,7 @@ restart:	adr	r0, LC0
                subs    r1, r5, r1
                addhi   r9, r9, r1
-                /* Get the dtb's size */
+                /* Get the current DTB size */
                ldr     r5, [r6, #4]
 #ifndef __ARMEB__
                /* convert r5 (dtb size) to little endian */
diff --git a/arch/arm/boot/dts/armada-370-db.dts b/arch/arm/boot/dts/armada-370-db.dts
index 1466580be295..70b1943a86b1 100644
--- a/arch/arm/boot/dts/armada-370-db.dts
+++ b/arch/arm/boot/dts/armada-370-db.dts
@@ -203,27 +203,3 @@
                compatible = "linux,spdif-dir";
        };
 };
-&pinctrl {
-        /*
-         * These pins might be muxed as I2S by
-         * the bootloader, but it conflicts
-         * with the real I2S pins that are
-         * muxed using i2s_pins. We must mux
-         * those pins to a function other than
-         * I2S.
-         */
-        pinctrl-0 = <&hog_pins1 &hog_pins2>;
-        pinctrl-names = "default";
-        hog_pins1: hog-pins1 {
-                marvell,pins = "mpp6",  "mpp8", "mpp10",
-                               "mpp12", "mpp13";
-                marvell,function = "gpio";
-        };
-        hog_pins2: hog-pins2 {
-                marvell,pins = "mpp5", "mpp7", "mpp9";
-                marvell,function = "gpo";
-        };
-};
diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
index 1467750e3377..e8c6c600a5b6 100644
--- a/arch/arm/boot/dts/at91sam9263.dtsi
+++ b/arch/arm/boot/dts/at91sam9263.dtsi
@@ -953,6 +953,8 @@
                        interrupts = <26 IRQ_TYPE_LEVEL_HIGH 3>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_fb>;
+                        clocks = <&lcd_clk>, <&lcd_clk>;
+                        clock-names = "lcdc_clk", "hclk";
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/berlin2q-marvell-dmp.dts b/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
index 28e7e2060c33..a98ac1bd8f65 100644
--- a/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
+++ b/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
@@ -65,6 +65,8 @@
 };
 &sdhci2 {
+        broken-cd;
+        bus-width = <8>;
        non-removable;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/berlin2q.dtsi b/arch/arm/boot/dts/berlin2q.dtsi
index 35253c947a7c..e2f61f27944e 100644
--- a/arch/arm/boot/dts/berlin2q.dtsi
+++ b/arch/arm/boot/dts/berlin2q.dtsi
@@ -83,7 +83,8 @@
                        compatible = "mrvl,pxav3-mmc";
                        reg = <0xab1000 0x200>;
                        interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
-                        clocks = <&chip CLKID_SDIO1XIN>;
+                        clocks = <&chip CLKID_NFC_ECC>, <&chip CLKID_NFC>;
+                        clock-names = "io", "core";
                        status = "disabled";
                };
@@ -348,36 +349,6 @@
                                interrupt-parent = <&gic>;
                                interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
                        };
-                        gpio4: gpio@5000 {
-                                compatible = "snps,dw-apb-gpio";
-                                reg = <0x5000 0x400>;
-                                #address-cells = <1>;
-                                #size-cells = <0>;
-                                porte: gpio-port@4 {
-                                        compatible = "snps,dw-apb-gpio-port";
-                                        gpio-controller;
-                                        #gpio-cells = <2>;
-                                        snps,nr-gpios = <32>;
-                                        reg = <0>;
-                                };
-                        };
-                        gpio5: gpio@c000 {
-                                compatible = "snps,dw-apb-gpio";
-                                reg = <0xc000 0x400>;
-                                #address-cells = <1>;
-                                #size-cells = <0>;
-                                portf: gpio-port@5 {
-                                        compatible = "snps,dw-apb-gpio-port";
-                                        gpio-controller;
-                                        #gpio-cells = <2>;
-                                        snps,nr-gpios = <32>;
-                                        reg = <0>;
-                                };
-                        };
                };
                chip: chip-control@ea0000 {
@@ -466,6 +437,21 @@
                        ranges = <0 0xfc0000 0x10000>;
                        interrupt-parent = <&sic>;
+                        sm_gpio1: gpio@5000 {
+                                compatible = "snps,dw-apb-gpio";
+                                reg = <0x5000 0x400>;
+                                #address-cells = <1>;
+                                #size-cells = <0>;
+                                portf: gpio-port@5 {
+                                        compatible = "snps,dw-apb-gpio-port";
+                                        gpio-controller;
+                                        #gpio-cells = <2>;
+                                        snps,nr-gpios = <32>;
+                                        reg = <0>;
+                                };
+                        };
                        i2c2: i2c@7000 {
                                compatible = "snps,designware-i2c";
                                #address-cells = <1>;
@@ -516,6 +502,21 @@
                                status = "disabled";
                        };
+                        sm_gpio0: gpio@c000 {
+                                compatible = "snps,dw-apb-gpio";
+                                reg = <0xc000 0x400>;
+                                #address-cells = <1>;
+                                #size-cells = <0>;
+                                porte: gpio-port@4 {
+                                        compatible = "snps,dw-apb-gpio-port";
+                                        gpio-controller;
+                                        #gpio-cells = <2>;
+                                        snps,nr-gpios = <32>;
+                                        reg = <0>;
+                                };
+                        };
                        sysctrl: pin-controller@d000 {
                                compatible = "marvell,berlin2q-system-ctrl";
                                reg = <0xd000 0x100>;
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index 10b725c7bfc0..ad4118f7e1a6 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -499,23 +499,23 @@
                };
                partition@5 {
                        label = "QSPI.u-boot-spl-os";
-                        reg = <0x00140000 0x00010000>;
+                        reg = <0x00140000 0x00080000>;
                };
                partition@6 {
                        label = "QSPI.u-boot-env";
-                        reg = <0x00150000 0x00010000>;
+                        reg = <0x001c0000 0x00010000>;
                };
                partition@7 {
                        label = "QSPI.u-boot-env.backup1";
-                        reg = <0x00160000 0x0010000>;
+                        reg = <0x001d0000 0x0010000>;
                };
                partition@8 {
                        label = "QSPI.kernel";
-                        reg = <0x00170000 0x0800000>;
+                        reg = <0x001e0000 0x0800000>;
                };
                partition@9 {
                        label = "QSPI.file-system";
-                        reg = <0x00970000 0x01690000>;
+                        reg = <0x009e0000 0x01620000>;
                };
        };
 };
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 22771bc1643a..63f8b007bdc5 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -1257,6 +1257,8 @@
                                tx-fifo-resize;
                                maximum-speed = "super-speed";
                                dr_mode = "otg";
+                                snps,dis_u3_susphy_quirk;
+                                snps,dis_u2_susphy_quirk;
                        };
                };
@@ -1278,6 +1280,8 @@
                                tx-fifo-resize;
                                maximum-speed = "high-speed";
                                dr_mode = "otg";
+                                snps,dis_u3_susphy_quirk;
+                                snps,dis_u2_susphy_quirk;
                        };
                };
@@ -1299,6 +1303,8 @@
                                tx-fifo-resize;
                                maximum-speed = "high-speed";
                                dr_mode = "otg";
+                                snps,dis_u3_susphy_quirk;
+                                snps,dis_u2_susphy_quirk;
                        };
                };
diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi
index b8168f1f8139..24ff27049ce0 100644
--- a/arch/arm/boot/dts/exynos4.dtsi
+++ b/arch/arm/boot/dts/exynos4.dtsi
@@ -368,7 +368,7 @@
        };
        i2s1: i2s@13960000 {
-                compatible = "samsung,s5pv210-i2s";
+                compatible = "samsung,s3c6410-i2s";
                reg = <0x13960000 0x100>;
                clocks = <&clock CLK_I2S1>;
                clock-names = "iis";
@@ -378,7 +378,7 @@
        };
        i2s2: i2s@13970000 {
-                compatible = "samsung,s5pv210-i2s";
+                compatible = "samsung,s3c6410-i2s";
                reg = <0x13970000 0x100>;
                clocks = <&clock CLK_I2S2>;
                clock-names = "iis";
diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
index 0a229fcd7acf..d75c89d7666a 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -736,7 +736,7 @@
        dp_phy: video-phy@10040720 {
                compatible = "samsung,exynos5250-dp-video-phy";
-                reg = <0x10040720 4>;
+                samsung,pmu-syscon = <&pmu_system_controller>;
                #phy-cells = <0>;
        };
diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
index aa7a7d727a7e..db2c1c4cd900 100644
--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
@@ -372,3 +372,7 @@
 &usbdrd_dwc3_1 {
        dr_mode = "host";
 };
+&cci {
+        status = "disabled";
+};
diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi
index 517e50f6760b..6d38f8bfd0e6 100644
--- a/arch/arm/boot/dts/exynos5420.dtsi
+++ b/arch/arm/boot/dts/exynos5420.dtsi
@@ -120,7 +120,7 @@
                };
        };
-        cci@10d20000 {
+        cci: cci@10d20000 {
                compatible = "arm,cci-400";
                #address-cells = <1>;
                #size-cells = <1>;
@@ -503,8 +503,8 @@
        };
        dp_phy: video-phy@10040728 {
-                compatible = "samsung,exynos5250-dp-video-phy";
+                compatible = "samsung,exynos5420-dp-video-phy";
-                reg = <0x10040728 4>;
+                samsung,pmu-syscon = <&pmu_system_controller>;
                #phy-cells = <0>;
        };
diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
index 58d3c3cf2923..e4d3aecc4ed2 100644
--- a/arch/arm/boot/dts/imx25.dtsi
+++ b/arch/arm/boot/dts/imx25.dtsi
@@ -162,7 +162,7 @@
                                #size-cells = <0>;
                                compatible = "fsl,imx25-cspi", "fsl,imx35-cspi";
                                reg = <0x43fa4000 0x4000>;
-                                clocks = <&clks 62>, <&clks 62>;
+                                clocks = <&clks 78>, <&clks 78>;
                                clock-names = "ipg", "per";
                                interrupts = <14>;
                                status = "disabled";
@@ -369,7 +369,7 @@
                                compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
                                #pwm-cells = <2>;
                                reg = <0x53fa0000 0x4000>;
-                                clocks = <&clks 106>, <&clks 36>;
+                                clocks = <&clks 106>, <&clks 52>;
                                clock-names = "ipg", "per";
                                interrupts = <36>;
                        };
@@ -388,7 +388,7 @@
                                compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
                                #pwm-cells = <2>;
                                reg = <0x53fa8000 0x4000>;
-                                clocks = <&clks 107>, <&clks 36>;
+                                clocks = <&clks 107>, <&clks 52>;
                                clock-names = "ipg", "per";
                                interrupts = <41>;
                        };
@@ -429,7 +429,7 @@
                        pwm4: pwm@53fc8000 {
                                compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
                                reg = <0x53fc8000 0x4000>;
-                                clocks = <&clks 108>, <&clks 36>;
+                                clocks = <&clks 108>, <&clks 52>;
                                clock-names = "ipg", "per";
                                interrupts = <42>;
                        };
@@ -476,7 +476,7 @@
                                compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
                                #pwm-cells = <2>;
                                reg = <0x53fe0000 0x4000>;
-                                clocks = <&clks 105>, <&clks 36>;
+                                clocks = <&clks 105>, <&clks 52>;
                                clock-names = "ipg", "per";
                                interrupts = <26>;
                        };
diff --git a/arch/arm/boot/dts/imx51-babbage.dts b/arch/arm/boot/dts/imx51-babbage.dts
index 56569cecaa78..649befeb2cf9 100644
--- a/arch/arm/boot/dts/imx51-babbage.dts
+++ b/arch/arm/boot/dts/imx51-babbage.dts
@@ -127,24 +127,12 @@
                #address-cells = <1>;
                #size-cells = <0>;
-                reg_usbh1_vbus: regulator@0 {
+                reg_hub_reset: regulator@0 {
-                        compatible = "regulator-fixed";
-                        pinctrl-names = "default";
-                        pinctrl-0 = <&pinctrl_usbh1reg>;
-                        reg = <0>;
-                        regulator-name = "usbh1_vbus";
-                        regulator-min-microvolt = <5000000>;
-                        regulator-max-microvolt = <5000000>;
-                        gpio = <&gpio2 5 GPIO_ACTIVE_HIGH>;
-                        enable-active-high;
-                };
-                reg_usbotg_vbus: regulator@1 {
                        compatible = "regulator-fixed";
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usbotgreg>;
-                        reg = <1>;
+                        reg = <0>;
-                        regulator-name = "usbotg_vbus";
+                        regulator-name = "hub_reset";
                        regulator-min-microvolt = <5000000>;
                        regulator-max-microvolt = <5000000>;
                        gpio = <&gpio1 7 GPIO_ACTIVE_HIGH>;
@@ -176,6 +164,7 @@
                        reg = <0>;
                        clocks = <&clks IMX5_CLK_DUMMY>;
                        clock-names = "main_clk";
+                        reset-gpios = <&gpio2 5 GPIO_ACTIVE_LOW>;
                };
        };
 };
@@ -419,7 +408,7 @@
 &usbh1 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usbh1>;
-        vbus-supply = <&reg_usbh1_vbus>;
+        vbus-supply = <&reg_hub_reset>;
        fsl,usbphy = <&usbh1phy>;
        phy_type = "ulpi";
        status = "okay";
@@ -429,7 +418,6 @@
        dr_mode = "otg";
        disable-over-current;
        phy_type = "utmi_wide";
-        vbus-supply = <&reg_usbotg_vbus>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index 4fc03b7f1cee..2109d0763c1b 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -335,8 +335,8 @@
                        vpu: vpu@02040000 {
                                compatible = "cnm,coda960";
                                reg = <0x02040000 0x3c000>;
-                                interrupts = <0 3 IRQ_TYPE_LEVEL_HIGH>,
+                                interrupts = <0 12 IRQ_TYPE_LEVEL_HIGH>,
-                                             <0 12 IRQ_TYPE_LEVEL_HIGH>;
+                                             <0 3 IRQ_TYPE_LEVEL_HIGH>;
                                interrupt-names = "bit", "jpeg";
                                clocks = <&clks IMX6QDL_CLK_VPU_AXI>,
                                         <&clks IMX6QDL_CLK_MMDC_CH0_AXI>,
diff --git a/arch/arm/boot/dts/imx6sx-sdb.dts b/arch/arm/boot/dts/imx6sx-sdb.dts
index 1e6e5cc1c14c..c108bb451337 100644
--- a/arch/arm/boot/dts/imx6sx-sdb.dts
+++ b/arch/arm/boot/dts/imx6sx-sdb.dts
@@ -159,13 +159,28 @@
        pinctrl-0 = <&pinctrl_enet1>;
        phy-supply = <&reg_enet_3v3>;
        phy-mode = "rgmii";
+        phy-handle = <&ethphy1>;
        status = "okay";
+        mdio {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                ethphy1: ethernet-phy@1 {
+                        reg = <1>;
+                };
+                ethphy2: ethernet-phy@2 {
+                        reg = <2>;
+                };
+        };
 };
 &fec2 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_enet2>;
        phy-mode = "rgmii";
+        phy-handle = <&ethphy2>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
index 657da14cb4b5..c70bb27ac65a 100644
--- a/arch/arm/boot/dts/ls1021a.dtsi
+++ b/arch/arm/boot/dts/ls1021a.dtsi
@@ -142,6 +142,7 @@
                scfg: scfg@1570000 {
                        compatible = "fsl,ls1021a-scfg", "syscon";
                        reg = <0x0 0x1570000 0x0 0x10000>;
+                        big-endian;
                };
                clockgen: clocking@1ee1000 {
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 53f3ca064140..b550c41b46f1 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -700,11 +700,9 @@
                };
        };
+        /* Ethernet is on some early development boards and qemu */
        ethernet@gpmc {
                compatible = "smsc,lan91c94";
-                status = "disabled";
                interrupt-parent = <&gpio2>;
                interrupts = <22 IRQ_TYPE_LEVEL_HIGH>;  /* gpio54 */
                reg = <1 0x300 0xf>;            /* 16 byte IO range at offset 0x300 */
diff --git a/arch/arm/boot/dts/rk3288-evb.dtsi b/arch/arm/boot/dts/rk3288-evb.dtsi
index 3e067dd65d0c..6194d673e80b 100644
--- a/arch/arm/boot/dts/rk3288-evb.dtsi
+++ b/arch/arm/boot/dts/rk3288-evb.dtsi
@@ -155,6 +155,15 @@
 };
 &pinctrl {
+        pcfg_pull_none_drv_8ma: pcfg-pull-none-drv-8ma {
+                drive-strength = <8>;
+        };
+        pcfg_pull_up_drv_8ma: pcfg-pull-up-drv-8ma {
+                bias-pull-up;
+                drive-strength = <8>;
+        };
        backlight {
                bl_en: bl-en {
                        rockchip,pins = <7 2 RK_FUNC_GPIO &pcfg_pull_none>;
@@ -173,6 +182,27 @@
                };
        };
+        sdmmc {
+                /*
+                 * Default drive strength isn't enough to achieve even
+                 * high-speed mode on EVB board so bump up to 8ma.
+                 */
+                sdmmc_bus4: sdmmc-bus4 {
+                        rockchip,pins = <6 16 RK_FUNC_1 &pcfg_pull_up_drv_8ma>,
+                                        <6 17 RK_FUNC_1 &pcfg_pull_up_drv_8ma>,
+                                        <6 18 RK_FUNC_1 &pcfg_pull_up_drv_8ma>,
+                                        <6 19 RK_FUNC_1 &pcfg_pull_up_drv_8ma>;
+                };
+                sdmmc_clk: sdmmc-clk {
+                        rockchip,pins = <6 20 RK_FUNC_1 &pcfg_pull_none_drv_8ma>;
+                };
+                sdmmc_cmd: sdmmc-cmd {
+                        rockchip,pins = <6 21 RK_FUNC_1 &pcfg_pull_up_drv_8ma>;
+                };
+        };
        usb {
                host_vbus_drv: host-vbus-drv {
                        rockchip,pins = <0 14 RK_FUNC_GPIO &pcfg_pull_none>;
diff --git a/arch/arm/boot/dts/sama5d3xmb.dtsi b/arch/arm/boot/dts/sama5d3xmb.dtsi
index 49c10d33df30..77e03655aca3 100644
--- a/arch/arm/boot/dts/sama5d3xmb.dtsi
+++ b/arch/arm/boot/dts/sama5d3xmb.dtsi
@@ -176,7 +176,7 @@
                        "Headphone Jack", "HPOUTR",
                        "IN2L", "Line In Jack",
                        "IN2R", "Line In Jack",
-                        "MICBIAS", "IN1L",
+                        "Mic", "MICBIAS",
                        "IN1L", "Mic";
                atmel,ssc-controller = <&ssc0>;
diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
index 1b0f30c2c4a5..b94995d1889f 100644
--- a/arch/arm/boot/dts/sama5d4.dtsi
+++ b/arch/arm/boot/dts/sama5d4.dtsi
@@ -1008,7 +1008,7 @@
                        pit: timer@fc068630 {
                                compatible = "atmel,at91sam9260-pit";
-                                reg = <0xfc068630 0xf>;
+                                reg = <0xfc068630 0x10>;
                                interrupts = <3 IRQ_TYPE_LEVEL_HIGH 5>;
                                clocks = <&h32ck>;
                        };
diff --git a/arch/arm/boot/dts/ste-nomadik-nhk15.dts b/arch/arm/boot/dts/ste-nomadik-nhk15.dts
index a8c00ee7522a..3d0b8755caee 100644
--- a/arch/arm/boot/dts/ste-nomadik-nhk15.dts
+++ b/arch/arm/boot/dts/ste-nomadik-nhk15.dts
@@ -25,11 +25,11 @@
                stmpe2401_1 {
                        stmpe2401_1_nhk_mode: stmpe2401_1_nhk {
                                nhk_cfg1 {
-                                        ste,pins = "GPIO76_B20"; // IRQ line
+                                        pins = "GPIO76_B20"; // IRQ line
                                        ste,input = <0>;
                                };
                                nhk_cfg2 {
-                                        ste,pins = "GPIO77_B8"; // reset line
+                                        pins = "GPIO77_B8"; // reset line
                                        ste,output = <1>;
                                };
                        };
@@ -37,11 +37,11 @@
                stmpe2401_2 {
                        stmpe2401_2_nhk_mode: stmpe2401_2_nhk {
                                nhk_cfg1 {
-                                        ste,pins = "GPIO78_A8"; // IRQ line
+                                        pins = "GPIO78_A8"; // IRQ line
                                        ste,input = <0>;
                                };
                                nhk_cfg2 {
-                                        ste,pins = "GPIO79_C9"; // reset line
+                                        pins = "GPIO79_C9"; // reset line
                                        ste,output = <1>;
                                };
                        };
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index 7b4099fcf817..d5c4669224b1 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -17,14 +17,6 @@
        aliases {
                ethernet0 = &emac;
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
-                serial4 = &uart4;
-                serial5 = &uart5;
-                serial6 = &uart6;
-                serial7 = &uart7;
        };
        chosen {
@@ -39,6 +31,14 @@
                                 <&ahb_gates 44>;
                        status = "disabled";
                };
+                framebuffer@1 {
+                        compatible = "allwinner,simple-framebuffer", "simple-framebuffer";
+                        allwinner,pipeline = "de_fe0-de_be0-lcd0-hdmi";
+                        clocks = <&pll5 1>, <&ahb_gates 36>, <&ahb_gates 43>,
+                                 <&ahb_gates 44>, <&ahb_gates 46>;
+                        status = "disabled";
+                };
        };
        cpus {
@@ -438,8 +438,8 @@
                        reg-names = "phy_ctrl", "pmu1", "pmu2";
                        clocks = <&usb_clk 8>;
                        clock-names = "usb_phy";
-                        resets = <&usb_clk 1>, <&usb_clk 2>;
+                        resets = <&usb_clk 0>, <&usb_clk 1>, <&usb_clk 2>;
-                        reset-names = "usb1_reset", "usb2_reset";
+                        reset-names = "usb0_reset", "usb1_reset", "usb2_reset";
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/sun5i-a10s-olinuxino-micro.dts b/arch/arm/boot/dts/sun5i-a10s-olinuxino-micro.dts
index fe3c559ca6a8..bfa742817690 100644
--- a/arch/arm/boot/dts/sun5i-a10s-olinuxino-micro.dts
+++ b/arch/arm/boot/dts/sun5i-a10s-olinuxino-micro.dts
@@ -55,6 +55,12 @@
        model = "Olimex A10s-Olinuxino Micro";
        compatible = "olimex,a10s-olinuxino-micro", "allwinner,sun5i-a10s";
+        aliases {
+                serial0 = &uart0;
+                serial1 = &uart2;
+                serial2 = &uart3;
+        };
        soc@01c00000 {
                emac: ethernet@01c0b000 {
                        pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
index 1b76667f3182..2e7d8263799d 100644
--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
+++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
@@ -18,10 +18,6 @@
        aliases {
                ethernet0 = &emac;
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
        };
        chosen {
@@ -390,8 +386,8 @@
                        reg-names = "phy_ctrl", "pmu1";
                        clocks = <&usb_clk 8>;
                        clock-names = "usb_phy";
-                        resets = <&usb_clk 1>;
+                        resets = <&usb_clk 0>, <&usb_clk 1>;
-                        reset-names = "usb1_reset";
+                        reset-names = "usb0_reset", "usb1_reset";
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/sun5i-a13-hsg-h702.dts b/arch/arm/boot/dts/sun5i-a13-hsg-h702.dts
index eeed1f236ee8..c7be3abd9fcc 100644
--- a/arch/arm/boot/dts/sun5i-a13-hsg-h702.dts
+++ b/arch/arm/boot/dts/sun5i-a13-hsg-h702.dts
@@ -53,6 +53,10 @@
        model = "HSG H702";
        compatible = "hsg,h702", "allwinner,sun5i-a13";
+        aliases {
+                serial0 = &uart1;
+        };
        soc@01c00000 {
                mmc0: mmc@01c0f000 {
                        pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun5i-a13-olinuxino-micro.dts b/arch/arm/boot/dts/sun5i-a13-olinuxino-micro.dts
index 916ee8bb826f..3decefb3c37a 100644
--- a/arch/arm/boot/dts/sun5i-a13-olinuxino-micro.dts
+++ b/arch/arm/boot/dts/sun5i-a13-olinuxino-micro.dts
@@ -54,6 +54,10 @@
        model = "Olimex A13-Olinuxino Micro";
        compatible = "olimex,a13-olinuxino-micro", "allwinner,sun5i-a13";
+        aliases {
+                serial0 = &uart1;
+        };
        soc@01c00000 {
                mmc0: mmc@01c0f000 {
                        pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun5i-a13-olinuxino.dts b/arch/arm/boot/dts/sun5i-a13-olinuxino.dts
index e31d291d14cb..b421f7fa197b 100644
--- a/arch/arm/boot/dts/sun5i-a13-olinuxino.dts
+++ b/arch/arm/boot/dts/sun5i-a13-olinuxino.dts
@@ -55,6 +55,10 @@
        model = "Olimex A13-Olinuxino";
        compatible = "olimex,a13-olinuxino", "allwinner,sun5i-a13";
+        aliases {
+                serial0 = &uart1;
+        };
        soc@01c00000 {
                mmc0: mmc@01c0f000 {
                        pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
index c35217ea1f64..c556688f8b8b 100644
--- a/arch/arm/boot/dts/sun5i-a13.dtsi
+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
@@ -16,11 +16,6 @@
 / {
        interrupt-parent = <&intc>;
-        aliases {
-                serial0 = &uart1;
-                serial1 = &uart3;
-        };
        cpus {
                #address-cells = <1>;
                #size-cells = <0>;
@@ -349,8 +344,8 @@
                        reg-names = "phy_ctrl", "pmu1";
                        clocks = <&usb_clk 8>;
                        clock-names = "usb_phy";
-                        resets = <&usb_clk 1>;
+                        resets = <&usb_clk 0>, <&usb_clk 1>;
-                        reset-names = "usb1_reset";
+                        reset-names = "usb0_reset", "usb1_reset";
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
index f47156b6572b..1e7e7bcf8307 100644
--- a/arch/arm/boot/dts/sun6i-a31.dtsi
+++ b/arch/arm/boot/dts/sun6i-a31.dtsi
@@ -53,12 +53,6 @@
        interrupt-parent = <&gic>;
        aliases {
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
-                serial4 = &uart4;
-                serial5 = &uart5;
                ethernet0 = &gmac;
        };
diff --git a/arch/arm/boot/dts/sun7i-a20-bananapi.dts b/arch/arm/boot/dts/sun7i-a20-bananapi.dts
index 1cf1214cc068..bd7b15add697 100644
--- a/arch/arm/boot/dts/sun7i-a20-bananapi.dts
+++ b/arch/arm/boot/dts/sun7i-a20-bananapi.dts
@@ -55,6 +55,12 @@
        model = "LeMaker Banana Pi";
        compatible = "lemaker,bananapi", "allwinner,sun7i-a20";
+        aliases {
+                serial0 = &uart0;
+                serial1 = &uart3;
+                serial2 = &uart7;
+        };
        soc@01c00000 {
                spi0: spi@01c05000 {
                        pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun7i-a20-hummingbird.dts b/arch/arm/boot/dts/sun7i-a20-hummingbird.dts
index 0e4bfa3b2b85..0bcefcbbb756 100644
--- a/arch/arm/boot/dts/sun7i-a20-hummingbird.dts
+++ b/arch/arm/boot/dts/sun7i-a20-hummingbird.dts
@@ -19,6 +19,14 @@
        model = "Merrii A20 Hummingbird";
        compatible = "merrii,a20-hummingbird", "allwinner,sun7i-a20";
+        aliases {
+                serial0 = &uart0;
+                serial1 = &uart2;
+                serial2 = &uart3;
+                serial3 = &uart4;
+                serial4 = &uart5;
+        };
        soc@01c00000 {
                mmc0: mmc@01c0f000 {
                        pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-micro.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-micro.dts
index 9d669cdf031d..66cc77707198 100644
--- a/arch/arm/boot/dts/sun7i-a20-olinuxino-micro.dts
+++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-micro.dts
@@ -20,6 +20,9 @@
        compatible = "olimex,a20-olinuxino-micro", "allwinner,sun7i-a20";
        aliases {
+                serial0 = &uart0;
+                serial1 = &uart6;
+                serial2 = &uart7;
                spi0 = &spi1;
                spi1 = &spi2;
        };
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index e21ce5992d56..89749ce34a84 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -54,14 +54,6 @@
        aliases {
                ethernet0 = &gmac;
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
-                serial4 = &uart4;
-                serial5 = &uart5;
-                serial6 = &uart6;
-                serial7 = &uart7;
        };
        chosen {
diff --git a/arch/arm/boot/dts/sun8i-a23-ippo-q8h-v5.dts b/arch/arm/boot/dts/sun8i-a23-ippo-q8h-v5.dts
index 7f2117ce6985..32ad80804dbb 100644
--- a/arch/arm/boot/dts/sun8i-a23-ippo-q8h-v5.dts
+++ b/arch/arm/boot/dts/sun8i-a23-ippo-q8h-v5.dts
@@ -55,6 +55,10 @@
        model = "Ippo Q8H Dual Core Tablet (v5)";
        compatible = "ippo,q8h-v5", "allwinner,sun8i-a23";
+        aliases {
+                serial0 = &r_uart;
+        };
        chosen {
                bootargs = "earlyprintk console=ttyS0,115200";
        };
diff --git a/arch/arm/boot/dts/sun8i-a23.dtsi b/arch/arm/boot/dts/sun8i-a23.dtsi
index 0746cd1024d7..86584fcf5e32 100644
--- a/arch/arm/boot/dts/sun8i-a23.dtsi
+++ b/arch/arm/boot/dts/sun8i-a23.dtsi
@@ -52,15 +52,6 @@
 / {
        interrupt-parent = <&gic>;
-        aliases {
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
-                serial4 = &uart4;
-                serial5 = &r_uart;
-        };
        cpus {
                #address-cells = <1>;
                #size-cells = <0>;
diff --git a/arch/arm/boot/dts/sun9i-a80-optimus.dts b/arch/arm/boot/dts/sun9i-a80-optimus.dts
index 506948f582ee..11ec71072e81 100644
--- a/arch/arm/boot/dts/sun9i-a80-optimus.dts
+++ b/arch/arm/boot/dts/sun9i-a80-optimus.dts
@@ -54,6 +54,11 @@
        model = "Merrii A80 Optimus Board";
        compatible = "merrii,a80-optimus", "allwinner,sun9i-a80";
+        aliases {
+                serial0 = &uart0;
+                serial1 = &uart4;
+        };
        chosen {
                bootargs = "earlyprintk console=ttyS0,115200";
        };
diff --git a/arch/arm/boot/dts/sun9i-a80.dtsi b/arch/arm/boot/dts/sun9i-a80.dtsi
index 494714f67b57..9ef4438206a9 100644
--- a/arch/arm/boot/dts/sun9i-a80.dtsi
+++ b/arch/arm/boot/dts/sun9i-a80.dtsi
@@ -52,16 +52,6 @@
 / {
        interrupt-parent = <&gic>;
-        aliases {
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
-                serial4 = &uart4;
-                serial5 = &uart5;
-                serial6 = &r_uart;
-        };
        cpus {
                #address-cells = <1>;
                #size-cells = <0>;
diff --git a/arch/arm/boot/dts/tegra20-seaboard.dts b/arch/arm/boot/dts/tegra20-seaboard.dts
index ea282c7c0ca5..e2fed2712249 100644
--- a/arch/arm/boot/dts/tegra20-seaboard.dts
+++ b/arch/arm/boot/dts/tegra20-seaboard.dts
@@ -406,7 +406,7 @@
                clock-frequency = <400000>;
                magnetometer@c {
-                        compatible = "ak,ak8975";
+                        compatible = "asahi-kasei,ak8975";
                        reg = <0xc>;
                        interrupt-parent = <&gpio>;
                        interrupts = <TEGRA_GPIO(N, 5) IRQ_TYPE_LEVEL_HIGH>;
diff --git a/arch/arm/boot/dts/vf610-twr.dts b/arch/arm/boot/dts/vf610-twr.dts
index a0f762159cb2..f2b64b1b00fa 100644
--- a/arch/arm/boot/dts/vf610-twr.dts
+++ b/arch/arm/boot/dts/vf610-twr.dts
@@ -129,13 +129,28 @@
 &fec0 {
        phy-mode = "rmii";
+        phy-handle = <&ethphy0>;
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_fec0>;
        status = "okay";
+        mdio {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                ethphy0: ethernet-phy@0 {
+                        reg = <0>;
+                };
+                ethphy1: ethernet-phy@1 {
+                        reg = <1>;
+                };
+        };
 };
 &fec1 {
        phy-mode = "rmii";
+        phy-handle = <&ethphy1>;
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_fec1>;
        status = "okay";
diff --git a/arch/arm/configs/exynos_defconfig b/arch/arm/configs/exynos_defconfig
index 5ef14de00a29..3d0c5d65c741 100644
--- a/arch/arm/configs/exynos_defconfig
+++ b/arch/arm/configs/exynos_defconfig
@@ -84,7 +84,8 @@ CONFIG_DEBUG_GPIO=y
 CONFIG_POWER_SUPPLY=y
 CONFIG_BATTERY_SBS=y
 CONFIG_CHARGER_TPS65090=y
-# CONFIG_HWMON is not set
+CONFIG_HWMON=y
+CONFIG_SENSORS_LM90=y
 CONFIG_THERMAL=y
 CONFIG_EXYNOS_THERMAL=y
 CONFIG_EXYNOS_THERMAL_CORE=y
@@ -109,11 +110,26 @@ CONFIG_REGULATOR_S2MPA01=y
 CONFIG_REGULATOR_S2MPS11=y
 CONFIG_REGULATOR_S5M8767=y
 CONFIG_REGULATOR_TPS65090=y
+CONFIG_DRM=y
+CONFIG_DRM_BRIDGE=y
+CONFIG_DRM_PTN3460=y
+CONFIG_DRM_PS8622=y
+CONFIG_DRM_EXYNOS=y
+CONFIG_DRM_EXYNOS_FIMD=y
+CONFIG_DRM_EXYNOS_DP=y
+CONFIG_DRM_PANEL=y
+CONFIG_DRM_PANEL_SIMPLE=y
 CONFIG_FB=y
 CONFIG_FB_MODE_HELPERS=y
 CONFIG_FB_SIMPLE=y
 CONFIG_EXYNOS_VIDEO=y
 CONFIG_EXYNOS_MIPI_DSI=y
+CONFIG_BACKLIGHT_LCD_SUPPORT=y
+CONFIG_LCD_CLASS_DEVICE=y
+CONFIG_LCD_PLATFORM=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BACKLIGHT_GENERIC=y
+CONFIG_BACKLIGHT_PWM=y
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_FONTS=y
 CONFIG_FONT_7x14=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 2328fe752e9c..bc393b7e5ece 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -338,6 +338,7 @@ CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_MVEBU=y
 CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_EXYNOS=y
 CONFIG_USB_EHCI_TEGRA=y
 CONFIG_USB_EHCI_HCD_STI=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index c2c3a852af9f..667d9d52aa01 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -68,7 +68,7 @@ CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
-CONFIG_GENERIC_CPUFREQ_CPU0=y
+CONFIG_CPUFREQ_DT=y
 # CONFIG_ARM_OMAP2PLUS_CPUFREQ is not set
 CONFIG_CPU_IDLE=y
 CONFIG_BINFMT_MISC=y
diff --git a/arch/arm/include/asm/kvm_emulate.h b/arch/arm/include/asm/kvm_emulate.h
index 66ce17655bb9..7b0152321b20 100644
--- a/arch/arm/include/asm/kvm_emulate.h
+++ b/arch/arm/include/asm/kvm_emulate.h
@@ -38,6 +38,16 @@ static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
        vcpu->arch.hcr = HCR_GUEST_MASK;
 }
+static inline unsigned long vcpu_get_hcr(struct kvm_vcpu *vcpu)
+{
+        return vcpu->arch.hcr;
+}
+static inline void vcpu_set_hcr(struct kvm_vcpu *vcpu, unsigned long hcr)
+{
+        vcpu->arch.hcr = hcr;
+}
 static inline bool vcpu_mode_is_32bit(struct kvm_vcpu *vcpu)
 {
        return 1;
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index 254e0650e48b..04b4ea0b550a 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -125,9 +125,6 @@ struct kvm_vcpu_arch {
         * Anything that is not used directly from assembly code goes
         * here.
         */
-        /* dcache set/way operation pending */
-        int last_pcpu;
-        cpumask_t require_dcache_flush;
        /* Don't run the guest on this vcpu */
        bool pause;
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index 63e0ecc04901..1bca8f8af442 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -44,6 +44,7 @@
 #ifndef __ASSEMBLY__
+#include <linux/highmem.h>
 #include <asm/cacheflush.h>
 #include <asm/pgalloc.h>
@@ -161,13 +162,10 @@ static inline bool vcpu_has_cache_enabled(struct kvm_vcpu *vcpu)
        return (vcpu->arch.cp15[c1_SCTLR] & 0b101) == 0b101;
 }
-static inline void coherent_cache_guest_page(struct kvm_vcpu *vcpu, hva_t hva,
+static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
-                                             unsigned long size,
+                                               unsigned long size,
-                                             bool ipa_uncached)
+                                               bool ipa_uncached)
 {
-        if (!vcpu_has_cache_enabled(vcpu) || ipa_uncached)
-                kvm_flush_dcache_to_poc((void *)hva, size);
-        
        /*
         * If we are going to insert an instruction page and the icache is
         * either VIPT or PIPT, there is a potential problem where the host
@@ -179,18 +177,77 @@ static inline void coherent_cache_guest_page(struct kvm_vcpu *vcpu, hva_t hva,
         *
         * VIVT caches are tagged using both the ASID and the VMID and doesn't
         * need any kind of flushing (DDI 0406C.b - Page B3-1392).
+         *
+         * We need to do this through a kernel mapping (using the
+         * user-space mapping has proved to be the wrong
+         * solution). For that, we need to kmap one page at a time,
+         * and iterate over the range.
         */
-        if (icache_is_pipt()) {
-                __cpuc_coherent_user_range(hva, hva + size);
+        bool need_flush = !vcpu_has_cache_enabled(vcpu) || ipa_uncached;
-        } else if (!icache_is_vivt_asid_tagged()) {
+        VM_BUG_ON(size & PAGE_MASK);
+        if (!need_flush && !icache_is_pipt())
+                goto vipt_cache;
+        while (size) {
+                void *va = kmap_atomic_pfn(pfn);
+                if (need_flush)
+                        kvm_flush_dcache_to_poc(va, PAGE_SIZE);
+                if (icache_is_pipt())
+                        __cpuc_coherent_user_range((unsigned long)va,
+                                                   (unsigned long)va + PAGE_SIZE);
+                size -= PAGE_SIZE;
+                pfn++;
+                kunmap_atomic(va);
+        }
+vipt_cache:
+        if (!icache_is_pipt() && !icache_is_vivt_asid_tagged()) {
                /* any kind of VIPT cache */
                __flush_icache_all();
        }
 }
+static inline void __kvm_flush_dcache_pte(pte_t pte)
+{
+        void *va = kmap_atomic(pte_page(pte));
+        kvm_flush_dcache_to_poc(va, PAGE_SIZE);
+        kunmap_atomic(va);
+}
+static inline void __kvm_flush_dcache_pmd(pmd_t pmd)
+{
+        unsigned long size = PMD_SIZE;
+        pfn_t pfn = pmd_pfn(pmd);
+        while (size) {
+                void *va = kmap_atomic_pfn(pfn);
+                kvm_flush_dcache_to_poc(va, PAGE_SIZE);
+                pfn++;
+                size -= PAGE_SIZE;
+                kunmap_atomic(va);
+        }
+}
+static inline void __kvm_flush_dcache_pud(pud_t pud)
+{
+}
 #define kvm_virt_to_phys(x)             virt_to_idmap((unsigned long)(x))
-void stage2_flush_vm(struct kvm *kvm);
+void kvm_set_way_flush(struct kvm_vcpu *vcpu);
+void kvm_toggle_cache(struct kvm_vcpu *vcpu, bool was_enabled);
 #endif  /* !__ASSEMBLY__ */
diff --git a/arch/arm/include/uapi/asm/unistd.h b/arch/arm/include/uapi/asm/unistd.h
index 705bb7620673..0c3f5a0dafd3 100644
--- a/arch/arm/include/uapi/asm/unistd.h
+++ b/arch/arm/include/uapi/asm/unistd.h
@@ -413,6 +413,7 @@
 #define __NR_getrandom                  (__NR_SYSCALL_BASE+384)
 #define __NR_memfd_create               (__NR_SYSCALL_BASE+385)
 #define __NR_bpf                        (__NR_SYSCALL_BASE+386)
+#define __NR_execveat                   (__NR_SYSCALL_BASE+387)
 /*
 * The following SWIs are ARM private.
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index e51833f8cc38..05745eb838c5 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -396,6 +396,7 @@
                CALL(sys_getrandom)
 /* 385 */       CALL(sys_memfd_create)
                CALL(sys_bpf)
+                CALL(sys_execveat)
 #ifndef syscalls_counted
 .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
 #define syscalls_counted
diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
index 4176df721bf0..1a0045abead7 100644
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -253,21 +253,22 @@
        .endm
        .macro  restore_user_regs, fast = 0, offset = 0
-        ldr     r1, [sp, #\offset + S_PSR]      @ get calling cpsr
+        mov     r2, sp
-        ldr     lr, [sp, #\offset + S_PC]!      @ get pc
+        ldr     r1, [r2, #\offset + S_PSR]      @ get calling cpsr
+        ldr     lr, [r2, #\offset + S_PC]!      @ get pc
        msr     spsr_cxsf, r1                   @ save in spsr_svc
 #if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
        @ We must avoid clrex due to Cortex-A15 erratum #830321
-        strex   r1, r2, [sp]                    @ clear the exclusive monitor
+        strex   r1, r2, [r2]                    @ clear the exclusive monitor
 #endif
        .if     \fast
-        ldmdb   sp, {r1 - lr}^                  @ get calling r1 - lr
+        ldmdb   r2, {r1 - lr}^                  @ get calling r1 - lr
        .else
-        ldmdb   sp, {r0 - lr}^                  @ get calling r0 - lr
+        ldmdb   r2, {r0 - lr}^                  @ get calling r0 - lr
        .endif
        mov     r0, r0                          @ ARMv5T and earlier require a nop
                                                @ after ldm {}^
-        add     sp, sp, #S_FRAME_SIZE - S_PC
+        add     sp, sp, #\offset + S_FRAME_SIZE
        movs    pc, lr                          @ return & move spsr_svc into cpsr
        .endm
diff --git a/arch/arm/kernel/entry-v7m.S b/arch/arm/kernel/entry-v7m.S
index 2260f1855820..8944f4991c3c 100644
--- a/arch/arm/kernel/entry-v7m.S
+++ b/arch/arm/kernel/entry-v7m.S
@@ -22,10 +22,12 @@
 __invalid_entry:
        v7m_exception_entry
+#ifdef CONFIG_PRINTK
        adr     r0, strerr
        mrs     r1, ipsr
        mov     r2, lr
        bl      printk
+#endif
        mov     r0, sp
        bl      show_regs
 1:      b       1b
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index f7c65adaa428..557e128e4df0 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -116,8 +116,14 @@ int armpmu_event_set_period(struct perf_event *event)
                ret = 1;
        }
-        if (left > (s64)armpmu->max_period)
+        /*
-                left = armpmu->max_period;
+         * Limit the maximum period to prevent the counter value
+         * from overtaking the one we are about to program. In
+         * effect we are reducing max_period to account for
+         * interrupt latency (and we are being very conservative).
+         */
+        if (left > (armpmu->max_period >> 1))
+                left = armpmu->max_period >> 1;
        local64_set(&hwc->prev_count, (u64)-left);
diff --git a/arch/arm/kernel/perf_regs.c b/arch/arm/kernel/perf_regs.c
index 6e4379c67cbc..592dda3f21ff 100644
--- a/arch/arm/kernel/perf_regs.c
+++ b/arch/arm/kernel/perf_regs.c
@@ -28,3 +28,11 @@ u64 perf_reg_abi(struct task_struct *task)
 {
        return PERF_SAMPLE_REGS_ABI_32;
 }
+void perf_get_regs_user(struct perf_regs *regs_user,
+                        struct pt_regs *regs,
+                        struct pt_regs *regs_user_copy)
+{
+        regs_user->regs = task_pt_regs(current);
+        regs_user->abi = perf_reg_abi(current);
+}
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index f9c863911038..e55408e96559 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -657,10 +657,13 @@ int __init arm_add_memory(u64 start, u64 size)
        /*
         * Ensure that start/size are aligned to a page boundary.
-         * Size is appropriately rounded down, start is rounded up.
+         * Size is rounded down, start is rounded up.
         */
-        size -= start & ~PAGE_MASK;
        aligned_start = PAGE_ALIGN(start);
+        if (aligned_start > start + size)
+                size = 0;
+        else
+                size -= aligned_start - start;
 #ifndef CONFIG_ARCH_PHYS_ADDR_T_64BIT
        if (aligned_start > ULONG_MAX) {
@@ -1046,6 +1049,15 @@ static int c_show(struct seq_file *m, void *v)
                seq_printf(m, "model name\t: %s rev %d (%s)\n",
                           cpu_name, cpuid & 15, elf_platform);
+#if defined(CONFIG_SMP)
+                seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
+                           per_cpu(cpu_data, i).loops_per_jiffy / (500000UL/HZ),
+                           (per_cpu(cpu_data, i).loops_per_jiffy / (5000UL/HZ)) % 100);
+#else
+                seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
+                           loops_per_jiffy / (500000/HZ),
+                           (loops_per_jiffy / (5000/HZ)) % 100);
+#endif
                /* dump out the processor features */
                seq_puts(m, "Features\t: ");
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 5e6052e18850..86ef244c5a24 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -387,6 +387,18 @@ asmlinkage void secondary_start_kernel(void)
 void __init smp_cpus_done(unsigned int max_cpus)
 {
+        int cpu;
+        unsigned long bogosum = 0;
+        for_each_online_cpu(cpu)
+                bogosum += per_cpu(cpu_data, cpu).loops_per_jiffy;
+        printk(KERN_INFO "SMP: Total of %d processors activated "
+               "(%lu.%02lu BogoMIPS).\n",
+               num_online_cpus(),
+               bogosum / (500000/HZ),
+               (bogosum / (5000/HZ)) % 100);
        hyp_mode_check();
 }
diff --git a/arch/arm/kvm/Kconfig b/arch/arm/kvm/Kconfig
index 466bd299b1a8..3afee5f40f4f 100644
--- a/arch/arm/kvm/Kconfig
+++ b/arch/arm/kvm/Kconfig
@@ -23,6 +23,7 @@ config KVM
        select HAVE_KVM_CPU_RELAX_INTERCEPT
        select KVM_MMIO
        select KVM_ARM_HOST
+        select SRCU
        depends on ARM_VIRT_EXT && ARM_LPAE
        ---help---
          Support hosting virtualized guest machines. You will also
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 2d6d91001062..0b0d58a905c4 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -281,15 +281,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
        vcpu->cpu = cpu;
        vcpu->arch.host_cpu_context = this_cpu_ptr(kvm_host_cpu_state);
-        /*
-         * Check whether this vcpu requires the cache to be flushed on
-         * this physical CPU. This is a consequence of doing dcache
-         * operations by set/way on this vcpu. We do it here to be in
-         * a non-preemptible section.
-         */
-        if (cpumask_test_and_clear_cpu(cpu, &vcpu->arch.require_dcache_flush))
-                flush_cache_all(); /* We'd really want v7_flush_dcache_all() */
        kvm_arm_set_running_vcpu(vcpu);
 }
@@ -541,7 +532,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
                ret = kvm_call_hyp(__kvm_vcpu_run, vcpu);
                vcpu->mode = OUTSIDE_GUEST_MODE;
-                vcpu->arch.last_pcpu = smp_processor_id();
                kvm_guest_exit();
                trace_kvm_exit(*vcpu_pc(vcpu));
                /*
diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
index 7928dbdf2102..f3d88dc388bc 100644
--- a/arch/arm/kvm/coproc.c
+++ b/arch/arm/kvm/coproc.c
@@ -189,82 +189,40 @@ static bool access_l2ectlr(struct kvm_vcpu *vcpu,
        return true;
 }
-/* See note at ARM ARM B1.14.4 */
+/*
+ * See note at ARMv7 ARM B1.14.4 (TL;DR: S/W ops are not easily virtualized).
+ */
 static bool access_dcsw(struct kvm_vcpu *vcpu,
                        const struct coproc_params *p,
                        const struct coproc_reg *r)
 {
-        unsigned long val;
-        int cpu;
        if (!p->is_write)
                return read_from_write_only(vcpu, p);
-        cpu = get_cpu();
+        kvm_set_way_flush(vcpu);
-        cpumask_setall(&vcpu->arch.require_dcache_flush);
-        cpumask_clear_cpu(cpu, &vcpu->arch.require_dcache_flush);
-        /* If we were already preempted, take the long way around */
-        if (cpu != vcpu->arch.last_pcpu) {
-                flush_cache_all();
-                goto done;
-        }
-        val = *vcpu_reg(vcpu, p->Rt1);
-        switch (p->CRm) {
-        case 6:                 /* Upgrade DCISW to DCCISW, as per HCR.SWIO */
-        case 14:                /* DCCISW */
-                asm volatile("mcr p15, 0, %0, c7, c14, 2" : : "r" (val));
-                break;
-        case 10:                /* DCCSW */
-                asm volatile("mcr p15, 0, %0, c7, c10, 2" : : "r" (val));
-                break;
-        }
-done:
-        put_cpu();
        return true;
 }
 /*
 * Generic accessor for VM registers. Only called as long as HCR_TVM
- * is set.
+ * is set.  If the guest enables the MMU, we stop trapping the VM
+ * sys_regs and leave it in complete control of the caches.
+ *
+ * Used by the cpu-specific code.
 */
-static bool access_vm_reg(struct kvm_vcpu *vcpu,
+bool access_vm_reg(struct kvm_vcpu *vcpu,
-                          const struct coproc_params *p,
+                   const struct coproc_params *p,
-                          const struct coproc_reg *r)
+                   const struct coproc_reg *r)
 {
+        bool was_enabled = vcpu_has_cache_enabled(vcpu);
        BUG_ON(!p->is_write);
        vcpu->arch.cp15[r->reg] = *vcpu_reg(vcpu, p->Rt1);
        if (p->is_64bit)
                vcpu->arch.cp15[r->reg + 1] = *vcpu_reg(vcpu, p->Rt2);
-        return true;
+        kvm_toggle_cache(vcpu, was_enabled);
-}
-/*
- * SCTLR accessor. Only called as long as HCR_TVM is set.  If the
- * guest enables the MMU, we stop trapping the VM sys_regs and leave
- * it in complete control of the caches.
- *
- * Used by the cpu-specific code.
- */
-bool access_sctlr(struct kvm_vcpu *vcpu,
-                  const struct coproc_params *p,
-                  const struct coproc_reg *r)
-{
-        access_vm_reg(vcpu, p, r);
-        if (vcpu_has_cache_enabled(vcpu)) {     /* MMU+Caches enabled? */
-                vcpu->arch.hcr &= ~HCR_TVM;
-                stage2_flush_vm(vcpu->kvm);
-        }
        return true;
 }
diff --git a/arch/arm/kvm/coproc.h b/arch/arm/kvm/coproc.h
index 1a44bbe39643..88d24a3a9778 100644
--- a/arch/arm/kvm/coproc.h
+++ b/arch/arm/kvm/coproc.h
@@ -153,8 +153,8 @@ static inline int cmp_reg(const struct coproc_reg *i1,
 #define is64            .is_64 = true
 #define is32            .is_64 = false
-bool access_sctlr(struct kvm_vcpu *vcpu,
+bool access_vm_reg(struct kvm_vcpu *vcpu,
-                  const struct coproc_params *p,
+                   const struct coproc_params *p,
-                  const struct coproc_reg *r);
+                   const struct coproc_reg *r);
 #endif /* __ARM_KVM_COPROC_LOCAL_H__ */
diff --git a/arch/arm/kvm/coproc_a15.c b/arch/arm/kvm/coproc_a15.c
index e6f4ae48bda9..a7136757d373 100644
--- a/arch/arm/kvm/coproc_a15.c
+++ b/arch/arm/kvm/coproc_a15.c
@@ -34,7 +34,7 @@
 static const struct coproc_reg a15_regs[] = {
        /* SCTLR: swapped by interrupt.S. */
        { CRn( 1), CRm( 0), Op1( 0), Op2( 0), is32,
-                        access_sctlr, reset_val, c1_SCTLR, 0x00C50078 },
+                        access_vm_reg, reset_val, c1_SCTLR, 0x00C50078 },
 };
 static struct kvm_coproc_target_table a15_target_table = {
diff --git a/arch/arm/kvm/coproc_a7.c b/arch/arm/kvm/coproc_a7.c
index 17fc7cd479d3..b19e46d1b2c0 100644
--- a/arch/arm/kvm/coproc_a7.c
+++ b/arch/arm/kvm/coproc_a7.c
@@ -37,7 +37,7 @@
 static const struct coproc_reg a7_regs[] = {
        /* SCTLR: swapped by interrupt.S. */
        { CRn( 1), CRm( 0), Op1( 0), Op2( 0), is32,
-                        access_sctlr, reset_val, c1_SCTLR, 0x00C50878 },
+                        access_vm_reg, reset_val, c1_SCTLR, 0x00C50878 },
 };
 static struct kvm_coproc_target_table a7_target_table = {
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 1dc9778a00af..136662547ca6 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -58,6 +58,26 @@ static void kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
                kvm_call_hyp(__kvm_tlb_flush_vmid_ipa, kvm, ipa);
 }
+/*
+ * D-Cache management functions. They take the page table entries by
+ * value, as they are flushing the cache using the kernel mapping (or
+ * kmap on 32bit).
+ */
+static void kvm_flush_dcache_pte(pte_t pte)
+{
+        __kvm_flush_dcache_pte(pte);
+}
+static void kvm_flush_dcache_pmd(pmd_t pmd)
+{
+        __kvm_flush_dcache_pmd(pmd);
+}
+static void kvm_flush_dcache_pud(pud_t pud)
+{
+        __kvm_flush_dcache_pud(pud);
+}
 static int mmu_topup_memory_cache(struct kvm_mmu_memory_cache *cache,
                                  int min, int max)
 {
@@ -119,6 +139,26 @@ static void clear_pmd_entry(struct kvm *kvm, pmd_t *pmd, phys_addr_t addr)
        put_page(virt_to_page(pmd));
 }
+/*
+ * Unmapping vs dcache management:
+ *
+ * If a guest maps certain memory pages as uncached, all writes will
+ * bypass the data cache and go directly to RAM.  However, the CPUs
+ * can still speculate reads (not writes) and fill cache lines with
+ * data.
+ *
+ * Those cache lines will be *clean* cache lines though, so a
+ * clean+invalidate operation is equivalent to an invalidate
+ * operation, because no cache lines are marked dirty.
+ *
+ * Those clean cache lines could be filled prior to an uncached write
+ * by the guest, and the cache coherent IO subsystem would therefore
+ * end up writing old data to disk.
+ *
+ * This is why right after unmapping a page/section and invalidating
+ * the corresponding TLBs, we call kvm_flush_dcache_p*() to make sure
+ * the IO subsystem will never hit in the cache.
+ */
 static void unmap_ptes(struct kvm *kvm, pmd_t *pmd,
                       phys_addr_t addr, phys_addr_t end)
 {
@@ -128,9 +168,16 @@ static void unmap_ptes(struct kvm *kvm, pmd_t *pmd,
        start_pte = pte = pte_offset_kernel(pmd, addr);
        do {
                if (!pte_none(*pte)) {
+                        pte_t old_pte = *pte;
                        kvm_set_pte(pte, __pte(0));
-                        put_page(virt_to_page(pte));
                        kvm_tlb_flush_vmid_ipa(kvm, addr);
+                        /* No need to invalidate the cache for device mappings */
+                        if ((pte_val(old_pte) & PAGE_S2_DEVICE) != PAGE_S2_DEVICE)
+                                kvm_flush_dcache_pte(old_pte);
+                        put_page(virt_to_page(pte));
                }
        } while (pte++, addr += PAGE_SIZE, addr != end);
@@ -149,8 +196,13 @@ static void unmap_pmds(struct kvm *kvm, pud_t *pud,
                next = kvm_pmd_addr_end(addr, end);
                if (!pmd_none(*pmd)) {
                        if (kvm_pmd_huge(*pmd)) {
+                                pmd_t old_pmd = *pmd;
                                pmd_clear(pmd);
                                kvm_tlb_flush_vmid_ipa(kvm, addr);
+                                kvm_flush_dcache_pmd(old_pmd);
                                put_page(virt_to_page(pmd));
                        } else {
                                unmap_ptes(kvm, pmd, addr, next);
@@ -173,8 +225,13 @@ static void unmap_puds(struct kvm *kvm, pgd_t *pgd,
                next = kvm_pud_addr_end(addr, end);
                if (!pud_none(*pud)) {
                        if (pud_huge(*pud)) {
+                                pud_t old_pud = *pud;
                                pud_clear(pud);
                                kvm_tlb_flush_vmid_ipa(kvm, addr);
+                                kvm_flush_dcache_pud(old_pud);
                                put_page(virt_to_page(pud));
                        } else {
                                unmap_pmds(kvm, pud, addr, next);
@@ -209,10 +266,9 @@ static void stage2_flush_ptes(struct kvm *kvm, pmd_t *pmd,
        pte = pte_offset_kernel(pmd, addr);
        do {
-                if (!pte_none(*pte)) {
+                if (!pte_none(*pte) &&
-                        hva_t hva = gfn_to_hva(kvm, addr >> PAGE_SHIFT);
+                    (pte_val(*pte) & PAGE_S2_DEVICE) != PAGE_S2_DEVICE)
-                        kvm_flush_dcache_to_poc((void*)hva, PAGE_SIZE);
+                        kvm_flush_dcache_pte(*pte);
-                }
        } while (pte++, addr += PAGE_SIZE, addr != end);
 }
@@ -226,12 +282,10 @@ static void stage2_flush_pmds(struct kvm *kvm, pud_t *pud,
        do {
                next = kvm_pmd_addr_end(addr, end);
                if (!pmd_none(*pmd)) {
-                        if (kvm_pmd_huge(*pmd)) {
+                        if (kvm_pmd_huge(*pmd))
-                                hva_t hva = gfn_to_hva(kvm, addr >> PAGE_SHIFT);
+                                kvm_flush_dcache_pmd(*pmd);
-                                kvm_flush_dcache_to_poc((void*)hva, PMD_SIZE);
+                        else
-                        } else {
                                stage2_flush_ptes(kvm, pmd, addr, next);
-                        }
                }
        } while (pmd++, addr = next, addr != end);
 }
@@ -246,12 +300,10 @@ static void stage2_flush_puds(struct kvm *kvm, pgd_t *pgd,
        do {
                next = kvm_pud_addr_end(addr, end);
                if (!pud_none(*pud)) {
-                        if (pud_huge(*pud)) {
+                        if (pud_huge(*pud))
-                                hva_t hva = gfn_to_hva(kvm, addr >> PAGE_SHIFT);
+                                kvm_flush_dcache_pud(*pud);
-                                kvm_flush_dcache_to_poc((void*)hva, PUD_SIZE);
+                        else
-                        } else {
                                stage2_flush_pmds(kvm, pud, addr, next);
-                        }
                }
        } while (pud++, addr = next, addr != end);
 }
@@ -278,7 +330,7 @@ static void stage2_flush_memslot(struct kvm *kvm,
 * Go through the stage 2 page tables and invalidate any cache lines
 * backing memory already mapped to the VM.
 */
-void stage2_flush_vm(struct kvm *kvm)
+static void stage2_flush_vm(struct kvm *kvm)
 {
        struct kvm_memslots *slots;
        struct kvm_memory_slot *memslot;
@@ -905,6 +957,12 @@ static bool kvm_is_device_pfn(unsigned long pfn)
        return !pfn_valid(pfn);
 }
+static void coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
+                                      unsigned long size, bool uncached)
+{
+        __coherent_cache_guest_page(vcpu, pfn, size, uncached);
+}
 static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
                          struct kvm_memory_slot *memslot, unsigned long hva,
                          unsigned long fault_status)
@@ -994,8 +1052,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
                        kvm_set_s2pmd_writable(&new_pmd);
                        kvm_set_pfn_dirty(pfn);
                }
-                coherent_cache_guest_page(vcpu, hva & PMD_MASK, PMD_SIZE,
+                coherent_cache_guest_page(vcpu, pfn, PMD_SIZE, fault_ipa_uncached);
-                                          fault_ipa_uncached);
                ret = stage2_set_pmd_huge(kvm, memcache, fault_ipa, &new_pmd);
        } else {
                pte_t new_pte = pfn_pte(pfn, mem_type);
@@ -1003,8 +1060,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
                        kvm_set_s2pte_writable(&new_pte);
                        kvm_set_pfn_dirty(pfn);
                }
-                coherent_cache_guest_page(vcpu, hva, PAGE_SIZE,
+                coherent_cache_guest_page(vcpu, pfn, PAGE_SIZE, fault_ipa_uncached);
-                                          fault_ipa_uncached);
                ret = stage2_set_pte(kvm, memcache, fault_ipa, &new_pte,
                        pgprot_val(mem_type) == pgprot_val(PAGE_S2_DEVICE));
        }
@@ -1411,3 +1467,71 @@ void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
        unmap_stage2_range(kvm, gpa, size);
        spin_unlock(&kvm->mmu_lock);
 }
+/*
+ * See note at ARMv7 ARM B1.14.4 (TL;DR: S/W ops are not easily virtualized).
+ *
+ * Main problems:
+ * - S/W ops are local to a CPU (not broadcast)
+ * - We have line migration behind our back (speculation)
+ * - System caches don't support S/W at all (damn!)
+ *
+ * In the face of the above, the best we can do is to try and convert
+ * S/W ops to VA ops. Because the guest is not allowed to infer the
+ * S/W to PA mapping, it can only use S/W to nuke the whole cache,
+ * which is a rather good thing for us.
+ *
+ * Also, it is only used when turning caches on/off ("The expected
+ * usage of the cache maintenance instructions that operate by set/way
+ * is associated with the cache maintenance instructions associated
+ * with the powerdown and powerup of caches, if this is required by
+ * the implementation.").
+ *
+ * We use the following policy:
+ *
+ * - If we trap a S/W operation, we enable VM trapping to detect
+ *   caches being turned on/off, and do a full clean.
+ *
+ * - We flush the caches on both caches being turned on and off.
+ *
+ * - Once the caches are enabled, we stop trapping VM ops.
+ */
+void kvm_set_way_flush(struct kvm_vcpu *vcpu)
+{
+        unsigned long hcr = vcpu_get_hcr(vcpu);
+        /*
+         * If this is the first time we do a S/W operation
+         * (i.e. HCR_TVM not set) flush the whole memory, and set the
+         * VM trapping.
+         *
+         * Otherwise, rely on the VM trapping to wait for the MMU +
+         * Caches to be turned off. At that point, we'll be able to
+         * clean the caches again.
+         */
+        if (!(hcr & HCR_TVM)) {
+                trace_kvm_set_way_flush(*vcpu_pc(vcpu),
+                                        vcpu_has_cache_enabled(vcpu));
+                stage2_flush_vm(vcpu->kvm);
+                vcpu_set_hcr(vcpu, hcr | HCR_TVM);
+        }
+}
+void kvm_toggle_cache(struct kvm_vcpu *vcpu, bool was_enabled)
+{
+        bool now_enabled = vcpu_has_cache_enabled(vcpu);
+        /*
+         * If switching the MMU+caches on, need to invalidate the caches.
+         * If switching it off, need to clean the caches.
+         * Clean + invalidate does the trick always.
+         */
+        if (now_enabled != was_enabled)
+                stage2_flush_vm(vcpu->kvm);
+        /* Caches are now on, stop trapping VM ops (until a S/W op) */
+        if (now_enabled)
+                vcpu_set_hcr(vcpu, vcpu_get_hcr(vcpu) & ~HCR_TVM);
+        trace_kvm_toggle_cache(*vcpu_pc(vcpu), was_enabled, now_enabled);
+}
diff --git a/arch/arm/kvm/trace.h b/arch/arm/kvm/trace.h
index b1d640f78623..b6a6e7102201 100644
--- a/arch/arm/kvm/trace.h
+++ b/arch/arm/kvm/trace.h
@@ -223,6 +223,45 @@ TRACE_EVENT(kvm_hvc,
                  __entry->vcpu_pc, __entry->r0, __entry->imm)
 );
+TRACE_EVENT(kvm_set_way_flush,
+            TP_PROTO(unsigned long vcpu_pc, bool cache),
+            TP_ARGS(vcpu_pc, cache),
+            TP_STRUCT__entry(
+                    __field(    unsigned long,  vcpu_pc         )
+                    __field(    bool,           cache           )
+            ),
+            TP_fast_assign(
+                    __entry->vcpu_pc            = vcpu_pc;
+                    __entry->cache              = cache;
+            ),
+            TP_printk("S/W flush at 0x%016lx (cache %s)",
+                      __entry->vcpu_pc, __entry->cache ? "on" : "off")
+);
+TRACE_EVENT(kvm_toggle_cache,
+            TP_PROTO(unsigned long vcpu_pc, bool was, bool now),
+            TP_ARGS(vcpu_pc, was, now),
+            TP_STRUCT__entry(
+                    __field(    unsigned long,  vcpu_pc         )
+                    __field(    bool,           was             )
+                    __field(    bool,           now             )
+            ),
+            TP_fast_assign(
+                    __entry->vcpu_pc            = vcpu_pc;
+                    __entry->was                = was;
+                    __entry->now                = now;
+            ),
+            TP_printk("VM op at 0x%016lx (cache was %s, now %s)",
+                      __entry->vcpu_pc, __entry->was ? "on" : "off",
+                      __entry->now ? "on" : "off")
+);
 #endif /* _TRACE_KVM_H */
 #undef TRACE_INCLUDE_PATH
diff --git a/arch/arm/mach-at91/board-dt-sama5.c b/arch/arm/mach-at91/board-dt-sama5.c
index 8fb9ef5333f1..97f7367d32b8 100644
--- a/arch/arm/mach-at91/board-dt-sama5.c
+++ b/arch/arm/mach-at91/board-dt-sama5.c
@@ -17,6 +17,7 @@
 #include <linux/of_platform.h>
 #include <linux/phy.h>
 #include <linux/clk-provider.h>
+#include <linux/phy.h>
 #include <asm/setup.h>
 #include <asm/irq.h>
@@ -26,8 +27,25 @@
 #include "generic.h"
+static int ksz8081_phy_fixup(struct phy_device *phy)
+{
+        int value;
+        value = phy_read(phy, 0x16);
+        value &= ~0x20;
+        phy_write(phy, 0x16, value);
+        return 0;
+}
 static void __init sama5_dt_device_init(void)
 {
+        if (of_machine_is_compatible("atmel,sama5d4ek") &&
+           IS_ENABLED(CONFIG_PHYLIB)) {
+                phy_register_fixup_for_id("fc028000.etherne:00",
+                                                ksz8081_phy_fixup);
+        }
        of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
 }
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index 5951660d1bd2..2daef619d053 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -144,7 +144,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
                post_div_table[1].div = 1;
                post_div_table[2].div = 1;
                video_div_table[1].div = 1;
-                video_div_table[2].div = 1;
+                video_div_table[3].div = 1;
        }
        clk[IMX6QDL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 2, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
diff --git a/arch/arm/mach-imx/clk-imx6sx.c b/arch/arm/mach-imx/clk-imx6sx.c
index 17354a11356f..5a3e5a159e70 100644
--- a/arch/arm/mach-imx/clk-imx6sx.c
+++ b/arch/arm/mach-imx/clk-imx6sx.c
@@ -558,6 +558,9 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
        clk_set_parent(clks[IMX6SX_CLK_GPU_CORE_SEL], clks[IMX6SX_CLK_PLL3_PFD0]);
        clk_set_parent(clks[IMX6SX_CLK_GPU_AXI_SEL], clks[IMX6SX_CLK_PLL3_PFD0]);
+        clk_set_parent(clks[IMX6SX_CLK_QSPI1_SEL], clks[IMX6SX_CLK_PLL2_BUS]);
+        clk_set_parent(clks[IMX6SX_CLK_QSPI2_SEL], clks[IMX6SX_CLK_PLL2_BUS]);
        /* Set initial power mode */
        imx6q_set_lpm(WAIT_CLOCKED);
 }
diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
index 3585cb394e9b..ccef8806bb58 100644
--- a/arch/arm/mach-mvebu/coherency.c
+++ b/arch/arm/mach-mvebu/coherency.c
@@ -190,6 +190,13 @@ static void __init armada_375_380_coherency_init(struct device_node *np)
        arch_ioremap_caller = armada_pcie_wa_ioremap_caller;
        /*
+         * We should switch the PL310 to I/O coherency mode only if
+         * I/O coherency is actually enabled.
+         */
+        if (!coherency_available())
+                return;
+        /*
         * Add the PL310 property "arm,io-coherent". This makes sure the
         * outer sync operation is not used, which allows to
         * workaround the system erratum that causes deadlocks when
@@ -246,9 +253,14 @@ static int coherency_type(void)
        return type;
 }
+/*
+ * As a precaution, we currently completely disable hardware I/O
+ * coherency, until enough testing is done with automatic I/O
+ * synchronization barriers to validate that it is a proper solution.
+ */
 int coherency_available(void)
 {
-        return coherency_type() != COHERENCY_FABRIC_TYPE_NONE;
+        return false;
 }
 int __init coherency_init(void)
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index 608079a1aba6..b61c049f92d6 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -77,6 +77,24 @@ MACHINE_END
 #endif
 #ifdef CONFIG_ARCH_OMAP3
+/* Some boards need board name for legacy userspace in /proc/cpuinfo */
+static const char *const n900_boards_compat[] __initconst = {
+        "nokia,omap3-n900",
+        NULL,
+};
+DT_MACHINE_START(OMAP3_N900_DT, "Nokia RX-51 board")
+        .reserve        = omap_reserve,
+        .map_io         = omap3_map_io,
+        .init_early     = omap3430_init_early,
+        .init_machine   = omap_generic_init,
+        .init_late      = omap3_init_late,
+        .init_time      = omap3_sync32k_timer_init,
+        .dt_compat      = n900_boards_compat,
+        .restart        = omap3xxx_restart,
+MACHINE_END
+/* Generic omap3 boards, most boards can use these */
 static const char *const omap3_boards_compat[] __initconst = {
        "ti,omap3430",
        "ti,omap3",
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index 377eea849e7b..64e44d6d07c0 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -211,6 +211,7 @@ extern struct device *omap2_get_iva_device(void);
 extern struct device *omap2_get_l3_device(void);
 extern struct device *omap4_get_dsp_device(void);
+unsigned int omap4_xlate_irq(unsigned int hwirq);
 void omap_gic_of_init(void);
 #ifdef CONFIG_CACHE_L2X0
@@ -249,6 +250,7 @@ extern void omap4_cpu_die(unsigned int cpu);
 extern struct smp_operations omap4_smp_ops;
 extern void omap5_secondary_startup(void);
+extern void omap5_secondary_hyp_startup(void);
 #endif
 #if defined(CONFIG_SMP) && defined(CONFIG_PM)
diff --git a/arch/arm/mach-omap2/control.h b/arch/arm/mach-omap2/control.h
index a3c013345c45..a80ac2d70bb1 100644
--- a/arch/arm/mach-omap2/control.h
+++ b/arch/arm/mach-omap2/control.h
@@ -286,6 +286,10 @@
 #define OMAP5XXX_CONTROL_STATUS                0x134
 #define OMAP5_DEVICETYPE_MASK          (0x7 << 6)
+/* DRA7XX CONTROL CORE BOOTSTRAP */
+#define DRA7_CTRL_CORE_BOOTSTRAP        0x6c4
+#define DRA7_SPEEDSELECT_MASK           (0x3 << 8)
 /*
 * REVISIT: This list of registers is not comprehensive - there are more
 * that should be added.
diff --git a/arch/arm/mach-omap2/omap-headsmp.S b/arch/arm/mach-omap2/omap-headsmp.S
index 4993d4bfe9b2..6d1dffca6c7b 100644
--- a/arch/arm/mach-omap2/omap-headsmp.S
+++ b/arch/arm/mach-omap2/omap-headsmp.S
@@ -22,6 +22,7 @@
 /* Physical address needed since MMU not enabled yet on secondary core */
 #define AUX_CORE_BOOT0_PA                       0x48281800
+#define API_HYP_ENTRY                           0x102
 /*
 * OMAP5 specific entry point for secondary CPU to jump from ROM
@@ -41,6 +42,26 @@ wait:	ldr	r2, =AUX_CORE_BOOT0_PA	@ read from AuxCoreBoot0
        b       secondary_startup
 ENDPROC(omap5_secondary_startup)
 /*
+ * Same as omap5_secondary_startup except we call into the ROM to
+ * enable HYP mode first.  This is called instead of
+ * omap5_secondary_startup if the primary CPU was put into HYP mode by
+ * the boot loader.
+ */
+ENTRY(omap5_secondary_hyp_startup)
+wait_2: ldr     r2, =AUX_CORE_BOOT0_PA  @ read from AuxCoreBoot0
+        ldr     r0, [r2]
+        mov     r0, r0, lsr #5
+        mrc     p15, 0, r4, c0, c0, 5
+        and     r4, r4, #0x0f
+        cmp     r0, r4
+        bne     wait_2
+        ldr     r12, =API_HYP_ENTRY
+        adr     r0, hyp_boot
+        smc     #0
+hyp_boot:
+        b       secondary_startup
+ENDPROC(omap5_secondary_hyp_startup)
+/*
 * OMAP4 specific entry point for secondary CPU to jump from ROM
 * code.  This routine also provides a holding flag into which
 * secondary core is held until we're ready for it to initialise.
diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
index 256e84ef0f67..5305ec7341ec 100644
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -22,6 +22,7 @@
 #include <linux/irqchip/arm-gic.h>
 #include <asm/smp_scu.h>
+#include <asm/virt.h>
 #include "omap-secure.h"
 #include "omap-wakeupgen.h"
@@ -227,8 +228,16 @@ static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
        if (omap_secure_apis_support())
                omap_auxcoreboot_addr(virt_to_phys(startup_addr));
        else
-                writel_relaxed(virt_to_phys(omap5_secondary_startup),
+                /*
-                               base + OMAP_AUX_CORE_BOOT_1);
+                 * If the boot CPU is in HYP mode then start secondary
+                 * CPU in HYP mode as well.
+                 */
+                if ((__boot_cpu_mode & MODE_MASK) == HYP_MODE)
+                        writel_relaxed(virt_to_phys(omap5_secondary_hyp_startup),
+                                       base + OMAP_AUX_CORE_BOOT_1);
+                else
+                        writel_relaxed(virt_to_phys(omap5_secondary_startup),
+                                       base + OMAP_AUX_CORE_BOOT_1);
 }
diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
index b7cb44abe49b..cc30e49a4cc2 100644
--- a/arch/arm/mach-omap2/omap4-common.c
+++ b/arch/arm/mach-omap2/omap4-common.c
@@ -256,6 +256,38 @@ static int __init omap4_sar_ram_init(void)
 }
 omap_early_initcall(omap4_sar_ram_init);
+static struct of_device_id gic_match[] = {
+        { .compatible = "arm,cortex-a9-gic", },
+        { .compatible = "arm,cortex-a15-gic", },
+        { },
+};
+static struct device_node *gic_node;
+unsigned int omap4_xlate_irq(unsigned int hwirq)
+{
+        struct of_phandle_args irq_data;
+        unsigned int irq;
+        if (!gic_node)
+                gic_node = of_find_matching_node(NULL, gic_match);
+        if (WARN_ON(!gic_node))
+                return hwirq;
+        irq_data.np = gic_node;
+        irq_data.args_count = 3;
+        irq_data.args[0] = 0;
+        irq_data.args[1] = hwirq - OMAP44XX_IRQ_GIC_START;
+        irq_data.args[2] = IRQ_TYPE_LEVEL_HIGH;
+        irq = irq_create_of_mapping(&irq_data);
+        if (WARN_ON(!irq))
+                irq = hwirq;
+        return irq;
+}
 void __init omap_gic_of_init(void)
 {
        struct device_node *np;
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index cbb908dc5cf0..9025ffffd2dc 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -3534,9 +3534,15 @@ int omap_hwmod_fill_resources(struct omap_hwmod *oh, struct resource *res)
        mpu_irqs_cnt = _count_mpu_irqs(oh);
        for (i = 0; i < mpu_irqs_cnt; i++) {
+                unsigned int irq;
+                if (oh->xlate_irq)
+                        irq = oh->xlate_irq((oh->mpu_irqs + i)->irq);
+                else
+                        irq = (oh->mpu_irqs + i)->irq;
                (res + r)->name = (oh->mpu_irqs + i)->name;
-                (res + r)->start = (oh->mpu_irqs + i)->irq;
+                (res + r)->start = irq;
-                (res + r)->end = (oh->mpu_irqs + i)->irq;
+                (res + r)->end = irq;
                (res + r)->flags = IORESOURCE_IRQ;
                r++;
        }
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index 35ca6efbec31..5b42fafcaf55 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -676,6 +676,7 @@ struct omap_hwmod {
        spinlock_t                      _lock;
        struct list_head                node;
        struct omap_hwmod_ocp_if        *_mpu_port;
+        unsigned int                    (*xlate_irq)(unsigned int);
        u16                             flags;
        u8                              mpu_rt_idx;
        u8                              response_lat;
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index c314b3c31117..f5e68a782025 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -479,6 +479,7 @@ static struct omap_hwmod omap44xx_dma_system_hwmod = {
        .class          = &omap44xx_dma_hwmod_class,
        .clkdm_name     = "l3_dma_clkdm",
        .mpu_irqs       = omap44xx_dma_system_irqs,
+        .xlate_irq      = omap4_xlate_irq,
        .main_clk       = "l3_div_ck",
        .prcm = {
                .omap4 = {
@@ -640,6 +641,7 @@ static struct omap_hwmod omap44xx_dss_dispc_hwmod = {
        .class          = &omap44xx_dispc_hwmod_class,
        .clkdm_name     = "l3_dss_clkdm",
        .mpu_irqs       = omap44xx_dss_dispc_irqs,
+        .xlate_irq      = omap4_xlate_irq,
        .sdma_reqs      = omap44xx_dss_dispc_sdma_reqs,
        .main_clk       = "dss_dss_clk",
        .prcm = {
@@ -693,6 +695,7 @@ static struct omap_hwmod omap44xx_dss_dsi1_hwmod = {
        .class          = &omap44xx_dsi_hwmod_class,
        .clkdm_name     = "l3_dss_clkdm",
        .mpu_irqs       = omap44xx_dss_dsi1_irqs,
+        .xlate_irq      = omap4_xlate_irq,
        .sdma_reqs      = omap44xx_dss_dsi1_sdma_reqs,
        .main_clk       = "dss_dss_clk",
        .prcm = {
@@ -726,6 +729,7 @@ static struct omap_hwmod omap44xx_dss_dsi2_hwmod = {
        .class          = &omap44xx_dsi_hwmod_class,
        .clkdm_name     = "l3_dss_clkdm",
        .mpu_irqs       = omap44xx_dss_dsi2_irqs,
+        .xlate_irq      = omap4_xlate_irq,
        .sdma_reqs      = omap44xx_dss_dsi2_sdma_reqs,
        .main_clk       = "dss_dss_clk",
        .prcm = {
@@ -784,6 +788,7 @@ static struct omap_hwmod omap44xx_dss_hdmi_hwmod = {
         */
        .flags          = HWMOD_SWSUP_SIDLE,
        .mpu_irqs       = omap44xx_dss_hdmi_irqs,
+        .xlate_irq      = omap4_xlate_irq,
        .sdma_reqs      = omap44xx_dss_hdmi_sdma_reqs,
        .main_clk       = "dss_48mhz_clk",
        .prcm = {
diff --git a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
index 3e9523084b2a..7c3fac035e93 100644
--- a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
@@ -288,6 +288,7 @@ static struct omap_hwmod omap54xx_dma_system_hwmod = {
        .class          = &omap54xx_dma_hwmod_class,
        .clkdm_name     = "dma_clkdm",
        .mpu_irqs       = omap54xx_dma_system_irqs,
+        .xlate_irq      = omap4_xlate_irq,
        .main_clk       = "l3_iclk_div",
        .prcm = {
                .omap4 = {
diff --git a/arch/arm/mach-omap2/prcm-common.h b/arch/arm/mach-omap2/prcm-common.h
index a8e4b582c527..6163d66102a3 100644
--- a/arch/arm/mach-omap2/prcm-common.h
+++ b/arch/arm/mach-omap2/prcm-common.h
@@ -498,6 +498,7 @@ struct omap_prcm_irq_setup {
        u8 nr_irqs;
        const struct omap_prcm_irq *irqs;
        int irq;
+        unsigned int (*xlate_irq)(unsigned int);
        void (*read_pending_irqs)(unsigned long *events);
        void (*ocp_barrier)(void);
        void (*save_and_clear_irqen)(u32 *saved_mask);
diff --git a/arch/arm/mach-omap2/prm44xx.c b/arch/arm/mach-omap2/prm44xx.c
index cc170fb81ff7..408c64efb807 100644
--- a/arch/arm/mach-omap2/prm44xx.c
+++ b/arch/arm/mach-omap2/prm44xx.c
@@ -49,6 +49,7 @@ static struct omap_prcm_irq_setup omap4_prcm_irq_setup = {
        .irqs                   = omap4_prcm_irqs,
        .nr_irqs                = ARRAY_SIZE(omap4_prcm_irqs),
        .irq                    = 11 + OMAP44XX_IRQ_GIC_START,
+        .xlate_irq              = omap4_xlate_irq,
        .read_pending_irqs      = &omap44xx_prm_read_pending_irqs,
        .ocp_barrier            = &omap44xx_prm_ocp_barrier,
        .save_and_clear_irqen   = &omap44xx_prm_save_and_clear_irqen,
@@ -751,8 +752,10 @@ static int omap44xx_prm_late_init(void)
                }
                /* Once OMAP4 DT is filled as well */
-                if (irq_num >= 0)
+                if (irq_num >= 0) {
                        omap4_prcm_irq_setup.irq = irq_num;
+                        omap4_prcm_irq_setup.xlate_irq = NULL;
+                }
        }
        omap44xx_prm_enable_io_wakeup();
diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c
index 779940cb6e56..dea2833ca627 100644
--- a/arch/arm/mach-omap2/prm_common.c
+++ b/arch/arm/mach-omap2/prm_common.c
@@ -187,6 +187,7 @@ int omap_prcm_event_to_irq(const char *name)
 */
 void omap_prcm_irq_cleanup(void)
 {
+        unsigned int irq;
        int i;
        if (!prcm_irq_setup) {
@@ -211,7 +212,11 @@ void omap_prcm_irq_cleanup(void)
        kfree(prcm_irq_setup->priority_mask);
        prcm_irq_setup->priority_mask = NULL;
-        irq_set_chained_handler(prcm_irq_setup->irq, NULL);
+        if (prcm_irq_setup->xlate_irq)
+                irq = prcm_irq_setup->xlate_irq(prcm_irq_setup->irq);
+        else
+                irq = prcm_irq_setup->irq;
+        irq_set_chained_handler(irq, NULL);
        if (prcm_irq_setup->base_irq > 0)
                irq_free_descs(prcm_irq_setup->base_irq,
@@ -259,6 +264,7 @@ int omap_prcm_register_chain_handler(struct omap_prcm_irq_setup *irq_setup)
        int offset, i;
        struct irq_chip_generic *gc;
        struct irq_chip_type *ct;
+        unsigned int irq;
        if (!irq_setup)
                return -EINVAL;
@@ -298,7 +304,11 @@ int omap_prcm_register_chain_handler(struct omap_prcm_irq_setup *irq_setup)
                                1 << (offset & 0x1f);
        }
-        irq_set_chained_handler(irq_setup->irq, omap_prcm_irq_handler);
+        if (irq_setup->xlate_irq)
+                irq = irq_setup->xlate_irq(irq_setup->irq);
+        else
+                irq = irq_setup->irq;
+        irq_set_chained_handler(irq, omap_prcm_irq_handler);
        irq_setup->base_irq = irq_alloc_descs(-1, 0, irq_setup->nr_regs * 32,
                0);
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index 4f61148ec168..7d45c84c69ba 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -54,6 +54,7 @@
 #include "soc.h"
 #include "common.h"
+#include "control.h"
 #include "powerdomain.h"
 #include "omap-secure.h"
@@ -496,7 +497,8 @@ static void __init realtime_counter_init(void)
        void __iomem *base;
        static struct clk *sys_clk;
        unsigned long rate;
-        unsigned int reg, num, den;
+        unsigned int reg;
+        unsigned long long num, den;
        base = ioremap(REALTIME_COUNTER_BASE, SZ_32);
        if (!base) {
@@ -511,13 +513,42 @@ static void __init realtime_counter_init(void)
        }
        rate = clk_get_rate(sys_clk);
+        if (soc_is_dra7xx()) {
+                /*
+                 * Errata i856 says the 32.768KHz crystal does not start at
+                 * power on, so the CPU falls back to an emulated 32KHz clock
+                 * based on sysclk / 610 instead. This causes the master counter
+                 * frequency to not be 6.144MHz but at sysclk / 610 * 375 / 2
+                 * (OR sysclk * 75 / 244)
+                 *
+                 * This affects at least the DRA7/AM572x 1.0, 1.1 revisions.
+                 * Of course any board built without a populated 32.768KHz
+                 * crystal would also need this fix even if the CPU is fixed
+                 * later.
+                 *
+                 * Either case can be detected by using the two speedselect bits
+                 * If they are not 0, then the 32.768KHz clock driving the
+                 * coarse counter that corrects the fine counter every time it
+                 * ticks is actually rate/610 rather than 32.768KHz and we
+                 * should compensate to avoid the 570ppm (at 20MHz, much worse
+                 * at other rates) too fast system time.
+                 */
+                reg = omap_ctrl_readl(DRA7_CTRL_CORE_BOOTSTRAP);
+                if (reg & DRA7_SPEEDSELECT_MASK) {
+                        num = 75;
+                        den = 244;
+                        goto sysclk1_based;
+                }
+        }
        /* Numerator/denumerator values refer TRM Realtime Counter section */
        switch (rate) {
-        case 1200000:
+        case 12000000:
                num = 64;
                den = 125;
                break;
-        case 1300000:
+        case 13000000:
                num = 768;
                den = 1625;
                break;
@@ -529,11 +560,11 @@ static void __init realtime_counter_init(void)
                num = 192;
                den = 625;
                break;
-        case 2600000:
+        case 26000000:
                num = 384;
                den = 1625;
                break;
-        case 2700000:
+        case 27000000:
                num = 256;
                den = 1125;
                break;
@@ -545,6 +576,7 @@ static void __init realtime_counter_init(void)
                break;
        }
+sysclk1_based:
        /* Program numerator and denumerator registers */
        reg = readl_relaxed(base + INCREMENTER_NUMERATOR_OFFSET) &
                        NUMERATOR_DENUMERATOR_MASK;
@@ -556,7 +588,7 @@ static void __init realtime_counter_init(void)
        reg |= den;
        writel_relaxed(reg, base + INCREMENTER_DENUMERATOR_RELOAD_OFFSET);
-        arch_timer_freq = (rate / den) * num;
+        arch_timer_freq = DIV_ROUND_UP_ULL(rate * num, den);
        set_cntfreq();
        iounmap(base);
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index 4457e731f7a4..292eca0e78ed 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -66,19 +66,24 @@ void __init omap_pmic_init(int bus, u32 clkrate,
        omap_register_i2c_bus(bus, clkrate, &pmic_i2c_board_info, 1);
 }
+#ifdef CONFIG_ARCH_OMAP4
 void __init omap4_pmic_init(const char *pmic_type,
                    struct twl4030_platform_data *pmic_data,
                    struct i2c_board_info *devices, int nr_devices)
 {
        /* PMIC part*/
+        unsigned int irq;
        omap_mux_init_signal("sys_nirq1", OMAP_PIN_INPUT_PULLUP | OMAP_PIN_OFF_WAKEUPENABLE);
        omap_mux_init_signal("fref_clk0_out.sys_drm_msecure", OMAP_PIN_OUTPUT);
-        omap_pmic_init(1, 400, pmic_type, 7 + OMAP44XX_IRQ_GIC_START, pmic_data);
+        irq = omap4_xlate_irq(7 + OMAP44XX_IRQ_GIC_START);
+        omap_pmic_init(1, 400, pmic_type, irq, pmic_data);
        /* Register additional devices on i2c1 bus if needed */
        if (devices)
                i2c_register_board_info(1, devices, nr_devices);
 }
+#endif
 void __init omap_pmic_late_init(void)
 {
diff --git a/arch/arm/mach-rockchip/rockchip.c b/arch/arm/mach-rockchip/rockchip.c
index d226b71d21d5..a611f4852582 100644
--- a/arch/arm/mach-rockchip/rockchip.c
+++ b/arch/arm/mach-rockchip/rockchip.c
@@ -19,11 +19,37 @@
 #include <linux/init.h>
 #include <linux/of_platform.h>
 #include <linux/irqchip.h>
+#include <linux/clk-provider.h>
+#include <linux/clocksource.h>
+#include <linux/mfd/syscon.h>
+#include <linux/regmap.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
 #include <asm/hardware/cache-l2x0.h>
 #include "core.h"
+#define RK3288_GRF_SOC_CON0 0x244
+static void __init rockchip_timer_init(void)
+{
+        if (of_machine_is_compatible("rockchip,rk3288")) {
+                struct regmap *grf;
+                /*
+                 * Disable auto jtag/sdmmc switching that causes issues
+                 * with the mmc controllers making them unreliable
+                 */
+                grf = syscon_regmap_lookup_by_compatible("rockchip,rk3288-grf");
+                if (!IS_ERR(grf))
+                        regmap_write(grf, RK3288_GRF_SOC_CON0, 0x10000000);
+                else
+                        pr_err("rockchip: could not get grf syscon\n");
+        }
+        of_clk_init(NULL);
+        clocksource_of_init();
+}
 static void __init rockchip_dt_init(void)
 {
        of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
@@ -42,6 +68,7 @@ static const char * const rockchip_board_dt_compat[] = {
 DT_MACHINE_START(ROCKCHIP_DT, "Rockchip Cortex-A9 (Device Tree)")
        .l2c_aux_val    = 0,
        .l2c_aux_mask   = ~0,
+        .init_time      = rockchip_timer_init,
        .dt_compat      = rockchip_board_dt_compat,
        .init_machine   = rockchip_dt_init,
 MACHINE_END
diff --git a/arch/arm/mach-shmobile/board-ape6evm.c b/arch/arm/mach-shmobile/board-ape6evm.c
index 66f67816a844..444f22d370f0 100644
--- a/arch/arm/mach-shmobile/board-ape6evm.c
+++ b/arch/arm/mach-shmobile/board-ape6evm.c
@@ -18,6 +18,8 @@
 #include <linux/gpio_keys.h>
 #include <linux/input.h>
 #include <linux/interrupt.h>
+#include <linux/irqchip.h>
+#include <linux/irqchip/arm-gic.h>
 #include <linux/kernel.h>
 #include <linux/mfd/tmio.h>
 #include <linux/mmc/host.h>
@@ -273,6 +275,22 @@ static void __init ape6evm_add_standard_devices(void)
                                      sizeof(ape6evm_leds_pdata));
 }
+static void __init ape6evm_legacy_init_time(void)
+{
+        /* Do not invoke DT-based timers via clocksource_of_init() */
+}
+static void __init ape6evm_legacy_init_irq(void)
+{
+        void __iomem *gic_dist_base = ioremap_nocache(0xf1001000, 0x1000);
+        void __iomem *gic_cpu_base = ioremap_nocache(0xf1002000, 0x1000);
+        gic_init(0, 29, gic_dist_base, gic_cpu_base);
+        /* Do not invoke DT-based interrupt code via irqchip_init() */
+}
 static const char *ape6evm_boards_compat_dt[] __initdata = {
        "renesas,ape6evm",
        NULL,
@@ -280,7 +298,9 @@ static const char *ape6evm_boards_compat_dt[] __initdata = {
 DT_MACHINE_START(APE6EVM_DT, "ape6evm")
        .init_early     = shmobile_init_delay,
+        .init_irq       = ape6evm_legacy_init_irq,
        .init_machine   = ape6evm_add_standard_devices,
        .init_late      = shmobile_init_late,
        .dt_compat      = ape6evm_boards_compat_dt,
+        .init_time      = ape6evm_legacy_init_time,
 MACHINE_END
diff --git a/arch/arm/mach-shmobile/board-lager.c b/arch/arm/mach-shmobile/board-lager.c
index f8197eb6e566..65b128dd4072 100644
--- a/arch/arm/mach-shmobile/board-lager.c
+++ b/arch/arm/mach-shmobile/board-lager.c
@@ -21,6 +21,8 @@
 #include <linux/input.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
+#include <linux/irqchip.h>
+#include <linux/irqchip/arm-gic.h>
 #include <linux/kernel.h>
 #include <linux/leds.h>
 #include <linux/mfd/tmio.h>
@@ -811,6 +813,16 @@ static void __init lager_init(void)
                                          lager_ksz8041_fixup);
 }
+static void __init lager_legacy_init_irq(void)
+{
+        void __iomem *gic_dist_base = ioremap_nocache(0xf1001000, 0x1000);
+        void __iomem *gic_cpu_base = ioremap_nocache(0xf1002000, 0x1000);
+        gic_init(0, 29, gic_dist_base, gic_cpu_base);
+        /* Do not invoke DT-based interrupt code via irqchip_init() */
+}
 static const char * const lager_boards_compat_dt[] __initconst = {
        "renesas,lager",
        NULL,
@@ -819,6 +831,7 @@ static const char * const lager_boards_compat_dt[] __initconst = {
 DT_MACHINE_START(LAGER_DT, "lager")
        .smp            = smp_ops(r8a7790_smp_ops),
        .init_early     = shmobile_init_delay,
+        .init_irq       = lager_legacy_init_irq,
        .init_time      = rcar_gen2_timer_init,
        .init_machine   = lager_init,
        .init_late      = shmobile_init_late,
diff --git a/arch/arm/mach-shmobile/setup-r8a7740.c b/arch/arm/mach-shmobile/setup-r8a7740.c
index 79ad93dfdae4..d191cf419731 100644
--- a/arch/arm/mach-shmobile/setup-r8a7740.c
+++ b/arch/arm/mach-shmobile/setup-r8a7740.c
@@ -800,7 +800,14 @@ void __init r8a7740_init_irq_of(void)
        void __iomem *intc_msk_base = ioremap_nocache(0xe6900040, 0x10);
        void __iomem *pfc_inta_ctrl = ioremap_nocache(0xe605807c, 0x4);
+#ifdef CONFIG_ARCH_SHMOBILE_LEGACY
+        void __iomem *gic_dist_base = ioremap_nocache(0xc2800000, 0x1000);
+        void __iomem *gic_cpu_base = ioremap_nocache(0xc2000000, 0x1000);
+        gic_init(0, 29, gic_dist_base, gic_cpu_base);
+#else
        irqchip_init();
+#endif
        /* route signals to GIC */
        iowrite32(0x0, pfc_inta_ctrl);
diff --git a/arch/arm/mach-shmobile/setup-r8a7778.c b/arch/arm/mach-shmobile/setup-r8a7778.c
index 170bd146ba17..cef8895a9b82 100644
--- a/arch/arm/mach-shmobile/setup-r8a7778.c
+++ b/arch/arm/mach-shmobile/setup-r8a7778.c
@@ -576,11 +576,18 @@ void __init r8a7778_init_irq_extpin(int irlm)
 void __init r8a7778_init_irq_dt(void)
 {
        void __iomem *base = ioremap_nocache(0xfe700000, 0x00100000);
+#ifdef CONFIG_ARCH_SHMOBILE_LEGACY
+        void __iomem *gic_dist_base = ioremap_nocache(0xfe438000, 0x1000);
+        void __iomem *gic_cpu_base = ioremap_nocache(0xfe430000, 0x1000);
+#endif
        BUG_ON(!base);
+#ifdef CONFIG_ARCH_SHMOBILE_LEGACY
+        gic_init(0, 29, gic_dist_base, gic_cpu_base);
+#else
        irqchip_init();
+#endif
        /* route all interrupts to ARM */
        __raw_writel(0x73ffffff, base + INT2NTSR0);
        __raw_writel(0xffffffff, base + INT2NTSR1);
diff --git a/arch/arm/mach-shmobile/setup-r8a7779.c b/arch/arm/mach-shmobile/setup-r8a7779.c
index 6156d172cf31..27dceaf9e688 100644
--- a/arch/arm/mach-shmobile/setup-r8a7779.c
+++ b/arch/arm/mach-shmobile/setup-r8a7779.c
@@ -720,10 +720,17 @@ static int r8a7779_set_wake(struct irq_data *data, unsigned int on)
 void __init r8a7779_init_irq_dt(void)
 {
+#ifdef CONFIG_ARCH_SHMOBILE_LEGACY
+        void __iomem *gic_dist_base = ioremap_nocache(0xf0001000, 0x1000);
+        void __iomem *gic_cpu_base = ioremap_nocache(0xf0000100, 0x1000);
+#endif
        gic_arch_extn.irq_set_wake = r8a7779_set_wake;
+#ifdef CONFIG_ARCH_SHMOBILE_LEGACY
+        gic_init(0, 29, gic_dist_base, gic_cpu_base);
+#else
        irqchip_init();
+#endif
        /* route all interrupts to ARM */
        __raw_writel(0xffffffff, INT2NTSR0);
        __raw_writel(0x3fffffff, INT2NTSR1);
diff --git a/arch/arm/mach-shmobile/setup-rcar-gen2.c b/arch/arm/mach-shmobile/setup-rcar-gen2.c
index 3dd6edd9bd1d..cc9470dfb1ce 100644
--- a/arch/arm/mach-shmobile/setup-rcar-gen2.c
+++ b/arch/arm/mach-shmobile/setup-rcar-gen2.c
@@ -133,7 +133,9 @@ void __init rcar_gen2_timer_init(void)
 #ifdef CONFIG_COMMON_CLK
        rcar_gen2_clocks_init(mode);
 #endif
+#ifdef CONFIG_ARCH_SHMOBILE_MULTI
        clocksource_of_init();
+#endif
 }
 struct memory_reserve_config {
diff --git a/arch/arm/mach-shmobile/setup-sh73a0.c b/arch/arm/mach-shmobile/setup-sh73a0.c
index 93ebe3430bfe..fb5e1bb34be8 100644
--- a/arch/arm/mach-shmobile/setup-sh73a0.c
+++ b/arch/arm/mach-shmobile/setup-sh73a0.c
@@ -595,6 +595,7 @@ static struct platform_device ipmmu_device = {
 static struct renesas_intc_irqpin_config irqpin0_platform_data = {
        .irq_base = irq_pin(0), /* IRQ0 -> IRQ7 */
+        .control_parent = true,
 };
 static struct resource irqpin0_resources[] = {
@@ -656,6 +657,7 @@ static struct platform_device irqpin1_device = {
 static struct renesas_intc_irqpin_config irqpin2_platform_data = {
        .irq_base = irq_pin(16), /* IRQ16 -> IRQ23 */
+        .control_parent = true,
 };
 static struct resource irqpin2_resources[] = {
@@ -686,6 +688,7 @@ static struct platform_device irqpin2_device = {
 static struct renesas_intc_irqpin_config irqpin3_platform_data = {
        .irq_base = irq_pin(24), /* IRQ24 -> IRQ31 */
+        .control_parent = true,
 };
 static struct resource irqpin3_resources[] = {
diff --git a/arch/arm/mach-shmobile/timer.c b/arch/arm/mach-shmobile/timer.c
index f1d027aa7a81..0edf2a6d2bbe 100644
--- a/arch/arm/mach-shmobile/timer.c
+++ b/arch/arm/mach-shmobile/timer.c
@@ -70,6 +70,18 @@ void __init shmobile_init_delay(void)
        if (!max_freq)
                return;
+#ifdef CONFIG_ARCH_SHMOBILE_LEGACY
+        /* Non-multiplatform r8a73a4 SoC cannot use arch timer due
+         * to GIC being initialized from C and arch timer via DT */
+        if (of_machine_is_compatible("renesas,r8a73a4"))
+                has_arch_timer = false;
+        /* Non-multiplatform r8a7790 SoC cannot use arch timer due
+         * to GIC being initialized from C and arch timer via DT */
+        if (of_machine_is_compatible("renesas,r8a7790"))
+                has_arch_timer = false;
+#endif
        if (!has_arch_timer || !IS_ENABLED(CONFIG_ARM_ARCH_TIMER)) {
                if (is_a7_a8_a9)
                        shmobile_setup_delay_hz(max_freq, 1, 3);
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 03823e784f63..c43c71455566 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -1012,6 +1012,7 @@ config ARCH_SUPPORTS_BIG_ENDIAN
 config ARM_KERNMEM_PERMS
        bool "Restrict kernel memory permissions"
+        depends on MMU
        help
          If this is set, kernel memory other than kernel text (and rodata)
          will be made non-executable. The tradeoff is that each region is
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index 91892569710f..845769e41332 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -144,21 +144,17 @@ static void flush_context(unsigned int cpu)
        /* Update the list of reserved ASIDs and the ASID bitmap. */
        bitmap_clear(asid_map, 0, NUM_USER_ASIDS);
        for_each_possible_cpu(i) {
-                if (i == cpu) {
+                asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
-                        asid = 0;
+                /*
-                } else {
+                 * If this CPU has already been through a
-                        asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
+                 * rollover, but hasn't run another task in
-                        /*
+                 * the meantime, we must preserve its reserved
-                         * If this CPU has already been through a
+                 * ASID, as this is the only trace we have of
-                         * rollover, but hasn't run another task in
+                 * the process it is still running.
-                         * the meantime, we must preserve its reserved
+                 */
-                         * ASID, as this is the only trace we have of
+                if (asid == 0)
-                         * the process it is still running.
+                        asid = per_cpu(reserved_asids, i);
-                         */
+                __set_bit(asid & ~ASID_MASK, asid_map);
-                        if (asid == 0)
-                                asid = per_cpu(reserved_asids, i);
-                        __set_bit(asid & ~ASID_MASK, asid_map);
-                }
                per_cpu(reserved_asids, i) = asid;
        }
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 7864797609b3..903dba064a03 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1940,13 +1940,32 @@ void arm_iommu_release_mapping(struct dma_iommu_mapping *mapping)
 }
 EXPORT_SYMBOL_GPL(arm_iommu_release_mapping);
+static int __arm_iommu_attach_device(struct device *dev,
+                                     struct dma_iommu_mapping *mapping)
+{
+        int err;
+        err = iommu_attach_device(mapping->domain, dev);
+        if (err)
+                return err;
+        kref_get(&mapping->kref);
+        dev->archdata.mapping = mapping;
+        pr_debug("Attached IOMMU controller to %s device.\n", dev_name(dev));
+        return 0;
+}
 /**
 * arm_iommu_attach_device
 * @dev: valid struct device pointer
 * @mapping: io address space mapping structure (returned from
 *      arm_iommu_create_mapping)
 *
- * Attaches specified io address space mapping to the provided device,
+ * Attaches specified io address space mapping to the provided device.
+ * This replaces the dma operations (dma_map_ops pointer) with the
+ * IOMMU aware version.
+ *
 * More than one client might be attached to the same io address space
 * mapping.
 */
@@ -1955,25 +1974,16 @@ int arm_iommu_attach_device(struct device *dev,
 {
        int err;
-        err = iommu_attach_device(mapping->domain, dev);
+        err = __arm_iommu_attach_device(dev, mapping);
        if (err)
                return err;
-        kref_get(&mapping->kref);
+        set_dma_ops(dev, &iommu_ops);
-        dev->archdata.mapping = mapping;
-        pr_debug("Attached IOMMU controller to %s device.\n", dev_name(dev));
        return 0;
 }
 EXPORT_SYMBOL_GPL(arm_iommu_attach_device);
-/**
+static void __arm_iommu_detach_device(struct device *dev)
- * arm_iommu_detach_device
- * @dev: valid struct device pointer
- *
- * Detaches the provided device from a previously attached map.
- */
-void arm_iommu_detach_device(struct device *dev)
 {
        struct dma_iommu_mapping *mapping;
@@ -1989,6 +1999,19 @@ void arm_iommu_detach_device(struct device *dev)
        pr_debug("Detached IOMMU controller from %s device.\n", dev_name(dev));
 }
+/**
+ * arm_iommu_detach_device
+ * @dev: valid struct device pointer
+ *
+ * Detaches the provided device from a previously attached map.
+ * This voids the dma operations (dma_map_ops pointer)
+ */
+void arm_iommu_detach_device(struct device *dev)
+{
+        __arm_iommu_detach_device(dev);
+        set_dma_ops(dev, NULL);
+}
 EXPORT_SYMBOL_GPL(arm_iommu_detach_device);
 static struct dma_map_ops *arm_get_iommu_dma_map_ops(bool coherent)
@@ -2011,7 +2034,7 @@ static bool arm_setup_iommu_dma_ops(struct device *dev, u64 dma_base, u64 size,
                return false;
        }
-        if (arm_iommu_attach_device(dev, mapping)) {
+        if (__arm_iommu_attach_device(dev, mapping)) {
                pr_warn("Failed to attached device %s to IOMMU_mapping\n",
                                dev_name(dev));
                arm_iommu_release_mapping(mapping);
@@ -2025,7 +2048,10 @@ static void arm_teardown_iommu_dma_ops(struct device *dev)
 {
        struct dma_iommu_mapping *mapping = dev->archdata.mapping;
-        arm_iommu_detach_device(dev);
+        if (!mapping)
+                return;
+        __arm_iommu_detach_device(dev);
        arm_iommu_release_mapping(mapping);
 }
diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
index 59424937e52b..9fe8e241335c 100644
--- a/arch/arm/mm/dump.c
+++ b/arch/arm/mm/dump.c
@@ -220,9 +220,6 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level, u
        static const char units[] = "KMGTPE";
        u64 prot = val & pg_level[level].mask;
-        if (addr < USER_PGTABLES_CEILING)
-                return;
        if (!st->level) {
                st->level = level;
                st->current_prot = prot;
@@ -308,15 +305,13 @@ static void walk_pgd(struct seq_file *m)
        pgd_t *pgd = swapper_pg_dir;
        struct pg_state st;
        unsigned long addr;
-        unsigned i, pgdoff = USER_PGTABLES_CEILING / PGDIR_SIZE;
+        unsigned i;
        memset(&st, 0, sizeof(st));
        st.seq = m;
        st.marker = address_markers;
-        pgd += pgdoff;
+        for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
-        for (i = pgdoff; i < PTRS_PER_PGD; i++, pgd++) {
                addr = i * PGDIR_SIZE;
                if (!pgd_none(*pgd)) {
                        walk_pud(&st, pgd, addr);
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 98ad9c79ea0e..2495c8cb47ba 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -658,8 +658,8 @@ static struct section_perm ro_perms[] = {
                .start  = (unsigned long)_stext,
                .end    = (unsigned long)__init_begin,
 #ifdef CONFIG_ARM_LPAE
-                .mask   = ~PMD_SECT_RDONLY,
+                .mask   = ~L_PMD_SECT_RDONLY,
-                .prot   = PMD_SECT_RDONLY,
+                .prot   = L_PMD_SECT_RDONLY,
 #else
                .mask   = ~(PMD_SECT_APX | PMD_SECT_AP_WRITE),
                .prot   = PMD_SECT_APX | PMD_SECT_AP_WRITE,
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index cda7c40999b6..4e6ef896c619 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -1329,8 +1329,8 @@ static void __init kmap_init(void)
 static void __init map_lowmem(void)
 {
        struct memblock_region *reg;
-        unsigned long kernel_x_start = round_down(__pa(_stext), SECTION_SIZE);
+        phys_addr_t kernel_x_start = round_down(__pa(_stext), SECTION_SIZE);
-        unsigned long kernel_x_end = round_up(__pa(__init_end), SECTION_SIZE);
+        phys_addr_t kernel_x_end = round_up(__pa(__init_end), SECTION_SIZE);
        /* Map all the lowmem memory banks. */
        for_each_memblock(memory, reg) {
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 1c43cec971b5..066688863920 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -85,6 +85,7 @@ vdso_install:
 # We use MRPROPER_FILES and CLEAN_FILES now
 archclean:
        $(Q)$(MAKE) $(clean)=$(boot)
+        $(Q)$(MAKE) $(clean)=$(boot)/dts
 define archhelp
  echo  '* Image.gz      - Compressed kernel image (arch/$(ARCH)/boot/Image.gz)'
diff --git a/arch/arm64/boot/dts/Makefile b/arch/arm64/boot/dts/Makefile
index 3b8d427c3985..c62b0f4d9ef6 100644
--- a/arch/arm64/boot/dts/Makefile
+++ b/arch/arm64/boot/dts/Makefile
@@ -3,6 +3,4 @@ dts-dirs += apm
 dts-dirs += arm
 dts-dirs += cavium
-always          := $(dtb-y)
 subdir-y        := $(dts-dirs)
-clean-files     := *.dtb
diff --git a/arch/arm64/boot/dts/arm/juno.dts b/arch/arm64/boot/dts/arm/juno.dts
index cb3073e4e7a8..d429129ecb3d 100644
--- a/arch/arm64/boot/dts/arm/juno.dts
+++ b/arch/arm64/boot/dts/arm/juno.dts
@@ -22,7 +22,7 @@
        };
        chosen {
-                stdout-path = &soc_uart0;
+                stdout-path = "serial0:115200n8";
        };
        psci {
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index dd301be89ecc..5376d908eabe 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -1,6 +1,7 @@
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
+CONFIG_FHANDLE=y
 CONFIG_AUDIT=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
@@ -13,14 +14,12 @@ CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_RESOURCE_COUNTERS=y
 CONFIG_MEMCG=y
 CONFIG_MEMCG_SWAP=y
 CONFIG_MEMCG_KMEM=y
 CONFIG_CGROUP_HUGETLB=y
 # CONFIG_UTS_NS is not set
 # CONFIG_IPC_NS is not set
-# CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
@@ -92,7 +91,6 @@ CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_VIRTIO_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
-# CONFIG_HMC_DRV is not set
 CONFIG_SPI=y
 CONFIG_SPI_PL022=y
 CONFIG_GPIO_PL061=y
@@ -133,6 +131,8 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS=y
 CONFIG_FANOTIFY=y
 CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_AUTOFS4_FS=y
 CONFIG_FUSE_FS=y
 CONFIG_CUSE=y
 CONFIG_VFAT_FS=y
@@ -152,14 +152,15 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOCKUP_DETECTOR=y
 # CONFIG_SCHED_DEBUG is not set
+# CONFIG_DEBUG_PREEMPT is not set
 # CONFIG_FTRACE is not set
+CONFIG_KEYS=y
 CONFIG_SECURITY=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_ARM64_CRYPTO=y
 CONFIG_CRYPTO_SHA1_ARM64_CE=y
 CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
-CONFIG_CRYPTO_AES_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y
diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
index b1fa4e614718..fbe0ca31a99c 100644
--- a/arch/arm64/include/asm/arch_timer.h
+++ b/arch/arm64/include/asm/arch_timer.h
@@ -21,6 +21,7 @@
 #include <asm/barrier.h>
+#include <linux/bug.h>
 #include <linux/init.h>
 #include <linux/types.h>
diff --git a/arch/arm64/include/asm/cpu.h b/arch/arm64/include/asm/cpu.h
index ace70682499b..8e797b2fcc01 100644
--- a/arch/arm64/include/asm/cpu.h
+++ b/arch/arm64/include/asm/cpu.h
@@ -39,6 +39,7 @@ struct cpuinfo_arm64 {
        u64             reg_id_aa64pfr0;
        u64             reg_id_aa64pfr1;
+        u32             reg_id_dfr0;
        u32             reg_id_isar0;
        u32             reg_id_isar1;
        u32             reg_id_isar2;
@@ -51,6 +52,10 @@ struct cpuinfo_arm64 {
        u32             reg_id_mmfr3;
        u32             reg_id_pfr0;
        u32             reg_id_pfr1;
+        u32             reg_mvfr0;
+        u32             reg_mvfr1;
+        u32             reg_mvfr2;
 };
 DECLARE_PER_CPU(struct cpuinfo_arm64, cpu_data);
diff --git a/arch/arm64/include/asm/dma-mapping.h b/arch/arm64/include/asm/dma-mapping.h
index d34189bceff7..9ce3e680ae1c 100644
--- a/arch/arm64/include/asm/dma-mapping.h
+++ b/arch/arm64/include/asm/dma-mapping.h
@@ -52,13 +52,14 @@ static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
        dev->archdata.dma_ops = ops;
 }
-static inline int set_arch_dma_coherent_ops(struct device *dev)
+static inline void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
+                                      struct iommu_ops *iommu, bool coherent)
 {
-        dev->archdata.dma_coherent = true;
+        dev->archdata.dma_coherent = coherent;
-        set_dma_ops(dev, &coherent_swiotlb_dma_ops);
+        if (coherent)
-        return 0;
+                set_dma_ops(dev, &coherent_swiotlb_dma_ops);
 }
-#define set_arch_dma_coherent_ops       set_arch_dma_coherent_ops
+#define arch_setup_dma_ops      arch_setup_dma_ops
 /* do not use this function in a driver */
 static inline bool is_device_dma_coherent(struct device *dev)
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 8127e45e2637..3cb4c856b10d 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -41,6 +41,18 @@ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
 static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
 {
        vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS;
+        if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features))
+                vcpu->arch.hcr_el2 &= ~HCR_RW;
+}
+static inline unsigned long vcpu_get_hcr(struct kvm_vcpu *vcpu)
+{
+        return vcpu->arch.hcr_el2;
+}
+static inline void vcpu_set_hcr(struct kvm_vcpu *vcpu, unsigned long hcr)
+{
+        vcpu->arch.hcr_el2 = hcr;
 }
 static inline unsigned long *vcpu_pc(const struct kvm_vcpu *vcpu)
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 0b7dfdb931df..acd101a9014d 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -116,9 +116,6 @@ struct kvm_vcpu_arch {
         * Anything that is not used directly from assembly code goes
         * here.
         */
-        /* dcache set/way operation pending */
-        int last_pcpu;
-        cpumask_t require_dcache_flush;
        /* Don't run the guest */
        bool pause;
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 14a74f136272..adcf49547301 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -243,24 +243,46 @@ static inline bool vcpu_has_cache_enabled(struct kvm_vcpu *vcpu)
        return (vcpu_sys_reg(vcpu, SCTLR_EL1) & 0b101) == 0b101;
 }
-static inline void coherent_cache_guest_page(struct kvm_vcpu *vcpu, hva_t hva,
+static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
-                                             unsigned long size,
+                                               unsigned long size,
-                                             bool ipa_uncached)
+                                               bool ipa_uncached)
 {
+        void *va = page_address(pfn_to_page(pfn));
        if (!vcpu_has_cache_enabled(vcpu) || ipa_uncached)
-                kvm_flush_dcache_to_poc((void *)hva, size);
+                kvm_flush_dcache_to_poc(va, size);
        if (!icache_is_aliasing()) {            /* PIPT */
-                flush_icache_range(hva, hva + size);
+                flush_icache_range((unsigned long)va,
+                                   (unsigned long)va + size);
        } else if (!icache_is_aivivt()) {       /* non ASID-tagged VIVT */
                /* any kind of VIPT cache */
                __flush_icache_all();
        }
 }
+static inline void __kvm_flush_dcache_pte(pte_t pte)
+{
+        struct page *page = pte_page(pte);
+        kvm_flush_dcache_to_poc(page_address(page), PAGE_SIZE);
+}
+static inline void __kvm_flush_dcache_pmd(pmd_t pmd)
+{
+        struct page *page = pmd_page(pmd);
+        kvm_flush_dcache_to_poc(page_address(page), PMD_SIZE);
+}
+static inline void __kvm_flush_dcache_pud(pud_t pud)
+{
+        struct page *page = pud_page(pud);
+        kvm_flush_dcache_to_poc(page_address(page), PUD_SIZE);
+}
 #define kvm_virt_to_phys(x)             __virt_to_phys((unsigned long)(x))
-void stage2_flush_vm(struct kvm *kvm);
+void kvm_set_way_flush(struct kvm_vcpu *vcpu);
+void kvm_toggle_cache(struct kvm_vcpu *vcpu, bool was_enabled);
 #endif /* __ASSEMBLY__ */
 #endif /* __ARM64_KVM_MMU_H__ */
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index df22314f57cf..210d632aa5ad 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -298,7 +298,6 @@ void pmdp_splitting_flush(struct vm_area_struct *vma, unsigned long address,
 #define pfn_pmd(pfn,prot)       (__pmd(((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
 #define mk_pmd(page,prot)       pfn_pmd(page_to_pfn(page),prot)
-#define pmd_page(pmd)           pfn_to_page(__phys_to_pfn(pmd_val(pmd) & PHYS_MASK))
 #define pud_write(pud)          pte_write(pud_pte(pud))
 #define pud_pfn(pud)            (((pud_val(pud) & PUD_MASK) & PHYS_MASK) >> PAGE_SHIFT)
@@ -401,7 +400,7 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
        return (pmd_t *)pud_page_vaddr(*pud) + pmd_index(addr);
 }
-#define pud_page(pud)           pmd_page(pud_pmd(pud))
+#define pud_page(pud)           pfn_to_page(__phys_to_pfn(pud_val(pud) & PHYS_MASK))
 #endif  /* CONFIG_ARM64_PGTABLE_LEVELS > 2 */
@@ -437,6 +436,8 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long addr)
        return (pud_t *)pgd_page_vaddr(*pgd) + pud_index(addr);
 }
+#define pgd_page(pgd)           pfn_to_page(__phys_to_pfn(pgd_val(pgd) & PHYS_MASK))
 #endif  /* CONFIG_ARM64_PGTABLE_LEVELS > 3 */
 #define pgd_ERROR(pgd)          __pgd_error(__FILE__, __LINE__, pgd_val(pgd))
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index 286b1bec547c..f9be30ea1cbd 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -31,6 +31,7 @@
 #include <asm/fpsimd.h>
 #include <asm/hw_breakpoint.h>
+#include <asm/pgtable-hwdef.h>
 #include <asm/ptrace.h>
 #include <asm/types.h>
@@ -123,9 +124,6 @@ struct task_struct;
 /* Free all resources held by a thread. */
 extern void release_thread(struct task_struct *);
-/* Prepare to copy thread state - unlazy all lazy status */
-#define prepare_to_copy(tsk)    do { } while (0)
 unsigned long get_wchan(struct task_struct *p);
 #define cpu_relax()                     barrier()
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index 49c9aefd24a5..23e9432ac112 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -44,7 +44,7 @@
 #define __ARM_NR_compat_cacheflush      (__ARM_NR_COMPAT_BASE+2)
 #define __ARM_NR_compat_set_tls         (__ARM_NR_COMPAT_BASE+5)
-#define __NR_compat_syscalls            386
+#define __NR_compat_syscalls            388
 #endif
 #define __ARCH_WANT_SYS_CLONE
diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h
index 8893cebcea5b..27224426e0bf 100644
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@ -795,3 +795,5 @@ __SYSCALL(__NR_getrandom, sys_getrandom)
 __SYSCALL(__NR_memfd_create, sys_memfd_create)
 #define __NR_bpf 386
 __SYSCALL(__NR_bpf, sys_bpf)
+#define __NR_execveat 387
+__SYSCALL(__NR_execveat, compat_sys_execveat)
diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
index 57b641747534..07d435cf2eea 100644
--- a/arch/arm64/kernel/cpuinfo.c
+++ b/arch/arm64/kernel/cpuinfo.c
@@ -147,6 +147,7 @@ static void cpuinfo_sanity_check(struct cpuinfo_arm64 *cur)
         * If we have AArch32, we care about 32-bit features for compat. These
         * registers should be RES0 otherwise.
         */
+        diff |= CHECK(id_dfr0, boot, cur, cpu);
        diff |= CHECK(id_isar0, boot, cur, cpu);
        diff |= CHECK(id_isar1, boot, cur, cpu);
        diff |= CHECK(id_isar2, boot, cur, cpu);
@@ -165,6 +166,10 @@ static void cpuinfo_sanity_check(struct cpuinfo_arm64 *cur)
        diff |= CHECK(id_pfr0, boot, cur, cpu);
        diff |= CHECK(id_pfr1, boot, cur, cpu);
+        diff |= CHECK(mvfr0, boot, cur, cpu);
+        diff |= CHECK(mvfr1, boot, cur, cpu);
+        diff |= CHECK(mvfr2, boot, cur, cpu);
        /*
         * Mismatched CPU features are a recipe for disaster. Don't even
         * pretend to support them.
@@ -189,6 +194,7 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info)
        info->reg_id_aa64pfr0 = read_cpuid(ID_AA64PFR0_EL1);
        info->reg_id_aa64pfr1 = read_cpuid(ID_AA64PFR1_EL1);
+        info->reg_id_dfr0 = read_cpuid(ID_DFR0_EL1);
        info->reg_id_isar0 = read_cpuid(ID_ISAR0_EL1);
        info->reg_id_isar1 = read_cpuid(ID_ISAR1_EL1);
        info->reg_id_isar2 = read_cpuid(ID_ISAR2_EL1);
@@ -202,6 +208,10 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info)
        info->reg_id_pfr0 = read_cpuid(ID_PFR0_EL1);
        info->reg_id_pfr1 = read_cpuid(ID_PFR1_EL1);
+        info->reg_mvfr0 = read_cpuid(MVFR0_EL1);
+        info->reg_mvfr1 = read_cpuid(MVFR1_EL1);
+        info->reg_mvfr2 = read_cpuid(MVFR2_EL1);
        cpuinfo_detect_icache_policy(info);
        check_local_cpu_errata();
diff --git a/arch/arm64/kernel/efi-stub.c b/arch/arm64/kernel/efi-stub.c
index d27dd982ff26..f5374065ad53 100644
--- a/arch/arm64/kernel/efi-stub.c
+++ b/arch/arm64/kernel/efi-stub.c
@@ -13,13 +13,13 @@
 #include <asm/efi.h>
 #include <asm/sections.h>
-efi_status_t handle_kernel_image(efi_system_table_t *sys_table,
+efi_status_t __init handle_kernel_image(efi_system_table_t *sys_table,
-                                 unsigned long *image_addr,
+                                        unsigned long *image_addr,
-                                 unsigned long *image_size,
+                                        unsigned long *image_size,
-                                 unsigned long *reserve_addr,
+                                        unsigned long *reserve_addr,
-                                 unsigned long *reserve_size,
+                                        unsigned long *reserve_size,
-                                 unsigned long dram_base,
+                                        unsigned long dram_base,
-                                 efi_loaded_image_t *image)
+                                        efi_loaded_image_t *image)
 {
        efi_status_t status;
        unsigned long kernel_size, kernel_memsize = 0;
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 6fac253bc783..2bb4347d0edf 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -326,6 +326,7 @@ void __init efi_idmap_init(void)
        /* boot time idmap_pg_dir is incomplete, so fill in missing parts */
        efi_setup_idmap();
+        early_memunmap(memmap.map, memmap.map_end - memmap.map);
 }
 static int __init remap_region(efi_memory_desc_t *md, void **new)
@@ -380,7 +381,6 @@ static int __init arm64_enter_virtual_mode(void)
        }
        mapsize = memmap.map_end - memmap.map;
-        early_memunmap(memmap.map, mapsize);
        if (efi_runtime_disabled()) {
                pr_info("EFI runtime services will be disabled.\n");
diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
index fd027b101de5..9b6f71db2709 100644
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -25,6 +25,7 @@
 #include <linux/mm.h>
 #include <linux/moduleloader.h>
 #include <linux/vmalloc.h>
+#include <asm/alternative.h>
 #include <asm/insn.h>
 #include <asm/sections.h>
diff --git a/arch/arm64/kernel/perf_regs.c b/arch/arm64/kernel/perf_regs.c
index 6762ad705587..3f62b35fb6f1 100644
--- a/arch/arm64/kernel/perf_regs.c
+++ b/arch/arm64/kernel/perf_regs.c
@@ -50,3 +50,11 @@ u64 perf_reg_abi(struct task_struct *task)
        else
                return PERF_SAMPLE_REGS_ABI_64;
 }
+void perf_get_regs_user(struct perf_regs *regs_user,
+                        struct pt_regs *regs,
+                        struct pt_regs *regs_user_copy)
+{
+        regs_user->regs = task_pt_regs(current);
+        regs_user->abi = perf_reg_abi(current);
+}
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index b80991166754..20fe2932ad0c 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -402,6 +402,7 @@ void __init setup_arch(char **cmdline_p)
        request_standard_resources();
        efi_idmap_init();
+        early_ioremap_reset();
        unflatten_device_tree();
diff --git a/arch/arm64/kernel/smp_spin_table.c b/arch/arm64/kernel/smp_spin_table.c
index 4f93c67e63de..14944e5b28da 100644
--- a/arch/arm64/kernel/smp_spin_table.c
+++ b/arch/arm64/kernel/smp_spin_table.c
@@ -25,6 +25,7 @@
 #include <asm/cacheflush.h>
 #include <asm/cpu_ops.h>
 #include <asm/cputype.h>
+#include <asm/io.h>
 #include <asm/smp_plat.h>
 extern void secondary_holding_pen(void);
diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c
index 3771b72b6569..2d6b6065fe7f 100644
--- a/arch/arm64/kernel/suspend.c
+++ b/arch/arm64/kernel/suspend.c
@@ -5,6 +5,7 @@
 #include <asm/debug-monitors.h>
 #include <asm/pgtable.h>
 #include <asm/memory.h>
+#include <asm/mmu_context.h>
 #include <asm/smp_plat.h>
 #include <asm/suspend.h>
 #include <asm/tlbflush.h>
@@ -98,7 +99,18 @@ int __cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
         */
        ret = __cpu_suspend_enter(arg, fn);
        if (ret == 0) {
-                cpu_switch_mm(mm->pgd, mm);
+                /*
+                 * We are resuming from reset with TTBR0_EL1 set to the
+                 * idmap to enable the MMU; restore the active_mm mappings in
+                 * TTBR0_EL1 unless the active_mm == &init_mm, in which case
+                 * the thread entered __cpu_suspend with TTBR0_EL1 set to
+                 * reserved TTBR0 page tables and should be restored as such.
+                 */
+                if (mm == &init_mm)
+                        cpu_set_reserved_ttbr0();
+                else
+                        cpu_switch_mm(mm->pgd, mm);
                flush_tlb_all();
                /*
diff --git a/arch/arm64/kvm/Kconfig b/arch/arm64/kvm/Kconfig
index 8ba85e9ea388..b334084d3675 100644
--- a/arch/arm64/kvm/Kconfig
+++ b/arch/arm64/kvm/Kconfig
@@ -26,6 +26,7 @@ config KVM
        select KVM_ARM_HOST
        select KVM_ARM_VGIC
        select KVM_ARM_TIMER
+        select SRCU
        ---help---
          Support hosting virtualized guest machines.
diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
index fbe909fb0a1a..c3ca89c27c6b 100644
--- a/arch/arm64/kvm/hyp.S
+++ b/arch/arm64/kvm/hyp.S
@@ -1014,6 +1014,7 @@ ENTRY(__kvm_tlb_flush_vmid_ipa)
         * Instead, we invalidate Stage-2 for this IPA, and the
         * whole of Stage-1. Weep...
         */
+        lsr     x1, x1, #12
        tlbi    ipas2e1is, x1
        /*
         * We have to ensure completion of the invalidation at Stage-2,
diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
index 70a7816535cd..0b4326578985 100644
--- a/arch/arm64/kvm/reset.c
+++ b/arch/arm64/kvm/reset.c
@@ -90,7 +90,6 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
                        if (!cpu_has_32bit_el1())
                                return -EINVAL;
                        cpu_reset = &default_regs_reset32;
-                        vcpu->arch.hcr_el2 &= ~HCR_RW;
                } else {
                        cpu_reset = &default_regs_reset;
                }
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 3d7c2df89946..f31e8bb2bc5b 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -69,68 +69,31 @@ static u32 get_ccsidr(u32 csselr)
        return ccsidr;
 }
-static void do_dc_cisw(u32 val)
+/*
-{
+ * See note at ARMv7 ARM B1.14.4 (TL;DR: S/W ops are not easily virtualized).
-        asm volatile("dc cisw, %x0" : : "r" (val));
+ */
-        dsb(ish);
-}
-static void do_dc_csw(u32 val)
-{
-        asm volatile("dc csw, %x0" : : "r" (val));
-        dsb(ish);
-}
-/* See note at ARM ARM B1.14.4 */
 static bool access_dcsw(struct kvm_vcpu *vcpu,
                        const struct sys_reg_params *p,
                        const struct sys_reg_desc *r)
 {
-        unsigned long val;
-        int cpu;
        if (!p->is_write)
                return read_from_write_only(vcpu, p);
-        cpu = get_cpu();
+        kvm_set_way_flush(vcpu);
-        cpumask_setall(&vcpu->arch.require_dcache_flush);
-        cpumask_clear_cpu(cpu, &vcpu->arch.require_dcache_flush);
-        /* If we were already preempted, take the long way around */
-        if (cpu != vcpu->arch.last_pcpu) {
-                flush_cache_all();
-                goto done;
-        }
-        val = *vcpu_reg(vcpu, p->Rt);
-        switch (p->CRm) {
-        case 6:                 /* Upgrade DCISW to DCCISW, as per HCR.SWIO */
-        case 14:                /* DCCISW */
-                do_dc_cisw(val);
-                break;
-        case 10:                /* DCCSW */
-                do_dc_csw(val);
-                break;
-        }
-done:
-        put_cpu();
        return true;
 }
 /*
 * Generic accessor for VM registers. Only called as long as HCR_TVM
- * is set.
+ * is set. If the guest enables the MMU, we stop trapping the VM
+ * sys_regs and leave it in complete control of the caches.
 */
 static bool access_vm_reg(struct kvm_vcpu *vcpu,
                          const struct sys_reg_params *p,
                          const struct sys_reg_desc *r)
 {
        unsigned long val;
+        bool was_enabled = vcpu_has_cache_enabled(vcpu);
        BUG_ON(!p->is_write);
@@ -143,25 +106,7 @@ static bool access_vm_reg(struct kvm_vcpu *vcpu,
                vcpu_cp15_64_low(vcpu, r->reg) = val & 0xffffffffUL;
        }
-        return true;
+        kvm_toggle_cache(vcpu, was_enabled);
-}
-/*
- * SCTLR_EL1 accessor. Only called as long as HCR_TVM is set.  If the
- * guest enables the MMU, we stop trapping the VM sys_regs and leave
- * it in complete control of the caches.
- */
-static bool access_sctlr(struct kvm_vcpu *vcpu,
-                         const struct sys_reg_params *p,
-                         const struct sys_reg_desc *r)
-{
-        access_vm_reg(vcpu, p, r);
-        if (vcpu_has_cache_enabled(vcpu)) {     /* MMU+Caches enabled? */
-                vcpu->arch.hcr_el2 &= ~HCR_TVM;
-                stage2_flush_vm(vcpu->kvm);
-        }
        return true;
 }
@@ -377,7 +322,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
          NULL, reset_mpidr, MPIDR_EL1 },
        /* SCTLR_EL1 */
        { Op0(0b11), Op1(0b000), CRn(0b0001), CRm(0b0000), Op2(0b000),
-          access_sctlr, reset_val, SCTLR_EL1, 0x00C50078 },
+          access_vm_reg, reset_val, SCTLR_EL1, 0x00C50078 },
        /* CPACR_EL1 */
        { Op0(0b11), Op1(0b000), CRn(0b0001), CRm(0b0000), Op2(0b010),
          NULL, reset_val, CPACR_EL1, 0 },
@@ -657,7 +602,7 @@ static const struct sys_reg_desc cp14_64_regs[] = {
 * register).
 */
 static const struct sys_reg_desc cp15_regs[] = {
-        { Op1( 0), CRn( 1), CRm( 0), Op2( 0), access_sctlr, NULL, c1_SCTLR },
+        { Op1( 0), CRn( 1), CRm( 0), Op2( 0), access_vm_reg, NULL, c1_SCTLR },
        { Op1( 0), CRn( 2), CRm( 0), Op2( 0), access_vm_reg, NULL, c2_TTBR0 },
        { Op1( 0), CRn( 2), CRm( 0), Op2( 1), access_vm_reg, NULL, c2_TTBR1 },
        { Op1( 0), CRn( 2), CRm( 0), Op2( 2), access_vm_reg, NULL, c2_TTBCR },
diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index cf33f33333cc..d54dc9ac4b70 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -15,6 +15,7 @@
 */
 #include <linux/debugfs.h>
 #include <linux/fs.h>
+#include <linux/io.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
 #include <linux/seq_file.h>
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index bac492c12fcc..c95464a33f36 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -335,14 +335,8 @@ static int keep_initrd;
 void free_initrd_mem(unsigned long start, unsigned long end)
 {
-        if (!keep_initrd) {
+        if (!keep_initrd)
-                if (start == initrd_start)
-                        start = round_down(start, PAGE_SIZE);
-                if (end == initrd_end)
-                        end = round_up(end, PAGE_SIZE);
                free_reserved_area((void *)start, (void *)end, 0, "initrd");
-        }
 }
 static int __init keepinitrd_setup(char *__unused)
diff --git a/arch/avr32/kernel/module.c b/arch/avr32/kernel/module.c
index 2c9412908024..164efa009e5b 100644
--- a/arch/avr32/kernel/module.c
+++ b/arch/avr32/kernel/module.c
@@ -19,12 +19,10 @@
 #include <linux/moduleloader.h>
 #include <linux/vmalloc.h>
-void module_free(struct module *mod, void *module_region)
+void module_arch_freeing_init(struct module *mod)
 {
        vfree(mod->arch.syminfo);
        mod->arch.syminfo = NULL;
-        vfree(module_region);
 }
 static inline int check_rela(Elf32_Rela *rela, struct module *module,
@@ -291,12 +289,3 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
        return ret;
 }
-int module_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
-                    struct module *module)
-{
-        vfree(module->arch.syminfo);
-        module->arch.syminfo = NULL;
-        return 0;
-}
diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
index 0eca93327195..d223a8b57c1e 100644
--- a/arch/avr32/mm/fault.c
+++ b/arch/avr32/mm/fault.c
@@ -142,6 +142,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/blackfin/mach-bf533/boards/stamp.c b/arch/blackfin/mach-bf533/boards/stamp.c
index 6f4bac969bf7..23eada79439c 100644
--- a/arch/blackfin/mach-bf533/boards/stamp.c
+++ b/arch/blackfin/mach-bf533/boards/stamp.c
@@ -7,6 +7,7 @@
 */
 #include <linux/device.h>
+#include <linux/delay.h>
 #include <linux/platform_device.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
diff --git a/arch/cris/arch-v32/drivers/sync_serial.c b/arch/cris/arch-v32/drivers/sync_serial.c
index 08a313fc2241..f772068d9e79 100644
--- a/arch/cris/arch-v32/drivers/sync_serial.c
+++ b/arch/cris/arch-v32/drivers/sync_serial.c
@@ -604,7 +604,7 @@ static ssize_t __sync_serial_read(struct file *file,
                                  struct timespec *ts)
 {
        unsigned long flags;
-        int dev = MINOR(file->f_dentry->d_inode->i_rdev);
+        int dev = MINOR(file_inode(file)->i_rdev);
        int avail;
        struct sync_port *port;
        unsigned char *start;
diff --git a/arch/cris/kernel/module.c b/arch/cris/kernel/module.c
index 51123f985eb5..af04cb6b6dc9 100644
--- a/arch/cris/kernel/module.c
+++ b/arch/cris/kernel/module.c
@@ -36,7 +36,7 @@ void *module_alloc(unsigned long size)
 }
 /* Free memory returned from module_alloc */
-void module_free(struct module *mod, void *module_region)
+void module_memfree(void *module_region)
 {
        kfree(module_region);
 }
diff --git a/arch/cris/mm/fault.c b/arch/cris/mm/fault.c
index 1790f22e71a2..2686a7aa8ec8 100644
--- a/arch/cris/mm/fault.c
+++ b/arch/cris/mm/fault.c
@@ -176,6 +176,8 @@ retry:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/frv/mb93090-mb00/pci-frv.c b/arch/frv/mb93090-mb00/pci-frv.c
index 67b1d1685759..0635bd6c2af3 100644
--- a/arch/frv/mb93090-mb00/pci-frv.c
+++ b/arch/frv/mb93090-mb00/pci-frv.c
@@ -94,7 +94,7 @@ static void __init pcibios_allocate_bus_resources(struct list_head *bus_list)
                                r = &dev->resource[idx];
                                if (!r->start)
                                        continue;
-                                pci_claim_resource(dev, idx);
+                                pci_claim_bridge_resource(dev, idx);
                        }
                }
                pcibios_allocate_bus_resources(&bus->children);
diff --git a/arch/frv/mm/fault.c b/arch/frv/mm/fault.c
index 9a66372fc7c7..ec4917ddf678 100644
--- a/arch/frv/mm/fault.c
+++ b/arch/frv/mm/fault.c
@@ -168,6 +168,8 @@ asmlinkage void do_page_fault(int datammu, unsigned long esr0, unsigned long ear
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
index f3b51b57740a..95c39b95e97e 100644
--- a/arch/ia64/include/asm/unistd.h
+++ b/arch/ia64/include/asm/unistd.h
@@ -11,7 +11,7 @@
-#define NR_syscalls                     318 /* length of syscall table */
+#define NR_syscalls                     319 /* length of syscall table */
 /*
 * The following defines stop scripts/checksyscalls.sh from complaining about
diff --git a/arch/ia64/include/uapi/asm/unistd.h b/arch/ia64/include/uapi/asm/unistd.h
index 4c2240c1b0cb..461079560c78 100644
--- a/arch/ia64/include/uapi/asm/unistd.h
+++ b/arch/ia64/include/uapi/asm/unistd.h
@@ -331,5 +331,6 @@
 #define __NR_getrandom                  1339
 #define __NR_memfd_create               1340
 #define __NR_bpf                        1341
+#define __NR_execveat                   1342
 #endif /* _UAPI_ASM_IA64_UNISTD_H */
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index 615ef81def49..e795cb848154 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -893,13 +893,13 @@ static int _acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
 }
 /* wrapper to silence section mismatch warning */
-int __ref acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
+int __ref acpi_map_cpu(acpi_handle handle, int physid, int *pcpu)
 {
        return _acpi_map_lsapic(handle, physid, pcpu);
 }
-EXPORT_SYMBOL(acpi_map_lsapic);
+EXPORT_SYMBOL(acpi_map_cpu);
-int acpi_unmap_lsapic(int cpu)
+int acpi_unmap_cpu(int cpu)
 {
        ia64_cpu_to_sapicid[cpu] = -1;
        set_cpu_present(cpu, false);
@@ -910,8 +910,7 @@ int acpi_unmap_lsapic(int cpu)
        return (0);
 }
+EXPORT_SYMBOL(acpi_unmap_cpu);
-EXPORT_SYMBOL(acpi_unmap_lsapic);
 #endif                          /* CONFIG_ACPI_HOTPLUG_CPU */
 #ifdef CONFIG_ACPI_NUMA
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index f5e96dffc63c..fcf8b8cbca0b 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1779,6 +1779,7 @@ sys_call_table:
        data8 sys_getrandom
        data8 sys_memfd_create                  // 1340
        data8 sys_bpf
+        data8 sys_execveat
        .org sys_call_table + 8*NR_syscalls     // guard against failures to increase NR_syscalls
 #endif /* __IA64_ASM_PARAVIRTUALIZED_NATIVE */
diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
index 24603be24c14..29754aae5177 100644
--- a/arch/ia64/kernel/module.c
+++ b/arch/ia64/kernel/module.c
@@ -305,14 +305,12 @@ plt_target (struct plt_entry *plt)
 #endif /* !USE_BRL */
 void
-module_free (struct module *mod, void *module_region)
+module_arch_freeing_init (struct module *mod)
 {
-        if (mod && mod->arch.init_unw_table &&
+        if (mod->arch.init_unw_table) {
-            module_region == mod->module_init) {
                unw_remove_unwind_table(mod->arch.init_unw_table);
                mod->arch.init_unw_table = NULL;
        }
-        vfree(module_region);
 }
 /* Have we already seen one of these relocations? */
diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
index 7225dad87094..ba5ba7accd0d 100644
--- a/arch/ia64/mm/fault.c
+++ b/arch/ia64/mm/fault.c
@@ -172,6 +172,8 @@ retry:
                 */
                if (fault & VM_FAULT_OOM) {
                        goto out_of_memory;
+                } else if (fault & VM_FAULT_SIGSEGV) {
+                        goto bad_area;
                } else if (fault & VM_FAULT_SIGBUS) {
                        signal = SIGBUS;
                        goto bad_area;
diff --git a/arch/ia64/pci/pci.c b/arch/ia64/pci/pci.c
index 291a582777cf..900cc93e5409 100644
--- a/arch/ia64/pci/pci.c
+++ b/arch/ia64/pci/pci.c
@@ -487,45 +487,39 @@ int pcibios_root_bridge_prepare(struct pci_host_bridge *bridge)
        return 0;
 }
-static int is_valid_resource(struct pci_dev *dev, int idx)
+void pcibios_fixup_device_resources(struct pci_dev *dev)
 {
-        unsigned int i, type_mask = IORESOURCE_IO | IORESOURCE_MEM;
+        int idx;
-        struct resource *devr = &dev->resource[idx], *busr;
        if (!dev->bus)
-                return 0;
+                return;
-        pci_bus_for_each_resource(dev->bus, busr, i) {
-                if (!busr || ((busr->flags ^ devr->flags) & type_mask))
-                        continue;
-                if ((devr->start) && (devr->start >= busr->start) &&
-                                (devr->end <= busr->end))
-                        return 1;
-        }
-        return 0;
-}
-static void pcibios_fixup_resources(struct pci_dev *dev, int start, int limit)
+        for (idx = 0; idx < PCI_BRIDGE_RESOURCES; idx++) {
-{
+                struct resource *r = &dev->resource[idx];
-        int i;
-        for (i = start; i < limit; i++) {
+                if (!r->flags || r->parent || !r->start)
-                if (!dev->resource[i].flags)
                        continue;
-                if ((is_valid_resource(dev, i)))
-                        pci_claim_resource(dev, i);
-        }
-}
-void pcibios_fixup_device_resources(struct pci_dev *dev)
+                pci_claim_resource(dev, idx);
-{
+        }
-        pcibios_fixup_resources(dev, 0, PCI_BRIDGE_RESOURCES);
 }
 EXPORT_SYMBOL_GPL(pcibios_fixup_device_resources);
 static void pcibios_fixup_bridge_resources(struct pci_dev *dev)
 {
-        pcibios_fixup_resources(dev, PCI_BRIDGE_RESOURCES, PCI_NUM_RESOURCES);
+        int idx;
+        if (!dev->bus)
+                return;
+        for (idx = PCI_BRIDGE_RESOURCES; idx < PCI_NUM_RESOURCES; idx++) {
+                struct resource *r = &dev->resource[idx];
+                if (!r->flags || r->parent || !r->start)
+                        continue;
+                pci_claim_bridge_resource(dev, idx);
+        }
 }
 /*
diff --git a/arch/m32r/mm/fault.c b/arch/m32r/mm/fault.c
index e9c6a8014bd6..e3d4d4890104 100644
--- a/arch/m32r/mm/fault.c
+++ b/arch/m32r/mm/fault.c
@@ -200,6 +200,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 75e75d7b1702..244e0dbe45db 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
-#define NR_syscalls             355
+#define NR_syscalls             356
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
index 2c1bec9a14b6..61fb6cb9d2ae 100644
--- a/arch/m68k/include/uapi/asm/unistd.h
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -360,5 +360,6 @@
 #define __NR_getrandom          352
 #define __NR_memfd_create       353
 #define __NR_bpf                354
+#define __NR_execveat           355
 #endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index 2ca219e184cd..a0ec4303f2c8 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -375,4 +375,5 @@ ENTRY(sys_call_table)
        .long sys_getrandom
        .long sys_memfd_create
        .long sys_bpf
+        .long sys_execveat              /* 355 */
diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c
index 2bd7487440c4..b2f04aee46ec 100644
--- a/arch/m68k/mm/fault.c
+++ b/arch/m68k/mm/fault.c
@@ -145,6 +145,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto map_err;
                else if (fault & VM_FAULT_SIGBUS)
                        goto bus_err;
                BUG();
diff --git a/arch/metag/mm/fault.c b/arch/metag/mm/fault.c
index 332680e5ebf2..2de5dc695a87 100644
--- a/arch/metag/mm/fault.c
+++ b/arch/metag/mm/fault.c
@@ -141,6 +141,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c
index fa4cf52aa7a6..d46a5ebb7570 100644
--- a/arch/microblaze/mm/fault.c
+++ b/arch/microblaze/mm/fault.c
@@ -224,6 +224,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/microblaze/pci/pci-common.c b/arch/microblaze/pci/pci-common.c
index b30e41c0c033..48528fb81eff 100644
--- a/arch/microblaze/pci/pci-common.c
+++ b/arch/microblaze/pci/pci-common.c
@@ -1026,6 +1026,8 @@ static void pcibios_allocate_bus_resources(struct pci_bus *bus)
                         pr, (pr && pr->name) ? pr->name : "nil");
                if (pr && !(pr->flags & IORESOURCE_UNSET)) {
+                        struct pci_dev *dev = bus->self;
                        if (request_resource(pr, res) == 0)
                                continue;
                        /*
@@ -1035,6 +1037,12 @@ static void pcibios_allocate_bus_resources(struct pci_bus *bus)
                         */
                        if (reparent_resources(pr, res) == 0)
                                continue;
+                        if (dev && i < PCI_BRIDGE_RESOURCE_NUM &&
+                            pci_claim_bridge_resource(dev,
+                                                 i + PCI_BRIDGE_RESOURCES) == 0)
+                                continue;
                }
                pr_warn("PCI: Cannot allocate resource region ");
                pr_cont("%d of PCI bridge %d, will remap\n", i, bus->number);
@@ -1227,7 +1235,10 @@ void pcibios_claim_one_bus(struct pci_bus *bus)
                                 (unsigned long long)r->end,
                                 (unsigned int)r->flags);
-                        pci_claim_resource(dev, i);
+                        if (pci_claim_resource(dev, i) == 0)
+                                continue;
+                        pci_claim_bridge_resource(dev, i);
                }
        }
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 3289969ee423..843713c05b79 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -2656,27 +2656,21 @@ config TRAD_SIGNALS
        bool
 config MIPS32_COMPAT
-        bool "Kernel support for Linux/MIPS 32-bit binary compatibility"
+        bool
-        depends on 64BIT
-        help
-          Select this option if you want Linux/MIPS 32-bit binary
-          compatibility. Since all software available for Linux/MIPS is
-          currently 32-bit you should say Y here.
 config COMPAT
        bool
-        depends on MIPS32_COMPAT
-        select ARCH_WANT_OLD_COMPAT_IPC
-        default y
 config SYSVIPC_COMPAT
        bool
-        depends on COMPAT && SYSVIPC
-        default y
 config MIPS32_O32
        bool "Kernel support for o32 binaries"
-        depends on MIPS32_COMPAT
+        depends on 64BIT
+        select ARCH_WANT_OLD_COMPAT_IPC
+        select COMPAT
+        select MIPS32_COMPAT
+        select SYSVIPC_COMPAT if SYSVIPC
        help
          Select this option if you want to run o32 binaries.  These are pure
          32-bit binaries as used by the 32-bit Linux/MIPS port.  Most of
@@ -2686,7 +2680,10 @@ config MIPS32_O32
 config MIPS32_N32
        bool "Kernel support for n32 binaries"
-        depends on MIPS32_COMPAT
+        depends on 64BIT
+        select COMPAT
+        select MIPS32_COMPAT
+        select SYSVIPC_COMPAT if SYSVIPC
        help
          Select this option if you want to run n32 binaries.  These are
          64-bit binaries using 32-bit quantities for addressing and certain
diff --git a/arch/mips/boot/elf2ecoff.c b/arch/mips/boot/elf2ecoff.c
index 8585078ae50e..2a4c52e27f41 100644
--- a/arch/mips/boot/elf2ecoff.c
+++ b/arch/mips/boot/elf2ecoff.c
@@ -49,7 +49,8 @@
 /*
 * Some extra ELF definitions
 */
-#define PT_MIPS_REGINFO 0x70000000      /* Register usage information */
+#define PT_MIPS_REGINFO         0x70000000      /* Register usage information */
+#define PT_MIPS_ABIFLAGS        0x70000003      /* Records ABI related flags  */
 /* -------------------------------------------------------------------- */
@@ -349,39 +350,46 @@ int main(int argc, char *argv[])
        for (i = 0; i < ex.e_phnum; i++) {
                /* Section types we can ignore... */
-                if (ph[i].p_type == PT_NULL || ph[i].p_type == PT_NOTE ||
+                switch (ph[i].p_type) {
-                    ph[i].p_type == PT_PHDR
+                case PT_NULL:
-                    || ph[i].p_type == PT_MIPS_REGINFO)
+                case PT_NOTE:
+                case PT_PHDR:
+                case PT_MIPS_REGINFO:
+                case PT_MIPS_ABIFLAGS:
                        continue;
-                /* Section types we can't handle... */
-                else if (ph[i].p_type != PT_LOAD) {
-                        fprintf(stderr,
-                                "Program header %d type %d can't be converted.\n",
-                                ex.e_phnum, ph[i].p_type);
-                        exit(1);
-                }
-                /* Writable (data) segment? */
-                if (ph[i].p_flags & PF_W) {
-                        struct sect ndata, nbss;
-                        ndata.vaddr = ph[i].p_vaddr;
+                case PT_LOAD:
-                        ndata.len = ph[i].p_filesz;
+                        /* Writable (data) segment? */
-                        nbss.vaddr = ph[i].p_vaddr + ph[i].p_filesz;
+                        if (ph[i].p_flags & PF_W) {
-                        nbss.len = ph[i].p_memsz - ph[i].p_filesz;
+                                struct sect ndata, nbss;
+                                ndata.vaddr = ph[i].p_vaddr;
+                                ndata.len = ph[i].p_filesz;
+                                nbss.vaddr = ph[i].p_vaddr + ph[i].p_filesz;
+                                nbss.len = ph[i].p_memsz - ph[i].p_filesz;
-                        combine(&data, &ndata, 0);
+                                combine(&data, &ndata, 0);
-                        combine(&bss, &nbss, 1);
+                                combine(&bss, &nbss, 1);
-                } else {
+                        } else {
-                        struct sect ntxt;
+                                struct sect ntxt;
-                        ntxt.vaddr = ph[i].p_vaddr;
+                                ntxt.vaddr = ph[i].p_vaddr;
-                        ntxt.len = ph[i].p_filesz;
+                                ntxt.len = ph[i].p_filesz;
-                        combine(&text, &ntxt, 0);
+                                combine(&text, &ntxt, 0);
+                        }
+                        /* Remember the lowest segment start address. */
+                        if (ph[i].p_vaddr < cur_vma)
+                                cur_vma = ph[i].p_vaddr;
+                        break;
+                default:
+                        /* Section types we can't handle... */
+                        fprintf(stderr,
+                                "Program header %d type %d can't be converted.\n",
+                                ex.e_phnum, ph[i].p_type);
+                        exit(1);
                }
-                /* Remember the lowest segment start address. */
-                if (ph[i].p_vaddr < cur_vma)
-                        cur_vma = ph[i].p_vaddr;
        }
        /* Sections must be in order to be converted... */
diff --git a/arch/mips/cavium-octeon/smp.c b/arch/mips/cavium-octeon/smp.c
index ecd903dd1c45..8b1eeffa12ed 100644
--- a/arch/mips/cavium-octeon/smp.c
+++ b/arch/mips/cavium-octeon/smp.c
@@ -240,9 +240,7 @@ static int octeon_cpu_disable(void)
        set_cpu_online(cpu, false);
        cpu_clear(cpu, cpu_callin_map);
-        local_irq_disable();
        octeon_fixup_irqs();
-        local_irq_enable();
        flush_cache_all();
        local_flush_tlb_all();
diff --git a/arch/mips/configs/malta_defconfig b/arch/mips/configs/malta_defconfig
index f57b96dcf7df..61a4460d67d3 100644
--- a/arch/mips/configs/malta_defconfig
+++ b/arch/mips/configs/malta_defconfig
@@ -132,7 +132,6 @@ CONFIG_IP_NF_MATCH_ECN=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_CLUSTERIP=m
 CONFIG_IP_NF_TARGET_ECN=m
@@ -175,7 +174,6 @@ CONFIG_BRIDGE_EBT_MARK_T=m
 CONFIG_BRIDGE_EBT_REDIRECT=m
 CONFIG_BRIDGE_EBT_SNAT=m
 CONFIG_BRIDGE_EBT_LOG=m
-CONFIG_BRIDGE_EBT_ULOG=m
 CONFIG_BRIDGE_EBT_NFLOG=m
 CONFIG_IP_SCTP=m
 CONFIG_BRIDGE=m
@@ -220,8 +218,6 @@ CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_CLS_IND=y
 CONFIG_CFG80211=m
 CONFIG_MAC80211=m
-CONFIG_MAC80211_RC_PID=y
-CONFIG_MAC80211_RC_DEFAULT_PID=y
 CONFIG_MAC80211_MESH=y
 CONFIG_RFKILL=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
@@ -248,19 +244,13 @@ CONFIG_ATA_OVER_ETH=m
 CONFIG_IDE=y
 CONFIG_BLK_DEV_IDECD=y
 CONFIG_IDE_GENERIC=y
-CONFIG_BLK_DEV_GENERIC=y
-CONFIG_BLK_DEV_PIIX=y
-CONFIG_BLK_DEV_IT8213=m
-CONFIG_BLK_DEV_TC86C001=m
 CONFIG_RAID_ATTRS=m
-CONFIG_SCSI=m
+CONFIG_BLK_DEV_SD=y
-CONFIG_BLK_DEV_SD=m
 CONFIG_CHR_DEV_ST=m
 CONFIG_CHR_DEV_OSST=m
 CONFIG_BLK_DEV_SR=m
 CONFIG_BLK_DEV_SR_VENDOR=y
 CONFIG_CHR_DEV_SG=m
-CONFIG_SCSI_MULTI_LUN=y
 CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
 CONFIG_SCSI_SCAN_ASYNC=y
@@ -273,6 +263,8 @@ CONFIG_SCSI_AACRAID=m
 CONFIG_SCSI_AIC7XXX=m
 CONFIG_AIC7XXX_RESET_DELAY_MS=15000
 # CONFIG_AIC7XXX_DEBUG_ENABLE is not set
+CONFIG_ATA=y
+CONFIG_ATA_PIIX=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -340,6 +332,7 @@ CONFIG_UIO=m
 CONFIG_UIO_CIF=m
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_REISERFS_PROC_INFO=y
 CONFIG_REISERFS_FS_XATTR=y
@@ -441,4 +434,3 @@ CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
-CONFIG_CRC16=m
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index 994d21939676..affebb78f5d6 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -64,7 +64,7 @@ static inline int __enable_fpu(enum fpu_mode mode)
                        return SIGFPE;
                /* set FRE */
-                write_c0_config5(read_c0_config5() | MIPS_CONF5_FRE);
+                set_c0_config5(MIPS_CONF5_FRE);
                goto fr_common;
        case FPU_64BIT:
@@ -74,8 +74,10 @@ static inline int __enable_fpu(enum fpu_mode mode)
 #endif
                /* fall through */
        case FPU_32BIT:
-                /* clear FRE */
+                if (cpu_has_fre) {
-                write_c0_config5(read_c0_config5() & ~MIPS_CONF5_FRE);
+                        /* clear FRE */
+                        clear_c0_config5(MIPS_CONF5_FRE);
+                }
 fr_common:
                /* set CU1 & change FR appropriately */
                fr = (int)mode & FPU_FR_MASK;
@@ -182,25 +184,32 @@ static inline int init_fpu(void)
        int ret = 0;
        if (cpu_has_fpu) {
+                unsigned int config5;
                ret = __own_fpu();
-                if (!ret) {
+                if (ret)
-                        unsigned int config5 = read_c0_config5();
+                        return ret;
-                        /*
-                         * Ensure FRE is clear whilst running _init_fpu, since
-                         * single precision FP instructions are used. If FRE
-                         * was set then we'll just end up initialising all 32
-                         * 64b registers.
-                         */
-                        write_c0_config5(config5 & ~MIPS_CONF5_FRE);
-                        enable_fpu_hazard();
+                if (!cpu_has_fre) {
                        _init_fpu();
-                        /* Restore FRE */
+                        return 0;
-                        write_c0_config5(config5);
-                        enable_fpu_hazard();
                }
+                /*
+                 * Ensure FRE is clear whilst running _init_fpu, since
+                 * single precision FP instructions are used. If FRE
+                 * was set then we'll just end up initialising all 32
+                 * 64b registers.
+                 */
+                config5 = clear_c0_config5(MIPS_CONF5_FRE);
+                enable_fpu_hazard();
+                _init_fpu();
+                /* Restore FRE */
+                write_c0_config5(config5);
+                enable_fpu_hazard();
        } else
                fpu_emulator_init_fpu();
diff --git a/arch/mips/include/asm/fw/arc/hinv.h b/arch/mips/include/asm/fw/arc/hinv.h
index f8d37d1df5de..9fac64a26353 100644
--- a/arch/mips/include/asm/fw/arc/hinv.h
+++ b/arch/mips/include/asm/fw/arc/hinv.h
@@ -119,7 +119,7 @@ union key_u {
 #define SGI_ARCS_REV    10                      /* rev .10, 3/04/92 */
 #endif
-typedef struct component {
+typedef struct {
        CONFIGCLASS     Class;
        CONFIGTYPE      Type;
        IDENTIFIERFLAG  Flags;
@@ -140,7 +140,7 @@ struct cfgdata {
 };
 /* System ID */
-typedef struct systemid {
+typedef struct {
        CHAR VendorId[8];
        CHAR ProductId[8];
 } SYSTEMID;
@@ -166,7 +166,7 @@ typedef enum memorytype {
 #endif  /* _NT_PROM */
 } MEMORYTYPE;
-typedef struct memorydescriptor {
+typedef struct {
        MEMORYTYPE      Type;
        LONG            BasePage;
        LONG            PageCount;
diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h
index b95a827d763e..59c0901bdd84 100644
--- a/arch/mips/include/asm/mips-cm.h
+++ b/arch/mips/include/asm/mips-cm.h
@@ -89,9 +89,9 @@ static inline bool mips_cm_has_l2sync(void)
 /* Macros to ease the creation of register access functions */
 #define BUILD_CM_R_(name, off)                                  \
-static inline u32 *addr_gcr_##name(void)                        \
+static inline u32 __iomem *addr_gcr_##name(void)                \
 {                                                               \
-        return (u32 *)(mips_cm_base + (off));                   \
+        return (u32 __iomem *)(mips_cm_base + (off));           \
 }                                                               \
                                                                \
 static inline u32 read_gcr_##name(void)                         \
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index 5e4aef304b02..5b720d8c2745 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -1386,12 +1386,27 @@ do {									\
        __res;                                                          \
 })
+#define _write_32bit_cp1_register(dest, val, gas_hardfloat)             \
+do {                                                                    \
+        __asm__ __volatile__(                                           \
+        "       .set    push                                    \n"     \
+        "       .set    reorder                                 \n"     \
+        "       "STR(gas_hardfloat)"                            \n"     \
+        "       ctc1    %0,"STR(dest)"                          \n"     \
+        "       .set    pop                                     \n"     \
+        : : "r" (val));                                                 \
+} while (0)
 #ifdef GAS_HAS_SET_HARDFLOAT
 #define read_32bit_cp1_register(source)                                 \
        _read_32bit_cp1_register(source, .set hardfloat)
+#define write_32bit_cp1_register(dest, val)                             \
+        _write_32bit_cp1_register(dest, val, .set hardfloat)
 #else
 #define read_32bit_cp1_register(source)                                 \
        _read_32bit_cp1_register(source, )
+#define write_32bit_cp1_register(dest, val)                             \
+        _write_32bit_cp1_register(dest, val, )
 #endif
 #ifdef HAVE_AS_DSP
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index bb7963753730..6499d93ae68d 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -29,13 +29,7 @@
 static inline long syscall_get_nr(struct task_struct *task,
                                  struct pt_regs *regs)
 {
-        /* O32 ABI syscall() - Either 64-bit with O32 or 32-bit */
+        return current_thread_info()->syscall;
-        if ((config_enabled(CONFIG_32BIT) ||
-            test_tsk_thread_flag(task, TIF_32BIT_REGS)) &&
-            (regs->regs[2] == __NR_syscall))
-                return regs->regs[4];
-        else
-                return regs->regs[2];
 }
 static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
index 99eea59604e9..e4440f92b366 100644
--- a/arch/mips/include/asm/thread_info.h
+++ b/arch/mips/include/asm/thread_info.h
@@ -36,6 +36,7 @@ struct thread_info {
                                                 */
        struct restart_block    restart_block;
        struct pt_regs          *regs;
+        long                    syscall;        /* syscall number */
 };
 /*
diff --git a/arch/mips/include/uapi/asm/unistd.h b/arch/mips/include/uapi/asm/unistd.h
index d001bb1ad177..c03088f9f514 100644
--- a/arch/mips/include/uapi/asm/unistd.h
+++ b/arch/mips/include/uapi/asm/unistd.h
@@ -376,16 +376,17 @@
 #define __NR_getrandom                  (__NR_Linux + 353)
 #define __NR_memfd_create               (__NR_Linux + 354)
 #define __NR_bpf                        (__NR_Linux + 355)
+#define __NR_execveat                   (__NR_Linux + 356)
 /*
 * Offset of the last Linux o32 flavoured syscall
 */
-#define __NR_Linux_syscalls             355
+#define __NR_Linux_syscalls             356
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         355
+#define __NR_O32_Linux_syscalls         356
 #if _MIPS_SIM == _MIPS_SIM_ABI64
@@ -709,16 +710,17 @@
 #define __NR_getrandom                  (__NR_Linux + 313)
 #define __NR_memfd_create               (__NR_Linux + 314)
 #define __NR_bpf                        (__NR_Linux + 315)
+#define __NR_execveat                   (__NR_Linux + 316)
 /*
 * Offset of the last Linux 64-bit flavoured syscall
 */
-#define __NR_Linux_syscalls             315
+#define __NR_Linux_syscalls             316
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          315
+#define __NR_64_Linux_syscalls          316
 #if _MIPS_SIM == _MIPS_SIM_NABI32
@@ -1046,15 +1048,16 @@
 #define __NR_getrandom                  (__NR_Linux + 317)
 #define __NR_memfd_create               (__NR_Linux + 318)
 #define __NR_bpf                        (__NR_Linux + 319)
+#define __NR_execveat                   (__NR_Linux + 320)
 /*
 * Offset of the last N32 flavoured syscall
 */
-#define __NR_Linux_syscalls             319
+#define __NR_Linux_syscalls             320
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         319
+#define __NR_N32_Linux_syscalls         320
 #endif /* _UAPI_ASM_UNISTD_H */
diff --git a/arch/mips/jz4740/irq.c b/arch/mips/jz4740/irq.c
index 2531da1d3add..97206b3deb97 100644
--- a/arch/mips/jz4740/irq.c
+++ b/arch/mips/jz4740/irq.c
@@ -30,6 +30,9 @@
 #include <asm/irq_cpu.h>
 #include <asm/mach-jz4740/base.h>
+#include <asm/mach-jz4740/irq.h>
+#include "irq.h"
 static void __iomem *jz_intc_base;
diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c
index c92b15df6893..a5b5b56485c1 100644
--- a/arch/mips/kernel/elf.c
+++ b/arch/mips/kernel/elf.c
@@ -19,8 +19,8 @@ enum {
 int arch_elf_pt_proc(void *_ehdr, void *_phdr, struct file *elf,
                     bool is_interp, struct arch_elf_state *state)
 {
-        struct elfhdr *ehdr = _ehdr;
+        struct elf32_hdr *ehdr = _ehdr;
-        struct elf_phdr *phdr = _phdr;
+        struct elf32_phdr *phdr = _phdr;
        struct mips_elf_abiflags_v0 abiflags;
        int ret;
@@ -48,7 +48,7 @@ int arch_elf_pt_proc(void *_ehdr, void *_phdr, struct file *elf,
        return 0;
 }
-static inline unsigned get_fp_abi(struct elfhdr *ehdr, int in_abi)
+static inline unsigned get_fp_abi(struct elf32_hdr *ehdr, int in_abi)
 {
        /* If the ABI requirement is provided, simply return that */
        if (in_abi != -1)
@@ -65,7 +65,7 @@ static inline unsigned get_fp_abi(struct elfhdr *ehdr, int in_abi)
 int arch_check_elf(void *_ehdr, bool has_interpreter,
                   struct arch_elf_state *state)
 {
-        struct elfhdr *ehdr = _ehdr;
+        struct elf32_hdr *ehdr = _ehdr;
        unsigned fp_abi, interp_fp_abi, abi0, abi1;
        /* Ignore non-O32 binaries */
diff --git a/arch/mips/kernel/irq_cpu.c b/arch/mips/kernel/irq_cpu.c
index 590c2c980fd3..6eb7a3f515fc 100644
--- a/arch/mips/kernel/irq_cpu.c
+++ b/arch/mips/kernel/irq_cpu.c
@@ -57,6 +57,8 @@ static struct irq_chip mips_cpu_irq_controller = {
        .irq_mask_ack   = mask_mips_irq,
        .irq_unmask     = unmask_mips_irq,
        .irq_eoi        = unmask_mips_irq,
+        .irq_disable    = mask_mips_irq,
+        .irq_enable     = unmask_mips_irq,
 };
 /*
@@ -93,6 +95,8 @@ static struct irq_chip mips_mt_cpu_irq_controller = {
        .irq_mask_ack   = mips_mt_cpu_irq_ack,
        .irq_unmask     = unmask_mips_irq,
        .irq_eoi        = unmask_mips_irq,
+        .irq_disable    = mask_mips_irq,
+        .irq_enable     = unmask_mips_irq,
 };
 asmlinkage void __weak plat_irq_dispatch(void)
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index eb76434828e8..85bff5d513e5 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -82,6 +82,30 @@ void flush_thread(void)
 {
 }
+int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+{
+        /*
+         * Save any process state which is live in hardware registers to the
+         * parent context prior to duplication. This prevents the new child
+         * state becoming stale if the parent is preempted before copy_thread()
+         * gets a chance to save the parent's live hardware registers to the
+         * child context.
+         */
+        preempt_disable();
+        if (is_msa_enabled())
+                save_msa(current);
+        else if (is_fpu_owner())
+                _save_fp(current);
+        save_dsp(current);
+        preempt_enable();
+        *dst = *src;
+        return 0;
+}
 int copy_thread(unsigned long clone_flags, unsigned long usp,
        unsigned long arg, struct task_struct *p)
 {
@@ -92,18 +116,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
        childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
-        preempt_disable();
-        if (is_msa_enabled())
-                save_msa(p);
-        else if (is_fpu_owner())
-                save_fp(p);
-        if (cpu_has_dsp)
-                save_dsp(p);
-        preempt_enable();
        /* set up new TSS. */
        childregs = (struct pt_regs *) childksp - 1;
        /*  Put the stack after the struct pt_regs.  */
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 9d1487d83293..510452812594 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -770,6 +770,8 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
        long ret = 0;
        user_exit();
+        current_thread_info()->syscall = syscall;
        if (secure_computing() == -1)
                return -1;
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 00cad1005a16..6e8de80bb446 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -181,6 +181,7 @@ illegal_syscall:
        sll     t1, t0, 2
        beqz    v0, einval
        lw      t2, sys_call_table(t1)          # syscall routine
+        sw      a0, PT_R2(sp)                   # call routine directly on restart
        /* Some syscalls like execve get their arguments from struct pt_regs
           and claim zero arguments in the syscall table. Thus we have to
@@ -580,3 +581,4 @@ EXPORT(sys_call_table)
        PTR     sys_getrandom
        PTR     sys_memfd_create
        PTR     sys_bpf                         /* 4355 */
+        PTR     sys_execveat
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index 5251565e344b..ad4d44635c76 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -435,4 +435,5 @@ EXPORT(sys_call_table)
        PTR     sys_getrandom
        PTR     sys_memfd_create
        PTR     sys_bpf                         /* 5315 */
+        PTR     sys_execveat
        .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 77e74398b828..446cc654da56 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -428,4 +428,5 @@ EXPORT(sysn32_call_table)
        PTR     sys_getrandom
        PTR     sys_memfd_create
        PTR     sys_bpf
+        PTR     compat_sys_execveat             /* 6320 */
        .size   sysn32_call_table,.-sysn32_call_table
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 6f8db9f728e8..d07b210fbeff 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -186,6 +186,7 @@ LEAF(sys32_syscall)
        dsll    t1, t0, 3
        beqz    v0, einval
        ld      t2, sys32_call_table(t1)                # syscall routine
+        sd      a0, PT_R2(sp)           # call routine directly on restart
        move    a0, a1                  # shift argument registers
        move    a1, a2
@@ -565,4 +566,5 @@ EXPORT(sys32_call_table)
        PTR     sys_getrandom
        PTR     sys_memfd_create
        PTR     sys_bpf                         /* 4355 */
+        PTR     compat_sys_execveat
        .size   sys32_call_table,.-sys32_call_table
diff --git a/arch/mips/kernel/smp-cmp.c b/arch/mips/kernel/smp-cmp.c
index 1e0a93c5a3e7..e36a859af666 100644
--- a/arch/mips/kernel/smp-cmp.c
+++ b/arch/mips/kernel/smp-cmp.c
@@ -44,8 +44,8 @@ static void cmp_init_secondary(void)
        struct cpuinfo_mips *c __maybe_unused = &current_cpu_data;
        /* Assume GIC is present */
-        change_c0_status(ST0_IM, STATUSF_IP3 | STATUSF_IP4 | STATUSF_IP6 |
+        change_c0_status(ST0_IM, STATUSF_IP2 | STATUSF_IP3 | STATUSF_IP4 |
-                                 STATUSF_IP7);
+                                 STATUSF_IP5 | STATUSF_IP6 | STATUSF_IP7);
        /* Enable per-cpu interrupts: platform specific */
diff --git a/arch/mips/kernel/smp-mt.c b/arch/mips/kernel/smp-mt.c
index ad86951b73bd..17ea705f6c40 100644
--- a/arch/mips/kernel/smp-mt.c
+++ b/arch/mips/kernel/smp-mt.c
@@ -161,7 +161,8 @@ static void vsmp_init_secondary(void)
 #ifdef CONFIG_MIPS_GIC
        /* This is Malta specific: IPI,performance and timer interrupts */
        if (gic_present)
-                change_c0_status(ST0_IM, STATUSF_IP3 | STATUSF_IP4 |
+                change_c0_status(ST0_IM, STATUSF_IP2 | STATUSF_IP3 |
+                                         STATUSF_IP4 | STATUSF_IP5 |
                                         STATUSF_IP6 | STATUSF_IP7);
        else
 #endif
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index c94c4e92e17d..1c0d8c50b7e1 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -123,10 +123,10 @@ asmlinkage void start_secondary(void)
        unsigned int cpu;
        cpu_probe();
-        cpu_report();
        per_cpu_trap_init(false);
        mips_clockevent_init();
        mp_ops->init_secondary();
+        cpu_report();
        /*
         * XXX parity protection should be folded in here when it's converted
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index ad3d2031c327..c3b41e24c05a 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -1231,7 +1231,8 @@ static int enable_restore_fp_context(int msa)
                /* Restore the scalar FP control & status register */
                if (!was_fpu_owner)
-                        asm volatile("ctc1 %0, $31" : : "r"(current->thread.fpu.fcr31));
+                        write_32bit_cp1_register(CP1_STATUS,
+                                                 current->thread.fpu.fcr31);
        }
 out:
diff --git a/arch/mips/kvm/Kconfig b/arch/mips/kvm/Kconfig
index 30e334e823bd..2ae12825529f 100644
--- a/arch/mips/kvm/Kconfig
+++ b/arch/mips/kvm/Kconfig
@@ -20,6 +20,7 @@ config KVM
        select PREEMPT_NOTIFIERS
        select ANON_INODES
        select KVM_MMIO
+        select SRCU
        ---help---
          Support for hosting Guest kernels.
          Currently supported on MIPS32 processors.
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
index becc42bb1849..70ab5d664332 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -158,6 +158,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index e90b2e899291..30639a6e9b8c 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -489,6 +489,8 @@ static void r4k_tlb_configure(void)
 #ifdef CONFIG_64BIT
                pg |= PG_ELPA;
 #endif
+                if (cpu_has_rixiex)
+                        pg |= PG_IEC;
                write_c0_pagegrain(pg);
        }
diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
index 9fd6834a2172..5d6139390bf8 100644
--- a/arch/mips/net/bpf_jit.c
+++ b/arch/mips/net/bpf_jit.c
@@ -1388,7 +1388,7 @@ out:
 void bpf_jit_free(struct bpf_prog *fp)
 {
        if (fp->jited)
-                module_free(NULL, fp->bpf_func);
+                module_memfree(fp->bpf_func);
        bpf_prog_unlock_free(fp);
 }
diff --git a/arch/mn10300/include/asm/cacheflush.h b/arch/mn10300/include/asm/cacheflush.h
index faed90240ded..6d6df839948f 100644
--- a/arch/mn10300/include/asm/cacheflush.h
+++ b/arch/mn10300/include/asm/cacheflush.h
@@ -159,13 +159,6 @@ extern void flush_icache_range(unsigned long start, unsigned long end);
 #define copy_from_user_page(vma, page, vaddr, dst, src, len) \
        memcpy(dst, src, len)
-/*
- * Internal debugging function
- */
-#ifdef CONFIG_DEBUG_PAGEALLOC
-extern void kernel_map_pages(struct page *page, int numpages, int enable);
-#endif
 #endif /* __ASSEMBLY__ */
 #endif /* _ASM_CACHEFLUSH_H */
diff --git a/arch/mn10300/mm/fault.c b/arch/mn10300/mm/fault.c
index 3516cbdf1ee9..0c2cc5d39c8e 100644
--- a/arch/mn10300/mm/fault.c
+++ b/arch/mn10300/mm/fault.c
@@ -262,6 +262,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/mn10300/unit-asb2305/pci-asb2305.c b/arch/mn10300/unit-asb2305/pci-asb2305.c
index febb9cd83177..b5b036f64275 100644
--- a/arch/mn10300/unit-asb2305/pci-asb2305.c
+++ b/arch/mn10300/unit-asb2305/pci-asb2305.c
@@ -106,7 +106,7 @@ static void __init pcibios_allocate_bus_resources(struct list_head *bus_list)
                                if (!r->flags)
                                        continue;
                                if (!r->start ||
-                                    pci_claim_resource(dev, idx) < 0) {
+                                    pci_claim_bridge_resource(dev, idx) < 0) {
                                        printk(KERN_ERR "PCI:"
                                               " Cannot allocate resource"
                                               " region %d of bridge %s\n",
diff --git a/arch/mn10300/unit-asb2305/pci.c b/arch/mn10300/unit-asb2305/pci.c
index 6b4339f8c9c2..471ff398090c 100644
--- a/arch/mn10300/unit-asb2305/pci.c
+++ b/arch/mn10300/unit-asb2305/pci.c
@@ -281,42 +281,37 @@ static int __init pci_check_direct(void)
        return -ENODEV;
 }
-static int is_valid_resource(struct pci_dev *dev, int idx)
+static void pcibios_fixup_device_resources(struct pci_dev *dev)
 {
-        unsigned int i, type_mask = IORESOURCE_IO | IORESOURCE_MEM;
+        int idx;
-        struct resource *devr = &dev->resource[idx], *busr;
-        if (dev->bus) {
-                pci_bus_for_each_resource(dev->bus, busr, i) {
-                        if (!busr || (busr->flags ^ devr->flags) & type_mask)
-                                continue;
-                        if (devr->start &&
-                            devr->start >= busr->start &&
-                            devr->end <= busr->end)
-                                return 1;
-                }
-        }
-        return 0;
+        if (!dev->bus)
+                return;
+        for (idx = 0; idx < PCI_BRIDGE_RESOURCES; idx++) {
+                struct resource *r = &dev->resource[idx];
+                if (!r->flags || r->parent || !r->start)
+                        continue;
+                pci_claim_resource(dev, idx);
+        }
 }
-static void pcibios_fixup_device_resources(struct pci_dev *dev)
+static void pcibios_fixup_bridge_resources(struct pci_dev *dev)
 {
-        int limit, i;
+        int idx;
-        if (dev->bus->number != 0)
+        if (!dev->bus)
                return;
-        limit = (dev->hdr_type == PCI_HEADER_TYPE_NORMAL) ?
+        for (idx = PCI_BRIDGE_RESOURCES; idx < PCI_NUM_RESOURCES; idx++) {
-                PCI_BRIDGE_RESOURCES : PCI_NUM_RESOURCES;
+                struct resource *r = &dev->resource[idx];
-        for (i = 0; i < limit; i++) {
+                if (!r->flags || r->parent || !r->start)
-                if (!dev->resource[i].flags)
                        continue;
-                if (is_valid_resource(dev, i))
+                pci_claim_bridge_resource(dev, idx);
-                        pci_claim_resource(dev, i);
        }
 }
@@ -330,7 +325,7 @@ void pcibios_fixup_bus(struct pci_bus *bus)
        if (bus->self) {
                pci_read_bridge_bases(bus);
-                pcibios_fixup_device_resources(bus->self);
+                pcibios_fixup_bridge_resources(bus->self);
        }
        list_for_each_entry(dev, &bus->devices, bus_list)
diff --git a/arch/nios2/kernel/cpuinfo.c b/arch/nios2/kernel/cpuinfo.c
index 51d5bb90d3e5..a223691dff4f 100644
--- a/arch/nios2/kernel/cpuinfo.c
+++ b/arch/nios2/kernel/cpuinfo.c
@@ -72,6 +72,7 @@ void __init setup_cpuinfo(void)
        cpuinfo.has_div = fcpu_has(cpu, "altr,has-div");
        cpuinfo.has_mul = fcpu_has(cpu, "altr,has-mul");
        cpuinfo.has_mulx = fcpu_has(cpu, "altr,has-mulx");
+        cpuinfo.mmu = fcpu_has(cpu, "altr,has-mmu");
        if (IS_ENABLED(CONFIG_NIOS2_HW_DIV_SUPPORT) && !cpuinfo.has_div)
                err_cpu("DIV");
diff --git a/arch/nios2/kernel/entry.S b/arch/nios2/kernel/entry.S
index 83bca17d1008..0bdfd13ff98b 100644
--- a/arch/nios2/kernel/entry.S
+++ b/arch/nios2/kernel/entry.S
@@ -365,30 +365,14 @@ ENTRY(ret_from_interrupt)
        GET_THREAD_INFO r1
        ldw     r4, TI_PREEMPT_COUNT(r1)
        bne     r4, r0, restore_all
-need_resched:
        ldw     r4, TI_FLAGS(r1)                /* ? Need resched set */
        BTBZ    r10, r4, TIF_NEED_RESCHED, restore_all
        ldw     r4, PT_ESTATUS(sp)      /* ? Interrupts off */
        andi    r10, r4, ESTATUS_EPIE
        beq     r10, r0, restore_all
-        movia   r4, PREEMPT_ACTIVE
+        call    preempt_schedule_irq
-        stw     r4, TI_PREEMPT_COUNT(r1)
-        rdctl   r10, status             /* enable intrs again */
-        ori     r10, r10 ,STATUS_PIE
-        wrctl   status, r10
-        PUSH    r1
-        call    schedule
-        POP     r1
-        mov     r4, r0
-        stw     r4, TI_PREEMPT_COUNT(r1)
-        rdctl   r10, status             /* disable intrs */
-        andi    r10, r10, %lo(~STATUS_PIE)
-        wrctl   status, r10
-        br      need_resched
-#else
-        br      restore_all
 #endif
+        br      restore_all
 /***********************************************************************
 * A few syscall wrappers
diff --git a/arch/nios2/kernel/module.c b/arch/nios2/kernel/module.c
index cc924a38f22a..e2e3f13f98d5 100644
--- a/arch/nios2/kernel/module.c
+++ b/arch/nios2/kernel/module.c
@@ -36,7 +36,7 @@ void *module_alloc(unsigned long size)
 }
 /* Free memory returned from module_alloc */
-void module_free(struct module *mod, void *module_region)
+void module_memfree(void *module_region)
 {
        kfree(module_region);
 }
diff --git a/arch/nios2/kernel/signal.c b/arch/nios2/kernel/signal.c
index f9d27883a714..2d0ea25be171 100644
--- a/arch/nios2/kernel/signal.c
+++ b/arch/nios2/kernel/signal.c
@@ -200,7 +200,7 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
        /* Set up to return from userspace; jump to fixed address sigreturn
           trampoline on kuser page.  */
-        regs->ra = (unsigned long) (0x1040);
+        regs->ra = (unsigned long) (0x1044);
        /* Set up registers for signal handler */
        regs->sp = (unsigned long) frame;
diff --git a/arch/nios2/mm/fault.c b/arch/nios2/mm/fault.c
index 15a0bb5fc06d..d194c0427b26 100644
--- a/arch/nios2/mm/fault.c
+++ b/arch/nios2/mm/fault.c
@@ -135,6 +135,8 @@ survive:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
@@ -157,9 +159,11 @@ bad_area:
 bad_area_nosemaphore:
        /* User mode accesses just cause a SIGSEGV */
        if (user_mode(regs)) {
-                pr_alert("%s: unhandled page fault (%d) at 0x%08lx, "
+                if (unhandled_signal(current, SIGSEGV) && printk_ratelimit()) {
-                        "cause %ld\n", current->comm, SIGSEGV, address, cause);
+                        pr_info("%s: unhandled page fault (%d) at 0x%08lx, "
-                show_regs(regs);
+                                "cause %ld\n", current->comm, SIGSEGV, address, cause);
+                        show_regs(regs);
+                }
                _exception(SIGSEGV, regs, code, address);
                return;
        }
diff --git a/arch/openrisc/mm/fault.c b/arch/openrisc/mm/fault.c
index 0703acf7d327..230ac20ae794 100644
--- a/arch/openrisc/mm/fault.c
+++ b/arch/openrisc/mm/fault.c
@@ -171,6 +171,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/parisc/include/asm/ldcw.h b/arch/parisc/include/asm/ldcw.h
index d2d11b7055ba..8121aa6db2ff 100644
--- a/arch/parisc/include/asm/ldcw.h
+++ b/arch/parisc/include/asm/ldcw.h
@@ -33,11 +33,18 @@
 #endif /*!CONFIG_PA20*/
-/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*.  */
+/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*.
+   We don't explicitly expose that "*a" may be written as reload
+   fails to find a register in class R1_REGS when "a" needs to be
+   reloaded when generating 64-bit PIC code.  Instead, we clobber
+   memory to indicate to the compiler that the assembly code reads
+   or writes to items other than those listed in the input and output
+   operands.  This may pessimize the code somewhat but __ldcw is
+   usually used within code blocks surrounded by memory barriors.  */
 #define __ldcw(a) ({                                            \
        unsigned __ret;                                         \
-        __asm__ __volatile__(__LDCW " 0(%2),%0"                 \
+        __asm__ __volatile__(__LDCW " 0(%1),%0"                 \
-                : "=r" (__ret), "+m" (*(a)) : "r" (a));         \
+                : "=r" (__ret) : "r" (a) : "memory");           \
        __ret;                                                  \
 })
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index 50dfafc3f2c1..5822e8e200e6 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -298,14 +298,10 @@ static inline unsigned long count_stubs(const Elf_Rela *rela, unsigned long n)
 }
 #endif
+void module_arch_freeing_init(struct module *mod)
-/* Free memory returned from module_alloc */
-void module_free(struct module *mod, void *module_region)
 {
        kfree(mod->arch.section);
        mod->arch.section = NULL;
-        vfree(module_region);
 }
 /* Additional bytes needed in front of individual sections */
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index 3ca9c1131cfe..e5120e653240 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -256,6 +256,8 @@ good_area:
                 */
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto bad_area;
                BUG();
diff --git a/arch/powerpc/crypto/sha1.c b/arch/powerpc/crypto/sha1.c
index d3feba5a275f..c154cebc1041 100644
--- a/arch/powerpc/crypto/sha1.c
+++ b/arch/powerpc/crypto/sha1.c
@@ -154,4 +154,5 @@ module_exit(sha1_powerpc_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm");
+MODULE_ALIAS_CRYPTO("sha1");
 MODULE_ALIAS_CRYPTO("sha1-powerpc");
diff --git a/arch/powerpc/include/asm/cacheflush.h b/arch/powerpc/include/asm/cacheflush.h
index 5b9312220e84..30b35fff2dea 100644
--- a/arch/powerpc/include/asm/cacheflush.h
+++ b/arch/powerpc/include/asm/cacheflush.h
@@ -60,13 +60,6 @@ extern void flush_dcache_phys_range(unsigned long start, unsigned long stop);
 #define copy_from_user_page(vma, page, vaddr, dst, src, len) \
        memcpy(dst, src, len)
-#ifdef CONFIG_DEBUG_PAGEALLOC
-/* internal debugging function */
-void kernel_map_pages(struct page *page, int numpages, int enable);
-#endif
 #endif /* __KERNEL__ */
 #endif /* _ASM_POWERPC_CACHEFLUSH_H */
diff --git a/arch/powerpc/include/asm/kexec.h b/arch/powerpc/include/asm/kexec.h
index 19c36cba37c4..a46f5f45570c 100644
--- a/arch/powerpc/include/asm/kexec.h
+++ b/arch/powerpc/include/asm/kexec.h
@@ -86,6 +86,11 @@ extern int overlaps_crashkernel(unsigned long start, unsigned long size);
 extern void reserve_crashkernel(void);
 extern void machine_kexec_mask_interrupts(void);
+static inline bool kdump_in_progress(void)
+{
+        return crashing_cpu >= 0;
+}
 #else /* !CONFIG_KEXEC */
 static inline void crash_kexec_secondary(struct pt_regs *regs) { }
@@ -106,6 +111,11 @@ static inline int crash_shutdown_unregister(crash_shutdown_t handler)
        return 0;
 }
+static inline bool kdump_in_progress(void)
+{
+        return false;
+}
 #endif /* CONFIG_KEXEC */
 #endif /* ! __ASSEMBLY__ */
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index ce9577d693be..91062eef582f 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -366,3 +366,4 @@ SYSCALL_SPU(seccomp)
 SYSCALL_SPU(getrandom)
 SYSCALL_SPU(memfd_create)
 SYSCALL_SPU(bpf)
+COMPAT_SYS(execveat)
diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
index ebc4f165690a..0be6c681cab1 100644
--- a/arch/powerpc/include/asm/thread_info.h
+++ b/arch/powerpc/include/asm/thread_info.h
@@ -23,9 +23,9 @@
 #define THREAD_SIZE             (1 << THREAD_SHIFT)
 #ifdef CONFIG_PPC64
-#define CURRENT_THREAD_INFO(dest, sp)   clrrdi dest, sp, THREAD_SHIFT
+#define CURRENT_THREAD_INFO(dest, sp)   stringify_in_c(clrrdi dest, sp, THREAD_SHIFT)
 #else
-#define CURRENT_THREAD_INFO(dest, sp)   rlwinm dest, sp, 0, 0, 31-THREAD_SHIFT
+#define CURRENT_THREAD_INFO(dest, sp)   stringify_in_c(rlwinm dest, sp, 0, 0, 31-THREAD_SHIFT)
 #endif
 #ifndef __ASSEMBLY__
@@ -71,12 +71,13 @@ struct thread_info {
 #define THREAD_SIZE_ORDER       (THREAD_SHIFT - PAGE_SHIFT)
 /* how to get the thread information struct from C */
-register unsigned long __current_r1 asm("r1");
 static inline struct thread_info *current_thread_info(void)
 {
-        /* gcc4, at least, is smart enough to turn this into a single
+        unsigned long val;
-         * rlwinm for ppc32 and clrrdi for ppc64 */
-        return (struct thread_info *)(__current_r1 & ~(THREAD_SIZE-1));
+        asm (CURRENT_THREAD_INFO(%0,1) : "=r" (val));
+        return (struct thread_info *)val;
 }
 #endif /* __ASSEMBLY__ */
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index e0da021caa00..36b79c31eedd 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
-#define __NR_syscalls           362
+#define __NR_syscalls           363
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index f55351f2e66e..ef5b5b1f3123 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -384,5 +384,6 @@
 #define __NR_getrandom          359
 #define __NR_memfd_create       360
 #define __NR_bpf                361
+#define __NR_execveat           362
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index 879b3aacac32..f96d1ec24189 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -330,7 +330,7 @@ void default_machine_kexec(struct kimage *image)
        * using debugger IPI.
        */
-        if (crashing_cpu == -1)
+        if (!kdump_in_progress())
                kexec_prepare_cpus();
        pr_debug("kexec: Starting switchover sequence.\n");
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index 37d512d35943..2a525c938158 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -1184,6 +1184,8 @@ static void pcibios_allocate_bus_resources(struct pci_bus *bus)
                         pr, (pr && pr->name) ? pr->name : "nil");
                if (pr && !(pr->flags & IORESOURCE_UNSET)) {
+                        struct pci_dev *dev = bus->self;
                        if (request_resource(pr, res) == 0)
                                continue;
                        /*
@@ -1193,6 +1195,11 @@ static void pcibios_allocate_bus_resources(struct pci_bus *bus)
                         */
                        if (reparent_resources(pr, res) == 0)
                                continue;
+                        if (dev && i < PCI_BRIDGE_RESOURCE_NUM &&
+                            pci_claim_bridge_resource(dev,
+                                                i + PCI_BRIDGE_RESOURCES) == 0)
+                                continue;
                }
                pr_warning("PCI: Cannot allocate resource region "
                           "%d of PCI bridge %d, will remap\n", i, bus->number);
@@ -1401,7 +1408,10 @@ void pcibios_claim_one_bus(struct pci_bus *bus)
                                 (unsigned long long)r->end,
                                 (unsigned int)r->flags);
-                        pci_claim_resource(dev, i);
+                        if (pci_claim_resource(dev, i) == 0)
+                                continue;
+                        pci_claim_bridge_resource(dev, i);
                }
        }
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 8ec017cb4446..8b2d2dc8ef10 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -700,6 +700,7 @@ void start_secondary(void *unused)
        smp_store_cpu_info(cpu);
        set_dec(tb_ticks_per_jiffy);
        preempt_disable();
+        cpu_callin_map[cpu] = 1;
        if (smp_ops->setup_cpu)
                smp_ops->setup_cpu(cpu);
@@ -738,14 +739,6 @@ void start_secondary(void *unused)
        notify_cpu_starting(cpu);
        set_cpu_online(cpu, true);
-        /*
-         * CPU must be marked active and online before we signal back to the
-         * master, because the scheduler needs to see the cpu_online and
-         * cpu_active bits set.
-         */
-        smp_wmb();
-        cpu_callin_map[cpu] = 1;
        local_irq_enable();
        cpu_startup_entry(CPUHP_ONLINE);
diff --git a/arch/powerpc/kvm/Kconfig b/arch/powerpc/kvm/Kconfig
index f5769f19ae25..11850f310fb4 100644
--- a/arch/powerpc/kvm/Kconfig
+++ b/arch/powerpc/kvm/Kconfig
@@ -21,6 +21,7 @@ config KVM
        select PREEMPT_NOTIFIERS
        select ANON_INODES
        select HAVE_KVM_EVENTFD
+        select SRCU
 config KVM_BOOK3S_HANDLER
        bool
diff --git a/arch/powerpc/mm/copro_fault.c b/arch/powerpc/mm/copro_fault.c
index 5a236f082c78..1b5305d4bdab 100644
--- a/arch/powerpc/mm/copro_fault.c
+++ b/arch/powerpc/mm/copro_fault.c
@@ -76,7 +76,7 @@ int copro_handle_mm_fault(struct mm_struct *mm, unsigned long ea,
                if (*flt & VM_FAULT_OOM) {
                        ret = -ENOMEM;
                        goto out_unlock;
-                } else if (*flt & VM_FAULT_SIGBUS) {
+                } else if (*flt & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
                        ret = -EFAULT;
                        goto out_unlock;
                }
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index eb79907f34fa..6154b0a2b063 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -437,6 +437,8 @@ good_area:
         */
        fault = handle_mm_fault(mm, vma, address, flags);
        if (unlikely(fault & (VM_FAULT_RETRY|VM_FAULT_ERROR))) {
+                if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                rc = mm_fault_error(regs, address, fault);
                if (rc >= MM_FAULT_RETURN)
                        goto bail;
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 1ca125b9c226..d1916b577f2c 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -699,7 +699,7 @@ out:
 void bpf_jit_free(struct bpf_prog *fp)
 {
        if (fp->jited)
-                module_free(NULL, fp->bpf_func);
+                module_memfree(fp->bpf_func);
        bpf_prog_unlock_free(fp);
 }
diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
index 54eca8b3b288..0509bca5e830 100644
--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
+++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
@@ -40,7 +40,6 @@ BEGIN_FTR_SECTION;						\
        b       1f;                                             \
 END_FTR_SECTION(0, 1);                                          \
        ld      r12,opal_tracepoint_refcount@toc(r2);           \
-        std     r12,32(r1);                                     \
        cmpdi   r12,0;                                          \
        bne-    LABEL;                                          \
 1:
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index b700a329c31d..d2de7d5d7574 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -304,7 +304,7 @@ int pnv_save_sprs_for_winkle(void)
         * all cpus at boot. Get these reg values of current cpu and use the
         * same accross all cpus.
         */
-        uint64_t lpcr_val = mfspr(SPRN_LPCR);
+        uint64_t lpcr_val = mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1;
        uint64_t hid0_val = mfspr(SPRN_HID0);
        uint64_t hid1_val = mfspr(SPRN_HID1);
        uint64_t hid4_val = mfspr(SPRN_HID4);
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 469751d92004..b5682fd6c984 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -43,6 +43,7 @@
 #include <asm/trace.h>
 #include <asm/firmware.h>
 #include <asm/plpar_wrappers.h>
+#include <asm/kexec.h>
 #include <asm/fadump.h>
 #include "pseries.h"
@@ -267,8 +268,13 @@ static void pSeries_lpar_hptab_clear(void)
                 * out to the user, but at least this will stop us from
                 * continuing on further and creating an even more
                 * difficult to debug situation.
+                 *
+                 * There is a known problem when kdump'ing, if cpus are offline
+                 * the above call will fail. Rather than panicking again, keep
+                 * going and hope the kdump kernel is also little endian, which
+                 * it usually is.
                 */
-                if (rc)
+                if (rc && !kdump_in_progress())
                        panic("Could not enable big endian exceptions");
        }
 #endif
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index 5b150f0c5df9..13c6e200b24e 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -337,6 +337,7 @@ static inline void disable_surveillance(void)
        args.token = rtas_token("set-indicator");
        if (args.token == RTAS_UNKNOWN_SERVICE)
                return;
+        args.token = cpu_to_be32(args.token);
        args.nargs = cpu_to_be32(3);
        args.nret = cpu_to_be32(1);
        args.rets = &args.args[3];
diff --git a/arch/s390/hypfs/hypfs_vm.c b/arch/s390/hypfs/hypfs_vm.c
index 32040ace00ea..afbe07907c10 100644
--- a/arch/s390/hypfs/hypfs_vm.c
+++ b/arch/s390/hypfs/hypfs_vm.c
@@ -231,7 +231,7 @@ failed:
 struct dbfs_d2fc_hdr {
        u64     len;            /* Length of d2fc buffer without header */
        u16     version;        /* Version of header */
-        char    tod_ext[16];    /* TOD clock for d2fc */
+        char    tod_ext[STORE_CLOCK_EXT_SIZE]; /* TOD clock for d2fc */
        u64     count;          /* Number of VM guests in d2fc buffer */
        char    reserved[30];
 } __attribute__ ((packed));
diff --git a/arch/s390/include/asm/cacheflush.h b/arch/s390/include/asm/cacheflush.h
index 3e20383d0921..58fae7d098cf 100644
--- a/arch/s390/include/asm/cacheflush.h
+++ b/arch/s390/include/asm/cacheflush.h
@@ -4,10 +4,6 @@
 /* Caches aren't brain-dead on the s390. */
 #include <asm-generic/cacheflush.h>
-#ifdef CONFIG_DEBUG_PAGEALLOC
-void kernel_map_pages(struct page *page, int numpages, int enable);
-#endif
 int set_memory_ro(unsigned long addr, int numpages);
 int set_memory_rw(unsigned long addr, int numpages);
 int set_memory_nx(unsigned long addr, int numpages);
diff --git a/arch/s390/include/asm/irqflags.h b/arch/s390/include/asm/irqflags.h
index 37b9091ab8c0..16aa0c779e07 100644
--- a/arch/s390/include/asm/irqflags.h
+++ b/arch/s390/include/asm/irqflags.h
@@ -36,7 +36,7 @@ static inline notrace void __arch_local_irq_ssm(unsigned long flags)
 static inline notrace unsigned long arch_local_save_flags(void)
 {
-        return __arch_local_irq_stosm(0x00);
+        return __arch_local_irq_stnsm(0xff);
 }
 static inline notrace unsigned long arch_local_irq_save(void)
diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
index 8beee1cceba4..98eb2a579223 100644
--- a/arch/s390/include/asm/timex.h
+++ b/arch/s390/include/asm/timex.h
@@ -67,20 +67,22 @@ static inline void local_tick_enable(unsigned long long comp)
        set_clock_comparator(S390_lowcore.clock_comparator);
 }
-#define CLOCK_TICK_RATE 1193180 /* Underlying HZ */
+#define CLOCK_TICK_RATE         1193180 /* Underlying HZ */
+#define STORE_CLOCK_EXT_SIZE    16      /* stcke writes 16 bytes */
 typedef unsigned long long cycles_t;
-static inline void get_tod_clock_ext(char clk[16])
+static inline void get_tod_clock_ext(char *clk)
 {
-        typedef struct { char _[sizeof(clk)]; } addrtype;
+        typedef struct { char _[STORE_CLOCK_EXT_SIZE]; } addrtype;
        asm volatile("stcke %0" : "=Q" (*(addrtype *) clk) : : "cc");
 }
 static inline unsigned long long get_tod_clock(void)
 {
-        unsigned char clk[16];
+        unsigned char clk[STORE_CLOCK_EXT_SIZE];
        get_tod_clock_ext(clk);
        return *((unsigned long long *)&clk[1]);
 }
diff --git a/arch/s390/include/uapi/asm/unistd.h b/arch/s390/include/uapi/asm/unistd.h
index 2b446cf0cc65..67878af257a0 100644
--- a/arch/s390/include/uapi/asm/unistd.h
+++ b/arch/s390/include/uapi/asm/unistd.h
@@ -289,7 +289,8 @@
 #define __NR_bpf                351
 #define __NR_s390_pci_mmio_write        352
 #define __NR_s390_pci_mmio_read         353
-#define NR_syscalls 354
+#define __NR_execveat           354
+#define NR_syscalls 355
 /* 
 * There are some system calls that are not present on 64 bit, some
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index b89b59158b95..409d152585be 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -55,14 +55,10 @@ void *module_alloc(unsigned long size)
 }
 #endif
-/* Free memory returned from module_alloc */
+void module_arch_freeing_init(struct module *mod)
-void module_free(struct module *mod, void *module_region)
 {
-        if (mod) {
+        vfree(mod->arch.syminfo);
-                vfree(mod->arch.syminfo);
+        mod->arch.syminfo = NULL;
-                mod->arch.syminfo = NULL;
-        }
-        vfree(module_region);
 }
 static void check_rela(Elf_Rela *rela, struct module *me)
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index a2987243bc76..939ec474b1dd 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -362,3 +362,4 @@ SYSCALL(sys_memfd_create,sys_memfd_create,compat_sys_memfd_create) /* 350 */
 SYSCALL(sys_bpf,sys_bpf,compat_sys_bpf)
 SYSCALL(sys_ni_syscall,sys_s390_pci_mmio_write,compat_sys_s390_pci_mmio_write)
 SYSCALL(sys_ni_syscall,sys_s390_pci_mmio_read,compat_sys_s390_pci_mmio_read)
+SYSCALL(sys_execveat,sys_execveat,compat_sys_execveat)
diff --git a/arch/s390/kernel/uprobes.c b/arch/s390/kernel/uprobes.c
index f6b3cd056ec2..cc7328080b60 100644
--- a/arch/s390/kernel/uprobes.c
+++ b/arch/s390/kernel/uprobes.c
@@ -48,6 +48,30 @@ bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
        return false;
 }
+static int check_per_event(unsigned short cause, unsigned long control,
+                           struct pt_regs *regs)
+{
+        if (!(regs->psw.mask & PSW_MASK_PER))
+                return 0;
+        /* user space single step */
+        if (control == 0)
+                return 1;
+        /* over indication for storage alteration */
+        if ((control & 0x20200000) && (cause & 0x2000))
+                return 1;
+        if (cause & 0x8000) {
+                /* all branches */
+                if ((control & 0x80800000) == 0x80000000)
+                        return 1;
+                /* branch into selected range */
+                if (((control & 0x80800000) == 0x80800000) &&
+                    regs->psw.addr >= current->thread.per_user.start &&
+                    regs->psw.addr <= current->thread.per_user.end)
+                        return 1;
+        }
+        return 0;
+}
 int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
 {
        int fixup = probe_get_fixup_type(auprobe->insn);
@@ -71,9 +95,13 @@ int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
                if (regs->psw.addr - utask->xol_vaddr == ilen)
                        regs->psw.addr = utask->vaddr + ilen;
        }
-        /* If per tracing was active generate trap */
+        if (check_per_event(current->thread.per_event.cause,
-        if (regs->psw.mask & PSW_MASK_PER)
+                            current->thread.per_user.control, regs)) {
-                do_per_trap(regs);
+                /* fix per address */
+                current->thread.per_event.address = utask->vaddr;
+                /* trigger per event */
+                set_pt_regs_flag(regs, PIF_PER_TRAP);
+        }
        return 0;
 }
@@ -106,6 +134,7 @@ void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
        clear_thread_flag(TIF_UPROBE_SINGLESTEP);
        regs->int_code = auprobe->saved_int_code;
        regs->psw.addr = current->utask->vaddr;
+        current->thread.per_event.address = current->utask->vaddr;
 }
 unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline,
@@ -146,17 +175,20 @@ static void adjust_psw_addr(psw_t *psw, unsigned long len)
        __rc;                                           \
 })
-#define emu_store_ril(ptr, input)                       \
+#define emu_store_ril(regs, ptr, input)                 \
 ({                                                      \
        unsigned int mask = sizeof(*(ptr)) - 1;         \
+        __typeof__(ptr) __ptr = (ptr);                  \
        int __rc = 0;                                   \
                                                        \
        if (!test_facility(34))                         \
                __rc = EMU_ILLEGAL_OP;                  \
-        else if ((u64 __force)ptr & mask)               \
+        else if ((u64 __force)__ptr & mask)             \
                __rc = EMU_SPECIFICATION;               \
-        else if (put_user(*(input), ptr))               \
+        else if (put_user(*(input), __ptr))             \
                __rc = EMU_ADDRESSING;                  \
+        if (__rc == 0)                                  \
+                sim_stor_event(regs, __ptr, mask + 1);  \
        __rc;                                           \
 })
@@ -198,6 +230,25 @@ union split_register {
 };
 /*
+ * If user per registers are setup to trace storage alterations and an
+ * emulated store took place on a fitting address a user trap is generated.
+ */
+static void sim_stor_event(struct pt_regs *regs, void *addr, int len)
+{
+        if (!(regs->psw.mask & PSW_MASK_PER))
+                return;
+        if (!(current->thread.per_user.control & PER_EVENT_STORE))
+                return;
+        if ((void *)current->thread.per_user.start > (addr + len))
+                return;
+        if ((void *)current->thread.per_user.end < addr)
+                return;
+        current->thread.per_event.address = regs->psw.addr;
+        current->thread.per_event.cause = PER_EVENT_STORE >> 16;
+        set_pt_regs_flag(regs, PIF_PER_TRAP);
+}
+/*
 * pc relative instructions are emulated, since parameters may not be
 * accessible from the xol area due to range limitations.
 */
@@ -249,13 +300,13 @@ static void handle_insn_ril(struct arch_uprobe *auprobe, struct pt_regs *regs)
                        rc = emu_load_ril((u32 __user *)uptr, &rx->u64);
                        break;
                case 0x07: /* sthrl */
-                        rc = emu_store_ril((u16 __user *)uptr, &rx->u16[3]);
+                        rc = emu_store_ril(regs, (u16 __user *)uptr, &rx->u16[3]);
                        break;
                case 0x0b: /* stgrl */
-                        rc = emu_store_ril((u64 __user *)uptr, &rx->u64);
+                        rc = emu_store_ril(regs, (u64 __user *)uptr, &rx->u64);
                        break;
                case 0x0f: /* strl */
-                        rc = emu_store_ril((u32 __user *)uptr, &rx->u32[1]);
+                        rc = emu_store_ril(regs, (u32 __user *)uptr, &rx->u32[1]);
                        break;
                }
                break;
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index 7f0089d9a4aa..e34122e539a1 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -128,8 +128,6 @@ void vtime_account_irq_enter(struct task_struct *tsk)
        struct thread_info *ti = task_thread_info(tsk);
        u64 timer, system;
-        WARN_ON_ONCE(!irqs_disabled());
        timer = S390_lowcore.last_update_timer;
        S390_lowcore.last_update_timer = get_vtimer();
        S390_lowcore.system_timer += timer - S390_lowcore.last_update_timer;
diff --git a/arch/s390/kvm/Kconfig b/arch/s390/kvm/Kconfig
index 646db9c467d1..5fce52cf0e57 100644
--- a/arch/s390/kvm/Kconfig
+++ b/arch/s390/kvm/Kconfig
@@ -28,6 +28,7 @@ config KVM
        select HAVE_KVM_IRQCHIP
        select HAVE_KVM_IRQFD
        select HAVE_KVM_IRQ_ROUTING
+        select SRCU
        ---help---
          Support hosting paravirtualized guest machines using the SIE
          virtualization capability on the mainframe. This should work
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 811937bb90be..9065d5aa3932 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -374,6 +374,12 @@ static noinline void do_fault_error(struct pt_regs *regs, int fault)
                                do_no_context(regs);
                        else
                                pagefault_out_of_memory();
+                } else if (fault & VM_FAULT_SIGSEGV) {
+                        /* Kernel mode? Handle exceptions or die */
+                        if (!user_mode(regs))
+                                do_no_context(regs);
+                        else
+                                do_sigsegv(regs, SEGV_MAPERR);
                } else if (fault & VM_FAULT_SIGBUS) {
                        /* Kernel mode? Handle exceptions or die */
                        if (!user_mode(regs))
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index be99357d238c..3cf8cc03fff6 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -322,11 +322,12 @@ static int gmap_alloc_table(struct gmap *gmap, unsigned long *table,
 static unsigned long __gmap_segment_gaddr(unsigned long *entry)
 {
        struct page *page;
-        unsigned long offset;
+        unsigned long offset, mask;
        offset = (unsigned long) entry / sizeof(unsigned long);
        offset = (offset & (PTRS_PER_PMD - 1)) * PMD_SIZE;
-        page = pmd_to_page((pmd_t *) entry);
+        mask = ~(PTRS_PER_PMD * sizeof(pmd_t) - 1);
+        page = virt_to_page((void *)((unsigned long) entry & mask));
        return page->index + offset;
 }
diff --git a/arch/s390/net/bpf_jit.S b/arch/s390/net/bpf_jit.S
index 7e45d13816c1..ba44c9f55346 100644
--- a/arch/s390/net/bpf_jit.S
+++ b/arch/s390/net/bpf_jit.S
@@ -22,8 +22,8 @@
 * skb_copy_bits takes 4 parameters:
 *   %r2 = skb pointer
 *   %r3 = offset into skb data
- *   %r4 = length to copy
+ *   %r4 = pointer to temp buffer
- *   %r5 = pointer to temp buffer
+ *   %r5 = length to copy
 */
 #define SKBDATA %r8
@@ -44,8 +44,9 @@ ENTRY(sk_load_word)
 sk_load_word_slow:
        lgr     %r9,%r2                 # save %r2
-        lhi     %r4,4                   # 4 bytes
+        lgr     %r3,%r1                 # offset
-        la      %r5,160(%r15)           # pointer to temp buffer
+        la      %r4,160(%r15)           # pointer to temp buffer
+        lghi    %r5,4                   # 4 bytes
        brasl   %r14,skb_copy_bits      # get data from skb
        l       %r5,160(%r15)           # load result from temp buffer
        ltgr    %r2,%r2                 # set cc to (%r2 != 0)
@@ -69,8 +70,9 @@ ENTRY(sk_load_half)
 sk_load_half_slow:
        lgr     %r9,%r2                 # save %r2
-        lhi     %r4,2                   # 2 bytes
+        lgr     %r3,%r1                 # offset
-        la      %r5,162(%r15)           # pointer to temp buffer
+        la      %r4,162(%r15)           # pointer to temp buffer
+        lghi    %r5,2                   # 2 bytes
        brasl   %r14,skb_copy_bits      # get data from skb
        xc      160(2,%r15),160(%r15)
        l       %r5,160(%r15)           # load result from temp buffer
@@ -95,8 +97,9 @@ ENTRY(sk_load_byte)
 sk_load_byte_slow:
        lgr     %r9,%r2                 # save %r2
-        lhi     %r4,1                   # 1 bytes
+        lgr     %r3,%r1                 # offset
-        la      %r5,163(%r15)           # pointer to temp buffer
+        la      %r4,163(%r15)           # pointer to temp buffer
+        lghi    %r5,1                   # 1 byte
        brasl   %r14,skb_copy_bits      # get data from skb
        xc      160(3,%r15),160(%r15)
        l       %r5,160(%r15)           # load result from temp buffer
@@ -104,11 +107,11 @@ sk_load_byte_slow:
        lgr     %r2,%r9                 # restore %r2
        br      %r8
-        /* A = (*(u8 *)(skb->data+K) & 0xf) << 2 */
+        /* X = (*(u8 *)(skb->data+K) & 0xf) << 2 */
 ENTRY(sk_load_byte_msh)
        llgfr   %r1,%r3                 # extend offset
        clr     %r11,%r3                # hlen < offset ?
-        jle     sk_load_byte_slow
+        jle     sk_load_byte_msh_slow
        lhi     %r12,0
        ic      %r12,0(%r1,%r10)        # get byte from skb
        nill    %r12,0x0f
@@ -118,8 +121,9 @@ ENTRY(sk_load_byte_msh)
 sk_load_byte_msh_slow:
        lgr     %r9,%r2                 # save %r2
-        lhi     %r4,2                   # 2 bytes
+        lgr     %r3,%r1                 # offset
-        la      %r5,162(%r15)           # pointer to temp buffer
+        la      %r4,163(%r15)           # pointer to temp buffer
+        lghi    %r5,1                   # 1 byte
        brasl   %r14,skb_copy_bits      # get data from skb
        xc      160(3,%r15),160(%r15)
        l       %r12,160(%r15)          # load result from temp buffer
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index c52ac77408ca..bbd1981cc150 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -431,8 +431,8 @@ static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
                EMIT4_DISP(0x88500000, K);
                break;
        case BPF_ALU | BPF_NEG: /* A = -A */
-                /* lnr %r5,%r5 */
+                /* lcr %r5,%r5 */
-                EMIT2(0x1155);
+                EMIT2(0x1355);
                break;
        case BPF_JMP | BPF_JA: /* ip += K */
                offset = addrs[i + K] + jit->start - jit->prg;
@@ -448,15 +448,12 @@ static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
                mask = 0x800000; /* je */
 kbranch:        /* Emit compare if the branch targets are different */
                if (filter->jt != filter->jf) {
-                        if (K <= 16383)
+                        if (test_facility(21))
-                                /* chi %r5,<K> */
-                                EMIT4_IMM(0xa75e0000, K);
-                        else if (test_facility(21))
                                /* clfi %r5,<K> */
                                EMIT6_IMM(0xc25f0000, K);
                        else
-                                /* c %r5,<d(K)>(%r13) */
+                                /* cl %r5,<d(K)>(%r13) */
-                                EMIT4_DISP(0x5950d000, EMIT_CONST(K));
+                                EMIT4_DISP(0x5550d000, EMIT_CONST(K));
                }
 branch:         if (filter->jt == filter->jf) {
                        if (filter->jt == 0)
@@ -502,8 +499,8 @@ branch:		if (filter->jt == filter->jf) {
 xbranch:        /* Emit compare if the branch targets are different */
                if (filter->jt != filter->jf) {
                        jit->seen |= SEEN_XREG;
-                        /* cr %r5,%r12 */
+                        /* clr %r5,%r12 */
-                        EMIT2(0x195c);
+                        EMIT2(0x155c);
                }
                goto branch;
        case BPF_JMP | BPF_JSET | BPF_X: /* ip += (A & X) ? jt : jf */
diff --git a/arch/score/mm/fault.c b/arch/score/mm/fault.c
index 52238983527d..6860beb2a280 100644
--- a/arch/score/mm/fault.c
+++ b/arch/score/mm/fault.c
@@ -114,6 +114,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/sh/mm/fault.c b/arch/sh/mm/fault.c
index 541dc6101508..a58fec9b55e0 100644
--- a/arch/sh/mm/fault.c
+++ b/arch/sh/mm/fault.c
@@ -353,6 +353,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
        } else {
                if (fault & VM_FAULT_SIGBUS)
                        do_sigbus(regs, error_code, address);
+                else if (fault & VM_FAULT_SIGSEGV)
+                        bad_area(regs, error_code, address);
                else
                        BUG();
        }
diff --git a/arch/sparc/include/asm/cacheflush_64.h b/arch/sparc/include/asm/cacheflush_64.h
index 38965379e350..68513c41e10d 100644
--- a/arch/sparc/include/asm/cacheflush_64.h
+++ b/arch/sparc/include/asm/cacheflush_64.h
@@ -74,11 +74,6 @@ void flush_ptrace_access(struct vm_area_struct *, struct page *,
 #define flush_cache_vmap(start, end)            do { } while (0)
 #define flush_cache_vunmap(start, end)          do { } while (0)
-#ifdef CONFIG_DEBUG_PAGEALLOC
-/* internal debugging function */
-void kernel_map_pages(struct page *page, int numpages, int enable);
-#endif
 #endif /* !__ASSEMBLY__ */
 #endif /* _SPARC64_CACHEFLUSH_H */
diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c
index b36365f49478..9ce5afe167ff 100644
--- a/arch/sparc/kernel/pci.c
+++ b/arch/sparc/kernel/pci.c
@@ -639,7 +639,10 @@ static void pci_claim_bus_resources(struct pci_bus *bus)
                                       (unsigned long long)r->end,
                                       (unsigned int)r->flags);
-                        pci_claim_resource(dev, i);
+                        if (pci_claim_resource(dev, i) == 0)
+                                continue;
+                        pci_claim_bridge_resource(dev, i);
                }
        }
diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
index 908e8c17c902..70d817154fe8 100644
--- a/arch/sparc/mm/fault_32.c
+++ b/arch/sparc/mm/fault_32.c
@@ -249,6 +249,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
index 18fcd7167095..479823249429 100644
--- a/arch/sparc/mm/fault_64.c
+++ b/arch/sparc/mm/fault_64.c
@@ -446,6 +446,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
index f33e7c7a3bf7..7931eeeb649a 100644
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -776,7 +776,7 @@ cond_branch:			f_offset = addrs[i + filter[i].jf];
                                if (unlikely(proglen + ilen > oldproglen)) {
                                        pr_err("bpb_jit_compile fatal error\n");
                                        kfree(addrs);
-                                        module_free(NULL, image);
+                                        module_memfree(image);
                                        return;
                                }
                                memcpy(image + proglen, temp, ilen);
@@ -822,7 +822,7 @@ out:
 void bpf_jit_free(struct bpf_prog *fp)
 {
        if (fp->jited)
-                module_free(NULL, fp->bpf_func);
+                module_memfree(fp->bpf_func);
        bpf_prog_unlock_free(fp);
 }
diff --git a/arch/tile/kernel/module.c b/arch/tile/kernel/module.c
index 96447c9160a0..2305084c9b93 100644
--- a/arch/tile/kernel/module.c
+++ b/arch/tile/kernel/module.c
@@ -74,7 +74,7 @@ error:
 /* Free memory returned from module_alloc */
-void module_free(struct module *mod, void *module_region)
+void module_memfree(void *module_region)
 {
        vfree(module_region);
@@ -83,7 +83,7 @@ void module_free(struct module *mod, void *module_region)
                     0, 0, 0, NULL, NULL, 0);
        /*
-         * FIXME: If module_region == mod->module_init, trim exception
+         * FIXME: Add module_arch_freeing_init to trim exception
         * table entries.
         */
 }
diff --git a/arch/tile/kvm/Kconfig b/arch/tile/kvm/Kconfig
index 2298cb1daff7..1e968f7550dc 100644
--- a/arch/tile/kvm/Kconfig
+++ b/arch/tile/kvm/Kconfig
@@ -21,6 +21,7 @@ config KVM
        depends on HAVE_KVM && MODULES
        select PREEMPT_NOTIFIERS
        select ANON_INODES
+        select SRCU
        ---help---
          Support hosting paravirtualized guest machines.
diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c
index 565e25a98334..0f61a73534e6 100644
--- a/arch/tile/mm/fault.c
+++ b/arch/tile/mm/fault.c
@@ -442,6 +442,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/arch/um/Kconfig.common b/arch/um/Kconfig.common
index 87bc86821bc9..d195a87ca542 100644
--- a/arch/um/Kconfig.common
+++ b/arch/um/Kconfig.common
@@ -3,6 +3,7 @@ config UML
        default y
        select HAVE_ARCH_AUDITSYSCALL
        select HAVE_UID16
+        select HAVE_FUTEX_CMPXCHG if FUTEX
        select GENERIC_IRQ_SHOW
        select GENERIC_CPU_DEVICES
        select GENERIC_IO
diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c
index 5678c3571e7c..209617302df8 100644
--- a/arch/um/kernel/trap.c
+++ b/arch/um/kernel/trap.c
@@ -80,6 +80,8 @@ good_area:
                if (unlikely(fault & VM_FAULT_ERROR)) {
                        if (fault & VM_FAULT_OOM) {
                                goto out_of_memory;
+                        } else if (fault & VM_FAULT_SIGSEGV) {
+                                goto out;
                        } else if (fault & VM_FAULT_SIGBUS) {
                                err = -EACCES;
                                goto out;
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ba397bde7948..5e28e2be3a41 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -138,6 +138,7 @@ config X86
        select HAVE_ACPI_APEI_NMI if ACPI
        select ACPI_LEGACY_TABLES_LOOKUP if ACPI
        select X86_FEATURE_NAMES if PROC_FS
+        select SRCU
 config INSTRUCTION_DECODER
        def_bool y
@@ -855,9 +856,13 @@ config SCHED_MC
 source "kernel/Kconfig.preempt"
+config UP_LATE_INIT
+       def_bool y
+       depends on !SMP && X86_LOCAL_APIC
 config X86_UP_APIC
        bool "Local APIC support on uniprocessors"
-        depends on X86_32 && !SMP && !X86_32_NON_STANDARD && !PCI_MSI
+        depends on X86_32 && !SMP && !X86_32_NON_STANDARD
        ---help---
          A local APIC (Advanced Programmable Interrupt Controller) is an
          integrated interrupt controller in the CPU. If you have a single-CPU
@@ -868,6 +873,10 @@ config X86_UP_APIC
          performance counters), and the NMI watchdog which detects hard
          lockups.
+config X86_UP_APIC_MSI
+        def_bool y
+        select X86_UP_APIC if X86_32 && !SMP && !X86_32_NON_STANDARD && PCI_MSI
 config X86_UP_IOAPIC
        bool "IO-APIC support on uniprocessors"
        depends on X86_UP_APIC
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index 5b016e2498f3..3db07f30636f 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -51,6 +51,7 @@ targets += cpustr.h
 $(obj)/cpustr.h: $(obj)/mkcpustr FORCE
        $(call if_changed,cpustr)
 endif
+clean-files += cpustr.h
 # ---------------------------------------------------------------------------
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index d999398928bc..ad754b4411f7 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -90,7 +90,7 @@ suffix-$(CONFIG_KERNEL_LZO) 	:= lzo
 suffix-$(CONFIG_KERNEL_LZ4)     := lz4
 RUN_SIZE = $(shell $(OBJDUMP) -h vmlinux | \
-             perl $(srctree)/arch/x86/tools/calc_run_size.pl)
+             $(CONFIG_SHELL) $(srctree)/arch/x86/tools/calc_run_size.sh)
 quiet_cmd_mkpiggy = MKPIGGY $@
      cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false )
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index dcc1c536cc21..a950864a64da 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -373,6 +373,8 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
                                  unsigned long output_len,
                                  unsigned long run_size)
 {
+        unsigned char *output_orig = output;
        real_mode = rmode;
        sanitize_boot_params(real_mode);
@@ -421,7 +423,12 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
        debug_putstr("\nDecompressing Linux... ");
        decompress(input_data, input_len, NULL, NULL, output, NULL, error);
        parse_elf(output);
-        handle_relocations(output, output_len);
+        /*
+         * 32-bit always performs relocations. 64-bit relocations are only
+         * needed if kASLR has chosen a different load address.
+         */
+        if (!IS_ENABLED(CONFIG_X86_64) || output != output_orig)
+                handle_relocations(output, output_len);
        debug_putstr("done.\nBooting the kernel.\n");
        return output;
 }
diff --git a/arch/x86/boot/ctype.h b/arch/x86/boot/ctype.h
index 25e13403193c..020f137df7a2 100644
--- a/arch/x86/boot/ctype.h
+++ b/arch/x86/boot/ctype.h
@@ -1,6 +1,5 @@
-#ifndef BOOT_ISDIGIT_H
+#ifndef BOOT_CTYPE_H
+#define BOOT_CTYPE_H
-#define BOOT_ISDIGIT_H
 static inline int isdigit(int ch)
 {
diff --git a/arch/x86/boot/early_serial_console.c b/arch/x86/boot/early_serial_console.c
index 5df2869c874b..45a07684bbab 100644
--- a/arch/x86/boot/early_serial_console.c
+++ b/arch/x86/boot/early_serial_console.c
@@ -2,8 +2,6 @@
 #define DEFAULT_SERIAL_PORT 0x3f8 /* ttyS0 */
-#define XMTRDY          0x20
 #define DLAB            0x80
 #define TXR             0       /*  Transmit register (WRITE) */
@@ -74,8 +72,8 @@ static void parse_earlyprintk(void)
                        static const int bases[] = { 0x3f8, 0x2f8 };
                        int idx = 0;
-                        if (!strncmp(arg + pos, "ttyS", 4))
+                        /* += strlen("ttyS"); */
-                                pos += 4;
+                        pos += 4;
                        if (arg[pos++] == '1')
                                idx = 1;
diff --git a/arch/x86/crypto/Makefile b/arch/x86/crypto/Makefile
index fd0f848938cc..5a4a089e8b1f 100644
--- a/arch/x86/crypto/Makefile
+++ b/arch/x86/crypto/Makefile
@@ -26,7 +26,6 @@ obj-$(CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL) += ghash-clmulni-intel.o
 obj-$(CONFIG_CRYPTO_CRC32C_INTEL) += crc32c-intel.o
 obj-$(CONFIG_CRYPTO_SHA1_SSSE3) += sha1-ssse3.o
-obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
 obj-$(CONFIG_CRYPTO_CRC32_PCLMUL) += crc32-pclmul.o
 obj-$(CONFIG_CRYPTO_SHA256_SSSE3) += sha256-ssse3.o
 obj-$(CONFIG_CRYPTO_SHA512_SSSE3) += sha512-ssse3.o
@@ -46,6 +45,7 @@ endif
 ifeq ($(avx2_supported),yes)
        obj-$(CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64) += camellia-aesni-avx2.o
        obj-$(CONFIG_CRYPTO_SERPENT_AVX2_X86_64) += serpent-avx2.o
+        obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
 endif
 aes-i586-y := aes-i586-asm_32.o aes_glue.o
diff --git a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
index 2df2a0298f5a..a916c4a61165 100644
--- a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
+++ b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
@@ -208,7 +208,7 @@ ddq_add_8:
        .if (klen == KEY_128)
                .if (load_keys)
-                        vmovdqa 3*16(p_keys), xkeyA
+                        vmovdqa 3*16(p_keys), xkey4
                .endif
        .else
                vmovdqa 3*16(p_keys), xkeyA
@@ -224,7 +224,7 @@ ddq_add_8:
        add     $(16*by), p_in
        .if (klen == KEY_128)
-                vmovdqa 4*16(p_keys), xkey4
+                vmovdqa 4*16(p_keys), xkeyB
        .else
                .if (load_keys)
                        vmovdqa 4*16(p_keys), xkey4
@@ -234,7 +234,12 @@ ddq_add_8:
        .set i, 0
        .rept by
                club XDATA, i
-                vaesenc xkeyA, var_xdata, var_xdata             /* key 3 */
+                /* key 3 */
+                .if (klen == KEY_128)
+                        vaesenc xkey4, var_xdata, var_xdata
+                .else
+                        vaesenc xkeyA, var_xdata, var_xdata
+                .endif
                .set i, (i +1)
        .endr
@@ -243,13 +248,18 @@ ddq_add_8:
        .set i, 0
        .rept by
                club XDATA, i
-                vaesenc xkey4, var_xdata, var_xdata             /* key 4 */
+                /* key 4 */
+                .if (klen == KEY_128)
+                        vaesenc xkeyB, var_xdata, var_xdata
+                .else
+                        vaesenc xkey4, var_xdata, var_xdata
+                .endif
                .set i, (i +1)
        .endr
        .if (klen == KEY_128)
                .if (load_keys)
-                        vmovdqa 6*16(p_keys), xkeyB
+                        vmovdqa 6*16(p_keys), xkey8
                .endif
        .else
                vmovdqa 6*16(p_keys), xkeyB
@@ -267,12 +277,17 @@ ddq_add_8:
        .set i, 0
        .rept by
                club XDATA, i
-                vaesenc xkeyB, var_xdata, var_xdata             /* key 6 */
+                /* key 6 */
+                .if (klen == KEY_128)
+                        vaesenc xkey8, var_xdata, var_xdata
+                .else
+                        vaesenc xkeyB, var_xdata, var_xdata
+                .endif
                .set i, (i +1)
        .endr
        .if (klen == KEY_128)
-                vmovdqa 8*16(p_keys), xkey8
+                vmovdqa 8*16(p_keys), xkeyB
        .else
                .if (load_keys)
                        vmovdqa 8*16(p_keys), xkey8
@@ -288,7 +303,7 @@ ddq_add_8:
        .if (klen == KEY_128)
                .if (load_keys)
-                        vmovdqa 9*16(p_keys), xkeyA
+                        vmovdqa 9*16(p_keys), xkey12
                .endif
        .else
                vmovdqa 9*16(p_keys), xkeyA
@@ -297,7 +312,12 @@ ddq_add_8:
        .set i, 0
        .rept by
                club XDATA, i
-                vaesenc xkey8, var_xdata, var_xdata             /* key 8 */
+                /* key 8 */
+                .if (klen == KEY_128)
+                        vaesenc xkeyB, var_xdata, var_xdata
+                .else
+                        vaesenc xkey8, var_xdata, var_xdata
+                .endif
                .set i, (i +1)
        .endr
@@ -306,7 +326,12 @@ ddq_add_8:
        .set i, 0
        .rept by
                club XDATA, i
-                vaesenc xkeyA, var_xdata, var_xdata             /* key 9 */
+                /* key 9 */
+                .if (klen == KEY_128)
+                        vaesenc xkey12, var_xdata, var_xdata
+                .else
+                        vaesenc xkeyA, var_xdata, var_xdata
+                .endif
                .set i, (i +1)
        .endr
@@ -412,7 +437,6 @@ ddq_add_8:
 /* main body of aes ctr load */
 .macro do_aes_ctrmain key_len
        cmp     $16, num_bytes
        jb      .Ldo_return2\key_len
diff --git a/arch/x86/crypto/sha-mb/sha1_mb.c b/arch/x86/crypto/sha-mb/sha1_mb.c
index a225a5ca1037..fd9f6b035b16 100644
--- a/arch/x86/crypto/sha-mb/sha1_mb.c
+++ b/arch/x86/crypto/sha-mb/sha1_mb.c
@@ -931,4 +931,4 @@ module_exit(sha1_mb_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, multi buffer accelerated");
-MODULE_ALIAS("sha1");
+MODULE_ALIAS_CRYPTO("sha1");
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 82e8a1d44658..156ebcab4ada 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -179,8 +179,8 @@ sysenter_dispatch:
 sysexit_from_sys_call:
        andl    $~TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET)
        /* clear IF, that popfq doesn't enable interrupts early */
-        andl  $~0x200,EFLAGS-R11(%rsp) 
+        andl    $~0x200,EFLAGS-ARGOFFSET(%rsp)
-        movl    RIP-R11(%rsp),%edx              /* User %eip */
+        movl    RIP-ARGOFFSET(%rsp),%edx                /* User %eip */
        CFI_REGISTER rip,rdx
        RESTORE_ARGS 0,24,0,0,0,0
        xorq    %r8,%r8
diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
index 0ab4f9fd2687..3a45668f6dc3 100644
--- a/arch/x86/include/asm/acpi.h
+++ b/arch/x86/include/asm/acpi.h
@@ -50,6 +50,7 @@ void acpi_pic_sci_set_trigger(unsigned int, u16);
 extern int (*__acpi_register_gsi)(struct device *dev, u32 gsi,
                                  int trigger, int polarity);
+extern void (*__acpi_unregister_gsi)(u32 gsi);
 static inline void disable_acpi(void)
 {
diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index 465b309af254..92003f3c8a42 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -106,7 +106,14 @@ extern u32 native_safe_apic_wait_icr_idle(void);
 extern void native_apic_icr_write(u32 low, u32 id);
 extern u64 native_apic_icr_read(void);
-extern int x2apic_mode;
+static inline bool apic_is_x2apic_enabled(void)
+{
+        u64 msr;
+        if (rdmsrl_safe(MSR_IA32_APICBASE, &msr))
+                return false;
+        return msr & X2APIC_ENABLE;
+}
 #ifdef CONFIG_X86_X2APIC
 /*
@@ -169,48 +176,23 @@ static inline u64 native_x2apic_icr_read(void)
        return val;
 }
+extern int x2apic_mode;
 extern int x2apic_phys;
-extern int x2apic_preenabled;
+extern void __init check_x2apic(void);
-extern void check_x2apic(void);
+extern void x2apic_setup(void);
-extern void enable_x2apic(void);
 static inline int x2apic_enabled(void)
 {
-        u64 msr;
+        return cpu_has_x2apic && apic_is_x2apic_enabled();
-        if (!cpu_has_x2apic)
-                return 0;
-        rdmsrl(MSR_IA32_APICBASE, msr);
-        if (msr & X2APIC_ENABLE)
-                return 1;
-        return 0;
 }
 #define x2apic_supported()      (cpu_has_x2apic)
-static inline void x2apic_force_phys(void)
-{
-        x2apic_phys = 1;
-}
 #else
-static inline void disable_x2apic(void)
+static inline void check_x2apic(void) { }
-{
+static inline void x2apic_setup(void) { }
-}
+static inline int x2apic_enabled(void) { return 0; }
-static inline void check_x2apic(void)
-{
-}
-static inline void enable_x2apic(void)
-{
-}
-static inline int x2apic_enabled(void)
-{
-        return 0;
-}
-static inline void x2apic_force_phys(void)
-{
-}
-#define x2apic_preenabled 0
+#define x2apic_mode             (0)
-#define x2apic_supported()      0
+#define x2apic_supported()      (0)
 #endif
 extern void enable_IR_x2apic(void);
@@ -219,7 +201,6 @@ extern int get_physical_broadcast(void);
 extern int lapic_get_maxlvt(void);
 extern void clear_local_APIC(void);
-extern void connect_bsp_APIC(void);
 extern void disconnect_bsp_APIC(int virt_wire_setup);
 extern void disable_local_APIC(void);
 extern void lapic_shutdown(void);
@@ -227,8 +208,6 @@ extern int verify_local_APIC(void);
 extern void sync_Arb_IDs(void);
 extern void init_bsp_APIC(void);
 extern void setup_local_APIC(void);
-extern void end_local_APIC_setup(void);
-extern void bsp_end_local_APIC_setup(void);
 extern void init_apic_mappings(void);
 void register_lapic_address(unsigned long address);
 extern void setup_boot_APIC_clock(void);
@@ -236,6 +215,9 @@ extern void setup_secondary_APIC_clock(void);
 extern int APIC_init_uniprocessor(void);
 extern int apic_force_enable(unsigned long addr);
+extern int apic_bsp_setup(bool upmode);
+extern void apic_ap_setup(void);
 /*
 * On 32bit this is mach-xxx local
 */
diff --git a/arch/x86/include/asm/calling.h b/arch/x86/include/asm/calling.h
index 76659b67fd11..1f1297b46f83 100644
--- a/arch/x86/include/asm/calling.h
+++ b/arch/x86/include/asm/calling.h
@@ -83,7 +83,6 @@ For 32-bit we have the following conventions - kernel is built with
 #define SS              160
 #define ARGOFFSET       R11
-#define SWFRAME         ORIG_RAX
        .macro SAVE_ARGS addskip=0, save_rcx=1, save_r891011=1, rax_enosys=0
        subq  $9*8+\addskip, %rsp
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index aede2c347bde..90a54851aedc 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -174,6 +174,7 @@
 #define X86_FEATURE_TOPOEXT     ( 6*32+22) /* topology extensions CPUID leafs */
 #define X86_FEATURE_PERFCTR_CORE ( 6*32+23) /* core performance counter extensions */
 #define X86_FEATURE_PERFCTR_NB  ( 6*32+24) /* NB performance counter extensions */
+#define X86_FEATURE_BPEXT       (6*32+26) /* data breakpoint extension */
 #define X86_FEATURE_PERFCTR_L2  ( 6*32+28) /* L2 performance counter extensions */
 /*
@@ -388,6 +389,7 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
 #define cpu_has_cx16            boot_cpu_has(X86_FEATURE_CX16)
 #define cpu_has_eager_fpu       boot_cpu_has(X86_FEATURE_EAGER_FPU)
 #define cpu_has_topoext         boot_cpu_has(X86_FEATURE_TOPOEXT)
+#define cpu_has_bpext           boot_cpu_has(X86_FEATURE_BPEXT)
 #if __GNUC__ >= 4
 extern void warn_pre_alternatives(void);
diff --git a/arch/x86/include/asm/debugreg.h b/arch/x86/include/asm/debugreg.h
index 61fd18b83b6c..12cb66f6d3a5 100644
--- a/arch/x86/include/asm/debugreg.h
+++ b/arch/x86/include/asm/debugreg.h
@@ -114,5 +114,10 @@ static inline void debug_stack_usage_inc(void) { }
 static inline void debug_stack_usage_dec(void) { }
 #endif /* X86_64 */
+#ifdef CONFIG_CPU_SUP_AMD
+extern void set_dr_addr_mask(unsigned long mask, int dr);
+#else
+static inline void set_dr_addr_mask(unsigned long mask, int dr) { }
+#endif
 #endif /* _ASM_X86_DEBUGREG_H */
diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
index 50d033a8947d..a94b82e8f156 100644
--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -251,7 +251,8 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
                gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
 }
-#define _LDT_empty(info)                                \
+/* This intentionally ignores lm, since 32-bit apps don't have that field. */
+#define LDT_empty(info)                                 \
        ((info)->base_addr              == 0    &&      \
         (info)->limit                  == 0    &&      \
         (info)->contents               == 0    &&      \
@@ -261,11 +262,18 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
         (info)->seg_not_present        == 1    &&      \
         (info)->useable                == 0)
-#ifdef CONFIG_X86_64
+/* Lots of programs expect an all-zero user_desc to mean "no segment at all". */
-#define LDT_empty(info) (_LDT_empty(info) && ((info)->lm == 0))
+static inline bool LDT_zero(const struct user_desc *info)
-#else
+{
-#define LDT_empty(info) (_LDT_empty(info))
+        return (info->base_addr         == 0 &&
-#endif
+                info->limit             == 0 &&
+                info->contents          == 0 &&
+                info->read_exec_only    == 0 &&
+                info->seg_32bit         == 0 &&
+                info->limit_in_pages    == 0 &&
+                info->seg_not_present   == 0 &&
+                info->useable           == 0);
+}
 static inline void clear_LDT(void)
 {
diff --git a/arch/x86/include/asm/hw_breakpoint.h b/arch/x86/include/asm/hw_breakpoint.h
index ef1c4d2d41ec..6c98be864a75 100644
--- a/arch/x86/include/asm/hw_breakpoint.h
+++ b/arch/x86/include/asm/hw_breakpoint.h
@@ -12,6 +12,7 @@
 */
 struct arch_hw_breakpoint {
        unsigned long   address;
+        unsigned long   mask;
        u8              len;
        u8              type;
 };
diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h
index bf006cce9418..2f91685fe1cd 100644
--- a/arch/x86/include/asm/io_apic.h
+++ b/arch/x86/include/asm/io_apic.h
@@ -279,6 +279,11 @@ static inline void disable_ioapic_support(void) { }
 #define native_ioapic_set_affinity      NULL
 #define native_setup_ioapic_entry       NULL
 #define native_eoi_ioapic_pin           NULL
+static inline void setup_IO_APIC(void) { }
+static inline void enable_IO_APIC(void) { }
+static inline void setup_ioapic_dest(void) { }
 #endif
 #endif /* _ASM_X86_IO_APIC_H */
diff --git a/arch/x86/include/asm/irq_remapping.h b/arch/x86/include/asm/irq_remapping.h
index b7747c4c2cf2..6224d316c405 100644
--- a/arch/x86/include/asm/irq_remapping.h
+++ b/arch/x86/include/asm/irq_remapping.h
@@ -33,8 +33,6 @@ struct irq_cfg;
 #ifdef CONFIG_IRQ_REMAP
-extern void setup_irq_remapping_ops(void);
-extern int irq_remapping_supported(void);
 extern void set_irq_remapping_broken(void);
 extern int irq_remapping_prepare(void);
 extern int irq_remapping_enable(void);
@@ -60,8 +58,6 @@ void irq_remap_modify_chip_defaults(struct irq_chip *chip);
 #else  /* CONFIG_IRQ_REMAP */
-static inline void setup_irq_remapping_ops(void) { }
-static inline int irq_remapping_supported(void) { return 0; }
 static inline void set_irq_remapping_broken(void) { }
 static inline int irq_remapping_prepare(void) { return -ENODEV; }
 static inline int irq_remapping_enable(void) { return -ENODEV; }
diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index 51b26e895933..9b3de99dc004 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -190,7 +190,6 @@ enum mcp_flags {
 void machine_check_poll(enum mcp_flags flags, mce_banks_t *b);
 int mce_notify_irq(void);
-void mce_notify_process(void);
 DECLARE_PER_CPU(struct mce, injectm);
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 40269a2bf6f9..4b75d591eb5e 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -130,7 +130,25 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
 static inline void arch_unmap(struct mm_struct *mm, struct vm_area_struct *vma,
                              unsigned long start, unsigned long end)
 {
-        mpx_notify_unmap(mm, vma, start, end);
+        /*
+         * mpx_notify_unmap() goes and reads a rarely-hot
+         * cacheline in the mm_struct.  That can be expensive
+         * enough to be seen in profiles.
+         *
+         * The mpx_notify_unmap() call and its contents have been
+         * observed to affect munmap() performance on hardware
+         * where MPX is not present.
+         *
+         * The unlikely() optimizes for the fast case: no MPX
+         * in the CPU, or no MPX use in the process.  Even if
+         * we get this wrong (in the unlikely event that MPX
+         * is widely enabled on some system) the overhead of
+         * MPX itself (reading bounds tables) is expected to
+         * overwhelm the overhead of getting this unlikely()
+         * consistently wrong.
+         */
+        if (unlikely(cpu_feature_enabled(X86_FEATURE_MPX)))
+                mpx_notify_unmap(mm, vma, start, end);
 }
 #endif /* _ASM_X86_MMU_CONTEXT_H */
diff --git a/arch/x86/include/asm/smpboot_hooks.h b/arch/x86/include/asm/smpboot_hooks.h
deleted file mode 100644
index 0da7409f0bec..000000000000
--- a/arch/x86/include/asm/smpboot_hooks.h
+++ /dev/null
@@ -1,68 +0,0 @@
-/* two abstractions specific to kernel/smpboot.c, mainly to cater to visws
- * which needs to alter them. */
-static inline void smpboot_clear_io_apic_irqs(void)
-{
-#ifdef CONFIG_X86_IO_APIC
-        io_apic_irqs = 0;
-#endif
-}
-static inline void smpboot_setup_warm_reset_vector(unsigned long start_eip)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&rtc_lock, flags);
-        CMOS_WRITE(0xa, 0xf);
-        spin_unlock_irqrestore(&rtc_lock, flags);
-        local_flush_tlb();
-        pr_debug("1.\n");
-        *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_HIGH)) =
-                                                        start_eip >> 4;
-        pr_debug("2.\n");
-        *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_LOW)) =
-                                                        start_eip & 0xf;
-        pr_debug("3.\n");
-}
-static inline void smpboot_restore_warm_reset_vector(void)
-{
-        unsigned long flags;
-        /*
-         * Install writable page 0 entry to set BIOS data area.
-         */
-        local_flush_tlb();
-        /*
-         * Paranoid:  Set warm reset code and vector here back
-         * to default values.
-         */
-        spin_lock_irqsave(&rtc_lock, flags);
-        CMOS_WRITE(0, 0xf);
-        spin_unlock_irqrestore(&rtc_lock, flags);
-        *((volatile u32 *)phys_to_virt(TRAMPOLINE_PHYS_LOW)) = 0;
-}
-static inline void __init smpboot_setup_io_apic(void)
-{
-#ifdef CONFIG_X86_IO_APIC
-        /*
-         * Here we can be sure that there is an IO-APIC in the system. Let's
-         * go and set it up:
-         */
-        if (!skip_ioapic_setup && nr_ioapics)
-                setup_IO_APIC();
-        else {
-                nr_ioapics = 0;
-        }
-#endif
-}
-static inline void smpboot_clear_io_apic(void)
-{
-#ifdef CONFIG_X86_IO_APIC
-        nr_ioapics = 0;
-#endif
-}
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index 547e344a6dc6..e82e95abc92b 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -75,7 +75,6 @@ struct thread_info {
 #define TIF_SYSCALL_EMU         6       /* syscall emulation active */
 #define TIF_SYSCALL_AUDIT       7       /* syscall auditing active */
 #define TIF_SECCOMP             8       /* secure computing */
-#define TIF_MCE_NOTIFY          10      /* notify userspace of an MCE */
 #define TIF_USER_RETURN_NOTIFY  11      /* notify kernel of userspace return */
 #define TIF_UPROBE              12      /* breakpointed or singlestepping */
 #define TIF_NOTSC               16      /* TSC is not accessible in userland */
@@ -100,7 +99,6 @@ struct thread_info {
 #define _TIF_SYSCALL_EMU        (1 << TIF_SYSCALL_EMU)
 #define _TIF_SYSCALL_AUDIT      (1 << TIF_SYSCALL_AUDIT)
 #define _TIF_SECCOMP            (1 << TIF_SECCOMP)
-#define _TIF_MCE_NOTIFY         (1 << TIF_MCE_NOTIFY)
 #define _TIF_USER_RETURN_NOTIFY (1 << TIF_USER_RETURN_NOTIFY)
 #define _TIF_UPROBE             (1 << TIF_UPROBE)
 #define _TIF_NOTSC              (1 << TIF_NOTSC)
@@ -140,7 +138,7 @@ struct thread_info {
 /* Only used for 64 bit */
 #define _TIF_DO_NOTIFY_MASK                                             \
-        (_TIF_SIGPENDING | _TIF_MCE_NOTIFY | _TIF_NOTIFY_RESUME |       \
+        (_TIF_SIGPENDING | _TIF_NOTIFY_RESUME |                         \
         _TIF_USER_RETURN_NOTIFY | _TIF_UPROBE)
 /* flags to check in __switch_to() */
@@ -170,6 +168,17 @@ static inline struct thread_info *current_thread_info(void)
        return ti;
 }
+static inline unsigned long current_stack_pointer(void)
+{
+        unsigned long sp;
+#ifdef CONFIG_X86_64
+        asm("mov %%rsp,%0" : "=g" (sp));
+#else
+        asm("mov %%esp,%0" : "=g" (sp));
+#endif
+        return sp;
+}
 #else /* !__ASSEMBLY__ */
 /* how to get the thread information struct from ASM */
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index 707adc6549d8..4e49d7dff78e 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -1,6 +1,7 @@
 #ifndef _ASM_X86_TRAPS_H
 #define _ASM_X86_TRAPS_H
+#include <linux/context_tracking_state.h>
 #include <linux/kprobes.h>
 #include <asm/debugreg.h>
@@ -110,6 +111,11 @@ asmlinkage void smp_thermal_interrupt(void);
 asmlinkage void mce_threshold_interrupt(void);
 #endif
+extern enum ctx_state ist_enter(struct pt_regs *regs);
+extern void ist_exit(struct pt_regs *regs, enum ctx_state prev_state);
+extern void ist_begin_non_atomic(struct pt_regs *regs);
+extern void ist_end_non_atomic(void);
 /* Interrupts/Exceptions */
 enum {
        X86_TRAP_DE = 0,        /*  0, Divide-by-zero */
diff --git a/arch/x86/include/asm/vgtod.h b/arch/x86/include/asm/vgtod.h
index e7e9682a33e9..f556c4843aa1 100644
--- a/arch/x86/include/asm/vgtod.h
+++ b/arch/x86/include/asm/vgtod.h
@@ -80,9 +80,11 @@ static inline unsigned int __getcpu(void)
        /*
         * Load per CPU data from GDT.  LSL is faster than RDTSCP and
-         * works on all CPUs.
+         * works on all CPUs.  This is volatile so that it orders
+         * correctly wrt barrier() and to keep gcc from cleverly
+         * hoisting it out of the calling function.
         */
-        asm("lsl %1,%0" : "=r" (p) : "r" (__PER_CPU_SEG));
+        asm volatile ("lsl %1,%0" : "=r" (p) : "r" (__PER_CPU_SEG));
        return p;
 }
diff --git a/arch/x86/include/uapi/asm/msr-index.h b/arch/x86/include/uapi/asm/msr-index.h
index c8aa65d56027..d979e5abae55 100644
--- a/arch/x86/include/uapi/asm/msr-index.h
+++ b/arch/x86/include/uapi/asm/msr-index.h
@@ -251,6 +251,10 @@
 /* Fam 16h MSRs */
 #define MSR_F16H_L2I_PERF_CTL           0xc0010230
 #define MSR_F16H_L2I_PERF_CTR           0xc0010231
+#define MSR_F16H_DR1_ADDR_MASK          0xc0011019
+#define MSR_F16H_DR2_ADDR_MASK          0xc001101a
+#define MSR_F16H_DR3_ADDR_MASK          0xc001101b
+#define MSR_F16H_DR0_ADDR_MASK          0xc0011027
 /* Fam 15h MSRs */
 #define MSR_F15H_PERF_CTL               0xc0010200
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 4433a4be8171..a18fff361c7f 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -611,20 +611,20 @@ void __init acpi_pic_sci_set_trigger(unsigned int irq, u16 trigger)
 int acpi_gsi_to_irq(u32 gsi, unsigned int *irqp)
 {
-        int irq;
+        int rc, irq, trigger, polarity;
-        if (acpi_irq_model == ACPI_IRQ_MODEL_PIC) {
+        rc = acpi_get_override_irq(gsi, &trigger, &polarity);
-                *irqp = gsi;
+        if (rc == 0) {
-        } else {
+                trigger = trigger ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE;
-                mutex_lock(&acpi_ioapic_lock);
+                polarity = polarity ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH;
-                irq = mp_map_gsi_to_irq(gsi,
+                irq = acpi_register_gsi(NULL, gsi, trigger, polarity);
-                                        IOAPIC_MAP_ALLOC | IOAPIC_MAP_CHECK);
+                if (irq >= 0) {
-                mutex_unlock(&acpi_ioapic_lock);
+                        *irqp = irq;
-                if (irq < 0)
+                        return 0;
-                        return -1;
+                }
-                *irqp = irq;
        }
-        return 0;
+        return -1;
 }
 EXPORT_SYMBOL_GPL(acpi_gsi_to_irq);
@@ -653,6 +653,7 @@ static int acpi_register_gsi_pic(struct device *dev, u32 gsi,
        return gsi;
 }
+#ifdef CONFIG_X86_LOCAL_APIC
 static int acpi_register_gsi_ioapic(struct device *dev, u32 gsi,
                                    int trigger, int polarity)
 {
@@ -675,6 +676,7 @@ static void acpi_unregister_gsi_ioapic(u32 gsi)
        mutex_unlock(&acpi_ioapic_lock);
 #endif
 }
+#endif
 int (*__acpi_register_gsi)(struct device *dev, u32 gsi,
                           int trigger, int polarity) = acpi_register_gsi_pic;
@@ -750,13 +752,13 @@ static int _acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
 }
 /* wrapper to silence section mismatch warning */
-int __ref acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
+int __ref acpi_map_cpu(acpi_handle handle, int physid, int *pcpu)
 {
        return _acpi_map_lsapic(handle, physid, pcpu);
 }
-EXPORT_SYMBOL(acpi_map_lsapic);
+EXPORT_SYMBOL(acpi_map_cpu);
-int acpi_unmap_lsapic(int cpu)
+int acpi_unmap_cpu(int cpu)
 {
 #ifdef CONFIG_ACPI_NUMA
        set_apicid_to_node(per_cpu(x86_cpu_to_apicid, cpu), NUMA_NO_NODE);
@@ -768,8 +770,7 @@ int acpi_unmap_lsapic(int cpu)
        return (0);
 }
+EXPORT_SYMBOL(acpi_unmap_cpu);
-EXPORT_SYMBOL(acpi_unmap_lsapic);
 #endif                          /* CONFIG_ACPI_HOTPLUG_CPU */
 int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base)
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 29b5b18afa27..b665d241efad 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -134,9 +134,6 @@ static inline void imcr_apic_to_pic(void)
 */
 static int force_enable_local_apic __initdata;
-/* Control whether x2APIC mode is enabled or not */
-static bool nox2apic __initdata;
 /*
 * APIC command line parameters
 */
@@ -161,33 +158,6 @@ static __init int setup_apicpmtimer(char *s)
 __setup("apicpmtimer", setup_apicpmtimer);
 #endif
-int x2apic_mode;
-#ifdef CONFIG_X86_X2APIC
-/* x2apic enabled before OS handover */
-int x2apic_preenabled;
-static int x2apic_disabled;
-static int __init setup_nox2apic(char *str)
-{
-        if (x2apic_enabled()) {
-                int apicid = native_apic_msr_read(APIC_ID);
-                if (apicid >= 255) {
-                        pr_warning("Apicid: %08x, cannot enforce nox2apic\n",
-                                   apicid);
-                        return 0;
-                }
-                pr_warning("x2apic already enabled. will disable it\n");
-        } else
-                setup_clear_cpu_cap(X86_FEATURE_X2APIC);
-        nox2apic = true;
-        return 0;
-}
-early_param("nox2apic", setup_nox2apic);
-#endif
 unsigned long mp_lapic_addr;
 int disable_apic;
 /* Disable local APIC timer from the kernel commandline or via dmi quirk */
@@ -1475,7 +1445,7 @@ void setup_local_APIC(void)
 #endif
 }
-void end_local_APIC_setup(void)
+static void end_local_APIC_setup(void)
 {
        lapic_setup_esr();
@@ -1492,116 +1462,184 @@ void end_local_APIC_setup(void)
        apic_pm_activate();
 }
-void __init bsp_end_local_APIC_setup(void)
+/*
+ * APIC setup function for application processors. Called from smpboot.c
+ */
+void apic_ap_setup(void)
 {
+        setup_local_APIC();
        end_local_APIC_setup();
-        /*
-         * Now that local APIC setup is completed for BP, configure the fault
-         * handling for interrupt remapping.
-         */
-        irq_remap_enable_fault_handling();
 }
 #ifdef CONFIG_X86_X2APIC
-/*
+int x2apic_mode;
- * Need to disable xapic and x2apic at the same time and then enable xapic mode
- */
-static inline void __disable_x2apic(u64 msr)
-{
-        wrmsrl(MSR_IA32_APICBASE,
-               msr & ~(X2APIC_ENABLE | XAPIC_ENABLE));
-        wrmsrl(MSR_IA32_APICBASE, msr & ~X2APIC_ENABLE);
-}
-static __init void disable_x2apic(void)
+enum {
+        X2APIC_OFF,
+        X2APIC_ON,
+        X2APIC_DISABLED,
+};
+static int x2apic_state;
+static inline void __x2apic_disable(void)
 {
        u64 msr;
-        if (!cpu_has_x2apic)
+        if (cpu_has_apic)
                return;
        rdmsrl(MSR_IA32_APICBASE, msr);
-        if (msr & X2APIC_ENABLE) {
+        if (!(msr & X2APIC_ENABLE))
-                u32 x2apic_id = read_apic_id();
+                return;
+        /* Disable xapic and x2apic first and then reenable xapic mode */
-                if (x2apic_id >= 255)
+        wrmsrl(MSR_IA32_APICBASE, msr & ~(X2APIC_ENABLE | XAPIC_ENABLE));
-                        panic("Cannot disable x2apic, id: %08x\n", x2apic_id);
+        wrmsrl(MSR_IA32_APICBASE, msr & ~X2APIC_ENABLE);
+        printk_once(KERN_INFO "x2apic disabled\n");
+}
-                pr_info("Disabling x2apic\n");
+static inline void __x2apic_enable(void)
-                __disable_x2apic(msr);
+{
+        u64 msr;
-                if (nox2apic) {
+        rdmsrl(MSR_IA32_APICBASE, msr);
-                        clear_cpu_cap(&cpu_data(0), X86_FEATURE_X2APIC);
+        if (msr & X2APIC_ENABLE)
-                        setup_clear_cpu_cap(X86_FEATURE_X2APIC);
+                return;
-                }
+        wrmsrl(MSR_IA32_APICBASE, msr | X2APIC_ENABLE);
+        printk_once(KERN_INFO "x2apic enabled\n");
+}
-                x2apic_disabled = 1;
+static int __init setup_nox2apic(char *str)
-                x2apic_mode = 0;
+{
+        if (x2apic_enabled()) {
+                int apicid = native_apic_msr_read(APIC_ID);
-                register_lapic_address(mp_lapic_addr);
+                if (apicid >= 255) {
+                        pr_warning("Apicid: %08x, cannot enforce nox2apic\n",
+                                   apicid);
+                        return 0;
+                }
+                pr_warning("x2apic already enabled.\n");
+                __x2apic_disable();
        }
+        setup_clear_cpu_cap(X86_FEATURE_X2APIC);
+        x2apic_state = X2APIC_DISABLED;
+        x2apic_mode = 0;
+        return 0;
 }
+early_param("nox2apic", setup_nox2apic);
-void check_x2apic(void)
+/* Called from cpu_init() to enable x2apic on (secondary) cpus */
+void x2apic_setup(void)
 {
-        if (x2apic_enabled()) {
+        /*
-                pr_info("x2apic enabled by BIOS, switching to x2apic ops\n");
+         * If x2apic is not in ON state, disable it if already enabled
-                x2apic_preenabled = x2apic_mode = 1;
+         * from BIOS.
+         */
+        if (x2apic_state != X2APIC_ON) {
+                __x2apic_disable();
+                return;
        }
+        __x2apic_enable();
 }
-void enable_x2apic(void)
+static __init void x2apic_disable(void)
 {
-        u64 msr;
+        u32 x2apic_id;
-        rdmsrl(MSR_IA32_APICBASE, msr);
+        if (x2apic_state != X2APIC_ON)
-        if (x2apic_disabled) {
+                goto out;
-                __disable_x2apic(msr);
+        x2apic_id = read_apic_id();
+        if (x2apic_id >= 255)
+                panic("Cannot disable x2apic, id: %08x\n", x2apic_id);
+        __x2apic_disable();
+        register_lapic_address(mp_lapic_addr);
+out:
+        x2apic_state = X2APIC_DISABLED;
+        x2apic_mode = 0;
+}
+static __init void x2apic_enable(void)
+{
+        if (x2apic_state != X2APIC_OFF)
                return;
-        }
-        if (!x2apic_mode)
+        x2apic_mode = 1;
+        x2apic_state = X2APIC_ON;
+        __x2apic_enable();
+}
+static __init void try_to_enable_x2apic(int remap_mode)
+{
+        if (x2apic_state == X2APIC_DISABLED)
                return;
-        if (!(msr & X2APIC_ENABLE)) {
+        if (remap_mode != IRQ_REMAP_X2APIC_MODE) {
-                printk_once(KERN_INFO "Enabling x2apic\n");
+                /* IR is required if there is APIC ID > 255 even when running
-                wrmsrl(MSR_IA32_APICBASE, msr | X2APIC_ENABLE);
+                 * under KVM
+                 */
+                if (max_physical_apicid > 255 ||
+                    (IS_ENABLED(CONFIG_HYPERVISOR_GUEST) &&
+                     !hypervisor_x2apic_available())) {
+                        pr_info("x2apic: IRQ remapping doesn't support X2APIC mode\n");
+                        x2apic_disable();
+                        return;
+                }
+                /*
+                 * without IR all CPUs can be addressed by IOAPIC/MSI
+                 * only in physical mode
+                 */
+                x2apic_phys = 1;
        }
+        x2apic_enable();
 }
-#endif /* CONFIG_X86_X2APIC */
-int __init enable_IR(void)
+void __init check_x2apic(void)
 {
-#ifdef CONFIG_IRQ_REMAP
+        if (x2apic_enabled()) {
-        if (!irq_remapping_supported()) {
+                pr_info("x2apic: enabled by BIOS, switching to x2apic ops\n");
-                pr_debug("intr-remapping not supported\n");
+                x2apic_mode = 1;
-                return -1;
+                x2apic_state = X2APIC_ON;
+        } else if (!cpu_has_x2apic) {
+                x2apic_state = X2APIC_DISABLED;
        }
+}
+#else /* CONFIG_X86_X2APIC */
+static int __init validate_x2apic(void)
+{
+        if (!apic_is_x2apic_enabled())
+                return 0;
+        /*
+         * Checkme: Can we simply turn off x2apic here instead of panic?
+         */
+        panic("BIOS has enabled x2apic but kernel doesn't support x2apic, please disable x2apic in BIOS.\n");
+}
+early_initcall(validate_x2apic);
-        if (!x2apic_preenabled && skip_ioapic_setup) {
+static inline void try_to_enable_x2apic(int remap_mode) { }
-                pr_info("Skipped enabling intr-remap because of skipping "
+static inline void __x2apic_enable(void) { }
-                        "io-apic setup\n");
+#endif /* !CONFIG_X86_X2APIC */
+static int __init try_to_enable_IR(void)
+{
+#ifdef CONFIG_X86_IO_APIC
+        if (!x2apic_enabled() && skip_ioapic_setup) {
+                pr_info("Not enabling interrupt remapping due to skipped IO-APIC setup\n");
                return -1;
        }
-        return irq_remapping_enable();
 #endif
-        return -1;
+        return irq_remapping_enable();
 }
 void __init enable_IR_x2apic(void)
 {
        unsigned long flags;
-        int ret, x2apic_enabled = 0;
+        int ret, ir_stat;
-        int hardware_init_ret;
-        /* Make sure irq_remap_ops are initialized */
-        setup_irq_remapping_ops();
-        hardware_init_ret = irq_remapping_prepare();
+        ir_stat = irq_remapping_prepare();
-        if (hardware_init_ret && !x2apic_supported())
+        if (ir_stat < 0 && !x2apic_supported())
                return;
        ret = save_ioapic_entries();
@@ -1614,49 +1652,13 @@ void __init enable_IR_x2apic(void)
        legacy_pic->mask_all();
        mask_ioapic_entries();
-        if (x2apic_preenabled && nox2apic)
+        /* If irq_remapping_prepare() succeded, try to enable it */
-                disable_x2apic();
+        if (ir_stat >= 0)
+                ir_stat = try_to_enable_IR();
-        if (hardware_init_ret)
+        /* ir_stat contains the remap mode or an error code */
-                ret = -1;
+        try_to_enable_x2apic(ir_stat);
-        else
-                ret = enable_IR();
-        if (!x2apic_supported())
-                goto skip_x2apic;
-        if (ret < 0) {
+        if (ir_stat < 0)
-                /* IR is required if there is APIC ID > 255 even when running
-                 * under KVM
-                 */
-                if (max_physical_apicid > 255 ||
-                    !hypervisor_x2apic_available()) {
-                        if (x2apic_preenabled)
-                                disable_x2apic();
-                        goto skip_x2apic;
-                }
-                /*
-                 * without IR all CPUs can be addressed by IOAPIC/MSI
-                 * only in physical mode
-                 */
-                x2apic_force_phys();
-        }
-        if (ret == IRQ_REMAP_XAPIC_MODE) {
-                pr_info("x2apic not enabled, IRQ remapping is in xapic mode\n");
-                goto skip_x2apic;
-        }
-        x2apic_enabled = 1;
-        if (x2apic_supported() && !x2apic_mode) {
-                x2apic_mode = 1;
-                enable_x2apic();
-                pr_info("Enabled x2apic\n");
-        }
-skip_x2apic:
-        if (ret < 0) /* IR enabling failed */
                restore_ioapic_entries();
        legacy_pic->restore_mask();
        local_irq_restore(flags);
@@ -1847,82 +1849,8 @@ void __init register_lapic_address(unsigned long address)
        }
 }
-/*
- * This initializes the IO-APIC and APIC hardware if this is
- * a UP kernel.
- */
 int apic_version[MAX_LOCAL_APIC];
-int __init APIC_init_uniprocessor(void)
-{
-        if (disable_apic) {
-                pr_info("Apic disabled\n");
-                return -1;
-        }
-#ifdef CONFIG_X86_64
-        if (!cpu_has_apic) {
-                disable_apic = 1;
-                pr_info("Apic disabled by BIOS\n");
-                return -1;
-        }
-#else
-        if (!smp_found_config && !cpu_has_apic)
-                return -1;
-        /*
-         * Complain if the BIOS pretends there is one.
-         */
-        if (!cpu_has_apic &&
-            APIC_INTEGRATED(apic_version[boot_cpu_physical_apicid])) {
-                pr_err("BIOS bug, local APIC 0x%x not detected!...\n",
-                        boot_cpu_physical_apicid);
-                return -1;
-        }
-#endif
-        default_setup_apic_routing();
-        verify_local_APIC();
-        connect_bsp_APIC();
-#ifdef CONFIG_X86_64
-        apic_write(APIC_ID, SET_APIC_ID(boot_cpu_physical_apicid));
-#else
-        /*
-         * Hack: In case of kdump, after a crash, kernel might be booting
-         * on a cpu with non-zero lapic id. But boot_cpu_physical_apicid
-         * might be zero if read from MP tables. Get it from LAPIC.
-         */
-# ifdef CONFIG_CRASH_DUMP
-        boot_cpu_physical_apicid = read_apic_id();
-# endif
-#endif
-        physid_set_mask_of_physid(boot_cpu_physical_apicid, &phys_cpu_present_map);
-        setup_local_APIC();
-#ifdef CONFIG_X86_IO_APIC
-        /*
-         * Now enable IO-APICs, actually call clear_IO_APIC
-         * We need clear_IO_APIC before enabling error vector
-         */
-        if (!skip_ioapic_setup && nr_ioapics)
-                enable_IO_APIC();
-#endif
-        bsp_end_local_APIC_setup();
-#ifdef CONFIG_X86_IO_APIC
-        if (smp_found_config && !skip_ioapic_setup && nr_ioapics)
-                setup_IO_APIC();
-        else {
-                nr_ioapics = 0;
-        }
-#endif
-        x86_init.timers.setup_percpu_clockev();
-        return 0;
-}
 /*
 * Local APIC interrupts
 */
@@ -2027,7 +1955,7 @@ __visible void smp_trace_error_interrupt(struct pt_regs *regs)
 /**
 * connect_bsp_APIC - attach the APIC to the interrupt system
 */
-void __init connect_bsp_APIC(void)
+static void __init connect_bsp_APIC(void)
 {
 #ifdef CONFIG_X86_32
        if (pic_mode) {
@@ -2274,6 +2202,100 @@ void __init apic_set_eoi_write(void (*eoi_write)(u32 reg, u32 v))
        }
 }
+static void __init apic_bsp_up_setup(void)
+{
+#ifdef CONFIG_X86_64
+        apic_write(APIC_ID, SET_APIC_ID(boot_cpu_physical_apicid));
+#else
+        /*
+         * Hack: In case of kdump, after a crash, kernel might be booting
+         * on a cpu with non-zero lapic id. But boot_cpu_physical_apicid
+         * might be zero if read from MP tables. Get it from LAPIC.
+         */
+# ifdef CONFIG_CRASH_DUMP
+        boot_cpu_physical_apicid = read_apic_id();
+# endif
+#endif
+        physid_set_mask_of_physid(boot_cpu_physical_apicid, &phys_cpu_present_map);
+}
+/**
+ * apic_bsp_setup - Setup function for local apic and io-apic
+ * @upmode:             Force UP mode (for APIC_init_uniprocessor)
+ *
+ * Returns:
+ * apic_id of BSP APIC
+ */
+int __init apic_bsp_setup(bool upmode)
+{
+        int id;
+        connect_bsp_APIC();
+        if (upmode)
+                apic_bsp_up_setup();
+        setup_local_APIC();
+        if (x2apic_mode)
+                id = apic_read(APIC_LDR);
+        else
+                id = GET_APIC_LOGICAL_ID(apic_read(APIC_LDR));
+        enable_IO_APIC();
+        end_local_APIC_setup();
+        irq_remap_enable_fault_handling();
+        setup_IO_APIC();
+        /* Setup local timer */
+        x86_init.timers.setup_percpu_clockev();
+        return id;
+}
+/*
+ * This initializes the IO-APIC and APIC hardware if this is
+ * a UP kernel.
+ */
+int __init APIC_init_uniprocessor(void)
+{
+        if (disable_apic) {
+                pr_info("Apic disabled\n");
+                return -1;
+        }
+#ifdef CONFIG_X86_64
+        if (!cpu_has_apic) {
+                disable_apic = 1;
+                pr_info("Apic disabled by BIOS\n");
+                return -1;
+        }
+#else
+        if (!smp_found_config && !cpu_has_apic)
+                return -1;
+        /*
+         * Complain if the BIOS pretends there is one.
+         */
+        if (!cpu_has_apic &&
+            APIC_INTEGRATED(apic_version[boot_cpu_physical_apicid])) {
+                pr_err("BIOS bug, local APIC 0x%x not detected!...\n",
+                        boot_cpu_physical_apicid);
+                return -1;
+        }
+#endif
+        if (!smp_found_config)
+                disable_ioapic_support();
+        default_setup_apic_routing();
+        verify_local_APIC();
+        apic_bsp_setup(true);
+        return 0;
+}
+#ifdef CONFIG_UP_LATE_INIT
+void __init up_late_init(void)
+{
+        APIC_init_uniprocessor();
+}
+#endif
 /*
 * Power management
 */
@@ -2359,9 +2381,9 @@ static void lapic_resume(void)
        mask_ioapic_entries();
        legacy_pic->mask_all();
-        if (x2apic_mode)
+        if (x2apic_mode) {
-                enable_x2apic();
+                __x2apic_enable();
-        else {
+        } else {
                /*
                 * Make sure the APICBASE points to the right address
                 *
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 3f5f60406ab1..f4dc2462a1ac 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1507,7 +1507,10 @@ void __init enable_IO_APIC(void)
        int i8259_apic, i8259_pin;
        int apic, pin;
-        if (!nr_legacy_irqs())
+        if (skip_ioapic_setup)
+                nr_ioapics = 0;
+        if (!nr_legacy_irqs() || !nr_ioapics)
                return;
        for_each_ioapic_pin(apic, pin) {
@@ -2295,7 +2298,7 @@ static inline void __init check_timer(void)
        }
        local_irq_disable();
        apic_printk(APIC_QUIET, KERN_INFO "..... failed :(.\n");
-        if (x2apic_preenabled)
+        if (apic_is_x2apic_enabled())
                apic_printk(APIC_QUIET, KERN_INFO
                            "Perhaps problem with the pre-enabled x2apic mode\n"
                            "Try booting with x2apic and interrupt-remapping disabled in the bios.\n");
@@ -2373,9 +2376,9 @@ void __init setup_IO_APIC(void)
 {
        int ioapic;
-        /*
+        if (skip_ioapic_setup || !nr_ioapics)
-         * calling enable_IO_APIC() is moved to setup_local_APIC for BP
+                return;
-         */
        io_apic_irqs = nr_legacy_irqs() ? ~PIC_IRQS : ~0UL;
        apic_printk(APIC_VERBOSE, "ENABLING IO-APIC IRQs\n");
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index e27b49d7c922..80091ae54c2b 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -66,3 +66,4 @@ targets += capflags.c
 $(obj)/capflags.c: $(cpufeature) $(src)/mkcapflags.sh FORCE
        $(call if_changed,mkcapflags)
 endif
+clean-files += capflags.c
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 15c5df92f74e..a220239cea65 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -869,3 +869,22 @@ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
        return false;
 }
+void set_dr_addr_mask(unsigned long mask, int dr)
+{
+        if (!cpu_has_bpext)
+                return;
+        switch (dr) {
+        case 0:
+                wrmsr(MSR_F16H_DR0_ADDR_MASK, mask, 0);
+                break;
+        case 1:
+        case 2:
+        case 3:
+                wrmsr(MSR_F16H_DR1_ADDR_MASK - 1 + dr, mask, 0);
+                break;
+        default:
+                break;
+        }
+}
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index c6049650c093..b15bffcaba6d 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -491,17 +491,18 @@ u16 __read_mostly tlb_lld_2m[NR_INFO];
 u16 __read_mostly tlb_lld_4m[NR_INFO];
 u16 __read_mostly tlb_lld_1g[NR_INFO];
-void cpu_detect_tlb(struct cpuinfo_x86 *c)
+static void cpu_detect_tlb(struct cpuinfo_x86 *c)
 {
        if (this_cpu->c_detect_tlb)
                this_cpu->c_detect_tlb(c);
-        printk(KERN_INFO "Last level iTLB entries: 4KB %d, 2MB %d, 4MB %d\n"
+        pr_info("Last level iTLB entries: 4KB %d, 2MB %d, 4MB %d\n",
-                "Last level dTLB entries: 4KB %d, 2MB %d, 4MB %d, 1GB %d\n",
                tlb_lli_4k[ENTRIES], tlb_lli_2m[ENTRIES],
-                tlb_lli_4m[ENTRIES], tlb_lld_4k[ENTRIES],
+                tlb_lli_4m[ENTRIES]);
-                tlb_lld_2m[ENTRIES], tlb_lld_4m[ENTRIES],
-                tlb_lld_1g[ENTRIES]);
+        pr_info("Last level dTLB entries: 4KB %d, 2MB %d, 4MB %d, 1GB %d\n",
+                tlb_lld_4k[ENTRIES], tlb_lld_2m[ENTRIES],
+                tlb_lld_4m[ENTRIES], tlb_lld_1g[ENTRIES]);
 }
 void detect_ht(struct cpuinfo_x86 *c)
@@ -1332,7 +1333,7 @@ void cpu_init(void)
        barrier();
        x86_configure_nx();
-        enable_x2apic();
+        x2apic_setup();
        /*
         * set up and load the per-CPU TSS
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 9cc6b6f25f42..94d7dcb12145 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -487,10 +487,8 @@ static void init_intel(struct cpuinfo_x86 *c)
                rdmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb);
                if ((epb & 0xF) == ENERGY_PERF_BIAS_PERFORMANCE) {
-                        printk_once(KERN_WARNING "ENERGY_PERF_BIAS:"
+                        pr_warn_once("ENERGY_PERF_BIAS: Set to 'normal', was 'performance'\n");
-                                " Set to 'normal', was 'performance'\n"
+                        pr_warn_once("ENERGY_PERF_BIAS: View and update with x86_energy_perf_policy(8)\n");
-                                "ENERGY_PERF_BIAS: View and update with"
-                                " x86_energy_perf_policy(8)\n");
                        epb = (epb & ~0xF) | ENERGY_PERF_BIAS_NORMAL;
                        wrmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb);
                }
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index d2c611699cd9..d23179900755 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -43,6 +43,7 @@
 #include <linux/export.h>
 #include <asm/processor.h>
+#include <asm/traps.h>
 #include <asm/mce.h>
 #include <asm/msr.h>
@@ -1003,51 +1004,6 @@ static void mce_clear_state(unsigned long *toclear)
 }
 /*
- * Need to save faulting physical address associated with a process
- * in the machine check handler some place where we can grab it back
- * later in mce_notify_process()
- */
-#define MCE_INFO_MAX    16
-struct mce_info {
-        atomic_t                inuse;
-        struct task_struct      *t;
-        __u64                   paddr;
-        int                     restartable;
-} mce_info[MCE_INFO_MAX];
-static void mce_save_info(__u64 addr, int c)
-{
-        struct mce_info *mi;
-        for (mi = mce_info; mi < &mce_info[MCE_INFO_MAX]; mi++) {
-                if (atomic_cmpxchg(&mi->inuse, 0, 1) == 0) {
-                        mi->t = current;
-                        mi->paddr = addr;
-                        mi->restartable = c;
-                        return;
-                }
-        }
-        mce_panic("Too many concurrent recoverable errors", NULL, NULL);
-}
-static struct mce_info *mce_find_info(void)
-{
-        struct mce_info *mi;
-        for (mi = mce_info; mi < &mce_info[MCE_INFO_MAX]; mi++)
-                if (atomic_read(&mi->inuse) && mi->t == current)
-                        return mi;
-        return NULL;
-}
-static void mce_clear_info(struct mce_info *mi)
-{
-        atomic_set(&mi->inuse, 0);
-}
-/*
 * The actual machine check handler. This only handles real
 * exceptions when something got corrupted coming in through int 18.
 *
@@ -1063,6 +1019,7 @@ void do_machine_check(struct pt_regs *regs, long error_code)
 {
        struct mca_config *cfg = &mca_cfg;
        struct mce m, *final;
+        enum ctx_state prev_state;
        int i;
        int worst = 0;
        int severity;
@@ -1084,6 +1041,10 @@ void do_machine_check(struct pt_regs *regs, long error_code)
        DECLARE_BITMAP(toclear, MAX_NR_BANKS);
        DECLARE_BITMAP(valid_banks, MAX_NR_BANKS);
        char *msg = "Unknown";
+        u64 recover_paddr = ~0ull;
+        int flags = MF_ACTION_REQUIRED;
+        prev_state = ist_enter(regs);
        this_cpu_inc(mce_exception_count);
@@ -1203,9 +1164,9 @@ void do_machine_check(struct pt_regs *regs, long error_code)
                if (no_way_out)
                        mce_panic("Fatal machine check on current CPU", &m, msg);
                if (worst == MCE_AR_SEVERITY) {
-                        /* schedule action before return to userland */
+                        recover_paddr = m.addr;
-                        mce_save_info(m.addr, m.mcgstatus & MCG_STATUS_RIPV);
+                        if (!(m.mcgstatus & MCG_STATUS_RIPV))
-                        set_thread_flag(TIF_MCE_NOTIFY);
+                                flags |= MF_MUST_KILL;
                } else if (kill_it) {
                        force_sig(SIGBUS, current);
                }
@@ -1216,6 +1177,27 @@ void do_machine_check(struct pt_regs *regs, long error_code)
        mce_wrmsrl(MSR_IA32_MCG_STATUS, 0);
 out:
        sync_core();
+        if (recover_paddr == ~0ull)
+                goto done;
+        pr_err("Uncorrected hardware memory error in user-access at %llx",
+                 recover_paddr);
+        /*
+         * We must call memory_failure() here even if the current process is
+         * doomed. We still need to mark the page as poisoned and alert any
+         * other users of the page.
+         */
+        ist_begin_non_atomic(regs);
+        local_irq_enable();
+        if (memory_failure(recover_paddr >> PAGE_SHIFT, MCE_VECTOR, flags) < 0) {
+                pr_err("Memory error not recovered");
+                force_sig(SIGBUS, current);
+        }
+        local_irq_disable();
+        ist_end_non_atomic();
+done:
+        ist_exit(regs, prev_state);
 }
 EXPORT_SYMBOL_GPL(do_machine_check);
@@ -1233,42 +1215,6 @@ int memory_failure(unsigned long pfn, int vector, int flags)
 #endif
 /*
- * Called in process context that interrupted by MCE and marked with
- * TIF_MCE_NOTIFY, just before returning to erroneous userland.
- * This code is allowed to sleep.
- * Attempt possible recovery such as calling the high level VM handler to
- * process any corrupted pages, and kill/signal current process if required.
- * Action required errors are handled here.
- */
-void mce_notify_process(void)
-{
-        unsigned long pfn;
-        struct mce_info *mi = mce_find_info();
-        int flags = MF_ACTION_REQUIRED;
-        if (!mi)
-                mce_panic("Lost physical address for unconsumed uncorrectable error", NULL, NULL);
-        pfn = mi->paddr >> PAGE_SHIFT;
-        clear_thread_flag(TIF_MCE_NOTIFY);
-        pr_err("Uncorrected hardware memory error in user-access at %llx",
-                 mi->paddr);
-        /*
-         * We must call memory_failure() here even if the current process is
-         * doomed. We still need to mark the page as poisoned and alert any
-         * other users of the page.
-         */
-        if (!mi->restartable)
-                flags |= MF_MUST_KILL;
-        if (memory_failure(pfn, MCE_VECTOR, flags) < 0) {
-                pr_err("Memory error not recovered");
-                force_sig(SIGBUS, current);
-        }
-        mce_clear_info(mi);
-}
-/*
 * Action optional processing happens here (picking up
 * from the list of faulting pages that do_machine_check()
 * placed into the "ring").
diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
index a3042989398c..ec2663a708e4 100644
--- a/arch/x86/kernel/cpu/mcheck/p5.c
+++ b/arch/x86/kernel/cpu/mcheck/p5.c
@@ -8,6 +8,7 @@
 #include <linux/smp.h>
 #include <asm/processor.h>
+#include <asm/traps.h>
 #include <asm/mce.h>
 #include <asm/msr.h>
@@ -17,8 +18,11 @@ int mce_p5_enabled __read_mostly;
 /* Machine check handler for Pentium class Intel CPUs: */
 static void pentium_machine_check(struct pt_regs *regs, long error_code)
 {
+        enum ctx_state prev_state;
        u32 loaddr, hi, lotype;
+        prev_state = ist_enter(regs);
        rdmsr(MSR_IA32_P5_MC_ADDR, loaddr, hi);
        rdmsr(MSR_IA32_P5_MC_TYPE, lotype, hi);
@@ -33,6 +37,8 @@ static void pentium_machine_check(struct pt_regs *regs, long error_code)
        }
        add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+        ist_exit(regs, prev_state);
 }
 /* Set up machine check reporting for processors with Intel style MCE: */
diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
index 7dc5564d0cdf..bd5d46a32210 100644
--- a/arch/x86/kernel/cpu/mcheck/winchip.c
+++ b/arch/x86/kernel/cpu/mcheck/winchip.c
@@ -7,14 +7,19 @@
 #include <linux/types.h>
 #include <asm/processor.h>
+#include <asm/traps.h>
 #include <asm/mce.h>
 #include <asm/msr.h>
 /* Machine check handler for WinChip C6: */
 static void winchip_machine_check(struct pt_regs *regs, long error_code)
 {
+        enum ctx_state prev_state = ist_enter(regs);
        printk(KERN_EMERG "CPU0: Machine Check Exception.\n");
        add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+        ist_exit(regs, prev_state);
 }
 /* Set up machine check reporting on the Winchip C6 series */
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 15c29096136b..36a83617eb21 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -552,7 +552,7 @@ static int __init microcode_init(void)
        int error;
        if (paravirt_enabled() || dis_ucode_ldr)
-                return 0;
+                return -EINVAL;
        if (c->x86_vendor == X86_VENDOR_INTEL)
                microcode_ops = init_intel_microcode();
diff --git a/arch/x86/kernel/cpu/mkcapflags.sh b/arch/x86/kernel/cpu/mkcapflags.sh
index e2b22df964cd..36d99a337b49 100644
--- a/arch/x86/kernel/cpu/mkcapflags.sh
+++ b/arch/x86/kernel/cpu/mkcapflags.sh
@@ -28,7 +28,7 @@ function dump_array()
                # If the /* comment */ starts with a quote string, grab that.
                VALUE="$(echo "$i" | sed -n 's@.*/\* *\("[^"]*"\).*\*/@\1@p')"
                [ -z "$VALUE" ] && VALUE="\"$NAME\""
-                [ "$VALUE" == '""' ] && continue
+                [ "$VALUE" = '""' ] && continue
                # Name is uppercase, VALUE is all lowercase
                VALUE="$(echo "$VALUE" | tr A-Z a-z)"
diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
index a450373e8e91..939155ffdece 100644
--- a/arch/x86/kernel/cpu/mshyperv.c
+++ b/arch/x86/kernel/cpu/mshyperv.c
@@ -107,6 +107,7 @@ static struct clocksource hyperv_cs = {
        .rating         = 400, /* use this when running on Hyperv*/
        .read           = read_hv_clock,
        .mask           = CLOCKSOURCE_MASK(64),
+        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 static void __init ms_hyperv_init_platform(void)
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 944bf019b74f..498b6d967138 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -2431,6 +2431,7 @@ __init int intel_pmu_init(void)
                break;
        case 55: /* 22nm Atom "Silvermont"                */
+        case 76: /* 14nm Atom "Airmont"                   */
        case 77: /* 22nm Atom "Silvermont Avoton/Rangely" */
                memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
                        sizeof(hw_cache_event_ids));
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index 3c895d480cd7..073983398364 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -568,8 +568,8 @@ struct event_constraint intel_atom_pebs_event_constraints[] = {
 };
 struct event_constraint intel_slm_pebs_event_constraints[] = {
-        /* UOPS_RETIRED.ALL, inv=1, cmask=16 (cycles:p). */
+        /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */
-        INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c2, 0xf),
+        INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x1),
        /* Allow all events as PEBS with no flags */
        INTEL_ALL_EVENT_CONSTRAINT(0, 0x1),
        EVENT_CONSTRAINT_END
diff --git a/arch/x86/kernel/cpu/perf_event_intel_rapl.c b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
index 673f930c700f..c4bb8b8e5017 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_rapl.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
@@ -103,6 +103,13 @@ static struct kobj_attribute format_attr_##_var =		\
 #define RAPL_CNTR_WIDTH 32 /* 32-bit rapl counters */
+#define RAPL_EVENT_ATTR_STR(_name, v, str)                              \
+static struct perf_pmu_events_attr event_attr_##v = {                   \
+        .attr           = __ATTR(_name, 0444, rapl_sysfs_show, NULL),   \
+        .id             = 0,                                            \
+        .event_str      = str,                                          \
+};
 struct rapl_pmu {
        spinlock_t       lock;
        int              hw_unit;  /* 1/2^hw_unit Joule */
@@ -135,7 +142,7 @@ static inline u64 rapl_scale(u64 v)
         * or use ldexp(count, -32).
         * Watts = Joules/Time delta
         */
-        return v << (32 - __this_cpu_read(rapl_pmu->hw_unit));
+        return v << (32 - __this_cpu_read(rapl_pmu)->hw_unit);
 }
 static u64 rapl_event_update(struct perf_event *event)
@@ -379,23 +386,36 @@ static struct attribute_group rapl_pmu_attr_group = {
        .attrs = rapl_pmu_attrs,
 };
-EVENT_ATTR_STR(energy-cores, rapl_cores, "event=0x01");
+static ssize_t rapl_sysfs_show(struct device *dev,
-EVENT_ATTR_STR(energy-pkg  ,   rapl_pkg, "event=0x02");
+                               struct device_attribute *attr,
-EVENT_ATTR_STR(energy-ram  ,   rapl_ram, "event=0x03");
+                               char *page)
-EVENT_ATTR_STR(energy-gpu  ,   rapl_gpu, "event=0x04");
+{
+        struct perf_pmu_events_attr *pmu_attr = \
+                container_of(attr, struct perf_pmu_events_attr, attr);
+        if (pmu_attr->event_str)
+                return sprintf(page, "%s", pmu_attr->event_str);
+        return 0;
+}
+RAPL_EVENT_ATTR_STR(energy-cores, rapl_cores, "event=0x01");
+RAPL_EVENT_ATTR_STR(energy-pkg  ,   rapl_pkg, "event=0x02");
+RAPL_EVENT_ATTR_STR(energy-ram  ,   rapl_ram, "event=0x03");
+RAPL_EVENT_ATTR_STR(energy-gpu  ,   rapl_gpu, "event=0x04");
-EVENT_ATTR_STR(energy-cores.unit, rapl_cores_unit, "Joules");
+RAPL_EVENT_ATTR_STR(energy-cores.unit, rapl_cores_unit, "Joules");
-EVENT_ATTR_STR(energy-pkg.unit  ,   rapl_pkg_unit, "Joules");
+RAPL_EVENT_ATTR_STR(energy-pkg.unit  ,   rapl_pkg_unit, "Joules");
-EVENT_ATTR_STR(energy-ram.unit  ,   rapl_ram_unit, "Joules");
+RAPL_EVENT_ATTR_STR(energy-ram.unit  ,   rapl_ram_unit, "Joules");
-EVENT_ATTR_STR(energy-gpu.unit  ,   rapl_gpu_unit, "Joules");
+RAPL_EVENT_ATTR_STR(energy-gpu.unit  ,   rapl_gpu_unit, "Joules");
 /*
 * we compute in 0.23 nJ increments regardless of MSR
 */
-EVENT_ATTR_STR(energy-cores.scale, rapl_cores_scale, "2.3283064365386962890625e-10");
+RAPL_EVENT_ATTR_STR(energy-cores.scale, rapl_cores_scale, "2.3283064365386962890625e-10");
-EVENT_ATTR_STR(energy-pkg.scale,     rapl_pkg_scale, "2.3283064365386962890625e-10");
+RAPL_EVENT_ATTR_STR(energy-pkg.scale,     rapl_pkg_scale, "2.3283064365386962890625e-10");
-EVENT_ATTR_STR(energy-ram.scale,     rapl_ram_scale, "2.3283064365386962890625e-10");
+RAPL_EVENT_ATTR_STR(energy-ram.scale,     rapl_ram_scale, "2.3283064365386962890625e-10");
-EVENT_ATTR_STR(energy-gpu.scale,     rapl_gpu_scale, "2.3283064365386962890625e-10");
+RAPL_EVENT_ATTR_STR(energy-gpu.scale,     rapl_gpu_scale, "2.3283064365386962890625e-10");
 static struct attribute *rapl_events_srv_attr[] = {
        EVENT_PTR(rapl_cores),
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index 10b8d3eaaf15..c635b8b49e93 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -840,7 +840,6 @@ static int uncore_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id
        box->phys_id = phys_id;
        box->pci_dev = pdev;
        box->pmu = pmu;
-        uncore_box_init(box);
        pci_set_drvdata(pdev, box);
        raw_spin_lock(&uncore_box_lock);
@@ -1004,10 +1003,8 @@ static int uncore_cpu_starting(int cpu)
                        pmu = &type->pmus[j];
                        box = *per_cpu_ptr(pmu->box, cpu);
                        /* called by uncore_cpu_init? */
-                        if (box && box->phys_id >= 0) {
+                        if (box && box->phys_id >= 0)
-                                uncore_box_init(box);
                                continue;
-                        }
                        for_each_online_cpu(k) {
                                exist = *per_cpu_ptr(pmu->box, k);
@@ -1023,10 +1020,8 @@ static int uncore_cpu_starting(int cpu)
                                }
                        }
-                        if (box) {
+                        if (box)
                                box->phys_id = phys_id;
-                                uncore_box_init(box);
-                        }
                }
        }
        return 0;
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.h b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
index 18eb78bbdd10..6c8c1e7e69d8 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.h
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
@@ -17,7 +17,7 @@
 #define UNCORE_PCI_DEV_TYPE(data)       ((data >> 8) & 0xff)
 #define UNCORE_PCI_DEV_IDX(data)        (data & 0xff)
 #define UNCORE_EXTRA_PCI_DEV            0xff
-#define UNCORE_EXTRA_PCI_DEV_MAX        2
+#define UNCORE_EXTRA_PCI_DEV_MAX        3
 /* support up to 8 sockets */
 #define UNCORE_SOCKET_MAX               8
@@ -257,6 +257,14 @@ static inline int uncore_num_counters(struct intel_uncore_box *box)
        return box->pmu->type->num_counters;
 }
+static inline void uncore_box_init(struct intel_uncore_box *box)
+{
+        if (!test_and_set_bit(UNCORE_BOX_FLAG_INITIATED, &box->flags)) {
+                if (box->pmu->type->ops->init_box)
+                        box->pmu->type->ops->init_box(box);
+        }
+}
 static inline void uncore_disable_box(struct intel_uncore_box *box)
 {
        if (box->pmu->type->ops->disable_box)
@@ -265,6 +273,8 @@ static inline void uncore_disable_box(struct intel_uncore_box *box)
 static inline void uncore_enable_box(struct intel_uncore_box *box)
 {
+        uncore_box_init(box);
        if (box->pmu->type->ops->enable_box)
                box->pmu->type->ops->enable_box(box);
 }
@@ -287,14 +297,6 @@ static inline u64 uncore_read_counter(struct intel_uncore_box *box,
        return box->pmu->type->ops->read_counter(box, event);
 }
-static inline void uncore_box_init(struct intel_uncore_box *box)
-{
-        if (!test_and_set_bit(UNCORE_BOX_FLAG_INITIATED, &box->flags)) {
-                if (box->pmu->type->ops->init_box)
-                        box->pmu->type->ops->init_box(box);
-        }
-}
 static inline bool uncore_box_is_fake(struct intel_uncore_box *box)
 {
        return (box->phys_id < 0);
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
index 745b158e9a65..21af6149edf2 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
@@ -891,6 +891,7 @@ void snbep_uncore_cpu_init(void)
 enum {
        SNBEP_PCI_QPI_PORT0_FILTER,
        SNBEP_PCI_QPI_PORT1_FILTER,
+        HSWEP_PCI_PCU_3,
 };
 static int snbep_qpi_hw_config(struct intel_uncore_box *box, struct perf_event *event)
@@ -2026,6 +2027,17 @@ void hswep_uncore_cpu_init(void)
 {
        if (hswep_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores)
                hswep_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores;
+        /* Detect 6-8 core systems with only two SBOXes */
+        if (uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3]) {
+                u32 capid4;
+                pci_read_config_dword(uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3],
+                                      0x94, &capid4);
+                if (((capid4 >> 6) & 0x3) == 0)
+                        hswep_uncore_sbox.num_boxes = 2;
+        }
        uncore_msr_uncores = hswep_msr_uncores;
 }
@@ -2287,6 +2299,11 @@ static DEFINE_PCI_DEVICE_TABLE(hswep_uncore_pci_ids) = {
                .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
                                                   SNBEP_PCI_QPI_PORT1_FILTER),
        },
+        { /* PCU.3 (for Capability registers) */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fc0),
+                .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+                                                   HSWEP_PCI_PCU_3),
+        },
        { /* end: all zeroes */ }
 };
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 9ebaf63ba182..db13655c3a2a 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -143,7 +143,8 @@ ENDPROC(native_usergs_sysret64)
        movq \tmp,RSP+\offset(%rsp)
        movq $__USER_DS,SS+\offset(%rsp)
        movq $__USER_CS,CS+\offset(%rsp)
-        movq $-1,RCX+\offset(%rsp)
+        movq RIP+\offset(%rsp),\tmp  /* get rip */
+        movq \tmp,RCX+\offset(%rsp)  /* copy it to rcx as sysret would do */
        movq R11+\offset(%rsp),\tmp  /* get eflags */
        movq \tmp,EFLAGS+\offset(%rsp)
        .endm
@@ -155,27 +156,6 @@ ENDPROC(native_usergs_sysret64)
        movq \tmp,R11+\offset(%rsp)
        .endm
-        .macro FAKE_STACK_FRAME child_rip
-        /* push in order ss, rsp, eflags, cs, rip */
-        xorl %eax, %eax
-        pushq_cfi $__KERNEL_DS /* ss */
-        /*CFI_REL_OFFSET        ss,0*/
-        pushq_cfi %rax /* rsp */
-        CFI_REL_OFFSET  rsp,0
-        pushq_cfi $(X86_EFLAGS_IF|X86_EFLAGS_FIXED) /* eflags - interrupts on */
-        /*CFI_REL_OFFSET        rflags,0*/
-        pushq_cfi $__KERNEL_CS /* cs */
-        /*CFI_REL_OFFSET        cs,0*/
-        pushq_cfi \child_rip /* rip */
-        CFI_REL_OFFSET  rip,0
-        pushq_cfi %rax /* orig rax */
-        .endm
-        .macro UNFAKE_STACK_FRAME
-        addq $8*6, %rsp
-        CFI_ADJUST_CFA_OFFSET   -(6*8)
-        .endm
 /*
 * initial frame state for interrupts (and exceptions without error code)
 */
@@ -238,51 +218,6 @@ ENDPROC(native_usergs_sysret64)
        CFI_REL_OFFSET r15, R15+\offset
        .endm
-/* save partial stack frame */
-        .macro SAVE_ARGS_IRQ
-        cld
-        /* start from rbp in pt_regs and jump over */
-        movq_cfi rdi, (RDI-RBP)
-        movq_cfi rsi, (RSI-RBP)
-        movq_cfi rdx, (RDX-RBP)
-        movq_cfi rcx, (RCX-RBP)
-        movq_cfi rax, (RAX-RBP)
-        movq_cfi  r8,  (R8-RBP)
-        movq_cfi  r9,  (R9-RBP)
-        movq_cfi r10, (R10-RBP)
-        movq_cfi r11, (R11-RBP)
-        /* Save rbp so that we can unwind from get_irq_regs() */
-        movq_cfi rbp, 0
-        /* Save previous stack value */
-        movq %rsp, %rsi
-        leaq -RBP(%rsp),%rdi    /* arg1 for handler */
-        testl $3, CS-RBP(%rsi)
-        je 1f
-        SWAPGS
-        /*
-         * irq_count is used to check if a CPU is already on an interrupt stack
-         * or not. While this is essentially redundant with preempt_count it is
-         * a little cheaper to use a separate counter in the PDA (short of
-         * moving irq_enter into assembly, which would be too much work)
-         */
-1:      incl PER_CPU_VAR(irq_count)
-        cmovzq PER_CPU_VAR(irq_stack_ptr),%rsp
-        CFI_DEF_CFA_REGISTER    rsi
-        /* Store previous stack value */
-        pushq %rsi
-        CFI_ESCAPE      0x0f /* DW_CFA_def_cfa_expression */, 6, \
-                        0x77 /* DW_OP_breg7 */, 0, \
-                        0x06 /* DW_OP_deref */, \
-                        0x08 /* DW_OP_const1u */, SS+8-RBP, \
-                        0x22 /* DW_OP_plus */
-        /* We entered an interrupt context - irqs are off: */
-        TRACE_IRQS_OFF
-        .endm
 ENTRY(save_paranoid)
        XCPT_FRAME 1 RDI+8
        cld
@@ -426,15 +361,12 @@ system_call_fastpath:
 * Has incomplete stack frame and undefined top of stack.
 */
 ret_from_sys_call:
-        movl $_TIF_ALLWORK_MASK,%edi
+        testl $_TIF_ALLWORK_MASK,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
-        /* edi: flagmask */
+        jnz int_ret_from_sys_call_fixup /* Go the the slow path */
-sysret_check:
        LOCKDEP_SYS_EXIT
        DISABLE_INTERRUPTS(CLBR_NONE)
        TRACE_IRQS_OFF
-        movl TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET),%edx
-        andl %edi,%edx
-        jnz  sysret_careful
        CFI_REMEMBER_STATE
        /*
         * sysretq will re-enable interrupts:
@@ -448,49 +380,10 @@ sysret_check:
        USERGS_SYSRET64
        CFI_RESTORE_STATE
-        /* Handle reschedules */
-        /* edx: work, edi: workmask */
-sysret_careful:
-        bt $TIF_NEED_RESCHED,%edx
-        jnc sysret_signal
-        TRACE_IRQS_ON
-        ENABLE_INTERRUPTS(CLBR_NONE)
-        pushq_cfi %rdi
-        SCHEDULE_USER
-        popq_cfi %rdi
-        jmp sysret_check
-        /* Handle a signal */
+int_ret_from_sys_call_fixup:
-sysret_signal:
-        TRACE_IRQS_ON
-        ENABLE_INTERRUPTS(CLBR_NONE)
-#ifdef CONFIG_AUDITSYSCALL
-        bt $TIF_SYSCALL_AUDIT,%edx
-        jc sysret_audit
-#endif
-        /*
-         * We have a signal, or exit tracing or single-step.
-         * These all wind up with the iret return path anyway,
-         * so just join that path right now.
-         */
        FIXUP_TOP_OF_STACK %r11, -ARGOFFSET
-        jmp int_check_syscall_exit_work
+        jmp int_ret_from_sys_call
-#ifdef CONFIG_AUDITSYSCALL
-        /*
-         * Return fast path for syscall audit.  Call __audit_syscall_exit()
-         * directly and then jump back to the fast path with TIF_SYSCALL_AUDIT
-         * masked off.
-         */
-sysret_audit:
-        movq RAX-ARGOFFSET(%rsp),%rsi   /* second arg, syscall return value */
-        cmpq $-MAX_ERRNO,%rsi   /* is it < -MAX_ERRNO? */
-        setbe %al               /* 1 if so, 0 if not */
-        movzbl %al,%edi         /* zero-extend that into %edi */
-        call __audit_syscall_exit
-        movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
-        jmp sysret_check
-#endif  /* CONFIG_AUDITSYSCALL */
        /* Do syscall tracing */
 tracesys:
@@ -626,19 +519,6 @@ END(\label)
        FORK_LIKE  vfork
        FIXED_FRAME stub_iopl, sys_iopl
-ENTRY(ptregscall_common)
-        DEFAULT_FRAME 1 8       /* offset 8: return address */
-        RESTORE_TOP_OF_STACK %r11, 8
-        movq_cfi_restore R15+8, r15
-        movq_cfi_restore R14+8, r14
-        movq_cfi_restore R13+8, r13
-        movq_cfi_restore R12+8, r12
-        movq_cfi_restore RBP+8, rbp
-        movq_cfi_restore RBX+8, rbx
-        ret $REST_SKIP          /* pop extended registers */
-        CFI_ENDPROC
-END(ptregscall_common)
 ENTRY(stub_execve)
        CFI_STARTPROC
        addq $8, %rsp
@@ -779,7 +659,48 @@ END(interrupt)
        /* reserve pt_regs for scratch regs and rbp */
        subq $ORIG_RAX-RBP, %rsp
        CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
-        SAVE_ARGS_IRQ
+        cld
+        /* start from rbp in pt_regs and jump over */
+        movq_cfi rdi, (RDI-RBP)
+        movq_cfi rsi, (RSI-RBP)
+        movq_cfi rdx, (RDX-RBP)
+        movq_cfi rcx, (RCX-RBP)
+        movq_cfi rax, (RAX-RBP)
+        movq_cfi  r8,  (R8-RBP)
+        movq_cfi  r9,  (R9-RBP)
+        movq_cfi r10, (R10-RBP)
+        movq_cfi r11, (R11-RBP)
+        /* Save rbp so that we can unwind from get_irq_regs() */
+        movq_cfi rbp, 0
+        /* Save previous stack value */
+        movq %rsp, %rsi
+        leaq -RBP(%rsp),%rdi    /* arg1 for handler */
+        testl $3, CS-RBP(%rsi)
+        je 1f
+        SWAPGS
+        /*
+         * irq_count is used to check if a CPU is already on an interrupt stack
+         * or not. While this is essentially redundant with preempt_count it is
+         * a little cheaper to use a separate counter in the PDA (short of
+         * moving irq_enter into assembly, which would be too much work)
+         */
+1:      incl PER_CPU_VAR(irq_count)
+        cmovzq PER_CPU_VAR(irq_stack_ptr),%rsp
+        CFI_DEF_CFA_REGISTER    rsi
+        /* Store previous stack value */
+        pushq %rsi
+        CFI_ESCAPE      0x0f /* DW_CFA_def_cfa_expression */, 6, \
+                        0x77 /* DW_OP_breg7 */, 0, \
+                        0x06 /* DW_OP_deref */, \
+                        0x08 /* DW_OP_const1u */, SS+8-RBP, \
+                        0x22 /* DW_OP_plus */
+        /* We entered an interrupt context - irqs are off: */
+        TRACE_IRQS_OFF
        call \func
        .endm
@@ -831,6 +752,60 @@ retint_swapgs:		/* return to user-space */
         */
        DISABLE_INTERRUPTS(CLBR_ANY)
        TRACE_IRQS_IRETQ
+        /*
+         * Try to use SYSRET instead of IRET if we're returning to
+         * a completely clean 64-bit userspace context.
+         */
+        movq (RCX-R11)(%rsp), %rcx
+        cmpq %rcx,(RIP-R11)(%rsp)               /* RCX == RIP */
+        jne opportunistic_sysret_failed
+        /*
+         * On Intel CPUs, sysret with non-canonical RCX/RIP will #GP
+         * in kernel space.  This essentially lets the user take over
+         * the kernel, since userspace controls RSP.  It's not worth
+         * testing for canonicalness exactly -- this check detects any
+         * of the 17 high bits set, which is true for non-canonical
+         * or kernel addresses.  (This will pessimize vsyscall=native.
+         * Big deal.)
+         *
+         * If virtual addresses ever become wider, this will need
+         * to be updated to remain correct on both old and new CPUs.
+         */
+        .ifne __VIRTUAL_MASK_SHIFT - 47
+        .error "virtual address width changed -- sysret checks need update"
+        .endif
+        shr $__VIRTUAL_MASK_SHIFT, %rcx
+        jnz opportunistic_sysret_failed
+        cmpq $__USER_CS,(CS-R11)(%rsp)          /* CS must match SYSRET */
+        jne opportunistic_sysret_failed
+        movq (R11-ARGOFFSET)(%rsp), %r11
+        cmpq %r11,(EFLAGS-ARGOFFSET)(%rsp)      /* R11 == RFLAGS */
+        jne opportunistic_sysret_failed
+        testq $X86_EFLAGS_RF,%r11               /* sysret can't restore RF */
+        jnz opportunistic_sysret_failed
+        /* nothing to check for RSP */
+        cmpq $__USER_DS,(SS-ARGOFFSET)(%rsp)    /* SS must match SYSRET */
+        jne opportunistic_sysret_failed
+        /*
+         * We win!  This label is here just for ease of understanding
+         * perf profiles.  Nothing jumps here.
+         */
+irq_return_via_sysret:
+        CFI_REMEMBER_STATE
+        RESTORE_ARGS 1,8,1
+        movq (RSP-RIP)(%rsp),%rsp
+        USERGS_SYSRET64
+        CFI_RESTORE_STATE
+opportunistic_sysret_failed:
        SWAPGS
        jmp restore_args
@@ -1048,6 +1023,11 @@ ENTRY(\sym)
        CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
        .if \paranoid
+        .if \paranoid == 1
+        CFI_REMEMBER_STATE
+        testl $3, CS(%rsp)              /* If coming from userspace, switch */
+        jnz 1f                          /* stacks. */
+        .endif
        call save_paranoid
        .else
        call error_entry
@@ -1088,6 +1068,36 @@ ENTRY(\sym)
        jmp error_exit                  /* %ebx: no swapgs flag */
        .endif
+        .if \paranoid == 1
+        CFI_RESTORE_STATE
+        /*
+         * Paranoid entry from userspace.  Switch stacks and treat it
+         * as a normal entry.  This means that paranoid handlers
+         * run in real process context if user_mode(regs).
+         */
+1:
+        call error_entry
+        DEFAULT_FRAME 0
+        movq %rsp,%rdi                  /* pt_regs pointer */
+        call sync_regs
+        movq %rax,%rsp                  /* switch stack */
+        movq %rsp,%rdi                  /* pt_regs pointer */
+        .if \has_error_code
+        movq ORIG_RAX(%rsp),%rsi        /* get error code */
+        movq $-1,ORIG_RAX(%rsp)         /* no syscall to restart */
+        .else
+        xorl %esi,%esi                  /* no error code */
+        .endif
+        call \do_sym
+        jmp error_exit                  /* %ebx: no swapgs flag */
+        .endif
        CFI_ENDPROC
 END(\sym)
 .endm
@@ -1108,7 +1118,7 @@ idtentry overflow do_overflow has_error_code=0
 idtentry bounds do_bounds has_error_code=0
 idtentry invalid_op do_invalid_op has_error_code=0
 idtentry device_not_available do_device_not_available has_error_code=0
-idtentry double_fault do_double_fault has_error_code=1 paranoid=1
+idtentry double_fault do_double_fault has_error_code=1 paranoid=2
 idtentry coprocessor_segment_overrun do_coprocessor_segment_overrun has_error_code=0
 idtentry invalid_TSS do_invalid_TSS has_error_code=1
 idtentry segment_not_present do_segment_not_present has_error_code=1
@@ -1289,16 +1299,14 @@ idtentry machine_check has_error_code=0 paranoid=1 do_sym=*machine_check_vector(
 #endif
        /*
-         * "Paranoid" exit path from exception stack.
+         * "Paranoid" exit path from exception stack.  This is invoked
-         * Paranoid because this is used by NMIs and cannot take
+         * only on return from non-NMI IST interrupts that came
-         * any kernel state for granted.
+         * from kernel space.
-         * We don't do kernel preemption checks here, because only
-         * NMI should be common and it does not enable IRQs and
-         * cannot get reschedule ticks.
         *
-         * "trace" is 0 for the NMI handler only, because irq-tracing
+         * We may be returning to very strange contexts (e.g. very early
-         * is fundamentally NMI-unsafe. (we cannot change the soft and
+         * in syscall entry), so checking for preemption here would
-         * hard flags at once, atomically)
+         * be complicated.  Fortunately, we there's no good reason
+         * to try to handle preemption here.
         */
        /* ebx: no swapgs flag */
@@ -1308,43 +1316,14 @@ ENTRY(paranoid_exit)
        TRACE_IRQS_OFF_DEBUG
        testl %ebx,%ebx                         /* swapgs needed? */
        jnz paranoid_restore
-        testl $3,CS(%rsp)
-        jnz   paranoid_userspace
-paranoid_swapgs:
        TRACE_IRQS_IRETQ 0
        SWAPGS_UNSAFE_STACK
        RESTORE_ALL 8
-        jmp irq_return
+        INTERRUPT_RETURN
 paranoid_restore:
        TRACE_IRQS_IRETQ_DEBUG 0
        RESTORE_ALL 8
-        jmp irq_return
+        INTERRUPT_RETURN
-paranoid_userspace:
-        GET_THREAD_INFO(%rcx)
-        movl TI_flags(%rcx),%ebx
-        andl $_TIF_WORK_MASK,%ebx
-        jz paranoid_swapgs
-        movq %rsp,%rdi                  /* &pt_regs */
-        call sync_regs
-        movq %rax,%rsp                  /* switch stack for scheduling */
-        testl $_TIF_NEED_RESCHED,%ebx
-        jnz paranoid_schedule
-        movl %ebx,%edx                  /* arg3: thread flags */
-        TRACE_IRQS_ON
-        ENABLE_INTERRUPTS(CLBR_NONE)
-        xorl %esi,%esi                  /* arg2: oldset */
-        movq %rsp,%rdi                  /* arg1: &pt_regs */
-        call do_notify_resume
-        DISABLE_INTERRUPTS(CLBR_NONE)
-        TRACE_IRQS_OFF
-        jmp paranoid_userspace
-paranoid_schedule:
-        TRACE_IRQS_ON
-        ENABLE_INTERRUPTS(CLBR_ANY)
-        SCHEDULE_USER
-        DISABLE_INTERRUPTS(CLBR_ANY)
-        TRACE_IRQS_OFF
-        jmp paranoid_userspace
        CFI_ENDPROC
 END(paranoid_exit)
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 2142376dc8c6..8b7b0a51e742 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -674,7 +674,7 @@ static inline void *alloc_tramp(unsigned long size)
 }
 static inline void tramp_free(void *tramp)
 {
-        module_free(NULL, tramp);
+        module_memfree(tramp);
 }
 #else
 /* Trampolines can only be created if modules are supported */
diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
index 3d5fb509bdeb..7114ba220fd4 100644
--- a/arch/x86/kernel/hw_breakpoint.c
+++ b/arch/x86/kernel/hw_breakpoint.c
@@ -126,6 +126,8 @@ int arch_install_hw_breakpoint(struct perf_event *bp)
        *dr7 |= encode_dr7(i, info->len, info->type);
        set_debugreg(*dr7, 7);
+        if (info->mask)
+                set_dr_addr_mask(info->mask, i);
        return 0;
 }
@@ -161,29 +163,8 @@ void arch_uninstall_hw_breakpoint(struct perf_event *bp)
        *dr7 &= ~__encode_dr7(i, info->len, info->type);
        set_debugreg(*dr7, 7);
-}
+        if (info->mask)
+                set_dr_addr_mask(0, i);
-static int get_hbp_len(u8 hbp_len)
-{
-        unsigned int len_in_bytes = 0;
-        switch (hbp_len) {
-        case X86_BREAKPOINT_LEN_1:
-                len_in_bytes = 1;
-                break;
-        case X86_BREAKPOINT_LEN_2:
-                len_in_bytes = 2;
-                break;
-        case X86_BREAKPOINT_LEN_4:
-                len_in_bytes = 4;
-                break;
-#ifdef CONFIG_X86_64
-        case X86_BREAKPOINT_LEN_8:
-                len_in_bytes = 8;
-                break;
-#endif
-        }
-        return len_in_bytes;
 }
 /*
@@ -196,7 +177,7 @@ int arch_check_bp_in_kernelspace(struct perf_event *bp)
        struct arch_hw_breakpoint *info = counter_arch_bp(bp);
        va = info->address;
-        len = get_hbp_len(info->len);
+        len = bp->attr.bp_len;
        return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
 }
@@ -277,6 +258,8 @@ static int arch_build_bp_info(struct perf_event *bp)
        }
        /* Len */
+        info->mask = 0;
        switch (bp->attr.bp_len) {
        case HW_BREAKPOINT_LEN_1:
                info->len = X86_BREAKPOINT_LEN_1;
@@ -293,11 +276,17 @@ static int arch_build_bp_info(struct perf_event *bp)
                break;
 #endif
        default:
-                return -EINVAL;
+                if (!is_power_of_2(bp->attr.bp_len))
+                        return -EINVAL;
+                if (!cpu_has_bpext)
+                        return -EOPNOTSUPP;
+                info->mask = bp->attr.bp_len - 1;
+                info->len = X86_BREAKPOINT_LEN_1;
        }
        return 0;
 }
 /*
 * Validate the arch-specific HW Breakpoint register settings
 */
@@ -312,11 +301,11 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
        if (ret)
                return ret;
-        ret = -EINVAL;
        switch (info->len) {
        case X86_BREAKPOINT_LEN_1:
                align = 0;
+                if (info->mask)
+                        align = info->mask;
                break;
        case X86_BREAKPOINT_LEN_2:
                align = 1;
@@ -330,7 +319,7 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
                break;
 #endif
        default:
-                return ret;
+                WARN_ON_ONCE(1);
        }
        /*
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 6307a0f0cf17..705ef8d48e2d 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -127,7 +127,7 @@ int arch_show_interrupts(struct seq_file *p, int prec)
        seq_puts(p, "  Machine check polls\n");
 #endif
 #if IS_ENABLED(CONFIG_HYPERV) || defined(CONFIG_XEN)
-        seq_printf(p, "%*s: ", prec, "THR");
+        seq_printf(p, "%*s: ", prec, "HYP");
        for_each_online_cpu(j)
                seq_printf(p, "%10u ", irq_stats(j)->irq_hv_callback_count);
        seq_puts(p, "  Hypervisor callback interrupts\n");
diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
index 63ce838e5a54..28d28f5eb8f4 100644
--- a/arch/x86/kernel/irq_32.c
+++ b/arch/x86/kernel/irq_32.c
@@ -69,16 +69,9 @@ static void call_on_stack(void *func, void *stack)
                     : "memory", "cc", "edx", "ecx", "eax");
 }
-/* how to get the current stack pointer from C */
-#define current_stack_pointer ({                \
-        unsigned long sp;                       \
-        asm("mov %%esp,%0" : "=g" (sp));        \
-        sp;                                     \
-})
 static inline void *current_stack(void)
 {
-        return (void *)(current_stack_pointer & ~(THREAD_SIZE - 1));
+        return (void *)(current_stack_pointer() & ~(THREAD_SIZE - 1));
 }
 static inline int
@@ -103,7 +96,7 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
        /* Save the next esp at the bottom of the stack */
        prev_esp = (u32 *)irqstk;
-        *prev_esp = current_stack_pointer;
+        *prev_esp = current_stack_pointer();
        if (unlikely(overflow))
                call_on_stack(print_stack_overflow, isp);
@@ -156,7 +149,7 @@ void do_softirq_own_stack(void)
        /* Push the previous esp onto the stack */
        prev_esp = (u32 *)irqstk;
-        *prev_esp = current_stack_pointer;
+        *prev_esp = current_stack_pointer();
        call_on_stack(__do_softirq, isp);
 }
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index f7e3cd50ece0..98f654d466e5 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -1020,6 +1020,15 @@ int setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
        regs->flags &= ~X86_EFLAGS_IF;
        trace_hardirqs_off();
        regs->ip = (unsigned long)(jp->entry);
+        /*
+         * jprobes use jprobe_return() which skips the normal return
+         * path of the function, and this messes up the accounting of the
+         * function graph tracer to get messed up.
+         *
+         * Pause function graph tracing while performing the jprobe function.
+         */
+        pause_graph_tracing();
        return 1;
 }
 NOKPROBE_SYMBOL(setjmp_pre_handler);
@@ -1048,24 +1057,25 @@ int longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
        struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
        u8 *addr = (u8 *) (regs->ip - 1);
        struct jprobe *jp = container_of(p, struct jprobe, kp);
+        void *saved_sp = kcb->jprobe_saved_sp;
        if ((addr > (u8 *) jprobe_return) &&
            (addr < (u8 *) jprobe_return_end)) {
-                if (stack_addr(regs) != kcb->jprobe_saved_sp) {
+                if (stack_addr(regs) != saved_sp) {
                        struct pt_regs *saved_regs = &kcb->jprobe_saved_regs;
                        printk(KERN_ERR
                               "current sp %p does not match saved sp %p\n",
-                               stack_addr(regs), kcb->jprobe_saved_sp);
+                               stack_addr(regs), saved_sp);
                        printk(KERN_ERR "Saved registers for jprobe %p\n", jp);
                        show_regs(saved_regs);
                        printk(KERN_ERR "Current registers\n");
                        show_regs(regs);
                        BUG();
                }
+                /* It's OK to start function graph tracing again */
+                unpause_graph_tracing();
                *regs = kcb->jprobe_saved_regs;
-                memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
+                memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp));
-                       kcb->jprobes_stack,
-                       MIN_STACK_SIZE(kcb->jprobe_saved_sp));
                preempt_enable_no_resched();
                return 1;
        }
diff --git a/arch/x86/kernel/perf_regs.c b/arch/x86/kernel/perf_regs.c
index e309cc5c276e..781861cc5ee8 100644
--- a/arch/x86/kernel/perf_regs.c
+++ b/arch/x86/kernel/perf_regs.c
@@ -78,6 +78,14 @@ u64 perf_reg_abi(struct task_struct *task)
 {
        return PERF_SAMPLE_REGS_ABI_32;
 }
+void perf_get_regs_user(struct perf_regs *regs_user,
+                        struct pt_regs *regs,
+                        struct pt_regs *regs_user_copy)
+{
+        regs_user->regs = task_pt_regs(current);
+        regs_user->abi = perf_reg_abi(current);
+}
 #else /* CONFIG_X86_64 */
 #define REG_NOSUPPORT ((1ULL << PERF_REG_X86_DS) | \
                       (1ULL << PERF_REG_X86_ES) | \
@@ -102,4 +110,86 @@ u64 perf_reg_abi(struct task_struct *task)
        else
                return PERF_SAMPLE_REGS_ABI_64;
 }
+void perf_get_regs_user(struct perf_regs *regs_user,
+                        struct pt_regs *regs,
+                        struct pt_regs *regs_user_copy)
+{
+        struct pt_regs *user_regs = task_pt_regs(current);
+        /*
+         * If we're in an NMI that interrupted task_pt_regs setup, then
+         * we can't sample user regs at all.  This check isn't really
+         * sufficient, though, as we could be in an NMI inside an interrupt
+         * that happened during task_pt_regs setup.
+         */
+        if (regs->sp > (unsigned long)&user_regs->r11 &&
+            regs->sp <= (unsigned long)(user_regs + 1)) {
+                regs_user->abi = PERF_SAMPLE_REGS_ABI_NONE;
+                regs_user->regs = NULL;
+                return;
+        }
+        /*
+         * RIP, flags, and the argument registers are usually saved.
+         * orig_ax is probably okay, too.
+         */
+        regs_user_copy->ip = user_regs->ip;
+        regs_user_copy->cx = user_regs->cx;
+        regs_user_copy->dx = user_regs->dx;
+        regs_user_copy->si = user_regs->si;
+        regs_user_copy->di = user_regs->di;
+        regs_user_copy->r8 = user_regs->r8;
+        regs_user_copy->r9 = user_regs->r9;
+        regs_user_copy->r10 = user_regs->r10;
+        regs_user_copy->r11 = user_regs->r11;
+        regs_user_copy->orig_ax = user_regs->orig_ax;
+        regs_user_copy->flags = user_regs->flags;
+        /*
+         * Don't even try to report the "rest" regs.
+         */
+        regs_user_copy->bx = -1;
+        regs_user_copy->bp = -1;
+        regs_user_copy->r12 = -1;
+        regs_user_copy->r13 = -1;
+        regs_user_copy->r14 = -1;
+        regs_user_copy->r15 = -1;
+        /*
+         * For this to be at all useful, we need a reasonable guess for
+         * sp and the ABI.  Be careful: we're in NMI context, and we're
+         * considering current to be the current task, so we should
+         * be careful not to look at any other percpu variables that might
+         * change during context switches.
+         */
+        if (IS_ENABLED(CONFIG_IA32_EMULATION) &&
+            task_thread_info(current)->status & TS_COMPAT) {
+                /* Easy case: we're in a compat syscall. */
+                regs_user->abi = PERF_SAMPLE_REGS_ABI_32;
+                regs_user_copy->sp = user_regs->sp;
+                regs_user_copy->cs = user_regs->cs;
+                regs_user_copy->ss = user_regs->ss;
+        } else if (user_regs->orig_ax != -1) {
+                /*
+                 * We're probably in a 64-bit syscall.
+                 * Warning: this code is severely racy.  At least it's better
+                 * than just blindly copying user_regs.
+                 */
+                regs_user->abi = PERF_SAMPLE_REGS_ABI_64;
+                regs_user_copy->sp = this_cpu_read(old_rsp);
+                regs_user_copy->cs = __USER_CS;
+                regs_user_copy->ss = __USER_DS;
+                regs_user_copy->cx = -1;  /* usually contains garbage */
+        } else {
+                /* We're probably in an interrupt or exception. */
+                regs_user->abi = user_64bit_mode(user_regs) ?
+                        PERF_SAMPLE_REGS_ABI_64 : PERF_SAMPLE_REGS_ABI_32;
+                regs_user_copy->sp = user_regs->sp;
+                regs_user_copy->cs = user_regs->cs;
+                regs_user_copy->ss = user_regs->ss;
+        }
+        regs_user->regs = regs_user_copy;
+}
 #endif /* CONFIG_X86_32 */
diff --git a/arch/x86/kernel/rtc.c b/arch/x86/kernel/rtc.c
index ca9622a25e95..fe3dbfe0c4a5 100644
--- a/arch/x86/kernel/rtc.c
+++ b/arch/x86/kernel/rtc.c
@@ -170,7 +170,7 @@ static struct platform_device rtc_device = {
 static __init int add_rtc_cmos(void)
 {
 #ifdef CONFIG_PNP
-        static const char * const  const ids[] __initconst =
+        static const char * const ids[] __initconst =
            { "PNP0b00", "PNP0b01", "PNP0b02", };
        struct pnp_dev *dev;
        struct pnp_id *id;
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index ed37a768d0fc..2a33c8f68319 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -740,12 +740,6 @@ do_notify_resume(struct pt_regs *regs, void *unused, __u32 thread_info_flags)
 {
        user_exit();
-#ifdef CONFIG_X86_MCE
-        /* notify userspace of pending MCEs */
-        if (thread_info_flags & _TIF_MCE_NOTIFY)
-                mce_notify_process();
-#endif /* CONFIG_X86_64 && CONFIG_X86_MCE */
        if (thread_info_flags & _TIF_UPROBE)
                uprobe_notify_resume(regs);
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 6d7022c683e3..febc6aabc72e 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -73,7 +73,6 @@
 #include <asm/setup.h>
 #include <asm/uv/uv.h>
 #include <linux/mc146818rtc.h>
-#include <asm/smpboot_hooks.h>
 #include <asm/i8259.h>
 #include <asm/realmode.h>
 #include <asm/misc.h>
@@ -104,6 +103,43 @@ EXPORT_PER_CPU_SYMBOL(cpu_info);
 atomic_t init_deasserted;
+static inline void smpboot_setup_warm_reset_vector(unsigned long start_eip)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&rtc_lock, flags);
+        CMOS_WRITE(0xa, 0xf);
+        spin_unlock_irqrestore(&rtc_lock, flags);
+        local_flush_tlb();
+        pr_debug("1.\n");
+        *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_HIGH)) =
+                                                        start_eip >> 4;
+        pr_debug("2.\n");
+        *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_LOW)) =
+                                                        start_eip & 0xf;
+        pr_debug("3.\n");
+}
+static inline void smpboot_restore_warm_reset_vector(void)
+{
+        unsigned long flags;
+        /*
+         * Install writable page 0 entry to set BIOS data area.
+         */
+        local_flush_tlb();
+        /*
+         * Paranoid:  Set warm reset code and vector here back
+         * to default values.
+         */
+        spin_lock_irqsave(&rtc_lock, flags);
+        CMOS_WRITE(0, 0xf);
+        spin_unlock_irqrestore(&rtc_lock, flags);
+        *((volatile u32 *)phys_to_virt(TRAMPOLINE_PHYS_LOW)) = 0;
+}
 /*
 * Report back to the Boot Processor during boot time or to the caller processor
 * during CPU online.
@@ -136,8 +172,7 @@ static void smp_callin(void)
         * CPU, first the APIC. (this is probably redundant on most
         * boards)
         */
-        setup_local_APIC();
+        apic_ap_setup();
-        end_local_APIC_setup();
        /*
         * Need to setup vector mappings before we enable interrupts.
@@ -955,9 +990,12 @@ void arch_disable_smp_support(void)
 */
 static __init void disable_smp(void)
 {
+        pr_info("SMP disabled\n");
+        disable_ioapic_support();
        init_cpu_present(cpumask_of(0));
        init_cpu_possible(cpumask_of(0));
-        smpboot_clear_io_apic_irqs();
        if (smp_found_config)
                physid_set_mask_of_physid(boot_cpu_physical_apicid, &phys_cpu_present_map);
@@ -967,6 +1005,13 @@ static __init void disable_smp(void)
        cpumask_set_cpu(0, cpu_core_mask(0));
 }
+enum {
+        SMP_OK,
+        SMP_NO_CONFIG,
+        SMP_NO_APIC,
+        SMP_FORCE_UP,
+};
 /*
 * Various sanity checks.
 */
@@ -1014,10 +1059,7 @@ static int __init smp_sanity_check(unsigned max_cpus)
        if (!smp_found_config && !acpi_lapic) {
                preempt_enable();
                pr_notice("SMP motherboard not detected\n");
-                disable_smp();
+                return SMP_NO_CONFIG;
-                if (APIC_init_uniprocessor())
-                        pr_notice("Local APIC not detected. Using dummy APIC emulation.\n");
-                return -1;
        }
        /*
@@ -1041,9 +1083,7 @@ static int __init smp_sanity_check(unsigned max_cpus)
                                boot_cpu_physical_apicid);
                        pr_err("... forcing use of dummy APIC emulation (tell your hw vendor)\n");
                }
-                smpboot_clear_io_apic();
+                return SMP_NO_APIC;
-                disable_ioapic_support();
-                return -1;
        }
        verify_local_APIC();
@@ -1053,15 +1093,10 @@ static int __init smp_sanity_check(unsigned max_cpus)
         */
        if (!max_cpus) {
                pr_info("SMP mode deactivated\n");
-                smpboot_clear_io_apic();
+                return SMP_FORCE_UP;
-                connect_bsp_APIC();
-                setup_local_APIC();
-                bsp_end_local_APIC_setup();
-                return -1;
        }
-        return 0;
+        return SMP_OK;
 }
 static void __init smp_cpu_index_default(void)
@@ -1101,10 +1136,21 @@ void __init native_smp_prepare_cpus(unsigned int max_cpus)
        }
        set_cpu_sibling_map(0);
-        if (smp_sanity_check(max_cpus) < 0) {
+        switch (smp_sanity_check(max_cpus)) {
-                pr_info("SMP disabled\n");
+        case SMP_NO_CONFIG:
                disable_smp();
+                if (APIC_init_uniprocessor())
+                        pr_notice("Local APIC not detected. Using dummy APIC emulation.\n");
                return;
+        case SMP_NO_APIC:
+                disable_smp();
+                return;
+        case SMP_FORCE_UP:
+                disable_smp();
+                apic_bsp_setup(false);
+                return;
+        case SMP_OK:
+                break;
        }
        default_setup_apic_routing();
@@ -1115,33 +1161,10 @@ void __init native_smp_prepare_cpus(unsigned int max_cpus)
                /* Or can we switch back to PIC here? */
        }
-        connect_bsp_APIC();
+        cpu0_logical_apicid = apic_bsp_setup(false);
-        /*
-         * Switch from PIC to APIC mode.
-         */
-        setup_local_APIC();
-        if (x2apic_mode)
-                cpu0_logical_apicid = apic_read(APIC_LDR);
-        else
-                cpu0_logical_apicid = GET_APIC_LOGICAL_ID(apic_read(APIC_LDR));
-        /*
-         * Enable IO APIC before setting up error vector
-         */
-        if (!skip_ioapic_setup && nr_ioapics)
-                enable_IO_APIC();
-        bsp_end_local_APIC_setup();
-        smpboot_setup_io_apic();
-        /*
-         * Set up local APIC timer on boot CPU.
-         */
        pr_info("CPU%d: ", 0);
        print_cpu_info(&cpu_data(0));
-        x86_init.timers.setup_percpu_clockev();
        if (is_uv_system())
                uv_system_init();
@@ -1177,9 +1200,7 @@ void __init native_smp_cpus_done(unsigned int max_cpus)
        nmi_selftest();
        impress_friends();
-#ifdef CONFIG_X86_IO_APIC
        setup_ioapic_dest();
-#endif
        mtrr_aps_init();
 }
diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
index 4e942f31b1a7..7fc5e843f247 100644
--- a/arch/x86/kernel/tls.c
+++ b/arch/x86/kernel/tls.c
@@ -29,7 +29,28 @@ static int get_free_idx(void)
 static bool tls_desc_okay(const struct user_desc *info)
 {
-        if (LDT_empty(info))
+        /*
+         * For historical reasons (i.e. no one ever documented how any
+         * of the segmentation APIs work), user programs can and do
+         * assume that a struct user_desc that's all zeros except for
+         * entry_number means "no segment at all".  This never actually
+         * worked.  In fact, up to Linux 3.19, a struct user_desc like
+         * this would create a 16-bit read-write segment with base and
+         * limit both equal to zero.
+         *
+         * That was close enough to "no segment at all" until we
+         * hardened this function to disallow 16-bit TLS segments.  Fix
+         * it up by interpreting these zeroed segments the way that they
+         * were almost certainly intended to be interpreted.
+         *
+         * The correct way to ask for "no segment at all" is to specify
+         * a user_desc that satisfies LDT_empty.  To keep everything
+         * working, we accept both.
+         *
+         * Note that there's a similar kludge in modify_ldt -- look at
+         * the distinction between modes 1 and 0x11.
+         */
+        if (LDT_empty(info) || LDT_zero(info))
                return true;
        /*
@@ -71,7 +92,7 @@ static void set_tls_desc(struct task_struct *p, int idx,
        cpu = get_cpu();
        while (n-- > 0) {
-                if (LDT_empty(info))
+                if (LDT_empty(info) || LDT_zero(info))
                        desc->a = desc->b = 0;
                else
                        fill_ldt(desc, info);
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index fb4cb6adf225..9d2073e2ecc9 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -108,6 +108,88 @@ static inline void preempt_conditional_cli(struct pt_regs *regs)
        preempt_count_dec();
 }
+enum ctx_state ist_enter(struct pt_regs *regs)
+{
+        enum ctx_state prev_state;
+        if (user_mode_vm(regs)) {
+                /* Other than that, we're just an exception. */
+                prev_state = exception_enter();
+        } else {
+                /*
+                 * We might have interrupted pretty much anything.  In
+                 * fact, if we're a machine check, we can even interrupt
+                 * NMI processing.  We don't want in_nmi() to return true,
+                 * but we need to notify RCU.
+                 */
+                rcu_nmi_enter();
+                prev_state = IN_KERNEL;  /* the value is irrelevant. */
+        }
+        /*
+         * We are atomic because we're on the IST stack (or we're on x86_32,
+         * in which case we still shouldn't schedule).
+         *
+         * This must be after exception_enter(), because exception_enter()
+         * won't do anything if in_interrupt() returns true.
+         */
+        preempt_count_add(HARDIRQ_OFFSET);
+        /* This code is a bit fragile.  Test it. */
+        rcu_lockdep_assert(rcu_is_watching(), "ist_enter didn't work");
+        return prev_state;
+}
+void ist_exit(struct pt_regs *regs, enum ctx_state prev_state)
+{
+        /* Must be before exception_exit. */
+        preempt_count_sub(HARDIRQ_OFFSET);
+        if (user_mode_vm(regs))
+                return exception_exit(prev_state);
+        else
+                rcu_nmi_exit();
+}
+/**
+ * ist_begin_non_atomic() - begin a non-atomic section in an IST exception
+ * @regs:       regs passed to the IST exception handler
+ *
+ * IST exception handlers normally cannot schedule.  As a special
+ * exception, if the exception interrupted userspace code (i.e.
+ * user_mode_vm(regs) would return true) and the exception was not
+ * a double fault, it can be safe to schedule.  ist_begin_non_atomic()
+ * begins a non-atomic section within an ist_enter()/ist_exit() region.
+ * Callers are responsible for enabling interrupts themselves inside
+ * the non-atomic section, and callers must call is_end_non_atomic()
+ * before ist_exit().
+ */
+void ist_begin_non_atomic(struct pt_regs *regs)
+{
+        BUG_ON(!user_mode_vm(regs));
+        /*
+         * Sanity check: we need to be on the normal thread stack.  This
+         * will catch asm bugs and any attempt to use ist_preempt_enable
+         * from double_fault.
+         */
+        BUG_ON(((current_stack_pointer() ^ this_cpu_read_stable(kernel_stack))
+                & ~(THREAD_SIZE - 1)) != 0);
+        preempt_count_sub(HARDIRQ_OFFSET);
+}
+/**
+ * ist_end_non_atomic() - begin a non-atomic section in an IST exception
+ *
+ * Ends a non-atomic section started with ist_begin_non_atomic().
+ */
+void ist_end_non_atomic(void)
+{
+        preempt_count_add(HARDIRQ_OFFSET);
+}
 static nokprobe_inline int
 do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
                  struct pt_regs *regs, long error_code)
@@ -251,6 +333,8 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
         * end up promoting it to a doublefault.  In that case, modify
         * the stack to make it look like we just entered the #GP
         * handler from user space, similar to bad_iret.
+         *
+         * No need for ist_enter here because we don't use RCU.
         */
        if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY &&
                regs->cs == __KERNEL_CS &&
@@ -263,12 +347,12 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
                normal_regs->orig_ax = 0;  /* Missing (lost) #GP error code */
                regs->ip = (unsigned long)general_protection;
                regs->sp = (unsigned long)&normal_regs->orig_ax;
                return;
        }
 #endif
-        exception_enter();
+        ist_enter(regs);  /* Discard prev_state because we won't return. */
-        /* Return not checked because double check cannot be ignored */
        notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);
        tsk->thread.error_code = error_code;
@@ -434,7 +518,7 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code)
        if (poke_int3_handler(regs))
                return;
-        prev_state = exception_enter();
+        prev_state = ist_enter(regs);
 #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP
        if (kgdb_ll_trap(DIE_INT3, "int3", regs, error_code, X86_TRAP_BP,
                                SIGTRAP) == NOTIFY_STOP)
@@ -460,33 +544,20 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code)
        preempt_conditional_cli(regs);
        debug_stack_usage_dec();
 exit:
-        exception_exit(prev_state);
+        ist_exit(regs, prev_state);
 }
 NOKPROBE_SYMBOL(do_int3);
 #ifdef CONFIG_X86_64
 /*
- * Help handler running on IST stack to switch back to user stack
+ * Help handler running on IST stack to switch off the IST stack if the
- * for scheduling or signal handling. The actual stack switch is done in
+ * interrupted code was in user mode. The actual stack switch is done in
- * entry.S
+ * entry_64.S
 */
 asmlinkage __visible notrace struct pt_regs *sync_regs(struct pt_regs *eregs)
 {
-        struct pt_regs *regs = eregs;
+        struct pt_regs *regs = task_pt_regs(current);
-        /* Did already sync */
+        *regs = *eregs;
-        if (eregs == (struct pt_regs *)eregs->sp)
-                ;
-        /* Exception from user space */
-        else if (user_mode(eregs))
-                regs = task_pt_regs(current);
-        /*
-         * Exception from kernel and interrupts are enabled. Move to
-         * kernel process stack.
-         */
-        else if (eregs->flags & X86_EFLAGS_IF)
-                regs = (struct pt_regs *)(eregs->sp -= sizeof(struct pt_regs));
-        if (eregs != regs)
-                *regs = *eregs;
        return regs;
 }
 NOKPROBE_SYMBOL(sync_regs);
@@ -554,7 +625,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
        unsigned long dr6;
        int si_code;
-        prev_state = exception_enter();
+        prev_state = ist_enter(regs);
        get_debugreg(dr6, 6);
@@ -629,7 +700,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
        debug_stack_usage_dec();
 exit:
-        exception_exit(prev_state);
+        ist_exit(regs, prev_state);
 }
 NOKPROBE_SYMBOL(do_debug);
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index b7e50bba3bbb..505449700e0c 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -617,7 +617,7 @@ static unsigned long quick_pit_calibrate(void)
                        goto success;
                }
        }
-        pr_err("Fast TSC calibration failed\n");
+        pr_info("Fast TSC calibration failed\n");
        return 0;
 success:
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index f9d16ff56c6b..7dc7ba577ecd 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -40,6 +40,7 @@ config KVM
        select HAVE_KVM_MSI
        select HAVE_KVM_CPU_RELAX_INTERCEPT
        select KVM_VFIO
+        select SRCU
        ---help---
          Support hosting fully virtualized guest machines using hardware
          virtualization extensions.  You will need a fairly recent
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 169b09d76ddd..de12c1d379f1 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -2348,7 +2348,7 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
         * Not recognized on AMD in compat mode (but is recognized in legacy
         * mode).
         */
-        if ((ctxt->mode == X86EMUL_MODE_PROT32) && (efer & EFER_LMA)
+        if ((ctxt->mode != X86EMUL_MODE_PROT64) && (efer & EFER_LMA)
            && !vendor_intel(ctxt))
                return emulate_ud(ctxt);
@@ -2359,25 +2359,13 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
        setup_syscalls_segments(ctxt, &cs, &ss);
        ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
-        switch (ctxt->mode) {
+        if ((msr_data & 0xfffc) == 0x0)
-        case X86EMUL_MODE_PROT32:
+                return emulate_gp(ctxt, 0);
-                if ((msr_data & 0xfffc) == 0x0)
-                        return emulate_gp(ctxt, 0);
-                break;
-        case X86EMUL_MODE_PROT64:
-                if (msr_data == 0x0)
-                        return emulate_gp(ctxt, 0);
-                break;
-        default:
-                break;
-        }
        ctxt->eflags &= ~(EFLG_VM | EFLG_IF);
-        cs_sel = (u16)msr_data;
+        cs_sel = (u16)msr_data & ~SELECTOR_RPL_MASK;
-        cs_sel &= ~SELECTOR_RPL_MASK;
        ss_sel = cs_sel + 8;
-        ss_sel &= ~SELECTOR_RPL_MASK;
+        if (efer & EFER_LMA) {
-        if (ctxt->mode == X86EMUL_MODE_PROT64 || (efer & EFER_LMA)) {
                cs.d = 0;
                cs.l = 1;
        }
@@ -2386,10 +2374,11 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
        ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
        ops->get_msr(ctxt, MSR_IA32_SYSENTER_EIP, &msr_data);
-        ctxt->_eip = msr_data;
+        ctxt->_eip = (efer & EFER_LMA) ? msr_data : (u32)msr_data;
        ops->get_msr(ctxt, MSR_IA32_SYSENTER_ESP, &msr_data);
-        *reg_write(ctxt, VCPU_REGS_RSP) = msr_data;
+        *reg_write(ctxt, VCPU_REGS_RSP) = (efer & EFER_LMA) ? msr_data :
+                                                              (u32)msr_data;
        return X86EMUL_CONTINUE;
 }
@@ -3791,8 +3780,8 @@ static const struct opcode group5[] = {
 };
 static const struct opcode group6[] = {
-        DI(Prot,        sldt),
+        DI(Prot | DstMem,       sldt),
-        DI(Prot,        str),
+        DI(Prot | DstMem,       str),
        II(Prot | Priv | SrcMem16, em_lldt, lldt),
        II(Prot | Priv | SrcMem16, em_ltr, ltr),
        N, N, N, N,
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 4f0c0b954686..d52dcf0776ea 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -192,6 +192,9 @@ static void recalculate_apic_map(struct kvm *kvm)
                u16 cid, lid;
                u32 ldr, aid;
+                if (!kvm_apic_present(vcpu))
+                        continue;
                aid = kvm_apic_id(apic);
                ldr = kvm_apic_get_reg(apic, APIC_LDR);
                cid = apic_cluster_id(new, ldr);
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 10fbed126b11..f83fc6c5e0ba 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -4448,7 +4448,7 @@ void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm)
         * zap all shadow pages.
         */
        if (unlikely(kvm_current_mmio_generation(kvm) == 0)) {
-                printk_ratelimited(KERN_INFO "kvm: zapping shadow pages for mmio generation wraparound\n");
+                printk_ratelimited(KERN_DEBUG "kvm: zapping shadow pages for mmio generation wraparound\n");
                kvm_mmu_invalidate_zap_all_pages(kvm);
        }
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index feb852b04598..d4c58d884838 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -5840,53 +5840,10 @@ static __init int hardware_setup(void)
        memset(vmx_msr_bitmap_legacy, 0xff, PAGE_SIZE);
        memset(vmx_msr_bitmap_longmode, 0xff, PAGE_SIZE);
-        vmx_disable_intercept_for_msr(MSR_FS_BASE, false);
-        vmx_disable_intercept_for_msr(MSR_GS_BASE, false);
-        vmx_disable_intercept_for_msr(MSR_KERNEL_GS_BASE, true);
-        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_CS, false);
-        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_ESP, false);
-        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_EIP, false);
-        vmx_disable_intercept_for_msr(MSR_IA32_BNDCFGS, true);
-        memcpy(vmx_msr_bitmap_legacy_x2apic,
-                        vmx_msr_bitmap_legacy, PAGE_SIZE);
-        memcpy(vmx_msr_bitmap_longmode_x2apic,
-                        vmx_msr_bitmap_longmode, PAGE_SIZE);
-        if (enable_apicv) {
-                for (msr = 0x800; msr <= 0x8ff; msr++)
-                        vmx_disable_intercept_msr_read_x2apic(msr);
-                /* According SDM, in x2apic mode, the whole id reg is used.
-                 * But in KVM, it only use the highest eight bits. Need to
-                 * intercept it */
-                vmx_enable_intercept_msr_read_x2apic(0x802);
-                /* TMCCT */
-                vmx_enable_intercept_msr_read_x2apic(0x839);
-                /* TPR */
-                vmx_disable_intercept_msr_write_x2apic(0x808);
-                /* EOI */
-                vmx_disable_intercept_msr_write_x2apic(0x80b);
-                /* SELF-IPI */
-                vmx_disable_intercept_msr_write_x2apic(0x83f);
-        }
-        if (enable_ept) {
-                kvm_mmu_set_mask_ptes(0ull,
-                        (enable_ept_ad_bits) ? VMX_EPT_ACCESS_BIT : 0ull,
-                        (enable_ept_ad_bits) ? VMX_EPT_DIRTY_BIT : 0ull,
-                        0ull, VMX_EPT_EXECUTABLE_MASK);
-                ept_set_mmio_spte_mask();
-                kvm_enable_tdp();
-        } else
-                kvm_disable_tdp();
-        update_ple_window_actual_max();
        if (setup_vmcs_config(&vmcs_config) < 0) {
                r = -EIO;
                goto out7;
-    }
+        }
        if (boot_cpu_has(X86_FEATURE_NX))
                kvm_enable_efer_bits(EFER_NX);
@@ -5945,6 +5902,49 @@ static __init int hardware_setup(void)
        if (nested)
                nested_vmx_setup_ctls_msrs();
+        vmx_disable_intercept_for_msr(MSR_FS_BASE, false);
+        vmx_disable_intercept_for_msr(MSR_GS_BASE, false);
+        vmx_disable_intercept_for_msr(MSR_KERNEL_GS_BASE, true);
+        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_CS, false);
+        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_ESP, false);
+        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_EIP, false);
+        vmx_disable_intercept_for_msr(MSR_IA32_BNDCFGS, true);
+        memcpy(vmx_msr_bitmap_legacy_x2apic,
+                        vmx_msr_bitmap_legacy, PAGE_SIZE);
+        memcpy(vmx_msr_bitmap_longmode_x2apic,
+                        vmx_msr_bitmap_longmode, PAGE_SIZE);
+        if (enable_apicv) {
+                for (msr = 0x800; msr <= 0x8ff; msr++)
+                        vmx_disable_intercept_msr_read_x2apic(msr);
+                /* According SDM, in x2apic mode, the whole id reg is used.
+                 * But in KVM, it only use the highest eight bits. Need to
+                 * intercept it */
+                vmx_enable_intercept_msr_read_x2apic(0x802);
+                /* TMCCT */
+                vmx_enable_intercept_msr_read_x2apic(0x839);
+                /* TPR */
+                vmx_disable_intercept_msr_write_x2apic(0x808);
+                /* EOI */
+                vmx_disable_intercept_msr_write_x2apic(0x80b);
+                /* SELF-IPI */
+                vmx_disable_intercept_msr_write_x2apic(0x83f);
+        }
+        if (enable_ept) {
+                kvm_mmu_set_mask_ptes(0ull,
+                        (enable_ept_ad_bits) ? VMX_EPT_ACCESS_BIT : 0ull,
+                        (enable_ept_ad_bits) ? VMX_EPT_DIRTY_BIT : 0ull,
+                        0ull, VMX_EPT_EXECUTABLE_MASK);
+                ept_set_mmio_spte_mask();
+                kvm_enable_tdp();
+        } else
+                kvm_disable_tdp();
+        update_ple_window_actual_max();
        return alloc_kvm_area();
 out7:
diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
index 2480978b31cc..1313ae6b478b 100644
--- a/arch/x86/lib/insn.c
+++ b/arch/x86/lib/insn.c
@@ -28,7 +28,7 @@
 /* Verify next sizeof(t) bytes can be on the same instruction */
 #define validate_next(t, insn, n)       \
-        ((insn)->next_byte + sizeof(t) + n < (insn)->end_kaddr)
+        ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)
 #define __get_next(t, insn)     \
        ({ t r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 38dcec403b46..e3ff27a5b634 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -898,6 +898,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
                if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
                             VM_FAULT_HWPOISON_LARGE))
                        do_sigbus(regs, error_code, address, fault);
+                else if (fault & VM_FAULT_SIGSEGV)
+                        bad_area_nosemaphore(regs, error_code, address);
                else
                        BUG();
        }
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index a97ee0801475..079c3b6a3ff1 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -43,7 +43,7 @@ uint16_t __cachemode2pte_tbl[_PAGE_CACHE_MODE_NUM] = {
        [_PAGE_CACHE_MODE_WT]           = _PAGE_PCD,
        [_PAGE_CACHE_MODE_WP]           = _PAGE_PCD,
 };
-EXPORT_SYMBOL_GPL(__cachemode2pte_tbl);
+EXPORT_SYMBOL(__cachemode2pte_tbl);
 uint8_t __pte2cachemode_tbl[8] = {
        [__pte2cm_idx(0)] = _PAGE_CACHE_MODE_WB,
        [__pte2cm_idx(_PAGE_PWT)] = _PAGE_CACHE_MODE_WC,
@@ -54,7 +54,7 @@ uint8_t __pte2cachemode_tbl[8] = {
        [__pte2cm_idx(_PAGE_PCD | _PAGE_PAT)] = _PAGE_CACHE_MODE_UC_MINUS,
        [__pte2cm_idx(_PAGE_PWT | _PAGE_PCD | _PAGE_PAT)] = _PAGE_CACHE_MODE_UC,
 };
-EXPORT_SYMBOL_GPL(__pte2cachemode_tbl);
+EXPORT_SYMBOL(__pte2cachemode_tbl);
 static unsigned long __initdata pgt_buf_start;
 static unsigned long __initdata pgt_buf_end;
@@ -438,20 +438,20 @@ static unsigned long __init init_range_memory_mapping(
 static unsigned long __init get_new_step_size(unsigned long step_size)
 {
        /*
-         * Explain why we shift by 5 and why we don't have to worry about
+         * Initial mapped size is PMD_SIZE (2M).
-         * 'step_size << 5' overflowing:
-         *
-         * initial mapped size is PMD_SIZE (2M).
         * We can not set step_size to be PUD_SIZE (1G) yet.
         * In worse case, when we cross the 1G boundary, and
         * PG_LEVEL_2M is not set, we will need 1+1+512 pages (2M + 8k)
-         * to map 1G range with PTE. Use 5 as shift for now.
+         * to map 1G range with PTE. Hence we use one less than the
+         * difference of page table level shifts.
         *
-         * Don't need to worry about overflow, on 32bit, when step_size
+         * Don't need to worry about overflow in the top-down case, on 32bit,
-         * is 0, round_down() returns 0 for start, and that turns it
+         * when step_size is 0, round_down() returns 0 for start, and that
-         * into 0x100000000ULL.
+         * turns it into 0x100000000ULL.
+         * In the bottom-up case, round_up(x, 0) returns 0 though too, which
+         * needs to be taken into consideration by the code below.
         */
-        return step_size << 5;
+        return step_size << (PMD_SHIFT - PAGE_SHIFT - 1);
 }
 /**
@@ -471,7 +471,6 @@ static void __init memory_map_top_down(unsigned long map_start,
        unsigned long step_size;
        unsigned long addr;
        unsigned long mapped_ram_size = 0;
-        unsigned long new_mapped_ram_size;
        /* xen has big range in reserved near end of ram, skip it at first.*/
        addr = memblock_find_in_range(map_start, map_end, PMD_SIZE, PMD_SIZE);
@@ -496,14 +495,12 @@ static void __init memory_map_top_down(unsigned long map_start,
                                start = map_start;
                } else
                        start = map_start;
-                new_mapped_ram_size = init_range_memory_mapping(start,
+                mapped_ram_size += init_range_memory_mapping(start,
                                                        last_start);
                last_start = start;
                min_pfn_mapped = last_start >> PAGE_SHIFT;
-                /* only increase step_size after big range get mapped */
+                if (mapped_ram_size >= step_size)
-                if (new_mapped_ram_size > mapped_ram_size)
                        step_size = get_new_step_size(step_size);
-                mapped_ram_size += new_mapped_ram_size;
        }
        if (real_end < map_end)
@@ -524,7 +521,7 @@ static void __init memory_map_top_down(unsigned long map_start,
 static void __init memory_map_bottom_up(unsigned long map_start,
                                        unsigned long map_end)
 {
-        unsigned long next, new_mapped_ram_size, start;
+        unsigned long next, start;
        unsigned long mapped_ram_size = 0;
        /* step_size need to be small so pgt_buf from BRK could cover it */
        unsigned long step_size = PMD_SIZE;
@@ -539,19 +536,19 @@ static void __init memory_map_bottom_up(unsigned long map_start,
         * for page table.
         */
        while (start < map_end) {
-                if (map_end - start > step_size) {
+                if (step_size && map_end - start > step_size) {
                        next = round_up(start + 1, step_size);
                        if (next > map_end)
                                next = map_end;
-                } else
+                } else {
                        next = map_end;
+                }
-                new_mapped_ram_size = init_range_memory_mapping(start, next);
+                mapped_ram_size += init_range_memory_mapping(start, next);
                start = next;
-                if (new_mapped_ram_size > mapped_ram_size)
+                if (mapped_ram_size >= step_size)
                        step_size = get_new_step_size(step_size);
-                mapped_ram_size += new_mapped_ram_size;
        }
 }
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index 67ebf5751222..c439ec478216 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -349,6 +349,12 @@ static __user void *task_get_bounds_dir(struct task_struct *tsk)
                return MPX_INVALID_BOUNDS_DIR;
        /*
+         * 32-bit binaries on 64-bit kernels are currently
+         * unsupported.
+         */
+        if (IS_ENABLED(CONFIG_X86_64) && test_thread_flag(TIF_IA32))
+                return MPX_INVALID_BOUNDS_DIR;
+        /*
         * The bounds directory pointer is stored in a register
         * only accessible if we first do an xsave.
         */
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index edf299c8ff6c..7ac68698406c 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -234,8 +234,13 @@ void pat_init(void)
              PAT(4, WB) | PAT(5, WC) | PAT(6, UC_MINUS) | PAT(7, UC);
        /* Boot CPU check */
-        if (!boot_pat_state)
+        if (!boot_pat_state) {
                rdmsrl(MSR_IA32_CR_PAT, boot_pat_state);
+                if (!boot_pat_state) {
+                        pat_disable("PAT read returns always zero, disabled.");
+                        return;
+                }
+        }
        wrmsrl(MSR_IA32_CR_PAT, pat);
diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
index 7b20bccf3648..2fb384724ebb 100644
--- a/arch/x86/pci/common.c
+++ b/arch/x86/pci/common.c
@@ -448,6 +448,22 @@ static const struct dmi_system_id pciprobe_dmi_table[] __initconst = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "ftServer"),
                },
        },
+        {
+                .callback = set_scan_all,
+                .ident = "Stratus/NEC ftServer",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R32"),
+                },
+        },
+        {
+                .callback = set_scan_all,
+                .ident = "Stratus/NEC ftServer",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R31"),
+                },
+        },
        {}
 };
diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
index 9b18ef315a55..349c0d32cc0b 100644
--- a/arch/x86/pci/i386.c
+++ b/arch/x86/pci/i386.c
@@ -216,7 +216,7 @@ static void pcibios_allocate_bridge_resources(struct pci_dev *dev)
                        continue;
                if (r->parent)  /* Already allocated */
                        continue;
-                if (!r->start || pci_claim_resource(dev, idx) < 0) {
+                if (!r->start || pci_claim_bridge_resource(dev, idx) < 0) {
                        /*
                         * Something is wrong with the region.
                         * Invalidate the resource to prevent
diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
index 44b9271580b5..852aa4c92da0 100644
--- a/arch/x86/pci/intel_mid_pci.c
+++ b/arch/x86/pci/intel_mid_pci.c
@@ -293,7 +293,6 @@ static void mrst_power_off_unused_dev(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0801, mrst_power_off_unused_dev);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0809, mrst_power_off_unused_dev);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x080C, mrst_power_off_unused_dev);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0812, mrst_power_off_unused_dev);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0815, mrst_power_off_unused_dev);
 /*
diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
index c489ef2c1a39..9098d880c476 100644
--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
@@ -458,6 +458,7 @@ int __init pci_xen_hvm_init(void)
         * just how GSIs get registered.
         */
        __acpi_register_gsi = acpi_register_gsi_xen_hvm;
+        __acpi_unregister_gsi = NULL;
 #endif
 #ifdef CONFIG_PCI_MSI
@@ -471,52 +472,6 @@ int __init pci_xen_hvm_init(void)
 }
 #ifdef CONFIG_XEN_DOM0
-static __init void xen_setup_acpi_sci(void)
-{
-        int rc;
-        int trigger, polarity;
-        int gsi = acpi_sci_override_gsi;
-        int irq = -1;
-        int gsi_override = -1;
-        if (!gsi)
-                return;
-        rc = acpi_get_override_irq(gsi, &trigger, &polarity);
-        if (rc) {
-                printk(KERN_WARNING "xen: acpi_get_override_irq failed for acpi"
-                                " sci, rc=%d\n", rc);
-                return;
-        }
-        trigger = trigger ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE;
-        polarity = polarity ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH;
-        printk(KERN_INFO "xen: sci override: global_irq=%d trigger=%d "
-                        "polarity=%d\n", gsi, trigger, polarity);
-        /* Before we bind the GSI to a Linux IRQ, check whether
-         * we need to override it with bus_irq (IRQ) value. Usually for
-         * IRQs below IRQ_LEGACY_IRQ this holds IRQ == GSI, as so:
-         *  ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level)
-         * but there are oddballs where the IRQ != GSI:
-         *  ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 20 low level)
-         * which ends up being: gsi_to_irq[9] == 20
-         * (which is what acpi_gsi_to_irq ends up calling when starting the
-         * the ACPI interpreter and keels over since IRQ 9 has not been
-         * setup as we had setup IRQ 20 for it).
-         */
-        if (acpi_gsi_to_irq(gsi, &irq) == 0) {
-                /* Use the provided value if it's valid. */
-                if (irq >= 0)
-                        gsi_override = irq;
-        }
-        gsi = xen_register_gsi(gsi, gsi_override, trigger, polarity);
-        printk(KERN_INFO "xen: acpi sci %d\n", gsi);
-        return;
-}
 int __init pci_xen_initial_domain(void)
 {
        int irq;
@@ -527,8 +482,8 @@ int __init pci_xen_initial_domain(void)
        x86_msi.restore_msi_irqs = xen_initdom_restore_msi_irqs;
        pci_msi_ignore_mask = 1;
 #endif
-        xen_setup_acpi_sci();
        __acpi_register_gsi = acpi_register_gsi_xen;
+        __acpi_unregister_gsi = NULL;
        /* Pre-allocate legacy irqs */
        for (irq = 0; irq < nr_legacy_irqs(); irq++) {
                int trigger, polarity;
diff --git a/arch/x86/tools/calc_run_size.pl b/arch/x86/tools/calc_run_size.pl
deleted file mode 100644
index 23210baade2d..000000000000
--- a/arch/x86/tools/calc_run_size.pl
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/usr/bin/perl
-#
-# Calculate the amount of space needed to run the kernel, including room for
-# the .bss and .brk sections.
-#
-# Usage:
-# objdump -h a.out | perl calc_run_size.pl
-use strict;
-my $mem_size = 0;
-my $file_offset = 0;
-my $sections=" *[0-9]+ \.(?:bss|brk) +";
-while (<>) {
-        if (/^$sections([0-9a-f]+) +(?:[0-9a-f]+ +){2}([0-9a-f]+)/) {
-                my $size = hex($1);
-                my $offset = hex($2);
-                $mem_size += $size;
-                if ($file_offset == 0) {
-                        $file_offset = $offset;
-                } elsif ($file_offset != $offset) {
-                        # BFD linker shows the same file offset in ELF.
-                        # Gold linker shows them as consecutive.
-                        next if ($file_offset + $mem_size == $offset + $size);
-                        printf STDERR "file_offset: 0x%lx\n", $file_offset;
-                        printf STDERR "mem_size: 0x%lx\n", $mem_size;
-                        printf STDERR "offset: 0x%lx\n", $offset;
-                        printf STDERR "size: 0x%lx\n", $size;
-                        die ".bss and .brk are non-contiguous\n";
-                }
-        }
-}
-if ($file_offset == 0) {
-        die "Never found .bss or .brk file offset\n";
-}
-printf("%d\n", $mem_size + $file_offset);
diff --git a/arch/x86/tools/calc_run_size.sh b/arch/x86/tools/calc_run_size.sh
new file mode 100644
index 000000000000..1a4c17bb3910
--- /dev/null
+++ b/arch/x86/tools/calc_run_size.sh
@@ -0,0 +1,42 @@
+#!/bin/sh
+#
+# Calculate the amount of space needed to run the kernel, including room for
+# the .bss and .brk sections.
+#
+# Usage:
+# objdump -h a.out | sh calc_run_size.sh
+NUM='\([0-9a-fA-F]*[ \t]*\)'
+OUT=$(sed -n 's/^[ \t0-9]*.b[sr][sk][ \t]*'"$NUM$NUM$NUM$NUM"'.*/\1\4/p')
+if [ -z "$OUT" ] ; then
+        echo "Never found .bss or .brk file offset" >&2
+        exit 1
+fi
+OUT=$(echo ${OUT# })
+sizeA=$(printf "%d" 0x${OUT%% *})
+OUT=${OUT#* }
+offsetA=$(printf "%d" 0x${OUT%% *})
+OUT=${OUT#* }
+sizeB=$(printf "%d" 0x${OUT%% *})
+OUT=${OUT#* }
+offsetB=$(printf "%d" 0x${OUT%% *})
+run_size=$(( $offsetA + $sizeA + $sizeB ))
+# BFD linker shows the same file offset in ELF.
+if [ "$offsetA" -ne "$offsetB" ] ; then
+        # Gold linker shows them as consecutive.
+        endB=$(( $offsetB + $sizeB ))
+        if [ "$endB" != "$run_size" ] ; then
+                printf "sizeA: 0x%x\n" $sizeA >&2
+                printf "offsetA: 0x%x\n" $offsetA >&2
+                printf "sizeB: 0x%x\n" $sizeB >&2
+                printf "offsetB: 0x%x\n" $offsetB >&2
+                echo ".bss and .brk are non-contiguous" >&2
+                exit 1
+        fi
+fi
+printf "%d\n" $run_size
+exit 0
diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
index 531d4269e2e3..bd16d6c370ec 100644
--- a/arch/x86/um/sys_call_table_32.c
+++ b/arch/x86/um/sys_call_table_32.c
@@ -34,7 +34,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void);
 extern asmlinkage void sys_ni_syscall(void);
-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
+const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
        /*
         * Smells like a compiler bug -- it doesn't work
         * when the & below is removed.
diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c
index 20c3649d0691..5cdfa9db2217 100644
--- a/arch/x86/um/sys_call_table_64.c
+++ b/arch/x86/um/sys_call_table_64.c
@@ -47,7 +47,7 @@ typedef void (*sys_call_ptr_t)(void);
 extern void sys_ni_syscall(void);
-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
+const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
        /*
         * Smells like a compiler bug -- it doesn't work
         * when the & below is removed.
diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
index 5a4affe025e8..09297c8e1fcd 100644
--- a/arch/x86/vdso/Makefile
+++ b/arch/x86/vdso/Makefile
@@ -205,4 +205,4 @@ $(vdso_img_insttargets): install_%: $(obj)/%.dbg $(MODLIB)/vdso FORCE
 PHONY += vdso_install $(vdso_img_insttargets)
 vdso_install: $(vdso_img_insttargets) FORCE
-clean-files := vdso32-syscall* vdso32-sysenter* vdso32-int80*
+clean-files := vdso32-syscall* vdso32-sysenter* vdso32-int80* vdso64*
diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
index 009495b9ab4b..1c9f750c3859 100644
--- a/arch/x86/vdso/vma.c
+++ b/arch/x86/vdso/vma.c
@@ -41,12 +41,17 @@ void __init init_vdso_image(const struct vdso_image *image)
 struct linux_binprm;
-/* Put the vdso above the (randomized) stack with another randomized offset.
+/*
-   This way there is no hole in the middle of address space.
+ * Put the vdso above the (randomized) stack with another randomized
-   To save memory make sure it is still in the same PTE as the stack top.
+ * offset.  This way there is no hole in the middle of address space.
-   This doesn't give that many random bits.
+ * To save memory make sure it is still in the same PTE as the stack
+ * top.  This doesn't give that many random bits.
-   Only used for the 64-bit and x32 vdsos. */
+ *
+ * Note that this algorithm is imperfect: the distribution of the vdso
+ * start address within a PMD is biased toward the end.
+ *
+ * Only used for the 64-bit and x32 vdsos.
+ */
 static unsigned long vdso_addr(unsigned long start, unsigned len)
 {
 #ifdef CONFIG_X86_32
@@ -54,22 +59,30 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
 #else
        unsigned long addr, end;
        unsigned offset;
-        end = (start + PMD_SIZE - 1) & PMD_MASK;
+        /*
+         * Round up the start address.  It can start out unaligned as a result
+         * of stack start randomization.
+         */
+        start = PAGE_ALIGN(start);
+        /* Round the lowest possible end address up to a PMD boundary. */
+        end = (start + len + PMD_SIZE - 1) & PMD_MASK;
        if (end >= TASK_SIZE_MAX)
                end = TASK_SIZE_MAX;
        end -= len;
-        /* This loses some more bits than a modulo, but is cheaper */
-        offset = get_random_int() & (PTRS_PER_PTE - 1);
+        if (end > start) {
-        addr = start + (offset << PAGE_SHIFT);
+                offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1);
-        if (addr >= end)
+                addr = start + (offset << PAGE_SHIFT);
-                addr = end;
+        } else {
+                addr = start;
+        }
        /*
-         * page-align it here so that get_unmapped_area doesn't
+         * Forcibly align the final address in case we have a hardware
-         * align it wrongfully again to the next page. addr can come in 4K
+         * issue that requires alignment for performance reasons.
-         * unaligned here as a result of stack start randomization.
         */
-        addr = PAGE_ALIGN(addr);
        addr = align_vdso_addr(addr);
        return addr;
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 6bf3a13e3e0f..78a881b7fc41 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -40,6 +40,7 @@
 #include <xen/interface/physdev.h>
 #include <xen/interface/vcpu.h>
 #include <xen/interface/memory.h>
+#include <xen/interface/nmi.h>
 #include <xen/interface/xen-mca.h>
 #include <xen/features.h>
 #include <xen/page.h>
@@ -66,6 +67,7 @@
 #include <asm/reboot.h>
 #include <asm/stackprotector.h>
 #include <asm/hypervisor.h>
+#include <asm/mach_traps.h>
 #include <asm/mwait.h>
 #include <asm/pci_x86.h>
 #include <asm/pat.h>
@@ -1351,6 +1353,21 @@ static const struct machine_ops xen_machine_ops __initconst = {
        .emergency_restart = xen_emergency_restart,
 };
+static unsigned char xen_get_nmi_reason(void)
+{
+        unsigned char reason = 0;
+        /* Construct a value which looks like it came from port 0x61. */
+        if (test_bit(_XEN_NMIREASON_io_error,
+                     &HYPERVISOR_shared_info->arch.nmi_reason))
+                reason |= NMI_REASON_IOCHK;
+        if (test_bit(_XEN_NMIREASON_pci_serr,
+                     &HYPERVISOR_shared_info->arch.nmi_reason))
+                reason |= NMI_REASON_SERR;
+        return reason;
+}
 static void __init xen_boot_params_init_edd(void)
 {
 #if IS_ENABLED(CONFIG_EDD)
@@ -1535,9 +1552,12 @@ asmlinkage __visible void __init xen_start_kernel(void)
        pv_info = xen_info;
        pv_init_ops = xen_init_ops;
        pv_apic_ops = xen_apic_ops;
-        if (!xen_pvh_domain())
+        if (!xen_pvh_domain()) {
                pv_cpu_ops = xen_cpu_ops;
+                x86_platform.get_nmi_reason = xen_get_nmi_reason;
+        }
        if (xen_feature(XENFEAT_auto_translated_physmap))
                x86_init.resources.memory_setup = xen_auto_xlated_memory_setup;
        else
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index edbc7a63fd73..70fb5075c901 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -167,10 +167,13 @@ static void * __ref alloc_p2m_page(void)
        return (void *)__get_free_page(GFP_KERNEL | __GFP_REPEAT);
 }
-/* Only to be called in case of a race for a page just allocated! */
+static void __ref free_p2m_page(void *p)
-static void free_p2m_page(void *p)
 {
-        BUG_ON(!slab_is_available());
+        if (unlikely(!slab_is_available())) {
+                free_bootmem((unsigned long)p, PAGE_SIZE);
+                return;
+        }
        free_page((unsigned long)p);
 }
@@ -375,7 +378,7 @@ static void __init xen_rebuild_p2m_list(unsigned long *p2m)
                        p2m_missing_pte : p2m_identity_pte;
                for (i = 0; i < PMDS_PER_MID_PAGE; i++) {
                        pmdp = populate_extra_pmd(
-                                (unsigned long)(p2m + pfn + i * PTRS_PER_PTE));
+                                (unsigned long)(p2m + pfn) + i * PMD_SIZE);
                        set_pmd(pmdp, __pmd(__pa(ptep) | _KERNPG_TABLE));
                }
        }
@@ -436,10 +439,9 @@ EXPORT_SYMBOL_GPL(get_phys_to_machine);
 * a new pmd is to replace p2m_missing_pte or p2m_identity_pte by a individual
 * pmd. In case of PAE/x86-32 there are multiple pmds to allocate!
 */
-static pte_t *alloc_p2m_pmd(unsigned long addr, pte_t *ptep, pte_t *pte_pg)
+static pte_t *alloc_p2m_pmd(unsigned long addr, pte_t *pte_pg)
 {
        pte_t *ptechk;
-        pte_t *pteret = ptep;
        pte_t *pte_newpg[PMDS_PER_MID_PAGE];
        pmd_t *pmdp;
        unsigned int level;
@@ -473,8 +475,6 @@ static pte_t *alloc_p2m_pmd(unsigned long addr, pte_t *ptep, pte_t *pte_pg)
                if (ptechk == pte_pg) {
                        set_pmd(pmdp,
                                __pmd(__pa(pte_newpg[i]) | _KERNPG_TABLE));
-                        if (vaddr == (addr & ~(PMD_SIZE - 1)))
-                                pteret = pte_offset_kernel(pmdp, addr);
                        pte_newpg[i] = NULL;
                }
@@ -488,7 +488,7 @@ static pte_t *alloc_p2m_pmd(unsigned long addr, pte_t *ptep, pte_t *pte_pg)
                vaddr += PMD_SIZE;
        }
-        return pteret;
+        return lookup_address(addr, &level);
 }
 /*
@@ -517,7 +517,7 @@ static bool alloc_p2m(unsigned long pfn)
        if (pte_pg == p2m_missing_pte || pte_pg == p2m_identity_pte) {
                /* PMD level is missing, allocate a new one */
-                ptep = alloc_p2m_pmd(addr, ptep, pte_pg);
+                ptep = alloc_p2m_pmd(addr, pte_pg);
                if (!ptep)
                        return false;
        }
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index dfd77dec8e2b..865e56cea7a0 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -140,7 +140,7 @@ static void __init xen_del_extra_mem(u64 start, u64 size)
 unsigned long __ref xen_chk_extra_mem(unsigned long pfn)
 {
        int i;
-        unsigned long addr = PFN_PHYS(pfn);
+        phys_addr_t addr = PFN_PHYS(pfn);
        for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) {
                if (addr >= xen_extra_mem[i].start &&
@@ -160,6 +160,8 @@ void __init xen_inv_extra_mem(void)
        int i;
        for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) {
+                if (!xen_extra_mem[i].size)
+                        continue;
                pfn_s = PFN_DOWN(xen_extra_mem[i].start);
                pfn_e = PFN_UP(xen_extra_mem[i].start + xen_extra_mem[i].size);
                for (pfn = pfn_s; pfn < pfn_e; pfn++)
@@ -229,15 +231,14 @@ static int __init xen_free_mfn(unsigned long mfn)
 * as a fallback if the remapping fails.
 */
 static void __init xen_set_identity_and_release_chunk(unsigned long start_pfn,
-        unsigned long end_pfn, unsigned long nr_pages, unsigned long *identity,
+        unsigned long end_pfn, unsigned long nr_pages, unsigned long *released)
-        unsigned long *released)
 {
-        unsigned long len = 0;
        unsigned long pfn, end;
        int ret;
        WARN_ON(start_pfn > end_pfn);
+        /* Release pages first. */
        end = min(end_pfn, nr_pages);
        for (pfn = start_pfn; pfn < end; pfn++) {
                unsigned long mfn = pfn_to_mfn(pfn);
@@ -250,16 +251,14 @@ static void __init xen_set_identity_and_release_chunk(unsigned long start_pfn,
                WARN(ret != 1, "Failed to release pfn %lx err=%d\n", pfn, ret);
                if (ret == 1) {
+                        (*released)++;
                        if (!__set_phys_to_machine(pfn, INVALID_P2M_ENTRY))
                                break;
-                        len++;
                } else
                        break;
        }
-        /* Need to release pages first */
+        set_phys_range_identity(start_pfn, end_pfn);
-        *released += len;
-        *identity += set_phys_range_identity(start_pfn, end_pfn);
 }
 /*
@@ -287,7 +286,7 @@ static void __init xen_update_mem_tables(unsigned long pfn, unsigned long mfn)
        }
        /* Update kernel mapping, but not for highmem. */
-        if ((pfn << PAGE_SHIFT) >= __pa(high_memory))
+        if (pfn >= PFN_UP(__pa(high_memory - 1)))
                return;
        if (HYPERVISOR_update_va_mapping((unsigned long)__va(pfn << PAGE_SHIFT),
@@ -318,7 +317,6 @@ static void __init xen_do_set_identity_and_remap_chunk(
        unsigned long ident_pfn_iter, remap_pfn_iter;
        unsigned long ident_end_pfn = start_pfn + size;
        unsigned long left = size;
-        unsigned long ident_cnt = 0;
        unsigned int i, chunk;
        WARN_ON(size == 0);
@@ -347,8 +345,7 @@ static void __init xen_do_set_identity_and_remap_chunk(
                xen_remap_mfn = mfn;
                /* Set identity map */
-                ident_cnt += set_phys_range_identity(ident_pfn_iter,
+                set_phys_range_identity(ident_pfn_iter, ident_pfn_iter + chunk);
-                        ident_pfn_iter + chunk);
                left -= chunk;
        }
@@ -371,7 +368,7 @@ static void __init xen_do_set_identity_and_remap_chunk(
 static unsigned long __init xen_set_identity_and_remap_chunk(
        const struct e820entry *list, size_t map_size, unsigned long start_pfn,
        unsigned long end_pfn, unsigned long nr_pages, unsigned long remap_pfn,
-        unsigned long *identity, unsigned long *released)
+        unsigned long *released, unsigned long *remapped)
 {
        unsigned long pfn;
        unsigned long i = 0;
@@ -386,8 +383,7 @@ static unsigned long __init xen_set_identity_and_remap_chunk(
                /* Do not remap pages beyond the current allocation */
                if (cur_pfn >= nr_pages) {
                        /* Identity map remaining pages */
-                        *identity += set_phys_range_identity(cur_pfn,
+                        set_phys_range_identity(cur_pfn, cur_pfn + size);
-                                cur_pfn + size);
                        break;
                }
                if (cur_pfn + size > nr_pages)
@@ -398,7 +394,7 @@ static unsigned long __init xen_set_identity_and_remap_chunk(
                if (!remap_range_size) {
                        pr_warning("Unable to find available pfn range, not remapping identity pages\n");
                        xen_set_identity_and_release_chunk(cur_pfn,
-                                cur_pfn + left, nr_pages, identity, released);
+                                cur_pfn + left, nr_pages, released);
                        break;
                }
                /* Adjust size to fit in current e820 RAM region */
@@ -410,7 +406,7 @@ static unsigned long __init xen_set_identity_and_remap_chunk(
                /* Update variables to reflect new mappings. */
                i += size;
                remap_pfn += size;
-                *identity += size;
+                *remapped += size;
        }
        /*
@@ -427,13 +423,13 @@ static unsigned long __init xen_set_identity_and_remap_chunk(
 static void __init xen_set_identity_and_remap(
        const struct e820entry *list, size_t map_size, unsigned long nr_pages,
-        unsigned long *released)
+        unsigned long *released, unsigned long *remapped)
 {
        phys_addr_t start = 0;
-        unsigned long identity = 0;
        unsigned long last_pfn = nr_pages;
        const struct e820entry *entry;
        unsigned long num_released = 0;
+        unsigned long num_remapped = 0;
        int i;
        /*
@@ -460,14 +456,14 @@ static void __init xen_set_identity_and_remap(
                                last_pfn = xen_set_identity_and_remap_chunk(
                                                list, map_size, start_pfn,
                                                end_pfn, nr_pages, last_pfn,
-                                                &identity, &num_released);
+                                                &num_released, &num_remapped);
                        start = end;
                }
        }
        *released = num_released;
+        *remapped = num_remapped;
-        pr_info("Set %ld page(s) to 1-1 mapping\n", identity);
        pr_info("Released %ld page(s)\n", num_released);
 }
@@ -586,6 +582,7 @@ char * __init xen_memory_setup(void)
        struct xen_memory_map memmap;
        unsigned long max_pages;
        unsigned long extra_pages = 0;
+        unsigned long remapped_pages;
        int i;
        int op;
@@ -635,9 +632,10 @@ char * __init xen_memory_setup(void)
         * underlying RAM.
         */
        xen_set_identity_and_remap(map, memmap.nr_entries, max_pfn,
-                                   &xen_released_pages);
+                                   &xen_released_pages, &remapped_pages);
        extra_pages += xen_released_pages;
+        extra_pages += remapped_pages;
        /*
         * Clamp the amount of extra memory to a EXTRA_MEM_RATIO
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index f473d268d387..69087341d9ae 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -391,7 +391,7 @@ static const struct clock_event_device *xen_clockevent =
 struct xen_clock_event_device {
        struct clock_event_device evt;
-        char *name;
+        char name[16];
 };
 static DEFINE_PER_CPU(struct xen_clock_event_device, xen_clock_events) = { .evt.irq = -1 };
@@ -420,46 +420,38 @@ void xen_teardown_timer(int cpu)
        if (evt->irq >= 0) {
                unbind_from_irqhandler(evt->irq, NULL);
                evt->irq = -1;
-                kfree(per_cpu(xen_clock_events, cpu).name);
-                per_cpu(xen_clock_events, cpu).name = NULL;
        }
 }
 void xen_setup_timer(int cpu)
 {
-        char *name;
+        struct xen_clock_event_device *xevt = &per_cpu(xen_clock_events, cpu);
-        struct clock_event_device *evt;
+        struct clock_event_device *evt = &xevt->evt;
        int irq;
-        evt = &per_cpu(xen_clock_events, cpu).evt;
        WARN(evt->irq >= 0, "IRQ%d for CPU%d is already allocated\n", evt->irq, cpu);
        if (evt->irq >= 0)
                xen_teardown_timer(cpu);
        printk(KERN_INFO "installing Xen timer for CPU %d\n", cpu);
-        name = kasprintf(GFP_KERNEL, "timer%d", cpu);
+        snprintf(xevt->name, sizeof(xevt->name), "timer%d", cpu);
-        if (!name)
-                name = "<timer kasprintf failed>";
        irq = bind_virq_to_irqhandler(VIRQ_TIMER, cpu, xen_timer_interrupt,
                                      IRQF_PERCPU|IRQF_NOBALANCING|IRQF_TIMER|
                                      IRQF_FORCE_RESUME|IRQF_EARLY_RESUME,
-                                      name, NULL);
+                                      xevt->name, NULL);
        (void)xen_set_irq_priority(irq, XEN_IRQ_PRIORITY_MAX);
        memcpy(evt, xen_clockevent, sizeof(*evt));
        evt->cpumask = cpumask_of(cpu);
        evt->irq = irq;
-        per_cpu(xen_clock_events, cpu).name = name;
 }
 void xen_setup_cpu_clockevents(void)
 {
-        BUG_ON(preemptible());
        clockevents_register_device(this_cpu_ptr(&xen_clock_events.evt));
 }
diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c
index b57c4f91f487..9e3571a6535c 100644
--- a/arch/xtensa/mm/fault.c
+++ b/arch/xtensa/mm/fault.c
@@ -117,6 +117,8 @@ good_area:
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                else if (fault & VM_FAULT_SIGBUS)
                        goto do_sigbus;
                BUG();
diff --git a/block/blk-core.c b/block/blk-core.c
index 30f6153a40c2..3ad405571dcc 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -473,6 +473,25 @@ void blk_queue_bypass_end(struct request_queue *q)
 }
 EXPORT_SYMBOL_GPL(blk_queue_bypass_end);
+void blk_set_queue_dying(struct request_queue *q)
+{
+        queue_flag_set_unlocked(QUEUE_FLAG_DYING, q);
+        if (q->mq_ops)
+                blk_mq_wake_waiters(q);
+        else {
+                struct request_list *rl;
+                blk_queue_for_each_rl(rl, q) {
+                        if (rl->rq_pool) {
+                                wake_up(&rl->wait[BLK_RW_SYNC]);
+                                wake_up(&rl->wait[BLK_RW_ASYNC]);
+                        }
+                }
+        }
+}
+EXPORT_SYMBOL_GPL(blk_set_queue_dying);
 /**
 * blk_cleanup_queue - shutdown a request queue
 * @q: request queue to shutdown
@@ -486,7 +505,7 @@ void blk_cleanup_queue(struct request_queue *q)
        /* mark @q DYING, no new request or merges will be allowed afterwards */
        mutex_lock(&q->sysfs_lock);
-        queue_flag_set_unlocked(QUEUE_FLAG_DYING, q);
+        blk_set_queue_dying(q);
        spin_lock_irq(lock);
        /*
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 32e8dbb9ad1c..60c9d4a93fe4 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -68,9 +68,9 @@ bool __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx)
 }
 /*
- * Wakeup all potentially sleeping on normal (non-reserved) tags
+ * Wakeup all potentially sleeping on tags
 */
-static void blk_mq_tag_wakeup_all(struct blk_mq_tags *tags)
+void blk_mq_tag_wakeup_all(struct blk_mq_tags *tags, bool include_reserve)
 {
        struct blk_mq_bitmap_tags *bt;
        int i, wake_index;
@@ -85,6 +85,12 @@ static void blk_mq_tag_wakeup_all(struct blk_mq_tags *tags)
                wake_index = bt_index_inc(wake_index);
        }
+        if (include_reserve) {
+                bt = &tags->breserved_tags;
+                if (waitqueue_active(&bt->bs[0].wait))
+                        wake_up(&bt->bs[0].wait);
+        }
 }
 /*
@@ -100,7 +106,7 @@ void __blk_mq_tag_idle(struct blk_mq_hw_ctx *hctx)
        atomic_dec(&tags->active_queues);
-        blk_mq_tag_wakeup_all(tags);
+        blk_mq_tag_wakeup_all(tags, false);
 }
 /*
@@ -584,7 +590,7 @@ int blk_mq_tag_update_depth(struct blk_mq_tags *tags, unsigned int tdepth)
         * static and should never need resizing.
         */
        bt_update_count(&tags->bitmap_tags, tdepth);
-        blk_mq_tag_wakeup_all(tags);
+        blk_mq_tag_wakeup_all(tags, false);
        return 0;
 }
diff --git a/block/blk-mq-tag.h b/block/blk-mq-tag.h
index 6206ed17ef76..a6fa0fc9d41a 100644
--- a/block/blk-mq-tag.h
+++ b/block/blk-mq-tag.h
@@ -54,6 +54,7 @@ extern bool blk_mq_has_free_tags(struct blk_mq_tags *tags);
 extern ssize_t blk_mq_tag_sysfs_show(struct blk_mq_tags *tags, char *page);
 extern void blk_mq_tag_init_last_tag(struct blk_mq_tags *tags, unsigned int *last_tag);
 extern int blk_mq_tag_update_depth(struct blk_mq_tags *tags, unsigned int depth);
+extern void blk_mq_tag_wakeup_all(struct blk_mq_tags *tags, bool);
 enum {
        BLK_MQ_TAG_CACHE_MIN    = 1,
diff --git a/block/blk-mq.c b/block/blk-mq.c
index da1ab5641227..2390c5541e71 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -107,7 +107,7 @@ static void blk_mq_usage_counter_release(struct percpu_ref *ref)
        wake_up_all(&q->mq_freeze_wq);
 }
-static void blk_mq_freeze_queue_start(struct request_queue *q)
+void blk_mq_freeze_queue_start(struct request_queue *q)
 {
        bool freeze;
@@ -120,6 +120,7 @@ static void blk_mq_freeze_queue_start(struct request_queue *q)
                blk_mq_run_queues(q, false);
        }
 }
+EXPORT_SYMBOL_GPL(blk_mq_freeze_queue_start);
 static void blk_mq_freeze_queue_wait(struct request_queue *q)
 {
@@ -136,7 +137,7 @@ void blk_mq_freeze_queue(struct request_queue *q)
        blk_mq_freeze_queue_wait(q);
 }
-static void blk_mq_unfreeze_queue(struct request_queue *q)
+void blk_mq_unfreeze_queue(struct request_queue *q)
 {
        bool wake;
@@ -149,6 +150,24 @@ static void blk_mq_unfreeze_queue(struct request_queue *q)
                wake_up_all(&q->mq_freeze_wq);
        }
 }
+EXPORT_SYMBOL_GPL(blk_mq_unfreeze_queue);
+void blk_mq_wake_waiters(struct request_queue *q)
+{
+        struct blk_mq_hw_ctx *hctx;
+        unsigned int i;
+        queue_for_each_hw_ctx(q, hctx, i)
+                if (blk_mq_hw_queue_mapped(hctx))
+                        blk_mq_tag_wakeup_all(hctx->tags, true);
+        /*
+         * If we are called because the queue has now been marked as
+         * dying, we need to ensure that processes currently waiting on
+         * the queue are notified as well.
+         */
+        wake_up_all(&q->mq_freeze_wq);
+}
 bool blk_mq_can_queue(struct blk_mq_hw_ctx *hctx)
 {
@@ -258,8 +277,10 @@ struct request *blk_mq_alloc_request(struct request_queue *q, int rw, gfp_t gfp,
                ctx = alloc_data.ctx;
        }
        blk_mq_put_ctx(ctx);
-        if (!rq)
+        if (!rq) {
+                blk_mq_queue_exit(q);
                return ERR_PTR(-EWOULDBLOCK);
+        }
        return rq;
 }
 EXPORT_SYMBOL(blk_mq_alloc_request);
@@ -383,6 +404,12 @@ void blk_mq_complete_request(struct request *rq)
 }
 EXPORT_SYMBOL(blk_mq_complete_request);
+int blk_mq_request_started(struct request *rq)
+{
+        return test_bit(REQ_ATOM_STARTED, &rq->atomic_flags);
+}
+EXPORT_SYMBOL_GPL(blk_mq_request_started);
 void blk_mq_start_request(struct request *rq)
 {
        struct request_queue *q = rq->q;
@@ -500,12 +527,38 @@ void blk_mq_add_to_requeue_list(struct request *rq, bool at_head)
 }
 EXPORT_SYMBOL(blk_mq_add_to_requeue_list);
+void blk_mq_cancel_requeue_work(struct request_queue *q)
+{
+        cancel_work_sync(&q->requeue_work);
+}
+EXPORT_SYMBOL_GPL(blk_mq_cancel_requeue_work);
 void blk_mq_kick_requeue_list(struct request_queue *q)
 {
        kblockd_schedule_work(&q->requeue_work);
 }
 EXPORT_SYMBOL(blk_mq_kick_requeue_list);
+void blk_mq_abort_requeue_list(struct request_queue *q)
+{
+        unsigned long flags;
+        LIST_HEAD(rq_list);
+        spin_lock_irqsave(&q->requeue_lock, flags);
+        list_splice_init(&q->requeue_list, &rq_list);
+        spin_unlock_irqrestore(&q->requeue_lock, flags);
+        while (!list_empty(&rq_list)) {
+                struct request *rq;
+                rq = list_first_entry(&rq_list, struct request, queuelist);
+                list_del_init(&rq->queuelist);
+                rq->errors = -EIO;
+                blk_mq_end_request(rq, rq->errors);
+        }
+}
+EXPORT_SYMBOL(blk_mq_abort_requeue_list);
 static inline bool is_flush_request(struct request *rq,
                struct blk_flush_queue *fq, unsigned int tag)
 {
@@ -566,13 +619,24 @@ void blk_mq_rq_timed_out(struct request *req, bool reserved)
                break;
        }
 }
-                
 static void blk_mq_check_expired(struct blk_mq_hw_ctx *hctx,
                struct request *rq, void *priv, bool reserved)
 {
        struct blk_mq_timeout_data *data = priv;
-        if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags))
+        if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags)) {
+                /*
+                 * If a request wasn't started before the queue was
+                 * marked dying, kill it here or it'll go unnoticed.
+                 */
+                if (unlikely(blk_queue_dying(rq->q))) {
+                        rq->errors = -EIO;
+                        blk_mq_complete_request(rq);
+                }
+                return;
+        }
+        if (rq->cmd_flags & REQ_NO_TIMEOUT)
                return;
        if (time_after_eq(jiffies, rq->deadline)) {
@@ -1577,10 +1641,8 @@ static void blk_mq_free_hw_queues(struct request_queue *q,
        struct blk_mq_hw_ctx *hctx;
        unsigned int i;
-        queue_for_each_hw_ctx(q, hctx, i) {
+        queue_for_each_hw_ctx(q, hctx, i)
                free_cpumask_var(hctx->cpumask);
-                kfree(hctx);
-        }
 }
 static int blk_mq_init_hctx(struct request_queue *q,
@@ -1601,7 +1663,6 @@ static int blk_mq_init_hctx(struct request_queue *q,
        hctx->queue = q;
        hctx->queue_num = hctx_idx;
        hctx->flags = set->flags;
-        hctx->cmd_size = set->cmd_size;
        blk_mq_init_cpu_notifier(&hctx->cpu_notifier,
                                        blk_mq_hctx_notify, hctx);
@@ -1806,6 +1867,27 @@ static void blk_mq_add_queue_tag_set(struct blk_mq_tag_set *set,
        mutex_unlock(&set->tag_list_lock);
 }
+/*
+ * It is the actual release handler for mq, but we do it from
+ * request queue's release handler for avoiding use-after-free
+ * and headache because q->mq_kobj shouldn't have been introduced,
+ * but we can't group ctx/kctx kobj without it.
+ */
+void blk_mq_release(struct request_queue *q)
+{
+        struct blk_mq_hw_ctx *hctx;
+        unsigned int i;
+        /* hctx kobj stays in hctx */
+        queue_for_each_hw_ctx(q, hctx, i)
+                kfree(hctx);
+        kfree(q->queue_hw_ctx);
+        /* ctx kobj stays in queue_ctx */
+        free_percpu(q->queue_ctx);
+}
 struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *set)
 {
        struct blk_mq_hw_ctx **hctxs;
@@ -1939,12 +2021,8 @@ void blk_mq_free_queue(struct request_queue *q)
        percpu_ref_exit(&q->mq_usage_counter);
-        free_percpu(q->queue_ctx);
-        kfree(q->queue_hw_ctx);
        kfree(q->mq_map);
-        q->queue_ctx = NULL;
-        q->queue_hw_ctx = NULL;
        q->mq_map = NULL;
        mutex_lock(&all_q_mutex);
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 206230e64f79..6a48c4c0d8a2 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -32,6 +32,7 @@ void blk_mq_free_queue(struct request_queue *q);
 void blk_mq_clone_flush_request(struct request *flush_rq,
                struct request *orig_rq);
 int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
+void blk_mq_wake_waiters(struct request_queue *q);
 /*
 * CPU hotplug helpers
@@ -61,6 +62,8 @@ extern void blk_mq_sysfs_unregister(struct request_queue *q);
 extern void blk_mq_rq_timed_out(struct request *req, bool reserved);
+void blk_mq_release(struct request_queue *q);
 /*
 * Basic implementation of sparser bitmap, allowing the user to spread
 * the bits over more cachelines.
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 935ea2aa0730..faaf36ade7eb 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -517,6 +517,8 @@ static void blk_release_queue(struct kobject *kobj)
        if (!q->mq_ops)
                blk_free_flush_queue(q->fq);
+        else
+                blk_mq_release(q);
        blk_trace_shutdown(q);
diff --git a/block/blk-timeout.c b/block/blk-timeout.c
index 56c025894cdf..246dfb16c3d9 100644
--- a/block/blk-timeout.c
+++ b/block/blk-timeout.c
@@ -190,6 +190,9 @@ void blk_add_timer(struct request *req)
        struct request_queue *q = req->q;
        unsigned long expiry;
+        if (req->cmd_flags & REQ_NO_TIMEOUT)
+                return;
        /* blk-mq has its own handler, so we don't need ->rq_timed_out_fn */
        if (!q->mq_ops && !q->rq_timed_out_fn)
                return;
diff --git a/block/partitions/efi.c b/block/partitions/efi.c
index 56d08fd75b1a..26cb624ace05 100644
--- a/block/partitions/efi.c
+++ b/block/partitions/efi.c
@@ -715,7 +715,7 @@ int efi_partition(struct parsed_partitions *state)
                        state->parts[i + 1].flags = ADDPART_FLAG_RAID;
                info = &state->parts[i + 1].info;
-                efi_guid_unparse(&ptes[i].unique_partition_guid, info->uuid);
+                efi_guid_to_str(&ptes[i].unique_partition_guid, info->uuid);
                /* Naively convert UTF16-LE to 7 bits. */
                label_max = min(ARRAY_SIZE(info->volname) - 1,
diff --git a/crypto/aes_generic.c b/crypto/aes_generic.c
index 9b3c54c1cbe8..3dd101144a58 100644
--- a/crypto/aes_generic.c
+++ b/crypto/aes_generic.c
@@ -1475,3 +1475,4 @@ module_exit(aes_fini);
 MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_ALIAS_CRYPTO("aes");
+MODULE_ALIAS_CRYPTO("aes-generic");
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 1fa7bc31be63..4665b79c729a 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -455,6 +455,9 @@ void af_alg_complete(struct crypto_async_request *req, int err)
 {
        struct af_alg_completion *completion = req->data;
+        if (err == -EINPROGRESS)
+                return;
        completion->err = err;
        complete(&completion->completion);
 }
diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
index b4485a108389..6f5bebc9bf01 100644
--- a/crypto/ansi_cprng.c
+++ b/crypto/ansi_cprng.c
@@ -477,3 +477,4 @@ MODULE_PARM_DESC(dbg, "Boolean to enable debugging (0/1 == off/on)");
 module_init(prng_mod_init);
 module_exit(prng_mod_fini);
 MODULE_ALIAS_CRYPTO("stdrng");
+MODULE_ALIAS_CRYPTO("ansi_cprng");
diff --git a/crypto/blowfish_generic.c b/crypto/blowfish_generic.c
index 7bd71f02d0dd..87b392a77a93 100644
--- a/crypto/blowfish_generic.c
+++ b/crypto/blowfish_generic.c
@@ -139,3 +139,4 @@ module_exit(blowfish_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Blowfish Cipher Algorithm");
 MODULE_ALIAS_CRYPTO("blowfish");
+MODULE_ALIAS_CRYPTO("blowfish-generic");
diff --git a/crypto/camellia_generic.c b/crypto/camellia_generic.c
index 1b74c5a3e891..a02286bf319e 100644
--- a/crypto/camellia_generic.c
+++ b/crypto/camellia_generic.c
@@ -1099,3 +1099,4 @@ module_exit(camellia_fini);
 MODULE_DESCRIPTION("Camellia Cipher Algorithm");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_CRYPTO("camellia");
+MODULE_ALIAS_CRYPTO("camellia-generic");
diff --git a/crypto/cast5_generic.c b/crypto/cast5_generic.c
index 84c86db67ec7..df5c72629383 100644
--- a/crypto/cast5_generic.c
+++ b/crypto/cast5_generic.c
@@ -550,3 +550,4 @@ module_exit(cast5_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Cast5 Cipher Algorithm");
 MODULE_ALIAS_CRYPTO("cast5");
+MODULE_ALIAS_CRYPTO("cast5-generic");
diff --git a/crypto/cast6_generic.c b/crypto/cast6_generic.c
index f408f0bd8de2..058c8d755d03 100644
--- a/crypto/cast6_generic.c
+++ b/crypto/cast6_generic.c
@@ -292,3 +292,4 @@ module_exit(cast6_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Cast6 Cipher Algorithm");
 MODULE_ALIAS_CRYPTO("cast6");
+MODULE_ALIAS_CRYPTO("cast6-generic");
diff --git a/crypto/crc32c_generic.c b/crypto/crc32c_generic.c
index 2a062025749d..06f1b60f02b2 100644
--- a/crypto/crc32c_generic.c
+++ b/crypto/crc32c_generic.c
@@ -171,4 +171,5 @@ MODULE_AUTHOR("Clay Haapala <chaapala@cisco.com>");
 MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations wrapper for lib/crc32c");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_CRYPTO("crc32c");
+MODULE_ALIAS_CRYPTO("crc32c-generic");
 MODULE_SOFTDEP("pre: crc32c");
diff --git a/crypto/crct10dif_generic.c b/crypto/crct10dif_generic.c
index 08bb4f504520..c1229614c7e3 100644
--- a/crypto/crct10dif_generic.c
+++ b/crypto/crct10dif_generic.c
@@ -125,3 +125,4 @@ MODULE_AUTHOR("Tim Chen <tim.c.chen@linux.intel.com>");
 MODULE_DESCRIPTION("T10 DIF CRC calculation.");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_CRYPTO("crct10dif");
+MODULE_ALIAS_CRYPTO("crct10dif-generic");
diff --git a/crypto/des_generic.c b/crypto/des_generic.c
index 42912948776b..a71720544d11 100644
--- a/crypto/des_generic.c
+++ b/crypto/des_generic.c
@@ -983,8 +983,6 @@ static struct crypto_alg des_algs[2] = { {
        .cia_decrypt            =       des3_ede_decrypt } }
 } };
-MODULE_ALIAS_CRYPTO("des3_ede");
 static int __init des_generic_mod_init(void)
 {
        return crypto_register_algs(des_algs, ARRAY_SIZE(des_algs));
@@ -1001,4 +999,7 @@ module_exit(des_generic_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms");
 MODULE_AUTHOR("Dag Arne Osvik <da@osvik.no>");
-MODULE_ALIAS("des");
+MODULE_ALIAS_CRYPTO("des");
+MODULE_ALIAS_CRYPTO("des-generic");
+MODULE_ALIAS_CRYPTO("des3_ede");
+MODULE_ALIAS_CRYPTO("des3_ede-generic");
diff --git a/crypto/ghash-generic.c b/crypto/ghash-generic.c
index 4e97fae9666f..bac70995e064 100644
--- a/crypto/ghash-generic.c
+++ b/crypto/ghash-generic.c
@@ -173,3 +173,4 @@ module_exit(ghash_mod_exit);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("GHASH Message Digest Algorithm");
 MODULE_ALIAS_CRYPTO("ghash");
+MODULE_ALIAS_CRYPTO("ghash-generic");
diff --git a/crypto/krng.c b/crypto/krng.c
index 67c88b331210..0224841b6579 100644
--- a/crypto/krng.c
+++ b/crypto/krng.c
@@ -63,3 +63,4 @@ module_exit(krng_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Kernel Random Number Generator");
 MODULE_ALIAS_CRYPTO("stdrng");
+MODULE_ALIAS_CRYPTO("krng");
diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c
index 3d0f9df30ac9..f550b5d94630 100644
--- a/crypto/salsa20_generic.c
+++ b/crypto/salsa20_generic.c
@@ -249,3 +249,4 @@ module_exit(salsa20_generic_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION ("Salsa20 stream cipher algorithm");
 MODULE_ALIAS_CRYPTO("salsa20");
+MODULE_ALIAS_CRYPTO("salsa20-generic");
diff --git a/crypto/serpent_generic.c b/crypto/serpent_generic.c
index a53b5e2af335..94970a794975 100644
--- a/crypto/serpent_generic.c
+++ b/crypto/serpent_generic.c
@@ -667,3 +667,4 @@ MODULE_DESCRIPTION("Serpent and tnepres (kerneli compatible serpent reversed) Ci
 MODULE_AUTHOR("Dag Arne Osvik <osvik@ii.uib.no>");
 MODULE_ALIAS_CRYPTO("tnepres");
 MODULE_ALIAS_CRYPTO("serpent");
+MODULE_ALIAS_CRYPTO("serpent-generic");
diff --git a/crypto/sha1_generic.c b/crypto/sha1_generic.c
index 039e58cfa155..a3e50c37eb6f 100644
--- a/crypto/sha1_generic.c
+++ b/crypto/sha1_generic.c
@@ -154,3 +154,4 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm");
 MODULE_ALIAS_CRYPTO("sha1");
+MODULE_ALIAS_CRYPTO("sha1-generic");
diff --git a/crypto/sha256_generic.c b/crypto/sha256_generic.c
index 5eb21b120033..b001ff5c2efc 100644
--- a/crypto/sha256_generic.c
+++ b/crypto/sha256_generic.c
@@ -385,4 +385,6 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA-224 and SHA-256 Secure Hash Algorithm");
 MODULE_ALIAS_CRYPTO("sha224");
+MODULE_ALIAS_CRYPTO("sha224-generic");
 MODULE_ALIAS_CRYPTO("sha256");
+MODULE_ALIAS_CRYPTO("sha256-generic");
diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
index 8d0b19ed4f4b..1c3c3767e079 100644
--- a/crypto/sha512_generic.c
+++ b/crypto/sha512_generic.c
@@ -289,4 +289,6 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA-512 and SHA-384 Secure Hash Algorithms");
 MODULE_ALIAS_CRYPTO("sha384");
+MODULE_ALIAS_CRYPTO("sha384-generic");
 MODULE_ALIAS_CRYPTO("sha512");
+MODULE_ALIAS_CRYPTO("sha512-generic");
diff --git a/crypto/tea.c b/crypto/tea.c
index 495be2d0077d..b70b441c7d1e 100644
--- a/crypto/tea.c
+++ b/crypto/tea.c
@@ -270,6 +270,7 @@ static void __exit tea_mod_fini(void)
        crypto_unregister_algs(tea_algs, ARRAY_SIZE(tea_algs));
 }
+MODULE_ALIAS_CRYPTO("tea");
 MODULE_ALIAS_CRYPTO("xtea");
 MODULE_ALIAS_CRYPTO("xeta");
diff --git a/crypto/tgr192.c b/crypto/tgr192.c
index 6e5651c66cf8..321bc6ff2a9d 100644
--- a/crypto/tgr192.c
+++ b/crypto/tgr192.c
@@ -676,6 +676,7 @@ static void __exit tgr192_mod_fini(void)
        crypto_unregister_shashes(tgr_algs, ARRAY_SIZE(tgr_algs));
 }
+MODULE_ALIAS_CRYPTO("tgr192");
 MODULE_ALIAS_CRYPTO("tgr160");
 MODULE_ALIAS_CRYPTO("tgr128");
diff --git a/crypto/twofish_generic.c b/crypto/twofish_generic.c
index 523ad8c4e359..ebf7a3efb572 100644
--- a/crypto/twofish_generic.c
+++ b/crypto/twofish_generic.c
@@ -212,3 +212,4 @@ module_exit(twofish_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION ("Twofish Cipher Algorithm");
 MODULE_ALIAS_CRYPTO("twofish");
+MODULE_ALIAS_CRYPTO("twofish-generic");
diff --git a/crypto/wp512.c b/crypto/wp512.c
index 0de42eb3d040..7ee5a043a988 100644
--- a/crypto/wp512.c
+++ b/crypto/wp512.c
@@ -1167,6 +1167,7 @@ static void __exit wp512_mod_fini(void)
        crypto_unregister_shashes(wp_algs, ARRAY_SIZE(wp_algs));
 }
+MODULE_ALIAS_CRYPTO("wp512");
 MODULE_ALIAS_CRYPTO("wp384");
 MODULE_ALIAS_CRYPTO("wp256");
diff --git a/drivers/Kconfig b/drivers/Kconfig
index 694d5a70d6ce..c70d6e45dc10 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -134,8 +134,6 @@ source "drivers/staging/Kconfig"
 source "drivers/platform/Kconfig"
-source "drivers/soc/Kconfig"
 source "drivers/clk/Kconfig"
 source "drivers/hwspinlock/Kconfig"
diff --git a/drivers/Makefile b/drivers/Makefile
index 67d2334dc41e..527a6da8d539 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -50,7 +50,10 @@ obj-$(CONFIG_RESET_CONTROLLER)	+= reset/
 obj-y                           += tty/
 obj-y                           += char/
-# gpu/ comes after char for AGP vs DRM startup
+# iommu/ comes before gpu as gpu are using iommu controllers
+obj-$(CONFIG_IOMMU_SUPPORT)     += iommu/
+# gpu/ comes after char for AGP vs DRM startup and after iommu
 obj-y                           += gpu/
 obj-$(CONFIG_CONNECTOR)         += connector/
@@ -141,7 +144,6 @@ obj-y				+= clk/
 obj-$(CONFIG_MAILBOX)           += mailbox/
 obj-$(CONFIG_HWSPINLOCK)        += hwspinlock/
-obj-$(CONFIG_IOMMU_SUPPORT)     += iommu/
 obj-$(CONFIG_REMOTEPROC)        += remoteproc/
 obj-$(CONFIG_RPMSG)             += rpmsg/
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 4f3febf8a589..e75737fd7eef 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -1,7 +1,7 @@
 /*
 * ACPI support for Intel Lynxpoint LPSS.
 *
- * Copyright (C) 2013, 2014, Intel Corporation
+ * Copyright (C) 2013, Intel Corporation
 * Authors: Mika Westerberg <mika.westerberg@linux.intel.com>
 *          Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 *
@@ -60,8 +60,6 @@ ACPI_MODULE_NAME("acpi_lpss");
 #define LPSS_CLK_DIVIDER                BIT(2)
 #define LPSS_LTR                        BIT(3)
 #define LPSS_SAVE_CTX                   BIT(4)
-#define LPSS_DEV_PROXY                  BIT(5)
-#define LPSS_PROXY_REQ                  BIT(6)
 struct lpss_private_data;
@@ -72,10 +70,8 @@ struct lpss_device_desc {
        void (*setup)(struct lpss_private_data *pdata);
 };
-static struct device *proxy_device;
 static struct lpss_device_desc lpss_dma_desc = {
-        .flags = LPSS_CLK | LPSS_PROXY_REQ,
+        .flags = LPSS_CLK,
 };
 struct lpss_private_data {
@@ -150,24 +146,22 @@ static struct lpss_device_desc byt_pwm_dev_desc = {
 };
 static struct lpss_device_desc byt_uart_dev_desc = {
-        .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX |
+        .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
-                 LPSS_DEV_PROXY,
        .prv_offset = 0x800,
        .setup = lpss_uart_setup,
 };
 static struct lpss_device_desc byt_spi_dev_desc = {
-        .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX |
+        .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
-                 LPSS_DEV_PROXY,
        .prv_offset = 0x400,
 };
 static struct lpss_device_desc byt_sdio_dev_desc = {
-        .flags = LPSS_CLK | LPSS_DEV_PROXY,
+        .flags = LPSS_CLK,
 };
 static struct lpss_device_desc byt_i2c_dev_desc = {
-        .flags = LPSS_CLK | LPSS_SAVE_CTX | LPSS_DEV_PROXY,
+        .flags = LPSS_CLK | LPSS_SAVE_CTX,
        .prv_offset = 0x800,
        .setup = byt_i2c_setup,
 };
@@ -374,8 +368,6 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
        adev->driver_data = pdata;
        pdev = acpi_create_platform_device(adev);
        if (!IS_ERR_OR_NULL(pdev)) {
-                if (!proxy_device && dev_desc->flags & LPSS_DEV_PROXY)
-                        proxy_device = &pdev->dev;
                return 1;
        }
@@ -600,14 +592,7 @@ static int acpi_lpss_runtime_suspend(struct device *dev)
        if (pdata->dev_desc->flags & LPSS_SAVE_CTX)
                acpi_lpss_save_ctx(dev, pdata);
-        ret = acpi_dev_runtime_suspend(dev);
+        return acpi_dev_runtime_suspend(dev);
-        if (ret)
-                return ret;
-        if (pdata->dev_desc->flags & LPSS_PROXY_REQ && proxy_device)
-                return pm_runtime_put_sync_suspend(proxy_device);
-        return 0;
 }
 static int acpi_lpss_runtime_resume(struct device *dev)
@@ -615,12 +600,6 @@ static int acpi_lpss_runtime_resume(struct device *dev)
        struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
        int ret;
-        if (pdata->dev_desc->flags & LPSS_PROXY_REQ && proxy_device) {
-                ret = pm_runtime_get_sync(proxy_device);
-                if (ret)
-                        return ret;
-        }
        ret = acpi_dev_runtime_resume(dev);
        if (ret)
                return ret;
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index 1fdf5e07a1c7..1020b1b53a17 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -170,7 +170,7 @@ static int acpi_processor_hotadd_init(struct acpi_processor *pr)
        acpi_status status;
        int ret;
-        if (pr->apic_id == -1)
+        if (pr->phys_id == -1)
                return -ENODEV;
        status = acpi_evaluate_integer(pr->handle, "_STA", NULL, &sta);
@@ -180,13 +180,13 @@ static int acpi_processor_hotadd_init(struct acpi_processor *pr)
        cpu_maps_update_begin();
        cpu_hotplug_begin();
-        ret = acpi_map_lsapic(pr->handle, pr->apic_id, &pr->id);
+        ret = acpi_map_cpu(pr->handle, pr->phys_id, &pr->id);
        if (ret)
                goto out;
        ret = arch_register_cpu(pr->id);
        if (ret) {
-                acpi_unmap_lsapic(pr->id);
+                acpi_unmap_cpu(pr->id);
                goto out;
        }
@@ -215,7 +215,7 @@ static int acpi_processor_get_info(struct acpi_device *device)
        union acpi_object object = { 0 };
        struct acpi_buffer buffer = { sizeof(union acpi_object), &object };
        struct acpi_processor *pr = acpi_driver_data(device);
-        int apic_id, cpu_index, device_declaration = 0;
+        int phys_id, cpu_index, device_declaration = 0;
        acpi_status status = AE_OK;
        static int cpu0_initialized;
        unsigned long long value;
@@ -262,15 +262,18 @@ static int acpi_processor_get_info(struct acpi_device *device)
                pr->acpi_id = value;
        }
-        apic_id = acpi_get_apicid(pr->handle, device_declaration, pr->acpi_id);
+        phys_id = acpi_get_phys_id(pr->handle, device_declaration, pr->acpi_id);
-        if (apic_id < 0)
+        if (phys_id < 0)
-                acpi_handle_debug(pr->handle, "failed to get CPU APIC ID.\n");
+                acpi_handle_debug(pr->handle, "failed to get CPU physical ID.\n");
-        pr->apic_id = apic_id;
+        pr->phys_id = phys_id;
-        cpu_index = acpi_map_cpuid(pr->apic_id, pr->acpi_id);
+        cpu_index = acpi_map_cpuid(pr->phys_id, pr->acpi_id);
        if (!cpu0_initialized && !acpi_has_cpu_in_madt()) {
                cpu0_initialized = 1;
-                /* Handle UP system running SMP kernel, with no LAPIC in MADT */
+                /*
+                 * Handle UP system running SMP kernel, with no CPU
+                 * entry in MADT
+                 */
                if ((cpu_index == -1) && (num_online_cpus() == 1))
                        cpu_index = 0;
        }
@@ -458,7 +461,7 @@ static void acpi_processor_remove(struct acpi_device *device)
        /* Remove the CPU. */
        arch_unregister_cpu(pr->id);
-        acpi_unmap_lsapic(pr->id);
+        acpi_unmap_cpu(pr->id);
        cpu_hotplug_done();
        cpu_maps_update_done();
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index c2daa85fc9f7..c0d44d394ca3 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -257,7 +257,7 @@ int acpi_bus_init_power(struct acpi_device *device)
        device->power.state = ACPI_STATE_UNKNOWN;
        if (!acpi_device_is_present(device))
-                return 0;
+                return -ENXIO;
        result = acpi_device_get_power(device, &state);
        if (result)
diff --git a/drivers/acpi/int340x_thermal.c b/drivers/acpi/int340x_thermal.c
index a27d31d1ba24..9dcf83682e36 100644
--- a/drivers/acpi/int340x_thermal.c
+++ b/drivers/acpi/int340x_thermal.c
@@ -14,10 +14,10 @@
 #include "internal.h"
-#define DO_ENUMERATION 0x01
+#define INT3401_DEVICE 0X01
 static const struct acpi_device_id int340x_thermal_device_ids[] = {
-        {"INT3400", DO_ENUMERATION },
+        {"INT3400"},
-        {"INT3401"},
+        {"INT3401", INT3401_DEVICE},
        {"INT3402"},
        {"INT3403"},
        {"INT3404"},
@@ -34,7 +34,10 @@ static int int340x_thermal_handler_attach(struct acpi_device *adev,
                                        const struct acpi_device_id *id)
 {
 #if defined(CONFIG_INT340X_THERMAL) || defined(CONFIG_INT340X_THERMAL_MODULE)
-        if (id->driver_data == DO_ENUMERATION)
+        acpi_create_platform_device(adev);
+#elif defined(INTEL_SOC_DTS_THERMAL) || defined(INTEL_SOC_DTS_THERMAL_MODULE)
+        /* Intel SoC DTS thermal driver needs INT3401 to set IRQ descriptor */
+        if (id->driver_data == INT3401_DEVICE)
                acpi_create_platform_device(adev);
 #endif
        return 1;
diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
index 5277a0ee5704..b1def411c0b8 100644
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -512,7 +512,6 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
        dev_dbg(&dev->dev, "PCI INT %c disabled\n", pin_name(pin));
        if (gsi >= 0) {
                acpi_unregister_gsi(gsi);
-                dev->irq = 0;
                dev->irq_managed = 0;
        }
 }
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 342942f90a10..02e48394276c 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -69,7 +69,7 @@ static int map_madt_entry(int type, u32 acpi_id)
        unsigned long madt_end, entry;
        static struct acpi_table_madt *madt;
        static int read_madt;
-        int apic_id = -1;
+        int phys_id = -1;       /* CPU hardware ID */
        if (!read_madt) {
                if (ACPI_FAILURE(acpi_get_table(ACPI_SIG_MADT, 0,
@@ -79,7 +79,7 @@ static int map_madt_entry(int type, u32 acpi_id)
        }
        if (!madt)
-                return apic_id;
+                return phys_id;
        entry = (unsigned long)madt;
        madt_end = entry + madt->header.length;
@@ -91,18 +91,18 @@ static int map_madt_entry(int type, u32 acpi_id)
                struct acpi_subtable_header *header =
                        (struct acpi_subtable_header *)entry;
                if (header->type == ACPI_MADT_TYPE_LOCAL_APIC) {
-                        if (!map_lapic_id(header, acpi_id, &apic_id))
+                        if (!map_lapic_id(header, acpi_id, &phys_id))
                                break;
                } else if (header->type == ACPI_MADT_TYPE_LOCAL_X2APIC) {
-                        if (!map_x2apic_id(header, type, acpi_id, &apic_id))
+                        if (!map_x2apic_id(header, type, acpi_id, &phys_id))
                                break;
                } else if (header->type == ACPI_MADT_TYPE_LOCAL_SAPIC) {
-                        if (!map_lsapic_id(header, type, acpi_id, &apic_id))
+                        if (!map_lsapic_id(header, type, acpi_id, &phys_id))
                                break;
                }
                entry += header->length;
        }
-        return apic_id;
+        return phys_id;
 }
 static int map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
@@ -110,7 +110,7 @@ static int map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
        union acpi_object *obj;
        struct acpi_subtable_header *header;
-        int apic_id = -1;
+        int phys_id = -1;
        if (ACPI_FAILURE(acpi_evaluate_object(handle, "_MAT", NULL, &buffer)))
                goto exit;
@@ -126,38 +126,38 @@ static int map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
        header = (struct acpi_subtable_header *)obj->buffer.pointer;
        if (header->type == ACPI_MADT_TYPE_LOCAL_APIC)
-                map_lapic_id(header, acpi_id, &apic_id);
+                map_lapic_id(header, acpi_id, &phys_id);
        else if (header->type == ACPI_MADT_TYPE_LOCAL_SAPIC)
-                map_lsapic_id(header, type, acpi_id, &apic_id);
+                map_lsapic_id(header, type, acpi_id, &phys_id);
        else if (header->type == ACPI_MADT_TYPE_LOCAL_X2APIC)
-                map_x2apic_id(header, type, acpi_id, &apic_id);
+                map_x2apic_id(header, type, acpi_id, &phys_id);
 exit:
        kfree(buffer.pointer);
-        return apic_id;
+        return phys_id;
 }
-int acpi_get_apicid(acpi_handle handle, int type, u32 acpi_id)
+int acpi_get_phys_id(acpi_handle handle, int type, u32 acpi_id)
 {
-        int apic_id;
+        int phys_id;
-        apic_id = map_mat_entry(handle, type, acpi_id);
+        phys_id = map_mat_entry(handle, type, acpi_id);
-        if (apic_id == -1)
+        if (phys_id == -1)
-                apic_id = map_madt_entry(type, acpi_id);
+                phys_id = map_madt_entry(type, acpi_id);
-        return apic_id;
+        return phys_id;
 }
-int acpi_map_cpuid(int apic_id, u32 acpi_id)
+int acpi_map_cpuid(int phys_id, u32 acpi_id)
 {
 #ifdef CONFIG_SMP
        int i;
 #endif
-        if (apic_id == -1) {
+        if (phys_id == -1) {
                /*
                 * On UP processor, there is no _MAT or MADT table.
-                 * So above apic_id is always set to -1.
+                 * So above phys_id is always set to -1.
                 *
                 * BIOS may define multiple CPU handles even for UP processor.
                 * For example,
@@ -170,7 +170,7 @@ int acpi_map_cpuid(int apic_id, u32 acpi_id)
                 *     Processor (CPU3, 0x03, 0x00000410, 0x06) {}
                 * }
                 *
-                 * Ignores apic_id and always returns 0 for the processor
+                 * Ignores phys_id and always returns 0 for the processor
                 * handle with acpi id 0 if nr_cpu_ids is 1.
                 * This should be the case if SMP tables are not found.
                 * Return -1 for other CPU's handle.
@@ -178,28 +178,28 @@ int acpi_map_cpuid(int apic_id, u32 acpi_id)
                if (nr_cpu_ids <= 1 && acpi_id == 0)
                        return acpi_id;
                else
-                        return apic_id;
+                        return phys_id;
        }
 #ifdef CONFIG_SMP
        for_each_possible_cpu(i) {
-                if (cpu_physical_id(i) == apic_id)
+                if (cpu_physical_id(i) == phys_id)
                        return i;
        }
 #else
        /* In UP kernel, only processor 0 is valid */
-        if (apic_id == 0)
+        if (phys_id == 0)
-                return apic_id;
+                return phys_id;
 #endif
        return -1;
 }
 int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
 {
-        int apic_id;
+        int phys_id;
-        apic_id = acpi_get_apicid(handle, type, acpi_id);
+        phys_id = acpi_get_phys_id(handle, type, acpi_id);
-        return acpi_map_cpuid(apic_id, acpi_id);
+        return acpi_map_cpuid(phys_id, acpi_id);
 }
 EXPORT_SYMBOL_GPL(acpi_get_cpuid);
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 499536504698..87b704e41877 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -985,8 +985,6 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr)
                state->flags = 0;
                switch (cx->type) {
                        case ACPI_STATE_C1:
-                        if (cx->entry_method != ACPI_CSTATE_FFH)
-                                state->flags |= CPUIDLE_FLAG_TIME_INVALID;
                        state->enter = acpi_idle_enter_c1;
                        state->enter_dead = acpi_idle_play_dead;
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 16914cc30882..dc4d8960684a 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1001,7 +1001,7 @@ static void acpi_free_power_resources_lists(struct acpi_device *device)
        if (device->wakeup.flags.valid)
                acpi_power_resources_list_free(&device->wakeup.resources);
-        if (!device->flags.power_manageable)
+        if (!device->power.flags.power_resources)
                return;
        for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3_HOT; i++) {
@@ -1744,10 +1744,8 @@ static void acpi_bus_get_power_flags(struct acpi_device *device)
                        device->power.flags.power_resources)
                device->power.states[ACPI_STATE_D3_COLD].flags.os_accessible = 1;
-        if (acpi_bus_init_power(device)) {
+        if (acpi_bus_init_power(device))
-                acpi_free_power_resources_lists(device);
                device->flags.power_manageable = 0;
-        }
 }
 static void acpi_bus_get_flags(struct acpi_device *device)
@@ -2371,13 +2369,18 @@ static void acpi_bus_attach(struct acpi_device *device)
        /* Skip devices that are not present. */
        if (!acpi_device_is_present(device)) {
                device->flags.visited = false;
+                device->flags.power_manageable = 0;
                return;
        }
        if (device->handler)
                goto ok;
        if (!device->flags.initialized) {
-                acpi_bus_update_power(device, NULL);
+                device->flags.power_manageable =
+                        device->power.states[ACPI_STATE_D0].flags.valid;
+                if (acpi_bus_init_power(device))
+                        device->flags.power_manageable = 0;
                device->flags.initialized = true;
        }
        device->flags.visited = false;
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 1eaadff2e198..032db459370f 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -505,6 +505,33 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                DMI_MATCH(DMI_PRODUCT_NAME, "HP ENVY 15 Notebook PC"),
                },
        },
+        {
+         .callback = video_disable_native_backlight,
+         .ident = "SAMSUNG 870Z5E/880Z5E/680Z5E",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "870Z5E/880Z5E/680Z5E"),
+                },
+        },
+        {
+         .callback = video_disable_native_backlight,
+         .ident = "SAMSUNG 370R4E/370R4V/370R5E/3570RE/370R5V",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "370R4E/370R4V/370R5E/3570RE/370R5V"),
+                },
+        },
+        {
+         /* https://bugzilla.redhat.com/show_bug.cgi?id=1163574 */
+         .callback = video_disable_native_backlight,
+         .ident = "Dell XPS15 L521X",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "XPS L521X"),
+                },
+        },
        {}
 };
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index a3a13605a9c4..5f601553b9b0 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -835,6 +835,7 @@ config PATA_AT32
 config PATA_AT91
        tristate "PATA support for AT91SAM9260"
        depends on ARM && SOC_AT91SAM9
+        depends on !ARCH_MULTIPLATFORM
        help
          This option enables support for IDE devices on the Atmel AT91SAM9260 SoC.
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 49f1e6890587..33bb06e006c9 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -325,7 +325,6 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */
        { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */
        { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
-        { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */
        { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
        { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */
        { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */
diff --git a/drivers/ata/ahci_xgene.c b/drivers/ata/ahci_xgene.c
index feeb8f1e2fe8..cbcd20810355 100644
--- a/drivers/ata/ahci_xgene.c
+++ b/drivers/ata/ahci_xgene.c
@@ -125,10 +125,11 @@ static int xgene_ahci_restart_engine(struct ata_port *ap)
 * xgene_ahci_qc_issue - Issue commands to the device
 * @qc: Command to issue
 *
- * Due to Hardware errata for IDENTIFY DEVICE command, the controller cannot
+ * Due to Hardware errata for IDENTIFY DEVICE command and PACKET
- * clear the BSY bit after receiving the PIO setup FIS. This results in the dma
+ * command of ATAPI protocol set, the controller cannot clear the BSY bit
- * state machine goes into the CMFatalErrorUpdate state and locks up. By
+ * after receiving the PIO setup FIS. This results in the DMA state machine
- * restarting the dma engine, it removes the controller out of lock up state.
+ * going into the CMFatalErrorUpdate state and locks up. By restarting the
+ * DMA engine, it removes the controller out of lock up state.
 */
 static unsigned int xgene_ahci_qc_issue(struct ata_queued_cmd *qc)
 {
@@ -137,7 +138,8 @@ static unsigned int xgene_ahci_qc_issue(struct ata_queued_cmd *qc)
        struct xgene_ahci_context *ctx = hpriv->plat_data;
        int rc = 0;
-        if (unlikely(ctx->last_cmd[ap->port_no] == ATA_CMD_ID_ATA))
+        if (unlikely((ctx->last_cmd[ap->port_no] == ATA_CMD_ID_ATA) ||
+            (ctx->last_cmd[ap->port_no] == ATA_CMD_PACKET)))
                xgene_ahci_restart_engine(ap);
        rc = ahci_qc_issue(qc);
@@ -188,7 +190,7 @@ static unsigned int xgene_ahci_read_id(struct ata_device *dev,
         *
         * Clear reserved bit 8 (DEVSLP bit) as we don't support DEVSLP
         */
-        id[ATA_ID_FEATURE_SUPP] &= ~(1 << 8);
+        id[ATA_ID_FEATURE_SUPP] &= cpu_to_le16(~(1 << 8));
        return 0;
 }
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 97683e45ab04..61a9c07e0dff 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2003,7 +2003,7 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep)
        devslp = readl(port_mmio + PORT_DEVSLP);
        if (!(devslp & PORT_DEVSLP_DSP)) {
-                dev_err(ap->host->dev, "port does not support device sleep\n");
+                dev_info(ap->host->dev, "port does not support device sleep\n");
                return;
        }
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 5c84fb5c3372..d1a05f9bb91f 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4233,10 +4233,33 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
        /* devices that don't properly handle queued TRIM commands */
-        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Micron_M[56]*",              NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
-        { "Crucial_CT???M500SSD*",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
-        { "Micron_M550*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT*SSD*",            NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT*M550SSD*",        NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        /*
+         * As defined, the DRAT (Deterministic Read After Trim) and RZAT
+         * (Return Zero After Trim) flags in the ATA Command Set are
+         * unreliable in the sense that they only define what happens if
+         * the device successfully executed the DSM TRIM command. TRIM
+         * is only advisory, however, and the device is free to silently
+         * ignore all or parts of the request.
+         *
+         * Whitelist drives that are known to reliably return zeroes
+         * after TRIM.
+         */
+        /*
+         * The intel 510 drive has buggy DRAT/RZAT. Explicitly exclude
+         * that model before whitelisting all other intel SSDs.
+         */
+        { "INTEL*SSDSC2MH*",            NULL,   0, },
+        { "INTEL*SSD*",                 NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "SSD*INTEL*",                 NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Samsung*SSD*",               NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "SAMSUNG*SSD*",               NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "ST[1248][0248]0[FH]*",       NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
        /*
         * Some WD SATA-I drives spin up and down erratically when the link
@@ -4748,7 +4771,10 @@ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
                return NULL;
        for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
-                tag = tag < max_queue ? tag : 0;
+                if (ap->flags & ATA_FLAG_LOWTAG)
+                        tag = i;
+                else
+                        tag = tag < max_queue ? tag : 0;
                /* the last tag is reserved for internal command. */
                if (tag == ATA_TAG_INTERNAL)
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 3dbec8954c86..8d00c2638bed 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2389,6 +2389,7 @@ const char *ata_get_cmd_descript(u8 command)
        return NULL;
 }
+EXPORT_SYMBOL_GPL(ata_get_cmd_descript);
 /**
 *      ata_eh_link_report - report error handling to user
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index e364e86e84d7..6abd17a85b13 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2532,13 +2532,15 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
                rbuf[15] = lowest_aligned;
                if (ata_id_has_trim(args->id)) {
-                        rbuf[14] |= 0x80; /* TPE */
+                        rbuf[14] |= 0x80; /* LBPME */
-                        if (ata_id_has_zero_after_trim(args->id))
+                        if (ata_id_has_zero_after_trim(args->id) &&
-                                rbuf[14] |= 0x40; /* TPRZ */
+                            dev->horkage & ATA_HORKAGE_ZERO_AFTER_TRIM) {
+                                ata_dev_info(dev, "Enabling discard_zeroes_data\n");
+                                rbuf[14] |= 0x40; /* LBPRZ */
+                        }
                }
        }
        return 0;
 }
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index db90aa35cb71..2e86e3b85266 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -1333,7 +1333,19 @@ void ata_sff_flush_pio_task(struct ata_port *ap)
        DPRINTK("ENTER\n");
        cancel_delayed_work_sync(&ap->sff_pio_task);
+        /*
+         * We wanna reset the HSM state to IDLE.  If we do so without
+         * grabbing the port lock, critical sections protected by it which
+         * expect the HSM state to stay stable may get surprised.  For
+         * example, we may set IDLE in between the time
+         * __ata_sff_port_intr() checks for HSM_ST_IDLE and before it calls
+         * ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG().
+         */
+        spin_lock_irq(ap->lock);
        ap->hsm_task_state = HSM_ST_IDLE;
+        spin_unlock_irq(ap->lock);
        ap->sff_pio_task_link = NULL;
        if (ata_msg_ctl(ap))
diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
index c7ddef89e7b0..8e8248179d20 100644
--- a/drivers/ata/sata_dwc_460ex.c
+++ b/drivers/ata/sata_dwc_460ex.c
@@ -797,7 +797,7 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq)
        if (err) {
                dev_err(host_pvt.dwc_dev, "%s: dma_request_interrupts returns"
                        " %d\n", __func__, err);
-                goto error_out;
+                return err;
        }
        /* Enabe DMA */
@@ -808,11 +808,6 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq)
                sata_dma_regs);
        return 0;
-error_out:
-        dma_dwc_exit(hsdev);
-        return err;
 }
 static int sata_dwc_scr_read(struct ata_link *link, unsigned int scr, u32 *val)
@@ -1662,7 +1657,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
        char *ver = (char *)&versionr;
        u8 *base = NULL;
        int err = 0;
-        int irq, rc;
+        int irq;
        struct ata_host *host;
        struct ata_port_info pi = sata_dwc_port_info[0];
        const struct ata_port_info *ppi[] = { &pi, NULL };
@@ -1725,7 +1720,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
        if (irq == NO_IRQ) {
                dev_err(&ofdev->dev, "no SATA DMA irq\n");
                err = -ENODEV;
-                goto error_out;
+                goto error_iomap;
        }
        /* Get physical SATA DMA register base address */
@@ -1734,14 +1729,16 @@ static int sata_dwc_probe(struct platform_device *ofdev)
                dev_err(&ofdev->dev, "ioremap failed for AHBDMA register"
                        " address\n");
                err = -ENODEV;
-                goto error_out;
+                goto error_iomap;
        }
        /* Save dev for later use in dev_xxx() routines */
        host_pvt.dwc_dev = &ofdev->dev;
        /* Initialize AHB DMAC */
-        dma_dwc_init(hsdev, irq);
+        err = dma_dwc_init(hsdev, irq);
+        if (err)
+                goto error_dma_iomap;
        /* Enable SATA Interrupts */
        sata_dwc_enable_interrupts(hsdev);
@@ -1759,9 +1756,8 @@ static int sata_dwc_probe(struct platform_device *ofdev)
         * device discovery process, invoking our port_start() handler &
         * error_handler() to execute a dummy Softreset EH session
         */
-        rc = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht);
+        err = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht);
+        if (err)
-        if (rc != 0)
                dev_err(&ofdev->dev, "failed to activate host");
        dev_set_drvdata(&ofdev->dev, host);
@@ -1770,7 +1766,8 @@ static int sata_dwc_probe(struct platform_device *ofdev)
 error_out:
        /* Free SATA DMA resources */
        dma_dwc_exit(hsdev);
+error_dma_iomap:
+        iounmap((void __iomem *)host_pvt.sata_dma_regs);
 error_iomap:
        iounmap(base);
 error_kmalloc:
@@ -1791,6 +1788,7 @@ static int sata_dwc_remove(struct platform_device *ofdev)
        /* Free SATA DMA resources */
        dma_dwc_exit(hsdev);
+        iounmap((void __iomem *)host_pvt.sata_dma_regs);
        iounmap(hsdev->reg_base);
        kfree(hsdev);
        kfree(host);
diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index d81b20ddb527..ea655949023f 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -246,7 +246,7 @@ enum {
        /* host flags */
        SIL24_COMMON_FLAGS      = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
                                  ATA_FLAG_NCQ | ATA_FLAG_ACPI_SATA |
-                                  ATA_FLAG_AN | ATA_FLAG_PMP,
+                                  ATA_FLAG_AN | ATA_FLAG_PMP | ATA_FLAG_LOWTAG,
        SIL24_FLAG_PCIX_IRQ_WOC = (1 << 24), /* IRQ loss errata on PCI-X */
        IRQ_STAT_4PORTS         = 0xf,
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 6a103a35ea9b..0d8780c04a5e 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -2088,7 +2088,7 @@ EXPORT_SYMBOL_GPL(of_genpd_del_provider);
 * Returns a valid pointer to struct generic_pm_domain on success or ERR_PTR()
 * on failure.
 */
-static struct generic_pm_domain *of_genpd_get_from_provider(
+struct generic_pm_domain *of_genpd_get_from_provider(
                                        struct of_phandle_args *genpdspec)
 {
        struct generic_pm_domain *genpd = ERR_PTR(-ENOENT);
@@ -2108,6 +2108,7 @@ static struct generic_pm_domain *of_genpd_get_from_provider(
        return genpd;
 }
+EXPORT_SYMBOL_GPL(of_genpd_get_from_provider);
 /**
 * genpd_dev_pm_detach - Detach a device from its PM domain.
diff --git a/drivers/base/power/opp.c b/drivers/base/power/opp.c
index d24dd614a0bd..106c69359306 100644
--- a/drivers/base/power/opp.c
+++ b/drivers/base/power/opp.c
@@ -108,6 +108,14 @@ static LIST_HEAD(dev_opp_list);
 /* Lock to allow exclusive modification to the device and opp lists */
 static DEFINE_MUTEX(dev_opp_list_lock);
+#define opp_rcu_lockdep_assert()                                        \
+do {                                                                    \
+        rcu_lockdep_assert(rcu_read_lock_held() ||                      \
+                                lockdep_is_held(&dev_opp_list_lock),    \
+                           "Missing rcu_read_lock() or "                \
+                           "dev_opp_list_lock protection");             \
+} while (0)
 /**
 * find_device_opp() - find device_opp struct using device pointer
 * @dev:        device pointer used to lookup device OPPs
@@ -208,9 +216,7 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_get_freq);
 * This function returns the number of available opps if there are any,
 * else returns 0 if none or the corresponding error value.
 *
- * Locking: This function must be called under rcu_read_lock(). This function
+ * Locking: This function takes rcu_read_lock().
- * internally references two RCU protected structures: device_opp and opp which
- * are safe as long as we are under a common RCU locked section.
 */
 int dev_pm_opp_get_opp_count(struct device *dev)
 {
@@ -218,11 +224,14 @@ int dev_pm_opp_get_opp_count(struct device *dev)
        struct dev_pm_opp *temp_opp;
        int count = 0;
+        rcu_read_lock();
        dev_opp = find_device_opp(dev);
        if (IS_ERR(dev_opp)) {
-                int r = PTR_ERR(dev_opp);
+                count = PTR_ERR(dev_opp);
-                dev_err(dev, "%s: device OPP not found (%d)\n", __func__, r);
+                dev_err(dev, "%s: device OPP not found (%d)\n",
-                return r;
+                        __func__, count);
+                goto out_unlock;
        }
        list_for_each_entry_rcu(temp_opp, &dev_opp->opp_list, node) {
@@ -230,6 +239,8 @@ int dev_pm_opp_get_opp_count(struct device *dev)
                        count++;
        }
+out_unlock:
+        rcu_read_unlock();
        return count;
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_get_opp_count);
@@ -267,6 +278,8 @@ struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
        struct device_opp *dev_opp;
        struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE);
+        opp_rcu_lockdep_assert();
        dev_opp = find_device_opp(dev);
        if (IS_ERR(dev_opp)) {
                int r = PTR_ERR(dev_opp);
@@ -313,6 +326,8 @@ struct dev_pm_opp *dev_pm_opp_find_freq_ceil(struct device *dev,
        struct device_opp *dev_opp;
        struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE);
+        opp_rcu_lockdep_assert();
        if (!dev || !freq) {
                dev_err(dev, "%s: Invalid argument freq=%p\n", __func__, freq);
                return ERR_PTR(-EINVAL);
@@ -361,6 +376,8 @@ struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
        struct device_opp *dev_opp;
        struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE);
+        opp_rcu_lockdep_assert();
        if (!dev || !freq) {
                dev_err(dev, "%s: Invalid argument freq=%p\n", __func__, freq);
                return ERR_PTR(-EINVAL);
@@ -783,9 +800,15 @@ void of_free_opp_table(struct device *dev)
        /* Check for existing list for 'dev' */
        dev_opp = find_device_opp(dev);
-        if (WARN(IS_ERR(dev_opp), "%s: dev_opp: %ld\n", dev_name(dev),
+        if (IS_ERR(dev_opp)) {
-                 PTR_ERR(dev_opp)))
+                int error = PTR_ERR(dev_opp);
+                if (error != -ENODEV)
+                        WARN(1, "%s: dev_opp: %d\n",
+                             IS_ERR_OR_NULL(dev) ?
+                                        "Invalid device" : dev_name(dev),
+                             error);
                return;
+        }
        /* Hold our list modification lock here */
        mutex_lock(&dev_opp_list_lock);
diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index 0da5865df5b1..beb8b27d4621 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -51,9 +51,11 @@ struct regmap_async {
 struct regmap {
        union {
                struct mutex mutex;
-                spinlock_t spinlock;
+                struct {
+                        spinlock_t spinlock;
+                        unsigned long spinlock_flags;
+                };
        };
-        unsigned long spinlock_flags;
        regmap_lock lock;
        regmap_unlock unlock;
        void *lock_arg; /* This is passed to lock/unlock functions */
@@ -233,6 +235,10 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
 void regmap_async_complete_cb(struct regmap_async *async, int ret);
+enum regmap_endian regmap_get_val_endian(struct device *dev,
+                                         const struct regmap_bus *bus,
+                                         const struct regmap_config *config);
 extern struct regcache_ops regcache_rbtree_ops;
 extern struct regcache_ops regcache_lzo_ops;
 extern struct regcache_ops regcache_flat_ops;
diff --git a/drivers/base/regmap/regmap-ac97.c b/drivers/base/regmap/regmap-ac97.c
index e4c45d2299c1..8d304e2a943d 100644
--- a/drivers/base/regmap/regmap-ac97.c
+++ b/drivers/base/regmap/regmap-ac97.c
@@ -74,8 +74,8 @@ static int regmap_ac97_reg_write(void *context, unsigned int reg,
 }
 static const struct regmap_bus ac97_regmap_bus = {
-                .reg_write = regmap_ac97_reg_write,
+        .reg_write = regmap_ac97_reg_write,
-                .reg_read = regmap_ac97_reg_read,
+        .reg_read = regmap_ac97_reg_read,
 };
 /**
diff --git a/drivers/base/regmap/regmap-i2c.c b/drivers/base/regmap/regmap-i2c.c
index 053150a7f9f2..4b76e33110a2 100644
--- a/drivers/base/regmap/regmap-i2c.c
+++ b/drivers/base/regmap/regmap-i2c.c
@@ -14,6 +14,7 @@
 #include <linux/i2c.h>
 #include <linux/module.h>
+#include "internal.h"
 static int regmap_smbus_byte_reg_read(void *context, unsigned int reg,
                                      unsigned int *val)
@@ -87,6 +88,42 @@ static struct regmap_bus regmap_smbus_word = {
        .reg_read = regmap_smbus_word_reg_read,
 };
+static int regmap_smbus_word_read_swapped(void *context, unsigned int reg,
+                                          unsigned int *val)
+{
+        struct device *dev = context;
+        struct i2c_client *i2c = to_i2c_client(dev);
+        int ret;
+        if (reg > 0xff)
+                return -EINVAL;
+        ret = i2c_smbus_read_word_swapped(i2c, reg);
+        if (ret < 0)
+                return ret;
+        *val = ret;
+        return 0;
+}
+static int regmap_smbus_word_write_swapped(void *context, unsigned int reg,
+                                           unsigned int val)
+{
+        struct device *dev = context;
+        struct i2c_client *i2c = to_i2c_client(dev);
+        if (val > 0xffff || reg > 0xff)
+                return -EINVAL;
+        return i2c_smbus_write_word_swapped(i2c, reg, val);
+}
+static struct regmap_bus regmap_smbus_word_swapped = {
+        .reg_write = regmap_smbus_word_write_swapped,
+        .reg_read = regmap_smbus_word_read_swapped,
+};
 static int regmap_i2c_write(void *context, const void *data, size_t count)
 {
        struct device *dev = context;
@@ -180,7 +217,14 @@ static const struct regmap_bus *regmap_get_i2c_bus(struct i2c_client *i2c,
        else if (config->val_bits == 16 && config->reg_bits == 8 &&
                 i2c_check_functionality(i2c->adapter,
                                         I2C_FUNC_SMBUS_WORD_DATA))
-                return &regmap_smbus_word;
+                switch (regmap_get_val_endian(&i2c->dev, NULL, config)) {
+                case REGMAP_ENDIAN_LITTLE:
+                        return &regmap_smbus_word;
+                case REGMAP_ENDIAN_BIG:
+                        return &regmap_smbus_word_swapped;
+                default:                /* everything else is not supported */
+                        break;
+                }
        else if (config->val_bits == 8 && config->reg_bits == 8 &&
                 i2c_check_functionality(i2c->adapter,
                                         I2C_FUNC_SMBUS_BYTE_DATA))
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index d2f8a818d200..f99b098ddabf 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -473,9 +473,9 @@ static enum regmap_endian regmap_get_reg_endian(const struct regmap_bus *bus,
        return REGMAP_ENDIAN_BIG;
 }
-static enum regmap_endian regmap_get_val_endian(struct device *dev,
+enum regmap_endian regmap_get_val_endian(struct device *dev,
-                                        const struct regmap_bus *bus,
+                                         const struct regmap_bus *bus,
-                                        const struct regmap_config *config)
+                                         const struct regmap_config *config)
 {
        struct device_node *np;
        enum regmap_endian endian;
@@ -513,6 +513,7 @@ static enum regmap_endian regmap_get_val_endian(struct device *dev,
        /* Use this if no other value was found */
        return REGMAP_ENDIAN_BIG;
 }
+EXPORT_SYMBOL_GPL(regmap_get_val_endian);
 /**
 * regmap_init(): Initialise register map
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index ae9f615382f6..aa2224aa7caa 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -530,7 +530,7 @@ static int null_add_dev(void)
                        goto out_cleanup_queues;
                nullb->q = blk_mq_init_queue(&nullb->tag_set);
-                if (!nullb->q) {
+                if (IS_ERR(nullb->q)) {
                        rv = -ENOMEM;
                        goto out_cleanup_tags;
                }
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c
index b1d5d8797315..d826bf3e62c8 100644
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -106,7 +106,7 @@ struct nvme_queue {
        dma_addr_t cq_dma_addr;
        u32 __iomem *q_db;
        u16 q_depth;
-        u16 cq_vector;
+        s16 cq_vector;
        u16 sq_head;
        u16 sq_tail;
        u16 cq_head;
@@ -215,6 +215,7 @@ static void nvme_set_info(struct nvme_cmd_info *cmd, void *ctx,
        cmd->fn = handler;
        cmd->ctx = ctx;
        cmd->aborted = 0;
+        blk_mq_start_request(blk_mq_rq_from_pdu(cmd));
 }
 /* Special values must be less than 0x1000 */
@@ -431,8 +432,13 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx,
        if (unlikely(status)) {
                if (!(status & NVME_SC_DNR || blk_noretry_request(req))
                    && (jiffies - req->start_time) < req->timeout) {
+                        unsigned long flags;
                        blk_mq_requeue_request(req);
-                        blk_mq_kick_requeue_list(req->q);
+                        spin_lock_irqsave(req->q->queue_lock, flags);
+                        if (!blk_queue_stopped(req->q))
+                                blk_mq_kick_requeue_list(req->q);
+                        spin_unlock_irqrestore(req->q->queue_lock, flags);
                        return;
                }
                req->errors = nvme_error_status(status);
@@ -664,8 +670,6 @@ static int nvme_queue_rq(struct blk_mq_hw_ctx *hctx,
                }
        }
-        blk_mq_start_request(req);
        nvme_set_info(cmd, iod, req_completion);
        spin_lock_irq(&nvmeq->q_lock);
        if (req->cmd_flags & REQ_DISCARD)
@@ -835,6 +839,7 @@ static int nvme_submit_async_admin_req(struct nvme_dev *dev)
        if (IS_ERR(req))
                return PTR_ERR(req);
+        req->cmd_flags |= REQ_NO_TIMEOUT;
        cmd_info = blk_mq_rq_to_pdu(req);
        nvme_set_info(cmd_info, req, async_req_completion);
@@ -1016,14 +1021,19 @@ static void nvme_abort_req(struct request *req)
        struct nvme_command cmd;
        if (!nvmeq->qid || cmd_rq->aborted) {
+                unsigned long flags;
+                spin_lock_irqsave(&dev_list_lock, flags);
                if (work_busy(&dev->reset_work))
-                        return;
+                        goto out;
                list_del_init(&dev->node);
                dev_warn(&dev->pci_dev->dev,
                        "I/O %d QID %d timeout, reset controller\n",
                                                        req->tag, nvmeq->qid);
                dev->reset_workfn = nvme_reset_failed_dev;
                queue_work(nvme_workq, &dev->reset_work);
+ out:
+                spin_unlock_irqrestore(&dev_list_lock, flags);
                return;
        }
@@ -1064,15 +1074,22 @@ static void nvme_cancel_queue_ios(struct blk_mq_hw_ctx *hctx,
        void *ctx;
        nvme_completion_fn fn;
        struct nvme_cmd_info *cmd;
-        static struct nvme_completion cqe = {
+        struct nvme_completion cqe;
-                .status = cpu_to_le16(NVME_SC_ABORT_REQ << 1),
-        };
+        if (!blk_mq_request_started(req))
+                return;
        cmd = blk_mq_rq_to_pdu(req);
        if (cmd->ctx == CMD_CTX_CANCELLED)
                return;
+        if (blk_queue_dying(req->q))
+                cqe.status = cpu_to_le16((NVME_SC_ABORT_REQ | NVME_SC_DNR) << 1);
+        else
+                cqe.status = cpu_to_le16(NVME_SC_ABORT_REQ << 1);
        dev_warn(nvmeq->q_dmadev, "Cancelling I/O %d QID %d\n",
                                                req->tag, nvmeq->qid);
        ctx = cancel_cmd_info(cmd, &fn);
@@ -1084,17 +1101,29 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
        struct nvme_cmd_info *cmd = blk_mq_rq_to_pdu(req);
        struct nvme_queue *nvmeq = cmd->nvmeq;
-        dev_warn(nvmeq->q_dmadev, "Timeout I/O %d QID %d\n", req->tag,
-                                                        nvmeq->qid);
-        if (nvmeq->dev->initialized)
-                nvme_abort_req(req);
        /*
         * The aborted req will be completed on receiving the abort req.
         * We enable the timer again. If hit twice, it'll cause a device reset,
         * as the device then is in a faulty state.
         */
-        return BLK_EH_RESET_TIMER;
+        int ret = BLK_EH_RESET_TIMER;
+        dev_warn(nvmeq->q_dmadev, "Timeout I/O %d QID %d\n", req->tag,
+                                                        nvmeq->qid);
+        spin_lock_irq(&nvmeq->q_lock);
+        if (!nvmeq->dev->initialized) {
+                /*
+                 * Force cancelled command frees the request, which requires we
+                 * return BLK_EH_NOT_HANDLED.
+                 */
+                nvme_cancel_queue_ios(nvmeq->hctx, req, nvmeq, reserved);
+                ret = BLK_EH_NOT_HANDLED;
+        } else
+                nvme_abort_req(req);
+        spin_unlock_irq(&nvmeq->q_lock);
+        return ret;
 }
 static void nvme_free_queue(struct nvme_queue *nvmeq)
@@ -1131,10 +1160,16 @@ static void nvme_free_queues(struct nvme_dev *dev, int lowest)
 */
 static int nvme_suspend_queue(struct nvme_queue *nvmeq)
 {
-        int vector = nvmeq->dev->entry[nvmeq->cq_vector].vector;
+        int vector;
        spin_lock_irq(&nvmeq->q_lock);
+        if (nvmeq->cq_vector == -1) {
+                spin_unlock_irq(&nvmeq->q_lock);
+                return 1;
+        }
+        vector = nvmeq->dev->entry[nvmeq->cq_vector].vector;
        nvmeq->dev->online_queues--;
+        nvmeq->cq_vector = -1;
        spin_unlock_irq(&nvmeq->q_lock);
        irq_set_affinity_hint(vector, NULL);
@@ -1169,11 +1204,13 @@ static void nvme_disable_queue(struct nvme_dev *dev, int qid)
                adapter_delete_sq(dev, qid);
                adapter_delete_cq(dev, qid);
        }
+        if (!qid && dev->admin_q)
+                blk_mq_freeze_queue_start(dev->admin_q);
        nvme_clear_queue(nvmeq);
 }
 static struct nvme_queue *nvme_alloc_queue(struct nvme_dev *dev, int qid,
-                                                        int depth, int vector)
+                                                        int depth)
 {
        struct device *dmadev = &dev->pci_dev->dev;
        struct nvme_queue *nvmeq = kzalloc(sizeof(*nvmeq), GFP_KERNEL);
@@ -1199,7 +1236,6 @@ static struct nvme_queue *nvme_alloc_queue(struct nvme_dev *dev, int qid,
        nvmeq->cq_phase = 1;
        nvmeq->q_db = &dev->dbs[qid * 2 * dev->db_stride];
        nvmeq->q_depth = depth;
-        nvmeq->cq_vector = vector;
        nvmeq->qid = qid;
        dev->queue_count++;
        dev->queues[qid] = nvmeq;
@@ -1244,6 +1280,7 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
        struct nvme_dev *dev = nvmeq->dev;
        int result;
+        nvmeq->cq_vector = qid - 1;
        result = adapter_alloc_cq(dev, qid, nvmeq);
        if (result < 0)
                return result;
@@ -1355,6 +1392,14 @@ static struct blk_mq_ops nvme_mq_ops = {
        .timeout        = nvme_timeout,
 };
+static void nvme_dev_remove_admin(struct nvme_dev *dev)
+{
+        if (dev->admin_q && !blk_queue_dying(dev->admin_q)) {
+                blk_cleanup_queue(dev->admin_q);
+                blk_mq_free_tag_set(&dev->admin_tagset);
+        }
+}
 static int nvme_alloc_admin_tags(struct nvme_dev *dev)
 {
        if (!dev->admin_q) {
@@ -1370,21 +1415,20 @@ static int nvme_alloc_admin_tags(struct nvme_dev *dev)
                        return -ENOMEM;
                dev->admin_q = blk_mq_init_queue(&dev->admin_tagset);
-                if (!dev->admin_q) {
+                if (IS_ERR(dev->admin_q)) {
                        blk_mq_free_tag_set(&dev->admin_tagset);
                        return -ENOMEM;
                }
-        }
+                if (!blk_get_queue(dev->admin_q)) {
+                        nvme_dev_remove_admin(dev);
+                        return -ENODEV;
+                }
+        } else
+                blk_mq_unfreeze_queue(dev->admin_q);
        return 0;
 }
-static void nvme_free_admin_tags(struct nvme_dev *dev)
-{
-        if (dev->admin_q)
-                blk_mq_free_tag_set(&dev->admin_tagset);
-}
 static int nvme_configure_admin_queue(struct nvme_dev *dev)
 {
        int result;
@@ -1416,7 +1460,7 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
        nvmeq = dev->queues[0];
        if (!nvmeq) {
-                nvmeq = nvme_alloc_queue(dev, 0, NVME_AQ_DEPTH, 0);
+                nvmeq = nvme_alloc_queue(dev, 0, NVME_AQ_DEPTH);
                if (!nvmeq)
                        return -ENOMEM;
        }
@@ -1439,18 +1483,13 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
        if (result)
                goto free_nvmeq;
-        result = nvme_alloc_admin_tags(dev);
+        nvmeq->cq_vector = 0;
-        if (result)
-                goto free_nvmeq;
        result = queue_request_irq(dev, nvmeq, nvmeq->irqname);
        if (result)
-                goto free_tags;
+                goto free_nvmeq;
        return result;
- free_tags:
-        nvme_free_admin_tags(dev);
 free_nvmeq:
        nvme_free_queues(dev, 0);
        return result;
@@ -1944,7 +1983,7 @@ static void nvme_create_io_queues(struct nvme_dev *dev)
        unsigned i;
        for (i = dev->queue_count; i <= dev->max_qid; i++)
-                if (!nvme_alloc_queue(dev, i, dev->q_depth, i - 1))
+                if (!nvme_alloc_queue(dev, i, dev->q_depth))
                        break;
        for (i = dev->online_queues; i <= dev->queue_count - 1; i++)
@@ -2235,13 +2274,18 @@ static void nvme_wait_dq(struct nvme_delq_ctx *dq, struct nvme_dev *dev)
                        break;
                if (!schedule_timeout(ADMIN_TIMEOUT) ||
                                        fatal_signal_pending(current)) {
+                        /*
+                         * Disable the controller first since we can't trust it
+                         * at this point, but leave the admin queue enabled
+                         * until all queue deletion requests are flushed.
+                         * FIXME: This may take a while if there are more h/w
+                         * queues than admin tags.
+                         */
                        set_current_state(TASK_RUNNING);
                        nvme_disable_ctrl(dev, readq(&dev->bar->cap));
-                        nvme_disable_queue(dev, 0);
+                        nvme_clear_queue(dev->queues[0]);
-                        send_sig(SIGKILL, dq->worker->task, 1);
                        flush_kthread_worker(dq->worker);
+                        nvme_disable_queue(dev, 0);
                        return;
                }
        }
@@ -2318,7 +2362,6 @@ static void nvme_del_queue_start(struct kthread_work *work)
 {
        struct nvme_queue *nvmeq = container_of(work, struct nvme_queue,
                                                        cmdinfo.work);
-        allow_signal(SIGKILL);
        if (nvme_delete_sq(nvmeq))
                nvme_del_queue_end(nvmeq);
 }
@@ -2376,6 +2419,34 @@ static void nvme_dev_list_remove(struct nvme_dev *dev)
                kthread_stop(tmp);
 }
+static void nvme_freeze_queues(struct nvme_dev *dev)
+{
+        struct nvme_ns *ns;
+        list_for_each_entry(ns, &dev->namespaces, list) {
+                blk_mq_freeze_queue_start(ns->queue);
+                spin_lock(ns->queue->queue_lock);
+                queue_flag_set(QUEUE_FLAG_STOPPED, ns->queue);
+                spin_unlock(ns->queue->queue_lock);
+                blk_mq_cancel_requeue_work(ns->queue);
+                blk_mq_stop_hw_queues(ns->queue);
+        }
+}
+static void nvme_unfreeze_queues(struct nvme_dev *dev)
+{
+        struct nvme_ns *ns;
+        list_for_each_entry(ns, &dev->namespaces, list) {
+                queue_flag_clear_unlocked(QUEUE_FLAG_STOPPED, ns->queue);
+                blk_mq_unfreeze_queue(ns->queue);
+                blk_mq_start_stopped_hw_queues(ns->queue, true);
+                blk_mq_kick_requeue_list(ns->queue);
+        }
+}
 static void nvme_dev_shutdown(struct nvme_dev *dev)
 {
        int i;
@@ -2384,8 +2455,10 @@ static void nvme_dev_shutdown(struct nvme_dev *dev)
        dev->initialized = 0;
        nvme_dev_list_remove(dev);
-        if (dev->bar)
+        if (dev->bar) {
+                nvme_freeze_queues(dev);
                csts = readl(&dev->bar->csts);
+        }
        if (csts & NVME_CSTS_CFS || !(csts & NVME_CSTS_RDY)) {
                for (i = dev->queue_count - 1; i >= 0; i--) {
                        struct nvme_queue *nvmeq = dev->queues[i];
@@ -2400,12 +2473,6 @@ static void nvme_dev_shutdown(struct nvme_dev *dev)
        nvme_dev_unmap(dev);
 }
-static void nvme_dev_remove_admin(struct nvme_dev *dev)
-{
-        if (dev->admin_q && !blk_queue_dying(dev->admin_q))
-                blk_cleanup_queue(dev->admin_q);
-}
 static void nvme_dev_remove(struct nvme_dev *dev)
 {
        struct nvme_ns *ns;
@@ -2413,8 +2480,10 @@ static void nvme_dev_remove(struct nvme_dev *dev)
        list_for_each_entry(ns, &dev->namespaces, list) {
                if (ns->disk->flags & GENHD_FL_UP)
                        del_gendisk(ns->disk);
-                if (!blk_queue_dying(ns->queue))
+                if (!blk_queue_dying(ns->queue)) {
+                        blk_mq_abort_requeue_list(ns->queue);
                        blk_cleanup_queue(ns->queue);
+                }
        }
 }
@@ -2495,6 +2564,7 @@ static void nvme_free_dev(struct kref *kref)
        nvme_free_namespaces(dev);
        nvme_release_instance(dev);
        blk_mq_free_tag_set(&dev->tagset);
+        blk_put_queue(dev->admin_q);
        kfree(dev->queues);
        kfree(dev->entry);
        kfree(dev);
@@ -2591,15 +2661,20 @@ static int nvme_dev_start(struct nvme_dev *dev)
        }
        nvme_init_queue(dev->queues[0], 0);
+        result = nvme_alloc_admin_tags(dev);
+        if (result)
+                goto disable;
        result = nvme_setup_io_queues(dev);
        if (result)
-                goto disable;
+                goto free_tags;
        nvme_set_irq_hints(dev);
        return result;
+ free_tags:
+        nvme_dev_remove_admin(dev);
 disable:
        nvme_disable_queue(dev, 0);
        nvme_dev_list_remove(dev);
@@ -2639,6 +2714,9 @@ static int nvme_dev_resume(struct nvme_dev *dev)
                dev->reset_workfn = nvme_remove_disks;
                queue_work(nvme_workq, &dev->reset_work);
                spin_unlock(&dev_list_lock);
+        } else {
+                nvme_unfreeze_queues(dev);
+                nvme_set_irq_hints(dev);
        }
        dev->initialized = 1;
        return 0;
@@ -2776,11 +2854,10 @@ static void nvme_remove(struct pci_dev *pdev)
        pci_set_drvdata(pdev, NULL);
        flush_work(&dev->reset_work);
        misc_deregister(&dev->miscdev);
-        nvme_dev_remove(dev);
        nvme_dev_shutdown(dev);
+        nvme_dev_remove(dev);
        nvme_dev_remove_admin(dev);
        nvme_free_queues(dev, 0);
-        nvme_free_admin_tags(dev);
        nvme_release_prp_pools(dev);
        kref_put(&dev->kref, nvme_free_dev);
 }
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 3ec85dfce124..8a86b62466f7 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -2098,32 +2098,26 @@ static void rbd_dev_parent_put(struct rbd_device *rbd_dev)
 * If an image has a non-zero parent overlap, get a reference to its
 * parent.
 *
- * We must get the reference before checking for the overlap to
- * coordinate properly with zeroing the parent overlap in
- * rbd_dev_v2_parent_info() when an image gets flattened.  We
- * drop it again if there is no overlap.
- *
 * Returns true if the rbd device has a parent with a non-zero
 * overlap and a reference for it was successfully taken, or
 * false otherwise.
 */
 static bool rbd_dev_parent_get(struct rbd_device *rbd_dev)
 {
-        int counter;
+        int counter = 0;
        if (!rbd_dev->parent_spec)
                return false;
-        counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
+        down_read(&rbd_dev->header_rwsem);
-        if (counter > 0 && rbd_dev->parent_overlap)
+        if (rbd_dev->parent_overlap)
-                return true;
+                counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
+        up_read(&rbd_dev->header_rwsem);
-        /* Image was flattened, but parent is not yet torn down */
        if (counter < 0)
                rbd_warn(rbd_dev, "parent reference overflow");
-        return false;
+        return counter > 0;
 }
 /*
@@ -4239,7 +4233,6 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
                 */
                if (rbd_dev->parent_overlap) {
                        rbd_dev->parent_overlap = 0;
-                        smp_mb();
                        rbd_dev_parent_put(rbd_dev);
                        pr_info("%s: clone image has been flattened\n",
                                rbd_dev->disk->disk_name);
@@ -4285,7 +4278,6 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
         * treat it specially.
         */
        rbd_dev->parent_overlap = overlap;
-        smp_mb();
        if (!overlap) {
                /* A null parent_spec indicates it's the initial probe */
@@ -5114,10 +5106,7 @@ static void rbd_dev_unprobe(struct rbd_device *rbd_dev)
 {
        struct rbd_image_header *header;
-        /* Drop parent reference unless it's already been done (or none) */
+        rbd_dev_parent_put(rbd_dev);
-        if (rbd_dev->parent_overlap)
-                rbd_dev_parent_put(rbd_dev);
        /* Free dynamic fields from the header, then zero it out */
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 7ef7c098708f..cdfbd21e3597 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -638,7 +638,7 @@ static int virtblk_probe(struct virtio_device *vdev)
                goto out_put_disk;
        q = vblk->disk->queue = blk_mq_init_queue(&vblk->tag_set);
-        if (!q) {
+        if (IS_ERR(q)) {
                err = -ENOMEM;
                goto out_free_tags;
        }
diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c
index 860da40b78ef..0ce5e2d65a06 100644
--- a/drivers/bus/arm-cci.c
+++ b/drivers/bus/arm-cci.c
@@ -1312,6 +1312,9 @@ static int cci_probe(void)
        if (!np)
                return -ENODEV;
+        if (!of_device_is_available(np))
+                return -ENODEV;
        cci_config = of_match_node(arm_cci_matches, np)->data;
        if (!cci_config)
                return -ENODEV;
diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
index eb7682dc123b..81bf297f1034 100644
--- a/drivers/bus/mvebu-mbus.c
+++ b/drivers/bus/mvebu-mbus.c
@@ -210,12 +210,25 @@ static void mvebu_mbus_disable_window(struct mvebu_mbus_state *mbus,
 }
 /* Checks whether the given window number is available */
+/* On Armada XP, 375 and 38x the MBus window 13 has the remap
+ * capability, like windows 0 to 7. However, the mvebu-mbus driver
+ * isn't currently taking into account this special case, which means
+ * that when window 13 is actually used, the remap registers are left
+ * to 0, making the device using this MBus window unavailable. The
+ * quick fix for stable is to not use window 13. A follow up patch
+ * will correctly handle this window.
+*/
 static int mvebu_mbus_window_is_free(struct mvebu_mbus_state *mbus,
                                     const int win)
 {
        void __iomem *addr = mbus->mbuswins_base +
                mbus->soc->win_cfg_offset(win);
        u32 ctrl = readl(addr + WIN_CTRL_OFF);
+        if (win == 13)
+                return false;
        return !(ctrl & WIN_CTRL_ENABLE);
 }
diff --git a/drivers/char/agp/ali-agp.c b/drivers/char/agp/ali-agp.c
index 19db03667650..dcbbb4ea3cc1 100644
--- a/drivers/char/agp/ali-agp.c
+++ b/drivers/char/agp/ali-agp.c
@@ -417,6 +417,6 @@ static void __exit agp_ali_cleanup(void)
 module_init(agp_ali_init);
 module_exit(agp_ali_cleanup);
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones");
 MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 3b47ed0310e1..0ef350010766 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -813,6 +813,6 @@ static void __exit agp_amd64_cleanup(void)
 module_init(agp_amd64_mod_init);
 module_exit(agp_amd64_cleanup);
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>, Andi Kleen");
+MODULE_AUTHOR("Dave Jones, Andi Kleen");
 module_param(agp_try_unsupported, bool, 0);
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index 18a7a6baa304..75a9786a77e6 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -579,6 +579,6 @@ static void __exit agp_ati_cleanup(void)
 module_init(agp_ati_init);
 module_exit(agp_ati_cleanup);
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones");
 MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index 317c28ce8328..38ffb281df97 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -356,7 +356,7 @@ static __init int agp_setup(char *s)
 __setup("agp=", agp_setup);
 #endif
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones, Jeff Hartmann");
 MODULE_DESCRIPTION("AGP GART driver");
 MODULE_LICENSE("GPL and additional rights");
 MODULE_ALIAS_MISCDEV(AGPGART_MINOR);
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index f9b9ca5d31b7..0a21daed5b62 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -920,5 +920,5 @@ static void __exit agp_intel_cleanup(void)
 module_init(agp_intel_init);
 module_exit(agp_intel_cleanup);
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones, Various @Intel");
 MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index f3334829e55a..92aa43fa8d70 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -1438,5 +1438,5 @@ void intel_gmch_remove(void)
 }
 EXPORT_SYMBOL(intel_gmch_remove);
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones, Various @Intel");
 MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/char/agp/nvidia-agp.c b/drivers/char/agp/nvidia-agp.c
index a1861b75eb31..6c8d39cb566e 100644
--- a/drivers/char/agp/nvidia-agp.c
+++ b/drivers/char/agp/nvidia-agp.c
@@ -1,7 +1,7 @@
 /*
 * Nvidia AGPGART routines.
 * Based upon a 2.4 agpgart diff by the folks from NVIDIA, and hacked up
- * to work in 2.5 by Dave Jones <davej@redhat.com>
+ * to work in 2.5 by Dave Jones.
 */
 #include <linux/module.h>
diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c
index 228f20cddc05..a4961d35e940 100644
--- a/drivers/char/agp/via-agp.c
+++ b/drivers/char/agp/via-agp.c
@@ -595,4 +595,4 @@ module_init(agp_via_init);
 module_exit(agp_via_cleanup);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones");
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 5fa83f751378..6b65fa4e0c55 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -199,18 +199,6 @@ struct bmc_device {
        int                    guid_set;
        char                   name[16];
        struct kref            usecount;
-        /* bmc device attributes */
-        struct device_attribute device_id_attr;
-        struct device_attribute provides_dev_sdrs_attr;
-        struct device_attribute revision_attr;
-        struct device_attribute firmware_rev_attr;
-        struct device_attribute version_attr;
-        struct device_attribute add_dev_support_attr;
-        struct device_attribute manufacturer_id_attr;
-        struct device_attribute product_id_attr;
-        struct device_attribute guid_attr;
-        struct device_attribute aux_firmware_rev_attr;
 };
 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)
@@ -2252,7 +2240,7 @@ static ssize_t device_id_show(struct device *dev,
        return snprintf(buf, 10, "%u\n", bmc->id.device_id);
 }
-DEVICE_ATTR(device_id, S_IRUGO, device_id_show, NULL);
+static DEVICE_ATTR(device_id, S_IRUGO, device_id_show, NULL);
 static ssize_t provides_device_sdrs_show(struct device *dev,
                                         struct device_attribute *attr,
@@ -2263,7 +2251,8 @@ static ssize_t provides_device_sdrs_show(struct device *dev,
        return snprintf(buf, 10, "%u\n",
                        (bmc->id.device_revision & 0x80) >> 7);
 }
-DEVICE_ATTR(provides_device_sdrs, S_IRUGO, provides_device_sdrs_show, NULL);
+static DEVICE_ATTR(provides_device_sdrs, S_IRUGO, provides_device_sdrs_show,
+                   NULL);
 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
                             char *buf)
@@ -2273,7 +2262,7 @@ static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
        return snprintf(buf, 20, "%u\n",
                        bmc->id.device_revision & 0x0F);
 }
-DEVICE_ATTR(revision, S_IRUGO, revision_show, NULL);
+static DEVICE_ATTR(revision, S_IRUGO, revision_show, NULL);
 static ssize_t firmware_revision_show(struct device *dev,
                                      struct device_attribute *attr,
@@ -2284,7 +2273,7 @@ static ssize_t firmware_revision_show(struct device *dev,
        return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
                        bmc->id.firmware_revision_2);
 }
-DEVICE_ATTR(firmware_revision, S_IRUGO, firmware_revision_show, NULL);
+static DEVICE_ATTR(firmware_revision, S_IRUGO, firmware_revision_show, NULL);
 static ssize_t ipmi_version_show(struct device *dev,
                                 struct device_attribute *attr,
@@ -2296,7 +2285,7 @@ static ssize_t ipmi_version_show(struct device *dev,
                        ipmi_version_major(&bmc->id),
                        ipmi_version_minor(&bmc->id));
 }
-DEVICE_ATTR(ipmi_version, S_IRUGO, ipmi_version_show, NULL);
+static DEVICE_ATTR(ipmi_version, S_IRUGO, ipmi_version_show, NULL);
 static ssize_t add_dev_support_show(struct device *dev,
                                    struct device_attribute *attr,
@@ -2307,7 +2296,8 @@ static ssize_t add_dev_support_show(struct device *dev,
        return snprintf(buf, 10, "0x%02x\n",
                        bmc->id.additional_device_support);
 }
-DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show, NULL);
+static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show,
+                   NULL);
 static ssize_t manufacturer_id_show(struct device *dev,
                                    struct device_attribute *attr,
@@ -2317,7 +2307,7 @@ static ssize_t manufacturer_id_show(struct device *dev,
        return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
 }
-DEVICE_ATTR(manufacturer_id, S_IRUGO, manufacturer_id_show, NULL);
+static DEVICE_ATTR(manufacturer_id, S_IRUGO, manufacturer_id_show, NULL);
 static ssize_t product_id_show(struct device *dev,
                               struct device_attribute *attr,
@@ -2327,7 +2317,7 @@ static ssize_t product_id_show(struct device *dev,
        return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
 }
-DEVICE_ATTR(product_id, S_IRUGO, product_id_show, NULL);
+static DEVICE_ATTR(product_id, S_IRUGO, product_id_show, NULL);
 static ssize_t aux_firmware_rev_show(struct device *dev,
                                     struct device_attribute *attr,
@@ -2341,7 +2331,7 @@ static ssize_t aux_firmware_rev_show(struct device *dev,
                        bmc->id.aux_firmware_revision[1],
                        bmc->id.aux_firmware_revision[0]);
 }
-DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
+static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
                         char *buf)
@@ -2352,7 +2342,7 @@ static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
                        (long long) bmc->guid[0],
                        (long long) bmc->guid[8]);
 }
-DEVICE_ATTR(guid, S_IRUGO, guid_show, NULL);
+static DEVICE_ATTR(guid, S_IRUGO, guid_show, NULL);
 static struct attribute *bmc_dev_attrs[] = {
        &dev_attr_device_id.attr,
@@ -2392,10 +2382,10 @@ cleanup_bmc_device(struct kref *ref)
        if (bmc->id.aux_firmware_revision_set)
                device_remove_file(&bmc->pdev.dev,
-                                   &bmc->aux_firmware_rev_attr);
+                                   &dev_attr_aux_firmware_revision);
        if (bmc->guid_set)
                device_remove_file(&bmc->pdev.dev,
-                                   &bmc->guid_attr);
+                                   &dev_attr_guid);
        platform_device_unregister(&bmc->pdev);
 }
@@ -2422,16 +2412,14 @@ static int create_bmc_files(struct bmc_device *bmc)
        int err;
        if (bmc->id.aux_firmware_revision_set) {
-                bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
                err = device_create_file(&bmc->pdev.dev,
-                                   &bmc->aux_firmware_rev_attr);
+                                         &dev_attr_aux_firmware_revision);
                if (err)
                        goto out;
        }
        if (bmc->guid_set) {
-                bmc->guid_attr.attr.name = "guid";
                err = device_create_file(&bmc->pdev.dev,
-                                   &bmc->guid_attr);
+                                         &dev_attr_guid);
                if (err)
                        goto out_aux_firm;
        }
@@ -2441,7 +2429,7 @@ static int create_bmc_files(struct bmc_device *bmc)
 out_aux_firm:
        if (bmc->id.aux_firmware_revision_set)
                device_remove_file(&bmc->pdev.dev,
-                                   &bmc->aux_firmware_rev_attr);
+                                   &dev_attr_aux_firmware_revision);
 out:
        return err;
 }
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index e178ac27e73c..982b96323f82 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -52,6 +52,7 @@
 #include <linux/dmi.h>
 #include <linux/kthread.h>
 #include <linux/acpi.h>
+#include <linux/ctype.h>
 #define PFX "ipmi_ssif: "
 #define DEVICE_NAME "ipmi_ssif"
@@ -968,7 +969,8 @@ static void sender(void                *send_info,
                do_gettimeofday(&t);
                pr_info("**Enqueue %02x %02x: %ld.%6.6ld\n",
-                       msg->data[0], msg->data[1], t.tv_sec, t.tv_usec);
+                       msg->data[0], msg->data[1],
+                       (long) t.tv_sec, (long) t.tv_usec);
        }
 }
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 04645c09fe5e..9cd6968e2f92 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -569,19 +569,19 @@ static void fast_mix(struct fast_pool *f)
        __u32 c = f->pool[2],   d = f->pool[3];
        a += b;                 c += d;
-        b = rol32(a, 6);        d = rol32(c, 27);
+        b = rol32(b, 6);        d = rol32(d, 27);
        d ^= a;                 b ^= c;
        a += b;                 c += d;
-        b = rol32(a, 16);       d = rol32(c, 14);
+        b = rol32(b, 16);       d = rol32(d, 14);
        d ^= a;                 b ^= c;
        a += b;                 c += d;
-        b = rol32(a, 6);        d = rol32(c, 27);
+        b = rol32(b, 6);        d = rol32(d, 27);
        d ^= a;                 b ^= c;
        a += b;                 c += d;
-        b = rol32(a, 16);       d = rol32(c, 14);
+        b = rol32(b, 16);       d = rol32(d, 14);
        d ^= a;                 b ^= c;
        f->pool[0] = a;  f->pool[1] = b;
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index 3f44f292d066..91f86131bb7a 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -13,6 +13,7 @@ config COMMON_CLK
        bool
        select HAVE_CLK_PREPARE
        select CLKDEV_LOOKUP
+        select SRCU
        ---help---
          The common clock framework is a single definition of struct
          clk, useful across many platforms, as well as an
diff --git a/drivers/clk/at91/clk-slow.c b/drivers/clk/at91/clk-slow.c
index 32f7c1b36204..2f13bd5246b5 100644
--- a/drivers/clk/at91/clk-slow.c
+++ b/drivers/clk/at91/clk-slow.c
@@ -70,6 +70,7 @@ struct clk_sam9x5_slow {
 #define to_clk_sam9x5_slow(hw) container_of(hw, struct clk_sam9x5_slow, hw)
+static struct clk *slow_clk;
 static int clk_slow_osc_prepare(struct clk_hw *hw)
 {
@@ -357,6 +358,8 @@ at91_clk_register_sam9x5_slow(void __iomem *sckcr,
        clk = clk_register(NULL, &slowck->hw);
        if (IS_ERR(clk))
                kfree(slowck);
+        else
+                slow_clk = clk;
        return clk;
 }
@@ -433,6 +436,8 @@ at91_clk_register_sam9260_slow(struct at91_pmc *pmc,
        clk = clk_register(NULL, &slowck->hw);
        if (IS_ERR(clk))
                kfree(slowck);
+        else
+                slow_clk = clk;
        return clk;
 }
@@ -465,3 +470,25 @@ void __init of_at91sam9260_clk_slow_setup(struct device_node *np,
        of_clk_add_provider(np, of_clk_src_simple_get, clk);
 }
+/*
+ * FIXME: All slow clk users are not properly claiming it (get + prepare +
+ * enable) before using it.
+ * If all users properly claiming this clock decide that they don't need it
+ * anymore (or are removed), it is disabled while faulty users are still
+ * requiring it, and the system hangs.
+ * Prevent this clock from being disabled until all users are properly
+ * requesting it.
+ * Once this is done we should remove this function and the slow_clk variable.
+ */
+static int __init of_at91_clk_slow_retain(void)
+{
+        if (!slow_clk)
+                return 0;
+        __clk_get(slow_clk);
+        clk_prepare_enable(slow_clk);
+        return 0;
+}
+arch_initcall(of_at91_clk_slow_retain);
diff --git a/drivers/clk/berlin/bg2q.c b/drivers/clk/berlin/bg2q.c
index 21784e4eb3f0..440ef81ab15c 100644
--- a/drivers/clk/berlin/bg2q.c
+++ b/drivers/clk/berlin/bg2q.c
@@ -285,7 +285,6 @@ static const struct berlin2_gate_data bg2q_gates[] __initconst = {
        { "pbridge",    "perif",        15, CLK_IGNORE_UNUSED },
        { "sdio",       "perif",        16, CLK_IGNORE_UNUSED },
        { "nfc",        "perif",        18 },
-        { "smemc",      "perif",        19 },
        { "pcie",       "perif",        22 },
 };
diff --git a/drivers/clk/clk-ppc-corenet.c b/drivers/clk/clk-ppc-corenet.c
index b6e6c85507a5..0a47d6f49cd6 100644
--- a/drivers/clk/clk-ppc-corenet.c
+++ b/drivers/clk/clk-ppc-corenet.c
@@ -291,7 +291,7 @@ static const struct of_device_id ppc_clk_ids[] __initconst = {
        {}
 };
-static struct platform_driver ppc_corenet_clk_driver __initdata = {
+static struct platform_driver ppc_corenet_clk_driver = {
        .driver = {
                .name = "ppc_corenet_clock",
                .of_match_table = ppc_clk_ids,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index f4963b7d4e17..d48ac71c6c8b 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1366,7 +1366,7 @@ static struct clk *clk_calc_new_rates(struct clk *clk, unsigned long rate)
                new_rate = clk->ops->determine_rate(clk->hw, rate,
                                                    &best_parent_rate,
                                                    &parent_hw);
-                parent = parent_hw->clk;
+                parent = parent_hw ? parent_hw->clk : NULL;
        } else if (clk->ops->round_rate) {
                new_rate = clk->ops->round_rate(clk->hw, rate,
                                                &best_parent_rate);
diff --git a/drivers/clk/rockchip/clk-cpu.c b/drivers/clk/rockchip/clk-cpu.c
index 75c8c45ef728..8539c4fd34cc 100644
--- a/drivers/clk/rockchip/clk-cpu.c
+++ b/drivers/clk/rockchip/clk-cpu.c
@@ -124,10 +124,11 @@ static int rockchip_cpuclk_pre_rate_change(struct rockchip_cpuclk *cpuclk,
 {
        const struct rockchip_cpuclk_reg_data *reg_data = cpuclk->reg_data;
        unsigned long alt_prate, alt_div;
+        unsigned long flags;
        alt_prate = clk_get_rate(cpuclk->alt_parent);
-        spin_lock(cpuclk->lock);
+        spin_lock_irqsave(cpuclk->lock, flags);
        /*
         * If the old parent clock speed is less than the clock speed
@@ -164,7 +165,7 @@ static int rockchip_cpuclk_pre_rate_change(struct rockchip_cpuclk *cpuclk,
                        cpuclk->reg_base + reg_data->core_reg);
        }
-        spin_unlock(cpuclk->lock);
+        spin_unlock_irqrestore(cpuclk->lock, flags);
        return 0;
 }
@@ -173,6 +174,7 @@ static int rockchip_cpuclk_post_rate_change(struct rockchip_cpuclk *cpuclk,
 {
        const struct rockchip_cpuclk_reg_data *reg_data = cpuclk->reg_data;
        const struct rockchip_cpuclk_rate_table *rate;
+        unsigned long flags;
        rate = rockchip_get_cpuclk_settings(cpuclk, ndata->new_rate);
        if (!rate) {
@@ -181,7 +183,7 @@ static int rockchip_cpuclk_post_rate_change(struct rockchip_cpuclk *cpuclk,
                return -EINVAL;
        }
-        spin_lock(cpuclk->lock);
+        spin_lock_irqsave(cpuclk->lock, flags);
        if (ndata->old_rate < ndata->new_rate)
                rockchip_cpuclk_set_dividers(cpuclk, rate);
@@ -201,7 +203,7 @@ static int rockchip_cpuclk_post_rate_change(struct rockchip_cpuclk *cpuclk,
        if (ndata->old_rate > ndata->new_rate)
                rockchip_cpuclk_set_dividers(cpuclk, rate);
-        spin_unlock(cpuclk->lock);
+        spin_unlock_irqrestore(cpuclk->lock, flags);
        return 0;
 }
diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
index c54078960847..7eb684c50d42 100644
--- a/drivers/clk/rockchip/clk-rk3188.c
+++ b/drivers/clk/rockchip/clk-rk3188.c
@@ -210,6 +210,17 @@ PNAME(mux_sclk_hsadc_p)		= { "hsadc_src", "hsadc_frac", "ext_hsadc" };
 PNAME(mux_mac_p)                = { "gpll", "dpll" };
 PNAME(mux_sclk_macref_p)        = { "mac_src", "ext_rmii" };
+static struct rockchip_pll_clock rk3066_pll_clks[] __initdata = {
+        [apll] = PLL(pll_rk3066, PLL_APLL, "apll", mux_pll_p, 0, RK2928_PLL_CON(0),
+                     RK2928_MODE_CON, 0, 5, 0, rk3188_pll_rates),
+        [dpll] = PLL(pll_rk3066, PLL_DPLL, "dpll", mux_pll_p, 0, RK2928_PLL_CON(4),
+                     RK2928_MODE_CON, 4, 4, 0, NULL),
+        [cpll] = PLL(pll_rk3066, PLL_CPLL, "cpll", mux_pll_p, 0, RK2928_PLL_CON(8),
+                     RK2928_MODE_CON, 8, 6, ROCKCHIP_PLL_SYNC_RATE, rk3188_pll_rates),
+        [gpll] = PLL(pll_rk3066, PLL_GPLL, "gpll", mux_pll_p, 0, RK2928_PLL_CON(12),
+                     RK2928_MODE_CON, 12, 7, ROCKCHIP_PLL_SYNC_RATE, rk3188_pll_rates),
+};
 static struct rockchip_pll_clock rk3188_pll_clks[] __initdata = {
        [apll] = PLL(pll_rk3066, PLL_APLL, "apll", mux_pll_p, 0, RK2928_PLL_CON(0),
                     RK2928_MODE_CON, 0, 6, 0, rk3188_pll_rates),
@@ -427,11 +438,11 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
        /* hclk_peri gates */
        GATE(0, "hclk_peri_axi_matrix", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(4), 0, GFLAGS),
        GATE(0, "hclk_peri_ahb_arbi", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(4), 6, GFLAGS),
-        GATE(0, "hclk_emem_peri", "hclk_peri", 0, RK2928_CLKGATE_CON(4), 7, GFLAGS),
+        GATE(0, "hclk_emem_peri", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(4), 7, GFLAGS),
        GATE(HCLK_EMAC, "hclk_emac", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 0, GFLAGS),
        GATE(HCLK_NANDC0, "hclk_nandc0", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 9, GFLAGS),
-        GATE(0, "hclk_usb_peri", "hclk_peri", 0, RK2928_CLKGATE_CON(4), 5, GFLAGS),
+        GATE(0, "hclk_usb_peri", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(4), 5, GFLAGS),
-        GATE(HCLK_OTG0, "hclk_usbotg0", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 13, GFLAGS),
+        GATE(HCLK_OTG0, "hclk_usbotg0", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(5), 13, GFLAGS),
        GATE(HCLK_HSADC, "hclk_hsadc", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 5, GFLAGS),
        GATE(HCLK_PIDF, "hclk_pidfilter", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 6, GFLAGS),
        GATE(HCLK_SDMMC, "hclk_sdmmc", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 10, GFLAGS),
@@ -592,7 +603,8 @@ static struct rockchip_clk_branch rk3066a_clk_branches[] __initdata = {
        GATE(0, "hclk_cif1", "hclk_cpu", 0, RK2928_CLKGATE_CON(6), 6, GFLAGS),
        GATE(0, "hclk_hdmi", "hclk_cpu", 0, RK2928_CLKGATE_CON(4), 14, GFLAGS),
-        GATE(HCLK_OTG1, "hclk_usbotg1", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 14, GFLAGS),
+        GATE(HCLK_OTG1, "hclk_usbotg1", "hclk_peri", CLK_IGNORE_UNUSED,
+                        RK2928_CLKGATE_CON(5), 14, GFLAGS),
        GATE(0, "aclk_cif1", "aclk_vio1", 0, RK2928_CLKGATE_CON(6), 7, GFLAGS),
@@ -680,7 +692,8 @@ static struct rockchip_clk_branch rk3188_clk_branches[] __initdata = {
        GATE(0, "hclk_imem0", "hclk_cpu", 0, RK2928_CLKGATE_CON(4), 14, GFLAGS),
        GATE(0, "hclk_imem1", "hclk_cpu", 0, RK2928_CLKGATE_CON(4), 15, GFLAGS),
-        GATE(HCLK_OTG1, "hclk_usbotg1", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 3, GFLAGS),
+        GATE(HCLK_OTG1, "hclk_usbotg1", "hclk_peri", CLK_IGNORE_UNUSED,
+                        RK2928_CLKGATE_CON(7), 3, GFLAGS),
        GATE(HCLK_HSIC, "hclk_hsic", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 4, GFLAGS),
        GATE(PCLK_TIMER3, "pclk_timer3", "pclk_cpu", 0, RK2928_CLKGATE_CON(7), 9, GFLAGS),
@@ -735,8 +748,8 @@ static void __init rk3188_common_clk_init(struct device_node *np)
 static void __init rk3066a_clk_init(struct device_node *np)
 {
        rk3188_common_clk_init(np);
-        rockchip_clk_register_plls(rk3188_pll_clks,
+        rockchip_clk_register_plls(rk3066_pll_clks,
-                                   ARRAY_SIZE(rk3188_pll_clks),
+                                   ARRAY_SIZE(rk3066_pll_clks),
                                   RK3066_GRF_SOC_STATUS);
        rockchip_clk_register_branches(rk3066a_clk_branches,
                                  ARRAY_SIZE(rk3066a_clk_branches));
diff --git a/drivers/clk/rockchip/clk-rk3288.c b/drivers/clk/rockchip/clk-rk3288.c
index ac6be7c0132d..11194b8329fe 100644
--- a/drivers/clk/rockchip/clk-rk3288.c
+++ b/drivers/clk/rockchip/clk-rk3288.c
@@ -145,20 +145,20 @@ struct rockchip_pll_rate_table rk3288_pll_rates[] = {
        }
 static struct rockchip_cpuclk_rate_table rk3288_cpuclk_rates[] __initdata = {
-        RK3288_CPUCLK_RATE(1800000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE(1800000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE(1704000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE(1704000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE(1608000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE(1608000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE(1512000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE(1512000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE(1416000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE(1416000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE(1200000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE(1200000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE(1008000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE(1008000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE( 816000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE( 816000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE( 696000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE( 696000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE( 600000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE( 600000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE( 408000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE( 408000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE( 312000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE( 312000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE( 216000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE( 216000000, 1, 3, 1, 3, 3),
-        RK3288_CPUCLK_RATE( 126000000, 2, 4, 2, 4, 4),
+        RK3288_CPUCLK_RATE( 126000000, 1, 3, 1, 3, 3),
 };
 static const struct rockchip_cpuclk_reg_data rk3288_cpuclk_data = {
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 6a79fc4f900c..095c1774592c 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -462,7 +462,7 @@ static void __init arch_counter_register(unsigned type)
        /* Register the CP15 based counter if we have one */
        if (type & ARCH_CP15_TIMER) {
-                if (arch_timer_use_virtual)
+                if (IS_ENABLED(CONFIG_ARM64) || arch_timer_use_virtual)
                        arch_timer_read_counter = arch_counter_get_cntvct;
                else
                        arch_timer_read_counter = arch_counter_get_cntpct;
diff --git a/drivers/clocksource/bcm_kona_timer.c b/drivers/clocksource/bcm_kona_timer.c
index 0595dc6c453e..f1e33d08dd83 100644
--- a/drivers/clocksource/bcm_kona_timer.c
+++ b/drivers/clocksource/bcm_kona_timer.c
@@ -68,9 +68,8 @@ static void kona_timer_disable_and_clear(void __iomem *base)
 }
 static void
-kona_timer_get_counter(void *timer_base, uint32_t *msw, uint32_t *lsw)
+kona_timer_get_counter(void __iomem *timer_base, uint32_t *msw, uint32_t *lsw)
 {
-        void __iomem *base = IOMEM(timer_base);
        int loop_limit = 4;
        /*
@@ -86,9 +85,9 @@ kona_timer_get_counter(void *timer_base, uint32_t *msw, uint32_t *lsw)
         */
        while (--loop_limit) {
-                *msw = readl(base + KONA_GPTIMER_STCHI_OFFSET);
+                *msw = readl(timer_base + KONA_GPTIMER_STCHI_OFFSET);
-                *lsw = readl(base + KONA_GPTIMER_STCLO_OFFSET);
+                *lsw = readl(timer_base + KONA_GPTIMER_STCLO_OFFSET);
-                if (*msw == readl(base + KONA_GPTIMER_STCHI_OFFSET))
+                if (*msw == readl(timer_base + KONA_GPTIMER_STCHI_OFFSET))
                        break;
        }
        if (!loop_limit) {
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index 9403061a2acc..83564c9cfdbe 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -97,8 +97,8 @@ static void exynos4_mct_write(unsigned int value, unsigned long offset)
        writel_relaxed(value, reg_base + offset);
        if (likely(offset >= EXYNOS4_MCT_L_BASE(0))) {
-                stat_addr = (offset & ~EXYNOS4_MCT_L_MASK) + MCT_L_WSTAT_OFFSET;
+                stat_addr = (offset & EXYNOS4_MCT_L_MASK) + MCT_L_WSTAT_OFFSET;
-                switch (offset & EXYNOS4_MCT_L_MASK) {
+                switch (offset & ~EXYNOS4_MCT_L_MASK) {
                case MCT_L_TCON_OFFSET:
                        mask = 1 << 3;          /* L_TCON write status */
                        break;
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 0f665b8f2461..f150ca82bfaf 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -428,7 +428,7 @@ static void sh_tmu_register_clockevent(struct sh_tmu_channel *ch,
        ced->features = CLOCK_EVT_FEAT_PERIODIC;
        ced->features |= CLOCK_EVT_FEAT_ONESHOT;
        ced->rating = 200;
-        ced->cpumask = cpumask_of(0);
+        ced->cpumask = cpu_possible_mask;
        ced->set_next_event = sh_tmu_clock_event_next;
        ced->set_mode = sh_tmu_clock_event_mode;
        ced->suspend = sh_tmu_clock_event_suspend;
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index 29b2ef5a68b9..a171fef2c2b6 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -2,6 +2,7 @@ menu "CPU Frequency scaling"
 config CPU_FREQ
        bool "CPU Frequency scaling"
+        select SRCU
        help
          CPU Frequency scaling allows you to change the clock speed of 
          CPUs on the fly. This is a nice method to save power, because 
diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
index f56147a1daed..fde97d6e31d6 100644
--- a/drivers/cpufreq/cpufreq-dt.c
+++ b/drivers/cpufreq/cpufreq-dt.c
@@ -211,6 +211,17 @@ static int cpufreq_init(struct cpufreq_policy *policy)
        /* OPPs might be populated at runtime, don't check for error here */
        of_init_opp_table(cpu_dev);
+        /*
+         * But we need OPP table to function so if it is not there let's
+         * give platform code chance to provide it for us.
+         */
+        ret = dev_pm_opp_get_opp_count(cpu_dev);
+        if (ret <= 0) {
+                pr_debug("OPP table is not ready, deferring probe\n");
+                ret = -EPROBE_DEFER;
+                goto out_free_opp;
+        }
        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
        if (!priv) {
                ret = -ENOMEM;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index a09a29c312a9..46bed4f81cde 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2028,6 +2028,12 @@ static int __cpufreq_governor(struct cpufreq_policy *policy,
        /* Don't start any governor operations if we are entering suspend */
        if (cpufreq_suspended)
                return 0;
+        /*
+         * Governor might not be initiated here if ACPI _PPC changed
+         * notification happened, so check it.
+         */
+        if (!policy->governor)
+                return -EINVAL;
        if (policy->governor->max_transition_latency &&
            policy->cpuinfo.transition_latency >
diff --git a/drivers/cpuidle/governors/ladder.c b/drivers/cpuidle/governors/ladder.c
index 37263d9a1051..401c0106ed34 100644
--- a/drivers/cpuidle/governors/ladder.c
+++ b/drivers/cpuidle/governors/ladder.c
@@ -79,12 +79,7 @@ static int ladder_select_state(struct cpuidle_driver *drv,
        last_state = &ldev->states[last_idx];
-        if (!(drv->states[last_idx].flags & CPUIDLE_FLAG_TIME_INVALID)) {
+        last_residency = cpuidle_get_last_residency(dev) - drv->states[last_idx].exit_latency;
-                last_residency = cpuidle_get_last_residency(dev) - \
-                                         drv->states[last_idx].exit_latency;
-        }
-        else
-                last_residency = last_state->threshold.promotion_time + 1;
        /* consider promotion */
        if (last_idx < drv->state_count - 1 &&
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index 659d7b0c9ebf..40580794e23d 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -396,8 +396,8 @@ static void menu_update(struct cpuidle_driver *drv, struct cpuidle_device *dev)
         * power state and occurrence of the wakeup event.
         *
         * If the entered idle state didn't support residency measurements,
-         * we are basically lost in the dark how much time passed.
+         * we use them anyway if they are short, and if long,
-         * As a compromise, assume we slept for the whole expected time.
+         * truncate to the whole expected time.
         *
         * Any measured amount of time will include the exit latency.
         * Since we are interested in when the wakeup begun, not when it
@@ -405,22 +405,17 @@ static void menu_update(struct cpuidle_driver *drv, struct cpuidle_device *dev)
         * the measured amount of time is less than the exit latency,
         * assume the state was never reached and the exit latency is 0.
         */
-        if (unlikely(target->flags & CPUIDLE_FLAG_TIME_INVALID)) {
-                /* Use timer value as is */
-                measured_us = data->next_timer_us;
-        } else {
+        /* measured value */
-                /* Use measured value */
+        measured_us = cpuidle_get_last_residency(dev);
-                measured_us = cpuidle_get_last_residency(dev);
-                /* Deduct exit latency */
+        /* Deduct exit latency */
-                if (measured_us > target->exit_latency)
+        if (measured_us > target->exit_latency)
-                        measured_us -= target->exit_latency;
+                measured_us -= target->exit_latency;
-                /* Make sure our coefficients do not exceed unity */
+        /* Make sure our coefficients do not exceed unity */
-                if (measured_us > data->next_timer_us)
+        if (measured_us > data->next_timer_us)
-                        measured_us = data->next_timer_us;
+                measured_us = data->next_timer_us;
-        }
        /* Update our correction ratio */
        new_factor = data->correction_factor[data->bucket];
diff --git a/drivers/devfreq/Kconfig b/drivers/devfreq/Kconfig
index faf4e70c42e0..3891f6781298 100644
--- a/drivers/devfreq/Kconfig
+++ b/drivers/devfreq/Kconfig
@@ -1,5 +1,6 @@
 menuconfig PM_DEVFREQ
        bool "Generic Dynamic Voltage and Frequency Scaling (DVFS) support"
+        select SRCU
        help
          A device may have a list of frequencies and voltages available.
          devfreq, a generic DVFS framework can be registered for a device
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index 380478562b7d..5c062548957c 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -1505,7 +1505,6 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
        dw->regs = chip->regs;
        chip->dw = dw;
-        pm_runtime_enable(chip->dev);
        pm_runtime_get_sync(chip->dev);
        dw_params = dma_read_byaddr(chip->regs, DW_PARAMS);
@@ -1703,7 +1702,6 @@ int dw_dma_remove(struct dw_dma_chip *chip)
        }
        pm_runtime_put_sync_suspend(chip->dev);
-        pm_runtime_disable(chip->dev);
        return 0;
 }
 EXPORT_SYMBOL_GPL(dw_dma_remove);
diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
index a630161473a4..32ea1aca7a0e 100644
--- a/drivers/dma/dw/platform.c
+++ b/drivers/dma/dw/platform.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/device.h>
 #include <linux/clk.h>
+#include <linux/pm_runtime.h>
 #include <linux/platform_device.h>
 #include <linux/dmaengine.h>
 #include <linux/dma-mapping.h>
@@ -185,6 +186,8 @@ static int dw_probe(struct platform_device *pdev)
        if (err)
                return err;
+        pm_runtime_enable(&pdev->dev);
        err = dw_dma_probe(chip, pdata);
        if (err)
                goto err_dw_dma_probe;
@@ -205,6 +208,7 @@ static int dw_probe(struct platform_device *pdev)
        return 0;
 err_dw_dma_probe:
+        pm_runtime_disable(&pdev->dev);
        clk_disable_unprepare(chip->clk);
        return err;
 }
@@ -217,6 +221,7 @@ static int dw_remove(struct platform_device *pdev)
                of_dma_controller_free(pdev->dev.of_node);
        dw_dma_remove(chip);
+        pm_runtime_disable(&pdev->dev);
        clk_disable_unprepare(chip->clk);
        return 0;
diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index f712d47f30d8..8de4da5c9ab6 100644
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -12,11 +12,11 @@ config EFI_VARS
          Note that using this driver in concert with efibootmgr requires
          at least test release version 0.5.0-test3 or later, which is
-          available from Matt Domsch's website located at:
+          available from:
          <http://linux.dell.com/efibootmgr/testing/efibootmgr-0.5.0-test3.tar.gz>
          Subsequent efibootmgr releases may be found at:
-          <http://linux.dell.com/efibootmgr>
+          <http://github.com/vathpela/efibootmgr>
 config EFI_VARS_PSTORE
        tristate "Register efivars backend for pstore"
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 9035c1b74d58..fccb464928c3 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -115,15 +115,24 @@ EFI_ATTR_SHOW(fw_vendor);
 EFI_ATTR_SHOW(runtime);
 EFI_ATTR_SHOW(config_table);
+static ssize_t fw_platform_size_show(struct kobject *kobj,
+                                     struct kobj_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", efi_enabled(EFI_64BIT) ? 64 : 32);
+}
 static struct kobj_attribute efi_attr_fw_vendor = __ATTR_RO(fw_vendor);
 static struct kobj_attribute efi_attr_runtime = __ATTR_RO(runtime);
 static struct kobj_attribute efi_attr_config_table = __ATTR_RO(config_table);
+static struct kobj_attribute efi_attr_fw_platform_size =
+        __ATTR_RO(fw_platform_size);
 static struct attribute *efi_subsys_attrs[] = {
        &efi_attr_systab.attr,
        &efi_attr_fw_vendor.attr,
        &efi_attr_runtime.attr,
        &efi_attr_config_table.attr,
+        &efi_attr_fw_platform_size.attr,
        NULL,
 };
@@ -272,15 +281,10 @@ static __init int match_config_table(efi_guid_t *guid,
                                     unsigned long table,
                                     efi_config_table_type_t *table_types)
 {
-        u8 str[EFI_VARIABLE_GUID_LEN + 1];
        int i;
        if (table_types) {
-                efi_guid_unparse(guid, str);
                for (i = 0; efi_guidcmp(table_types[i].guid, NULL_GUID); i++) {
-                        efi_guid_unparse(&table_types[i].guid, str);
                        if (!efi_guidcmp(*guid, table_types[i].guid)) {
                                *(table_types[i].ptr) = table;
                                pr_cont(" %s=0x%lx ",
@@ -403,8 +407,7 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
        u64 val;
        int i, len;
-        if (depth != 1 ||
+        if (depth != 1 || strcmp(uname, "chosen") != 0)
-            (strcmp(uname, "chosen") != 0 && strcmp(uname, "chosen@0") != 0))
                return 0;
        for (i = 0; i < ARRAY_SIZE(dt_params); i++) {
diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
index f256ecd8a176..7b2e0496e0c0 100644
--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -39,7 +39,7 @@
 *   fix locking per Peter Chubb's findings
 *
 *  25 Mar 2002 - Matt Domsch <Matt_Domsch@dell.com>
- *   move uuid_unparse() to include/asm-ia64/efi.h:efi_guid_unparse()
+ *   move uuid_unparse() to include/asm-ia64/efi.h:efi_guid_to_str()
 *
 *  12 Feb 2002 - Matt Domsch <Matt_Domsch@dell.com>
 *   use list_for_each_safe when deleting vars.
@@ -128,7 +128,7 @@ efivar_guid_read(struct efivar_entry *entry, char *buf)
        if (!entry || !buf)
                return 0;
-        efi_guid_unparse(&var->VendorGuid, str);
+        efi_guid_to_str(&var->VendorGuid, str);
        str += strlen(str);
        str += sprintf(str, "\n");
@@ -569,7 +569,7 @@ efivar_create_sysfs_entry(struct efivar_entry *new_var)
           private variables from another's.         */
        *(short_name + strlen(short_name)) = '-';
-        efi_guid_unparse(&new_var->var.VendorGuid,
+        efi_guid_to_str(&new_var->var.VendorGuid,
                         short_name + strlen(short_name));
        new_var->kobj.kset = efivars_kset;
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index b14bc2b9fb4d..8902f52e0998 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -24,3 +24,17 @@ lib-y				:= efi-stub-helper.o
 lib-$(CONFIG_EFI_ARMSTUB)       += arm-stub.o fdt.o
 CFLAGS_fdt.o                    += -I$(srctree)/scripts/dtc/libfdt/
+#
+# arm64 puts the stub in the kernel proper, which will unnecessarily retain all
+# code indefinitely unless it is annotated as __init/__initdata/__initconst etc.
+# So let's apply the __init annotations at the section level, by prefixing
+# the section names directly. This will ensure that even all the inline string
+# literals are covered.
+#
+extra-$(CONFIG_ARM64)           := $(lib-y)
+lib-$(CONFIG_ARM64)             := $(patsubst %.o,%.init.o,$(lib-y))
+OBJCOPYFLAGS := --prefix-alloc-sections=.init
+$(obj)/%.init.o: $(obj)/%.o FORCE
+        $(call if_changed,objcopy)
diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index eb48a1a1a576..2b3814702dcf 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -17,10 +17,10 @@
 #include "efistub.h"
-static int __init efi_secureboot_enabled(efi_system_table_t *sys_table_arg)
+static int efi_secureboot_enabled(efi_system_table_t *sys_table_arg)
 {
-        static efi_guid_t const var_guid __initconst = EFI_GLOBAL_VARIABLE_GUID;
+        static efi_guid_t const var_guid = EFI_GLOBAL_VARIABLE_GUID;
-        static efi_char16_t const var_name[] __initconst = {
+        static efi_char16_t const var_name[] = {
                'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0 };
        efi_get_variable_t *f_getvar = sys_table_arg->runtime->get_variable;
@@ -164,7 +164,7 @@ efi_status_t handle_kernel_image(efi_system_table_t *sys_table,
 * for both archictectures, with the arch-specific code provided in the
 * handle_kernel_image() function.
 */
-unsigned long __init efi_entry(void *handle, efi_system_table_t *sys_table,
+unsigned long efi_entry(void *handle, efi_system_table_t *sys_table,
                               unsigned long *image_addr)
 {
        efi_loaded_image_t *image;
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index a920fec8fe88..d073e3946383 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -66,25 +66,29 @@ efi_status_t efi_get_memory_map(efi_system_table_t *sys_table_arg,
        unsigned long key;
        u32 desc_version;
-        *map_size = sizeof(*m) * 32;
+        *map_size = 0;
-again:
+        *desc_size = 0;
+        key = 0;
+        status = efi_call_early(get_memory_map, map_size, NULL,
+                                &key, desc_size, &desc_version);
+        if (status != EFI_BUFFER_TOO_SMALL)
+                return EFI_LOAD_ERROR;
        /*
         * Add an additional efi_memory_desc_t because we're doing an
         * allocation which may be in a new descriptor region.
         */
-        *map_size += sizeof(*m);
+        *map_size += *desc_size;
        status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
                                *map_size, (void **)&m);
        if (status != EFI_SUCCESS)
                goto fail;
-        *desc_size = 0;
-        key = 0;
        status = efi_call_early(get_memory_map, map_size, m,
                                &key, desc_size, &desc_version);
        if (status == EFI_BUFFER_TOO_SMALL) {
                efi_call_early(free_pool, m);
-                goto again;
+                return EFI_LOAD_ERROR;
        }
        if (status != EFI_SUCCESS)
@@ -101,7 +105,7 @@ fail:
 }
-unsigned long __init get_dram_base(efi_system_table_t *sys_table_arg)
+unsigned long get_dram_base(efi_system_table_t *sys_table_arg)
 {
        efi_status_t status;
        unsigned long map_size;
diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c
index 018c29a26615..87b8e3b900d2 100644
--- a/drivers/firmware/efi/runtime-map.c
+++ b/drivers/firmware/efi/runtime-map.c
@@ -191,7 +191,7 @@ int __init efi_runtime_map_init(struct kobject *efi_kobj)
        return 0;
 out_add_entry:
-        for (j = i - 1; j > 0; j--) {
+        for (j = i - 1; j >= 0; j--) {
                entry = *(map_entries + j);
                kobject_put(&entry->kobj);
        }
diff --git a/drivers/gpio/gpio-crystalcove.c b/drivers/gpio/gpio-crystalcove.c
index 55d4803d71b0..3d9e08f7e823 100644
--- a/drivers/gpio/gpio-crystalcove.c
+++ b/drivers/gpio/gpio-crystalcove.c
@@ -272,7 +272,7 @@ static irqreturn_t crystalcove_gpio_irq_handler(int irq, void *data)
        for (gpio = 0; gpio < CRYSTALCOVE_GPIO_NUM; gpio++) {
                if (pending & BIT(gpio)) {
                        virq = irq_find_mapping(cg->chip.irqdomain, gpio);
-                        generic_handle_irq(virq);
+                        handle_nested_irq(virq);
                }
        }
diff --git a/drivers/gpio/gpio-dln2.c b/drivers/gpio/gpio-dln2.c
index 978b51eae2ec..ce3c1558cb0a 100644
--- a/drivers/gpio/gpio-dln2.c
+++ b/drivers/gpio/gpio-dln2.c
@@ -47,13 +47,6 @@
 #define DLN2_GPIO_MAX_PINS 32
-struct dln2_irq_work {
-        struct work_struct work;
-        struct dln2_gpio *dln2;
-        int pin;
-        int type;
-};
 struct dln2_gpio {
        struct platform_device *pdev;
        struct gpio_chip gpio;
@@ -64,10 +57,12 @@ struct dln2_gpio {
         */
        DECLARE_BITMAP(output_enabled, DLN2_GPIO_MAX_PINS);
-        DECLARE_BITMAP(irqs_masked, DLN2_GPIO_MAX_PINS);
+        /* active IRQs - not synced to hardware */
-        DECLARE_BITMAP(irqs_enabled, DLN2_GPIO_MAX_PINS);
+        DECLARE_BITMAP(unmasked_irqs, DLN2_GPIO_MAX_PINS);
-        DECLARE_BITMAP(irqs_pending, DLN2_GPIO_MAX_PINS);
+        /* active IRQS - synced to hardware */
-        struct dln2_irq_work *irq_work;
+        DECLARE_BITMAP(enabled_irqs, DLN2_GPIO_MAX_PINS);
+        int irq_type[DLN2_GPIO_MAX_PINS];
+        struct mutex irq_lock;
 };
 struct dln2_gpio_pin {
@@ -141,16 +136,16 @@ static int dln2_gpio_pin_get_out_val(struct dln2_gpio *dln2, unsigned int pin)
        return !!ret;
 }
-static void dln2_gpio_pin_set_out_val(struct dln2_gpio *dln2,
+static int dln2_gpio_pin_set_out_val(struct dln2_gpio *dln2,
-                                      unsigned int pin, int value)
+                                     unsigned int pin, int value)
 {
        struct dln2_gpio_pin_val req = {
                .pin = cpu_to_le16(pin),
                .value = value,
        };
-        dln2_transfer_tx(dln2->pdev, DLN2_GPIO_PIN_SET_OUT_VAL, &req,
+        return dln2_transfer_tx(dln2->pdev, DLN2_GPIO_PIN_SET_OUT_VAL, &req,
-                         sizeof(req));
+                                sizeof(req));
 }
 #define DLN2_GPIO_DIRECTION_IN          0
@@ -267,6 +262,13 @@ static int dln2_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 static int dln2_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
                                      int value)
 {
+        struct dln2_gpio *dln2 = container_of(chip, struct dln2_gpio, gpio);
+        int ret;
+        ret = dln2_gpio_pin_set_out_val(dln2, offset, value);
+        if (ret < 0)
+                return ret;
        return dln2_gpio_set_direction(chip, offset, DLN2_GPIO_DIRECTION_OUT);
 }
@@ -297,36 +299,13 @@ static int dln2_gpio_set_event_cfg(struct dln2_gpio *dln2, unsigned pin,
                                &req, sizeof(req));
 }
-static void dln2_irq_work(struct work_struct *w)
+static void dln2_irq_unmask(struct irq_data *irqd)
-{
-        struct dln2_irq_work *iw = container_of(w, struct dln2_irq_work, work);
-        struct dln2_gpio *dln2 = iw->dln2;
-        u8 type = iw->type & DLN2_GPIO_EVENT_MASK;
-        if (test_bit(iw->pin, dln2->irqs_enabled))
-                dln2_gpio_set_event_cfg(dln2, iw->pin, type, 0);
-        else
-                dln2_gpio_set_event_cfg(dln2, iw->pin, DLN2_GPIO_EVENT_NONE, 0);
-}
-static void dln2_irq_enable(struct irq_data *irqd)
-{
-        struct gpio_chip *gc = irq_data_get_irq_chip_data(irqd);
-        struct dln2_gpio *dln2 = container_of(gc, struct dln2_gpio, gpio);
-        int pin = irqd_to_hwirq(irqd);
-        set_bit(pin, dln2->irqs_enabled);
-        schedule_work(&dln2->irq_work[pin].work);
-}
-static void dln2_irq_disable(struct irq_data *irqd)
 {
        struct gpio_chip *gc = irq_data_get_irq_chip_data(irqd);
        struct dln2_gpio *dln2 = container_of(gc, struct dln2_gpio, gpio);
        int pin = irqd_to_hwirq(irqd);
-        clear_bit(pin, dln2->irqs_enabled);
+        set_bit(pin, dln2->unmasked_irqs);
-        schedule_work(&dln2->irq_work[pin].work);
 }
 static void dln2_irq_mask(struct irq_data *irqd)
@@ -335,27 +314,7 @@ static void dln2_irq_mask(struct irq_data *irqd)
        struct dln2_gpio *dln2 = container_of(gc, struct dln2_gpio, gpio);
        int pin = irqd_to_hwirq(irqd);
-        set_bit(pin, dln2->irqs_masked);
+        clear_bit(pin, dln2->unmasked_irqs);
-}
-static void dln2_irq_unmask(struct irq_data *irqd)
-{
-        struct gpio_chip *gc = irq_data_get_irq_chip_data(irqd);
-        struct dln2_gpio *dln2 = container_of(gc, struct dln2_gpio, gpio);
-        struct device *dev = dln2->gpio.dev;
-        int pin = irqd_to_hwirq(irqd);
-        if (test_and_clear_bit(pin, dln2->irqs_pending)) {
-                int irq;
-                irq = irq_find_mapping(dln2->gpio.irqdomain, pin);
-                if (!irq) {
-                        dev_err(dev, "pin %d not mapped to IRQ\n", pin);
-                        return;
-                }
-                generic_handle_irq(irq);
-        }
 }
 static int dln2_irq_set_type(struct irq_data *irqd, unsigned type)
@@ -366,19 +325,19 @@ static int dln2_irq_set_type(struct irq_data *irqd, unsigned type)
        switch (type) {
        case IRQ_TYPE_LEVEL_HIGH:
-                dln2->irq_work[pin].type = DLN2_GPIO_EVENT_LVL_HIGH;
+                dln2->irq_type[pin] = DLN2_GPIO_EVENT_LVL_HIGH;
                break;
        case IRQ_TYPE_LEVEL_LOW:
-                dln2->irq_work[pin].type = DLN2_GPIO_EVENT_LVL_LOW;
+                dln2->irq_type[pin] = DLN2_GPIO_EVENT_LVL_LOW;
                break;
        case IRQ_TYPE_EDGE_BOTH:
-                dln2->irq_work[pin].type = DLN2_GPIO_EVENT_CHANGE;
+                dln2->irq_type[pin] = DLN2_GPIO_EVENT_CHANGE;
                break;
        case IRQ_TYPE_EDGE_RISING:
-                dln2->irq_work[pin].type = DLN2_GPIO_EVENT_CHANGE_RISING;
+                dln2->irq_type[pin] = DLN2_GPIO_EVENT_CHANGE_RISING;
                break;
        case IRQ_TYPE_EDGE_FALLING:
-                dln2->irq_work[pin].type = DLN2_GPIO_EVENT_CHANGE_FALLING;
+                dln2->irq_type[pin] = DLN2_GPIO_EVENT_CHANGE_FALLING;
                break;
        default:
                return -EINVAL;
@@ -387,13 +346,50 @@ static int dln2_irq_set_type(struct irq_data *irqd, unsigned type)
        return 0;
 }
+static void dln2_irq_bus_lock(struct irq_data *irqd)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(irqd);
+        struct dln2_gpio *dln2 = container_of(gc, struct dln2_gpio, gpio);
+        mutex_lock(&dln2->irq_lock);
+}
+static void dln2_irq_bus_unlock(struct irq_data *irqd)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(irqd);
+        struct dln2_gpio *dln2 = container_of(gc, struct dln2_gpio, gpio);
+        int pin = irqd_to_hwirq(irqd);
+        int enabled, unmasked;
+        unsigned type;
+        int ret;
+        enabled = test_bit(pin, dln2->enabled_irqs);
+        unmasked = test_bit(pin, dln2->unmasked_irqs);
+        if (enabled != unmasked) {
+                if (unmasked) {
+                        type = dln2->irq_type[pin] & DLN2_GPIO_EVENT_MASK;
+                        set_bit(pin, dln2->enabled_irqs);
+                } else {
+                        type = DLN2_GPIO_EVENT_NONE;
+                        clear_bit(pin, dln2->enabled_irqs);
+                }
+                ret = dln2_gpio_set_event_cfg(dln2, pin, type, 0);
+                if (ret)
+                        dev_err(dln2->gpio.dev, "failed to set event\n");
+        }
+        mutex_unlock(&dln2->irq_lock);
+}
 static struct irq_chip dln2_gpio_irqchip = {
        .name = "dln2-irq",
-        .irq_enable = dln2_irq_enable,
-        .irq_disable = dln2_irq_disable,
        .irq_mask = dln2_irq_mask,
        .irq_unmask = dln2_irq_unmask,
        .irq_set_type = dln2_irq_set_type,
+        .irq_bus_lock = dln2_irq_bus_lock,
+        .irq_bus_sync_unlock = dln2_irq_bus_unlock,
 };
 static void dln2_gpio_event(struct platform_device *pdev, u16 echo,
@@ -425,14 +421,7 @@ static void dln2_gpio_event(struct platform_device *pdev, u16 echo,
                return;
        }
-        if (!test_bit(pin, dln2->irqs_enabled))
+        switch (dln2->irq_type[pin]) {
-                return;
-        if (test_bit(pin, dln2->irqs_masked)) {
-                set_bit(pin, dln2->irqs_pending);
-                return;
-        }
-        switch (dln2->irq_work[pin].type) {
        case DLN2_GPIO_EVENT_CHANGE_RISING:
                if (event->value)
                        generic_handle_irq(irq);
@@ -451,7 +440,7 @@ static int dln2_gpio_probe(struct platform_device *pdev)
        struct dln2_gpio *dln2;
        struct device *dev = &pdev->dev;
        int pins;
-        int i, ret;
+        int ret;
        pins = dln2_gpio_get_pin_count(pdev);
        if (pins < 0) {
@@ -467,15 +456,7 @@ static int dln2_gpio_probe(struct platform_device *pdev)
        if (!dln2)
                return -ENOMEM;
-        dln2->irq_work = devm_kcalloc(&pdev->dev, pins,
+        mutex_init(&dln2->irq_lock);
-                                      sizeof(struct dln2_irq_work), GFP_KERNEL);
-        if (!dln2->irq_work)
-                return -ENOMEM;
-        for (i = 0; i < pins; i++) {
-                INIT_WORK(&dln2->irq_work[i].work, dln2_irq_work);
-                dln2->irq_work[i].pin = i;
-                dln2->irq_work[i].dln2 = dln2;
-        }
        dln2->pdev = pdev;
@@ -529,11 +510,8 @@ out:
 static int dln2_gpio_remove(struct platform_device *pdev)
 {
        struct dln2_gpio *dln2 = platform_get_drvdata(pdev);
-        int i;
        dln2_unregister_event_cb(pdev, DLN2_GPIO_CONDITION_MET_EV);
-        for (i = 0; i < dln2->gpio.ngpio; i++)
-                flush_work(&dln2->irq_work[i].work);
        gpiochip_remove(&dln2->gpio);
        return 0;
diff --git a/drivers/gpio/gpio-grgpio.c b/drivers/gpio/gpio-grgpio.c
index 09daaf2aeb56..3a5a71050559 100644
--- a/drivers/gpio/gpio-grgpio.c
+++ b/drivers/gpio/gpio-grgpio.c
@@ -441,7 +441,8 @@ static int grgpio_probe(struct platform_device *ofdev)
        err = gpiochip_add(gc);
        if (err) {
                dev_err(&ofdev->dev, "Could not add gpiochip\n");
-                irq_domain_remove(priv->domain);
+                if (priv->domain)
+                        irq_domain_remove(priv->domain);
                return err;
        }
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index da9c316059bc..eea5d7e578c9 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -801,9 +801,11 @@ static int mcp230xx_probe(struct i2c_client *client,
                client->irq = irq_of_parse_and_map(client->dev.of_node, 0);
        } else {
                pdata = dev_get_platdata(&client->dev);
-                if (!pdata || !gpio_is_valid(pdata->base)) {
+                if (!pdata) {
-                        dev_dbg(&client->dev, "invalid platform data\n");
+                        pdata = devm_kzalloc(&client->dev,
-                        return -EINVAL;
+                                        sizeof(struct mcp23s08_platform_data),
+                                        GFP_KERNEL);
+                        pdata->base = -1;
                }
        }
@@ -924,10 +926,11 @@ static int mcp23s08_probe(struct spi_device *spi)
        } else {
                type = spi_get_device_id(spi)->driver_data;
                pdata = dev_get_platdata(&spi->dev);
-                if (!pdata || !gpio_is_valid(pdata->base)) {
+                if (!pdata) {
-                        dev_dbg(&spi->dev,
+                        pdata = devm_kzalloc(&spi->dev,
-                                        "invalid or missing platform data\n");
+                                        sizeof(struct mcp23s08_platform_data),
-                        return -EINVAL;
+                                        GFP_KERNEL);
+                        pdata->base = -1;
                }
                for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++) {
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 30646cfe0efa..f476ae2eb0b3 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -88,6 +88,8 @@ struct gpio_bank {
 #define BANK_USED(bank) (bank->mod_usage || bank->irq_usage)
 #define LINE_USED(line, offset) (line & (BIT(offset)))
+static void omap_gpio_unmask_irq(struct irq_data *d);
 static int omap_irq_to_gpio(struct gpio_bank *bank, unsigned int gpio_irq)
 {
        return bank->chip.base + gpio_irq;
@@ -477,6 +479,16 @@ static int omap_gpio_is_input(struct gpio_bank *bank, int mask)
        return readl_relaxed(reg) & mask;
 }
+static void omap_gpio_init_irq(struct gpio_bank *bank, unsigned gpio,
+                               unsigned offset)
+{
+        if (!LINE_USED(bank->mod_usage, offset)) {
+                omap_enable_gpio_module(bank, offset);
+                omap_set_gpio_direction(bank, offset, 1);
+        }
+        bank->irq_usage |= BIT(GPIO_INDEX(bank, gpio));
+}
 static int omap_gpio_irq_type(struct irq_data *d, unsigned type)
 {
        struct gpio_bank *bank = omap_irq_data_get_bank(d);
@@ -506,15 +518,11 @@ static int omap_gpio_irq_type(struct irq_data *d, unsigned type)
        spin_lock_irqsave(&bank->lock, flags);
        offset = GPIO_INDEX(bank, gpio);
        retval = omap_set_gpio_triggering(bank, offset, type);
-        if (!LINE_USED(bank->mod_usage, offset)) {
+        omap_gpio_init_irq(bank, gpio, offset);
-                omap_enable_gpio_module(bank, offset);
+        if (!omap_gpio_is_input(bank, BIT(offset))) {
-                omap_set_gpio_direction(bank, offset, 1);
-        } else if (!omap_gpio_is_input(bank, BIT(offset))) {
                spin_unlock_irqrestore(&bank->lock, flags);
                return -EINVAL;
        }
-        bank->irq_usage |= BIT(GPIO_INDEX(bank, gpio));
        spin_unlock_irqrestore(&bank->lock, flags);
        if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
@@ -792,6 +800,24 @@ exit:
        pm_runtime_put(bank->dev);
 }
+static unsigned int omap_gpio_irq_startup(struct irq_data *d)
+{
+        struct gpio_bank *bank = omap_irq_data_get_bank(d);
+        unsigned int gpio = omap_irq_to_gpio(bank, d->hwirq);
+        unsigned long flags;
+        unsigned offset = GPIO_INDEX(bank, gpio);
+        if (!BANK_USED(bank))
+                pm_runtime_get_sync(bank->dev);
+        spin_lock_irqsave(&bank->lock, flags);
+        omap_gpio_init_irq(bank, gpio, offset);
+        spin_unlock_irqrestore(&bank->lock, flags);
+        omap_gpio_unmask_irq(d);
+        return 0;
+}
 static void omap_gpio_irq_shutdown(struct irq_data *d)
 {
        struct gpio_bank *bank = omap_irq_data_get_bank(d);
@@ -1181,6 +1207,7 @@ static int omap_gpio_probe(struct platform_device *pdev)
        if (!irqc)
                return -ENOMEM;
+        irqc->irq_startup = omap_gpio_irq_startup,
        irqc->irq_shutdown = omap_gpio_irq_shutdown,
        irqc->irq_ack = omap_gpio_ack_irq,
        irqc->irq_mask = omap_gpio_mask_irq,
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 604dbe60bdee..08261f2b3a82 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -45,8 +45,14 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data)
                return false;
        ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags);
-        if (ret < 0)
+        if (ret < 0) {
-                return false;
+                /* We've found the gpio chip, but the translation failed.
+                 * Return true to stop looking and return the translation
+                 * error via out_gpio
+                 */
+                gg_data->out_gpio = ERR_PTR(ret);
+                return true;
+         }
        gg_data->out_gpio = gpiochip_get_desc(gc, ret);
        return true;
diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
index 2ac1800b58bb..7722ed53bd65 100644
--- a/drivers/gpio/gpiolib-sysfs.c
+++ b/drivers/gpio/gpiolib-sysfs.c
@@ -128,7 +128,7 @@ static ssize_t gpio_value_store(struct device *dev,
        return status;
 }
-static const DEVICE_ATTR(value, 0644,
+static DEVICE_ATTR(value, 0644,
                gpio_value_show, gpio_value_store);
 static irqreturn_t gpio_sysfs_irq(int irq, void *priv)
@@ -353,17 +353,46 @@ static ssize_t gpio_active_low_store(struct device *dev,
        return status ? : size;
 }
-static const DEVICE_ATTR(active_low, 0644,
+static DEVICE_ATTR(active_low, 0644,
                gpio_active_low_show, gpio_active_low_store);
-static const struct attribute *gpio_attrs[] = {
+static umode_t gpio_is_visible(struct kobject *kobj, struct attribute *attr,
+                               int n)
+{
+        struct device *dev = container_of(kobj, struct device, kobj);
+        struct gpio_desc *desc = dev_get_drvdata(dev);
+        umode_t mode = attr->mode;
+        bool show_direction = test_bit(FLAG_SYSFS_DIR, &desc->flags);
+        if (attr == &dev_attr_direction.attr) {
+                if (!show_direction)
+                        mode = 0;
+        } else if (attr == &dev_attr_edge.attr) {
+                if (gpiod_to_irq(desc) < 0)
+                        mode = 0;
+                if (!show_direction && test_bit(FLAG_IS_OUT, &desc->flags))
+                        mode = 0;
+        }
+        return mode;
+}
+static struct attribute *gpio_attrs[] = {
+        &dev_attr_direction.attr,
+        &dev_attr_edge.attr,
        &dev_attr_value.attr,
        &dev_attr_active_low.attr,
        NULL,
 };
-static const struct attribute_group gpio_attr_group = {
+static const struct attribute_group gpio_group = {
-        .attrs = (struct attribute **) gpio_attrs,
+        .attrs = gpio_attrs,
+        .is_visible = gpio_is_visible,
+};
+static const struct attribute_group *gpio_groups[] = {
+        &gpio_group,
+        NULL
 };
 /*
@@ -400,16 +429,13 @@ static ssize_t chip_ngpio_show(struct device *dev,
 }
 static DEVICE_ATTR(ngpio, 0444, chip_ngpio_show, NULL);
-static const struct attribute *gpiochip_attrs[] = {
+static struct attribute *gpiochip_attrs[] = {
        &dev_attr_base.attr,
        &dev_attr_label.attr,
        &dev_attr_ngpio.attr,
        NULL,
 };
+ATTRIBUTE_GROUPS(gpiochip);
-static const struct attribute_group gpiochip_attr_group = {
-        .attrs = (struct attribute **) gpiochip_attrs,
-};
 /*
 * /sys/class/gpio/export ... write-only
@@ -556,45 +582,30 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
                goto fail_unlock;
        }
-        if (!desc->chip->direction_input || !desc->chip->direction_output)
+        if (desc->chip->direction_input && desc->chip->direction_output &&
-                direction_may_change = false;
+                        direction_may_change) {
+                set_bit(FLAG_SYSFS_DIR, &desc->flags);
+        }
        spin_unlock_irqrestore(&gpio_lock, flags);
        offset = gpio_chip_hwgpio(desc);
        if (desc->chip->names && desc->chip->names[offset])
                ioname = desc->chip->names[offset];
-        dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0),
+        dev = device_create_with_groups(&gpio_class, desc->chip->dev,
-                            desc, ioname ? ioname : "gpio%u",
+                                        MKDEV(0, 0), desc, gpio_groups,
-                            desc_to_gpio(desc));
+                                        ioname ? ioname : "gpio%u",
+                                        desc_to_gpio(desc));
        if (IS_ERR(dev)) {
                status = PTR_ERR(dev);
                goto fail_unlock;
        }
-        status = sysfs_create_group(&dev->kobj, &gpio_attr_group);
-        if (status)
-                goto fail_unregister_device;
-        if (direction_may_change) {
-                status = device_create_file(dev, &dev_attr_direction);
-                if (status)
-                        goto fail_unregister_device;
-        }
-        if (gpiod_to_irq(desc) >= 0 && (direction_may_change ||
-                                       !test_bit(FLAG_IS_OUT, &desc->flags))) {
-                status = device_create_file(dev, &dev_attr_edge);
-                if (status)
-                        goto fail_unregister_device;
-        }
        set_bit(FLAG_EXPORT, &desc->flags);
        mutex_unlock(&sysfs_lock);
        return 0;
-fail_unregister_device:
-        device_unregister(dev);
 fail_unlock:
        mutex_unlock(&sysfs_lock);
        gpiod_dbg(desc, "%s: status %d\n", __func__, status);
@@ -637,6 +648,7 @@ int gpiod_export_link(struct device *dev, const char *name,
                if (tdev != NULL) {
                        status = sysfs_create_link(&dev->kobj, &tdev->kobj,
                                                name);
+                        put_device(tdev);
                } else {
                        status = -ENODEV;
                }
@@ -684,7 +696,7 @@ int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value)
        }
        status = sysfs_set_active_low(desc, dev, value);
+        put_device(dev);
 unlock:
        mutex_unlock(&sysfs_lock);
@@ -718,6 +730,7 @@ void gpiod_unexport(struct gpio_desc *desc)
                dev = class_find_device(&gpio_class, NULL, desc, match_export);
                if (dev) {
                        gpio_setup_irq(desc, dev, 0);
+                        clear_bit(FLAG_SYSFS_DIR, &desc->flags);
                        clear_bit(FLAG_EXPORT, &desc->flags);
                } else
                        status = -ENODEV;
@@ -750,13 +763,13 @@ int gpiochip_export(struct gpio_chip *chip)
        /* use chip->base for the ID; it's already known to be unique */
        mutex_lock(&sysfs_lock);
-        dev = device_create(&gpio_class, chip->dev, MKDEV(0, 0), chip,
+        dev = device_create_with_groups(&gpio_class, chip->dev, MKDEV(0, 0),
-                                "gpiochip%d", chip->base);
+                                        chip, gpiochip_groups,
-        if (!IS_ERR(dev)) {
+                                        "gpiochip%d", chip->base);
-                status = sysfs_create_group(&dev->kobj,
+        if (IS_ERR(dev))
-                                &gpiochip_attr_group);
-        } else
                status = PTR_ERR(dev);
+        else
+                status = 0;
        chip->exported = (status == 0);
        mutex_unlock(&sysfs_lock);
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 487afe6f22fc..568aa2b6bdb0 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -248,29 +248,30 @@ int gpiochip_add(struct gpio_chip *chip)
                base = gpiochip_find_base(chip->ngpio);
                if (base < 0) {
                        status = base;
-                        goto unlock;
+                        spin_unlock_irqrestore(&gpio_lock, flags);
+                        goto err_free_descs;
                }
                chip->base = base;
        }
        status = gpiochip_add_to_list(chip);
+        if (status) {
+                spin_unlock_irqrestore(&gpio_lock, flags);
+                goto err_free_descs;
+        }
-        if (status == 0) {
+        for (id = 0; id < chip->ngpio; id++) {
-                for (id = 0; id < chip->ngpio; id++) {
+                struct gpio_desc *desc = &descs[id];
-                        struct gpio_desc *desc = &descs[id];
-                        desc->chip = chip;
+                desc->chip = chip;
-                        /* REVISIT:  most hardware initializes GPIOs as
+                /* REVISIT: most hardware initializes GPIOs as inputs (often
-                         * inputs (often with pullups enabled) so power
+                 * with pullups enabled) so power usage is minimized. Linux
-                         * usage is minimized.  Linux code should set the
+                 * code should set the gpio direction first thing; but until
-                         * gpio direction first thing; but until it does,
+                 * it does, and in case chip->get_direction is not set, we may
-                         * and in case chip->get_direction is not set,
+                 * expose the wrong direction in sysfs.
-                         * we may expose the wrong direction in sysfs.
+                 */
-                         */
+                desc->flags = !chip->direction_input ? (1 << FLAG_IS_OUT) : 0;
-                        desc->flags = !chip->direction_input
-                                ? (1 << FLAG_IS_OUT)
-                                : 0;
-                }
        }
        chip->desc = descs;
@@ -284,12 +285,9 @@ int gpiochip_add(struct gpio_chip *chip)
        of_gpiochip_add(chip);
        acpi_gpiochip_add(chip);
-        if (status)
-                goto fail;
        status = gpiochip_export(chip);
        if (status)
-                goto fail;
+                goto err_remove_chip;
        pr_debug("%s: registered GPIOs %d to %d on device: %s\n", __func__,
                chip->base, chip->base + chip->ngpio - 1,
@@ -297,11 +295,15 @@ int gpiochip_add(struct gpio_chip *chip)
        return 0;
-unlock:
+err_remove_chip:
+        acpi_gpiochip_remove(chip);
+        of_gpiochip_remove(chip);
+        spin_lock_irqsave(&gpio_lock, flags);
+        list_del(&chip->list);
        spin_unlock_irqrestore(&gpio_lock, flags);
-fail:
-        kfree(descs);
        chip->desc = NULL;
+err_free_descs:
+        kfree(descs);
        /* failures here can mean systems won't boot... */
        pr_err("%s: GPIOs %d..%d (%s) failed to register\n", __func__,
@@ -325,14 +327,15 @@ void gpiochip_remove(struct gpio_chip *chip)
        unsigned long   flags;
        unsigned        id;
-        acpi_gpiochip_remove(chip);
+        gpiochip_unexport(chip);
-        spin_lock_irqsave(&gpio_lock, flags);
        gpiochip_irqchip_remove(chip);
+        acpi_gpiochip_remove(chip);
        gpiochip_remove_pin_ranges(chip);
        of_gpiochip_remove(chip);
+        spin_lock_irqsave(&gpio_lock, flags);
        for (id = 0; id < chip->ngpio; id++) {
                if (test_bit(FLAG_REQUESTED, &chip->desc[id].flags))
                        dev_crit(chip->dev, "REMOVING GPIOCHIP WITH GPIOS STILL REQUESTED\n");
@@ -342,7 +345,6 @@ void gpiochip_remove(struct gpio_chip *chip)
        list_del(&chip->list);
        spin_unlock_irqrestore(&gpio_lock, flags);
-        gpiochip_unexport(chip);
        kfree(chip->desc);
        chip->desc = NULL;
diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
index e3a52113a541..550a5eafbd38 100644
--- a/drivers/gpio/gpiolib.h
+++ b/drivers/gpio/gpiolib.h
@@ -77,6 +77,7 @@ struct gpio_desc {
 #define FLAG_OPEN_DRAIN 7       /* Gpio is open drain type */
 #define FLAG_OPEN_SOURCE 8      /* Gpio is open source type */
 #define FLAG_USED_AS_IRQ 9      /* GPIO is connected to an IRQ */
+#define FLAG_SYSFS_DIR  10      /* show sysfs direction attribute */
 #define ID_SHIFT        16      /* add new flags before this one */
diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile
index 66e40398b3d3..e620807418ea 100644
--- a/drivers/gpu/drm/Makefile
+++ b/drivers/gpu/drm/Makefile
@@ -37,6 +37,7 @@ obj-$(CONFIG_DRM_MIPI_DSI) += drm_mipi_dsi.o
 obj-$(CONFIG_DRM_TTM)   += ttm/
 obj-$(CONFIG_DRM_TDFX)  += tdfx/
 obj-$(CONFIG_DRM_R128)  += r128/
+obj-$(CONFIG_HSA_AMD) += amd/amdkfd/
 obj-$(CONFIG_DRM_RADEON)+= radeon/
 obj-$(CONFIG_DRM_MGA)   += mga/
 obj-$(CONFIG_DRM_I810)  += i810/
@@ -67,4 +68,3 @@ obj-$(CONFIG_DRM_IMX) += imx/
 obj-y                   += i2c/
 obj-y                   += panel/
 obj-y                   += bridge/
-obj-$(CONFIG_HSA_AMD) += amd/amdkfd/
diff --git a/drivers/gpu/drm/amd/amdkfd/Makefile b/drivers/gpu/drm/amd/amdkfd/Makefile
index be6246de5091..307a309110e6 100644
--- a/drivers/gpu/drm/amd/amdkfd/Makefile
+++ b/drivers/gpu/drm/amd/amdkfd/Makefile
@@ -8,7 +8,6 @@ amdkfd-y	:= kfd_module.o kfd_device.o kfd_chardev.o kfd_topology.o \
                kfd_pasid.o kfd_doorbell.o kfd_flat_memory.o \
                kfd_process.o kfd_queue.o kfd_mqd_manager.o \
                kfd_kernel_queue.o kfd_packet_manager.o \
-                kfd_process_queue_manager.o kfd_device_queue_manager.o \
+                kfd_process_queue_manager.o kfd_device_queue_manager.o
-                kfd_interrupt.o
 obj-$(CONFIG_HSA_AMD)   += amdkfd.o
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 4f7b275f2f7b..fcfdf23e1913 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -31,7 +31,6 @@
 #include <uapi/linux/kfd_ioctl.h>
 #include <linux/time.h>
 #include <linux/mm.h>
-#include <linux/uaccess.h>
 #include <uapi/asm-generic/mman-common.h>
 #include <asm/processor.h>
 #include "kfd_priv.h"
@@ -121,27 +120,20 @@ static int kfd_open(struct inode *inode, struct file *filep)
        if (IS_ERR(process))
                return PTR_ERR(process);
-        process->is_32bit_user_mode = is_32bit_user_mode;
        dev_dbg(kfd_device, "process %d opened, compat mode (32 bit) - %d\n",
                process->pasid, process->is_32bit_user_mode);
-        kfd_init_apertures(process);
        return 0;
 }
-static long kfd_ioctl_get_version(struct file *filep, struct kfd_process *p,
+static int kfd_ioctl_get_version(struct file *filep, struct kfd_process *p,
-                                        void __user *arg)
+                                        void *data)
 {
-        struct kfd_ioctl_get_version_args args;
+        struct kfd_ioctl_get_version_args *args = data;
        int err = 0;
-        args.major_version = KFD_IOCTL_MAJOR_VERSION;
+        args->major_version = KFD_IOCTL_MAJOR_VERSION;
-        args.minor_version = KFD_IOCTL_MINOR_VERSION;
+        args->minor_version = KFD_IOCTL_MINOR_VERSION;
-        if (copy_to_user(arg, &args, sizeof(args)))
-                err = -EFAULT;
        return err;
 }
@@ -225,10 +217,10 @@ static int set_queue_properties_from_user(struct queue_properties *q_properties,
        return 0;
 }
-static long kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
+static int kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
-                                        void __user *arg)
+                                        void *data)
 {
-        struct kfd_ioctl_create_queue_args args;
+        struct kfd_ioctl_create_queue_args *args = data;
        struct kfd_dev *dev;
        int err = 0;
        unsigned int queue_id;
@@ -237,16 +229,13 @@ static long kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
        memset(&q_properties, 0, sizeof(struct queue_properties));
-        if (copy_from_user(&args, arg, sizeof(args)))
-                return -EFAULT;
        pr_debug("kfd: creating queue ioctl\n");
-        err = set_queue_properties_from_user(&q_properties, &args);
+        err = set_queue_properties_from_user(&q_properties, args);
        if (err)
                return err;
-        dev = kfd_device_by_id(args.gpu_id);
+        dev = kfd_device_by_id(args->gpu_id);
        if (dev == NULL)
                return -EINVAL;
@@ -254,7 +243,7 @@ static long kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
        pdd = kfd_bind_process_to_device(dev, p);
        if (IS_ERR(pdd)) {
-                err = PTR_ERR(pdd);
+                err = -ESRCH;
                goto err_bind_process;
        }
@@ -267,33 +256,26 @@ static long kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
        if (err != 0)
                goto err_create_queue;
-        args.queue_id = queue_id;
+        args->queue_id = queue_id;
        /* Return gpu_id as doorbell offset for mmap usage */
-        args.doorbell_offset = args.gpu_id << PAGE_SHIFT;
+        args->doorbell_offset = args->gpu_id << PAGE_SHIFT;
-        if (copy_to_user(arg, &args, sizeof(args))) {
-                err = -EFAULT;
-                goto err_copy_args_out;
-        }
        mutex_unlock(&p->mutex);
-        pr_debug("kfd: queue id %d was created successfully\n", args.queue_id);
+        pr_debug("kfd: queue id %d was created successfully\n", args->queue_id);
        pr_debug("ring buffer address == 0x%016llX\n",
-                        args.ring_base_address);
+                        args->ring_base_address);
        pr_debug("read ptr address    == 0x%016llX\n",
-                        args.read_pointer_address);
+                        args->read_pointer_address);
        pr_debug("write ptr address   == 0x%016llX\n",
-                        args.write_pointer_address);
+                        args->write_pointer_address);
        return 0;
-err_copy_args_out:
-        pqm_destroy_queue(&p->pqm, queue_id);
 err_create_queue:
 err_bind_process:
        mutex_unlock(&p->mutex);
@@ -301,99 +283,90 @@ err_bind_process:
 }
 static int kfd_ioctl_destroy_queue(struct file *filp, struct kfd_process *p,
-                                        void __user *arg)
+                                        void *data)
 {
        int retval;
-        struct kfd_ioctl_destroy_queue_args args;
+        struct kfd_ioctl_destroy_queue_args *args = data;
-        if (copy_from_user(&args, arg, sizeof(args)))
-                return -EFAULT;
        pr_debug("kfd: destroying queue id %d for PASID %d\n",
-                                args.queue_id,
+                                args->queue_id,
                                p->pasid);
        mutex_lock(&p->mutex);
-        retval = pqm_destroy_queue(&p->pqm, args.queue_id);
+        retval = pqm_destroy_queue(&p->pqm, args->queue_id);
        mutex_unlock(&p->mutex);
        return retval;
 }
 static int kfd_ioctl_update_queue(struct file *filp, struct kfd_process *p,
-                                        void __user *arg)
+                                        void *data)
 {
        int retval;
-        struct kfd_ioctl_update_queue_args args;
+        struct kfd_ioctl_update_queue_args *args = data;
        struct queue_properties properties;
-        if (copy_from_user(&args, arg, sizeof(args)))
+        if (args->queue_percentage > KFD_MAX_QUEUE_PERCENTAGE) {
-                return -EFAULT;
-        if (args.queue_percentage > KFD_MAX_QUEUE_PERCENTAGE) {
                pr_err("kfd: queue percentage must be between 0 to KFD_MAX_QUEUE_PERCENTAGE\n");
                return -EINVAL;
        }
-        if (args.queue_priority > KFD_MAX_QUEUE_PRIORITY) {
+        if (args->queue_priority > KFD_MAX_QUEUE_PRIORITY) {
                pr_err("kfd: queue priority must be between 0 to KFD_MAX_QUEUE_PRIORITY\n");
                return -EINVAL;
        }
-        if ((args.ring_base_address) &&
+        if ((args->ring_base_address) &&
                (!access_ok(VERIFY_WRITE,
-                        (const void __user *) args.ring_base_address,
+                        (const void __user *) args->ring_base_address,
                        sizeof(uint64_t)))) {
                pr_err("kfd: can't access ring base address\n");
                return -EFAULT;
        }
-        if (!is_power_of_2(args.ring_size) && (args.ring_size != 0)) {
+        if (!is_power_of_2(args->ring_size) && (args->ring_size != 0)) {
                pr_err("kfd: ring size must be a power of 2 or 0\n");
                return -EINVAL;
        }
-        properties.queue_address = args.ring_base_address;
+        properties.queue_address = args->ring_base_address;
-        properties.queue_size = args.ring_size;
+        properties.queue_size = args->ring_size;
-        properties.queue_percent = args.queue_percentage;
+        properties.queue_percent = args->queue_percentage;
-        properties.priority = args.queue_priority;
+        properties.priority = args->queue_priority;
        pr_debug("kfd: updating queue id %d for PASID %d\n",
-                        args.queue_id, p->pasid);
+                        args->queue_id, p->pasid);
        mutex_lock(&p->mutex);
-        retval = pqm_update_queue(&p->pqm, args.queue_id, &properties);
+        retval = pqm_update_queue(&p->pqm, args->queue_id, &properties);
        mutex_unlock(&p->mutex);
        return retval;
 }
-static long kfd_ioctl_set_memory_policy(struct file *filep,
+static int kfd_ioctl_set_memory_policy(struct file *filep,
-                                struct kfd_process *p, void __user *arg)
+                                        struct kfd_process *p, void *data)
 {
-        struct kfd_ioctl_set_memory_policy_args args;
+        struct kfd_ioctl_set_memory_policy_args *args = data;
        struct kfd_dev *dev;
        int err = 0;
        struct kfd_process_device *pdd;
        enum cache_policy default_policy, alternate_policy;
-        if (copy_from_user(&args, arg, sizeof(args)))
+        if (args->default_policy != KFD_IOC_CACHE_POLICY_COHERENT
-                return -EFAULT;
+            && args->default_policy != KFD_IOC_CACHE_POLICY_NONCOHERENT) {
-        if (args.default_policy != KFD_IOC_CACHE_POLICY_COHERENT
-            && args.default_policy != KFD_IOC_CACHE_POLICY_NONCOHERENT) {
                return -EINVAL;
        }
-        if (args.alternate_policy != KFD_IOC_CACHE_POLICY_COHERENT
+        if (args->alternate_policy != KFD_IOC_CACHE_POLICY_COHERENT
-            && args.alternate_policy != KFD_IOC_CACHE_POLICY_NONCOHERENT) {
+            && args->alternate_policy != KFD_IOC_CACHE_POLICY_NONCOHERENT) {
                return -EINVAL;
        }
-        dev = kfd_device_by_id(args.gpu_id);
+        dev = kfd_device_by_id(args->gpu_id);
        if (dev == NULL)
                return -EINVAL;
@@ -401,23 +374,23 @@ static long kfd_ioctl_set_memory_policy(struct file *filep,
        pdd = kfd_bind_process_to_device(dev, p);
        if (IS_ERR(pdd)) {
-                err = PTR_ERR(pdd);
+                err = -ESRCH;
                goto out;
        }
-        default_policy = (args.default_policy == KFD_IOC_CACHE_POLICY_COHERENT)
+        default_policy = (args->default_policy == KFD_IOC_CACHE_POLICY_COHERENT)
                         ? cache_policy_coherent : cache_policy_noncoherent;
        alternate_policy =
-                (args.alternate_policy == KFD_IOC_CACHE_POLICY_COHERENT)
+                (args->alternate_policy == KFD_IOC_CACHE_POLICY_COHERENT)
                   ? cache_policy_coherent : cache_policy_noncoherent;
        if (!dev->dqm->set_cache_memory_policy(dev->dqm,
                                &pdd->qpd,
                                default_policy,
                                alternate_policy,
-                                (void __user *)args.alternate_aperture_base,
+                                (void __user *)args->alternate_aperture_base,
-                                args.alternate_aperture_size))
+                                args->alternate_aperture_size))
                err = -EINVAL;
 out:
@@ -426,53 +399,44 @@ out:
        return err;
 }
-static long kfd_ioctl_get_clock_counters(struct file *filep,
+static int kfd_ioctl_get_clock_counters(struct file *filep,
-                                struct kfd_process *p, void __user *arg)
+                                struct kfd_process *p, void *data)
 {
-        struct kfd_ioctl_get_clock_counters_args args;
+        struct kfd_ioctl_get_clock_counters_args *args = data;
        struct kfd_dev *dev;
        struct timespec time;
-        if (copy_from_user(&args, arg, sizeof(args)))
+        dev = kfd_device_by_id(args->gpu_id);
-                return -EFAULT;
-        dev = kfd_device_by_id(args.gpu_id);
        if (dev == NULL)
                return -EINVAL;
        /* Reading GPU clock counter from KGD */
-        args.gpu_clock_counter = kfd2kgd->get_gpu_clock_counter(dev->kgd);
+        args->gpu_clock_counter = kfd2kgd->get_gpu_clock_counter(dev->kgd);
        /* No access to rdtsc. Using raw monotonic time */
        getrawmonotonic(&time);
-        args.cpu_clock_counter = (uint64_t)timespec_to_ns(&time);
+        args->cpu_clock_counter = (uint64_t)timespec_to_ns(&time);
        get_monotonic_boottime(&time);
-        args.system_clock_counter = (uint64_t)timespec_to_ns(&time);
+        args->system_clock_counter = (uint64_t)timespec_to_ns(&time);
        /* Since the counter is in nano-seconds we use 1GHz frequency */
-        args.system_clock_freq = 1000000000;
+        args->system_clock_freq = 1000000000;
-        if (copy_to_user(arg, &args, sizeof(args)))
-                return -EFAULT;
        return 0;
 }
 static int kfd_ioctl_get_process_apertures(struct file *filp,
-                                struct kfd_process *p, void __user *arg)
+                                struct kfd_process *p, void *data)
 {
-        struct kfd_ioctl_get_process_apertures_args args;
+        struct kfd_ioctl_get_process_apertures_args *args = data;
        struct kfd_process_device_apertures *pAperture;
        struct kfd_process_device *pdd;
        dev_dbg(kfd_device, "get apertures for PASID %d", p->pasid);
-        if (copy_from_user(&args, arg, sizeof(args)))
+        args->num_of_nodes = 0;
-                return -EFAULT;
-        args.num_of_nodes = 0;
        mutex_lock(&p->mutex);
@@ -481,7 +445,8 @@ static int kfd_ioctl_get_process_apertures(struct file *filp,
                /* Run over all pdd of the process */
                pdd = kfd_get_first_process_device_data(p);
                do {
-                        pAperture = &args.process_apertures[args.num_of_nodes];
+                        pAperture =
+                                &args->process_apertures[args->num_of_nodes];
                        pAperture->gpu_id = pdd->dev->id;
                        pAperture->lds_base = pdd->lds_base;
                        pAperture->lds_limit = pdd->lds_limit;
@@ -491,7 +456,7 @@ static int kfd_ioctl_get_process_apertures(struct file *filp,
                        pAperture->scratch_limit = pdd->scratch_limit;
                        dev_dbg(kfd_device,
-                                "node id %u\n", args.num_of_nodes);
+                                "node id %u\n", args->num_of_nodes);
                        dev_dbg(kfd_device,
                                "gpu id %u\n", pdd->dev->id);
                        dev_dbg(kfd_device,
@@ -507,80 +472,131 @@ static int kfd_ioctl_get_process_apertures(struct file *filp,
                        dev_dbg(kfd_device,
                                "scratch_limit %llX\n", pdd->scratch_limit);
-                        args.num_of_nodes++;
+                        args->num_of_nodes++;
                } while ((pdd = kfd_get_next_process_device_data(p, pdd)) != NULL &&
-                                (args.num_of_nodes < NUM_OF_SUPPORTED_GPUS));
+                                (args->num_of_nodes < NUM_OF_SUPPORTED_GPUS));
        }
        mutex_unlock(&p->mutex);
-        if (copy_to_user(arg, &args, sizeof(args)))
-                return -EFAULT;
        return 0;
 }
+#define AMDKFD_IOCTL_DEF(ioctl, _func, _flags) \
+        [_IOC_NR(ioctl)] = {.cmd = ioctl, .func = _func, .flags = _flags, .cmd_drv = 0, .name = #ioctl}
+/** Ioctl table */
+static const struct amdkfd_ioctl_desc amdkfd_ioctls[] = {
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_VERSION,
+                        kfd_ioctl_get_version, 0),
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_CREATE_QUEUE,
+                        kfd_ioctl_create_queue, 0),
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_DESTROY_QUEUE,
+                        kfd_ioctl_destroy_queue, 0),
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_SET_MEMORY_POLICY,
+                        kfd_ioctl_set_memory_policy, 0),
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_CLOCK_COUNTERS,
+                        kfd_ioctl_get_clock_counters, 0),
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_PROCESS_APERTURES,
+                        kfd_ioctl_get_process_apertures, 0),
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_UPDATE_QUEUE,
+                        kfd_ioctl_update_queue, 0),
+};
+#define AMDKFD_CORE_IOCTL_COUNT ARRAY_SIZE(amdkfd_ioctls)
 static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
 {
        struct kfd_process *process;
-        long err = -EINVAL;
+        amdkfd_ioctl_t *func;
+        const struct amdkfd_ioctl_desc *ioctl = NULL;
+        unsigned int nr = _IOC_NR(cmd);
+        char stack_kdata[128];
+        char *kdata = NULL;
+        unsigned int usize, asize;
+        int retcode = -EINVAL;
+        if (nr >= AMDKFD_CORE_IOCTL_COUNT)
+                goto err_i1;
+        if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
+                u32 amdkfd_size;
+                ioctl = &amdkfd_ioctls[nr];
-        dev_dbg(kfd_device,
+                amdkfd_size = _IOC_SIZE(ioctl->cmd);
-                "ioctl cmd 0x%x (#%d), arg 0x%lx\n",
+                usize = asize = _IOC_SIZE(cmd);
-                cmd, _IOC_NR(cmd), arg);
+                if (amdkfd_size > asize)
+                        asize = amdkfd_size;
+                cmd = ioctl->cmd;
+        } else
+                goto err_i1;
+        dev_dbg(kfd_device, "ioctl cmd 0x%x (#%d), arg 0x%lx\n", cmd, nr, arg);
        process = kfd_get_process(current);
-        if (IS_ERR(process))
+        if (IS_ERR(process)) {
-                return PTR_ERR(process);
+                dev_dbg(kfd_device, "no process\n");
+                goto err_i1;
+        }
-        switch (cmd) {
+        /* Do not trust userspace, use our own definition */
-        case KFD_IOC_GET_VERSION:
+        func = ioctl->func;
-                err = kfd_ioctl_get_version(filep, process, (void __user *)arg);
-                break;
+        if (unlikely(!func)) {
-        case KFD_IOC_CREATE_QUEUE:
+                dev_dbg(kfd_device, "no function\n");
-                err = kfd_ioctl_create_queue(filep, process,
+                retcode = -EINVAL;
-                                                (void __user *)arg);
+                goto err_i1;
-                break;
-        case KFD_IOC_DESTROY_QUEUE:
-                err = kfd_ioctl_destroy_queue(filep, process,
-                                                (void __user *)arg);
-                break;
-        case KFD_IOC_SET_MEMORY_POLICY:
-                err = kfd_ioctl_set_memory_policy(filep, process,
-                                                (void __user *)arg);
-                break;
-        case KFD_IOC_GET_CLOCK_COUNTERS:
-                err = kfd_ioctl_get_clock_counters(filep, process,
-                                                (void __user *)arg);
-                break;
-        case KFD_IOC_GET_PROCESS_APERTURES:
-                err = kfd_ioctl_get_process_apertures(filep, process,
-                                                (void __user *)arg);
-                break;
-        case KFD_IOC_UPDATE_QUEUE:
-                err = kfd_ioctl_update_queue(filep, process,
-                                                (void __user *)arg);
-                break;
-        default:
-                dev_err(kfd_device,
-                        "unknown ioctl cmd 0x%x, arg 0x%lx)\n",
-                        cmd, arg);
-                err = -EINVAL;
-                break;
        }
-        if (err < 0)
+        if (cmd & (IOC_IN | IOC_OUT)) {
-                dev_err(kfd_device,
+                if (asize <= sizeof(stack_kdata)) {
-                        "ioctl error %ld for ioctl cmd 0x%x (#%d)\n",
+                        kdata = stack_kdata;
-                        err, cmd, _IOC_NR(cmd));
+                } else {
+                        kdata = kmalloc(asize, GFP_KERNEL);
+                        if (!kdata) {
+                                retcode = -ENOMEM;
+                                goto err_i1;
+                        }
+                }
+                if (asize > usize)
+                        memset(kdata + usize, 0, asize - usize);
+        }
-        return err;
+        if (cmd & IOC_IN) {
+                if (copy_from_user(kdata, (void __user *)arg, usize) != 0) {
+                        retcode = -EFAULT;
+                        goto err_i1;
+                }
+        } else if (cmd & IOC_OUT) {
+                memset(kdata, 0, usize);
+        }
+        retcode = func(filep, process, kdata);
+        if (cmd & IOC_OUT)
+                if (copy_to_user((void __user *)arg, kdata, usize) != 0)
+                        retcode = -EFAULT;
+err_i1:
+        if (!ioctl)
+                dev_dbg(kfd_device, "invalid ioctl: pid=%d, cmd=0x%02x, nr=0x%02x\n",
+                          task_pid_nr(current), cmd, nr);
+        if (kdata != stack_kdata)
+                kfree(kdata);
+        if (retcode)
+                dev_dbg(kfd_device, "ret = %d\n", retcode);
+        return retcode;
 }
 static int kfd_mmap(struct file *filp, struct vm_area_struct *vma)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index 43884ebd4303..25bc47f3c1cf 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -26,6 +26,7 @@
 #include <linux/slab.h>
 #include "kfd_priv.h"
 #include "kfd_device_queue_manager.h"
+#include "kfd_pm4_headers.h"
 #define MQD_SIZE_ALIGNED 768
@@ -169,9 +170,8 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd,
        kfd->shared_resources = *gpu_resources;
        /* calculate max size of mqds needed for queues */
-        size = max_num_of_processes *
+        size = max_num_of_queues_per_device *
-                max_num_of_queues_per_process *
+                        kfd->device_info->mqd_size_aligned;
-                kfd->device_info->mqd_size_aligned;
        /* add another 512KB for all other allocations on gart */
        size += 512 * 1024;
@@ -192,13 +192,6 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd,
                goto kfd_topology_add_device_error;
        }
-        if (kfd_interrupt_init(kfd)) {
-                dev_err(kfd_device,
-                        "Error initializing interrupts for device (%x:%x)\n",
-                        kfd->pdev->vendor, kfd->pdev->device);
-                goto kfd_interrupt_error;
-        }
        if (!device_iommu_pasid_init(kfd)) {
                dev_err(kfd_device,
                        "Error initializing iommuv2 for device (%x:%x)\n",
@@ -237,8 +230,6 @@ dqm_start_error:
 device_queue_manager_error:
        amd_iommu_free_device(kfd->pdev);
 device_iommu_pasid_error:
-        kfd_interrupt_exit(kfd);
-kfd_interrupt_error:
        kfd_topology_remove_device(kfd);
 kfd_topology_add_device_error:
        kfd2kgd->fini_sa_manager(kfd->kgd);
@@ -254,7 +245,6 @@ void kgd2kfd_device_exit(struct kfd_dev *kfd)
        if (kfd->init_complete) {
                device_queue_manager_uninit(kfd->dqm);
                amd_iommu_free_device(kfd->pdev);
-                kfd_interrupt_exit(kfd);
                kfd_topology_remove_device(kfd);
        }
@@ -296,13 +286,5 @@ int kgd2kfd_resume(struct kfd_dev *kfd)
 /* This is called directly from KGD at ISR. */
 void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry)
 {
-        if (kfd->init_complete) {
+        /* Process interrupts / schedule work as necessary */
-                spin_lock(&kfd->interrupt_lock);
-                if (kfd->interrupts_active
-                    && enqueue_ih_ring_entry(kfd, ih_ring_entry))
-                        schedule_work(&kfd->interrupt_work);
-                spin_unlock(&kfd->interrupt_lock);
-        }
 }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 924e90c072e5..0fd592799d58 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -161,6 +161,9 @@ static void deallocate_vmid(struct device_queue_manager *dqm,
 {
        int bit = qpd->vmid - KFD_VMID_START_OFFSET;
+        /* Release the vmid mapping */
+        set_pasid_vmid_mapping(dqm, 0, qpd->vmid);
        set_bit(bit, (unsigned long *)&dqm->vmid_bitmap);
        qpd->vmid = 0;
        q->properties.vmid = 0;
@@ -180,6 +183,13 @@ static int create_queue_nocpsch(struct device_queue_manager *dqm,
        mutex_lock(&dqm->lock);
+        if (dqm->total_queue_count >= max_num_of_queues_per_device) {
+                pr_warn("amdkfd: Can't create new usermode queue because %d queues were already created\n",
+                                dqm->total_queue_count);
+                mutex_unlock(&dqm->lock);
+                return -EPERM;
+        }
        if (list_empty(&qpd->queues_list)) {
                retval = allocate_vmid(dqm, qpd, q);
                if (retval != 0) {
@@ -204,6 +214,14 @@ static int create_queue_nocpsch(struct device_queue_manager *dqm,
        list_add(&q->list, &qpd->queues_list);
        dqm->queue_count++;
+        /*
+         * Unconditionally increment this counter, regardless of the queue's
+         * type or whether the queue is active.
+         */
+        dqm->total_queue_count++;
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
        mutex_unlock(&dqm->lock);
        return 0;
 }
@@ -272,6 +290,18 @@ static int create_compute_queue_nocpsch(struct device_queue_manager *dqm,
                return retval;
        }
+        pr_debug("kfd: loading mqd to hqd on pipe (%d) queue (%d)\n",
+                        q->pipe,
+                        q->queue);
+        retval = mqd->load_mqd(mqd, q->mqd, q->pipe,
+                        q->queue, (uint32_t __user *) q->properties.write_ptr);
+        if (retval != 0) {
+                deallocate_hqd(dqm, q);
+                mqd->uninit_mqd(mqd, q->mqd, q->mqd_mem_obj);
+                return retval;
+        }
        return 0;
 }
@@ -311,6 +341,15 @@ static int destroy_queue_nocpsch(struct device_queue_manager *dqm,
        if (list_empty(&qpd->queues_list))
                deallocate_vmid(dqm, qpd, q);
        dqm->queue_count--;
+        /*
+         * Unconditionally decrement this counter, regardless of the queue's
+         * type
+         */
+        dqm->total_queue_count--;
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
 out:
        mutex_unlock(&dqm->lock);
        return retval;
@@ -320,6 +359,7 @@ static int update_queue(struct device_queue_manager *dqm, struct queue *q)
 {
        int retval;
        struct mqd_manager *mqd;
+        bool prev_active = false;
        BUG_ON(!dqm || !q || !q->mqd);
@@ -330,10 +370,18 @@ static int update_queue(struct device_queue_manager *dqm, struct queue *q)
                return -ENOMEM;
        }
-        retval = mqd->update_mqd(mqd, q->mqd, &q->properties);
        if (q->properties.is_active == true)
+                prev_active = true;
+        /*
+         *
+         * check active state vs. the previous state
+         * and modify counter accordingly
+         */
+        retval = mqd->update_mqd(mqd, q->mqd, &q->properties);
+        if ((q->properties.is_active == true) && (prev_active == false))
                dqm->queue_count++;
-        else
+        else if ((q->properties.is_active == false) && (prev_active == true))
                dqm->queue_count--;
        if (sched_policy != KFD_SCHED_POLICY_NO_HWS)
@@ -517,10 +565,14 @@ static int init_pipelines(struct device_queue_manager *dqm,
        for (i = 0; i < pipes_num; i++) {
                inx = i + first_pipe;
+                /*
+                 * HPD buffer on GTT is allocated by amdkfd, no need to waste
+                 * space in GTT for pipelines we don't initialize
+                 */
                pipe_hpd_addr = dqm->pipelines_addr + i * CIK_HPD_EOP_BYTES;
                pr_debug("kfd: pipeline address %llX\n", pipe_hpd_addr);
                /* = log2(bytes/4)-1 */
-                kfd2kgd->init_pipeline(dqm->dev->kgd, i,
+                kfd2kgd->init_pipeline(dqm->dev->kgd, inx,
                                CIK_HPD_EOP_BYTES_LOG2 - 3, pipe_hpd_addr);
        }
@@ -536,7 +588,7 @@ static int init_scheduler(struct device_queue_manager *dqm)
        pr_debug("kfd: In %s\n", __func__);
-        retval = init_pipelines(dqm, get_pipes_num(dqm), KFD_DQM_FIRST_PIPE);
+        retval = init_pipelines(dqm, get_pipes_num(dqm), get_first_pipe(dqm));
        if (retval != 0)
                return retval;
@@ -728,6 +780,21 @@ static int create_kernel_queue_cpsch(struct device_queue_manager *dqm,
        pr_debug("kfd: In func %s\n", __func__);
        mutex_lock(&dqm->lock);
+        if (dqm->total_queue_count >= max_num_of_queues_per_device) {
+                pr_warn("amdkfd: Can't create new kernel queue because %d queues were already created\n",
+                                dqm->total_queue_count);
+                mutex_unlock(&dqm->lock);
+                return -EPERM;
+        }
+        /*
+         * Unconditionally increment this counter, regardless of the queue's
+         * type or whether the queue is active.
+         */
+        dqm->total_queue_count++;
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
        list_add(&kq->list, &qpd->priv_queue_list);
        dqm->queue_count++;
        qpd->is_debug = true;
@@ -751,6 +818,13 @@ static void destroy_kernel_queue_cpsch(struct device_queue_manager *dqm,
        dqm->queue_count--;
        qpd->is_debug = false;
        execute_queues_cpsch(dqm, false);
+        /*
+         * Unconditionally decrement this counter, regardless of the queue's
+         * type.
+         */
+        dqm->total_queue_count--;
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
        mutex_unlock(&dqm->lock);
 }
@@ -769,6 +843,13 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
        mutex_lock(&dqm->lock);
+        if (dqm->total_queue_count >= max_num_of_queues_per_device) {
+                pr_warn("amdkfd: Can't create new usermode queue because %d queues were already created\n",
+                                dqm->total_queue_count);
+                retval = -EPERM;
+                goto out;
+        }
        mqd = dqm->get_mqd_manager(dqm, KFD_MQD_TYPE_CIK_CP);
        if (mqd == NULL) {
                mutex_unlock(&dqm->lock);
@@ -786,6 +867,15 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
                retval = execute_queues_cpsch(dqm, false);
        }
+        /*
+         * Unconditionally increment this counter, regardless of the queue's
+         * type or whether the queue is active.
+         */
+        dqm->total_queue_count++;
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
 out:
        mutex_unlock(&dqm->lock);
        return retval;
@@ -906,6 +996,14 @@ static int destroy_queue_cpsch(struct device_queue_manager *dqm,
        mqd->uninit_mqd(mqd, q->mqd, q->mqd_mem_obj);
+        /*
+         * Unconditionally decrement this counter, regardless of the queue's
+         * type
+         */
+        dqm->total_queue_count--;
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
        mutex_unlock(&dqm->lock);
        return 0;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
index c3f189e8ae35..52035bf0c1cb 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
@@ -130,6 +130,7 @@ struct device_queue_manager {
        struct list_head        queues;
        unsigned int            processes_count;
        unsigned int            queue_count;
+        unsigned int            total_queue_count;
        unsigned int            next_pipe_to_allocate;
        unsigned int            *allocated_queues;
        unsigned int            vmid_bitmap;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c b/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c
index 66df4da01c29..e64aa99e5e41 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c
@@ -299,13 +299,13 @@ int kfd_init_apertures(struct kfd_process *process)
        struct kfd_dev *dev;
        struct kfd_process_device *pdd;
-        mutex_lock(&process->mutex);
        /*Iterating over all devices*/
        while ((dev = kfd_topology_enum_kfd_devices(id)) != NULL &&
                id < NUM_OF_SUPPORTED_GPUS) {
                pdd = kfd_get_process_device_data(dev, process, 1);
+                if (!pdd)
+                        return -1;
                /*
                 * For 64 bit process aperture will be statically reserved in
@@ -348,8 +348,6 @@ int kfd_init_apertures(struct kfd_process *process)
                id++;
        }
-        mutex_unlock(&process->mutex);
        return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c
deleted file mode 100644
index 5b999095a1f7..000000000000
--- a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c
+++ /dev/null
@@ -1,176 +0,0 @@
-/*
- * Copyright 2014 Advanced Micro Devices, Inc.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-/*
- * KFD Interrupts.
- *
- * AMD GPUs deliver interrupts by pushing an interrupt description onto the
- * interrupt ring and then sending an interrupt. KGD receives the interrupt
- * in ISR and sends us a pointer to each new entry on the interrupt ring.
- *
- * We generally can't process interrupt-signaled events from ISR, so we call
- * out to each interrupt client module (currently only the scheduler) to ask if
- * each interrupt is interesting. If they return true, then it requires further
- * processing so we copy it to an internal interrupt ring and call each
- * interrupt client again from a work-queue.
- *
- * There's no acknowledgment for the interrupts we use. The hardware simply
- * queues a new interrupt each time without waiting.
- *
- * The fixed-size internal queue means that it's possible for us to lose
- * interrupts because we have no back-pressure to the hardware.
- */
-#include <linux/slab.h>
-#include <linux/device.h>
-#include "kfd_priv.h"
-#define KFD_INTERRUPT_RING_SIZE 256
-static void interrupt_wq(struct work_struct *);
-int kfd_interrupt_init(struct kfd_dev *kfd)
-{
-        void *interrupt_ring = kmalloc_array(KFD_INTERRUPT_RING_SIZE,
-                                        kfd->device_info->ih_ring_entry_size,
-                                        GFP_KERNEL);
-        if (!interrupt_ring)
-                return -ENOMEM;
-        kfd->interrupt_ring = interrupt_ring;
-        kfd->interrupt_ring_size =
-                KFD_INTERRUPT_RING_SIZE * kfd->device_info->ih_ring_entry_size;
-        atomic_set(&kfd->interrupt_ring_wptr, 0);
-        atomic_set(&kfd->interrupt_ring_rptr, 0);
-        spin_lock_init(&kfd->interrupt_lock);
-        INIT_WORK(&kfd->interrupt_work, interrupt_wq);
-        kfd->interrupts_active = true;
-        /*
-         * After this function returns, the interrupt will be enabled. This
-         * barrier ensures that the interrupt running on a different processor
-         * sees all the above writes.
-         */
-        smp_wmb();
-        return 0;
-}
-void kfd_interrupt_exit(struct kfd_dev *kfd)
-{
-        /*
-         * Stop the interrupt handler from writing to the ring and scheduling
-         * workqueue items. The spinlock ensures that any interrupt running
-         * after we have unlocked sees interrupts_active = false.
-         */
-        unsigned long flags;
-        spin_lock_irqsave(&kfd->interrupt_lock, flags);
-        kfd->interrupts_active = false;
-        spin_unlock_irqrestore(&kfd->interrupt_lock, flags);
-        /*
-         * Flush_scheduled_work ensures that there are no outstanding
-         * work-queue items that will access interrupt_ring. New work items
-         * can't be created because we stopped interrupt handling above.
-         */
-        flush_scheduled_work();
-        kfree(kfd->interrupt_ring);
-}
-/*
- * This assumes that it can't be called concurrently with itself
- * but only with dequeue_ih_ring_entry.
- */
-bool enqueue_ih_ring_entry(struct kfd_dev *kfd, const void *ih_ring_entry)
-{
-        unsigned int rptr = atomic_read(&kfd->interrupt_ring_rptr);
-        unsigned int wptr = atomic_read(&kfd->interrupt_ring_wptr);
-        if ((rptr - wptr) % kfd->interrupt_ring_size ==
-                                        kfd->device_info->ih_ring_entry_size) {
-                /* This is very bad, the system is likely to hang. */
-                dev_err_ratelimited(kfd_chardev(),
-                        "Interrupt ring overflow, dropping interrupt.\n");
-                return false;
-        }
-        memcpy(kfd->interrupt_ring + wptr, ih_ring_entry,
-                        kfd->device_info->ih_ring_entry_size);
-        wptr = (wptr + kfd->device_info->ih_ring_entry_size) %
-                        kfd->interrupt_ring_size;
-        smp_wmb(); /* Ensure memcpy'd data is visible before wptr update. */
-        atomic_set(&kfd->interrupt_ring_wptr, wptr);
-        return true;
-}
-/*
- * This assumes that it can't be called concurrently with itself
- * but only with enqueue_ih_ring_entry.
- */
-static bool dequeue_ih_ring_entry(struct kfd_dev *kfd, void *ih_ring_entry)
-{
-        /*
-         * Assume that wait queues have an implicit barrier, i.e. anything that
-         * happened in the ISR before it queued work is visible.
-         */
-        unsigned int wptr = atomic_read(&kfd->interrupt_ring_wptr);
-        unsigned int rptr = atomic_read(&kfd->interrupt_ring_rptr);
-        if (rptr == wptr)
-                return false;
-        memcpy(ih_ring_entry, kfd->interrupt_ring + rptr,
-                        kfd->device_info->ih_ring_entry_size);
-        rptr = (rptr + kfd->device_info->ih_ring_entry_size) %
-                        kfd->interrupt_ring_size;
-        /*
-         * Ensure the rptr write update is not visible until
-         * memcpy has finished reading.
-         */
-        smp_mb();
-        atomic_set(&kfd->interrupt_ring_rptr, rptr);
-        return true;
-}
-static void interrupt_wq(struct work_struct *work)
-{
-        struct kfd_dev *dev = container_of(work, struct kfd_dev,
-                                                interrupt_work);
-        uint32_t ih_ring_entry[DIV_ROUND_UP(
-                                dev->device_info->ih_ring_entry_size,
-                                sizeof(uint32_t))];
-        while (dequeue_ih_ring_entry(dev, ih_ring_entry))
-                ;
-}
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_module.c b/drivers/gpu/drm/amd/amdkfd/kfd_module.c
index 95d5af138e6e..1c385c23dd0b 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c
@@ -50,15 +50,10 @@ module_param(sched_policy, int, 0444);
 MODULE_PARM_DESC(sched_policy,
        "Kernel cmdline parameter that defines the amdkfd scheduling policy");
-int max_num_of_processes = KFD_MAX_NUM_OF_PROCESSES_DEFAULT;
+int max_num_of_queues_per_device = KFD_MAX_NUM_OF_QUEUES_PER_DEVICE_DEFAULT;
-module_param(max_num_of_processes, int, 0444);
+module_param(max_num_of_queues_per_device, int, 0444);
-MODULE_PARM_DESC(max_num_of_processes,
+MODULE_PARM_DESC(max_num_of_queues_per_device,
-        "Kernel cmdline parameter that defines the amdkfd maximum number of supported processes");
+        "Maximum number of supported queues per device (1 = Minimum, 4096 = default)");
-int max_num_of_queues_per_process = KFD_MAX_NUM_OF_QUEUES_PER_PROCESS_DEFAULT;
-module_param(max_num_of_queues_per_process, int, 0444);
-MODULE_PARM_DESC(max_num_of_queues_per_process,
-        "Kernel cmdline parameter that defines the amdkfd maximum number of supported queues per process");
 bool kgd2kfd_init(unsigned interface_version,
                  const struct kfd2kgd_calls *f2g,
@@ -100,16 +95,10 @@ static int __init kfd_module_init(void)
        }
        /* Verify module parameters */
-        if ((max_num_of_processes < 0) ||
+        if ((max_num_of_queues_per_device < 1) ||
-                (max_num_of_processes > KFD_MAX_NUM_OF_PROCESSES)) {
+                (max_num_of_queues_per_device >
-                pr_err("kfd: max_num_of_processes must be between 0 to KFD_MAX_NUM_OF_PROCESSES\n");
+                        KFD_MAX_NUM_OF_QUEUES_PER_DEVICE)) {
-                return -1;
+                pr_err("kfd: max_num_of_queues_per_device must be between 1 to KFD_MAX_NUM_OF_QUEUES_PER_DEVICE\n");
-        }
-        if ((max_num_of_queues_per_process < 0) ||
-                (max_num_of_queues_per_process >
-                        KFD_MAX_NUM_OF_QUEUES_PER_PROCESS)) {
-                pr_err("kfd: max_num_of_queues_per_process must be between 0 to KFD_MAX_NUM_OF_QUEUES_PER_PROCESS\n");
                return -1;
        }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
index adc31474e786..4c3828cf45bf 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
@@ -184,7 +184,7 @@ static bool is_occupied(struct mqd_manager *mm, void *mqd,
                        uint32_t queue_id)
 {
-        return kfd2kgd->hqd_is_occupies(mm->dev->kgd, queue_address,
+        return kfd2kgd->hqd_is_occupied(mm->dev->kgd, queue_address,
                                        pipe_id, queue_id);
 }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c b/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c
index 71699ad97d74..6cfe7f1f18cf 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c
@@ -30,9 +30,9 @@ static DEFINE_MUTEX(pasid_mutex);
 int kfd_pasid_init(void)
 {
-        pasid_limit = max_num_of_processes;
+        pasid_limit = KFD_MAX_NUM_OF_PROCESSES;
-        pasid_bitmap = kzalloc(BITS_TO_LONGS(pasid_limit), GFP_KERNEL);
+        pasid_bitmap = kcalloc(BITS_TO_LONGS(pasid_limit), sizeof(long), GFP_KERNEL);
        if (!pasid_bitmap)
                return -ENOMEM;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index f9fb81e3bb09..96dc10e8904a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -52,20 +52,19 @@
 #define kfd_alloc_struct(ptr_to_struct) \
        ((typeof(ptr_to_struct)) kzalloc(sizeof(*ptr_to_struct), GFP_KERNEL))
-/* Kernel module parameter to specify maximum number of supported processes */
-extern int max_num_of_processes;
-#define KFD_MAX_NUM_OF_PROCESSES_DEFAULT 32
 #define KFD_MAX_NUM_OF_PROCESSES 512
+#define KFD_MAX_NUM_OF_QUEUES_PER_PROCESS 1024
 /*
- * Kernel module parameter to specify maximum number of supported queues
+ * Kernel module parameter to specify maximum number of supported queues per
- * per process
+ * device
 */
-extern int max_num_of_queues_per_process;
+extern int max_num_of_queues_per_device;
-#define KFD_MAX_NUM_OF_QUEUES_PER_PROCESS_DEFAULT 128
+#define KFD_MAX_NUM_OF_QUEUES_PER_DEVICE_DEFAULT 4096
-#define KFD_MAX_NUM_OF_QUEUES_PER_PROCESS 1024
+#define KFD_MAX_NUM_OF_QUEUES_PER_DEVICE                \
+        (KFD_MAX_NUM_OF_PROCESSES *                     \
+                        KFD_MAX_NUM_OF_QUEUES_PER_PROCESS)
 #define KFD_KERNEL_QUEUE_SIZE 2048
@@ -135,22 +134,10 @@ struct kfd_dev {
        struct kgd2kfd_shared_resources shared_resources;
-        void *interrupt_ring;
-        size_t interrupt_ring_size;
-        atomic_t interrupt_ring_rptr;
-        atomic_t interrupt_ring_wptr;
-        struct work_struct interrupt_work;
-        spinlock_t interrupt_lock;
        /* QCM Device instance */
        struct device_queue_manager *dqm;
        bool init_complete;
-        /*
-         * Interrupts of interest to KFD are copied
-         * from the HW ring into a SW ring.
-         */
-        bool interrupts_active;
 };
 /* KGD2KFD callbacks */
@@ -463,6 +450,24 @@ struct kfd_process {
        bool is_32bit_user_mode;
 };
+/**
+ * Ioctl function type.
+ *
+ * \param filep pointer to file structure.
+ * \param p amdkfd process pointer.
+ * \param data pointer to arg that was copied from user.
+ */
+typedef int amdkfd_ioctl_t(struct file *filep, struct kfd_process *p,
+                                void *data);
+struct amdkfd_ioctl_desc {
+        unsigned int cmd;
+        int flags;
+        amdkfd_ioctl_t *func;
+        unsigned int cmd_drv;
+        const char *name;
+};
 void kfd_process_create_wq(void);
 void kfd_process_destroy_wq(void);
 struct kfd_process *kfd_create_process(const struct task_struct *);
@@ -513,10 +518,7 @@ struct kfd_dev *kfd_device_by_pci_dev(const struct pci_dev *pdev);
 struct kfd_dev *kfd_topology_enum_kfd_devices(uint8_t idx);
 /* Interrupts */
-int kfd_interrupt_init(struct kfd_dev *dev);
-void kfd_interrupt_exit(struct kfd_dev *dev);
 void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry);
-bool enqueue_ih_ring_entry(struct kfd_dev *kfd, const void *ih_ring_entry);
 /* Power Management */
 void kgd2kfd_suspend(struct kfd_dev *kfd);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
index b85eb0b830b4..3c76ef05cbcf 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -26,6 +26,8 @@
 #include <linux/slab.h>
 #include <linux/amd-iommu.h>
 #include <linux/notifier.h>
+#include <linux/compat.h>
 struct mm_struct;
 #include "kfd_priv.h"
@@ -285,8 +287,15 @@ static struct kfd_process *create_process(const struct task_struct *thread)
        if (err != 0)
                goto err_process_pqm_init;
+        /* init process apertures*/
+        process->is_32bit_user_mode = is_compat_task();
+        if (kfd_init_apertures(process) != 0)
+                goto err_init_apretures;
        return process;
+err_init_apretures:
+        pqm_uninit(&process->pqm);
 err_process_pqm_init:
        hash_del_rcu(&process->kfd_processes);
        synchronize_rcu();
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
index 47526780d736..2fda1927bff7 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
@@ -54,11 +54,11 @@ static int find_available_queue_slot(struct process_queue_manager *pqm,
        pr_debug("kfd: in %s\n", __func__);
        found = find_first_zero_bit(pqm->queue_slot_bitmap,
-                        max_num_of_queues_per_process);
+                        KFD_MAX_NUM_OF_QUEUES_PER_PROCESS);
        pr_debug("kfd: the new slot id %lu\n", found);
-        if (found >= max_num_of_queues_per_process) {
+        if (found >= KFD_MAX_NUM_OF_QUEUES_PER_PROCESS) {
                pr_info("amdkfd: Can not open more queues for process with pasid %d\n",
                                pqm->process->pasid);
                return -ENOMEM;
@@ -76,7 +76,7 @@ int pqm_init(struct process_queue_manager *pqm, struct kfd_process *p)
        INIT_LIST_HEAD(&pqm->queues);
        pqm->queue_slot_bitmap =
-                        kzalloc(DIV_ROUND_UP(max_num_of_queues_per_process,
+                        kzalloc(DIV_ROUND_UP(KFD_MAX_NUM_OF_QUEUES_PER_PROCESS,
                                        BITS_PER_BYTE), GFP_KERNEL);
        if (pqm->queue_slot_bitmap == NULL)
                return -ENOMEM;
@@ -203,6 +203,7 @@ int pqm_create_queue(struct process_queue_manager *pqm,
                pqn->kq = NULL;
                retval = dev->dqm->create_queue(dev->dqm, q, &pdd->qpd,
                                                &q->properties.vmid);
+                pr_debug("DQM returned %d for create_queue\n", retval);
                print_queue(q);
                break;
        case KFD_QUEUE_TYPE_DIQ:
@@ -222,7 +223,7 @@ int pqm_create_queue(struct process_queue_manager *pqm,
        }
        if (retval != 0) {
-                pr_err("kfd: error dqm create queue\n");
+                pr_debug("Error dqm create queue\n");
                goto err_create_queue;
        }
@@ -241,7 +242,10 @@ int pqm_create_queue(struct process_queue_manager *pqm,
 err_create_queue:
        kfree(pqn);
 err_allocate_pqn:
+        /* check if queues list is empty unregister process from device */
        clear_bit(*qid, pqm->queue_slot_bitmap);
+        if (list_empty(&pqm->queues))
+                dev->dqm->unregister_process(dev->dqm, &pdd->qpd);
        return retval;
 }
@@ -311,7 +315,11 @@ int pqm_update_queue(struct process_queue_manager *pqm, unsigned int qid,
        BUG_ON(!pqm);
        pqn = get_queue_by_qid(pqm, qid);
-        BUG_ON(!pqn);
+        if (!pqn) {
+                pr_debug("amdkfd: No queue %d exists for update operation\n",
+                                qid);
+                return -EFAULT;
+        }
        pqn->q->properties.queue_address = p->queue_address;
        pqn->q->properties.queue_size = p->queue_size;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index 5733e2859e8a..cca1708fd811 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -700,8 +700,6 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr,
                                dev->node_props.simd_per_cu);
                sysfs_show_32bit_prop(buffer, "max_slots_scratch_cu",
                                dev->node_props.max_slots_scratch_cu);
-                sysfs_show_32bit_prop(buffer, "engine_id",
-                                dev->node_props.engine_id);
                sysfs_show_32bit_prop(buffer, "vendor_id",
                                dev->node_props.vendor_id);
                sysfs_show_32bit_prop(buffer, "device_id",
@@ -715,6 +713,12 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr,
                                                dev->gpu->kgd));
                        sysfs_show_64bit_prop(buffer, "local_mem_size",
                                        kfd2kgd->get_vmem_size(dev->gpu->kgd));
+                        sysfs_show_32bit_prop(buffer, "fw_version",
+                                        kfd2kgd->get_fw_version(
+                                                        dev->gpu->kgd,
+                                                        KGD_ENGINE_MEC1));
                }
                ret = sysfs_show_32bit_prop(buffer, "max_engine_clk_ccompute",
@@ -917,7 +921,7 @@ static int kfd_build_sysfs_node_tree(void)
        uint32_t i = 0;
        list_for_each_entry(dev, &topology_device_list, list) {
-                ret = kfd_build_sysfs_node_entry(dev, 0);
+                ret = kfd_build_sysfs_node_entry(dev, i);
                if (ret < 0)
                        return ret;
                i++;
diff --git a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
index 9c729dd8dd50..96a512208fad 100644
--- a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
+++ b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
@@ -45,6 +45,17 @@ enum kgd_memory_pool {
        KGD_POOL_FRAMEBUFFER = 3,
 };
+enum kgd_engine_type {
+        KGD_ENGINE_PFP = 1,
+        KGD_ENGINE_ME,
+        KGD_ENGINE_CE,
+        KGD_ENGINE_MEC1,
+        KGD_ENGINE_MEC2,
+        KGD_ENGINE_RLC,
+        KGD_ENGINE_SDMA,
+        KGD_ENGINE_MAX
+};
 struct kgd2kfd_shared_resources {
        /* Bit n == 1 means VMID n is available for KFD. */
        unsigned int compute_vmid_bitmap;
@@ -137,6 +148,8 @@ struct kgd2kfd_calls {
 *
 * @hqd_destroy: Destructs and preempts the queue assigned to that hqd slot.
 *
+ * @get_fw_version: Returns FW versions from the header
+ *
 * This structure contains function pointers to services that the kgd driver
 * provides to amdkfd driver.
 *
@@ -170,12 +183,14 @@ struct kfd2kgd_calls {
        int (*hqd_load)(struct kgd_dev *kgd, void *mqd, uint32_t pipe_id,
                        uint32_t queue_id, uint32_t __user *wptr);
-        bool (*hqd_is_occupies)(struct kgd_dev *kgd, uint64_t queue_address,
+        bool (*hqd_is_occupied)(struct kgd_dev *kgd, uint64_t queue_address,
                                uint32_t pipe_id, uint32_t queue_id);
        int (*hqd_destroy)(struct kgd_dev *kgd, uint32_t reset_type,
                                unsigned int timeout, uint32_t pipe_id,
                                uint32_t queue_id);
+        uint16_t (*get_fw_version)(struct kgd_dev *kgd,
+                                enum kgd_engine_type type);
 };
 bool kgd2kfd_init(unsigned interface_version,
diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.c b/drivers/gpu/drm/cirrus/cirrus_drv.c
index c2a1cba1e984..b9140032962d 100644
--- a/drivers/gpu/drm/cirrus/cirrus_drv.c
+++ b/drivers/gpu/drm/cirrus/cirrus_drv.c
@@ -16,9 +16,12 @@
 #include "cirrus_drv.h"
 int cirrus_modeset = -1;
+int cirrus_bpp = 24;
 MODULE_PARM_DESC(modeset, "Disable/Enable modesetting");
 module_param_named(modeset, cirrus_modeset, int, 0400);
+MODULE_PARM_DESC(bpp, "Max bits-per-pixel (default:24)");
+module_param_named(bpp, cirrus_bpp, int, 0400);
 /*
 * This is the generic driver code. This binds the driver to the drm core,
diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.h b/drivers/gpu/drm/cirrus/cirrus_drv.h
index 693a4565c4ff..705061537a27 100644
--- a/drivers/gpu/drm/cirrus/cirrus_drv.h
+++ b/drivers/gpu/drm/cirrus/cirrus_drv.h
@@ -262,4 +262,7 @@ static inline void cirrus_bo_unreserve(struct cirrus_bo *bo)
 int cirrus_bo_push_sysram(struct cirrus_bo *bo);
 int cirrus_bo_pin(struct cirrus_bo *bo, u32 pl_flag, u64 *gpu_addr);
+extern int cirrus_bpp;
 #endif                          /* __CIRRUS_DRV_H__ */
diff --git a/drivers/gpu/drm/cirrus/cirrus_main.c b/drivers/gpu/drm/cirrus/cirrus_main.c
index 4c2d68e9102d..e4b976658087 100644
--- a/drivers/gpu/drm/cirrus/cirrus_main.c
+++ b/drivers/gpu/drm/cirrus/cirrus_main.c
@@ -320,6 +320,8 @@ bool cirrus_check_framebuffer(struct cirrus_device *cdev, int width, int height,
        const int max_pitch = 0x1FF << 3; /* (4096 - 1) & ~111b bytes */
        const int max_size = cdev->mc.vram_size;
+        if (bpp > cirrus_bpp)
+                return false;
        if (bpp > 32)
                return false;
diff --git a/drivers/gpu/drm/cirrus/cirrus_mode.c b/drivers/gpu/drm/cirrus/cirrus_mode.c
index 99d4a74ffeaf..61385f2298bf 100644
--- a/drivers/gpu/drm/cirrus/cirrus_mode.c
+++ b/drivers/gpu/drm/cirrus/cirrus_mode.c
@@ -501,8 +501,13 @@ static int cirrus_vga_get_modes(struct drm_connector *connector)
        int count;
        /* Just add a static list of modes */
-        count = drm_add_modes_noedid(connector, 1280, 1024);
+        if (cirrus_bpp <= 24) {
-        drm_set_preferred_mode(connector, 1024, 768);
+                count = drm_add_modes_noedid(connector, 1280, 1024);
+                drm_set_preferred_mode(connector, 1024, 768);
+        } else {
+                count = drm_add_modes_noedid(connector, 800, 600);
+                drm_set_preferred_mode(connector, 800, 600);
+        }
        return count;
 }
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 4a78a773151c..bbdbe4721573 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -61,7 +61,7 @@ drm_atomic_helper_plane_changed(struct drm_atomic_state *state,
        struct drm_crtc_state *crtc_state;
        if (plane->state->crtc) {
-                crtc_state = state->crtc_states[drm_crtc_index(plane->crtc)];
+                crtc_state = state->crtc_states[drm_crtc_index(plane->state->crtc)];
                if (WARN_ON(!crtc_state))
                        return;
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 52ce26d6b4fb..dc386ebe5193 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -145,6 +145,31 @@ int drm_fb_helper_add_one_connector(struct drm_fb_helper *fb_helper, struct drm_
 }
 EXPORT_SYMBOL(drm_fb_helper_add_one_connector);
+static void remove_from_modeset(struct drm_mode_set *set,
+                struct drm_connector *connector)
+{
+        int i, j;
+        for (i = 0; i < set->num_connectors; i++) {
+                if (set->connectors[i] == connector)
+                        break;
+        }
+        if (i == set->num_connectors)
+                return;
+        for (j = i + 1; j < set->num_connectors; j++) {
+                set->connectors[j - 1] = set->connectors[j];
+        }
+        set->num_connectors--;
+        /* because i915 is pissy about this..
+         * TODO maybe need to makes sure we set it back to !=NULL somewhere?
+         */
+        if (set->num_connectors == 0)
+                set->fb = NULL;
+}
 int drm_fb_helper_remove_one_connector(struct drm_fb_helper *fb_helper,
                                       struct drm_connector *connector)
 {
@@ -167,6 +192,11 @@ int drm_fb_helper_remove_one_connector(struct drm_fb_helper *fb_helper,
        }
        fb_helper->connector_count--;
        kfree(fb_helper_connector);
+        /* also cleanup dangling references to the connector: */
+        for (i = 0; i < fb_helper->crtc_count; i++)
+                remove_from_modeset(&fb_helper->crtc_info[i].mode_set, connector);
        return 0;
 }
 EXPORT_SYMBOL(drm_fb_helper_remove_one_connector);
@@ -741,7 +771,9 @@ int drm_fb_helper_setcmap(struct fb_cmap *cmap, struct fb_info *info)
        int i, j, rc = 0;
        int start;
-        drm_modeset_lock_all(dev);
+        if (__drm_modeset_lock_all(dev, !!oops_in_progress)) {
+                return -EBUSY;
+        }
        if (!drm_fb_helper_is_bound(fb_helper)) {
                drm_modeset_unlock_all(dev);
                return -EBUSY;
@@ -915,7 +947,9 @@ int drm_fb_helper_pan_display(struct fb_var_screeninfo *var,
        int ret = 0;
        int i;
-        drm_modeset_lock_all(dev);
+        if (__drm_modeset_lock_all(dev, !!oops_in_progress)) {
+                return -EBUSY;
+        }
        if (!drm_fb_helper_is_bound(fb_helper)) {
                drm_modeset_unlock_all(dev);
                return -EBUSY;
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index f5a5f18efa5b..4d79dad9d44f 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -830,6 +830,8 @@ drm_get_last_vbltimestamp(struct drm_device *dev, int crtc,
 * vblank events since the system was booted, including lost events due to
 * modesetting activity.
 *
+ * This is the legacy version of drm_crtc_vblank_count().
+ *
 * Returns:
 * The software vblank counter.
 */
@@ -844,6 +846,25 @@ u32 drm_vblank_count(struct drm_device *dev, int crtc)
 EXPORT_SYMBOL(drm_vblank_count);
 /**
+ * drm_crtc_vblank_count - retrieve "cooked" vblank counter value
+ * @crtc: which counter to retrieve
+ *
+ * Fetches the "cooked" vblank count value that represents the number of
+ * vblank events since the system was booted, including lost events due to
+ * modesetting activity.
+ *
+ * This is the native KMS version of drm_vblank_count().
+ *
+ * Returns:
+ * The software vblank counter.
+ */
+u32 drm_crtc_vblank_count(struct drm_crtc *crtc)
+{
+        return drm_vblank_count(crtc->dev, drm_crtc_index(crtc));
+}
+EXPORT_SYMBOL(drm_crtc_vblank_count);
+/**
 * drm_vblank_count_and_time - retrieve "cooked" vblank counter value
 * and the system timestamp corresponding to that vblank counter value.
 *
@@ -904,6 +925,8 @@ static void send_vblank_event(struct drm_device *dev,
 *
 * Updates sequence # and timestamp on event, and sends it to userspace.
 * Caller must hold event lock.
+ *
+ * This is the legacy version of drm_crtc_send_vblank_event().
 */
 void drm_send_vblank_event(struct drm_device *dev, int crtc,
                struct drm_pending_vblank_event *e)
@@ -923,6 +946,23 @@ void drm_send_vblank_event(struct drm_device *dev, int crtc,
 EXPORT_SYMBOL(drm_send_vblank_event);
 /**
+ * drm_crtc_send_vblank_event - helper to send vblank event after pageflip
+ * @crtc: the source CRTC of the vblank event
+ * @e: the event to send
+ *
+ * Updates sequence # and timestamp on event, and sends it to userspace.
+ * Caller must hold event lock.
+ *
+ * This is the native KMS version of drm_send_vblank_event().
+ */
+void drm_crtc_send_vblank_event(struct drm_crtc *crtc,
+                                struct drm_pending_vblank_event *e)
+{
+        drm_send_vblank_event(crtc->dev, drm_crtc_index(crtc), e);
+}
+EXPORT_SYMBOL(drm_crtc_send_vblank_event);
+/**
 * drm_vblank_enable - enable the vblank interrupt on a CRTC
 * @dev: DRM device
 * @crtc: CRTC in question
@@ -1594,6 +1634,8 @@ static void drm_handle_vblank_events(struct drm_device *dev, int crtc)
 *
 * Drivers should call this routine in their vblank interrupt handlers to
 * update the vblank counter and send any signals that may be pending.
+ *
+ * This is the legacy version of drm_crtc_handle_vblank().
 */
 bool drm_handle_vblank(struct drm_device *dev, int crtc)
 {
@@ -1670,3 +1712,21 @@ bool drm_handle_vblank(struct drm_device *dev, int crtc)
        return true;
 }
 EXPORT_SYMBOL(drm_handle_vblank);
+/**
+ * drm_crtc_handle_vblank - handle a vblank event
+ * @crtc: where this event occurred
+ *
+ * Drivers should call this routine in their vblank interrupt handlers to
+ * update the vblank counter and send any signals that may be pending.
+ *
+ * This is the native KMS version of drm_handle_vblank().
+ *
+ * Returns:
+ * True if the event was successfully handled, false on failure.
+ */
+bool drm_crtc_handle_vblank(struct drm_crtc *crtc)
+{
+        return drm_handle_vblank(crtc->dev, drm_crtc_index(crtc));
+}
+EXPORT_SYMBOL(drm_crtc_handle_vblank);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 121470a83d1a..1bcbe07cecfc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -645,18 +645,6 @@ static int exynos_drm_init(void)
        if (!is_exynos)
                return -ENODEV;
-        /*
-         * Register device object only in case of Exynos SoC.
-         *
-         * Below codes resolves temporarily infinite loop issue incurred
-         * by Exynos drm driver when using multi-platform kernel.
-         * So these codes will be replaced with more generic way later.
-         */
-        if (!of_machine_is_compatible("samsung,exynos3") &&
-                        !of_machine_is_compatible("samsung,exynos4") &&
-                        !of_machine_is_compatible("samsung,exynos5"))
-                return -ENODEV;
        exynos_drm_pdev = platform_device_register_simple("exynos-drm", -1,
                                                                NULL, 0);
        if (IS_ERR(exynos_drm_pdev))
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 5765a161abdd..98051e8e855a 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -1669,7 +1669,6 @@ static void hdmi_mode_apply(struct hdmi_context *hdata)
 static void hdmiphy_conf_reset(struct hdmi_context *hdata)
 {
-        u8 buffer[2];
        u32 reg;
        clk_disable_unprepare(hdata->res.sclk_hdmi);
@@ -1677,11 +1676,8 @@ static void hdmiphy_conf_reset(struct hdmi_context *hdata)
        clk_prepare_enable(hdata->res.sclk_hdmi);
        /* operation mode */
-        buffer[0] = 0x1f;
+        hdmiphy_reg_writeb(hdata, HDMIPHY_MODE_SET_DONE,
-        buffer[1] = 0x00;
+                                HDMI_PHY_ENABLE_MODE_SET);
-        if (hdata->hdmiphy_port)
-                i2c_master_send(hdata->hdmiphy_port, buffer, 2);
        if (hdata->type == HDMI_TYPE13)
                reg = HDMI_V13_PHY_RSTOUT;
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 820b76234ef4..064ed6597def 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -1026,6 +1026,7 @@ static void mixer_win_disable(struct exynos_drm_manager *mgr, int zpos)
 static void mixer_wait_for_vblank(struct exynos_drm_manager *mgr)
 {
        struct mixer_context *mixer_ctx = mgr_to_mixer(mgr);
+        int err;
        mutex_lock(&mixer_ctx->mixer_mutex);
        if (!mixer_ctx->powered) {
@@ -1034,7 +1035,11 @@ static void mixer_wait_for_vblank(struct exynos_drm_manager *mgr)
        }
        mutex_unlock(&mixer_ctx->mixer_mutex);
-        drm_vblank_get(mgr->crtc->dev, mixer_ctx->pipe);
+        err = drm_vblank_get(mgr->crtc->dev, mixer_ctx->pipe);
+        if (err < 0) {
+                DRM_DEBUG_KMS("failed to acquire vblank counter\n");
+                return;
+        }
        atomic_set(&mixer_ctx->wait_vsync_event, 1);
@@ -1262,8 +1267,6 @@ static int mixer_bind(struct device *dev, struct device *manager, void *data)
                return ret;
        }
-        pm_runtime_enable(dev);
        return 0;
 }
@@ -1272,8 +1275,6 @@ static void mixer_unbind(struct device *dev, struct device *master, void *data)
        struct mixer_context *ctx = dev_get_drvdata(dev);
        mixer_mgr_remove(&ctx->manager);
-        pm_runtime_disable(dev);
 }
 static const struct component_ops mixer_component_ops = {
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index d4762799351d..a9041d1a8ff0 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -32,6 +32,8 @@
 struct tda998x_priv {
        struct i2c_client *cec;
        struct i2c_client *hdmi;
+        struct mutex mutex;
+        struct delayed_work dwork;
        uint16_t rev;
        uint8_t current_page;
        int dpms;
@@ -402,9 +404,10 @@ reg_read_range(struct tda998x_priv *priv, uint16_t reg, char *buf, int cnt)
        uint8_t addr = REG2ADDR(reg);
        int ret;
+        mutex_lock(&priv->mutex);
        ret = set_page(priv, reg);
        if (ret < 0)
-                return ret;
+                goto out;
        ret = i2c_master_send(client, &addr, sizeof(addr));
        if (ret < 0)
@@ -414,10 +417,12 @@ reg_read_range(struct tda998x_priv *priv, uint16_t reg, char *buf, int cnt)
        if (ret < 0)
                goto fail;
-        return ret;
+        goto out;
 fail:
        dev_err(&client->dev, "Error %d reading from 0x%x\n", ret, reg);
+out:
+        mutex_unlock(&priv->mutex);
        return ret;
 }
@@ -431,13 +436,16 @@ reg_write_range(struct tda998x_priv *priv, uint16_t reg, uint8_t *p, int cnt)
        buf[0] = REG2ADDR(reg);
        memcpy(&buf[1], p, cnt);
+        mutex_lock(&priv->mutex);
        ret = set_page(priv, reg);
        if (ret < 0)
-                return;
+                goto out;
        ret = i2c_master_send(client, buf, cnt + 1);
        if (ret < 0)
                dev_err(&client->dev, "Error %d writing to 0x%x\n", ret, reg);
+out:
+        mutex_unlock(&priv->mutex);
 }
 static int
@@ -459,13 +467,16 @@ reg_write(struct tda998x_priv *priv, uint16_t reg, uint8_t val)
        uint8_t buf[] = {REG2ADDR(reg), val};
        int ret;
+        mutex_lock(&priv->mutex);
        ret = set_page(priv, reg);
        if (ret < 0)
-                return;
+                goto out;
        ret = i2c_master_send(client, buf, sizeof(buf));
        if (ret < 0)
                dev_err(&client->dev, "Error %d writing to 0x%x\n", ret, reg);
+out:
+        mutex_unlock(&priv->mutex);
 }
 static void
@@ -475,13 +486,16 @@ reg_write16(struct tda998x_priv *priv, uint16_t reg, uint16_t val)
        uint8_t buf[] = {REG2ADDR(reg), val >> 8, val};
        int ret;
+        mutex_lock(&priv->mutex);
        ret = set_page(priv, reg);
        if (ret < 0)
-                return;
+                goto out;
        ret = i2c_master_send(client, buf, sizeof(buf));
        if (ret < 0)
                dev_err(&client->dev, "Error %d writing to 0x%x\n", ret, reg);
+out:
+        mutex_unlock(&priv->mutex);
 }
 static void
@@ -536,6 +550,17 @@ tda998x_reset(struct tda998x_priv *priv)
        reg_write(priv, REG_MUX_VP_VIP_OUT, 0x24);
 }
+/* handle HDMI connect/disconnect */
+static void tda998x_hpd(struct work_struct *work)
+{
+        struct delayed_work *dwork = to_delayed_work(work);
+        struct tda998x_priv *priv =
+                        container_of(dwork, struct tda998x_priv, dwork);
+        if (priv->encoder && priv->encoder->dev)
+                drm_kms_helper_hotplug_event(priv->encoder->dev);
+}
 /*
 * only 2 interrupts may occur: screen plug/unplug and EDID read
 */
@@ -559,8 +584,7 @@ static irqreturn_t tda998x_irq_thread(int irq, void *data)
                priv->wq_edid_wait = 0;
                wake_up(&priv->wq_edid);
        } else if (cec != 0) {                  /* HPD change */
-                if (priv->encoder && priv->encoder->dev)
+                schedule_delayed_work(&priv->dwork, HZ/10);
-                        drm_helper_hpd_irq_event(priv->encoder->dev);
        }
        return IRQ_HANDLED;
 }
@@ -1170,8 +1194,10 @@ static void tda998x_destroy(struct tda998x_priv *priv)
        /* disable all IRQs and free the IRQ handler */
        cec_write(priv, REG_CEC_RXSHPDINTENA, 0);
        reg_clear(priv, REG_INT_FLAGS_2, INT_FLAGS_2_EDID_BLK_RD);
-        if (priv->hdmi->irq)
+        if (priv->hdmi->irq) {
                free_irq(priv->hdmi->irq, priv);
+                cancel_delayed_work_sync(&priv->dwork);
+        }
        i2c_unregister_device(priv->cec);
 }
@@ -1255,6 +1281,7 @@ static int tda998x_create(struct i2c_client *client, struct tda998x_priv *priv)
        struct device_node *np = client->dev.of_node;
        u32 video;
        int rev_lo, rev_hi, ret;
+        unsigned short cec_addr;
        priv->vip_cntrl_0 = VIP_CNTRL_0_SWAP_A(2) | VIP_CNTRL_0_SWAP_B(3);
        priv->vip_cntrl_1 = VIP_CNTRL_1_SWAP_C(0) | VIP_CNTRL_1_SWAP_D(1);
@@ -1262,12 +1289,16 @@ static int tda998x_create(struct i2c_client *client, struct tda998x_priv *priv)
        priv->current_page = 0xff;
        priv->hdmi = client;
-        priv->cec = i2c_new_dummy(client->adapter, 0x34);
+        /* CEC I2C address bound to TDA998x I2C addr by configuration pins */
+        cec_addr = 0x34 + (client->addr & 0x03);
+        priv->cec = i2c_new_dummy(client->adapter, cec_addr);
        if (!priv->cec)
                return -ENODEV;
        priv->dpms = DRM_MODE_DPMS_OFF;
+        mutex_init(&priv->mutex);       /* protect the page access */
        /* wake up the device: */
        cec_write(priv, REG_CEC_ENAMODS,
                        CEC_ENAMODS_EN_RXSENS | CEC_ENAMODS_EN_HDMI);
@@ -1323,8 +1354,9 @@ static int tda998x_create(struct i2c_client *client, struct tda998x_priv *priv)
        if (client->irq) {
                int irqf_trigger;
-                /* init read EDID waitqueue */
+                /* init read EDID waitqueue and HDP work */
                init_waitqueue_head(&priv->wq_edid);
+                INIT_DELAYED_WORK(&priv->dwork, tda998x_hpd);
                /* clear pending interrupts */
                reg_read(priv, REG_INT_FLAGS_0);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index f990ab4c3efb..7643300828c3 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -462,19 +462,13 @@ void intel_detect_pch(struct drm_device *dev)
                        } else if (id == INTEL_PCH_LPT_DEVICE_ID_TYPE) {
                                dev_priv->pch_type = PCH_LPT;
                                DRM_DEBUG_KMS("Found LynxPoint PCH\n");
-                                WARN_ON(!IS_HASWELL(dev));
+                                WARN_ON(!IS_HASWELL(dev) && !IS_BROADWELL(dev));
-                                WARN_ON(IS_HSW_ULT(dev));
+                                WARN_ON(IS_HSW_ULT(dev) || IS_BDW_ULT(dev));
-                        } else if (IS_BROADWELL(dev)) {
-                                dev_priv->pch_type = PCH_LPT;
-                                dev_priv->pch_id =
-                                        INTEL_PCH_LPT_LP_DEVICE_ID_TYPE;
-                                DRM_DEBUG_KMS("This is Broadwell, assuming "
-                                              "LynxPoint LP PCH\n");
                        } else if (id == INTEL_PCH_LPT_LP_DEVICE_ID_TYPE) {
                                dev_priv->pch_type = PCH_LPT;
                                DRM_DEBUG_KMS("Found LynxPoint LP PCH\n");
-                                WARN_ON(!IS_HASWELL(dev));
+                                WARN_ON(!IS_HASWELL(dev) && !IS_BROADWELL(dev));
-                                WARN_ON(!IS_HSW_ULT(dev));
+                                WARN_ON(!IS_HSW_ULT(dev) && !IS_BDW_ULT(dev));
                        } else if (id == INTEL_PCH_SPT_DEVICE_ID_TYPE) {
                                dev_priv->pch_type = PCH_SPT;
                                DRM_DEBUG_KMS("Found SunrisePoint PCH\n");
@@ -811,6 +805,8 @@ int i915_reset(struct drm_device *dev)
        if (!i915.reset)
                return 0;
+        intel_reset_gt_powersave(dev);
        mutex_lock(&dev->struct_mutex);
        i915_gem_reset(dev);
@@ -880,7 +876,7 @@ int i915_reset(struct drm_device *dev)
                 * of re-init after reset.
                 */
                if (INTEL_INFO(dev)->gen > 5)
-                        intel_reset_gt_powersave(dev);
+                        intel_enable_gt_powersave(dev);
        } else {
                mutex_unlock(&dev->struct_mutex);
        }
@@ -1584,7 +1580,7 @@ static struct drm_driver driver = {
        .gem_prime_import = i915_gem_prime_import,
        .dumb_create = i915_gem_dumb_create,
-        .dumb_map_offset = i915_gem_dumb_map_offset,
+        .dumb_map_offset = i915_gem_mmap_gtt,
        .dumb_destroy = drm_gem_dumb_destroy,
        .ioctls = i915_ioctls,
        .fops = &i915_driver_fops,
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 63bcda5541ec..9d7a7155bf02 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1756,8 +1756,6 @@ struct drm_i915_private {
         */
        struct workqueue_struct *dp_wq;
-        uint32_t bios_vgacntr;
        /* Abstract the submission mechanism (legacy ringbuffer or execlists) away */
        struct {
                int (*do_execbuf)(struct drm_device *dev, struct drm_file *file,
@@ -2161,8 +2159,7 @@ struct drm_i915_cmd_table {
 #define IS_HSW_EARLY_SDV(dev)   (IS_HASWELL(dev) && \
                                 (INTEL_DEVID(dev) & 0xFF00) == 0x0C00)
 #define IS_BDW_ULT(dev)         (IS_BROADWELL(dev) && \
-                                 ((INTEL_DEVID(dev) & 0xf) == 0x2  || \
+                                 ((INTEL_DEVID(dev) & 0xf) == 0x6 ||    \
-                                 (INTEL_DEVID(dev) & 0xf) == 0x6 || \
                                 (INTEL_DEVID(dev) & 0xf) == 0xe))
 #define IS_BDW_GT3(dev)         (IS_BROADWELL(dev) && \
                                 (INTEL_DEVID(dev) & 0x00F0) == 0x0020)
@@ -2501,9 +2498,8 @@ void i915_vma_move_to_active(struct i915_vma *vma,
 int i915_gem_dumb_create(struct drm_file *file_priv,
                         struct drm_device *dev,
                         struct drm_mode_create_dumb *args);
-int i915_gem_dumb_map_offset(struct drm_file *file_priv,
+int i915_gem_mmap_gtt(struct drm_file *file_priv, struct drm_device *dev,
-                             struct drm_device *dev, uint32_t handle,
+                      uint32_t handle, uint64_t *offset);
-                             uint64_t *offset);
 /**
 * Returns true if seq1 is later than seq2.
 */
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 4a9faea626db..5f614828d365 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -401,7 +401,6 @@ static int
 i915_gem_create(struct drm_file *file,
                struct drm_device *dev,
                uint64_t size,
-                bool dumb,
                uint32_t *handle_p)
 {
        struct drm_i915_gem_object *obj;
@@ -417,7 +416,6 @@ i915_gem_create(struct drm_file *file,
        if (obj == NULL)
                return -ENOMEM;
-        obj->base.dumb = dumb;
        ret = drm_gem_handle_create(file, &obj->base, &handle);
        /* drop reference from allocate - handle holds it now */
        drm_gem_object_unreference_unlocked(&obj->base);
@@ -437,7 +435,7 @@ i915_gem_dumb_create(struct drm_file *file,
        args->pitch = ALIGN(args->width * DIV_ROUND_UP(args->bpp, 8), 64);
        args->size = args->pitch * args->height;
        return i915_gem_create(file, dev,
-                               args->size, true, &args->handle);
+                               args->size, &args->handle);
 }
 /**
@@ -450,7 +448,7 @@ i915_gem_create_ioctl(struct drm_device *dev, void *data,
        struct drm_i915_gem_create *args = data;
        return i915_gem_create(file, dev,
-                               args->size, false, &args->handle);
+                               args->size, &args->handle);
 }
 static inline int
@@ -1050,6 +1048,7 @@ int
 i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                      struct drm_file *file)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_pwrite *args = data;
        struct drm_i915_gem_object *obj;
        int ret;
@@ -1069,9 +1068,11 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                        return -EFAULT;
        }
+        intel_runtime_pm_get(dev_priv);
        ret = i915_mutex_lock_interruptible(dev);
        if (ret)
-                return ret;
+                goto put_rpm;
        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (&obj->base == NULL) {
@@ -1123,6 +1124,9 @@ out:
        drm_gem_object_unreference(&obj->base);
 unlock:
        mutex_unlock(&dev->struct_mutex);
+put_rpm:
+        intel_runtime_pm_put(dev_priv);
        return ret;
 }
@@ -1840,10 +1844,10 @@ static void i915_gem_object_free_mmap_offset(struct drm_i915_gem_object *obj)
        drm_gem_free_mmap_offset(&obj->base);
 }
-static int
+int
 i915_gem_mmap_gtt(struct drm_file *file,
                  struct drm_device *dev,
-                  uint32_t handle, bool dumb,
+                  uint32_t handle,
                  uint64_t *offset)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -1860,13 +1864,6 @@ i915_gem_mmap_gtt(struct drm_file *file,
                goto unlock;
        }
-        /*
-         * We don't allow dumb mmaps on objects created using another
-         * interface.
-         */
-        WARN_ONCE(dumb && !(obj->base.dumb || obj->base.import_attach),
-                  "Illegal dumb map of accelerated buffer.\n");
        if (obj->base.size > dev_priv->gtt.mappable_end) {
                ret = -E2BIG;
                goto out;
@@ -1891,15 +1888,6 @@ unlock:
        return ret;
 }
-int
-i915_gem_dumb_map_offset(struct drm_file *file,
-                         struct drm_device *dev,
-                         uint32_t handle,
-                         uint64_t *offset)
-{
-        return i915_gem_mmap_gtt(file, dev, handle, true, offset);
-}
 /**
 * i915_gem_mmap_gtt_ioctl - prepare an object for GTT mmap'ing
 * @dev: DRM device
@@ -1921,7 +1909,7 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
 {
        struct drm_i915_gem_mmap_gtt *args = data;
-        return i915_gem_mmap_gtt(file, dev, args->handle, false, &args->offset);
+        return i915_gem_mmap_gtt(file, dev, args->handle, &args->offset);
 }
 static inline int
@@ -3160,6 +3148,13 @@ static void i965_write_fence_reg(struct drm_device *dev, int reg,
                u32 size = i915_gem_obj_ggtt_size(obj);
                uint64_t val;
+                /* Adjust fence size to match tiled area */
+                if (obj->tiling_mode != I915_TILING_NONE) {
+                        uint32_t row_size = obj->stride *
+                                (obj->tiling_mode == I915_TILING_Y ? 32 : 8);
+                        size = (size / row_size) * row_size;
+                }
                val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) &
                                 0xfffff000) << 32;
                val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000;
@@ -4896,25 +4891,18 @@ i915_gem_init_hw(struct drm_device *dev)
        for (i = 0; i < NUM_L3_SLICES(dev); i++)
                i915_gem_l3_remap(&dev_priv->ring[RCS], i);
-        /*
+        ret = i915_ppgtt_init_hw(dev);
-         * XXX: Contexts should only be initialized once. Doing a switch to the
-         * default context switch however is something we'd like to do after
-         * reset or thaw (the latter may not actually be necessary for HW, but
-         * goes with our code better). Context switching requires rings (for
-         * the do_switch), but before enabling PPGTT. So don't move this.
-         */
-        ret = i915_gem_context_enable(dev_priv);
        if (ret && ret != -EIO) {
-                DRM_ERROR("Context enable failed %d\n", ret);
+                DRM_ERROR("PPGTT enable failed %d\n", ret);
                i915_gem_cleanup_ringbuffer(dev);
-                return ret;
        }
-        ret = i915_ppgtt_init_hw(dev);
+        ret = i915_gem_context_enable(dev_priv);
        if (ret && ret != -EIO) {
-                DRM_ERROR("PPGTT enable failed %d\n", ret);
+                DRM_ERROR("Context enable failed %d\n", ret);
                i915_gem_cleanup_ringbuffer(dev);
+                return ret;
        }
        return ret;
@@ -5167,7 +5155,7 @@ static bool mutex_is_locked_by(struct mutex *mutex, struct task_struct *task)
        if (!mutex_is_locked(mutex))
                return false;
-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_MUTEXES)
+#if defined(CONFIG_SMP) && !defined(CONFIG_DEBUG_MUTEXES)
        return mutex->owner == task;
 #else
        /* Since UP may be pre-empted, we cannot assume that we own the lock */
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index d17ff435f276..d011ec82ef1e 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -473,7 +473,12 @@ mi_set_context(struct intel_engine_cs *ring,
               u32 hw_flags)
 {
        u32 flags = hw_flags | MI_MM_SPACE_GTT;
-        int ret;
+        const int num_rings =
+                /* Use an extended w/a on ivb+ if signalling from other rings */
+                i915_semaphore_is_enabled(ring->dev) ?
+                hweight32(INTEL_INFO(ring->dev)->ring_mask) - 1 :
+                0;
+        int len, i, ret;
        /* w/a: If Flush TLB Invalidation Mode is enabled, driver must do a TLB
         * invalidation prior to MI_SET_CONTEXT. On GEN6 we don't set the value
@@ -490,15 +495,31 @@ mi_set_context(struct intel_engine_cs *ring,
        if (!IS_HASWELL(ring->dev) && INTEL_INFO(ring->dev)->gen < 8)
                flags |= (MI_SAVE_EXT_STATE_EN | MI_RESTORE_EXT_STATE_EN);
-        ret = intel_ring_begin(ring, 6);
+        len = 4;
+        if (INTEL_INFO(ring->dev)->gen >= 7)
+                len += 2 + (num_rings ? 4*num_rings + 2 : 0);
+        ret = intel_ring_begin(ring, len);
        if (ret)
                return ret;
        /* WaProgramMiArbOnOffAroundMiSetContext:ivb,vlv,hsw,bdw,chv */
-        if (INTEL_INFO(ring->dev)->gen >= 7)
+        if (INTEL_INFO(ring->dev)->gen >= 7) {
                intel_ring_emit(ring, MI_ARB_ON_OFF | MI_ARB_DISABLE);
-        else
+                if (num_rings) {
-                intel_ring_emit(ring, MI_NOOP);
+                        struct intel_engine_cs *signaller;
+                        intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(num_rings));
+                        for_each_ring(signaller, to_i915(ring->dev), i) {
+                                if (signaller == ring)
+                                        continue;
+                                intel_ring_emit(ring, RING_PSMI_CTL(signaller->mmio_base));
+                                intel_ring_emit(ring, _MASKED_BIT_ENABLE(GEN6_PSMI_SLEEP_MSG_DISABLE));
+                        }
+                }
+        }
        intel_ring_emit(ring, MI_NOOP);
        intel_ring_emit(ring, MI_SET_CONTEXT);
@@ -510,10 +531,21 @@ mi_set_context(struct intel_engine_cs *ring,
         */
        intel_ring_emit(ring, MI_NOOP);
-        if (INTEL_INFO(ring->dev)->gen >= 7)
+        if (INTEL_INFO(ring->dev)->gen >= 7) {
+                if (num_rings) {
+                        struct intel_engine_cs *signaller;
+                        intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(num_rings));
+                        for_each_ring(signaller, to_i915(ring->dev), i) {
+                                if (signaller == ring)
+                                        continue;
+                                intel_ring_emit(ring, RING_PSMI_CTL(signaller->mmio_base));
+                                intel_ring_emit(ring, _MASKED_BIT_DISABLE(GEN6_PSMI_SLEEP_MSG_DISABLE));
+                        }
+                }
                intel_ring_emit(ring, MI_ARB_ON_OFF | MI_ARB_ENABLE);
-        else
+        }
-                intel_ring_emit(ring, MI_NOOP);
        intel_ring_advance(ring);
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index f06027ba3ee5..11738316394a 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -121,9 +121,6 @@ eb_lookup_vmas(struct eb_vmas *eb,
                        goto err;
                }
-                WARN_ONCE(obj->base.dumb,
-                          "GPU use of dumb buffer is illegal.\n");
                drm_gem_object_reference(&obj->base);
                list_add_tail(&obj->obj_exec_link, &objects);
        }
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 981834b0f9b6..b051a238baf9 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -281,13 +281,34 @@ void gen6_enable_rps_interrupts(struct drm_device *dev)
        struct drm_i915_private *dev_priv = dev->dev_private;
        spin_lock_irq(&dev_priv->irq_lock);
        WARN_ON(dev_priv->rps.pm_iir);
        WARN_ON(I915_READ(gen6_pm_iir(dev_priv)) & dev_priv->pm_rps_events);
        dev_priv->rps.interrupts_enabled = true;
+        I915_WRITE(gen6_pm_ier(dev_priv), I915_READ(gen6_pm_ier(dev_priv)) |
+                                dev_priv->pm_rps_events);
        gen6_enable_pm_irq(dev_priv, dev_priv->pm_rps_events);
        spin_unlock_irq(&dev_priv->irq_lock);
 }
+u32 gen6_sanitize_rps_pm_mask(struct drm_i915_private *dev_priv, u32 mask)
+{
+        /*
+         * SNB,IVB can while VLV,CHV may hard hang on looping batchbuffer
+         * if GEN6_PM_UP_EI_EXPIRED is masked.
+         *
+         * TODO: verify if this can be reproduced on VLV,CHV.
+         */
+        if (INTEL_INFO(dev_priv)->gen <= 7 && !IS_HASWELL(dev_priv))
+                mask &= ~GEN6_PM_RP_UP_EI_EXPIRED;
+        if (INTEL_INFO(dev_priv)->gen >= 8)
+                mask &= ~GEN8_PMINTR_REDIRECT_TO_NON_DISP;
+        return mask;
+}
 void gen6_disable_rps_interrupts(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -300,8 +321,7 @@ void gen6_disable_rps_interrupts(struct drm_device *dev)
        spin_lock_irq(&dev_priv->irq_lock);
-        I915_WRITE(GEN6_PMINTRMSK, INTEL_INFO(dev_priv)->gen >= 8 ?
+        I915_WRITE(GEN6_PMINTRMSK, gen6_sanitize_rps_pm_mask(dev_priv, ~0));
-                   ~GEN8_PMINTR_REDIRECT_TO_NON_DISP : ~0);
        __gen6_disable_pm_irq(dev_priv, dev_priv->pm_rps_events);
        I915_WRITE(gen6_pm_ier(dev_priv), I915_READ(gen6_pm_ier(dev_priv)) &
@@ -3307,8 +3327,10 @@ static void gen5_gt_irq_postinstall(struct drm_device *dev)
        GEN5_IRQ_INIT(GT, dev_priv->gt_irq_mask, gt_irqs);
        if (INTEL_INFO(dev)->gen >= 6) {
-                pm_irqs |= dev_priv->pm_rps_events;
+                /*
+                 * RPS interrupts will get enabled/disabled on demand when RPS
+                 * itself is enabled/disabled.
+                 */
                if (HAS_VEBOX(dev))
                        pm_irqs |= PM_VEBOX_USER_INTERRUPT;
@@ -3520,7 +3542,11 @@ static void gen8_gt_irq_postinstall(struct drm_i915_private *dev_priv)
        dev_priv->pm_irq_mask = 0xffffffff;
        GEN8_IRQ_INIT_NDX(GT, 0, ~gt_interrupts[0], gt_interrupts[0]);
        GEN8_IRQ_INIT_NDX(GT, 1, ~gt_interrupts[1], gt_interrupts[1]);
-        GEN8_IRQ_INIT_NDX(GT, 2, dev_priv->pm_irq_mask, dev_priv->pm_rps_events);
+        /*
+         * RPS interrupts will get enabled/disabled on demand when RPS itself
+         * is enabled/disabled.
+         */
+        GEN8_IRQ_INIT_NDX(GT, 2, dev_priv->pm_irq_mask, 0);
        GEN8_IRQ_INIT_NDX(GT, 3, ~gt_interrupts[3], gt_interrupts[3]);
 }
@@ -3609,7 +3635,7 @@ static void vlv_display_irq_uninstall(struct drm_i915_private *dev_priv)
        vlv_display_irq_reset(dev_priv);
-        dev_priv->irq_mask = 0;
+        dev_priv->irq_mask = ~0;
 }
 static void valleyview_irq_uninstall(struct drm_device *dev)
@@ -3715,8 +3741,6 @@ static bool i8xx_handle_vblank(struct drm_device *dev,
        if ((iir & flip_pending) == 0)
                goto check_page_flip;
-        intel_prepare_page_flip(dev, plane);
        /* We detect FlipDone by looking for the change in PendingFlip from '1'
         * to '0' on the following vblank, i.e. IIR has the Pendingflip
         * asserted following the MI_DISPLAY_FLIP, but ISR is deasserted, hence
@@ -3726,6 +3750,7 @@ static bool i8xx_handle_vblank(struct drm_device *dev,
        if (I915_READ16(ISR) & flip_pending)
                goto check_page_flip;
+        intel_prepare_page_flip(dev, plane);
        intel_finish_page_flip(dev, pipe);
        return true;
@@ -3897,8 +3922,6 @@ static bool i915_handle_vblank(struct drm_device *dev,
        if ((iir & flip_pending) == 0)
                goto check_page_flip;
-        intel_prepare_page_flip(dev, plane);
        /* We detect FlipDone by looking for the change in PendingFlip from '1'
         * to '0' on the following vblank, i.e. IIR has the Pendingflip
         * asserted following the MI_DISPLAY_FLIP, but ISR is deasserted, hence
@@ -3908,6 +3931,7 @@ static bool i915_handle_vblank(struct drm_device *dev,
        if (I915_READ(ISR) & flip_pending)
                goto check_page_flip;
+        intel_prepare_page_flip(dev, plane);
        intel_finish_page_flip(dev, pipe);
        return true;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index eefdc238f70b..172de3b3433b 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -395,6 +395,7 @@
 #define   PIPE_CONTROL_STORE_DATA_INDEX                 (1<<21)
 #define   PIPE_CONTROL_CS_STALL                         (1<<20)
 #define   PIPE_CONTROL_TLB_INVALIDATE                   (1<<18)
+#define   PIPE_CONTROL_MEDIA_STATE_CLEAR                (1<<16)
 #define   PIPE_CONTROL_QW_WRITE                         (1<<14)
 #define   PIPE_CONTROL_POST_SYNC_OP_MASK                (3<<14)
 #define   PIPE_CONTROL_DEPTH_STALL                      (1<<13)
@@ -1128,6 +1129,7 @@ enum punit_power_well {
 #define GEN6_VERSYNC    (RING_SYNC_1(VEBOX_RING_BASE))
 #define GEN6_VEVSYNC    (RING_SYNC_2(VEBOX_RING_BASE))
 #define GEN6_NOSYNC 0
+#define RING_PSMI_CTL(base)     ((base)+0x50)
 #define RING_MAX_IDLE(base)     ((base)+0x54)
 #define RING_HWS_PGA(base)      ((base)+0x80)
 #define RING_HWS_PGA_GEN6(base) ((base)+0x2080)
@@ -1458,6 +1460,7 @@ enum punit_power_well {
 #define   GEN6_BLITTER_FBC_NOTIFY                       (1<<3)
 #define GEN6_RC_SLEEP_PSMI_CONTROL      0x2050
+#define   GEN6_PSMI_SLEEP_MSG_DISABLE   (1 << 0)
 #define   GEN8_RC_SEMA_IDLE_MSG_DISABLE (1 << 12)
 #define   GEN8_FF_DOP_CLOCK_GATE_DISABLE        (1<<10)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index fb3e3d429191..e7a16f119a29 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9815,7 +9815,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
                if (obj->tiling_mode != work->old_fb_obj->tiling_mode)
                        /* vlv: DISPLAY_FLIP fails to change tiling */
                        ring = NULL;
-        } else if (IS_IVYBRIDGE(dev)) {
+        } else if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev)) {
                ring = &dev_priv->ring[BCS];
        } else if (INTEL_INFO(dev)->gen >= 7) {
                ring = obj->ring;
@@ -13057,11 +13057,7 @@ static void i915_disable_vga(struct drm_device *dev)
        vga_put(dev->pdev, VGA_RSRC_LEGACY_IO);
        udelay(300);
-        /*
+        I915_WRITE(vga_reg, VGA_DISP_DISABLE);
-         * Fujitsu-Siemens Lifebook S6010 (830) has problems resuming
-         * from S3 without preserving (some of?) the other bits.
-         */
-        I915_WRITE(vga_reg, dev_priv->bios_vgacntr | VGA_DISP_DISABLE);
        POSTING_READ(vga_reg);
 }
@@ -13146,8 +13142,6 @@ void intel_modeset_init(struct drm_device *dev)
        intel_shared_dpll_init(dev);
-        /* save the BIOS value before clobbering it */
-        dev_priv->bios_vgacntr = I915_READ(i915_vgacntrl_reg(dev));
        /* Just disable it once at startup */
        i915_disable_vga(dev);
        intel_setup_outputs(dev);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 25fdbb16d4e0..3b40a17b8852 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -794,6 +794,7 @@ void gen6_disable_pm_irq(struct drm_i915_private *dev_priv, uint32_t mask);
 void gen6_reset_rps_interrupts(struct drm_device *dev);
 void gen6_enable_rps_interrupts(struct drm_device *dev);
 void gen6_disable_rps_interrupts(struct drm_device *dev);
+u32 gen6_sanitize_rps_pm_mask(struct drm_i915_private *dev_priv, u32 mask);
 void intel_runtime_pm_disable_interrupts(struct drm_i915_private *dev_priv);
 void intel_runtime_pm_enable_interrupts(struct drm_i915_private *dev_priv);
 static inline bool intel_irqs_enabled(struct drm_i915_private *dev_priv)
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 4d63839bd9b4..dfb783a8f2c3 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -962,7 +962,7 @@ void intel_panel_enable_backlight(struct intel_connector *connector)
        WARN_ON(panel->backlight.max == 0);
-        if (panel->backlight.level == 0) {
+        if (panel->backlight.level <= panel->backlight.min) {
                panel->backlight.level = panel->backlight.max;
                if (panel->backlight.device)
                        panel->backlight.device->props.brightness =
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 1f4b56e273c8..bf814a64582a 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4363,16 +4363,7 @@ static u32 gen6_rps_pm_mask(struct drm_i915_private *dev_priv, u8 val)
        mask |= dev_priv->pm_rps_events & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED);
        mask &= dev_priv->pm_rps_events;
-        /* IVB and SNB hard hangs on looping batchbuffer
+        return gen6_sanitize_rps_pm_mask(dev_priv, ~mask);
-         * if GEN6_PM_UP_EI_EXPIRED is masked.
-         */
-        if (INTEL_INFO(dev_priv->dev)->gen <= 7 && !IS_HASWELL(dev_priv->dev))
-                mask |= GEN6_PM_RP_UP_EI_EXPIRED;
-        if (IS_GEN8(dev_priv->dev))
-                mask |= GEN8_PMINTR_REDIRECT_TO_NON_DISP;
-        return ~mask;
 }
 /* gen6_set_rps is called to update the frequency request, but should also be
@@ -4441,7 +4432,8 @@ static void vlv_set_rps_idle(struct drm_i915_private *dev_priv)
                return;
        /* Mask turbo interrupt so that they will not come in between */
-        I915_WRITE(GEN6_PMINTRMSK, 0xffffffff);
+        I915_WRITE(GEN6_PMINTRMSK,
+                   gen6_sanitize_rps_pm_mask(dev_priv, ~0));
        vlv_force_gfx_clock(dev_priv, true);
@@ -6191,6 +6183,20 @@ void intel_cleanup_gt_powersave(struct drm_device *dev)
                valleyview_cleanup_gt_powersave(dev);
 }
+static void gen6_suspend_rps(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        flush_delayed_work(&dev_priv->rps.delayed_resume_work);
+        /*
+         * TODO: disable RPS interrupts on GEN9+ too once RPS support
+         * is added for it.
+         */
+        if (INTEL_INFO(dev)->gen < 9)
+                gen6_disable_rps_interrupts(dev);
+}
 /**
 * intel_suspend_gt_powersave - suspend PM work and helper threads
 * @dev: drm device
@@ -6206,14 +6212,7 @@ void intel_suspend_gt_powersave(struct drm_device *dev)
        if (INTEL_INFO(dev)->gen < 6)
                return;
-        flush_delayed_work(&dev_priv->rps.delayed_resume_work);
+        gen6_suspend_rps(dev);
-        /*
-         * TODO: disable RPS interrupts on GEN9+ too once RPS support
-         * is added for it.
-         */
-        if (INTEL_INFO(dev)->gen < 9)
-                gen6_disable_rps_interrupts(dev);
        /* Force GPU to min freq during suspend */
        gen6_rps_idle(dev_priv);
@@ -6316,8 +6315,11 @@ void intel_reset_gt_powersave(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (INTEL_INFO(dev)->gen < 6)
+                return;
+        gen6_suspend_rps(dev);
        dev_priv->rps.enabled = false;
-        intel_enable_gt_powersave(dev);
 }
 static void ibx_init_clock_gating(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 9f445e9a75d1..c7bc93d28d84 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -362,12 +362,15 @@ gen7_render_ring_flush(struct intel_engine_cs *ring,
                flags |= PIPE_CONTROL_VF_CACHE_INVALIDATE;
                flags |= PIPE_CONTROL_CONST_CACHE_INVALIDATE;
                flags |= PIPE_CONTROL_STATE_CACHE_INVALIDATE;
+                flags |= PIPE_CONTROL_MEDIA_STATE_CLEAR;
                /*
                 * TLB invalidate requires a post-sync write.
                 */
                flags |= PIPE_CONTROL_QW_WRITE;
                flags |= PIPE_CONTROL_GLOBAL_GTT_IVB;
+                flags |= PIPE_CONTROL_STALL_AT_SCOREBOARD;
                /* Workaround: we must issue a pipe_control with CS-stall bit
                 * set before a pipe_control command that has the state cache
                 * invalidate bit set. */
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index f5a78d53e297..ac6da7102fbb 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -615,29 +615,6 @@ static void chv_pipe_power_well_disable(struct drm_i915_private *dev_priv,
                vlv_power_sequencer_reset(dev_priv);
 }
-static void check_power_well_state(struct drm_i915_private *dev_priv,
-                                   struct i915_power_well *power_well)
-{
-        bool enabled = power_well->ops->is_enabled(dev_priv, power_well);
-        if (power_well->always_on || !i915.disable_power_well) {
-                if (!enabled)
-                        goto mismatch;
-                return;
-        }
-        if (enabled != (power_well->count > 0))
-                goto mismatch;
-        return;
-mismatch:
-        WARN(1, "state mismatch for '%s' (always_on %d hw state %d use-count %d disable_power_well %d\n",
-                  power_well->name, power_well->always_on, enabled,
-                  power_well->count, i915.disable_power_well);
-}
 /**
 * intel_display_power_get - grab a power domain reference
 * @dev_priv: i915 device instance
@@ -669,8 +646,6 @@ void intel_display_power_get(struct drm_i915_private *dev_priv,
                        power_well->ops->enable(dev_priv, power_well);
                        power_well->hw_enabled = true;
                }
-                check_power_well_state(dev_priv, power_well);
        }
        power_domains->domain_use_count[domain]++;
@@ -709,8 +684,6 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
                        power_well->hw_enabled = false;
                        power_well->ops->disable(dev_priv, power_well);
                }
-                check_power_well_state(dev_priv, power_well);
        }
        mutex_unlock(&power_domains->lock);
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index aa873048308b..94a5bee69fe7 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -386,9 +386,7 @@ void adreno_gpu_cleanup(struct adreno_gpu *gpu)
                        msm_gem_put_iova(gpu->memptrs_bo, gpu->base.id);
                drm_gem_object_unreference(gpu->memptrs_bo);
        }
-        if (gpu->pm4)
+        release_firmware(gpu->pm4);
-                release_firmware(gpu->pm4);
+        release_firmware(gpu->pfp);
-        if (gpu->pfp)
-                release_firmware(gpu->pfp);
        msm_gpu_cleanup(&gpu->base);
 }
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
index fbebb0405d76..b4e70e0e3cfa 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
@@ -141,6 +141,15 @@ static int hpd_enable(struct hdmi_connector *hdmi_connector)
        uint32_t hpd_ctrl;
        int i, ret;
+        for (i = 0; i < config->hpd_reg_cnt; i++) {
+                ret = regulator_enable(hdmi->hpd_regs[i]);
+                if (ret) {
+                        dev_err(dev->dev, "failed to enable hpd regulator: %s (%d)\n",
+                                        config->hpd_reg_names[i], ret);
+                        goto fail;
+                }
+        }
        ret = gpio_config(hdmi, true);
        if (ret) {
                dev_err(dev->dev, "failed to configure GPIOs: %d\n", ret);
@@ -164,15 +173,6 @@ static int hpd_enable(struct hdmi_connector *hdmi_connector)
                }
        }
-        for (i = 0; i < config->hpd_reg_cnt; i++) {
-                ret = regulator_enable(hdmi->hpd_regs[i]);
-                if (ret) {
-                        dev_err(dev->dev, "failed to enable hpd regulator: %s (%d)\n",
-                                        config->hpd_reg_names[i], ret);
-                        goto fail;
-                }
-        }
        hdmi_set_mode(hdmi, false);
        phy->funcs->reset(phy);
        hdmi_set_mode(hdmi, true);
@@ -200,7 +200,7 @@ fail:
        return ret;
 }
-static int hdp_disable(struct hdmi_connector *hdmi_connector)
+static void hdp_disable(struct hdmi_connector *hdmi_connector)
 {
        struct hdmi *hdmi = hdmi_connector->hdmi;
        const struct hdmi_platform_config *config = hdmi->config;
@@ -212,28 +212,19 @@ static int hdp_disable(struct hdmi_connector *hdmi_connector)
        hdmi_set_mode(hdmi, false);
-        for (i = 0; i < config->hpd_reg_cnt; i++) {
-                ret = regulator_disable(hdmi->hpd_regs[i]);
-                if (ret) {
-                        dev_err(dev->dev, "failed to disable hpd regulator: %s (%d)\n",
-                                        config->hpd_reg_names[i], ret);
-                        goto fail;
-                }
-        }
        for (i = 0; i < config->hpd_clk_cnt; i++)
                clk_disable_unprepare(hdmi->hpd_clks[i]);
        ret = gpio_config(hdmi, false);
-        if (ret) {
+        if (ret)
-                dev_err(dev->dev, "failed to unconfigure GPIOs: %d\n", ret);
+                dev_warn(dev->dev, "failed to unconfigure GPIOs: %d\n", ret);
-                goto fail;
-        }
-        return 0;
-fail:
+        for (i = 0; i < config->hpd_reg_cnt; i++) {
-        return ret;
+                ret = regulator_disable(hdmi->hpd_regs[i]);
+                if (ret)
+                        dev_warn(dev->dev, "failed to disable hpd regulator: %s (%d)\n",
+                                        config->hpd_reg_names[i], ret);
+        }
 }
 static void
@@ -260,11 +251,11 @@ void hdmi_connector_irq(struct drm_connector *connector)
                        (hpd_int_status & HDMI_HPD_INT_STATUS_INT)) {
                bool detected = !!(hpd_int_status & HDMI_HPD_INT_STATUS_CABLE_DETECTED);
-                DBG("status=%04x, ctrl=%04x", hpd_int_status, hpd_int_ctrl);
+                /* ack & disable (temporarily) HPD events: */
-                /* ack the irq: */
                hdmi_write(hdmi, REG_HDMI_HPD_INT_CTRL,
-                                hpd_int_ctrl | HDMI_HPD_INT_CTRL_INT_ACK);
+                        HDMI_HPD_INT_CTRL_INT_ACK);
+                DBG("status=%04x, ctrl=%04x", hpd_int_status, hpd_int_ctrl);
                /* detect disconnect if we are connected or visa versa: */
                hpd_int_ctrl = HDMI_HPD_INT_CTRL_INT_EN;
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
index a7672e100d8b..3449213f1e76 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
@@ -331,17 +331,8 @@ static int mdp4_crtc_atomic_check(struct drm_crtc *crtc,
                struct drm_crtc_state *state)
 {
        struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
-        struct drm_device *dev = crtc->dev;
        DBG("%s: check", mdp4_crtc->name);
-        if (mdp4_crtc->event) {
-                dev_err(dev->dev, "already pending flip!\n");
-                return -EBUSY;
-        }
        // TODO anything else to check?
        return 0;
 }
@@ -357,7 +348,7 @@ static void mdp4_crtc_atomic_flush(struct drm_crtc *crtc)
        struct drm_device *dev = crtc->dev;
        unsigned long flags;
-        DBG("%s: flush", mdp4_crtc->name);
+        DBG("%s: event: %p", mdp4_crtc->name, crtc->state->event);
        WARN_ON(mdp4_crtc->event);
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index 0e9a2e3a82d7..f021f960a8a2 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -303,11 +303,6 @@ static int mdp5_crtc_atomic_check(struct drm_crtc *crtc,
        DBG("%s: check", mdp5_crtc->name);
-        if (mdp5_crtc->event) {
-                dev_err(dev->dev, "already pending flip!\n");
-                return -EBUSY;
-        }
        /* request a free CTL, if none is already allocated for this CRTC */
        if (state->enable && !mdp5_crtc->ctl) {
                mdp5_crtc->ctl = mdp5_ctlm_request(mdp5_kms->ctlm, crtc);
@@ -364,7 +359,7 @@ static void mdp5_crtc_atomic_flush(struct drm_crtc *crtc)
        struct drm_device *dev = crtc->dev;
        unsigned long flags;
-        DBG("%s: flush", mdp5_crtc->name);
+        DBG("%s: event: %p", mdp5_crtc->name, crtc->state->event);
        WARN_ON(mdp5_crtc->event);
@@ -460,10 +455,7 @@ void mdp5_crtc_set_intf(struct drm_crtc *crtc, int intf,
        /* now that we know what irq's we want: */
        mdp5_crtc->err.irqmask = intf2err(intf);
        mdp5_crtc->vblank.irqmask = intf2vblank(intf);
+        mdp_irq_update(&mdp5_kms->base);
-        /* when called from modeset_init(), skip the rest until later: */
-        if (!mdp5_kms)
-                return;
        spin_lock_irqsave(&mdp5_kms->resource_lock, flags);
        intf_sel = mdp5_read(mdp5_kms, REG_MDP5_DISP_INTF_SEL);
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index a11f1b80c488..9f01a4f21af2 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -216,17 +216,7 @@ static int modeset_init(struct mdp5_kms *mdp5_kms)
                goto fail;
        }
-        /* NOTE: the vsync and error irq's are actually associated with
+        encoder->possible_crtcs = (1 << priv->num_crtcs) - 1;;
-         * the INTF/encoder.. the easiest way to deal with this (ie. what
-         * we do now) is assume a fixed relationship between crtc's and
-         * encoders.  I'm not sure if there is ever a need to more freely
-         * assign crtcs to encoders, but if there is then we need to take
-         * care of error and vblank irq's that the crtc has registered,
-         * and also update user-requested vblank_mask.
-         */
-        encoder->possible_crtcs = BIT(0);
-        mdp5_crtc_set_intf(priv->crtcs[0], 3, INTF_HDMI);
        priv->encoders[priv->num_encoders++] = encoder;
        /* Construct bridge/connector for HDMI: */
diff --git a/drivers/gpu/drm/msm/mdp/mdp_kms.c b/drivers/gpu/drm/msm/mdp/mdp_kms.c
index 03455b64a245..2a731722d840 100644
--- a/drivers/gpu/drm/msm/mdp/mdp_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp_kms.c
@@ -42,7 +42,10 @@ static void update_irq(struct mdp_kms *mdp_kms)
        mdp_kms->funcs->set_irqmask(mdp_kms, irqmask);
 }
-static void update_irq_unlocked(struct mdp_kms *mdp_kms)
+/* if an mdp_irq's irqmask has changed, such as when mdp5 crtc<->encoder
+ * link changes, this must be called to figure out the new global irqmask
+ */
+void mdp_irq_update(struct mdp_kms *mdp_kms)
 {
        unsigned long flags;
        spin_lock_irqsave(&list_lock, flags);
@@ -122,7 +125,7 @@ void mdp_irq_register(struct mdp_kms *mdp_kms, struct mdp_irq *irq)
        spin_unlock_irqrestore(&list_lock, flags);
        if (needs_update)
-                update_irq_unlocked(mdp_kms);
+                mdp_irq_update(mdp_kms);
 }
 void mdp_irq_unregister(struct mdp_kms *mdp_kms, struct mdp_irq *irq)
@@ -141,5 +144,5 @@ void mdp_irq_unregister(struct mdp_kms *mdp_kms, struct mdp_irq *irq)
        spin_unlock_irqrestore(&list_lock, flags);
        if (needs_update)
-                update_irq_unlocked(mdp_kms);
+                mdp_irq_update(mdp_kms);
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp_kms.h b/drivers/gpu/drm/msm/mdp/mdp_kms.h
index 99557b5ad4fd..b268ce95d394 100644
--- a/drivers/gpu/drm/msm/mdp/mdp_kms.h
+++ b/drivers/gpu/drm/msm/mdp/mdp_kms.h
@@ -75,7 +75,7 @@ void mdp_update_vblank_mask(struct mdp_kms *mdp_kms, uint32_t mask, bool enable)
 void mdp_irq_wait(struct mdp_kms *mdp_kms, uint32_t irqmask);
 void mdp_irq_register(struct mdp_kms *mdp_kms, struct mdp_irq *irq);
 void mdp_irq_unregister(struct mdp_kms *mdp_kms, struct mdp_irq *irq);
+void mdp_irq_update(struct mdp_kms *mdp_kms);
 /*
 * pixel format helpers:
diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
index f0de412e13dc..191968256c58 100644
--- a/drivers/gpu/drm/msm/msm_atomic.c
+++ b/drivers/gpu/drm/msm/msm_atomic.c
@@ -23,10 +23,41 @@ struct msm_commit {
        struct drm_atomic_state *state;
        uint32_t fence;
        struct msm_fence_cb fence_cb;
+        uint32_t crtc_mask;
 };
 static void fence_cb(struct msm_fence_cb *cb);
+/* block until specified crtcs are no longer pending update, and
+ * atomically mark them as pending update
+ */
+static int start_atomic(struct msm_drm_private *priv, uint32_t crtc_mask)
+{
+        int ret;
+        spin_lock(&priv->pending_crtcs_event.lock);
+        ret = wait_event_interruptible_locked(priv->pending_crtcs_event,
+                        !(priv->pending_crtcs & crtc_mask));
+        if (ret == 0) {
+                DBG("start: %08x", crtc_mask);
+                priv->pending_crtcs |= crtc_mask;
+        }
+        spin_unlock(&priv->pending_crtcs_event.lock);
+        return ret;
+}
+/* clear specified crtcs (no longer pending update)
+ */
+static void end_atomic(struct msm_drm_private *priv, uint32_t crtc_mask)
+{
+        spin_lock(&priv->pending_crtcs_event.lock);
+        DBG("end: %08x", crtc_mask);
+        priv->pending_crtcs &= ~crtc_mask;
+        wake_up_all_locked(&priv->pending_crtcs_event);
+        spin_unlock(&priv->pending_crtcs_event.lock);
+}
 static struct msm_commit *new_commit(struct drm_atomic_state *state)
 {
        struct msm_commit *c = kzalloc(sizeof(*c), GFP_KERNEL);
@@ -58,12 +89,27 @@ static void complete_commit(struct msm_commit *c)
        drm_atomic_helper_commit_post_planes(dev, state);
+        /* NOTE: _wait_for_vblanks() only waits for vblank on
+         * enabled CRTCs.  So we end up faulting when disabling
+         * due to (potentially) unref'ing the outgoing fb's
+         * before the vblank when the disable has latched.
+         *
+         * But if it did wait on disabled (or newly disabled)
+         * CRTCs, that would be racy (ie. we could have missed
+         * the irq.  We need some way to poll for pipe shut
+         * down.  Or just live with occasionally hitting the
+         * timeout in the CRTC disable path (which really should
+         * not be critical path)
+         */
        drm_atomic_helper_wait_for_vblanks(dev, state);
        drm_atomic_helper_cleanup_planes(dev, state);
        drm_atomic_state_free(state);
+        end_atomic(dev->dev_private, c->crtc_mask);
        kfree(c);
 }
@@ -97,8 +143,9 @@ static void add_fb(struct msm_commit *c, struct drm_framebuffer *fb)
 int msm_atomic_commit(struct drm_device *dev,
                struct drm_atomic_state *state, bool async)
 {
-        struct msm_commit *c;
        int nplanes = dev->mode_config.num_total_plane;
+        int ncrtcs = dev->mode_config.num_crtc;
+        struct msm_commit *c;
        int i, ret;
        ret = drm_atomic_helper_prepare_planes(dev, state);
@@ -106,6 +153,18 @@ int msm_atomic_commit(struct drm_device *dev,
                return ret;
        c = new_commit(state);
+        if (!c)
+                return -ENOMEM;
+        /*
+         * Figure out what crtcs we have:
+         */
+        for (i = 0; i < ncrtcs; i++) {
+                struct drm_crtc *crtc = state->crtcs[i];
+                if (!crtc)
+                        continue;
+                c->crtc_mask |= (1 << drm_crtc_index(crtc));
+        }
        /*
         * Figure out what fence to wait for:
@@ -122,6 +181,14 @@ int msm_atomic_commit(struct drm_device *dev,
        }
        /*
+         * Wait for pending updates on any of the same crtc's and then
+         * mark our set of crtc's as busy:
+         */
+        ret = start_atomic(dev->dev_private, c->crtc_mask);
+        if (ret)
+                return ret;
+        /*
         * This is the point of no return - everything below never fails except
         * when the hw goes bonghits. Which means we can commit the new state on
         * the software side now.
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index c795217e1bfc..9a61546a0b05 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -193,6 +193,7 @@ static int msm_load(struct drm_device *dev, unsigned long flags)
        priv->wq = alloc_ordered_workqueue("msm", 0);
        init_waitqueue_head(&priv->fence_event);
+        init_waitqueue_head(&priv->pending_crtcs_event);
        INIT_LIST_HEAD(&priv->inactive_list);
        INIT_LIST_HEAD(&priv->fence_cbs);
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 136303818436..b69ef2d5a26c 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -96,6 +96,10 @@ struct msm_drm_private {
        /* callbacks deferred until bo is inactive: */
        struct list_head fence_cbs;
+        /* crtcs pending async atomic updates: */
+        uint32_t pending_crtcs;
+        wait_queue_head_t pending_crtcs_event;
        /* registered MMUs: */
        unsigned int num_mmus;
        struct msm_mmu *mmus[NUM_DOMAINS];
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index 94d55e526b4e..1f3af13ccede 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -190,8 +190,7 @@ fail_unlock:
 fail:
        if (ret) {
-                if (fbi)
+                framebuffer_release(fbi);
-                        framebuffer_release(fbi);
                if (fb) {
                        drm_framebuffer_unregister_private(fb);
                        drm_framebuffer_remove(fb);
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 4a6f0e49d5b5..49dea4fb55ac 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -535,8 +535,7 @@ void msm_gem_free_object(struct drm_gem_object *obj)
                        drm_free_large(msm_obj->pages);
        } else {
-                if (msm_obj->vaddr)
+                vunmap(msm_obj->vaddr);
-                        vunmap(msm_obj->vaddr);
                put_pages(obj);
        }
diff --git a/drivers/gpu/drm/nouveau/core/core/event.c b/drivers/gpu/drm/nouveau/core/core/event.c
index ff2b434b3db4..760947e380c9 100644
--- a/drivers/gpu/drm/nouveau/core/core/event.c
+++ b/drivers/gpu/drm/nouveau/core/core/event.c
@@ -26,7 +26,7 @@
 void
 nvkm_event_put(struct nvkm_event *event, u32 types, int index)
 {
-        BUG_ON(!spin_is_locked(&event->refs_lock));
+        assert_spin_locked(&event->refs_lock);
        while (types) {
                int type = __ffs(types); types &= ~(1 << type);
                if (--event->refs[index * event->types_nr + type] == 0) {
@@ -39,7 +39,7 @@ nvkm_event_put(struct nvkm_event *event, u32 types, int index)
 void
 nvkm_event_get(struct nvkm_event *event, u32 types, int index)
 {
-        BUG_ON(!spin_is_locked(&event->refs_lock));
+        assert_spin_locked(&event->refs_lock);
        while (types) {
                int type = __ffs(types); types &= ~(1 << type);
                if (++event->refs[index * event->types_nr + type] == 1) {
diff --git a/drivers/gpu/drm/nouveau/core/core/notify.c b/drivers/gpu/drm/nouveau/core/core/notify.c
index d1bcde55e9d7..839a32577680 100644
--- a/drivers/gpu/drm/nouveau/core/core/notify.c
+++ b/drivers/gpu/drm/nouveau/core/core/notify.c
@@ -98,7 +98,7 @@ nvkm_notify_send(struct nvkm_notify *notify, void *data, u32 size)
        struct nvkm_event *event = notify->event;
        unsigned long flags;
-        BUG_ON(!spin_is_locked(&event->list_lock));
+        assert_spin_locked(&event->list_lock);
        BUG_ON(size != notify->size);
        spin_lock_irqsave(&event->refs_lock, flags);
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nve0.c b/drivers/gpu/drm/nouveau/core/engine/device/nve0.c
index 674da1f095b2..732922690653 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nve0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nve0.c
@@ -249,6 +249,39 @@ nve0_identify(struct nouveau_device *device)
                device->oclass[NVDEV_ENGINE_PPP    ] = &nvc0_ppp_oclass;
                device->oclass[NVDEV_ENGINE_PERFMON] = &nvf0_perfmon_oclass;
                break;
+        case 0x106:
+                device->cname = "GK208B";
+                device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
+                device->oclass[NVDEV_SUBDEV_GPIO   ] =  nve0_gpio_oclass;
+                device->oclass[NVDEV_SUBDEV_I2C    ] =  nve0_i2c_oclass;
+                device->oclass[NVDEV_SUBDEV_FUSE   ] = &gf100_fuse_oclass;
+                device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nve0_clock_oclass;
+                device->oclass[NVDEV_SUBDEV_THERM  ] = &nvd0_therm_oclass;
+                device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
+                device->oclass[NVDEV_SUBDEV_DEVINIT] =  nvc0_devinit_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  gk20a_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_BUS    ] =  nvc0_bus_oclass;
+                device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
+                device->oclass[NVDEV_SUBDEV_FB     ] =  nve0_fb_oclass;
+                device->oclass[NVDEV_SUBDEV_LTC    ] =  gk104_ltc_oclass;
+                device->oclass[NVDEV_SUBDEV_IBUS   ] = &nve0_ibus_oclass;
+                device->oclass[NVDEV_SUBDEV_INSTMEM] =  nv50_instmem_oclass;
+                device->oclass[NVDEV_SUBDEV_VM     ] = &nvc0_vmmgr_oclass;
+                device->oclass[NVDEV_SUBDEV_BAR    ] = &nvc0_bar_oclass;
+                device->oclass[NVDEV_SUBDEV_PWR    ] =  nv108_pwr_oclass;
+                device->oclass[NVDEV_SUBDEV_VOLT   ] = &nv40_volt_oclass;
+                device->oclass[NVDEV_ENGINE_DMAOBJ ] =  nvd0_dmaeng_oclass;
+                device->oclass[NVDEV_ENGINE_FIFO   ] =  nv108_fifo_oclass;
+                device->oclass[NVDEV_ENGINE_SW     ] =  nvc0_software_oclass;
+                device->oclass[NVDEV_ENGINE_GR     ] =  nv108_graph_oclass;
+                device->oclass[NVDEV_ENGINE_DISP   ] =  nvf0_disp_oclass;
+                device->oclass[NVDEV_ENGINE_COPY0  ] = &nve0_copy0_oclass;
+                device->oclass[NVDEV_ENGINE_COPY1  ] = &nve0_copy1_oclass;
+                device->oclass[NVDEV_ENGINE_COPY2  ] = &nve0_copy2_oclass;
+                device->oclass[NVDEV_ENGINE_BSP    ] = &nve0_bsp_oclass;
+                device->oclass[NVDEV_ENGINE_VP     ] = &nve0_vp_oclass;
+                device->oclass[NVDEV_ENGINE_PPP    ] = &nvc0_ppp_oclass;
+                break;
        case 0x108:
                device->cname = "GK208";
                device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/shadowramin.c b/drivers/gpu/drm/nouveau/core/subdev/bios/shadowramin.c
index 5e58bba0dd5c..a7a890fad1e5 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/shadowramin.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/shadowramin.c
@@ -44,8 +44,10 @@ static void
 pramin_fini(void *data)
 {
        struct priv *priv = data;
-        nv_wr32(priv->bios, 0x001700, priv->bar0);
+        if (priv) {
-        kfree(priv);
+                nv_wr32(priv->bios, 0x001700, priv->bar0);
+                kfree(priv);
+        }
 }
 static void *
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvaa.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvaa.c
index 00f2ca7e44a5..033a8e999497 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvaa.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvaa.c
@@ -24,34 +24,71 @@
 #include "nv50.h"
+struct nvaa_ram_priv {
+        struct nouveau_ram base;
+        u64 poller_base;
+};
 static int
 nvaa_ram_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
              struct nouveau_oclass *oclass, void *data, u32 datasize,
              struct nouveau_object **pobject)
 {
-        const u32 rsvd_head = ( 256 * 1024) >> 12; /* vga memory */
+        u32 rsvd_head = ( 256 * 1024); /* vga memory */
-        const u32 rsvd_tail = (1024 * 1024) >> 12; /* vbios etc */
+        u32 rsvd_tail = (1024 * 1024); /* vbios etc */
        struct nouveau_fb *pfb = nouveau_fb(parent);
-        struct nouveau_ram *ram;
+        struct nvaa_ram_priv *priv;
        int ret;
-        ret = nouveau_ram_create(parent, engine, oclass, &ram);
+        ret = nouveau_ram_create(parent, engine, oclass, &priv);
-        *pobject = nv_object(ram);
+        *pobject = nv_object(priv);
        if (ret)
                return ret;
-        ram->size = nv_rd32(pfb, 0x10020c);
+        priv->base.type   = NV_MEM_TYPE_STOLEN;
-        ram->size = (ram->size & 0xffffff00) | ((ram->size & 0x000000ff) << 32);
+        priv->base.stolen = (u64)nv_rd32(pfb, 0x100e10) << 12;
+        priv->base.size   = (u64)nv_rd32(pfb, 0x100e14) << 12;
-        ret = nouveau_mm_init(&pfb->vram, rsvd_head, (ram->size >> 12) -
+        rsvd_tail += 0x1000;
-                              (rsvd_head + rsvd_tail), 1);
+        priv->poller_base = priv->base.size - rsvd_tail;
+        ret = nouveau_mm_init(&pfb->vram, rsvd_head >> 12,
+                              (priv->base.size  - (rsvd_head + rsvd_tail)) >> 12,
+                              1);
        if (ret)
                return ret;
-        ram->type   = NV_MEM_TYPE_STOLEN;
+        priv->base.get = nv50_ram_get;
-        ram->stolen = (u64)nv_rd32(pfb, 0x100e10) << 12;
+        priv->base.put = nv50_ram_put;
-        ram->get = nv50_ram_get;
+        return 0;
-        ram->put = nv50_ram_put;
+}
+static int
+nvaa_ram_init(struct nouveau_object *object)
+{
+        struct nouveau_fb *pfb = nouveau_fb(object);
+        struct nvaa_ram_priv *priv = (void *)object;
+        int ret;
+        u64 dniso, hostnb, flush;
+        ret = nouveau_ram_init(&priv->base);
+        if (ret)
+                return ret;
+        dniso  = ((priv->base.size - (priv->poller_base + 0x00)) >> 5) - 1;
+        hostnb = ((priv->base.size - (priv->poller_base + 0x20)) >> 5) - 1;
+        flush  = ((priv->base.size - (priv->poller_base + 0x40)) >> 5) - 1;
+        /* Enable NISO poller for various clients and set their associated
+         * read address, only for MCP77/78 and MCP79/7A. (fd#25701)
+         */
+        nv_wr32(pfb, 0x100c18, dniso);
+        nv_mask(pfb, 0x100c14, 0x00000000, 0x00000001);
+        nv_wr32(pfb, 0x100c1c, hostnb);
+        nv_mask(pfb, 0x100c14, 0x00000000, 0x00000002);
+        nv_wr32(pfb, 0x100c24, flush);
+        nv_mask(pfb, 0x100c14, 0x00000000, 0x00010000);
        return 0;
 }
@@ -60,7 +97,7 @@ nvaa_ram_oclass = {
        .ofuncs = &(struct nouveau_ofuncs) {
                .ctor = nvaa_ram_ctor,
                .dtor = _nouveau_ram_dtor,
-                .init = _nouveau_ram_init,
+                .init = nvaa_ram_init,
                .fini = _nouveau_ram_fini,
        },
 };
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
index a75c35ccf25c..165401c4045c 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
@@ -24,13 +24,6 @@
 #include "nv04.h"
-static void
-nv4c_mc_msi_rearm(struct nouveau_mc *pmc)
-{
-        struct nv04_mc_priv *priv = (void *)pmc;
-        nv_wr08(priv, 0x088050, 0xff);
-}
 struct nouveau_oclass *
 nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
        .base.handle = NV_SUBDEV(MC, 0x4c),
@@ -41,5 +34,4 @@ nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
                .fini = _nouveau_mc_fini,
        },
        .intr = nv04_mc_intr,
-        .msi_rearm = nv4c_mc_msi_rearm,
 }.base;
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 21ec561edc99..bba2960d3dfb 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -1572,8 +1572,10 @@ nouveau_ttm_tt_unpopulate(struct ttm_tt *ttm)
         * so use the DMA API for them.
         */
        if (!nv_device_is_cpu_coherent(device) &&
-            ttm->caching_state == tt_uncached)
+            ttm->caching_state == tt_uncached) {
                ttm_dma_unpopulate(ttm_dma, dev->dev);
+                return;
+        }
 #if __OS_HAS_AGP
        if (drm->agp.stat == ENABLED) {
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 5d93902a91ab..f8042433752b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -876,7 +876,6 @@ nouveau_display_dumb_create(struct drm_file *file_priv, struct drm_device *dev,
        if (ret)
                return ret;
-        bo->gem.dumb = true;
        ret = drm_gem_handle_create(file_priv, &bo->gem, &args->handle);
        drm_gem_object_unreference_unlocked(&bo->gem);
        return ret;
@@ -892,14 +891,6 @@ nouveau_display_dumb_map_offset(struct drm_file *file_priv,
        gem = drm_gem_object_lookup(dev, file_priv, handle);
        if (gem) {
                struct nouveau_bo *bo = nouveau_gem_object(gem);
-                /*
-                 * We don't allow dumb mmaps on objects created using another
-                 * interface.
-                 */
-                WARN_ONCE(!(gem->dumb || gem->import_attach),
-                          "Illegal dumb map of accelerated buffer.\n");
                *poffset = drm_vma_node_offset_addr(&bo->bo.vma_node);
                drm_gem_object_unreference_unlocked(gem);
                return 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 28d51a22a4bf..bf0f9e21d714 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -36,7 +36,14 @@ void
 nouveau_gem_object_del(struct drm_gem_object *gem)
 {
        struct nouveau_bo *nvbo = nouveau_gem_object(gem);
+        struct nouveau_drm *drm = nouveau_bdev(nvbo->bo.bdev);
        struct ttm_buffer_object *bo = &nvbo->bo;
+        struct device *dev = drm->dev->dev;
+        int ret;
+        ret = pm_runtime_get_sync(dev);
+        if (WARN_ON(ret < 0 && ret != -EACCES))
+                return;
        if (gem->import_attach)
                drm_prime_gem_destroy(gem, nvbo->bo.sg);
@@ -46,6 +53,9 @@ nouveau_gem_object_del(struct drm_gem_object *gem)
        /* reset filp so nouveau_bo_del_ttm() can test for it */
        gem->filp = NULL;
        ttm_bo_unref(&bo);
+        pm_runtime_mark_last_busy(dev);
+        pm_runtime_put_autosuspend(dev);
 }
 int
@@ -53,7 +63,9 @@ nouveau_gem_object_open(struct drm_gem_object *gem, struct drm_file *file_priv)
 {
        struct nouveau_cli *cli = nouveau_cli(file_priv);
        struct nouveau_bo *nvbo = nouveau_gem_object(gem);
+        struct nouveau_drm *drm = nouveau_bdev(nvbo->bo.bdev);
        struct nouveau_vma *vma;
+        struct device *dev = drm->dev->dev;
        int ret;
        if (!cli->vm)
@@ -71,11 +83,16 @@ nouveau_gem_object_open(struct drm_gem_object *gem, struct drm_file *file_priv)
                        goto out;
                }
+                ret = pm_runtime_get_sync(dev);
+                if (ret < 0 && ret != -EACCES)
+                        goto out;
                ret = nouveau_bo_vma_add(nvbo, cli->vm, vma);
-                if (ret) {
+                if (ret)
                        kfree(vma);
-                        goto out;
-                }
+                pm_runtime_mark_last_busy(dev);
+                pm_runtime_put_autosuspend(dev);
        } else {
                vma->refcount++;
        }
@@ -129,6 +146,8 @@ nouveau_gem_object_close(struct drm_gem_object *gem, struct drm_file *file_priv)
 {
        struct nouveau_cli *cli = nouveau_cli(file_priv);
        struct nouveau_bo *nvbo = nouveau_gem_object(gem);
+        struct nouveau_drm *drm = nouveau_bdev(nvbo->bo.bdev);
+        struct device *dev = drm->dev->dev;
        struct nouveau_vma *vma;
        int ret;
@@ -141,8 +160,14 @@ nouveau_gem_object_close(struct drm_gem_object *gem, struct drm_file *file_priv)
        vma = nouveau_bo_vma_find(nvbo, cli->vm);
        if (vma) {
-                if (--vma->refcount == 0)
+                if (--vma->refcount == 0) {
-                        nouveau_gem_object_unmap(nvbo, vma);
+                        ret = pm_runtime_get_sync(dev);
+                        if (!WARN_ON(ret < 0 && ret != -EACCES)) {
+                                nouveau_gem_object_unmap(nvbo, vma);
+                                pm_runtime_mark_last_busy(dev);
+                                pm_runtime_put_autosuspend(dev);
+                        }
+                }
        }
        ttm_bo_unreserve(&nvbo->bo);
 }
@@ -444,9 +469,6 @@ validate_list(struct nouveau_channel *chan, struct nouveau_cli *cli,
        list_for_each_entry(nvbo, list, entry) {
                struct drm_nouveau_gem_pushbuf_bo *b = &pbbo[nvbo->pbbo_index];
-                WARN_ONCE(nvbo->gem.dumb,
-                          "GPU use of dumb buffer is illegal.\n");
                ret = nouveau_gem_set_domain(&nvbo->gem, b->read_domains,
                                             b->write_domains,
                                             b->valid_domains);
diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index 753a6def61e7..3d1cfcb96b6b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -28,6 +28,7 @@
 #include "nouveau_ttm.h"
 #include "nouveau_gem.h"
+#include "drm_legacy.h"
 static int
 nouveau_vram_manager_init(struct ttm_mem_type_manager *man, unsigned long psize)
 {
@@ -281,7 +282,7 @@ nouveau_ttm_mmap(struct file *filp, struct vm_area_struct *vma)
        struct nouveau_drm *drm = nouveau_drm(file_priv->minor->dev);
        if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET))
-                return -EINVAL;
+                return drm_legacy_mmap(filp, vma);
        return ttm_bo_mmap(filp, vma, &drm->ttm.bdev);
 }
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index d59ec491dbb9..ed644a4f6f57 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1851,10 +1851,9 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                                return pll;
                }
                /* otherwise, pick one of the plls */
-                if ((rdev->family == CHIP_KAVERI) ||
+                if ((rdev->family == CHIP_KABINI) ||
-                    (rdev->family == CHIP_KABINI) ||
                    (rdev->family == CHIP_MULLINS)) {
-                        /* KB/KV/ML has PPLL1 and PPLL2 */
+                        /* KB/ML has PPLL1 and PPLL2 */
                        pll_in_use = radeon_get_pll_use_mask(crtc);
                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
                                return ATOM_PPLL2;
@@ -1863,7 +1862,7 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                        DRM_ERROR("unable to allocate a PPLL\n");
                        return ATOM_PPLL_INVALID;
                } else {
-                        /* CI has PPLL0, PPLL1, and PPLL2 */
+                        /* CI/KV has PPLL0, PPLL1, and PPLL2 */
                        pll_in_use = radeon_get_pll_use_mask(crtc);
                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
                                return ATOM_PPLL2;
@@ -2155,6 +2154,7 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
        case ATOM_PPLL0:
                /* disable the ppll */
                if ((rdev->family == CHIP_ARUBA) ||
+                    (rdev->family == CHIP_KAVERI) ||
                    (rdev->family == CHIP_BONAIRE) ||
                    (rdev->family == CHIP_HAWAII))
                        atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id,
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 11ba9d21b89b..db42a670f995 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -492,6 +492,10 @@ int radeon_dp_mode_valid_helper(struct drm_connector *connector,
        struct radeon_connector_atom_dig *dig_connector;
        int dp_clock;
+        if ((mode->clock > 340000) &&
+            (!radeon_connector_is_dp12_capable(connector)))
+                return MODE_CLOCK_HIGH;
        if (!radeon_connector->con_priv)
                return MODE_CLOCK_HIGH;
        dig_connector = radeon_connector->con_priv;
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 6dcde3798b45..64fdae558d36 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -6033,6 +6033,17 @@ void cik_vm_flush(struct radeon_device *rdev, struct radeon_ring *ring,
        radeon_ring_write(ring, 0);
        radeon_ring_write(ring, 1 << vm_id);
+        /* wait for the invalidate to complete */
+        radeon_ring_write(ring, PACKET3(PACKET3_WAIT_REG_MEM, 5));
+        radeon_ring_write(ring, (WAIT_REG_MEM_OPERATION(0) | /* wait */
+                                 WAIT_REG_MEM_FUNCTION(0) |  /* always */
+                                 WAIT_REG_MEM_ENGINE(0))); /* me */
+        radeon_ring_write(ring, VM_INVALIDATE_REQUEST >> 2);
+        radeon_ring_write(ring, 0);
+        radeon_ring_write(ring, 0); /* ref */
+        radeon_ring_write(ring, 0); /* mask */
+        radeon_ring_write(ring, 0x20); /* poll interval */
        /* compute doesn't have PFP */
        if (usepfp) {
                /* sync PFP to ME, otherwise we might get invalid PFP reads */
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index dde5c7e29eb2..42cd0cffe210 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -816,7 +816,6 @@ void cik_sdma_vm_write_pages(struct radeon_device *rdev,
                for (; ndw > 0; ndw -= 2, --count, pe += 8) {
                        if (flags & R600_PTE_SYSTEM) {
                                value = radeon_vm_map_gart(rdev, addr);
-                                value &= 0xFFFFFFFFFFFFF000ULL;
                        } else if (flags & R600_PTE_VALID) {
                                value = addr;
                        } else {
@@ -903,6 +902,9 @@ void cik_sdma_vm_pad_ib(struct radeon_ib *ib)
 void cik_dma_vm_flush(struct radeon_device *rdev, struct radeon_ring *ring,
                      unsigned vm_id, uint64_t pd_addr)
 {
+        u32 extra_bits = (SDMA_POLL_REG_MEM_EXTRA_OP(0) |
+                          SDMA_POLL_REG_MEM_EXTRA_FUNC(0)); /* always */
        radeon_ring_write(ring, SDMA_PACKET(SDMA_OPCODE_SRBM_WRITE, 0, 0xf000));
        if (vm_id < 8) {
                radeon_ring_write(ring, (VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (vm_id << 2)) >> 2);
@@ -943,5 +945,12 @@ void cik_dma_vm_flush(struct radeon_device *rdev, struct radeon_ring *ring,
        radeon_ring_write(ring, SDMA_PACKET(SDMA_OPCODE_SRBM_WRITE, 0, 0xf000));
        radeon_ring_write(ring, VM_INVALIDATE_REQUEST >> 2);
        radeon_ring_write(ring, 1 << vm_id);
+        radeon_ring_write(ring, SDMA_PACKET(SDMA_OPCODE_POLL_REG_MEM, 0, extra_bits));
+        radeon_ring_write(ring, VM_INVALIDATE_REQUEST >> 2);
+        radeon_ring_write(ring, 0);
+        radeon_ring_write(ring, 0); /* reference */
+        radeon_ring_write(ring, 0); /* mask */
+        radeon_ring_write(ring, (0xfff << 16) | 10); /* retry count, poll interval */
 }
diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
index ba85986febea..03003f8a6de6 100644
--- a/drivers/gpu/drm/radeon/cikd.h
+++ b/drivers/gpu/drm/radeon/cikd.h
@@ -2156,4 +2156,6 @@
 #define ATC_VM_APERTURE1_HIGH_ADDR                              0x330Cu
 #define ATC_VM_APERTURE1_LOW_ADDR                               0x3304u
+#define IH_VMID_0_LUT                                           0x3D40u
 #endif
diff --git a/drivers/gpu/drm/radeon/dce3_1_afmt.c b/drivers/gpu/drm/radeon/dce3_1_afmt.c
index 2fe8cfc966d9..bafdf92a5732 100644
--- a/drivers/gpu/drm/radeon/dce3_1_afmt.c
+++ b/drivers/gpu/drm/radeon/dce3_1_afmt.c
@@ -103,7 +103,7 @@ static void dce3_2_afmt_write_sad_regs(struct drm_encoder *encoder)
        }
        sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
                return;
        }
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 9b42001295ba..e3e9c10cfba9 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2745,13 +2745,11 @@ int kv_dpm_init(struct radeon_device *rdev)
        pi->enable_auto_thermal_throttling = true;
        pi->disable_nb_ps3_in_battery = false;
        if (radeon_bapm == -1) {
-                /* There are stability issues reported on with
+                /* only enable bapm on KB, ML by default */
-                 * bapm enabled on an asrock system.
+                if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
-                 */
-                if (rdev->pdev->subsystem_vendor == 0x1849)
-                        pi->bapm_enable = false;
-                else
                        pi->bapm_enable = true;
+                else
+                        pi->bapm_enable = false;
        } else if (radeon_bapm == 0) {
                pi->bapm_enable = false;
        } else {
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 360de9f1f491..aea48c89b241 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -2516,6 +2516,16 @@ void cayman_vm_flush(struct radeon_device *rdev, struct radeon_ring *ring,
        radeon_ring_write(ring, PACKET0(VM_INVALIDATE_REQUEST, 0));
        radeon_ring_write(ring, 1 << vm_id);
+        /* wait for the invalidate to complete */
+        radeon_ring_write(ring, PACKET3(PACKET3_WAIT_REG_MEM, 5));
+        radeon_ring_write(ring, (WAIT_REG_MEM_FUNCTION(0) |  /* always */
+                                 WAIT_REG_MEM_ENGINE(0))); /* me */
+        radeon_ring_write(ring, VM_INVALIDATE_REQUEST >> 2);
+        radeon_ring_write(ring, 0);
+        radeon_ring_write(ring, 0); /* ref */
+        radeon_ring_write(ring, 0); /* mask */
+        radeon_ring_write(ring, 0x20); /* poll interval */
        /* sync PFP to ME, otherwise we might get invalid PFP reads */
        radeon_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
        radeon_ring_write(ring, 0x0);
diff --git a/drivers/gpu/drm/radeon/ni_dma.c b/drivers/gpu/drm/radeon/ni_dma.c
index 50f88611ff60..ce787a9f12c0 100644
--- a/drivers/gpu/drm/radeon/ni_dma.c
+++ b/drivers/gpu/drm/radeon/ni_dma.c
@@ -372,7 +372,6 @@ void cayman_dma_vm_write_pages(struct radeon_device *rdev,
                for (; ndw > 0; ndw -= 2, --count, pe += 8) {
                        if (flags & R600_PTE_SYSTEM) {
                                value = radeon_vm_map_gart(rdev, addr);
-                                value &= 0xFFFFFFFFFFFFF000ULL;
                        } else if (flags & R600_PTE_VALID) {
                                value = addr;
                        } else {
@@ -463,5 +462,11 @@ void cayman_dma_vm_flush(struct radeon_device *rdev, struct radeon_ring *ring,
        radeon_ring_write(ring, DMA_PACKET(DMA_PACKET_SRBM_WRITE, 0, 0, 0));
        radeon_ring_write(ring, (0xf << 16) | (VM_INVALIDATE_REQUEST >> 2));
        radeon_ring_write(ring, 1 << vm_id);
+        /* wait for invalidate to complete */
+        radeon_ring_write(ring, DMA_SRBM_READ_PACKET);
+        radeon_ring_write(ring, (0xff << 20) | (VM_INVALIDATE_REQUEST >> 2));
+        radeon_ring_write(ring, 0); /* mask */
+        radeon_ring_write(ring, 0); /* value */
 }
diff --git a/drivers/gpu/drm/radeon/nid.h b/drivers/gpu/drm/radeon/nid.h
index 2e12e4d69253..ad7125486894 100644
--- a/drivers/gpu/drm/radeon/nid.h
+++ b/drivers/gpu/drm/radeon/nid.h
@@ -1133,6 +1133,23 @@
 #define PACKET3_MEM_SEMAPHORE                           0x39
 #define PACKET3_MPEG_INDEX                              0x3A
 #define PACKET3_WAIT_REG_MEM                            0x3C
+#define         WAIT_REG_MEM_FUNCTION(x)                ((x) << 0)
+                /* 0 - always
+                 * 1 - <
+                 * 2 - <=
+                 * 3 - ==
+                 * 4 - !=
+                 * 5 - >=
+                 * 6 - >
+                 */
+#define         WAIT_REG_MEM_MEM_SPACE(x)               ((x) << 4)
+                /* 0 - reg
+                 * 1 - mem
+                 */
+#define         WAIT_REG_MEM_ENGINE(x)                  ((x) << 8)
+                /* 0 - me
+                 * 1 - pfp
+                 */
 #define PACKET3_MEM_WRITE                               0x3D
 #define PACKET3_PFP_SYNC_ME                             0x42
 #define PACKET3_SURFACE_SYNC                            0x43
@@ -1272,6 +1289,13 @@
                                         (1 << 21) |                    \
                                         (((n) & 0xFFFFF) << 0))
+#define DMA_SRBM_POLL_PACKET            ((9 << 28) |                    \
+                                         (1 << 27) |                    \
+                                         (1 << 26))
+#define DMA_SRBM_READ_PACKET            ((9 << 28) |                    \
+                                         (1 << 27))
 /* async DMA Packet types */
 #define DMA_PACKET_WRITE                                  0x2
 #define DMA_PACKET_COPY                                   0x3
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 74f06d540591..279801ca5110 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -644,6 +644,7 @@ int r100_pci_gart_init(struct radeon_device *rdev)
                return r;
        rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
        rdev->asic->gart.tlb_flush = &r100_pci_gart_tlb_flush;
+        rdev->asic->gart.get_page_entry = &r100_pci_gart_get_page_entry;
        rdev->asic->gart.set_page = &r100_pci_gart_set_page;
        return radeon_gart_table_ram_alloc(rdev);
 }
@@ -681,11 +682,16 @@ void r100_pci_gart_disable(struct radeon_device *rdev)
        WREG32(RADEON_AIC_HI_ADDR, 0);
 }
+uint64_t r100_pci_gart_get_page_entry(uint64_t addr, uint32_t flags)
+{
+        return addr;
+}
 void r100_pci_gart_set_page(struct radeon_device *rdev, unsigned i,
-                            uint64_t addr, uint32_t flags)
+                            uint64_t entry)
 {
        u32 *gtt = rdev->gart.ptr;
-        gtt[i] = cpu_to_le32(lower_32_bits(addr));
+        gtt[i] = cpu_to_le32(lower_32_bits(entry));
 }
 void r100_pci_gart_fini(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 064ad5569cca..08d68f3e13e9 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -73,11 +73,8 @@ void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev)
 #define R300_PTE_WRITEABLE (1 << 2)
 #define R300_PTE_READABLE  (1 << 3)
-void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
+uint64_t rv370_pcie_gart_get_page_entry(uint64_t addr, uint32_t flags)
-                              uint64_t addr, uint32_t flags)
 {
-        void __iomem *ptr = rdev->gart.ptr;
        addr = (lower_32_bits(addr) >> 8) |
                ((upper_32_bits(addr) & 0xff) << 24);
        if (flags & RADEON_GART_PAGE_READ)
@@ -86,10 +83,18 @@ void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
                addr |= R300_PTE_WRITEABLE;
        if (!(flags & RADEON_GART_PAGE_SNOOP))
                addr |= R300_PTE_UNSNOOPED;
+        return addr;
+}
+void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
+                              uint64_t entry)
+{
+        void __iomem *ptr = rdev->gart.ptr;
        /* on x86 we want this to be CPU endian, on powerpc
         * on powerpc without HW swappers, it'll get swapped on way
         * into VRAM - so no need for cpu_to_le32 on VRAM tables */
-        writel(addr, ((void __iomem *)ptr) + (i * 4));
+        writel(entry, ((void __iomem *)ptr) + (i * 4));
 }
 int rv370_pcie_gart_init(struct radeon_device *rdev)
@@ -109,6 +114,7 @@ int rv370_pcie_gart_init(struct radeon_device *rdev)
                DRM_ERROR("Failed to register debugfs file for PCIE gart !\n");
        rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
        rdev->asic->gart.tlb_flush = &rv370_pcie_gart_tlb_flush;
+        rdev->asic->gart.get_page_entry = &rv370_pcie_gart_get_page_entry;
        rdev->asic->gart.set_page = &rv370_pcie_gart_set_page;
        return radeon_gart_table_vram_alloc(rdev);
 }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 54529b837afa..3f2a8d3febca 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -242,6 +242,7 @@ bool radeon_get_bios(struct radeon_device *rdev);
 * Dummy page
 */
 struct radeon_dummy_page {
+        uint64_t        entry;
        struct page     *page;
        dma_addr_t      addr;
 };
@@ -645,7 +646,7 @@ struct radeon_gart {
        unsigned                        num_cpu_pages;
        unsigned                        table_size;
        struct page                     **pages;
-        dma_addr_t                      *pages_addr;
+        uint64_t                        *pages_entry;
        bool                            ready;
 };
@@ -1847,8 +1848,9 @@ struct radeon_asic {
        /* gart */
        struct {
                void (*tlb_flush)(struct radeon_device *rdev);
+                uint64_t (*get_page_entry)(uint64_t addr, uint32_t flags);
                void (*set_page)(struct radeon_device *rdev, unsigned i,
-                                 uint64_t addr, uint32_t flags);
+                                 uint64_t entry);
        } gart;
        struct {
                int (*init)(struct radeon_device *rdev);
@@ -2852,7 +2854,8 @@ static inline void radeon_ring_write(struct radeon_ring *ring, uint32_t v)
 #define radeon_vga_set_state(rdev, state) (rdev)->asic->vga_set_state((rdev), (state))
 #define radeon_asic_reset(rdev) (rdev)->asic->asic_reset((rdev))
 #define radeon_gart_tlb_flush(rdev) (rdev)->asic->gart.tlb_flush((rdev))
-#define radeon_gart_set_page(rdev, i, p, f) (rdev)->asic->gart.set_page((rdev), (i), (p), (f))
+#define radeon_gart_get_page_entry(a, f) (rdev)->asic->gart.get_page_entry((a), (f))
+#define radeon_gart_set_page(rdev, i, e) (rdev)->asic->gart.set_page((rdev), (i), (e))
 #define radeon_asic_vm_init(rdev) (rdev)->asic->vm.init((rdev))
 #define radeon_asic_vm_fini(rdev) (rdev)->asic->vm.fini((rdev))
 #define radeon_asic_vm_copy_pages(rdev, ib, pe, src, count) ((rdev)->asic->vm.copy_pages((rdev), (ib), (pe), (src), (count)))
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 850de57069be..ed0e10eee2dc 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -159,11 +159,13 @@ void radeon_agp_disable(struct radeon_device *rdev)
                DRM_INFO("Forcing AGP to PCIE mode\n");
                rdev->flags |= RADEON_IS_PCIE;
                rdev->asic->gart.tlb_flush = &rv370_pcie_gart_tlb_flush;
+                rdev->asic->gart.get_page_entry = &rv370_pcie_gart_get_page_entry;
                rdev->asic->gart.set_page = &rv370_pcie_gart_set_page;
        } else {
                DRM_INFO("Forcing AGP to PCI mode\n");
                rdev->flags |= RADEON_IS_PCI;
                rdev->asic->gart.tlb_flush = &r100_pci_gart_tlb_flush;
+                rdev->asic->gart.get_page_entry = &r100_pci_gart_get_page_entry;
                rdev->asic->gart.set_page = &r100_pci_gart_set_page;
        }
        rdev->mc.gtt_size = radeon_gart_size * 1024 * 1024;
@@ -199,6 +201,7 @@ static struct radeon_asic r100_asic = {
        .mc_wait_for_idle = &r100_mc_wait_for_idle,
        .gart = {
                .tlb_flush = &r100_pci_gart_tlb_flush,
+                .get_page_entry = &r100_pci_gart_get_page_entry,
                .set_page = &r100_pci_gart_set_page,
        },
        .ring = {
@@ -265,6 +268,7 @@ static struct radeon_asic r200_asic = {
        .mc_wait_for_idle = &r100_mc_wait_for_idle,
        .gart = {
                .tlb_flush = &r100_pci_gart_tlb_flush,
+                .get_page_entry = &r100_pci_gart_get_page_entry,
                .set_page = &r100_pci_gart_set_page,
        },
        .ring = {
@@ -333,6 +337,20 @@ static struct radeon_asic_ring r300_gfx_ring = {
        .set_wptr = &r100_gfx_set_wptr,
 };
+static struct radeon_asic_ring rv515_gfx_ring = {
+        .ib_execute = &r100_ring_ib_execute,
+        .emit_fence = &r300_fence_ring_emit,
+        .emit_semaphore = &r100_semaphore_ring_emit,
+        .cs_parse = &r300_cs_parse,
+        .ring_start = &rv515_ring_start,
+        .ring_test = &r100_ring_test,
+        .ib_test = &r100_ib_test,
+        .is_lockup = &r100_gpu_is_lockup,
+        .get_rptr = &r100_gfx_get_rptr,
+        .get_wptr = &r100_gfx_get_wptr,
+        .set_wptr = &r100_gfx_set_wptr,
+};
 static struct radeon_asic r300_asic = {
        .init = &r300_init,
        .fini = &r300_fini,
@@ -345,6 +363,7 @@ static struct radeon_asic r300_asic = {
        .mc_wait_for_idle = &r300_mc_wait_for_idle,
        .gart = {
                .tlb_flush = &r100_pci_gart_tlb_flush,
+                .get_page_entry = &r100_pci_gart_get_page_entry,
                .set_page = &r100_pci_gart_set_page,
        },
        .ring = {
@@ -411,6 +430,7 @@ static struct radeon_asic r300_asic_pcie = {
        .mc_wait_for_idle = &r300_mc_wait_for_idle,
        .gart = {
                .tlb_flush = &rv370_pcie_gart_tlb_flush,
+                .get_page_entry = &rv370_pcie_gart_get_page_entry,
                .set_page = &rv370_pcie_gart_set_page,
        },
        .ring = {
@@ -477,6 +497,7 @@ static struct radeon_asic r420_asic = {
        .mc_wait_for_idle = &r300_mc_wait_for_idle,
        .gart = {
                .tlb_flush = &rv370_pcie_gart_tlb_flush,
+                .get_page_entry = &rv370_pcie_gart_get_page_entry,
                .set_page = &rv370_pcie_gart_set_page,
        },
        .ring = {
@@ -543,6 +564,7 @@ static struct radeon_asic rs400_asic = {
        .mc_wait_for_idle = &rs400_mc_wait_for_idle,
        .gart = {
                .tlb_flush = &rs400_gart_tlb_flush,
+                .get_page_entry = &rs400_gart_get_page_entry,
                .set_page = &rs400_gart_set_page,
        },
        .ring = {
@@ -609,6 +631,7 @@ static struct radeon_asic rs600_asic = {
        .mc_wait_for_idle = &rs600_mc_wait_for_idle,
        .gart = {
                .tlb_flush = &rs600_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .ring = {
@@ -677,6 +700,7 @@ static struct radeon_asic rs690_asic = {
        .mc_wait_for_idle = &rs690_mc_wait_for_idle,
        .gart = {
                .tlb_flush = &rs400_gart_tlb_flush,
+                .get_page_entry = &rs400_gart_get_page_entry,
                .set_page = &rs400_gart_set_page,
        },
        .ring = {
@@ -745,10 +769,11 @@ static struct radeon_asic rv515_asic = {
        .mc_wait_for_idle = &rv515_mc_wait_for_idle,
        .gart = {
                .tlb_flush = &rv370_pcie_gart_tlb_flush,
+                .get_page_entry = &rv370_pcie_gart_get_page_entry,
                .set_page = &rv370_pcie_gart_set_page,
        },
        .ring = {
-                [RADEON_RING_TYPE_GFX_INDEX] = &r300_gfx_ring
+                [RADEON_RING_TYPE_GFX_INDEX] = &rv515_gfx_ring
        },
        .irq = {
                .set = &rs600_irq_set,
@@ -811,10 +836,11 @@ static struct radeon_asic r520_asic = {
        .mc_wait_for_idle = &r520_mc_wait_for_idle,
        .gart = {
                .tlb_flush = &rv370_pcie_gart_tlb_flush,
+                .get_page_entry = &rv370_pcie_gart_get_page_entry,
                .set_page = &rv370_pcie_gart_set_page,
        },
        .ring = {
-                [RADEON_RING_TYPE_GFX_INDEX] = &r300_gfx_ring
+                [RADEON_RING_TYPE_GFX_INDEX] = &rv515_gfx_ring
        },
        .irq = {
                .set = &rs600_irq_set,
@@ -905,6 +931,7 @@ static struct radeon_asic r600_asic = {
        .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &r600_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .ring = {
@@ -990,6 +1017,7 @@ static struct radeon_asic rv6xx_asic = {
        .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &r600_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .ring = {
@@ -1081,6 +1109,7 @@ static struct radeon_asic rs780_asic = {
        .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &r600_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .ring = {
@@ -1185,6 +1214,7 @@ static struct radeon_asic rv770_asic = {
        .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &r600_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .ring = {
@@ -1303,6 +1333,7 @@ static struct radeon_asic evergreen_asic = {
        .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &evergreen_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .ring = {
@@ -1395,6 +1426,7 @@ static struct radeon_asic sumo_asic = {
        .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &evergreen_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .ring = {
@@ -1486,6 +1518,7 @@ static struct radeon_asic btc_asic = {
        .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &evergreen_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .ring = {
@@ -1621,6 +1654,7 @@ static struct radeon_asic cayman_asic = {
        .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &cayman_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .vm = {
@@ -1724,6 +1758,7 @@ static struct radeon_asic trinity_asic = {
        .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &cayman_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .vm = {
@@ -1857,6 +1892,7 @@ static struct radeon_asic si_asic = {
        .get_gpu_clock_counter = &si_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &si_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .vm = {
@@ -2018,6 +2054,7 @@ static struct radeon_asic ci_asic = {
        .get_gpu_clock_counter = &cik_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &cik_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .vm = {
@@ -2125,6 +2162,7 @@ static struct radeon_asic kv_asic = {
        .get_gpu_clock_counter = &cik_get_gpu_clock_counter,
        .gart = {
                .tlb_flush = &cik_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                .set_page = &rs600_gart_set_page,
        },
        .vm = {
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index 2a45d548d5ec..8d787d115653 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -67,8 +67,9 @@ bool r100_gpu_is_lockup(struct radeon_device *rdev, struct radeon_ring *cp);
 int r100_asic_reset(struct radeon_device *rdev);
 u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc);
 void r100_pci_gart_tlb_flush(struct radeon_device *rdev);
+uint64_t r100_pci_gart_get_page_entry(uint64_t addr, uint32_t flags);
 void r100_pci_gart_set_page(struct radeon_device *rdev, unsigned i,
-                            uint64_t addr, uint32_t flags);
+                            uint64_t entry);
 void r100_ring_start(struct radeon_device *rdev, struct radeon_ring *ring);
 int r100_irq_set(struct radeon_device *rdev);
 int r100_irq_process(struct radeon_device *rdev);
@@ -172,8 +173,9 @@ extern void r300_fence_ring_emit(struct radeon_device *rdev,
                                struct radeon_fence *fence);
 extern int r300_cs_parse(struct radeon_cs_parser *p);
 extern void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev);
+extern uint64_t rv370_pcie_gart_get_page_entry(uint64_t addr, uint32_t flags);
 extern void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
-                                     uint64_t addr, uint32_t flags);
+                                     uint64_t entry);
 extern void rv370_set_pcie_lanes(struct radeon_device *rdev, int lanes);
 extern int rv370_get_pcie_lanes(struct radeon_device *rdev);
 extern void r300_set_reg_safe(struct radeon_device *rdev);
@@ -208,8 +210,9 @@ extern void rs400_fini(struct radeon_device *rdev);
 extern int rs400_suspend(struct radeon_device *rdev);
 extern int rs400_resume(struct radeon_device *rdev);
 void rs400_gart_tlb_flush(struct radeon_device *rdev);
+uint64_t rs400_gart_get_page_entry(uint64_t addr, uint32_t flags);
 void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
-                         uint64_t addr, uint32_t flags);
+                         uint64_t entry);
 uint32_t rs400_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs400_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 int rs400_gart_init(struct radeon_device *rdev);
@@ -232,8 +235,9 @@ int rs600_irq_process(struct radeon_device *rdev);
 void rs600_irq_disable(struct radeon_device *rdev);
 u32 rs600_get_vblank_counter(struct radeon_device *rdev, int crtc);
 void rs600_gart_tlb_flush(struct radeon_device *rdev);
+uint64_t rs600_gart_get_page_entry(uint64_t addr, uint32_t flags);
 void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
-                         uint64_t addr, uint32_t flags);
+                         uint64_t entry);
 uint32_t rs600_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs600_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 void rs600_bandwidth_update(struct radeon_device *rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c
index 9e7f23dd14bd..87d5fb21cb61 100644
--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
+++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
@@ -34,7 +34,8 @@
 static int radeon_benchmark_do_move(struct radeon_device *rdev, unsigned size,
                                    uint64_t saddr, uint64_t daddr,
-                                    int flag, int n)
+                                    int flag, int n,
+                                    struct reservation_object *resv)
 {
        unsigned long start_jiffies;
        unsigned long end_jiffies;
@@ -47,12 +48,12 @@ static int radeon_benchmark_do_move(struct radeon_device *rdev, unsigned size,
                case RADEON_BENCHMARK_COPY_DMA:
                        fence = radeon_copy_dma(rdev, saddr, daddr,
                                                size / RADEON_GPU_PAGE_SIZE,
-                                                NULL);
+                                                resv);
                        break;
                case RADEON_BENCHMARK_COPY_BLIT:
                        fence = radeon_copy_blit(rdev, saddr, daddr,
                                                 size / RADEON_GPU_PAGE_SIZE,
-                                                 NULL);
+                                                 resv);
                        break;
                default:
                        DRM_ERROR("Unknown copy method\n");
@@ -120,7 +121,8 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size,
        if (rdev->asic->copy.dma) {
                time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
-                                                RADEON_BENCHMARK_COPY_DMA, n);
+                                                RADEON_BENCHMARK_COPY_DMA, n,
+                                                dobj->tbo.resv);
                if (time < 0)
                        goto out_cleanup;
                if (time > 0)
@@ -130,7 +132,8 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size,
        if (rdev->asic->copy.blit) {
                time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
-                                                RADEON_BENCHMARK_COPY_BLIT, n);
+                                                RADEON_BENCHMARK_COPY_BLIT, n,
+                                                dobj->tbo.resv);
                if (time < 0)
                        goto out_cleanup;
                if (time > 0)
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 0ec65168f331..bd7519fdd3f4 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -774,6 +774,8 @@ int radeon_dummy_page_init(struct radeon_device *rdev)
                rdev->dummy_page.page = NULL;
                return -ENOMEM;
        }
+        rdev->dummy_page.entry = radeon_gart_get_page_entry(rdev->dummy_page.addr,
+                                                            RADEON_GART_PAGE_DUMMY);
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 102116902a07..913fafa597ad 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -960,6 +960,9 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
        if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV &&
            pll->flags & RADEON_PLL_USE_REF_DIV)
                ref_div_max = pll->reference_div;
+        else if (pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP)
+                /* fix for problems on RS880 */
+                ref_div_max = min(pll->max_ref_div, 7u);
        else
                ref_div_max = pll->max_ref_div;
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 84146d5901aa..5450fa95a47e 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -165,6 +165,19 @@ int radeon_gart_table_vram_pin(struct radeon_device *rdev)
                radeon_bo_unpin(rdev->gart.robj);
        radeon_bo_unreserve(rdev->gart.robj);
        rdev->gart.table_addr = gpu_addr;
+        if (!r) {
+                int i;
+                /* We might have dropped some GART table updates while it wasn't
+                 * mapped, restore all entries
+                 */
+                for (i = 0; i < rdev->gart.num_gpu_pages; i++)
+                        radeon_gart_set_page(rdev, i, rdev->gart.pages_entry[i]);
+                mb();
+                radeon_gart_tlb_flush(rdev);
+        }
        return r;
 }
@@ -228,7 +241,6 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
        unsigned t;
        unsigned p;
        int i, j;
-        u64 page_base;
        if (!rdev->gart.ready) {
                WARN(1, "trying to unbind memory from uninitialized GART !\n");
@@ -239,14 +251,12 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
        for (i = 0; i < pages; i++, p++) {
                if (rdev->gart.pages[p]) {
                        rdev->gart.pages[p] = NULL;
-                        rdev->gart.pages_addr[p] = rdev->dummy_page.addr;
-                        page_base = rdev->gart.pages_addr[p];
                        for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
+                                rdev->gart.pages_entry[t] = rdev->dummy_page.entry;
                                if (rdev->gart.ptr) {
-                                        radeon_gart_set_page(rdev, t, page_base,
+                                        radeon_gart_set_page(rdev, t,
-                                                             RADEON_GART_PAGE_DUMMY);
+                                                             rdev->dummy_page.entry);
                                }
-                                page_base += RADEON_GPU_PAGE_SIZE;
                        }
                }
        }
@@ -274,7 +284,7 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
 {
        unsigned t;
        unsigned p;
-        uint64_t page_base;
+        uint64_t page_base, page_entry;
        int i, j;
        if (!rdev->gart.ready) {
@@ -285,14 +295,15 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
        p = t / (PAGE_SIZE / RADEON_GPU_PAGE_SIZE);
        for (i = 0; i < pages; i++, p++) {
-                rdev->gart.pages_addr[p] = dma_addr[i];
                rdev->gart.pages[p] = pagelist[i];
-                if (rdev->gart.ptr) {
+                page_base = dma_addr[i];
-                        page_base = rdev->gart.pages_addr[p];
+                for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
-                        for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
+                        page_entry = radeon_gart_get_page_entry(page_base, flags);
-                                radeon_gart_set_page(rdev, t, page_base, flags);
+                        rdev->gart.pages_entry[t] = page_entry;
-                                page_base += RADEON_GPU_PAGE_SIZE;
+                        if (rdev->gart.ptr) {
+                                radeon_gart_set_page(rdev, t, page_entry);
                        }
+                        page_base += RADEON_GPU_PAGE_SIZE;
                }
        }
        mb();
@@ -334,16 +345,15 @@ int radeon_gart_init(struct radeon_device *rdev)
                radeon_gart_fini(rdev);
                return -ENOMEM;
        }
-        rdev->gart.pages_addr = vzalloc(sizeof(dma_addr_t) *
+        rdev->gart.pages_entry = vmalloc(sizeof(uint64_t) *
-                                        rdev->gart.num_cpu_pages);
+                                         rdev->gart.num_gpu_pages);
-        if (rdev->gart.pages_addr == NULL) {
+        if (rdev->gart.pages_entry == NULL) {
                radeon_gart_fini(rdev);
                return -ENOMEM;
        }
        /* set GART entry to point to the dummy page by default */
-        for (i = 0; i < rdev->gart.num_cpu_pages; i++) {
+        for (i = 0; i < rdev->gart.num_gpu_pages; i++)
-                rdev->gart.pages_addr[i] = rdev->dummy_page.addr;
+                rdev->gart.pages_entry[i] = rdev->dummy_page.entry;
-        }
        return 0;
 }
@@ -356,15 +366,15 @@ int radeon_gart_init(struct radeon_device *rdev)
 */
 void radeon_gart_fini(struct radeon_device *rdev)
 {
-        if (rdev->gart.pages && rdev->gart.pages_addr && rdev->gart.ready) {
+        if (rdev->gart.ready) {
                /* unbind pages */
                radeon_gart_unbind(rdev, 0, rdev->gart.num_cpu_pages);
        }
        rdev->gart.ready = false;
        vfree(rdev->gart.pages);
-        vfree(rdev->gart.pages_addr);
+        vfree(rdev->gart.pages_entry);
        rdev->gart.pages = NULL;
-        rdev->gart.pages_addr = NULL;
+        rdev->gart.pages_entry = NULL;
        radeon_dummy_page_fini(rdev);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index fe48f229043e..ac3c1310b953 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -146,7 +146,8 @@ int radeon_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_pri
        struct radeon_bo_va *bo_va;
        int r;
-        if (rdev->family < CHIP_CAYMAN) {
+        if ((rdev->family < CHIP_CAYMAN) ||
+            (!rdev->accel_working)) {
                return 0;
        }
@@ -176,7 +177,8 @@ void radeon_gem_object_close(struct drm_gem_object *obj,
        struct radeon_bo_va *bo_va;
        int r;
-        if (rdev->family < CHIP_CAYMAN) {
+        if ((rdev->family < CHIP_CAYMAN) ||
+            (!rdev->accel_working)) {
                return;
        }
@@ -394,10 +396,9 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data,
        return r;
 }
-static int radeon_mode_mmap(struct drm_file *filp,
+int radeon_mode_dumb_mmap(struct drm_file *filp,
-                            struct drm_device *dev,
+                          struct drm_device *dev,
-                            uint32_t handle, bool dumb,
+                          uint32_t handle, uint64_t *offset_p)
-                            uint64_t *offset_p)
 {
        struct drm_gem_object *gobj;
        struct radeon_bo *robj;
@@ -406,14 +407,6 @@ static int radeon_mode_mmap(struct drm_file *filp,
        if (gobj == NULL) {
                return -ENOENT;
        }
-        /*
-         * We don't allow dumb mmaps on objects created using another
-         * interface.
-         */
-        WARN_ONCE(dumb && !(gobj->dumb || gobj->import_attach),
-                "Illegal dumb map of GPU buffer.\n");
        robj = gem_to_radeon_bo(gobj);
        if (radeon_ttm_tt_has_userptr(robj->tbo.ttm)) {
                drm_gem_object_unreference_unlocked(gobj);
@@ -424,20 +417,12 @@ static int radeon_mode_mmap(struct drm_file *filp,
        return 0;
 }
-int radeon_mode_dumb_mmap(struct drm_file *filp,
-                          struct drm_device *dev,
-                          uint32_t handle, uint64_t *offset_p)
-{
-        return radeon_mode_mmap(filp, dev, handle, true, offset_p);
-}
 int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
                          struct drm_file *filp)
 {
        struct drm_radeon_gem_mmap *args = data;
-        return radeon_mode_mmap(filp, dev, args->handle, false,
+        return radeon_mode_dumb_mmap(filp, dev, args->handle, &args->addr_ptr);
-                                &args->addr_ptr);
 }
 int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
@@ -593,7 +578,7 @@ error_unreserve:
 error_free:
        drm_free_large(vm_bos);
-        if (r)
+        if (r && r != -ERESTARTSYS)
                DRM_ERROR("Couldn't update BO_VA (%d)\n", r);
 }
@@ -763,7 +748,6 @@ int radeon_mode_dumb_create(struct drm_file *file_priv,
                return -ENOMEM;
        r = drm_gem_handle_create(file_priv, gobj, &handle);
-        gobj->dumb = true;
        /* drop reference from allocate - handle holds it now */
        drm_gem_object_unreference_unlocked(gobj);
        if (r) {
diff --git a/drivers/gpu/drm/radeon/radeon_kfd.c b/drivers/gpu/drm/radeon/radeon_kfd.c
index 065d02068ec3..bef9a0953284 100644
--- a/drivers/gpu/drm/radeon/radeon_kfd.c
+++ b/drivers/gpu/drm/radeon/radeon_kfd.c
@@ -28,6 +28,8 @@
 #include "cikd.h"
 #include "cik_reg.h"
 #include "radeon_kfd.h"
+#include "radeon_ucode.h"
+#include <linux/firmware.h>
 #define CIK_PIPE_PER_MEC        (4)
@@ -49,6 +51,7 @@ static uint64_t get_vmem_size(struct kgd_dev *kgd);
 static uint64_t get_gpu_clock_counter(struct kgd_dev *kgd);
 static uint32_t get_max_engine_clock_in_mhz(struct kgd_dev *kgd);
+static uint16_t get_fw_version(struct kgd_dev *kgd, enum kgd_engine_type type);
 /*
 * Register access functions
@@ -69,7 +72,7 @@ static int kgd_init_pipeline(struct kgd_dev *kgd, uint32_t pipe_id,
 static int kgd_hqd_load(struct kgd_dev *kgd, void *mqd, uint32_t pipe_id,
                        uint32_t queue_id, uint32_t __user *wptr);
-static bool kgd_hqd_is_occupies(struct kgd_dev *kgd, uint64_t queue_address,
+static bool kgd_hqd_is_occupied(struct kgd_dev *kgd, uint64_t queue_address,
                                uint32_t pipe_id, uint32_t queue_id);
 static int kgd_hqd_destroy(struct kgd_dev *kgd, uint32_t reset_type,
@@ -89,14 +92,16 @@ static const struct kfd2kgd_calls kfd2kgd = {
        .init_memory = kgd_init_memory,
        .init_pipeline = kgd_init_pipeline,
        .hqd_load = kgd_hqd_load,
-        .hqd_is_occupies = kgd_hqd_is_occupies,
+        .hqd_is_occupied = kgd_hqd_is_occupied,
        .hqd_destroy = kgd_hqd_destroy,
+        .get_fw_version = get_fw_version
 };
 static const struct kgd2kfd_calls *kgd2kfd;
 bool radeon_kfd_init(void)
 {
+#if defined(CONFIG_HSA_AMD_MODULE)
        bool (*kgd2kfd_init_p)(unsigned, const struct kfd2kgd_calls*,
                                const struct kgd2kfd_calls**);
@@ -113,6 +118,17 @@ bool radeon_kfd_init(void)
        }
        return true;
+#elif defined(CONFIG_HSA_AMD)
+        if (!kgd2kfd_init(KFD_INTERFACE_VERSION, &kfd2kgd, &kgd2kfd)) {
+                kgd2kfd = NULL;
+                return false;
+        }
+        return true;
+#else
+        return false;
+#endif
 }
 void radeon_kfd_fini(void)
@@ -374,6 +390,10 @@ static int kgd_set_pasid_vmid_mapping(struct kgd_dev *kgd, unsigned int pasid,
                cpu_relax();
        write_register(kgd, ATC_VMID_PASID_MAPPING_UPDATE_STATUS, 1U << vmid);
+        /* Mapping vmid to pasid also for IH block */
+        write_register(kgd, IH_VMID_0_LUT + vmid * sizeof(uint32_t),
+                        pasid_mapping);
        return 0;
 }
@@ -416,7 +436,7 @@ static int kgd_init_memory(struct kgd_dev *kgd)
 static int kgd_init_pipeline(struct kgd_dev *kgd, uint32_t pipe_id,
                                uint32_t hpd_size, uint64_t hpd_gpu_addr)
 {
-        uint32_t mec = (++pipe_id / CIK_PIPE_PER_MEC) + 1;
+        uint32_t mec = (pipe_id / CIK_PIPE_PER_MEC) + 1;
        uint32_t pipe = (pipe_id % CIK_PIPE_PER_MEC);
        lock_srbm(kgd, mec, pipe, 0, 0);
@@ -513,7 +533,7 @@ static int kgd_hqd_load(struct kgd_dev *kgd, void *mqd, uint32_t pipe_id,
        return 0;
 }
-static bool kgd_hqd_is_occupies(struct kgd_dev *kgd, uint64_t queue_address,
+static bool kgd_hqd_is_occupied(struct kgd_dev *kgd, uint64_t queue_address,
                                uint32_t pipe_id, uint32_t queue_id)
 {
        uint32_t act;
@@ -552,6 +572,7 @@ static int kgd_hqd_destroy(struct kgd_dev *kgd, uint32_t reset_type,
                if (timeout == 0) {
                        pr_err("kfd: cp queue preemption time out (%dms)\n",
                                temp);
+                        release_queue(kgd);
                        return -ETIME;
                }
                msleep(20);
@@ -561,3 +582,52 @@ static int kgd_hqd_destroy(struct kgd_dev *kgd, uint32_t reset_type,
        release_queue(kgd);
        return 0;
 }
+static uint16_t get_fw_version(struct kgd_dev *kgd, enum kgd_engine_type type)
+{
+        struct radeon_device *rdev = (struct radeon_device *) kgd;
+        const union radeon_firmware_header *hdr;
+        BUG_ON(kgd == NULL || rdev->mec_fw == NULL);
+        switch (type) {
+        case KGD_ENGINE_PFP:
+                hdr = (const union radeon_firmware_header *) rdev->pfp_fw->data;
+                break;
+        case KGD_ENGINE_ME:
+                hdr = (const union radeon_firmware_header *) rdev->me_fw->data;
+                break;
+        case KGD_ENGINE_CE:
+                hdr = (const union radeon_firmware_header *) rdev->ce_fw->data;
+                break;
+        case KGD_ENGINE_MEC1:
+                hdr = (const union radeon_firmware_header *) rdev->mec_fw->data;
+                break;
+        case KGD_ENGINE_MEC2:
+                hdr = (const union radeon_firmware_header *)
+                                                        rdev->mec2_fw->data;
+                break;
+        case KGD_ENGINE_RLC:
+                hdr = (const union radeon_firmware_header *) rdev->rlc_fw->data;
+                break;
+        case KGD_ENGINE_SDMA:
+                hdr = (const union radeon_firmware_header *)
+                                                        rdev->sdma_fw->data;
+                break;
+        default:
+                return 0;
+        }
+        if (hdr == NULL)
+                return 0;
+        /* Only 12 bit in use*/
+        return hdr->common.ucode_version;
+}
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 3cf9c1fa6475..686411e4e4f6 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -605,14 +605,14 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
                        return -ENOMEM;
                }
-                vm = &fpriv->vm;
-                r = radeon_vm_init(rdev, vm);
-                if (r) {
-                        kfree(fpriv);
-                        return r;
-                }
                if (rdev->accel_working) {
+                        vm = &fpriv->vm;
+                        r = radeon_vm_init(rdev, vm);
+                        if (r) {
+                                kfree(fpriv);
+                                return r;
+                        }
                        r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
                        if (r) {
                                radeon_vm_fini(rdev, vm);
@@ -668,9 +668,9 @@ void radeon_driver_postclose_kms(struct drm_device *dev,
                                        radeon_vm_bo_rmv(rdev, vm->ib_bo_va);
                                radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
                        }
+                        radeon_vm_fini(rdev, vm);
                }
-                radeon_vm_fini(rdev, vm);
                kfree(fpriv);
                file_priv->driver_priv = NULL;
        }
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 7d68223eb469..86fc56434b28 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -529,9 +529,6 @@ int radeon_bo_list_validate(struct radeon_device *rdev,
                        u32 current_domain =
                                radeon_mem_type_to_domain(bo->tbo.mem.mem_type);
-                        WARN_ONCE(bo->gem_base.dumb,
-                                  "GPU use of dumb buffer is illegal.\n");
                        /* Check if this buffer will be moved and don't move it
                         * if we have moved too many buffers for this IB already.
                         *
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 32522cc940a1..f7da8fe96a66 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -1287,8 +1287,39 @@ dpm_failed:
        return ret;
 }
+struct radeon_dpm_quirk {
+        u32 chip_vendor;
+        u32 chip_device;
+        u32 subsys_vendor;
+        u32 subsys_device;
+};
+/* cards with dpm stability problems */
+static struct radeon_dpm_quirk radeon_dpm_quirk_list[] = {
+        /* TURKS - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1386534 */
+        { PCI_VENDOR_ID_ATI, 0x6759, 0x1682, 0x3195 },
+        /* TURKS - https://bugzilla.kernel.org/show_bug.cgi?id=83731 */
+        { PCI_VENDOR_ID_ATI, 0x6840, 0x1179, 0xfb81 },
+        { 0, 0, 0, 0 },
+};
 int radeon_pm_init(struct radeon_device *rdev)
 {
+        struct radeon_dpm_quirk *p = radeon_dpm_quirk_list;
+        bool disable_dpm = false;
+        /* Apply dpm quirks */
+        while (p && p->chip_device != 0) {
+                if (rdev->pdev->vendor == p->chip_vendor &&
+                    rdev->pdev->device == p->chip_device &&
+                    rdev->pdev->subsystem_vendor == p->subsys_vendor &&
+                    rdev->pdev->subsystem_device == p->subsys_device) {
+                        disable_dpm = true;
+                        break;
+                }
+                ++p;
+        }
        /* enable dpm on rv6xx+ */
        switch (rdev->family) {
        case CHIP_RV610:
@@ -1344,6 +1375,8 @@ int radeon_pm_init(struct radeon_device *rdev)
                         (!(rdev->flags & RADEON_IS_IGP)) &&
                         (!rdev->smc_fw))
                        rdev->pm.pm_method = PM_METHOD_PROFILE;
+                else if (disable_dpm && (radeon_dpm == -1))
+                        rdev->pm.pm_method = PM_METHOD_PROFILE;
                else if (radeon_dpm == 0)
                        rdev->pm.pm_method = PM_METHOD_PROFILE;
                else
diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
index 535403e0c8a2..15aee723db77 100644
--- a/drivers/gpu/drm/radeon/radeon_state.c
+++ b/drivers/gpu/drm/radeon/radeon_state.c
@@ -1703,7 +1703,7 @@ static int radeon_cp_dispatch_texture(struct drm_device * dev,
        u32 format;
        u32 *buffer;
        const u8 __user *data;
-        int size, dwords, tex_width, blit_width, spitch;
+        unsigned int size, dwords, tex_width, blit_width, spitch;
        u32 height;
        int i;
        u32 texpitch, microtile;
diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
index 07b506b41008..791818165c76 100644
--- a/drivers/gpu/drm/radeon/radeon_test.c
+++ b/drivers/gpu/drm/radeon/radeon_test.c
@@ -119,11 +119,11 @@ static void radeon_do_test_moves(struct radeon_device *rdev, int flag)
                if (ring == R600_RING_TYPE_DMA_INDEX)
                        fence = radeon_copy_dma(rdev, gtt_addr, vram_addr,
                                                size / RADEON_GPU_PAGE_SIZE,
-                                                NULL);
+                                                vram_obj->tbo.resv);
                else
                        fence = radeon_copy_blit(rdev, gtt_addr, vram_addr,
                                                 size / RADEON_GPU_PAGE_SIZE,
-                                                 NULL);
+                                                 vram_obj->tbo.resv);
                if (IS_ERR(fence)) {
                        DRM_ERROR("Failed GTT->VRAM copy %d\n", i);
                        r = PTR_ERR(fence);
@@ -170,11 +170,11 @@ static void radeon_do_test_moves(struct radeon_device *rdev, int flag)
                if (ring == R600_RING_TYPE_DMA_INDEX)
                        fence = radeon_copy_dma(rdev, vram_addr, gtt_addr,
                                                size / RADEON_GPU_PAGE_SIZE,
-                                                NULL);
+                                                vram_obj->tbo.resv);
                else
                        fence = radeon_copy_blit(rdev, vram_addr, gtt_addr,
                                                 size / RADEON_GPU_PAGE_SIZE,
-                                                 NULL);
+                                                 vram_obj->tbo.resv);
                if (IS_ERR(fence)) {
                        DRM_ERROR("Failed VRAM->GTT copy %d\n", i);
                        r = PTR_ERR(fence);
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index cde48c42b30a..2a5a4a9e772d 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -587,10 +587,8 @@ uint64_t radeon_vm_map_gart(struct radeon_device *rdev, uint64_t addr)
        uint64_t result;
        /* page table offset */
-        result = rdev->gart.pages_addr[addr >> PAGE_SHIFT];
+        result = rdev->gart.pages_entry[addr >> RADEON_GPU_PAGE_SHIFT];
+        result &= ~RADEON_GPU_PAGE_MASK;
-        /* in case cpu page size != gpu page size*/
-        result |= addr & (~PAGE_MASK);
        return result;
 }
@@ -745,9 +743,11 @@ static void radeon_vm_frag_ptes(struct radeon_device *rdev,
         */
        /* NI is optimized for 256KB fragments, SI and newer for 64KB */
-        uint64_t frag_flags = rdev->family == CHIP_CAYMAN ?
+        uint64_t frag_flags = ((rdev->family == CHIP_CAYMAN) ||
+                               (rdev->family == CHIP_ARUBA)) ?
                        R600_PTE_FRAG_256KB : R600_PTE_FRAG_64KB;
-        uint64_t frag_align = rdev->family == CHIP_CAYMAN ? 0x200 : 0x80;
+        uint64_t frag_align = ((rdev->family == CHIP_CAYMAN) ||
+                               (rdev->family == CHIP_ARUBA)) ? 0x200 : 0x80;
        uint64_t frag_start = ALIGN(pe_start, frag_align);
        uint64_t frag_end = pe_end & ~(frag_align - 1);
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index c5799f16aa4b..34e3235f41d2 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -212,11 +212,9 @@ void rs400_gart_fini(struct radeon_device *rdev)
 #define RS400_PTE_WRITEABLE (1 << 2)
 #define RS400_PTE_READABLE  (1 << 3)
-void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
+uint64_t rs400_gart_get_page_entry(uint64_t addr, uint32_t flags)
-                         uint64_t addr, uint32_t flags)
 {
        uint32_t entry;
-        u32 *gtt = rdev->gart.ptr;
        entry = (lower_32_bits(addr) & PAGE_MASK) |
                ((upper_32_bits(addr) & 0xff) << 4);
@@ -226,8 +224,14 @@ void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
                entry |= RS400_PTE_WRITEABLE;
        if (!(flags & RADEON_GART_PAGE_SNOOP))
                entry |= RS400_PTE_UNSNOOPED;
-        entry = cpu_to_le32(entry);
+        return entry;
-        gtt[i] = entry;
+}
+void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
+                         uint64_t entry)
+{
+        u32 *gtt = rdev->gart.ptr;
+        gtt[i] = cpu_to_le32(lower_32_bits(entry));
 }
 int rs400_mc_wait_for_idle(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 9acb1c3c005b..74bce91aecc1 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -625,11 +625,8 @@ static void rs600_gart_fini(struct radeon_device *rdev)
        radeon_gart_table_vram_free(rdev);
 }
-void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
+uint64_t rs600_gart_get_page_entry(uint64_t addr, uint32_t flags)
-                         uint64_t addr, uint32_t flags)
 {
-        void __iomem *ptr = (void *)rdev->gart.ptr;
        addr = addr & 0xFFFFFFFFFFFFF000ULL;
        addr |= R600_PTE_SYSTEM;
        if (flags & RADEON_GART_PAGE_VALID)
@@ -640,7 +637,14 @@ void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
                addr |= R600_PTE_WRITEABLE;
        if (flags & RADEON_GART_PAGE_SNOOP)
                addr |= R600_PTE_SNOOPED;
-        writeq(addr, ptr + (i * 8));
+        return addr;
+}
+void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
+                         uint64_t entry)
+{
+        void __iomem *ptr = (void *)rdev->gart.ptr;
+        writeq(entry, ptr + (i * 8));
 }
 int rs600_irq_set(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 60df444bd075..5d89b874a1a2 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -5057,6 +5057,16 @@ void si_vm_flush(struct radeon_device *rdev, struct radeon_ring *ring,
        radeon_ring_write(ring, 0);
        radeon_ring_write(ring, 1 << vm_id);
+        /* wait for the invalidate to complete */
+        radeon_ring_write(ring, PACKET3(PACKET3_WAIT_REG_MEM, 5));
+        radeon_ring_write(ring, (WAIT_REG_MEM_FUNCTION(0) |  /* always */
+                                 WAIT_REG_MEM_ENGINE(0))); /* me */
+        radeon_ring_write(ring, VM_INVALIDATE_REQUEST >> 2);
+        radeon_ring_write(ring, 0);
+        radeon_ring_write(ring, 0); /* ref */
+        radeon_ring_write(ring, 0); /* mask */
+        radeon_ring_write(ring, 0x20); /* poll interval */
        /* sync PFP to ME, otherwise we might get invalid PFP reads */
        radeon_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
        radeon_ring_write(ring, 0x0);
diff --git a/drivers/gpu/drm/radeon/si_dma.c b/drivers/gpu/drm/radeon/si_dma.c
index f5cc777e1c5f..83207929fc62 100644
--- a/drivers/gpu/drm/radeon/si_dma.c
+++ b/drivers/gpu/drm/radeon/si_dma.c
@@ -123,7 +123,6 @@ void si_dma_vm_write_pages(struct radeon_device *rdev,
                for (; ndw > 0; ndw -= 2, --count, pe += 8) {
                        if (flags & R600_PTE_SYSTEM) {
                                value = radeon_vm_map_gart(rdev, addr);
-                                value &= 0xFFFFFFFFFFFFF000ULL;
                        } else if (flags & R600_PTE_VALID) {
                                value = addr;
                        } else {
@@ -206,6 +205,14 @@ void si_dma_vm_flush(struct radeon_device *rdev, struct radeon_ring *ring,
        radeon_ring_write(ring, DMA_PACKET(DMA_PACKET_SRBM_WRITE, 0, 0, 0, 0));
        radeon_ring_write(ring, (0xf << 16) | (VM_INVALIDATE_REQUEST >> 2));
        radeon_ring_write(ring, 1 << vm_id);
+        /* wait for invalidate to complete */
+        radeon_ring_write(ring, DMA_PACKET(DMA_PACKET_POLL_REG_MEM, 0, 0, 0, 0));
+        radeon_ring_write(ring, VM_INVALIDATE_REQUEST);
+        radeon_ring_write(ring, 0xff << 16); /* retry */
+        radeon_ring_write(ring, 1 << vm_id); /* mask */
+        radeon_ring_write(ring, 0); /* value */
+        radeon_ring_write(ring, (0 << 28) | 0x20); /* func(always) | poll interval */
 }
 /**
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 32e354b8b0ab..eff8a6444956 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2908,6 +2908,22 @@ static int si_init_smc_spll_table(struct radeon_device *rdev)
        return ret;
 }
+struct si_dpm_quirk {
+        u32 chip_vendor;
+        u32 chip_device;
+        u32 subsys_vendor;
+        u32 subsys_device;
+        u32 max_sclk;
+        u32 max_mclk;
+};
+/* cards with dpm stability problems */
+static struct si_dpm_quirk si_dpm_quirk_list[] = {
+        /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
+        { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
+        { 0, 0, 0, 0 },
+};
 static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                                        struct radeon_ps *rps)
 {
@@ -2918,7 +2934,22 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
        u32 mclk, sclk;
        u16 vddc, vddci;
        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
+        u32 max_sclk = 0, max_mclk = 0;
        int i;
+        struct si_dpm_quirk *p = si_dpm_quirk_list;
+        /* Apply dpm quirks */
+        while (p && p->chip_device != 0) {
+                if (rdev->pdev->vendor == p->chip_vendor &&
+                    rdev->pdev->device == p->chip_device &&
+                    rdev->pdev->subsystem_vendor == p->subsys_vendor &&
+                    rdev->pdev->subsystem_device == p->subsys_device) {
+                        max_sclk = p->max_sclk;
+                        max_mclk = p->max_mclk;
+                        break;
+                }
+                ++p;
+        }
        if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
            ni_dpm_vblank_too_short(rdev))
@@ -2972,6 +3003,14 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                        if (ps->performance_levels[i].mclk > max_mclk_vddc)
                                ps->performance_levels[i].mclk = max_mclk_vddc;
                }
+                if (max_mclk) {
+                        if (ps->performance_levels[i].mclk > max_mclk)
+                                ps->performance_levels[i].mclk = max_mclk;
+                }
+                if (max_sclk) {
+                        if (ps->performance_levels[i].sclk > max_sclk)
+                                ps->performance_levels[i].sclk = max_sclk;
+                }
        }
        /* XXX validate the min clocks required for display */
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index 4069be89e585..84999242c747 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -1632,6 +1632,23 @@
 #define PACKET3_MPEG_INDEX                              0x3A
 #define PACKET3_COPY_DW                                 0x3B
 #define PACKET3_WAIT_REG_MEM                            0x3C
+#define         WAIT_REG_MEM_FUNCTION(x)                ((x) << 0)
+                /* 0 - always
+                 * 1 - <
+                 * 2 - <=
+                 * 3 - ==
+                 * 4 - !=
+                 * 5 - >=
+                 * 6 - >
+                 */
+#define         WAIT_REG_MEM_MEM_SPACE(x)               ((x) << 4)
+                /* 0 - reg
+                 * 1 - mem
+                 */
+#define         WAIT_REG_MEM_ENGINE(x)                  ((x) << 8)
+                /* 0 - me
+                 * 1 - pfp
+                 */
 #define PACKET3_MEM_WRITE                               0x3D
 #define PACKET3_COPY_DATA                               0x40
 #define PACKET3_CP_DMA                                  0x41
@@ -1835,6 +1852,7 @@
 #define DMA_PACKET_TRAP                                   0x7
 #define DMA_PACKET_SRBM_WRITE                             0x9
 #define DMA_PACKET_CONSTANT_FILL                          0xd
+#define DMA_PACKET_POLL_REG_MEM                           0xe
 #define DMA_PACKET_NOP                                    0xf
 #define VCE_STATUS                                      0x20004
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index 3367960286a6..978993fa3a36 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -168,7 +168,7 @@ static int tegra_dc_setup_window(struct tegra_dc *dc, unsigned int index,
                                 const struct tegra_dc_window *window)
 {
        unsigned h_offset, v_offset, h_size, v_size, h_dda, v_dda, bpp;
-        unsigned long value;
+        unsigned long value, flags;
        bool yuv, planar;
        /*
@@ -181,6 +181,8 @@ static int tegra_dc_setup_window(struct tegra_dc *dc, unsigned int index,
        else
                bpp = planar ? 1 : 2;
+        spin_lock_irqsave(&dc->lock, flags);
        value = WINDOW_A_SELECT << index;
        tegra_dc_writel(dc, value, DC_CMD_DISPLAY_WINDOW_HEADER);
@@ -273,6 +275,7 @@ static int tegra_dc_setup_window(struct tegra_dc *dc, unsigned int index,
                case TEGRA_BO_TILING_MODE_BLOCK:
                        DRM_ERROR("hardware doesn't support block linear mode\n");
+                        spin_unlock_irqrestore(&dc->lock, flags);
                        return -EINVAL;
                }
@@ -331,6 +334,8 @@ static int tegra_dc_setup_window(struct tegra_dc *dc, unsigned int index,
        tegra_dc_window_commit(dc, index);
+        spin_unlock_irqrestore(&dc->lock, flags);
        return 0;
 }
@@ -338,11 +343,14 @@ static int tegra_window_plane_disable(struct drm_plane *plane)
 {
        struct tegra_dc *dc = to_tegra_dc(plane->crtc);
        struct tegra_plane *p = to_tegra_plane(plane);
+        unsigned long flags;
        u32 value;
        if (!plane->crtc)
                return 0;
+        spin_lock_irqsave(&dc->lock, flags);
        value = WINDOW_A_SELECT << p->index;
        tegra_dc_writel(dc, value, DC_CMD_DISPLAY_WINDOW_HEADER);
@@ -352,6 +360,8 @@ static int tegra_window_plane_disable(struct drm_plane *plane)
        tegra_dc_window_commit(dc, p->index);
+        spin_unlock_irqrestore(&dc->lock, flags);
        return 0;
 }
@@ -699,14 +709,16 @@ static int tegra_dc_set_base(struct tegra_dc *dc, int x, int y,
        struct tegra_bo *bo = tegra_fb_get_plane(fb, 0);
        unsigned int h_offset = 0, v_offset = 0;
        struct tegra_bo_tiling tiling;
+        unsigned long value, flags;
        unsigned int format, swap;
-        unsigned long value;
        int err;
        err = tegra_fb_get_tiling(fb, &tiling);
        if (err < 0)
                return err;
+        spin_lock_irqsave(&dc->lock, flags);
        tegra_dc_writel(dc, WINDOW_A_SELECT, DC_CMD_DISPLAY_WINDOW_HEADER);
        value = fb->offsets[0] + y * fb->pitches[0] +
@@ -752,6 +764,7 @@ static int tegra_dc_set_base(struct tegra_dc *dc, int x, int y,
                case TEGRA_BO_TILING_MODE_BLOCK:
                        DRM_ERROR("hardware doesn't support block linear mode\n");
+                        spin_unlock_irqrestore(&dc->lock, flags);
                        return -EINVAL;
                }
@@ -778,6 +791,8 @@ static int tegra_dc_set_base(struct tegra_dc *dc, int x, int y,
        tegra_dc_writel(dc, value << 8, DC_CMD_STATE_CONTROL);
        tegra_dc_writel(dc, value, DC_CMD_STATE_CONTROL);
+        spin_unlock_irqrestore(&dc->lock, flags);
        return 0;
 }
@@ -814,23 +829,32 @@ static void tegra_dc_finish_page_flip(struct tegra_dc *dc)
        unsigned long flags, base;
        struct tegra_bo *bo;
-        if (!dc->event)
+        spin_lock_irqsave(&drm->event_lock, flags);
+        if (!dc->event) {
+                spin_unlock_irqrestore(&drm->event_lock, flags);
                return;
+        }
        bo = tegra_fb_get_plane(crtc->primary->fb, 0);
+        spin_lock_irqsave(&dc->lock, flags);
        /* check if new start address has been latched */
+        tegra_dc_writel(dc, WINDOW_A_SELECT, DC_CMD_DISPLAY_WINDOW_HEADER);
        tegra_dc_writel(dc, READ_MUX, DC_CMD_STATE_ACCESS);
        base = tegra_dc_readl(dc, DC_WINBUF_START_ADDR);
        tegra_dc_writel(dc, 0, DC_CMD_STATE_ACCESS);
+        spin_unlock_irqrestore(&dc->lock, flags);
        if (base == bo->paddr + crtc->primary->fb->offsets[0]) {
-                spin_lock_irqsave(&drm->event_lock, flags);
+                drm_crtc_send_vblank_event(crtc, dc->event);
-                drm_send_vblank_event(drm, dc->pipe, dc->event);
+                drm_crtc_vblank_put(crtc);
-                drm_vblank_put(drm, dc->pipe);
                dc->event = NULL;
-                spin_unlock_irqrestore(&drm->event_lock, flags);
        }
+        spin_unlock_irqrestore(&drm->event_lock, flags);
 }
 void tegra_dc_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file)
@@ -843,7 +867,7 @@ void tegra_dc_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file)
        if (dc->event && dc->event->base.file_priv == file) {
                dc->event->base.destroy(&dc->event->base);
-                drm_vblank_put(drm, dc->pipe);
+                drm_crtc_vblank_put(crtc);
                dc->event = NULL;
        }
@@ -853,16 +877,16 @@ void tegra_dc_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file)
 static int tegra_dc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                              struct drm_pending_vblank_event *event, uint32_t page_flip_flags)
 {
+        unsigned int pipe = drm_crtc_index(crtc);
        struct tegra_dc *dc = to_tegra_dc(crtc);
-        struct drm_device *drm = crtc->dev;
        if (dc->event)
                return -EBUSY;
        if (event) {
-                event->pipe = dc->pipe;
+                event->pipe = pipe;
                dc->event = event;
-                drm_vblank_get(drm, dc->pipe);
+                drm_crtc_vblank_get(crtc);
        }
        tegra_dc_set_base(dc, 0, 0, fb);
@@ -1127,7 +1151,7 @@ static irqreturn_t tegra_dc_irq(int irq, void *data)
                /*
                dev_dbg(dc->dev, "%s(): vertical blank\n", __func__);
                */
-                drm_handle_vblank(dc->base.dev, dc->pipe);
+                drm_crtc_handle_vblank(&dc->base);
                tegra_dc_finish_page_flip(dc);
        }
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index e549afeece1f..d4f827593dfa 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -694,24 +694,28 @@ static const struct file_operations tegra_drm_fops = {
        .llseek = noop_llseek,
 };
-static struct drm_crtc *tegra_crtc_from_pipe(struct drm_device *drm, int pipe)
+static struct drm_crtc *tegra_crtc_from_pipe(struct drm_device *drm,
+                                             unsigned int pipe)
 {
        struct drm_crtc *crtc;
        list_for_each_entry(crtc, &drm->mode_config.crtc_list, head) {
-                struct tegra_dc *dc = to_tegra_dc(crtc);
+                if (pipe == drm_crtc_index(crtc))
-                if (dc->pipe == pipe)
                        return crtc;
        }
        return NULL;
 }
-static u32 tegra_drm_get_vblank_counter(struct drm_device *dev, int crtc)
+static u32 tegra_drm_get_vblank_counter(struct drm_device *drm, int pipe)
 {
+        struct drm_crtc *crtc = tegra_crtc_from_pipe(drm, pipe);
+        if (!crtc)
+                return 0;
        /* TODO: implement real hardware counter using syncpoints */
-        return drm_vblank_count(dev, crtc);
+        return drm_crtc_vblank_count(crtc);
 }
 static int tegra_drm_enable_vblank(struct drm_device *drm, int pipe)
diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index da32086cbeaf..8777b7f75791 100644
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -216,32 +216,58 @@ static void tegra_bo_free(struct drm_device *drm, struct tegra_bo *bo)
        }
 }
-static int tegra_bo_get_pages(struct drm_device *drm, struct tegra_bo *bo,
+static int tegra_bo_get_pages(struct drm_device *drm, struct tegra_bo *bo)
-                              size_t size)
 {
+        struct scatterlist *s;
+        struct sg_table *sgt;
+        unsigned int i;
        bo->pages = drm_gem_get_pages(&bo->gem);
        if (IS_ERR(bo->pages))
                return PTR_ERR(bo->pages);
-        bo->num_pages = size >> PAGE_SHIFT;
+        bo->num_pages = bo->gem.size >> PAGE_SHIFT;
-        bo->sgt = drm_prime_pages_to_sg(bo->pages, bo->num_pages);
+        sgt = drm_prime_pages_to_sg(bo->pages, bo->num_pages);
-        if (IS_ERR(bo->sgt)) {
+        if (IS_ERR(sgt))
-                drm_gem_put_pages(&bo->gem, bo->pages, false, false);
+                goto put_pages;
-                return PTR_ERR(bo->sgt);
+        /*
+         * Fake up the SG table so that dma_map_sg() can be used to flush the
+         * pages associated with it. Note that this relies on the fact that
+         * the DMA API doesn't hook into IOMMU on Tegra, therefore mapping is
+         * only cache maintenance.
+         *
+         * TODO: Replace this by drm_clflash_sg() once it can be implemented
+         * without relying on symbols that are not exported.
+         */
+        for_each_sg(sgt->sgl, s, sgt->nents, i)
+                sg_dma_address(s) = sg_phys(s);
+        if (dma_map_sg(drm->dev, sgt->sgl, sgt->nents, DMA_TO_DEVICE) == 0) {
+                sgt = ERR_PTR(-ENOMEM);
+                goto release_sgt;
        }
+        bo->sgt = sgt;
        return 0;
+release_sgt:
+        sg_free_table(sgt);
+        kfree(sgt);
+put_pages:
+        drm_gem_put_pages(&bo->gem, bo->pages, false, false);
+        return PTR_ERR(sgt);
 }
-static int tegra_bo_alloc(struct drm_device *drm, struct tegra_bo *bo,
+static int tegra_bo_alloc(struct drm_device *drm, struct tegra_bo *bo)
-                          size_t size)
 {
        struct tegra_drm *tegra = drm->dev_private;
        int err;
        if (tegra->domain) {
-                err = tegra_bo_get_pages(drm, bo, size);
+                err = tegra_bo_get_pages(drm, bo);
                if (err < 0)
                        return err;
@@ -251,6 +277,8 @@ static int tegra_bo_alloc(struct drm_device *drm, struct tegra_bo *bo,
                        return err;
                }
        } else {
+                size_t size = bo->gem.size;
                bo->vaddr = dma_alloc_writecombine(drm->dev, size, &bo->paddr,
                                                   GFP_KERNEL | __GFP_NOWARN);
                if (!bo->vaddr) {
@@ -274,7 +302,7 @@ struct tegra_bo *tegra_bo_create(struct drm_device *drm, size_t size,
        if (IS_ERR(bo))
                return bo;
-        err = tegra_bo_alloc(drm, bo, size);
+        err = tegra_bo_alloc(drm, bo);
        if (err < 0)
                goto release;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 7b5d22110f25..6c6b655defcf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -406,11 +406,9 @@ int vmw_3d_resource_inc(struct vmw_private *dev_priv,
                if (unlikely(ret != 0))
                        --dev_priv->num_3d_resources;
        } else if (unhide_svga) {
-                mutex_lock(&dev_priv->hw_mutex);
                vmw_write(dev_priv, SVGA_REG_ENABLE,
                          vmw_read(dev_priv, SVGA_REG_ENABLE) &
                          ~SVGA_REG_ENABLE_HIDE);
-                mutex_unlock(&dev_priv->hw_mutex);
        }
        mutex_unlock(&dev_priv->release_mutex);
@@ -433,13 +431,10 @@ void vmw_3d_resource_dec(struct vmw_private *dev_priv,
        mutex_lock(&dev_priv->release_mutex);
        if (unlikely(--dev_priv->num_3d_resources == 0))
                vmw_release_device(dev_priv);
-        else if (hide_svga) {
+        else if (hide_svga)
-                mutex_lock(&dev_priv->hw_mutex);
                vmw_write(dev_priv, SVGA_REG_ENABLE,
                          vmw_read(dev_priv, SVGA_REG_ENABLE) |
                          SVGA_REG_ENABLE_HIDE);
-                mutex_unlock(&dev_priv->hw_mutex);
-        }
        n3d = (int32_t) dev_priv->num_3d_resources;
        mutex_unlock(&dev_priv->release_mutex);
@@ -600,12 +595,14 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
        dev_priv->dev = dev;
        dev_priv->vmw_chipset = chipset;
        dev_priv->last_read_seqno = (uint32_t) -100;
-        mutex_init(&dev_priv->hw_mutex);
        mutex_init(&dev_priv->cmdbuf_mutex);
        mutex_init(&dev_priv->release_mutex);
        mutex_init(&dev_priv->binding_mutex);
        rwlock_init(&dev_priv->resource_lock);
        ttm_lock_init(&dev_priv->reservation_sem);
+        spin_lock_init(&dev_priv->hw_lock);
+        spin_lock_init(&dev_priv->waiter_lock);
+        spin_lock_init(&dev_priv->cap_lock);
        for (i = vmw_res_context; i < vmw_res_max; ++i) {
                idr_init(&dev_priv->res_idr[i]);
@@ -626,14 +623,11 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
        dev_priv->enable_fb = enable_fbdev;
-        mutex_lock(&dev_priv->hw_mutex);
        vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
        svga_id = vmw_read(dev_priv, SVGA_REG_ID);
        if (svga_id != SVGA_ID_2) {
                ret = -ENOSYS;
                DRM_ERROR("Unsupported SVGA ID 0x%x\n", svga_id);
-                mutex_unlock(&dev_priv->hw_mutex);
                goto out_err0;
        }
@@ -683,10 +677,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                dev_priv->prim_bb_mem = dev_priv->vram_size;
        ret = vmw_dma_masks(dev_priv);
-        if (unlikely(ret != 0)) {
+        if (unlikely(ret != 0))
-                mutex_unlock(&dev_priv->hw_mutex);
                goto out_err0;
-        }
        /*
         * Limit back buffer size to VRAM size.  Remove this once
@@ -695,8 +687,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
        if (dev_priv->prim_bb_mem > dev_priv->vram_size)
                dev_priv->prim_bb_mem = dev_priv->vram_size;
-        mutex_unlock(&dev_priv->hw_mutex);
        vmw_print_capabilities(dev_priv->capabilities);
        if (dev_priv->capabilities & SVGA_CAP_GMR2) {
@@ -1160,9 +1150,7 @@ static int vmw_master_set(struct drm_device *dev,
                if (unlikely(ret != 0))
                        return ret;
                vmw_kms_save_vga(dev_priv);
-                mutex_lock(&dev_priv->hw_mutex);
                vmw_write(dev_priv, SVGA_REG_TRACES, 0);
-                mutex_unlock(&dev_priv->hw_mutex);
        }
        if (active) {
@@ -1196,9 +1184,7 @@ out_no_active_lock:
        if (!dev_priv->enable_fb) {
                vmw_kms_restore_vga(dev_priv);
                vmw_3d_resource_dec(dev_priv, true);
-                mutex_lock(&dev_priv->hw_mutex);
                vmw_write(dev_priv, SVGA_REG_TRACES, 1);
-                mutex_unlock(&dev_priv->hw_mutex);
        }
        return ret;
 }
@@ -1233,9 +1219,7 @@ static void vmw_master_drop(struct drm_device *dev,
                        DRM_ERROR("Unable to clean VRAM on master drop.\n");
                vmw_kms_restore_vga(dev_priv);
                vmw_3d_resource_dec(dev_priv, true);
-                mutex_lock(&dev_priv->hw_mutex);
                vmw_write(dev_priv, SVGA_REG_TRACES, 1);
-                mutex_unlock(&dev_priv->hw_mutex);
        }
        dev_priv->active_master = &dev_priv->fbdev_master;
@@ -1367,10 +1351,8 @@ static void vmw_pm_complete(struct device *kdev)
        struct drm_device *dev = pci_get_drvdata(pdev);
        struct vmw_private *dev_priv = vmw_priv(dev);
-        mutex_lock(&dev_priv->hw_mutex);
        vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
        (void) vmw_read(dev_priv, SVGA_REG_ID);
-        mutex_unlock(&dev_priv->hw_mutex);
        /**
         * Reclaim 3d reference held by fbdev and potentially
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 4ee799b43d5d..d26a6daa9719 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -399,7 +399,8 @@ struct vmw_private {
        uint32_t memory_size;
        bool has_gmr;
        bool has_mob;
-        struct mutex hw_mutex;
+        spinlock_t hw_lock;
+        spinlock_t cap_lock;
        /*
         * VGA registers.
@@ -449,8 +450,9 @@ struct vmw_private {
        atomic_t marker_seq;
        wait_queue_head_t fence_queue;
        wait_queue_head_t fifo_queue;
-        int fence_queue_waiters; /* Protected by hw_mutex */
+        spinlock_t waiter_lock;
-        int goal_queue_waiters; /* Protected by hw_mutex */
+        int fence_queue_waiters; /* Protected by waiter_lock */
+        int goal_queue_waiters; /* Protected by waiter_lock */
        atomic_t fifo_queue_waiters;
        uint32_t last_read_seqno;
        spinlock_t irq_lock;
@@ -553,20 +555,35 @@ static inline struct vmw_master *vmw_master(struct drm_master *master)
        return (struct vmw_master *) master->driver_priv;
 }
+/*
+ * The locking here is fine-grained, so that it is performed once
+ * for every read- and write operation. This is of course costly, but we
+ * don't perform much register access in the timing critical paths anyway.
+ * Instead we have the extra benefit of being sure that we don't forget
+ * the hw lock around register accesses.
+ */
 static inline void vmw_write(struct vmw_private *dev_priv,
                             unsigned int offset, uint32_t value)
 {
+        unsigned long irq_flags;
+        spin_lock_irqsave(&dev_priv->hw_lock, irq_flags);
        outl(offset, dev_priv->io_start + VMWGFX_INDEX_PORT);
        outl(value, dev_priv->io_start + VMWGFX_VALUE_PORT);
+        spin_unlock_irqrestore(&dev_priv->hw_lock, irq_flags);
 }
 static inline uint32_t vmw_read(struct vmw_private *dev_priv,
                                unsigned int offset)
 {
-        uint32_t val;
+        unsigned long irq_flags;
+        u32 val;
+        spin_lock_irqsave(&dev_priv->hw_lock, irq_flags);
        outl(offset, dev_priv->io_start + VMWGFX_INDEX_PORT);
        val = inl(dev_priv->io_start + VMWGFX_VALUE_PORT);
+        spin_unlock_irqrestore(&dev_priv->hw_lock, irq_flags);
        return val;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index b7594cb758af..945f1e0dad92 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -35,7 +35,7 @@ struct vmw_fence_manager {
        struct vmw_private *dev_priv;
        spinlock_t lock;
        struct list_head fence_list;
-        struct work_struct work, ping_work;
+        struct work_struct work;
        u32 user_fence_size;
        u32 fence_size;
        u32 event_fence_action_size;
@@ -134,14 +134,6 @@ static const char *vmw_fence_get_timeline_name(struct fence *f)
        return "svga";
 }
-static void vmw_fence_ping_func(struct work_struct *work)
-{
-        struct vmw_fence_manager *fman =
-                container_of(work, struct vmw_fence_manager, ping_work);
-        vmw_fifo_ping_host(fman->dev_priv, SVGA_SYNC_GENERIC);
-}
 static bool vmw_fence_enable_signaling(struct fence *f)
 {
        struct vmw_fence_obj *fence =
@@ -155,11 +147,7 @@ static bool vmw_fence_enable_signaling(struct fence *f)
        if (seqno - fence->base.seqno < VMW_FENCE_WRAP)
                return false;
-        if (mutex_trylock(&dev_priv->hw_mutex)) {
+        vmw_fifo_ping_host(dev_priv, SVGA_SYNC_GENERIC);
-                vmw_fifo_ping_host_locked(dev_priv, SVGA_SYNC_GENERIC);
-                mutex_unlock(&dev_priv->hw_mutex);
-        } else
-                schedule_work(&fman->ping_work);
        return true;
 }
@@ -305,7 +293,6 @@ struct vmw_fence_manager *vmw_fence_manager_init(struct vmw_private *dev_priv)
        INIT_LIST_HEAD(&fman->fence_list);
        INIT_LIST_HEAD(&fman->cleanup_list);
        INIT_WORK(&fman->work, &vmw_fence_work_func);
-        INIT_WORK(&fman->ping_work, &vmw_fence_ping_func);
        fman->fifo_down = true;
        fman->user_fence_size = ttm_round_pot(sizeof(struct vmw_user_fence));
        fman->fence_size = ttm_round_pot(sizeof(struct vmw_fence_obj));
@@ -323,7 +310,6 @@ void vmw_fence_manager_takedown(struct vmw_fence_manager *fman)
        bool lists_empty;
        (void) cancel_work_sync(&fman->work);
-        (void) cancel_work_sync(&fman->ping_work);
        spin_lock_irqsave(&fman->lock, irq_flags);
        lists_empty = list_empty(&fman->fence_list) &&
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index 09e10aefcd8e..39f2b03888e7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -44,10 +44,10 @@ bool vmw_fifo_have_3d(struct vmw_private *dev_priv)
                if (!dev_priv->has_mob)
                        return false;
-                mutex_lock(&dev_priv->hw_mutex);
+                spin_lock(&dev_priv->cap_lock);
                vmw_write(dev_priv, SVGA_REG_DEV_CAP, SVGA3D_DEVCAP_3D);
                result = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
-                mutex_unlock(&dev_priv->hw_mutex);
+                spin_unlock(&dev_priv->cap_lock);
                return (result != 0);
        }
@@ -120,7 +120,6 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
        DRM_INFO("height %d\n", vmw_read(dev_priv, SVGA_REG_HEIGHT));
        DRM_INFO("bpp %d\n", vmw_read(dev_priv, SVGA_REG_BITS_PER_PIXEL));
-        mutex_lock(&dev_priv->hw_mutex);
        dev_priv->enable_state = vmw_read(dev_priv, SVGA_REG_ENABLE);
        dev_priv->config_done_state = vmw_read(dev_priv, SVGA_REG_CONFIG_DONE);
        dev_priv->traces_state = vmw_read(dev_priv, SVGA_REG_TRACES);
@@ -143,7 +142,6 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
        mb();
        vmw_write(dev_priv, SVGA_REG_CONFIG_DONE, 1);
-        mutex_unlock(&dev_priv->hw_mutex);
        max = ioread32(fifo_mem + SVGA_FIFO_MAX);
        min = ioread32(fifo_mem  + SVGA_FIFO_MIN);
@@ -160,31 +158,28 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
        return vmw_fifo_send_fence(dev_priv, &dummy);
 }
-void vmw_fifo_ping_host_locked(struct vmw_private *dev_priv, uint32_t reason)
+void vmw_fifo_ping_host(struct vmw_private *dev_priv, uint32_t reason)
 {
        __le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+        static DEFINE_SPINLOCK(ping_lock);
+        unsigned long irq_flags;
+        /*
+         * The ping_lock is needed because we don't have an atomic
+         * test-and-set of the SVGA_FIFO_BUSY register.
+         */
+        spin_lock_irqsave(&ping_lock, irq_flags);
        if (unlikely(ioread32(fifo_mem + SVGA_FIFO_BUSY) == 0)) {
                iowrite32(1, fifo_mem + SVGA_FIFO_BUSY);
                vmw_write(dev_priv, SVGA_REG_SYNC, reason);
        }
-}
+        spin_unlock_irqrestore(&ping_lock, irq_flags);
-void vmw_fifo_ping_host(struct vmw_private *dev_priv, uint32_t reason)
-{
-        mutex_lock(&dev_priv->hw_mutex);
-        vmw_fifo_ping_host_locked(dev_priv, reason);
-        mutex_unlock(&dev_priv->hw_mutex);
 }
 void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
 {
        __le32 __iomem *fifo_mem = dev_priv->mmio_virt;
-        mutex_lock(&dev_priv->hw_mutex);
        vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
        while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0)
                ;
@@ -198,7 +193,6 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
        vmw_write(dev_priv, SVGA_REG_TRACES,
                  dev_priv->traces_state);
-        mutex_unlock(&dev_priv->hw_mutex);
        vmw_marker_queue_takedown(&fifo->marker_queue);
        if (likely(fifo->static_buffer != NULL)) {
@@ -271,7 +265,7 @@ static int vmw_fifo_wait(struct vmw_private *dev_priv,
                return vmw_fifo_wait_noirq(dev_priv, bytes,
                                           interruptible, timeout);
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
        if (atomic_add_return(1, &dev_priv->fifo_queue_waiters) > 0) {
                spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
                outl(SVGA_IRQFLAG_FIFO_PROGRESS,
@@ -280,7 +274,7 @@ static int vmw_fifo_wait(struct vmw_private *dev_priv,
                vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
        }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
        if (interruptible)
                ret = wait_event_interruptible_timeout
@@ -296,14 +290,14 @@ static int vmw_fifo_wait(struct vmw_private *dev_priv,
        else if (likely(ret > 0))
                ret = 0;
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
        if (atomic_dec_and_test(&dev_priv->fifo_queue_waiters)) {
                spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
                dev_priv->irq_mask &= ~SVGA_IRQFLAG_FIFO_PROGRESS;
                vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
        }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
        return ret;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index 37881ecf5d7a..69c8ce23123c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -135,13 +135,13 @@ static int vmw_fill_compat_cap(struct vmw_private *dev_priv, void *bounce,
                (pair_offset + max_size * sizeof(SVGA3dCapPair)) / sizeof(u32);
        compat_cap->header.type = SVGA3DCAPS_RECORD_DEVCAPS;
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->cap_lock);
        for (i = 0; i < max_size; ++i) {
                vmw_write(dev_priv, SVGA_REG_DEV_CAP, i);
                compat_cap->pairs[i][0] = i;
                compat_cap->pairs[i][1] = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
        }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->cap_lock);
        return 0;
 }
@@ -191,12 +191,12 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
                if (num > SVGA3D_DEVCAP_MAX)
                        num = SVGA3D_DEVCAP_MAX;
-                mutex_lock(&dev_priv->hw_mutex);
+                spin_lock(&dev_priv->cap_lock);
                for (i = 0; i < num; ++i) {
                        vmw_write(dev_priv, SVGA_REG_DEV_CAP, i);
                        *bounce32++ = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
                }
-                mutex_unlock(&dev_priv->hw_mutex);
+                spin_unlock(&dev_priv->cap_lock);
        } else if (gb_objects) {
                ret = vmw_fill_compat_cap(dev_priv, bounce, size);
                if (unlikely(ret != 0))
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
index 0c423766c441..9fe9827ee499 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
@@ -62,13 +62,8 @@ irqreturn_t vmw_irq_handler(int irq, void *arg)
 static bool vmw_fifo_idle(struct vmw_private *dev_priv, uint32_t seqno)
 {
-        uint32_t busy;
-        mutex_lock(&dev_priv->hw_mutex);
+        return (vmw_read(dev_priv, SVGA_REG_BUSY) == 0);
-        busy = vmw_read(dev_priv, SVGA_REG_BUSY);
-        mutex_unlock(&dev_priv->hw_mutex);
-        return (busy == 0);
 }
 void vmw_update_seqno(struct vmw_private *dev_priv,
@@ -184,7 +179,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
 void vmw_seqno_waiter_add(struct vmw_private *dev_priv)
 {
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
        if (dev_priv->fence_queue_waiters++ == 0) {
                unsigned long irq_flags;
@@ -195,12 +190,12 @@ void vmw_seqno_waiter_add(struct vmw_private *dev_priv)
                vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
        }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
 }
 void vmw_seqno_waiter_remove(struct vmw_private *dev_priv)
 {
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
        if (--dev_priv->fence_queue_waiters == 0) {
                unsigned long irq_flags;
@@ -209,13 +204,13 @@ void vmw_seqno_waiter_remove(struct vmw_private *dev_priv)
                vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
        }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
 }
 void vmw_goal_waiter_add(struct vmw_private *dev_priv)
 {
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
        if (dev_priv->goal_queue_waiters++ == 0) {
                unsigned long irq_flags;
@@ -226,12 +221,12 @@ void vmw_goal_waiter_add(struct vmw_private *dev_priv)
                vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
        }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
 }
 void vmw_goal_waiter_remove(struct vmw_private *dev_priv)
 {
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
        if (--dev_priv->goal_queue_waiters == 0) {
                unsigned long irq_flags;
@@ -240,7 +235,7 @@ void vmw_goal_waiter_remove(struct vmw_private *dev_priv)
                vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
        }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
 }
 int vmw_wait_seqno(struct vmw_private *dev_priv,
@@ -315,9 +310,7 @@ void vmw_irq_uninstall(struct drm_device *dev)
        if (!(dev_priv->capabilities & SVGA_CAP_IRQMASK))
                return;
-        mutex_lock(&dev_priv->hw_mutex);
        vmw_write(dev_priv, SVGA_REG_IRQMASK, 0);
-        mutex_unlock(&dev_priv->hw_mutex);
        status = inl(dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
        outl(status, dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 3725b521d931..8725b79e7847 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1828,9 +1828,7 @@ vmw_du_connector_detect(struct drm_connector *connector, bool force)
        struct vmw_private *dev_priv = vmw_priv(dev);
        struct vmw_display_unit *du = vmw_connector_to_du(connector);
-        mutex_lock(&dev_priv->hw_mutex);
        num_displays = vmw_read(dev_priv, SVGA_REG_NUM_DISPLAYS);
-        mutex_unlock(&dev_priv->hw_mutex);
        return ((vmw_connector_to_du(connector)->unit < num_displays &&
                 du->pref_active) ?
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 230b6f887cd8..dfdc26970022 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -27,7 +27,8 @@ if HID
 config HID_BATTERY_STRENGTH
        bool "Battery level reporting for HID devices"
-        depends on HID && POWER_SUPPLY && HID = POWER_SUPPLY
+        depends on HID
+        select POWER_SUPPLY
        default n
        ---help---
        This option adds support of reporting battery strength (for HID devices
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index c3d0ac1a0988..8b638792cb43 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1805,6 +1805,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2) },
        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LCPOWER, USB_DEVICE_ID_LCPOWER_LC1000 ) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 7460f3402298..9243359c1821 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -526,6 +526,7 @@
 #define USB_DEVICE_ID_KYE_GPEN_560      0x5003
 #define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010
 #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X        0x5011
+#define USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2      0x501a
 #define USB_DEVICE_ID_KYE_EASYPEN_M610X 0x5013
 #define USB_VENDOR_ID_LABTEC            0x1020
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index e0a0f06ac5ef..9505605b6e22 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -312,6 +312,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
                               USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI),
          HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
+                               USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO),
+          HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
                USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI),
          HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
        {}
diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
index b92bf01a1ae8..158fcf577fae 100644
--- a/drivers/hid/hid-kye.c
+++ b/drivers/hid/hid-kye.c
@@ -323,6 +323,7 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                }
                break;
        case USB_DEVICE_ID_KYE_MOUSEPEN_I608X:
+        case USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2:
                if (*rsize == MOUSEPEN_I608X_RDESC_ORIG_SIZE) {
                        rdesc = mousepen_i608x_rdesc_fixed;
                        *rsize = sizeof(mousepen_i608x_rdesc_fixed);
@@ -415,6 +416,7 @@ static int kye_probe(struct hid_device *hdev, const struct hid_device_id *id)
        switch (id->product) {
        case USB_DEVICE_ID_KYE_EASYPEN_I405X:
        case USB_DEVICE_ID_KYE_MOUSEPEN_I608X:
+        case USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2:
        case USB_DEVICE_ID_KYE_EASYPEN_M610X:
                ret = kye_tablet_enable(hdev);
                if (ret) {
@@ -446,6 +448,8 @@ static const struct hid_device_id kye_devices[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
                                USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
        { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+                                USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
                                USB_DEVICE_ID_KYE_EASYPEN_M610X) },
        { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
                                USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index c917ab61aafa..5bc6d80d5be7 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -962,10 +962,24 @@ static int logi_dj_raw_event(struct hid_device *hdev,
        switch (data[0]) {
        case REPORT_ID_DJ_SHORT:
+                if (size != DJREPORT_SHORT_LENGTH) {
+                        dev_err(&hdev->dev, "DJ report of bad size (%d)", size);
+                        return false;
+                }
                return logi_dj_dj_event(hdev, report, data, size);
        case REPORT_ID_HIDPP_SHORT:
-                /* intentional fallthrough */
+                if (size != HIDPP_REPORT_SHORT_LENGTH) {
+                        dev_err(&hdev->dev,
+                                "Short HID++ report of bad size (%d)", size);
+                        return false;
+                }
+                return logi_dj_hidpp_event(hdev, report, data, size);
        case REPORT_ID_HIDPP_LONG:
+                if (size != HIDPP_REPORT_LONG_LENGTH) {
+                        dev_err(&hdev->dev,
+                                "Long HID++ report of bad size (%d)", size);
+                        return false;
+                }
                return logi_dj_hidpp_event(hdev, report, data, size);
        }
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 2f420c0b6609..a93cefe0e522 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -282,6 +282,33 @@ static inline bool hidpp_report_is_connect_event(struct hidpp_report *report)
                (report->rap.sub_id == 0x41);
 }
+/**
+ * hidpp_prefix_name() prefixes the current given name with "Logitech ".
+ */
+static void hidpp_prefix_name(char **name, int name_length)
+{
+#define PREFIX_LENGTH 9 /* "Logitech " */
+        int new_length;
+        char *new_name;
+        if (name_length > PREFIX_LENGTH &&
+            strncmp(*name, "Logitech ", PREFIX_LENGTH) == 0)
+                /* The prefix has is already in the name */
+                return;
+        new_length = PREFIX_LENGTH + name_length;
+        new_name = kzalloc(new_length, GFP_KERNEL);
+        if (!new_name)
+                return;
+        snprintf(new_name, new_length, "Logitech %s", *name);
+        kfree(*name);
+        *name = new_name;
+}
 /* -------------------------------------------------------------------------- */
 /* HIDP++ 1.0 commands                                                        */
 /* -------------------------------------------------------------------------- */
@@ -321,6 +348,10 @@ static char *hidpp_get_unifying_name(struct hidpp_device *hidpp_dev)
                return NULL;
        memcpy(name, &response.rap.params[2], len);
+        /* include the terminating '\0' */
+        hidpp_prefix_name(&name, len + 1);
        return name;
 }
@@ -498,6 +529,9 @@ static char *hidpp_get_device_name(struct hidpp_device *hidpp)
                index += ret;
        }
+        /* include the terminating '\0' */
+        hidpp_prefix_name(&name, __name_length + 1);
        return name;
 }
@@ -794,18 +828,25 @@ static int wtp_raw_event(struct hid_device *hdev, u8 *data, int size)
        switch (data[0]) {
        case 0x02:
+                if (size < 2) {
+                        hid_err(hdev, "Received HID report of bad size (%d)",
+                                size);
+                        return 1;
+                }
                if (hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS) {
                        input_event(wd->input, EV_KEY, BTN_LEFT,
                                        !!(data[1] & 0x01));
                        input_event(wd->input, EV_KEY, BTN_RIGHT,
                                        !!(data[1] & 0x02));
                        input_sync(wd->input);
+                        return 0;
                } else {
                        if (size < 21)
                                return 1;
                        return wtp_mouse_raw_xy_event(hidpp, &data[7]);
                }
        case REPORT_ID_HIDPP_LONG:
+                /* size is already checked in hidpp_raw_event. */
                if ((report->fap.feature_index != wd->mt_feature_index) ||
                    (report->fap.funcindex_clientid != EVENT_TOUCHPAD_RAW_XY))
                        return 1;
diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
index 1a07e07d99a0..47d7e74231e5 100644
--- a/drivers/hid/hid-roccat-pyra.c
+++ b/drivers/hid/hid-roccat-pyra.c
@@ -35,6 +35,8 @@ static struct class *pyra_class;
 static void profile_activated(struct pyra_device *pyra,
                unsigned int new_profile)
 {
+        if (new_profile >= ARRAY_SIZE(pyra->profile_settings))
+                return;
        pyra->actual_profile = new_profile;
        pyra->actual_cpi = pyra->profile_settings[pyra->actual_profile].y_cpi;
 }
@@ -257,9 +259,11 @@ static ssize_t pyra_sysfs_write_settings(struct file *fp,
        if (off != 0 || count != PYRA_SIZE_SETTINGS)
                return -EINVAL;
-        mutex_lock(&pyra->pyra_lock);
        settings = (struct pyra_settings const *)buf;
+        if (settings->startup_profile >= ARRAY_SIZE(pyra->profile_settings))
+                return -EINVAL;
+        mutex_lock(&pyra->pyra_lock);
        retval = pyra_set_settings(usb_dev, settings);
        if (retval) {
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index d32037cbf9db..d43e967e7533 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -706,12 +706,7 @@ static int i2c_hid_start(struct hid_device *hid)
 static void i2c_hid_stop(struct hid_device *hid)
 {
-        struct i2c_client *client = hid->driver_data;
-        struct i2c_hid *ihid = i2c_get_clientdata(client);
        hid->claimed = 0;
-        i2c_hid_free_buffers(ihid);
 }
 static int i2c_hid_open(struct hid_device *hid)
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index dc89be90b35e..b27b3d33ebab 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -124,6 +124,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 6529c09c46f0..d931cbbed240 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -574,6 +574,16 @@ config SENSORS_IIO_HWMON
          for those channels specified in the map.  This map can be provided
          either via platform data or the device tree bindings.
+config SENSORS_I5500
+        tristate "Intel 5500/5520/X58 temperature sensor"
+        depends on X86 && PCI
+        help
+          If you say yes here you get support for the temperature
+          sensor inside the Intel 5500, 5520 and X58 chipsets.
+          This driver can also be built as a module. If so, the module
+          will be called i5500_temp.
 config SENSORS_CORETEMP
        tristate "Intel Core/Core2/Atom temperature sensor"
        depends on X86
@@ -1379,6 +1389,7 @@ config SENSORS_ADS1015
 config SENSORS_ADS7828
        tristate "Texas Instruments ADS7828 and compatibles"
        depends on I2C
+        select REGMAP_I2C
        help
          If you say yes here you get support for Texas Instruments ADS7828 and
          ADS7830 8-channel A/D converters. ADS7828 resolution is 12-bit, while
@@ -1420,8 +1431,8 @@ config SENSORS_INA2XX
        tristate "Texas Instruments INA219 and compatibles"
        depends on I2C
        help
-          If you say yes here you get support for INA219, INA220, INA226, and
+          If you say yes here you get support for INA219, INA220, INA226,
-          INA230 power monitor chips.
+          INA230, and INA231 power monitor chips.
          The INA2xx driver is configured for the default configuration of
          the part as described in the datasheet.
diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile
index 67280643bcf0..6c941472e707 100644
--- a/drivers/hwmon/Makefile
+++ b/drivers/hwmon/Makefile
@@ -68,6 +68,7 @@ obj-$(CONFIG_SENSORS_GPIO_FAN)	+= gpio-fan.o
 obj-$(CONFIG_SENSORS_HIH6130)   += hih6130.o
 obj-$(CONFIG_SENSORS_HTU21)     += htu21.o
 obj-$(CONFIG_SENSORS_ULTRA45)   += ultra45_env.o
+obj-$(CONFIG_SENSORS_I5500)     += i5500_temp.o
 obj-$(CONFIG_SENSORS_I5K_AMB)   += i5k_amb.o
 obj-$(CONFIG_SENSORS_IBMAEM)    += ibmaem.o
 obj-$(CONFIG_SENSORS_IBMPEX)    += ibmpex.o
diff --git a/drivers/hwmon/abx500.c b/drivers/hwmon/abx500.c
index 13875968c844..6cb89c0ebab6 100644
--- a/drivers/hwmon/abx500.c
+++ b/drivers/hwmon/abx500.c
@@ -221,7 +221,7 @@ static ssize_t show_min(struct device *dev,
        struct abx500_temp *data = dev_get_drvdata(dev);
        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        return sprintf(buf, "%ld\n", data->min[attr->index]);
+        return sprintf(buf, "%lu\n", data->min[attr->index]);
 }
 static ssize_t show_max(struct device *dev,
@@ -230,7 +230,7 @@ static ssize_t show_max(struct device *dev,
        struct abx500_temp *data = dev_get_drvdata(dev);
        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        return sprintf(buf, "%ld\n", data->max[attr->index]);
+        return sprintf(buf, "%lu\n", data->max[attr->index]);
 }
 static ssize_t show_max_hyst(struct device *dev,
@@ -239,7 +239,7 @@ static ssize_t show_max_hyst(struct device *dev,
        struct abx500_temp *data = dev_get_drvdata(dev);
        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        return sprintf(buf, "%ld\n", data->max_hyst[attr->index]);
+        return sprintf(buf, "%lu\n", data->max_hyst[attr->index]);
 }
 static ssize_t show_min_alarm(struct device *dev,
diff --git a/drivers/hwmon/ad7314.c b/drivers/hwmon/ad7314.c
index f4f9b219bf16..11955467fc0f 100644
--- a/drivers/hwmon/ad7314.c
+++ b/drivers/hwmon/ad7314.c
@@ -16,6 +16,7 @@
 #include <linux/err.h>
 #include <linux/hwmon.h>
 #include <linux/hwmon-sysfs.h>
+#include <linux/bitops.h>
 /*
 * AD7314 temperature masks
@@ -67,7 +68,7 @@ static ssize_t ad7314_show_temperature(struct device *dev,
        switch (spi_get_device_id(chip->spi_dev)->driver_data) {
        case ad7314:
                data = (ret & AD7314_TEMP_MASK) >> AD7314_TEMP_SHIFT;
-                data = (data << 6) >> 6;
+                data = sign_extend32(data, 9);
                return sprintf(buf, "%d\n", 250 * data);
        case adt7301:
@@ -78,7 +79,7 @@ static ssize_t ad7314_show_temperature(struct device *dev,
                 * register.  1lsb - 31.25 milli degrees centigrade
                 */
                data = ret & ADT7301_TEMP_MASK;
-                data = (data << 2) >> 2;
+                data = sign_extend32(data, 13);
                return sprintf(buf, "%d\n",
                               DIV_ROUND_CLOSEST(data * 3125, 100));
diff --git a/drivers/hwmon/adc128d818.c b/drivers/hwmon/adc128d818.c
index 0625e50d7a6e..ad2b47e40345 100644
--- a/drivers/hwmon/adc128d818.c
+++ b/drivers/hwmon/adc128d818.c
@@ -27,6 +27,7 @@
 #include <linux/err.h>
 #include <linux/regulator/consumer.h>
 #include <linux/mutex.h>
+#include <linux/bitops.h>
 /* Addresses to scan
 * The chip also supports addresses 0x35..0x37. Don't scan those addresses
@@ -189,7 +190,7 @@ static ssize_t adc128_show_temp(struct device *dev,
        if (IS_ERR(data))
                return PTR_ERR(data);
-        temp = (data->temp[index] << 7) >> 7;   /* sign extend */
+        temp = sign_extend32(data->temp[index], 8);
        return sprintf(buf, "%d\n", temp * 500);/* 0.5 degrees C resolution */
 }
diff --git a/drivers/hwmon/ads7828.c b/drivers/hwmon/ads7828.c
index a622d40eec17..bce4e9ff21bf 100644
--- a/drivers/hwmon/ads7828.c
+++ b/drivers/hwmon/ads7828.c
@@ -30,14 +30,12 @@
 #include <linux/hwmon-sysfs.h>
 #include <linux/i2c.h>
 #include <linux/init.h>
-#include <linux/jiffies.h>
 #include <linux/module.h>
-#include <linux/mutex.h>
 #include <linux/platform_data/ads7828.h>
+#include <linux/regmap.h>
 #include <linux/slab.h>
 /* The ADS7828 registers */
-#define ADS7828_NCH             8       /* 8 channels supported */
 #define ADS7828_CMD_SD_SE       0x80    /* Single ended inputs */
 #define ADS7828_CMD_PD1         0x04    /* Internal vref OFF && A/D ON */
 #define ADS7828_CMD_PD3         0x0C    /* Internal vref ON && A/D ON */
@@ -50,17 +48,9 @@ enum ads7828_chips { ads7828, ads7830 };
 /* Client specific data */
 struct ads7828_data {
-        struct i2c_client *client;
+        struct regmap *regmap;
-        struct mutex update_lock;       /* Mutex protecting updates */
-        unsigned long last_updated;     /* Last updated time (in jiffies) */
-        u16 adc_input[ADS7828_NCH];     /* ADS7828_NCH samples */
-        bool valid;                     /* Validity flag */
-        bool diff_input;                /* Differential input */
-        bool ext_vref;                  /* External voltage reference */
-        unsigned int vref_mv;           /* voltage reference value */
        u8 cmd_byte;                    /* Command byte without channel bits */
        unsigned int lsb_resol;         /* Resolution of the ADC sample LSB */
-        s32 (*read_channel)(const struct i2c_client *client, u8 command);
 };
 /* Command byte C2,C1,C0 - see datasheet */
@@ -69,42 +59,22 @@ static inline u8 ads7828_cmd_byte(u8 cmd, int ch)
        return cmd | (((ch >> 1) | (ch & 0x01) << 2) << 4);
 }
-/* Update data for the device (all 8 channels) */
-static struct ads7828_data *ads7828_update_device(struct device *dev)
-{
-        struct ads7828_data *data = dev_get_drvdata(dev);
-        struct i2c_client *client = data->client;
-        mutex_lock(&data->update_lock);
-        if (time_after(jiffies, data->last_updated + HZ + HZ / 2)
-                        || !data->valid) {
-                unsigned int ch;
-                dev_dbg(&client->dev, "Starting ads7828 update\n");
-                for (ch = 0; ch < ADS7828_NCH; ch++) {
-                        u8 cmd = ads7828_cmd_byte(data->cmd_byte, ch);
-                        data->adc_input[ch] = data->read_channel(client, cmd);
-                }
-                data->last_updated = jiffies;
-                data->valid = true;
-        }
-        mutex_unlock(&data->update_lock);
-        return data;
-}
 /* sysfs callback function */
 static ssize_t ads7828_show_in(struct device *dev, struct device_attribute *da,
                               char *buf)
 {
        struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
-        struct ads7828_data *data = ads7828_update_device(dev);
+        struct ads7828_data *data = dev_get_drvdata(dev);
-        unsigned int value = DIV_ROUND_CLOSEST(data->adc_input[attr->index] *
+        u8 cmd = ads7828_cmd_byte(data->cmd_byte, attr->index);
-                                               data->lsb_resol, 1000);
+        unsigned int regval;
+        int err;
-        return sprintf(buf, "%d\n", value);
+        err = regmap_read(data->regmap, cmd, &regval);
+        if (err < 0)
+                return err;
+        return sprintf(buf, "%d\n",
+                       DIV_ROUND_CLOSEST(regval * data->lsb_resol, 1000));
 }
 static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, ads7828_show_in, NULL, 0);
@@ -130,6 +100,16 @@ static struct attribute *ads7828_attrs[] = {
 ATTRIBUTE_GROUPS(ads7828);
+static const struct regmap_config ads2828_regmap_config = {
+        .reg_bits = 8,
+        .val_bits = 16,
+};
+static const struct regmap_config ads2830_regmap_config = {
+        .reg_bits = 8,
+        .val_bits = 8,
+};
 static int ads7828_probe(struct i2c_client *client,
                         const struct i2c_device_id *id)
 {
@@ -137,42 +117,40 @@ static int ads7828_probe(struct i2c_client *client,
        struct ads7828_platform_data *pdata = dev_get_platdata(dev);
        struct ads7828_data *data;
        struct device *hwmon_dev;
+        unsigned int vref_mv = ADS7828_INT_VREF_MV;
+        bool diff_input = false;
+        bool ext_vref = false;
        data = devm_kzalloc(dev, sizeof(struct ads7828_data), GFP_KERNEL);
        if (!data)
                return -ENOMEM;
        if (pdata) {
-                data->diff_input = pdata->diff_input;
+                diff_input = pdata->diff_input;
-                data->ext_vref = pdata->ext_vref;
+                ext_vref = pdata->ext_vref;
-                if (data->ext_vref)
+                if (ext_vref && pdata->vref_mv)
-                        data->vref_mv = pdata->vref_mv;
+                        vref_mv = pdata->vref_mv;
        }
-        /* Bound Vref with min/max values if it was provided */
+        /* Bound Vref with min/max values */
-        if (data->vref_mv)
+        vref_mv = clamp_val(vref_mv, ADS7828_EXT_VREF_MV_MIN,
-                data->vref_mv = clamp_val(data->vref_mv,
+                            ADS7828_EXT_VREF_MV_MAX);
-                                          ADS7828_EXT_VREF_MV_MIN,
-                                          ADS7828_EXT_VREF_MV_MAX);
-        else
-                data->vref_mv = ADS7828_INT_VREF_MV;
        /* ADS7828 uses 12-bit samples, while ADS7830 is 8-bit */
        if (id->driver_data == ads7828) {
-                data->lsb_resol = DIV_ROUND_CLOSEST(data->vref_mv * 1000, 4096);
+                data->lsb_resol = DIV_ROUND_CLOSEST(vref_mv * 1000, 4096);
-                data->read_channel = i2c_smbus_read_word_swapped;
+                data->regmap = devm_regmap_init_i2c(client,
+                                                    &ads2828_regmap_config);
        } else {
-                data->lsb_resol = DIV_ROUND_CLOSEST(data->vref_mv * 1000, 256);
+                data->lsb_resol = DIV_ROUND_CLOSEST(vref_mv * 1000, 256);
-                data->read_channel = i2c_smbus_read_byte_data;
+                data->regmap = devm_regmap_init_i2c(client,
+                                                    &ads2830_regmap_config);
        }
-        data->cmd_byte = data->ext_vref ? ADS7828_CMD_PD1 : ADS7828_CMD_PD3;
+        data->cmd_byte = ext_vref ? ADS7828_CMD_PD1 : ADS7828_CMD_PD3;
-        if (!data->diff_input)
+        if (!diff_input)
                data->cmd_byte |= ADS7828_CMD_SD_SE;
-        data->client = client;
-        mutex_init(&data->update_lock);
        hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
                                                           data,
                                                           ads7828_groups);
diff --git a/drivers/hwmon/i5500_temp.c b/drivers/hwmon/i5500_temp.c
new file mode 100644
index 000000000000..3e3ccbf18b4e
--- /dev/null
+++ b/drivers/hwmon/i5500_temp.c
@@ -0,0 +1,149 @@
+/*
+ * i5500_temp - Driver for Intel 5500/5520/X58 chipset thermal sensor
+ *
+ * Copyright (C) 2012, 2014 Jean Delvare <jdelvare@suse.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/jiffies.h>
+#include <linux/device.h>
+#include <linux/pci.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/err.h>
+#include <linux/mutex.h>
+/* Register definitions from datasheet */
+#define REG_TSTHRCATA   0xE2
+#define REG_TSCTRL      0xE8
+#define REG_TSTHRRPEX   0xEB
+#define REG_TSTHRLO     0xEC
+#define REG_TSTHRHI     0xEE
+#define REG_CTHINT      0xF0
+#define REG_TSFSC       0xF3
+#define REG_CTSTS       0xF4
+#define REG_TSTHRRQPI   0xF5
+#define REG_CTCTRL      0xF7
+#define REG_TSTIMER     0xF8
+/*
+ * Sysfs stuff
+ */
+/* Sensor resolution : 0.5 degree C */
+static ssize_t show_temp(struct device *dev,
+                         struct device_attribute *devattr, char *buf)
+{
+        struct pci_dev *pdev = to_pci_dev(dev->parent);
+        long temp;
+        u16 tsthrhi;
+        s8 tsfsc;
+        pci_read_config_word(pdev, REG_TSTHRHI, &tsthrhi);
+        pci_read_config_byte(pdev, REG_TSFSC, &tsfsc);
+        temp = ((long)tsthrhi - tsfsc) * 500;
+        return sprintf(buf, "%ld\n", temp);
+}
+static ssize_t show_thresh(struct device *dev,
+                           struct device_attribute *devattr, char *buf)
+{
+        struct pci_dev *pdev = to_pci_dev(dev->parent);
+        int reg = to_sensor_dev_attr(devattr)->index;
+        long temp;
+        u16 tsthr;
+        pci_read_config_word(pdev, reg, &tsthr);
+        temp = tsthr * 500;
+        return sprintf(buf, "%ld\n", temp);
+}
+static ssize_t show_alarm(struct device *dev,
+                          struct device_attribute *devattr, char *buf)
+{
+        struct pci_dev *pdev = to_pci_dev(dev->parent);
+        int nr = to_sensor_dev_attr(devattr)->index;
+        u8 ctsts;
+        pci_read_config_byte(pdev, REG_CTSTS, &ctsts);
+        return sprintf(buf, "%u\n", (unsigned int)ctsts & (1 << nr));
+}
+static DEVICE_ATTR(temp1_input, S_IRUGO, show_temp, NULL);
+static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, show_thresh, NULL, 0xE2);
+static SENSOR_DEVICE_ATTR(temp1_max_hyst, S_IRUGO, show_thresh, NULL, 0xEC);
+static SENSOR_DEVICE_ATTR(temp1_max, S_IRUGO, show_thresh, NULL, 0xEE);
+static SENSOR_DEVICE_ATTR(temp1_crit_alarm, S_IRUGO, show_alarm, NULL, 0);
+static SENSOR_DEVICE_ATTR(temp1_max_alarm, S_IRUGO, show_alarm, NULL, 1);
+static struct attribute *i5500_temp_attrs[] = {
+        &dev_attr_temp1_input.attr,
+        &sensor_dev_attr_temp1_crit.dev_attr.attr,
+        &sensor_dev_attr_temp1_max_hyst.dev_attr.attr,
+        &sensor_dev_attr_temp1_max.dev_attr.attr,
+        &sensor_dev_attr_temp1_crit_alarm.dev_attr.attr,
+        &sensor_dev_attr_temp1_max_alarm.dev_attr.attr,
+        NULL
+};
+ATTRIBUTE_GROUPS(i5500_temp);
+static const struct pci_device_id i5500_temp_ids[] = {
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x3438) },
+        { 0 },
+};
+MODULE_DEVICE_TABLE(pci, i5500_temp_ids);
+static int i5500_temp_probe(struct pci_dev *pdev,
+                            const struct pci_device_id *id)
+{
+        int err;
+        struct device *hwmon_dev;
+        u32 tstimer;
+        s8 tsfsc;
+        err = pci_enable_device(pdev);
+        if (err) {
+                dev_err(&pdev->dev, "Failed to enable device\n");
+                return err;
+        }
+        pci_read_config_byte(pdev, REG_TSFSC, &tsfsc);
+        pci_read_config_dword(pdev, REG_TSTIMER, &tstimer);
+        if (tsfsc == 0x7F && tstimer == 0x07D30D40) {
+                dev_notice(&pdev->dev, "Sensor seems to be disabled\n");
+                return -ENODEV;
+        }
+        hwmon_dev = devm_hwmon_device_register_with_groups(&pdev->dev,
+                                                           "intel5500", NULL,
+                                                           i5500_temp_groups);
+        return PTR_ERR_OR_ZERO(hwmon_dev);
+}
+static struct pci_driver i5500_temp_driver = {
+        .name = "i5500_temp",
+        .id_table = i5500_temp_ids,
+        .probe = i5500_temp_probe,
+};
+module_pci_driver(i5500_temp_driver);
+MODULE_AUTHOR("Jean Delvare <jdelvare@suse.de>");
+MODULE_DESCRIPTION("Intel 5500/5520/X58 chipset thermal sensor driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
index e01feba909c3..d1542b7d4bc3 100644
--- a/drivers/hwmon/ina2xx.c
+++ b/drivers/hwmon/ina2xx.c
@@ -35,6 +35,7 @@
 #include <linux/hwmon-sysfs.h>
 #include <linux/jiffies.h>
 #include <linux/of.h>
+#include <linux/delay.h>
 #include <linux/platform_data/ina2xx.h>
@@ -51,7 +52,6 @@
 #define INA226_ALERT_LIMIT              0x07
 #define INA226_DIE_ID                   0xFF
 /* register count */
 #define INA219_REGISTERS                6
 #define INA226_REGISTERS                8
@@ -64,6 +64,24 @@
 /* worst case is 68.10 ms (~14.6Hz, ina219) */
 #define INA2XX_CONVERSION_RATE          15
+#define INA2XX_MAX_DELAY                69 /* worst case delay in ms */
+#define INA2XX_RSHUNT_DEFAULT           10000
+/* bit mask for reading the averaging setting in the configuration register */
+#define INA226_AVG_RD_MASK              0x0E00
+#define INA226_READ_AVG(reg)            (((reg) & INA226_AVG_RD_MASK) >> 9)
+#define INA226_SHIFT_AVG(val)           ((val) << 9)
+/* common attrs, ina226 attrs and NULL */
+#define INA2XX_MAX_ATTRIBUTE_GROUPS     3
+/*
+ * Both bus voltage and shunt voltage conversion times for ina226 are set
+ * to 0b0100 on POR, which translates to 2200 microseconds in total.
+ */
+#define INA226_TOTAL_CONV_TIME_DEFAULT  2200
 enum ina2xx_ids { ina219, ina226 };
@@ -81,11 +99,16 @@ struct ina2xx_data {
        struct i2c_client *client;
        const struct ina2xx_config *config;
+        long rshunt;
+        u16 curr_config;
        struct mutex update_lock;
        bool valid;
        unsigned long last_updated;
+        int update_interval; /* in jiffies */
        int kind;
+        const struct attribute_group *groups[INA2XX_MAX_ATTRIBUTE_GROUPS];
        u16 regs[INA2XX_MAX_REGISTERS];
 };
@@ -110,34 +133,156 @@ static const struct ina2xx_config ina2xx_config[] = {
        },
 };
-static struct ina2xx_data *ina2xx_update_device(struct device *dev)
+/*
+ * Available averaging rates for ina226. The indices correspond with
+ * the bit values expected by the chip (according to the ina226 datasheet,
+ * table 3 AVG bit settings, found at
+ * http://www.ti.com/lit/ds/symlink/ina226.pdf.
+ */
+static const int ina226_avg_tab[] = { 1, 4, 16, 64, 128, 256, 512, 1024 };
+static int ina226_avg_bits(int avg)
+{
+        int i;
+        /* Get the closest average from the tab. */
+        for (i = 0; i < ARRAY_SIZE(ina226_avg_tab) - 1; i++) {
+                if (avg <= (ina226_avg_tab[i] + ina226_avg_tab[i + 1]) / 2)
+                        break;
+        }
+        return i; /* Return 0b0111 for values greater than 1024. */
+}
+static int ina226_reg_to_interval(u16 config)
+{
+        int avg = ina226_avg_tab[INA226_READ_AVG(config)];
+        /*
+         * Multiply the total conversion time by the number of averages.
+         * Return the result in milliseconds.
+         */
+        return DIV_ROUND_CLOSEST(avg * INA226_TOTAL_CONV_TIME_DEFAULT, 1000);
+}
+static u16 ina226_interval_to_reg(int interval, u16 config)
+{
+        int avg, avg_bits;
+        avg = DIV_ROUND_CLOSEST(interval * 1000,
+                                INA226_TOTAL_CONV_TIME_DEFAULT);
+        avg_bits = ina226_avg_bits(avg);
+        return (config & ~INA226_AVG_RD_MASK) | INA226_SHIFT_AVG(avg_bits);
+}
+static void ina226_set_update_interval(struct ina2xx_data *data)
+{
+        int ms;
+        ms = ina226_reg_to_interval(data->curr_config);
+        data->update_interval = msecs_to_jiffies(ms);
+}
+static int ina2xx_calibrate(struct ina2xx_data *data)
+{
+        u16 val = DIV_ROUND_CLOSEST(data->config->calibration_factor,
+                                    data->rshunt);
+        return i2c_smbus_write_word_swapped(data->client,
+                                            INA2XX_CALIBRATION, val);
+}
+/*
+ * Initialize the configuration and calibration registers.
+ */
+static int ina2xx_init(struct ina2xx_data *data)
 {
-        struct ina2xx_data *data = dev_get_drvdata(dev);
        struct i2c_client *client = data->client;
-        struct ina2xx_data *ret = data;
+        int ret;
-        mutex_lock(&data->update_lock);
+        /* device configuration */
+        ret = i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
+                                           data->curr_config);
+        if (ret < 0)
+                return ret;
-        if (time_after(jiffies, data->last_updated +
+        /*
-                       HZ / INA2XX_CONVERSION_RATE) || !data->valid) {
+         * Set current LSB to 1mA, shunt is in uOhms
+         * (equation 13 in datasheet).
+         */
+        return ina2xx_calibrate(data);
+}
-                int i;
+static int ina2xx_do_update(struct device *dev)
+{
+        struct ina2xx_data *data = dev_get_drvdata(dev);
+        struct i2c_client *client = data->client;
+        int i, rv, retry;
-                dev_dbg(&client->dev, "Starting ina2xx update\n");
+        dev_dbg(&client->dev, "Starting ina2xx update\n");
+        for (retry = 5; retry; retry--) {
                /* Read all registers */
                for (i = 0; i < data->config->registers; i++) {
-                        int rv = i2c_smbus_read_word_swapped(client, i);
+                        rv = i2c_smbus_read_word_swapped(client, i);
-                        if (rv < 0) {
+                        if (rv < 0)
-                                ret = ERR_PTR(rv);
+                                return rv;
-                                goto abort;
-                        }
                        data->regs[i] = rv;
                }
+                /*
+                 * If the current value in the calibration register is 0, the
+                 * power and current registers will also remain at 0. In case
+                 * the chip has been reset let's check the calibration
+                 * register and reinitialize if needed.
+                 */
+                if (data->regs[INA2XX_CALIBRATION] == 0) {
+                        dev_warn(dev, "chip not calibrated, reinitializing\n");
+                        rv = ina2xx_init(data);
+                        if (rv < 0)
+                                return rv;
+                        /*
+                         * Let's make sure the power and current registers
+                         * have been updated before trying again.
+                         */
+                        msleep(INA2XX_MAX_DELAY);
+                        continue;
+                }
                data->last_updated = jiffies;
                data->valid = 1;
+                return 0;
        }
-abort:
+        /*
+         * If we're here then although all write operations succeeded, the
+         * chip still returns 0 in the calibration register. Nothing more we
+         * can do here.
+         */
+        dev_err(dev, "unable to reinitialize the chip\n");
+        return -ENODEV;
+}
+static struct ina2xx_data *ina2xx_update_device(struct device *dev)
+{
+        struct ina2xx_data *data = dev_get_drvdata(dev);
+        struct ina2xx_data *ret = data;
+        unsigned long after;
+        int rv;
+        mutex_lock(&data->update_lock);
+        after = data->last_updated + data->update_interval;
+        if (time_after(jiffies, after) || !data->valid) {
+                rv = ina2xx_do_update(dev);
+                if (rv < 0)
+                        ret = ERR_PTR(rv);
+        }
        mutex_unlock(&data->update_lock);
        return ret;
 }
@@ -164,6 +309,10 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg)
                /* signed register, LSB=1mA (selected), in mA */
                val = (s16)data->regs[reg];
                break;
+        case INA2XX_CALIBRATION:
+                val = DIV_ROUND_CLOSEST(data->config->calibration_factor,
+                                        data->regs[reg]);
+                break;
        default:
                /* programmer goofed */
                WARN_ON_ONCE(1);
@@ -187,6 +336,85 @@ static ssize_t ina2xx_show_value(struct device *dev,
                        ina2xx_get_value(data, attr->index));
 }
+static ssize_t ina2xx_set_shunt(struct device *dev,
+                                struct device_attribute *da,
+                                const char *buf, size_t count)
+{
+        struct ina2xx_data *data = ina2xx_update_device(dev);
+        unsigned long val;
+        int status;
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+        status = kstrtoul(buf, 10, &val);
+        if (status < 0)
+                return status;
+        if (val == 0 ||
+            /* Values greater than the calibration factor make no sense. */
+            val > data->config->calibration_factor)
+                return -EINVAL;
+        mutex_lock(&data->update_lock);
+        data->rshunt = val;
+        status = ina2xx_calibrate(data);
+        mutex_unlock(&data->update_lock);
+        if (status < 0)
+                return status;
+        return count;
+}
+static ssize_t ina226_set_interval(struct device *dev,
+                                   struct device_attribute *da,
+                                   const char *buf, size_t count)
+{
+        struct ina2xx_data *data = dev_get_drvdata(dev);
+        unsigned long val;
+        int status;
+        status = kstrtoul(buf, 10, &val);
+        if (status < 0)
+                return status;
+        if (val > INT_MAX || val == 0)
+                return -EINVAL;
+        mutex_lock(&data->update_lock);
+        data->curr_config = ina226_interval_to_reg(val,
+                                                   data->regs[INA2XX_CONFIG]);
+        status = i2c_smbus_write_word_swapped(data->client,
+                                              INA2XX_CONFIG,
+                                              data->curr_config);
+        ina226_set_update_interval(data);
+        /* Make sure the next access re-reads all registers. */
+        data->valid = 0;
+        mutex_unlock(&data->update_lock);
+        if (status < 0)
+                return status;
+        return count;
+}
+static ssize_t ina226_show_interval(struct device *dev,
+                                    struct device_attribute *da, char *buf)
+{
+        struct ina2xx_data *data = ina2xx_update_device(dev);
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+        /*
+         * We don't use data->update_interval here as we want to display
+         * the actual interval used by the chip and jiffies_to_msecs()
+         * doesn't seem to be accurate enough.
+         */
+        return snprintf(buf, PAGE_SIZE, "%d\n",
+                        ina226_reg_to_interval(data->regs[INA2XX_CONFIG]));
+}
 /* shunt voltage */
 static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, ina2xx_show_value, NULL,
                          INA2XX_SHUNT_VOLTAGE);
@@ -203,15 +431,37 @@ static SENSOR_DEVICE_ATTR(curr1_input, S_IRUGO, ina2xx_show_value, NULL,
 static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL,
                          INA2XX_POWER);
+/* shunt resistance */
+static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR,
+                          ina2xx_show_value, ina2xx_set_shunt,
+                          INA2XX_CALIBRATION);
+/* update interval (ina226 only) */
+static SENSOR_DEVICE_ATTR(update_interval, S_IRUGO | S_IWUSR,
+                          ina226_show_interval, ina226_set_interval, 0);
 /* pointers to created device attributes */
 static struct attribute *ina2xx_attrs[] = {
        &sensor_dev_attr_in0_input.dev_attr.attr,
        &sensor_dev_attr_in1_input.dev_attr.attr,
        &sensor_dev_attr_curr1_input.dev_attr.attr,
        &sensor_dev_attr_power1_input.dev_attr.attr,
+        &sensor_dev_attr_shunt_resistor.dev_attr.attr,
        NULL,
 };
-ATTRIBUTE_GROUPS(ina2xx);
+static const struct attribute_group ina2xx_group = {
+        .attrs = ina2xx_attrs,
+};
+static struct attribute *ina226_attrs[] = {
+        &sensor_dev_attr_update_interval.dev_attr.attr,
+        NULL,
+};
+static const struct attribute_group ina226_group = {
+        .attrs = ina226_attrs,
+};
 static int ina2xx_probe(struct i2c_client *client,
                        const struct i2c_device_id *id)
@@ -221,9 +471,8 @@ static int ina2xx_probe(struct i2c_client *client,
        struct device *dev = &client->dev;
        struct ina2xx_data *data;
        struct device *hwmon_dev;
-        long shunt = 10000; /* default shunt value 10mOhms */
        u32 val;
-        int ret;
+        int ret, group = 0;
        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_WORD_DATA))
                return -ENODEV;
@@ -234,50 +483,52 @@ static int ina2xx_probe(struct i2c_client *client,
        if (dev_get_platdata(dev)) {
                pdata = dev_get_platdata(dev);
-                shunt = pdata->shunt_uohms;
+                data->rshunt = pdata->shunt_uohms;
        } else if (!of_property_read_u32(dev->of_node,
                                         "shunt-resistor", &val)) {
-                shunt = val;
+                data->rshunt = val;
+        } else {
+                data->rshunt = INA2XX_RSHUNT_DEFAULT;
        }
-        if (shunt <= 0)
-                return -ENODEV;
        /* set the device type */
        data->kind = id->driver_data;
        data->config = &ina2xx_config[data->kind];
+        data->curr_config = data->config->config_default;
-        /* device configuration */
+        data->client = client;
-        ret = i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
-                                           data->config->config_default);
-        if (ret < 0) {
-                dev_err(dev,
-                        "error writing to the config register: %d", ret);
-                return -ENODEV;
-        }
        /*
-         * Set current LSB to 1mA, shunt is in uOhms
+         * Ina226 has a variable update_interval. For ina219 we
-         * (equation 13 in datasheet).
+         * use a constant value.
         */
-        ret = i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
+        if (data->kind == ina226)
-                                data->config->calibration_factor / shunt);
+                ina226_set_update_interval(data);
+        else
+                data->update_interval = HZ / INA2XX_CONVERSION_RATE;
+        if (data->rshunt <= 0 ||
+            data->rshunt > data->config->calibration_factor)
+                return -ENODEV;
+        ret = ina2xx_init(data);
        if (ret < 0) {
-                dev_err(dev,
+                dev_err(dev, "error configuring the device: %d\n", ret);
-                        "error writing to the calibration register: %d", ret);
                return -ENODEV;
        }
-        data->client = client;
        mutex_init(&data->update_lock);
+        data->groups[group++] = &ina2xx_group;
+        if (data->kind == ina226)
+                data->groups[group++] = &ina226_group;
        hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
-                                                           data, ina2xx_groups);
+                                                           data, data->groups);
        if (IS_ERR(hwmon_dev))
                return PTR_ERR(hwmon_dev);
        dev_info(dev, "power monitor %s (Rshunt = %li uOhm)\n",
-                 id->name, shunt);
+                 id->name, data->rshunt);
        return 0;
 }
@@ -287,6 +538,7 @@ static const struct i2c_device_id ina2xx_id[] = {
        { "ina220", ina219 },
        { "ina226", ina226 },
        { "ina230", ina226 },
+        { "ina231", ina226 },
        { }
 };
 MODULE_DEVICE_TABLE(i2c, ina2xx_id);
diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
index 388f8bcd898e..996bdfd5cf25 100644
--- a/drivers/hwmon/jc42.c
+++ b/drivers/hwmon/jc42.c
@@ -201,7 +201,7 @@ struct jc42_data {
 #define JC42_TEMP_MIN           0
 #define JC42_TEMP_MAX           125000
-static u16 jc42_temp_to_reg(int temp, bool extended)
+static u16 jc42_temp_to_reg(long temp, bool extended)
 {
        int ntemp = clamp_val(temp,
                              extended ? JC42_TEMP_MIN_EXTENDED :
@@ -213,11 +213,7 @@ static u16 jc42_temp_to_reg(int temp, bool extended)
 static int jc42_temp_from_reg(s16 reg)
 {
-        reg &= 0x1fff;
+        reg = sign_extend32(reg, 12);
-        /* sign extend register */
-        if (reg & 0x1000)
-                reg |= 0xf000;
        /* convert from 0.0625 to 0.001 resolution */
        return reg * 125 / 2;
@@ -308,15 +304,18 @@ static ssize_t set_temp_crit_hyst(struct device *dev,
                                  const char *buf, size_t count)
 {
        struct jc42_data *data = dev_get_drvdata(dev);
-        unsigned long val;
+        long val;
        int diff, hyst;
        int err;
        int ret = count;
-        if (kstrtoul(buf, 10, &val) < 0)
+        if (kstrtol(buf, 10, &val) < 0)
                return -EINVAL;
+        val = clamp_val(val, (data->extended ? JC42_TEMP_MIN_EXTENDED :
+                              JC42_TEMP_MIN) - 6000, JC42_TEMP_MAX);
        diff = jc42_temp_from_reg(data->temp[t_crit]) - val;
        hyst = 0;
        if (diff > 0) {
                if (diff < 2250)
diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
index ec5678289e4a..55765790907b 100644
--- a/drivers/hwmon/nct7802.c
+++ b/drivers/hwmon/nct7802.c
@@ -779,7 +779,7 @@ static bool nct7802_regmap_is_volatile(struct device *dev, unsigned int reg)
        return reg != REG_BANK && reg <= 0x20;
 }
-static struct regmap_config nct7802_regmap_config = {
+static const struct regmap_config nct7802_regmap_config = {
        .reg_bits = 8,
        .val_bits = 8,
        .cache_type = REGCACHE_RBTREE,
diff --git a/drivers/hwmon/tmp102.c b/drivers/hwmon/tmp102.c
index ba9f478f64ee..9da2735f1424 100644
--- a/drivers/hwmon/tmp102.c
+++ b/drivers/hwmon/tmp102.c
@@ -253,7 +253,7 @@ static int tmp102_remove(struct i2c_client *client)
        return 0;
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int tmp102_suspend(struct device *dev)
 {
        struct i2c_client *client = to_i2c_client(dev);
@@ -279,17 +279,10 @@ static int tmp102_resume(struct device *dev)
        config &= ~TMP102_CONF_SD;
        return i2c_smbus_write_word_swapped(client, TMP102_CONF_REG, config);
 }
-static const struct dev_pm_ops tmp102_dev_pm_ops = {
-        .suspend        = tmp102_suspend,
-        .resume         = tmp102_resume,
-};
-#define TMP102_DEV_PM_OPS (&tmp102_dev_pm_ops)
-#else
-#define TMP102_DEV_PM_OPS NULL
 #endif /* CONFIG_PM */
+static SIMPLE_DEV_PM_OPS(tmp102_dev_pm_ops, tmp102_suspend, tmp102_resume);
 static const struct i2c_device_id tmp102_id[] = {
        { "tmp102", 0 },
        { }
@@ -298,7 +291,7 @@ MODULE_DEVICE_TABLE(i2c, tmp102_id);
 static struct i2c_driver tmp102_driver = {
        .driver.name    = DRIVER_NAME,
-        .driver.pm      = TMP102_DEV_PM_OPS,
+        .driver.pm      = &tmp102_dev_pm_ops,
        .probe          = tmp102_probe,
        .remove         = tmp102_remove,
        .id_table       = tmp102_id,
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 31e8308ba899..ab838d9e28b6 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -881,6 +881,7 @@ config I2C_XLR
 config I2C_RCAR
        tristate "Renesas R-Car I2C Controller"
        depends on ARCH_SHMOBILE || COMPILE_TEST
+        select I2C_SLAVE
        help
          If you say yes to this option, support will be included for the
          R-Car I2C controller.
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index bff20a589621..958c8db4ec30 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -785,14 +785,16 @@ static int s3c24xx_i2c_xfer(struct i2c_adapter *adap,
        int ret;
        pm_runtime_get_sync(&adap->dev);
-        clk_prepare_enable(i2c->clk);
+        ret = clk_enable(i2c->clk);
+        if (ret)
+                return ret;
        for (retry = 0; retry < adap->retries; retry++) {
                ret = s3c24xx_i2c_doxfer(i2c, msgs, num);
                if (ret != -EAGAIN) {
-                        clk_disable_unprepare(i2c->clk);
+                        clk_disable(i2c->clk);
                        pm_runtime_put(&adap->dev);
                        return ret;
                }
@@ -802,7 +804,7 @@ static int s3c24xx_i2c_xfer(struct i2c_adapter *adap,
                udelay(100);
        }
-        clk_disable_unprepare(i2c->clk);
+        clk_disable(i2c->clk);
        pm_runtime_put(&adap->dev);
        return -EREMOTEIO;
 }
@@ -1197,7 +1199,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
        clk_prepare_enable(i2c->clk);
        ret = s3c24xx_i2c_init(i2c);
-        clk_disable_unprepare(i2c->clk);
+        clk_disable(i2c->clk);
        if (ret != 0) {
                dev_err(&pdev->dev, "I2C controller init failed\n");
                return ret;
@@ -1210,6 +1212,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
                i2c->irq = ret = platform_get_irq(pdev, 0);
                if (ret <= 0) {
                        dev_err(&pdev->dev, "cannot find IRQ\n");
+                        clk_unprepare(i2c->clk);
                        return ret;
                }
@@ -1218,6 +1221,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
                if (ret != 0) {
                        dev_err(&pdev->dev, "cannot claim IRQ %d\n", i2c->irq);
+                        clk_unprepare(i2c->clk);
                        return ret;
                }
        }
@@ -1225,6 +1229,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
        ret = s3c24xx_i2c_register_cpufreq(i2c);
        if (ret < 0) {
                dev_err(&pdev->dev, "failed to register cpufreq notifier\n");
+                clk_unprepare(i2c->clk);
                return ret;
        }
@@ -1241,6 +1246,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
        if (ret < 0) {
                dev_err(&pdev->dev, "failed to add bus to i2c core\n");
                s3c24xx_i2c_deregister_cpufreq(i2c);
+                clk_unprepare(i2c->clk);
                return ret;
        }
@@ -1262,6 +1268,8 @@ static int s3c24xx_i2c_remove(struct platform_device *pdev)
 {
        struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
+        clk_unprepare(i2c->clk);
        pm_runtime_disable(&i2c->adap.dev);
        pm_runtime_disable(&pdev->dev);
@@ -1293,13 +1301,16 @@ static int s3c24xx_i2c_resume_noirq(struct device *dev)
 {
        struct platform_device *pdev = to_platform_device(dev);
        struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
+        int ret;
        if (!IS_ERR(i2c->sysreg))
                regmap_write(i2c->sysreg, EXYNOS5_SYS_I2C_CFG, i2c->sys_i2c_cfg);
-        clk_prepare_enable(i2c->clk);
+        ret = clk_enable(i2c->clk);
+        if (ret)
+                return ret;
        s3c24xx_i2c_init(i2c);
-        clk_disable_unprepare(i2c->clk);
+        clk_disable(i2c->clk);
        i2c->suspended = 0;
        return 0;
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 440d5dbc8b5f..007818b3e174 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -139,6 +139,7 @@ struct sh_mobile_i2c_data {
        int pos;
        int sr;
        bool send_stop;
+        bool stop_after_dma;
        struct resource *res;
        struct dma_chan *dma_tx;
@@ -407,7 +408,7 @@ static int sh_mobile_i2c_isr_tx(struct sh_mobile_i2c_data *pd)
        if (pd->pos == pd->msg->len) {
                /* Send stop if we haven't yet (DMA case) */
-                if (pd->send_stop && (iic_rd(pd, ICCR) & ICCR_BBSY))
+                if (pd->send_stop && pd->stop_after_dma)
                        i2c_op(pd, OP_TX_STOP, 0);
                return 1;
        }
@@ -449,6 +450,13 @@ static int sh_mobile_i2c_isr_rx(struct sh_mobile_i2c_data *pd)
                real_pos = pd->pos - 2;
                if (pd->pos == pd->msg->len) {
+                        if (pd->stop_after_dma) {
+                                /* Simulate PIO end condition after DMA transfer */
+                                i2c_op(pd, OP_RX_STOP, 0);
+                                pd->pos++;
+                                break;
+                        }
                        if (real_pos < 0) {
                                i2c_op(pd, OP_RX_STOP, 0);
                                break;
@@ -536,6 +544,7 @@ static void sh_mobile_i2c_dma_callback(void *data)
        sh_mobile_i2c_dma_unmap(pd);
        pd->pos = pd->msg->len;
+        pd->stop_after_dma = true;
        iic_set_clr(pd, ICIC, 0, ICIC_TDMAE | ICIC_RDMAE);
 }
@@ -726,6 +735,7 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,
                bool do_start = pd->send_stop || !i;
                msg = &msgs[i];
                pd->send_stop = i == num - 1 || msg->flags & I2C_M_STOP;
+                pd->stop_after_dma = false;
                err = start_ch(pd, msg, do_start);
                if (err)
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 39d25a8cb1ad..e9eae57a2b50 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -2972,6 +2972,7 @@ trace:
 }
 EXPORT_SYMBOL(i2c_smbus_xfer);
+#if IS_ENABLED(CONFIG_I2C_SLAVE)
 int i2c_slave_register(struct i2c_client *client, i2c_slave_cb_t slave_cb)
 {
        int ret;
@@ -3019,6 +3020,7 @@ int i2c_slave_unregister(struct i2c_client *client)
        return ret;
 }
 EXPORT_SYMBOL_GPL(i2c_slave_unregister);
+#endif
 MODULE_AUTHOR("Simon G. Vogl <simon@tk.uni-linz.ac.at>");
 MODULE_DESCRIPTION("I2C-Bus main module");
diff --git a/drivers/i2c/i2c-slave-eeprom.c b/drivers/i2c/i2c-slave-eeprom.c
index 6631400b5f02..cf9b09db092f 100644
--- a/drivers/i2c/i2c-slave-eeprom.c
+++ b/drivers/i2c/i2c-slave-eeprom.c
@@ -74,7 +74,7 @@ static ssize_t i2c_slave_eeprom_bin_read(struct file *filp, struct kobject *kobj
        struct eeprom_data *eeprom;
        unsigned long flags;
-        if (off + count >= attr->size)
+        if (off + count > attr->size)
                return -EFBIG;
        eeprom = dev_get_drvdata(container_of(kobj, struct device, kobj));
@@ -92,7 +92,7 @@ static ssize_t i2c_slave_eeprom_bin_write(struct file *filp, struct kobject *kob
        struct eeprom_data *eeprom;
        unsigned long flags;
-        if (off + count >= attr->size)
+        if (off + count > attr->size)
                return -EFBIG;
        eeprom = dev_get_drvdata(container_of(kobj, struct device, kobj));
diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
index e37412da15f5..b99de00e57b8 100644
--- a/drivers/iio/adc/ad799x.c
+++ b/drivers/iio/adc/ad799x.c
@@ -143,9 +143,15 @@ static int ad799x_write_config(struct ad799x_state *st, u16 val)
        case ad7998:
                return i2c_smbus_write_word_swapped(st->client, AD7998_CONF_REG,
                        val);
-        default:
+        case ad7992:
+        case ad7993:
+        case ad7994:
                return i2c_smbus_write_byte_data(st->client, AD7998_CONF_REG,
                        val);
+        default:
+                /* Will be written when doing a conversion */
+                st->config = val;
+                return 0;
        }
 }
@@ -155,8 +161,13 @@ static int ad799x_read_config(struct ad799x_state *st)
        case ad7997:
        case ad7998:
                return i2c_smbus_read_word_swapped(st->client, AD7998_CONF_REG);
-        default:
+        case ad7992:
+        case ad7993:
+        case ad7994:
                return i2c_smbus_read_byte_data(st->client, AD7998_CONF_REG);
+        default:
+                /* No readback support */
+                return st->config;
        }
 }
diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index 866fe904cba2..90c8cb727cc7 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -449,6 +449,9 @@ static int iio_channel_read(struct iio_channel *chan, int *val, int *val2,
        if (val2 == NULL)
                val2 = &unused;
+        if(!iio_channel_has_info(chan->channel, info))
+                return -EINVAL;
        if (chan->indio_dev->info->read_raw_multi) {
                ret = chan->indio_dev->info->read_raw_multi(chan->indio_dev,
                                        chan->channel, INDIO_MAX_RAW_ELEMENTS,
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index b716b0815644..643c08a025a5 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -258,6 +258,5 @@ IB_UVERBS_DECLARE_CMD(close_xrcd);
 IB_UVERBS_DECLARE_EX_CMD(create_flow);
 IB_UVERBS_DECLARE_EX_CMD(destroy_flow);
-IB_UVERBS_DECLARE_EX_CMD(query_device);
 #endif /* UVERBS_H */
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 532d8eba8b02..b7943ff16ed3 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -400,52 +400,6 @@ err:
        return ret;
 }
-static void copy_query_dev_fields(struct ib_uverbs_file *file,
-                                  struct ib_uverbs_query_device_resp *resp,
-                                  struct ib_device_attr *attr)
-{
-        resp->fw_ver            = attr->fw_ver;
-        resp->node_guid         = file->device->ib_dev->node_guid;
-        resp->sys_image_guid    = attr->sys_image_guid;
-        resp->max_mr_size       = attr->max_mr_size;
-        resp->page_size_cap     = attr->page_size_cap;
-        resp->vendor_id         = attr->vendor_id;
-        resp->vendor_part_id    = attr->vendor_part_id;
-        resp->hw_ver            = attr->hw_ver;
-        resp->max_qp            = attr->max_qp;
-        resp->max_qp_wr         = attr->max_qp_wr;
-        resp->device_cap_flags  = attr->device_cap_flags;
-        resp->max_sge           = attr->max_sge;
-        resp->max_sge_rd        = attr->max_sge_rd;
-        resp->max_cq            = attr->max_cq;
-        resp->max_cqe           = attr->max_cqe;
-        resp->max_mr            = attr->max_mr;
-        resp->max_pd            = attr->max_pd;
-        resp->max_qp_rd_atom    = attr->max_qp_rd_atom;
-        resp->max_ee_rd_atom    = attr->max_ee_rd_atom;
-        resp->max_res_rd_atom   = attr->max_res_rd_atom;
-        resp->max_qp_init_rd_atom       = attr->max_qp_init_rd_atom;
-        resp->max_ee_init_rd_atom       = attr->max_ee_init_rd_atom;
-        resp->atomic_cap                = attr->atomic_cap;
-        resp->max_ee                    = attr->max_ee;
-        resp->max_rdd                   = attr->max_rdd;
-        resp->max_mw                    = attr->max_mw;
-        resp->max_raw_ipv6_qp           = attr->max_raw_ipv6_qp;
-        resp->max_raw_ethy_qp           = attr->max_raw_ethy_qp;
-        resp->max_mcast_grp             = attr->max_mcast_grp;
-        resp->max_mcast_qp_attach       = attr->max_mcast_qp_attach;
-        resp->max_total_mcast_qp_attach = attr->max_total_mcast_qp_attach;
-        resp->max_ah                    = attr->max_ah;
-        resp->max_fmr                   = attr->max_fmr;
-        resp->max_map_per_fmr           = attr->max_map_per_fmr;
-        resp->max_srq                   = attr->max_srq;
-        resp->max_srq_wr                = attr->max_srq_wr;
-        resp->max_srq_sge               = attr->max_srq_sge;
-        resp->max_pkeys                 = attr->max_pkeys;
-        resp->local_ca_ack_delay        = attr->local_ca_ack_delay;
-        resp->phys_port_cnt             = file->device->ib_dev->phys_port_cnt;
-}
 ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
                               const char __user *buf,
                               int in_len, int out_len)
@@ -466,7 +420,47 @@ ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
                return ret;
        memset(&resp, 0, sizeof resp);
-        copy_query_dev_fields(file, &resp, &attr);
+        resp.fw_ver                    = attr.fw_ver;
+        resp.node_guid                 = file->device->ib_dev->node_guid;
+        resp.sys_image_guid            = attr.sys_image_guid;
+        resp.max_mr_size               = attr.max_mr_size;
+        resp.page_size_cap             = attr.page_size_cap;
+        resp.vendor_id                 = attr.vendor_id;
+        resp.vendor_part_id            = attr.vendor_part_id;
+        resp.hw_ver                    = attr.hw_ver;
+        resp.max_qp                    = attr.max_qp;
+        resp.max_qp_wr                 = attr.max_qp_wr;
+        resp.device_cap_flags          = attr.device_cap_flags;
+        resp.max_sge                   = attr.max_sge;
+        resp.max_sge_rd                = attr.max_sge_rd;
+        resp.max_cq                    = attr.max_cq;
+        resp.max_cqe                   = attr.max_cqe;
+        resp.max_mr                    = attr.max_mr;
+        resp.max_pd                    = attr.max_pd;
+        resp.max_qp_rd_atom            = attr.max_qp_rd_atom;
+        resp.max_ee_rd_atom            = attr.max_ee_rd_atom;
+        resp.max_res_rd_atom           = attr.max_res_rd_atom;
+        resp.max_qp_init_rd_atom       = attr.max_qp_init_rd_atom;
+        resp.max_ee_init_rd_atom       = attr.max_ee_init_rd_atom;
+        resp.atomic_cap                = attr.atomic_cap;
+        resp.max_ee                    = attr.max_ee;
+        resp.max_rdd                   = attr.max_rdd;
+        resp.max_mw                    = attr.max_mw;
+        resp.max_raw_ipv6_qp           = attr.max_raw_ipv6_qp;
+        resp.max_raw_ethy_qp           = attr.max_raw_ethy_qp;
+        resp.max_mcast_grp             = attr.max_mcast_grp;
+        resp.max_mcast_qp_attach       = attr.max_mcast_qp_attach;
+        resp.max_total_mcast_qp_attach = attr.max_total_mcast_qp_attach;
+        resp.max_ah                    = attr.max_ah;
+        resp.max_fmr                   = attr.max_fmr;
+        resp.max_map_per_fmr           = attr.max_map_per_fmr;
+        resp.max_srq                   = attr.max_srq;
+        resp.max_srq_wr                = attr.max_srq_wr;
+        resp.max_srq_sge               = attr.max_srq_sge;
+        resp.max_pkeys                 = attr.max_pkeys;
+        resp.local_ca_ack_delay        = attr.local_ca_ack_delay;
+        resp.phys_port_cnt             = file->device->ib_dev->phys_port_cnt;
        if (copy_to_user((void __user *) (unsigned long) cmd.response,
                         &resp, sizeof resp))
@@ -3293,52 +3287,3 @@ ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
        return ret ? ret : in_len;
 }
-int ib_uverbs_ex_query_device(struct ib_uverbs_file *file,
-                              struct ib_udata *ucore,
-                              struct ib_udata *uhw)
-{
-        struct ib_uverbs_ex_query_device_resp resp;
-        struct ib_uverbs_ex_query_device  cmd;
-        struct ib_device_attr attr;
-        struct ib_device *device;
-        int err;
-        device = file->device->ib_dev;
-        if (ucore->inlen < sizeof(cmd))
-                return -EINVAL;
-        err = ib_copy_from_udata(&cmd, ucore, sizeof(cmd));
-        if (err)
-                return err;
-        if (cmd.reserved)
-                return -EINVAL;
-        err = device->query_device(device, &attr);
-        if (err)
-                return err;
-        memset(&resp, 0, sizeof(resp));
-        copy_query_dev_fields(file, &resp.base, &attr);
-        resp.comp_mask = 0;
-#ifdef CONFIG_INFINIBAND_ON_DEMAND_PAGING
-        if (cmd.comp_mask & IB_USER_VERBS_EX_QUERY_DEVICE_ODP) {
-                resp.odp_caps.general_caps = attr.odp_caps.general_caps;
-                resp.odp_caps.per_transport_caps.rc_odp_caps =
-                        attr.odp_caps.per_transport_caps.rc_odp_caps;
-                resp.odp_caps.per_transport_caps.uc_odp_caps =
-                        attr.odp_caps.per_transport_caps.uc_odp_caps;
-                resp.odp_caps.per_transport_caps.ud_odp_caps =
-                        attr.odp_caps.per_transport_caps.ud_odp_caps;
-                resp.comp_mask |= IB_USER_VERBS_EX_QUERY_DEVICE_ODP;
-        }
-#endif
-        err = ib_copy_to_udata(ucore, &resp, sizeof(resp));
-        if (err)
-                return err;
-        return 0;
-}
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index e6c23b9eab33..5db1a8cc388d 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -123,7 +123,6 @@ static int (*uverbs_ex_cmd_table[])(struct ib_uverbs_file *file,
                                    struct ib_udata *uhw) = {
        [IB_USER_VERBS_EX_CMD_CREATE_FLOW]      = ib_uverbs_ex_create_flow,
        [IB_USER_VERBS_EX_CMD_DESTROY_FLOW]     = ib_uverbs_ex_destroy_flow,
-        [IB_USER_VERBS_EX_CMD_QUERY_DEVICE]     = ib_uverbs_ex_query_device
 };
 static void ib_uverbs_add_one(struct ib_device *device);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 57ecc5b204f3..9117b7a2d5f8 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1114,7 +1114,8 @@ static int mlx4_ib_tunnel_steer_add(struct ib_qp *qp, struct ib_flow_attr *flow_
        struct mlx4_dev *dev = to_mdev(qp->device)->dev;
        int err = 0;
-        if (dev->caps.tunnel_offload_mode != MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
+        if (dev->caps.tunnel_offload_mode != MLX4_TUNNEL_OFFLOAD_MODE_VXLAN ||
+            dev->caps.dmfs_high_steer_mode == MLX4_STEERING_DMFS_A0_STATIC)
                return 0; /* do nothing */
        ib_flow = flow_attr + 1;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 8a87404e9c76..03bf81211a54 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1331,8 +1331,6 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
                (1ull << IB_USER_VERBS_CMD_DESTROY_SRQ)         |
                (1ull << IB_USER_VERBS_CMD_CREATE_XSRQ)         |
                (1ull << IB_USER_VERBS_CMD_OPEN_QP);
-        dev->ib_dev.uverbs_ex_cmd_mask =
-                (1ull << IB_USER_VERBS_EX_CMD_QUERY_DEVICE);
        dev->ib_dev.query_device        = mlx5_ib_query_device;
        dev->ib_dev.query_port          = mlx5_ib_query_port;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 8ba80a6d3a46..d7562beb5423 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -98,15 +98,9 @@ enum {
        IPOIB_MCAST_FLAG_FOUND    = 0,  /* used in set_multicast_list */
        IPOIB_MCAST_FLAG_SENDONLY = 1,
-        /*
+        IPOIB_MCAST_FLAG_BUSY     = 2,  /* joining or already joined */
-         * For IPOIB_MCAST_FLAG_BUSY
-         * When set, in flight join and mcast->mc is unreliable
-         * When clear and mcast->mc IS_ERR_OR_NULL, need to restart or
-         *   haven't started yet
-         * When clear and mcast->mc is valid pointer, join was successful
-         */
-        IPOIB_MCAST_FLAG_BUSY     = 2,
        IPOIB_MCAST_FLAG_ATTACHED = 3,
+        IPOIB_MCAST_JOIN_STARTED  = 4,
        MAX_SEND_CQE              = 16,
        IPOIB_CM_COPYBREAK        = 256,
@@ -323,7 +317,6 @@ struct ipoib_dev_priv {
        struct list_head multicast_list;
        struct rb_root multicast_tree;
-        struct workqueue_struct *wq;
        struct delayed_work mcast_task;
        struct work_struct carrier_on_task;
        struct work_struct flush_light;
@@ -484,10 +477,10 @@ void ipoib_ib_dev_flush_heavy(struct work_struct *work);
 void ipoib_pkey_event(struct work_struct *work);
 void ipoib_ib_dev_cleanup(struct net_device *dev);
-int ipoib_ib_dev_open(struct net_device *dev);
+int ipoib_ib_dev_open(struct net_device *dev, int flush);
 int ipoib_ib_dev_up(struct net_device *dev);
-int ipoib_ib_dev_down(struct net_device *dev);
+int ipoib_ib_dev_down(struct net_device *dev, int flush);
-int ipoib_ib_dev_stop(struct net_device *dev);
+int ipoib_ib_dev_stop(struct net_device *dev, int flush);
 void ipoib_pkey_dev_check_presence(struct net_device *dev);
 int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port);
@@ -499,7 +492,7 @@ void ipoib_mcast_send(struct net_device *dev, u8 *daddr, struct sk_buff *skb);
 void ipoib_mcast_restart_task(struct work_struct *work);
 int ipoib_mcast_start_thread(struct net_device *dev);
-int ipoib_mcast_stop_thread(struct net_device *dev);
+int ipoib_mcast_stop_thread(struct net_device *dev, int flush);
 void ipoib_mcast_dev_down(struct net_device *dev);
 void ipoib_mcast_dev_flush(struct net_device *dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 56959adb6c7d..933efcea0d03 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -474,7 +474,7 @@ static int ipoib_cm_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *even
        }
        spin_lock_irq(&priv->lock);
-        queue_delayed_work(priv->wq,
+        queue_delayed_work(ipoib_workqueue,
                           &priv->cm.stale_task, IPOIB_CM_RX_DELAY);
        /* Add this entry to passive ids list head, but do not re-add it
         * if IB_EVENT_QP_LAST_WQE_REACHED has moved it to flush list. */
@@ -576,7 +576,7 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
                        spin_lock_irqsave(&priv->lock, flags);
                        list_splice_init(&priv->cm.rx_drain_list, &priv->cm.rx_reap_list);
                        ipoib_cm_start_rx_drain(priv);
-                        queue_work(priv->wq, &priv->cm.rx_reap_task);
+                        queue_work(ipoib_workqueue, &priv->cm.rx_reap_task);
                        spin_unlock_irqrestore(&priv->lock, flags);
                } else
                        ipoib_warn(priv, "cm recv completion event with wrid %d (> %d)\n",
@@ -603,7 +603,7 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
                                spin_lock_irqsave(&priv->lock, flags);
                                list_move(&p->list, &priv->cm.rx_reap_list);
                                spin_unlock_irqrestore(&priv->lock, flags);
-                                queue_work(priv->wq, &priv->cm.rx_reap_task);
+                                queue_work(ipoib_workqueue, &priv->cm.rx_reap_task);
                        }
                        return;
                }
@@ -827,7 +827,7 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
                if (test_and_clear_bit(IPOIB_FLAG_INITIALIZED, &tx->flags)) {
                        list_move(&tx->list, &priv->cm.reap_list);
-                        queue_work(priv->wq, &priv->cm.reap_task);
+                        queue_work(ipoib_workqueue, &priv->cm.reap_task);
                }
                clear_bit(IPOIB_FLAG_OPER_UP, &tx->flags);
@@ -1255,7 +1255,7 @@ static int ipoib_cm_tx_handler(struct ib_cm_id *cm_id,
                if (test_and_clear_bit(IPOIB_FLAG_INITIALIZED, &tx->flags)) {
                        list_move(&tx->list, &priv->cm.reap_list);
-                        queue_work(priv->wq, &priv->cm.reap_task);
+                        queue_work(ipoib_workqueue, &priv->cm.reap_task);
                }
                spin_unlock_irqrestore(&priv->lock, flags);
@@ -1284,7 +1284,7 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path
        tx->dev = dev;
        list_add(&tx->list, &priv->cm.start_list);
        set_bit(IPOIB_FLAG_INITIALIZED, &tx->flags);
-        queue_work(priv->wq, &priv->cm.start_task);
+        queue_work(ipoib_workqueue, &priv->cm.start_task);
        return tx;
 }
@@ -1295,7 +1295,7 @@ void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
        if (test_and_clear_bit(IPOIB_FLAG_INITIALIZED, &tx->flags)) {
                spin_lock_irqsave(&priv->lock, flags);
                list_move(&tx->list, &priv->cm.reap_list);
-                queue_work(priv->wq, &priv->cm.reap_task);
+                queue_work(ipoib_workqueue, &priv->cm.reap_task);
                ipoib_dbg(priv, "Reap connection for gid %pI6\n",
                          tx->neigh->daddr + 4);
                tx->neigh = NULL;
@@ -1417,7 +1417,7 @@ void ipoib_cm_skb_too_long(struct net_device *dev, struct sk_buff *skb,
        skb_queue_tail(&priv->cm.skb_queue, skb);
        if (e)
-                queue_work(priv->wq, &priv->cm.skb_task);
+                queue_work(ipoib_workqueue, &priv->cm.skb_task);
 }
 static void ipoib_cm_rx_reap(struct work_struct *work)
@@ -1450,7 +1450,7 @@ static void ipoib_cm_stale_task(struct work_struct *work)
        }
        if (!list_empty(&priv->cm.passive_ids))
-                queue_delayed_work(priv->wq,
+                queue_delayed_work(ipoib_workqueue,
                                   &priv->cm.stale_task, IPOIB_CM_RX_DELAY);
        spin_unlock_irq(&priv->lock);
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index fe65abb5150c..72626c348174 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -655,7 +655,7 @@ void ipoib_reap_ah(struct work_struct *work)
        __ipoib_reap_ah(dev);
        if (!test_bit(IPOIB_STOP_REAPER, &priv->flags))
-                queue_delayed_work(priv->wq, &priv->ah_reap_task,
+                queue_delayed_work(ipoib_workqueue, &priv->ah_reap_task,
                                   round_jiffies_relative(HZ));
 }
@@ -664,7 +664,7 @@ static void ipoib_ib_tx_timer_func(unsigned long ctx)
        drain_tx_cq((struct net_device *)ctx);
 }
-int ipoib_ib_dev_open(struct net_device *dev)
+int ipoib_ib_dev_open(struct net_device *dev, int flush)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        int ret;
@@ -696,7 +696,7 @@ int ipoib_ib_dev_open(struct net_device *dev)
        }
        clear_bit(IPOIB_STOP_REAPER, &priv->flags);
-        queue_delayed_work(priv->wq, &priv->ah_reap_task,
+        queue_delayed_work(ipoib_workqueue, &priv->ah_reap_task,
                           round_jiffies_relative(HZ));
        if (!test_and_set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags))
@@ -706,7 +706,7 @@ int ipoib_ib_dev_open(struct net_device *dev)
 dev_stop:
        if (!test_and_set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags))
                napi_enable(&priv->napi);
-        ipoib_ib_dev_stop(dev);
+        ipoib_ib_dev_stop(dev, flush);
        return -1;
 }
@@ -738,7 +738,7 @@ int ipoib_ib_dev_up(struct net_device *dev)
        return ipoib_mcast_start_thread(dev);
 }
-int ipoib_ib_dev_down(struct net_device *dev)
+int ipoib_ib_dev_down(struct net_device *dev, int flush)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
@@ -747,7 +747,7 @@ int ipoib_ib_dev_down(struct net_device *dev)
        clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
        netif_carrier_off(dev);
-        ipoib_mcast_stop_thread(dev);
+        ipoib_mcast_stop_thread(dev, flush);
        ipoib_mcast_dev_flush(dev);
        ipoib_flush_paths(dev);
@@ -807,7 +807,7 @@ void ipoib_drain_cq(struct net_device *dev)
        local_bh_enable();
 }
-int ipoib_ib_dev_stop(struct net_device *dev)
+int ipoib_ib_dev_stop(struct net_device *dev, int flush)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ib_qp_attr qp_attr;
@@ -880,7 +880,8 @@ timeout:
        /* Wait for all AHs to be reaped */
        set_bit(IPOIB_STOP_REAPER, &priv->flags);
        cancel_delayed_work(&priv->ah_reap_task);
-        flush_workqueue(priv->wq);
+        if (flush)
+                flush_workqueue(ipoib_workqueue);
        begin = jiffies;
@@ -917,7 +918,7 @@ int ipoib_ib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
                    (unsigned long) dev);
        if (dev->flags & IFF_UP) {
-                if (ipoib_ib_dev_open(dev)) {
+                if (ipoib_ib_dev_open(dev, 1)) {
                        ipoib_transport_dev_cleanup(dev);
                        return -ENODEV;
                }
@@ -1039,12 +1040,12 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
        }
        if (level >= IPOIB_FLUSH_NORMAL)
-                ipoib_ib_dev_down(dev);
+                ipoib_ib_dev_down(dev, 0);
        if (level == IPOIB_FLUSH_HEAVY) {
                if (test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags))
-                        ipoib_ib_dev_stop(dev);
+                        ipoib_ib_dev_stop(dev, 0);
-                if (ipoib_ib_dev_open(dev) != 0)
+                if (ipoib_ib_dev_open(dev, 0) != 0)
                        return;
                if (netif_queue_stopped(dev))
                        netif_start_queue(dev);
@@ -1096,7 +1097,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
         */
        ipoib_flush_paths(dev);
-        ipoib_mcast_stop_thread(dev);
+        ipoib_mcast_stop_thread(dev, 1);
        ipoib_mcast_dev_flush(dev);
        ipoib_transport_dev_cleanup(dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 6bad17d4d588..58b5aa3b6f2d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -108,7 +108,7 @@ int ipoib_open(struct net_device *dev)
        set_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags);
-        if (ipoib_ib_dev_open(dev)) {
+        if (ipoib_ib_dev_open(dev, 1)) {
                if (!test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags))
                        return 0;
                goto err_disable;
@@ -139,7 +139,7 @@ int ipoib_open(struct net_device *dev)
        return 0;
 err_stop:
-        ipoib_ib_dev_stop(dev);
+        ipoib_ib_dev_stop(dev, 1);
 err_disable:
        clear_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags);
@@ -157,8 +157,8 @@ static int ipoib_stop(struct net_device *dev)
        netif_stop_queue(dev);
-        ipoib_ib_dev_down(dev);
+        ipoib_ib_dev_down(dev, 1);
-        ipoib_ib_dev_stop(dev);
+        ipoib_ib_dev_stop(dev, 0);
        if (!test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags)) {
                struct ipoib_dev_priv *cpriv;
@@ -839,7 +839,7 @@ static void ipoib_set_mcast_list(struct net_device *dev)
                return;
        }
-        queue_work(priv->wq, &priv->restart_task);
+        queue_work(ipoib_workqueue, &priv->restart_task);
 }
 static u32 ipoib_addr_hash(struct ipoib_neigh_hash *htbl, u8 *daddr)
@@ -954,7 +954,7 @@ static void ipoib_reap_neigh(struct work_struct *work)
        __ipoib_reap_neigh(priv);
        if (!test_bit(IPOIB_STOP_NEIGH_GC, &priv->flags))
-                queue_delayed_work(priv->wq, &priv->neigh_reap_task,
+                queue_delayed_work(ipoib_workqueue, &priv->neigh_reap_task,
                                   arp_tbl.gc_interval);
 }
@@ -1133,7 +1133,7 @@ static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
        /* start garbage collection */
        clear_bit(IPOIB_STOP_NEIGH_GC, &priv->flags);
-        queue_delayed_work(priv->wq, &priv->neigh_reap_task,
+        queue_delayed_work(ipoib_workqueue, &priv->neigh_reap_task,
                           arp_tbl.gc_interval);
        return 0;
@@ -1262,13 +1262,15 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        if (ipoib_neigh_hash_init(priv) < 0)
+                goto out;
        /* Allocate RX/TX "rings" to hold queued skbs */
        priv->rx_ring = kzalloc(ipoib_recvq_size * sizeof *priv->rx_ring,
                                GFP_KERNEL);
        if (!priv->rx_ring) {
                printk(KERN_WARNING "%s: failed to allocate RX ring (%d entries)\n",
                       ca->name, ipoib_recvq_size);
-                goto out;
+                goto out_neigh_hash_cleanup;
        }
        priv->tx_ring = vzalloc(ipoib_sendq_size * sizeof *priv->tx_ring);
@@ -1283,24 +1285,16 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
        if (ipoib_ib_dev_init(dev, ca, port))
                goto out_tx_ring_cleanup;
-        /*
-         * Must be after ipoib_ib_dev_init so we can allocate a per
-         * device wq there and use it here
-         */
-        if (ipoib_neigh_hash_init(priv) < 0)
-                goto out_dev_uninit;
        return 0;
-out_dev_uninit:
-        ipoib_ib_dev_cleanup(dev);
 out_tx_ring_cleanup:
        vfree(priv->tx_ring);
 out_rx_ring_cleanup:
        kfree(priv->rx_ring);
+out_neigh_hash_cleanup:
+        ipoib_neigh_hash_uninit(dev);
 out:
        return -ENOMEM;
 }
@@ -1323,12 +1317,6 @@ void ipoib_dev_cleanup(struct net_device *dev)
        }
        unregister_netdevice_many(&head);
-        /*
-         * Must be before ipoib_ib_dev_cleanup or we delete an in use
-         * work queue
-         */
-        ipoib_neigh_hash_uninit(dev);
        ipoib_ib_dev_cleanup(dev);
        kfree(priv->rx_ring);
@@ -1336,6 +1324,8 @@ void ipoib_dev_cleanup(struct net_device *dev)
        priv->rx_ring = NULL;
        priv->tx_ring = NULL;
+        ipoib_neigh_hash_uninit(dev);
 }
 static const struct header_ops ipoib_header_ops = {
@@ -1646,7 +1636,7 @@ register_failed:
        /* Stop GC if started before flush */
        set_bit(IPOIB_STOP_NEIGH_GC, &priv->flags);
        cancel_delayed_work(&priv->neigh_reap_task);
-        flush_workqueue(priv->wq);
+        flush_workqueue(ipoib_workqueue);
 event_failed:
        ipoib_dev_cleanup(priv->dev);
@@ -1717,7 +1707,7 @@ static void ipoib_remove_one(struct ib_device *device)
                /* Stop GC */
                set_bit(IPOIB_STOP_NEIGH_GC, &priv->flags);
                cancel_delayed_work(&priv->neigh_reap_task);
-                flush_workqueue(priv->wq);
+                flush_workqueue(ipoib_workqueue);
                unregister_netdev(priv->dev);
                free_netdev(priv->dev);
@@ -1758,13 +1748,8 @@ static int __init ipoib_init_module(void)
         * unregister_netdev() and linkwatch_event take the rtnl lock,
         * so flush_scheduled_work() can deadlock during device
         * removal.
-         *
-         * In addition, bringing one device up and another down at the
-         * same time can deadlock a single workqueue, so we have this
-         * global fallback workqueue, but we also attempt to open a
-         * per device workqueue each time we bring an interface up
         */
-        ipoib_workqueue = create_singlethread_workqueue("ipoib_flush");
+        ipoib_workqueue = create_singlethread_workqueue("ipoib");
        if (!ipoib_workqueue) {
                ret = -ENOMEM;
                goto err_fs;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index bc50dd0d0e4d..ffb83b5f7e80 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -190,6 +190,12 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
                spin_unlock_irq(&priv->lock);
                priv->tx_wr.wr.ud.remote_qkey = priv->qkey;
                set_qkey = 1;
+                if (!ipoib_cm_admin_enabled(dev)) {
+                        rtnl_lock();
+                        dev_set_mtu(dev, min(priv->mcast_mtu, priv->admin_mtu));
+                        rtnl_unlock();
+                }
        }
        if (!test_bit(IPOIB_MCAST_FLAG_SENDONLY, &mcast->flags)) {
@@ -271,27 +277,16 @@ ipoib_mcast_sendonly_join_complete(int status,
        struct ipoib_mcast *mcast = multicast->context;
        struct net_device *dev = mcast->dev;
-        /*
-         * We have to take the mutex to force mcast_sendonly_join to
-         * return from ib_sa_multicast_join and set mcast->mc to a
-         * valid value.  Otherwise we were racing with ourselves in
-         * that we might fail here, but get a valid return from
-         * ib_sa_multicast_join after we had cleared mcast->mc here,
-         * resulting in mis-matched joins and leaves and a deadlock
-         */
-        mutex_lock(&mcast_mutex);
        /* We trap for port events ourselves. */
        if (status == -ENETRESET)
-                goto out;
+                return 0;
        if (!status)
                status = ipoib_mcast_join_finish(mcast, &multicast->rec);
        if (status) {
                if (mcast->logcount++ < 20)
-                        ipoib_dbg_mcast(netdev_priv(dev), "sendonly multicast "
+                        ipoib_dbg_mcast(netdev_priv(dev), "multicast join failed for %pI6, status %d\n",
-                                        "join failed for %pI6, status %d\n",
                                        mcast->mcmember.mgid.raw, status);
                /* Flush out any queued packets */
@@ -301,15 +296,11 @@ ipoib_mcast_sendonly_join_complete(int status,
                        dev_kfree_skb_any(skb_dequeue(&mcast->pkt_queue));
                }
                netif_tx_unlock_bh(dev);
+                /* Clear the busy flag so we try again */
+                status = test_and_clear_bit(IPOIB_MCAST_FLAG_BUSY,
+                                            &mcast->flags);
        }
-out:
-        clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
-        if (status)
-                mcast->mc = NULL;
-        complete(&mcast->done);
-        if (status == -ENETRESET)
-                status = 0;
-        mutex_unlock(&mcast_mutex);
        return status;
 }
@@ -327,14 +318,12 @@ static int ipoib_mcast_sendonly_join(struct ipoib_mcast *mcast)
        int ret = 0;
        if (!test_bit(IPOIB_FLAG_OPER_UP, &priv->flags)) {
-                ipoib_dbg_mcast(priv, "device shutting down, no sendonly "
+                ipoib_dbg_mcast(priv, "device shutting down, no multicast joins\n");
-                                "multicast joins\n");
                return -ENODEV;
        }
-        if (test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags)) {
+        if (test_and_set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags)) {
-                ipoib_dbg_mcast(priv, "multicast entry busy, skipping "
+                ipoib_dbg_mcast(priv, "multicast entry busy, skipping\n");
-                                "sendonly join\n");
                return -EBUSY;
        }
@@ -342,9 +331,6 @@ static int ipoib_mcast_sendonly_join(struct ipoib_mcast *mcast)
        rec.port_gid = priv->local_gid;
        rec.pkey     = cpu_to_be16(priv->pkey);
-        mutex_lock(&mcast_mutex);
-        init_completion(&mcast->done);
-        set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
        mcast->mc = ib_sa_join_multicast(&ipoib_sa_client, priv->ca,
                                         priv->port, &rec,
                                         IB_SA_MCMEMBER_REC_MGID        |
@@ -357,14 +343,12 @@ static int ipoib_mcast_sendonly_join(struct ipoib_mcast *mcast)
        if (IS_ERR(mcast->mc)) {
                ret = PTR_ERR(mcast->mc);
                clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
-                complete(&mcast->done);
+                ipoib_warn(priv, "ib_sa_join_multicast failed (ret = %d)\n",
-                ipoib_warn(priv, "ib_sa_join_multicast for sendonly join "
+                           ret);
-                           "failed (ret = %d)\n", ret);
        } else {
-                ipoib_dbg_mcast(priv, "no multicast record for %pI6, starting "
+                ipoib_dbg_mcast(priv, "no multicast record for %pI6, starting join\n",
-                                "sendonly join\n", mcast->mcmember.mgid.raw);
+                                mcast->mcmember.mgid.raw);
        }
-        mutex_unlock(&mcast_mutex);
        return ret;
 }
@@ -375,29 +359,18 @@ void ipoib_mcast_carrier_on_task(struct work_struct *work)
                                                   carrier_on_task);
        struct ib_port_attr attr;
+        /*
+         * Take rtnl_lock to avoid racing with ipoib_stop() and
+         * turning the carrier back on while a device is being
+         * removed.
+         */
        if (ib_query_port(priv->ca, priv->port, &attr) ||
            attr.state != IB_PORT_ACTIVE) {
                ipoib_dbg(priv, "Keeping carrier off until IB port is active\n");
                return;
        }
-        /*
+        rtnl_lock();
-         * Take rtnl_lock to avoid racing with ipoib_stop() and
-         * turning the carrier back on while a device is being
-         * removed.  However, ipoib_stop() will attempt to flush
-         * the workqueue while holding the rtnl lock, so loop
-         * on trylock until either we get the lock or we see
-         * FLAG_ADMIN_UP go away as that signals that we are bailing
-         * and can safely ignore the carrier on work.
-         */
-        while (!rtnl_trylock()) {
-                if (!test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))
-                        return;
-                else
-                        msleep(20);
-        }
-        if (!ipoib_cm_admin_enabled(priv->dev))
-                dev_set_mtu(priv->dev, min(priv->mcast_mtu, priv->admin_mtu));
        netif_carrier_on(priv->dev);
        rtnl_unlock();
 }
@@ -412,63 +385,60 @@ static int ipoib_mcast_join_complete(int status,
        ipoib_dbg_mcast(priv, "join completion for %pI6 (status %d)\n",
                        mcast->mcmember.mgid.raw, status);
-        /*
-         * We have to take the mutex to force mcast_join to
-         * return from ib_sa_multicast_join and set mcast->mc to a
-         * valid value.  Otherwise we were racing with ourselves in
-         * that we might fail here, but get a valid return from
-         * ib_sa_multicast_join after we had cleared mcast->mc here,
-         * resulting in mis-matched joins and leaves and a deadlock
-         */
-        mutex_lock(&mcast_mutex);
        /* We trap for port events ourselves. */
-        if (status == -ENETRESET)
+        if (status == -ENETRESET) {
+                status = 0;
                goto out;
+        }
        if (!status)
                status = ipoib_mcast_join_finish(mcast, &multicast->rec);
        if (!status) {
                mcast->backoff = 1;
+                mutex_lock(&mcast_mutex);
                if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
-                        queue_delayed_work(priv->wq, &priv->mcast_task, 0);
+                        queue_delayed_work(ipoib_workqueue,
+                                           &priv->mcast_task, 0);
+                mutex_unlock(&mcast_mutex);
                /*
-                 * Defer carrier on work to priv->wq to avoid a
+                 * Defer carrier on work to ipoib_workqueue to avoid a
                 * deadlock on rtnl_lock here.
                 */
                if (mcast == priv->broadcast)
-                        queue_work(priv->wq, &priv->carrier_on_task);
+                        queue_work(ipoib_workqueue, &priv->carrier_on_task);
-        } else {
-                if (mcast->logcount++ < 20) {
-                        if (status == -ETIMEDOUT || status == -EAGAIN) {
-                                ipoib_dbg_mcast(priv, "multicast join failed for %pI6, status %d\n",
-                                                mcast->mcmember.mgid.raw, status);
-                        } else {
-                                ipoib_warn(priv, "multicast join failed for %pI6, status %d\n",
-                                           mcast->mcmember.mgid.raw, status);
-                        }
-                }
-                mcast->backoff *= 2;
+                status = 0;
-                if (mcast->backoff > IPOIB_MAX_BACKOFF_SECONDS)
+                goto out;
-                        mcast->backoff = IPOIB_MAX_BACKOFF_SECONDS;
        }
-out:
+        if (mcast->logcount++ < 20) {
+                if (status == -ETIMEDOUT || status == -EAGAIN) {
+                        ipoib_dbg_mcast(priv, "multicast join failed for %pI6, status %d\n",
+                                        mcast->mcmember.mgid.raw, status);
+                } else {
+                        ipoib_warn(priv, "multicast join failed for %pI6, status %d\n",
+                                   mcast->mcmember.mgid.raw, status);
+                }
+        }
+        mcast->backoff *= 2;
+        if (mcast->backoff > IPOIB_MAX_BACKOFF_SECONDS)
+                mcast->backoff = IPOIB_MAX_BACKOFF_SECONDS;
+        /* Clear the busy flag so we try again */
+        status = test_and_clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
+        mutex_lock(&mcast_mutex);
        spin_lock_irq(&priv->lock);
-        clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
+        if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
-        if (status)
+                queue_delayed_work(ipoib_workqueue, &priv->mcast_task,
-                mcast->mc = NULL;
-        complete(&mcast->done);
-        if (status == -ENETRESET)
-                status = 0;
-        if (status && test_bit(IPOIB_MCAST_RUN, &priv->flags))
-                queue_delayed_work(priv->wq, &priv->mcast_task,
                                   mcast->backoff * HZ);
        spin_unlock_irq(&priv->lock);
        mutex_unlock(&mcast_mutex);
+out:
+        complete(&mcast->done);
        return status;
 }
@@ -517,9 +487,10 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast,
                rec.hop_limit     = priv->broadcast->mcmember.hop_limit;
        }
-        mutex_lock(&mcast_mutex);
-        init_completion(&mcast->done);
        set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
+        init_completion(&mcast->done);
+        set_bit(IPOIB_MCAST_JOIN_STARTED, &mcast->flags);
        mcast->mc = ib_sa_join_multicast(&ipoib_sa_client, priv->ca, priv->port,
                                         &rec, comp_mask, GFP_KERNEL,
                                         ipoib_mcast_join_complete, mcast);
@@ -533,11 +504,13 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast,
                if (mcast->backoff > IPOIB_MAX_BACKOFF_SECONDS)
                        mcast->backoff = IPOIB_MAX_BACKOFF_SECONDS;
+                mutex_lock(&mcast_mutex);
                if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
-                        queue_delayed_work(priv->wq, &priv->mcast_task,
+                        queue_delayed_work(ipoib_workqueue,
+                                           &priv->mcast_task,
                                           mcast->backoff * HZ);
+                mutex_unlock(&mcast_mutex);
        }
-        mutex_unlock(&mcast_mutex);
 }
 void ipoib_mcast_join_task(struct work_struct *work)
@@ -574,8 +547,8 @@ void ipoib_mcast_join_task(struct work_struct *work)
                        ipoib_warn(priv, "failed to allocate broadcast group\n");
                        mutex_lock(&mcast_mutex);
                        if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
-                                queue_delayed_work(priv->wq, &priv->mcast_task,
+                                queue_delayed_work(ipoib_workqueue,
-                                                   HZ);
+                                                   &priv->mcast_task, HZ);
                        mutex_unlock(&mcast_mutex);
                        return;
                }
@@ -590,8 +563,7 @@ void ipoib_mcast_join_task(struct work_struct *work)
        }
        if (!test_bit(IPOIB_MCAST_FLAG_ATTACHED, &priv->broadcast->flags)) {
-                if (IS_ERR_OR_NULL(priv->broadcast->mc) &&
+                if (!test_bit(IPOIB_MCAST_FLAG_BUSY, &priv->broadcast->flags))
-                    !test_bit(IPOIB_MCAST_FLAG_BUSY, &priv->broadcast->flags))
                        ipoib_mcast_join(dev, priv->broadcast, 0);
                return;
        }
@@ -599,33 +571,23 @@ void ipoib_mcast_join_task(struct work_struct *work)
        while (1) {
                struct ipoib_mcast *mcast = NULL;
-                /*
-                 * Need the mutex so our flags are consistent, need the
-                 * priv->lock so we don't race with list removals in either
-                 * mcast_dev_flush or mcast_restart_task
-                 */
-                mutex_lock(&mcast_mutex);
                spin_lock_irq(&priv->lock);
                list_for_each_entry(mcast, &priv->multicast_list, list) {
-                        if (IS_ERR_OR_NULL(mcast->mc) &&
+                        if (!test_bit(IPOIB_MCAST_FLAG_SENDONLY, &mcast->flags)
-                            !test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags) &&
+                            && !test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags)
-                            !test_bit(IPOIB_MCAST_FLAG_ATTACHED, &mcast->flags)) {
+                            && !test_bit(IPOIB_MCAST_FLAG_ATTACHED, &mcast->flags)) {
                                /* Found the next unjoined group */
                                break;
                        }
                }
                spin_unlock_irq(&priv->lock);
-                mutex_unlock(&mcast_mutex);
                if (&mcast->list == &priv->multicast_list) {
                        /* All done */
                        break;
                }
-                if (test_bit(IPOIB_MCAST_FLAG_SENDONLY, &mcast->flags))
+                ipoib_mcast_join(dev, mcast, 1);
-                        ipoib_mcast_sendonly_join(mcast);
-                else
-                        ipoib_mcast_join(dev, mcast, 1);
                return;
        }
@@ -642,13 +604,13 @@ int ipoib_mcast_start_thread(struct net_device *dev)
        mutex_lock(&mcast_mutex);
        if (!test_and_set_bit(IPOIB_MCAST_RUN, &priv->flags))
-                queue_delayed_work(priv->wq, &priv->mcast_task, 0);
+                queue_delayed_work(ipoib_workqueue, &priv->mcast_task, 0);
        mutex_unlock(&mcast_mutex);
        return 0;
 }
-int ipoib_mcast_stop_thread(struct net_device *dev)
+int ipoib_mcast_stop_thread(struct net_device *dev, int flush)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
@@ -659,7 +621,8 @@ int ipoib_mcast_stop_thread(struct net_device *dev)
        cancel_delayed_work(&priv->mcast_task);
        mutex_unlock(&mcast_mutex);
-        flush_workqueue(priv->wq);
+        if (flush)
+                flush_workqueue(ipoib_workqueue);
        return 0;
 }
@@ -670,9 +633,6 @@ static int ipoib_mcast_leave(struct net_device *dev, struct ipoib_mcast *mcast)
        int ret = 0;
        if (test_and_clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
-                ipoib_warn(priv, "ipoib_mcast_leave on an in-flight join\n");
-        if (!IS_ERR_OR_NULL(mcast->mc))
                ib_sa_free_multicast(mcast->mc);
        if (test_and_clear_bit(IPOIB_MCAST_FLAG_ATTACHED, &mcast->flags)) {
@@ -725,8 +685,6 @@ void ipoib_mcast_send(struct net_device *dev, u8 *daddr, struct sk_buff *skb)
                memcpy(mcast->mcmember.mgid.raw, mgid, sizeof (union ib_gid));
                __ipoib_mcast_add(dev, mcast);
                list_add_tail(&mcast->list, &priv->multicast_list);
-                if (!test_and_set_bit(IPOIB_MCAST_RUN, &priv->flags))
-                        queue_delayed_work(priv->wq, &priv->mcast_task, 0);
        }
        if (!mcast->ah) {
@@ -740,6 +698,8 @@ void ipoib_mcast_send(struct net_device *dev, u8 *daddr, struct sk_buff *skb)
                if (test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
                        ipoib_dbg_mcast(priv, "no address vector, "
                                        "but multicast join already started\n");
+                else if (test_bit(IPOIB_MCAST_FLAG_SENDONLY, &mcast->flags))
+                        ipoib_mcast_sendonly_join(mcast);
                /*
                 * If lookup completes between here and out:, don't
@@ -799,12 +759,9 @@ void ipoib_mcast_dev_flush(struct net_device *dev)
        spin_unlock_irqrestore(&priv->lock, flags);
-        /*
+        /* seperate between the wait to the leave*/
-         * make sure the in-flight joins have finished before we attempt
-         * to leave
-         */
        list_for_each_entry_safe(mcast, tmcast, &remove_list, list)
-                if (test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
+                if (test_bit(IPOIB_MCAST_JOIN_STARTED, &mcast->flags))
                        wait_for_completion(&mcast->done);
        list_for_each_entry_safe(mcast, tmcast, &remove_list, list) {
@@ -837,6 +794,8 @@ void ipoib_mcast_restart_task(struct work_struct *work)
        ipoib_dbg_mcast(priv, "restarting multicast task\n");
+        ipoib_mcast_stop_thread(dev, 0);
        local_irq_save(flags);
        netif_addr_lock(dev);
        spin_lock(&priv->lock);
@@ -921,38 +880,14 @@ void ipoib_mcast_restart_task(struct work_struct *work)
        netif_addr_unlock(dev);
        local_irq_restore(flags);
-        /*
+        /* We have to cancel outside of the spinlock */
-         * make sure the in-flight joins have finished before we attempt
-         * to leave
-         */
-        list_for_each_entry_safe(mcast, tmcast, &remove_list, list)
-                if (test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
-                        wait_for_completion(&mcast->done);
-        /*
-         * We have to cancel outside of the spinlock, but we have to
-         * take the rtnl lock or else we race with the removal of
-         * entries from the remove list in mcast_dev_flush as part
-         * of ipoib_stop().  We detect the drop of the ADMIN_UP flag
-         * to signal that we have hit this particular race, and we
-         * return since we know we don't need to do anything else
-         * anyway.
-         */
-        while (!rtnl_trylock()) {
-                if (!test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))
-                        return;
-                else
-                        msleep(20);
-        }
        list_for_each_entry_safe(mcast, tmcast, &remove_list, list) {
                ipoib_mcast_leave(mcast->dev, mcast);
                ipoib_mcast_free(mcast);
        }
-        /*
-         * Restart our join task if needed
+        if (test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))
-         */
+                ipoib_mcast_start_thread(dev);
-        ipoib_mcast_start_thread(dev);
-        rtnl_unlock();
 }
 #ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index b72a753eb41d..c56d5d44c53b 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -145,20 +145,10 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
        int ret, size;
        int i;
-        /*
-         * the various IPoIB tasks assume they will never race against
-         * themselves, so always use a single thread workqueue
-         */
-        priv->wq = create_singlethread_workqueue("ipoib_wq");
-        if (!priv->wq) {
-                printk(KERN_WARNING "ipoib: failed to allocate device WQ\n");
-                return -ENODEV;
-        }
        priv->pd = ib_alloc_pd(priv->ca);
        if (IS_ERR(priv->pd)) {
                printk(KERN_WARNING "%s: failed to allocate PD\n", ca->name);
-                goto out_free_wq;
+                return -ENODEV;
        }
        priv->mr = ib_get_dma_mr(priv->pd, IB_ACCESS_LOCAL_WRITE);
@@ -252,10 +242,6 @@ out_free_mr:
 out_free_pd:
        ib_dealloc_pd(priv->pd);
-out_free_wq:
-        destroy_workqueue(priv->wq);
-        priv->wq = NULL;
        return -ENODEV;
 }
@@ -284,12 +270,6 @@ void ipoib_transport_dev_cleanup(struct net_device *dev)
        if (ib_dealloc_pd(priv->pd))
                ipoib_warn(priv, "ib_dealloc_pd failed\n");
-        if (priv->wq) {
-                flush_workqueue(priv->wq);
-                destroy_workqueue(priv->wq);
-                priv->wq = NULL;
-        }
 }
 void ipoib_event(struct ib_event_handler *handler,
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 8afa28e4570e..18d4b2c8fe55 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -28,6 +28,13 @@
 #include <linux/cdev.h>
 #include "input-compat.h"
+enum evdev_clock_type {
+        EV_CLK_REAL = 0,
+        EV_CLK_MONO,
+        EV_CLK_BOOT,
+        EV_CLK_MAX
+};
 struct evdev {
        int open;
        struct input_handle handle;
@@ -49,12 +56,32 @@ struct evdev_client {
        struct fasync_struct *fasync;
        struct evdev *evdev;
        struct list_head node;
-        int clkid;
+        int clk_type;
        bool revoked;
        unsigned int bufsize;
        struct input_event buffer[];
 };
+static int evdev_set_clk_type(struct evdev_client *client, unsigned int clkid)
+{
+        switch (clkid) {
+        case CLOCK_REALTIME:
+                client->clk_type = EV_CLK_REAL;
+                break;
+        case CLOCK_MONOTONIC:
+                client->clk_type = EV_CLK_MONO;
+                break;
+        case CLOCK_BOOTTIME:
+                client->clk_type = EV_CLK_BOOT;
+                break;
+        default:
+                return -EINVAL;
+        }
+        return 0;
+}
 /* flush queued events of type @type, caller must hold client->buffer_lock */
 static void __evdev_flush_queue(struct evdev_client *client, unsigned int type)
 {
@@ -108,8 +135,11 @@ static void evdev_queue_syn_dropped(struct evdev_client *client)
        struct input_event ev;
        ktime_t time;
-        time = (client->clkid == CLOCK_MONOTONIC) ?
+        time = client->clk_type == EV_CLK_REAL ?
-                ktime_get() : ktime_get_real();
+                        ktime_get_real() :
+                        client->clk_type == EV_CLK_MONO ?
+                                ktime_get() :
+                                ktime_get_boottime();
        ev.time = ktime_to_timeval(time);
        ev.type = EV_SYN;
@@ -159,7 +189,7 @@ static void __pass_event(struct evdev_client *client,
 static void evdev_pass_values(struct evdev_client *client,
                        const struct input_value *vals, unsigned int count,
-                        ktime_t mono, ktime_t real)
+                        ktime_t *ev_time)
 {
        struct evdev *evdev = client->evdev;
        const struct input_value *v;
@@ -169,8 +199,7 @@ static void evdev_pass_values(struct evdev_client *client,
        if (client->revoked)
                return;
-        event.time = ktime_to_timeval(client->clkid == CLOCK_MONOTONIC ?
+        event.time = ktime_to_timeval(ev_time[client->clk_type]);
-                                      mono : real);
        /* Interrupts are disabled, just acquire the lock. */
        spin_lock(&client->buffer_lock);
@@ -198,21 +227,22 @@ static void evdev_events(struct input_handle *handle,
 {
        struct evdev *evdev = handle->private;
        struct evdev_client *client;
-        ktime_t time_mono, time_real;
+        ktime_t ev_time[EV_CLK_MAX];
-        time_mono = ktime_get();
+        ev_time[EV_CLK_MONO] = ktime_get();
-        time_real = ktime_mono_to_real(time_mono);
+        ev_time[EV_CLK_REAL] = ktime_mono_to_real(ev_time[EV_CLK_MONO]);
+        ev_time[EV_CLK_BOOT] = ktime_mono_to_any(ev_time[EV_CLK_MONO],
+                                                 TK_OFFS_BOOT);
        rcu_read_lock();
        client = rcu_dereference(evdev->grab);
        if (client)
-                evdev_pass_values(client, vals, count, time_mono, time_real);
+                evdev_pass_values(client, vals, count, ev_time);
        else
                list_for_each_entry_rcu(client, &evdev->client_list, node)
-                        evdev_pass_values(client, vals, count,
+                        evdev_pass_values(client, vals, count, ev_time);
-                                          time_mono, time_real);
        rcu_read_unlock();
 }
@@ -877,10 +907,8 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
        case EVIOCSCLOCKID:
                if (copy_from_user(&i, p, sizeof(unsigned int)))
                        return -EFAULT;
-                if (i != CLOCK_MONOTONIC && i != CLOCK_REALTIME)
-                        return -EINVAL;
+                return evdev_set_clk_type(client, i);
-                client->clkid = i;
-                return 0;
        case EVIOCGKEYCODE:
                return evdev_handle_get_keycode(dev, p);
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 04217c2e345c..213e3a1903ee 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1974,18 +1974,22 @@ static unsigned int input_estimate_events_per_packet(struct input_dev *dev)
        events = mt_slots + 1; /* count SYN_MT_REPORT and SYN_REPORT */
-        for (i = 0; i < ABS_CNT; i++) {
+        if (test_bit(EV_ABS, dev->evbit)) {
-                if (test_bit(i, dev->absbit)) {
+                for (i = 0; i < ABS_CNT; i++) {
-                        if (input_is_mt_axis(i))
+                        if (test_bit(i, dev->absbit)) {
-                                events += mt_slots;
+                                if (input_is_mt_axis(i))
-                        else
+                                        events += mt_slots;
-                                events++;
+                                else
+                                        events++;
+                        }
                }
        }
-        for (i = 0; i < REL_CNT; i++)
+        if (test_bit(EV_REL, dev->evbit)) {
-                if (test_bit(i, dev->relbit))
+                for (i = 0; i < REL_CNT; i++)
-                        events++;
+                        if (test_bit(i, dev->relbit))
+                                events++;
+        }
        /* Make room for KEY and MSC events */
        events += 7;
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 96ee26c555e0..a5d9b3f3c871 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -559,6 +559,7 @@ config KEYBOARD_SH_KEYSC
 config KEYBOARD_STMPE
        tristate "STMPE keypad support"
        depends on MFD_STMPE
+        depends on OF
        select INPUT_MATRIXKMAP
        help
          Say Y here if you want to use the keypad controller on STMPE I/O
diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index d4dd78a7d56b..883d6aed5b9a 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c
@@ -35,9 +35,13 @@
 struct gpio_button_data {
        const struct gpio_keys_button *button;
        struct input_dev *input;
-        struct timer_list timer;
-        struct work_struct work;
+        struct timer_list release_timer;
-        unsigned int timer_debounce;    /* in msecs */
+        unsigned int release_delay;     /* in msecs, for IRQ-only buttons */
+        struct delayed_work work;
+        unsigned int software_debounce; /* in msecs, for GPIO-driven buttons */
        unsigned int irq;
        spinlock_t lock;
        bool disabled;
@@ -116,11 +120,14 @@ static void gpio_keys_disable_button(struct gpio_button_data *bdata)
 {
        if (!bdata->disabled) {
                /*
-                 * Disable IRQ and possible debouncing timer.
+                 * Disable IRQ and associated timer/work structure.
                 */
                disable_irq(bdata->irq);
-                if (bdata->timer_debounce)
-                        del_timer_sync(&bdata->timer);
+                if (gpio_is_valid(bdata->button->gpio))
+                        cancel_delayed_work_sync(&bdata->work);
+                else
+                        del_timer_sync(&bdata->release_timer);
                bdata->disabled = true;
        }
@@ -343,7 +350,7 @@ static void gpio_keys_gpio_report_event(struct gpio_button_data *bdata)
 static void gpio_keys_gpio_work_func(struct work_struct *work)
 {
        struct gpio_button_data *bdata =
-                container_of(work, struct gpio_button_data, work);
+                container_of(work, struct gpio_button_data, work.work);
        gpio_keys_gpio_report_event(bdata);
@@ -351,13 +358,6 @@ static void gpio_keys_gpio_work_func(struct work_struct *work)
                pm_relax(bdata->input->dev.parent);
 }
-static void gpio_keys_gpio_timer(unsigned long _data)
-{
-        struct gpio_button_data *bdata = (struct gpio_button_data *)_data;
-        schedule_work(&bdata->work);
-}
 static irqreturn_t gpio_keys_gpio_isr(int irq, void *dev_id)
 {
        struct gpio_button_data *bdata = dev_id;
@@ -366,11 +366,10 @@ static irqreturn_t gpio_keys_gpio_isr(int irq, void *dev_id)
        if (bdata->button->wakeup)
                pm_stay_awake(bdata->input->dev.parent);
-        if (bdata->timer_debounce)
-                mod_timer(&bdata->timer,
+        mod_delayed_work(system_wq,
-                        jiffies + msecs_to_jiffies(bdata->timer_debounce));
+                         &bdata->work,
-        else
+                         msecs_to_jiffies(bdata->software_debounce));
-                schedule_work(&bdata->work);
        return IRQ_HANDLED;
 }
@@ -408,7 +407,7 @@ static irqreturn_t gpio_keys_irq_isr(int irq, void *dev_id)
                input_event(input, EV_KEY, button->code, 1);
                input_sync(input);
-                if (!bdata->timer_debounce) {
+                if (!bdata->release_delay) {
                        input_event(input, EV_KEY, button->code, 0);
                        input_sync(input);
                        goto out;
@@ -417,9 +416,9 @@ static irqreturn_t gpio_keys_irq_isr(int irq, void *dev_id)
                bdata->key_pressed = true;
        }
-        if (bdata->timer_debounce)
+        if (bdata->release_delay)
-                mod_timer(&bdata->timer,
+                mod_timer(&bdata->release_timer,
-                        jiffies + msecs_to_jiffies(bdata->timer_debounce));
+                        jiffies + msecs_to_jiffies(bdata->release_delay));
 out:
        spin_unlock_irqrestore(&bdata->lock, flags);
        return IRQ_HANDLED;
@@ -429,10 +428,10 @@ static void gpio_keys_quiesce_key(void *data)
 {
        struct gpio_button_data *bdata = data;
-        if (bdata->timer_debounce)
+        if (gpio_is_valid(bdata->button->gpio))
-                del_timer_sync(&bdata->timer);
+                cancel_delayed_work_sync(&bdata->work);
+        else
-        cancel_work_sync(&bdata->work);
+                del_timer_sync(&bdata->release_timer);
 }
 static int gpio_keys_setup_key(struct platform_device *pdev,
@@ -466,23 +465,25 @@ static int gpio_keys_setup_key(struct platform_device *pdev,
                                        button->debounce_interval * 1000);
                        /* use timer if gpiolib doesn't provide debounce */
                        if (error < 0)
-                                bdata->timer_debounce =
+                                bdata->software_debounce =
                                                button->debounce_interval;
                }
-                irq = gpio_to_irq(button->gpio);
+                if (button->irq) {
-                if (irq < 0) {
+                        bdata->irq = button->irq;
-                        error = irq;
+                } else {
-                        dev_err(dev,
+                        irq = gpio_to_irq(button->gpio);
-                                "Unable to get irq number for GPIO %d, error %d\n",
+                        if (irq < 0) {
-                                button->gpio, error);
+                                error = irq;
-                        return error;
+                                dev_err(dev,
+                                        "Unable to get irq number for GPIO %d, error %d\n",
+                                        button->gpio, error);
+                                return error;
+                        }
+                        bdata->irq = irq;
                }
-                bdata->irq = irq;
-                INIT_WORK(&bdata->work, gpio_keys_gpio_work_func);
+                INIT_DELAYED_WORK(&bdata->work, gpio_keys_gpio_work_func);
-                setup_timer(&bdata->timer,
-                            gpio_keys_gpio_timer, (unsigned long)bdata);
                isr = gpio_keys_gpio_isr;
                irqflags = IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING;
@@ -499,8 +500,8 @@ static int gpio_keys_setup_key(struct platform_device *pdev,
                        return -EINVAL;
                }
-                bdata->timer_debounce = button->debounce_interval;
+                bdata->release_delay = button->debounce_interval;
-                setup_timer(&bdata->timer,
+                setup_timer(&bdata->release_timer,
                            gpio_keys_irq_timer, (unsigned long)bdata);
                isr = gpio_keys_irq_isr;
@@ -510,7 +511,7 @@ static int gpio_keys_setup_key(struct platform_device *pdev,
        input_set_capability(input, button->type ?: EV_KEY, button->code);
        /*
-         * Install custom action to cancel debounce timer and
+         * Install custom action to cancel release timer and
         * workqueue item.
         */
        error = devm_add_action(&pdev->dev, gpio_keys_quiesce_key, bdata);
@@ -618,33 +619,30 @@ gpio_keys_get_devtree_pdata(struct device *dev)
        i = 0;
        for_each_child_of_node(node, pp) {
-                int gpio = -1;
                enum of_gpio_flags flags;
                button = &pdata->buttons[i++];
-                if (!of_find_property(pp, "gpios", NULL)) {
+                button->gpio = of_get_gpio_flags(pp, 0, &flags);
-                        button->irq = irq_of_parse_and_map(pp, 0);
+                if (button->gpio < 0) {
-                        if (button->irq == 0) {
+                        error = button->gpio;
-                                i--;
+                        if (error != -ENOENT) {
-                                pdata->nbuttons--;
-                                dev_warn(dev, "Found button without gpios or irqs\n");
-                                continue;
-                        }
-                } else {
-                        gpio = of_get_gpio_flags(pp, 0, &flags);
-                        if (gpio < 0) {
-                                error = gpio;
                                if (error != -EPROBE_DEFER)
                                        dev_err(dev,
                                                "Failed to get gpio flags, error: %d\n",
                                                error);
                                return ERR_PTR(error);
                        }
+                } else {
+                        button->active_low = flags & OF_GPIO_ACTIVE_LOW;
                }
-                button->gpio = gpio;
+                button->irq = irq_of_parse_and_map(pp, 0);
-                button->active_low = flags & OF_GPIO_ACTIVE_LOW;
+                if (!gpio_is_valid(button->gpio) && !button->irq) {
+                        dev_err(dev, "Found button without gpios or irqs\n");
+                        return ERR_PTR(-EINVAL);
+                }
                if (of_property_read_u32(pp, "linux,code", &button->code)) {
                        dev_err(dev, "Button without keycode: 0x%x\n",
@@ -659,6 +657,8 @@ gpio_keys_get_devtree_pdata(struct device *dev)
                button->wakeup = !!of_get_property(pp, "gpio-key,wakeup", NULL);
+                button->can_disable = !!of_get_property(pp, "linux,can-disable", NULL);
                if (of_property_read_u32(pp, "debounce-interval",
                                         &button->debounce_interval))
                        button->debounce_interval = 5;
diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c
index 610a8af795a1..5b152f25a8e1 100644
--- a/drivers/input/keyboard/hil_kbd.c
+++ b/drivers/input/keyboard/hil_kbd.c
@@ -473,7 +473,7 @@ static int hil_dev_connect(struct serio *serio, struct serio_driver *drv)
        if (error)
                goto bail1;
-        init_completion(&dev->cmd_done);
+        reinit_completion(&dev->cmd_done);
        serio_write(serio, 0);
        serio_write(serio, 0);
        serio_write(serio, HIL_PKT_CMD >> 8);
@@ -482,7 +482,7 @@ static int hil_dev_connect(struct serio *serio, struct serio_driver *drv)
        if (error)
                goto bail1;
-        init_completion(&dev->cmd_done);
+        reinit_completion(&dev->cmd_done);
        serio_write(serio, 0);
        serio_write(serio, 0);
        serio_write(serio, HIL_PKT_CMD >> 8);
@@ -491,7 +491,7 @@ static int hil_dev_connect(struct serio *serio, struct serio_driver *drv)
        if (error)
                goto bail1;
-        init_completion(&dev->cmd_done);
+        reinit_completion(&dev->cmd_done);
        serio_write(serio, 0);
        serio_write(serio, 0);
        serio_write(serio, HIL_PKT_CMD >> 8);
diff --git a/drivers/input/keyboard/stmpe-keypad.c b/drivers/input/keyboard/stmpe-keypad.c
index ef5e67fb567e..fe6e3f22eed7 100644
--- a/drivers/input/keyboard/stmpe-keypad.c
+++ b/drivers/input/keyboard/stmpe-keypad.c
@@ -45,13 +45,14 @@
 #define STMPE_KEYPAD_MAX_ROWS           8
 #define STMPE_KEYPAD_MAX_COLS           8
 #define STMPE_KEYPAD_ROW_SHIFT          3
-#define STMPE_KEYPAD_KEYMAP_SIZE        \
+#define STMPE_KEYPAD_KEYMAP_MAX_SIZE \
        (STMPE_KEYPAD_MAX_ROWS * STMPE_KEYPAD_MAX_COLS)
 /**
 * struct stmpe_keypad_variant - model-specific attributes
 * @auto_increment: whether the KPC_DATA_BYTE register address
 *                  auto-increments on multiple read
+ * @set_pullup: whether the pins need to have their pull-ups set
 * @num_data: number of data bytes
 * @num_normal_data: number of normal keys' data bytes
 * @max_cols: maximum number of columns supported
@@ -61,6 +62,7 @@
 */
 struct stmpe_keypad_variant {
        bool            auto_increment;
+        bool            set_pullup;
        int             num_data;
        int             num_normal_data;
        int             max_cols;
@@ -81,6 +83,7 @@ static const struct stmpe_keypad_variant stmpe_keypad_variants[] = {
        },
        [STMPE2401] = {
                .auto_increment         = false,
+                .set_pullup             = true,
                .num_data               = 3,
                .num_normal_data        = 2,
                .max_cols               = 8,
@@ -90,6 +93,7 @@ static const struct stmpe_keypad_variant stmpe_keypad_variants[] = {
        },
        [STMPE2403] = {
                .auto_increment         = true,
+                .set_pullup             = true,
                .num_data               = 5,
                .num_normal_data        = 3,
                .max_cols               = 8,
@@ -99,16 +103,30 @@ static const struct stmpe_keypad_variant stmpe_keypad_variants[] = {
        },
 };
+/**
+ * struct stmpe_keypad - STMPE keypad state container
+ * @stmpe: pointer to parent STMPE device
+ * @input: spawned input device
+ * @variant: STMPE variant
+ * @debounce_ms: debounce interval, in ms.  Maximum is
+ *               %STMPE_KEYPAD_MAX_DEBOUNCE.
+ * @scan_count: number of key scanning cycles to confirm key data.
+ *              Maximum is %STMPE_KEYPAD_MAX_SCAN_COUNT.
+ * @no_autorepeat: disable key autorepeat
+ * @rows: bitmask for the rows
+ * @cols: bitmask for the columns
+ * @keymap: the keymap
+ */
 struct stmpe_keypad {
        struct stmpe *stmpe;
        struct input_dev *input;
        const struct stmpe_keypad_variant *variant;
-        const struct stmpe_keypad_platform_data *plat;
+        unsigned int debounce_ms;
+        unsigned int scan_count;
+        bool no_autorepeat;
        unsigned int rows;
        unsigned int cols;
+        unsigned short keymap[STMPE_KEYPAD_KEYMAP_MAX_SIZE];
-        unsigned short keymap[STMPE_KEYPAD_KEYMAP_SIZE];
 };
 static int stmpe_keypad_read_data(struct stmpe_keypad *keypad, u8 *data)
@@ -171,7 +189,10 @@ static int stmpe_keypad_altfunc_init(struct stmpe_keypad *keypad)
        unsigned int col_gpios = variant->col_gpios;
        unsigned int row_gpios = variant->row_gpios;
        struct stmpe *stmpe = keypad->stmpe;
+        u8 pureg = stmpe->regs[STMPE_IDX_GPPUR_LSB];
        unsigned int pins = 0;
+        unsigned int pu_pins = 0;
+        int ret;
        int i;
        /*
@@ -188,8 +209,10 @@ static int stmpe_keypad_altfunc_init(struct stmpe_keypad *keypad)
        for (i = 0; i < variant->max_cols; i++) {
                int num = __ffs(col_gpios);
-                if (keypad->cols & (1 << i))
+                if (keypad->cols & (1 << i)) {
                        pins |= 1 << num;
+                        pu_pins |= 1 << num;
+                }
                col_gpios &= ~(1 << num);
        }
@@ -203,20 +226,43 @@ static int stmpe_keypad_altfunc_init(struct stmpe_keypad *keypad)
                row_gpios &= ~(1 << num);
        }
-        return stmpe_set_altfunc(stmpe, pins, STMPE_BLOCK_KEYPAD);
+        ret = stmpe_set_altfunc(stmpe, pins, STMPE_BLOCK_KEYPAD);
+        if (ret)
+                return ret;
+        /*
+         * On STMPE24xx, set pin bias to pull-up on all keypad input
+         * pins (columns), this incidentally happen to be maximum 8 pins
+         * and placed at GPIO0-7 so only the LSB of the pull up register
+         * ever needs to be written.
+         */
+        if (variant->set_pullup) {
+                u8 val;
+                ret = stmpe_reg_read(stmpe, pureg);
+                if (ret)
+                        return ret;
+                /* Do not touch unused pins, may be used for GPIO */
+                val = ret & ~pu_pins;
+                val |= pu_pins;
+                ret = stmpe_reg_write(stmpe, pureg, val);
+        }
+        return 0;
 }
 static int stmpe_keypad_chip_init(struct stmpe_keypad *keypad)
 {
-        const struct stmpe_keypad_platform_data *plat = keypad->plat;
        const struct stmpe_keypad_variant *variant = keypad->variant;
        struct stmpe *stmpe = keypad->stmpe;
        int ret;
-        if (plat->debounce_ms > STMPE_KEYPAD_MAX_DEBOUNCE)
+        if (keypad->debounce_ms > STMPE_KEYPAD_MAX_DEBOUNCE)
                return -EINVAL;
-        if (plat->scan_count > STMPE_KEYPAD_MAX_SCAN_COUNT)
+        if (keypad->scan_count > STMPE_KEYPAD_MAX_SCAN_COUNT)
                return -EINVAL;
        ret = stmpe_enable(stmpe, STMPE_BLOCK_KEYPAD);
@@ -245,7 +291,7 @@ static int stmpe_keypad_chip_init(struct stmpe_keypad *keypad)
        ret = stmpe_set_bits(stmpe, STMPE_KPC_CTRL_MSB,
                             STMPE_KPC_CTRL_MSB_SCAN_COUNT,
-                             plat->scan_count << 4);
+                             keypad->scan_count << 4);
        if (ret < 0)
                return ret;
@@ -253,17 +299,18 @@ static int stmpe_keypad_chip_init(struct stmpe_keypad *keypad)
                              STMPE_KPC_CTRL_LSB_SCAN |
                              STMPE_KPC_CTRL_LSB_DEBOUNCE,
                              STMPE_KPC_CTRL_LSB_SCAN |
-                              (plat->debounce_ms << 1));
+                              (keypad->debounce_ms << 1));
 }
-static void stmpe_keypad_fill_used_pins(struct stmpe_keypad *keypad)
+static void stmpe_keypad_fill_used_pins(struct stmpe_keypad *keypad,
+                                        u32 used_rows, u32 used_cols)
 {
        int row, col;
-        for (row = 0; row < STMPE_KEYPAD_MAX_ROWS; row++) {
+        for (row = 0; row < used_rows; row++) {
-                for (col = 0; col < STMPE_KEYPAD_MAX_COLS; col++) {
+                for (col = 0; col < used_cols; col++) {
                        int code = MATRIX_SCAN_CODE(row, col,
-                                                STMPE_KEYPAD_ROW_SHIFT);
+                                                    STMPE_KEYPAD_ROW_SHIFT);
                        if (keypad->keymap[code] != KEY_RESERVED) {
                                keypad->rows |= 1 << row;
                                keypad->cols |= 1 << col;
@@ -272,51 +319,17 @@ static void stmpe_keypad_fill_used_pins(struct stmpe_keypad *keypad)
        }
 }
-#ifdef CONFIG_OF
-static const struct stmpe_keypad_platform_data *
-stmpe_keypad_of_probe(struct device *dev)
-{
-        struct device_node *np = dev->of_node;
-        struct stmpe_keypad_platform_data *plat;
-        if (!np)
-                return ERR_PTR(-ENODEV);
-        plat = devm_kzalloc(dev, sizeof(*plat), GFP_KERNEL);
-        if (!plat)
-                return ERR_PTR(-ENOMEM);
-        of_property_read_u32(np, "debounce-interval", &plat->debounce_ms);
-        of_property_read_u32(np, "st,scan-count", &plat->scan_count);
-        plat->no_autorepeat = of_property_read_bool(np, "st,no-autorepeat");
-        return plat;
-}
-#else
-static inline const struct stmpe_keypad_platform_data *
-stmpe_keypad_of_probe(struct device *dev)
-{
-        return ERR_PTR(-EINVAL);
-}
-#endif
 static int stmpe_keypad_probe(struct platform_device *pdev)
 {
        struct stmpe *stmpe = dev_get_drvdata(pdev->dev.parent);
-        const struct stmpe_keypad_platform_data *plat;
+        struct device_node *np = pdev->dev.of_node;
        struct stmpe_keypad *keypad;
        struct input_dev *input;
+        u32 rows;
+        u32 cols;
        int error;
        int irq;
-        plat = stmpe->pdata->keypad;
-        if (!plat) {
-                plat = stmpe_keypad_of_probe(&pdev->dev);
-                if (IS_ERR(plat))
-                        return PTR_ERR(plat);
-        }
        irq = platform_get_irq(pdev, 0);
        if (irq < 0)
                return irq;
@@ -326,6 +339,13 @@ static int stmpe_keypad_probe(struct platform_device *pdev)
        if (!keypad)
                return -ENOMEM;
+        keypad->stmpe = stmpe;
+        keypad->variant = &stmpe_keypad_variants[stmpe->partnum];
+        of_property_read_u32(np, "debounce-interval", &keypad->debounce_ms);
+        of_property_read_u32(np, "st,scan-count", &keypad->scan_count);
+        keypad->no_autorepeat = of_property_read_bool(np, "st,no-autorepeat");
        input = devm_input_allocate_device(&pdev->dev);
        if (!input)
                return -ENOMEM;
@@ -334,23 +354,22 @@ static int stmpe_keypad_probe(struct platform_device *pdev)
        input->id.bustype = BUS_I2C;
        input->dev.parent = &pdev->dev;
-        error = matrix_keypad_build_keymap(plat->keymap_data, NULL,
+        error = matrix_keypad_parse_of_params(&pdev->dev, &rows, &cols);
-                                           STMPE_KEYPAD_MAX_ROWS,
+        if (error)
-                                           STMPE_KEYPAD_MAX_COLS,
+                return error;
+        error = matrix_keypad_build_keymap(NULL, NULL, rows, cols,
                                           keypad->keymap, input);
        if (error)
                return error;
        input_set_capability(input, EV_MSC, MSC_SCAN);
-        if (!plat->no_autorepeat)
+        if (!keypad->no_autorepeat)
                __set_bit(EV_REP, input->evbit);
-        stmpe_keypad_fill_used_pins(keypad);
+        stmpe_keypad_fill_used_pins(keypad, rows, cols);
-        keypad->stmpe = stmpe;
-        keypad->plat = plat;
        keypad->input = input;
-        keypad->variant = &stmpe_keypad_variants[stmpe->partnum];
        error = stmpe_keypad_chip_init(keypad);
        if (error < 0)
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index d125a019383f..d88d73d83552 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -881,6 +881,34 @@ static void alps_get_finger_coordinate_v7(struct input_mt_pos *mt,
                                          unsigned char *pkt,
                                          unsigned char pkt_id)
 {
+        /*
+         *       packet-fmt    b7   b6    b5   b4   b3   b2   b1   b0
+         * Byte0 TWO & MULTI    L    1     R    M    1 Y0-2 Y0-1 Y0-0
+         * Byte0 NEW            L    1  X1-5    1    1 Y0-2 Y0-1 Y0-0
+         * Byte1            Y0-10 Y0-9  Y0-8 Y0-7 Y0-6 Y0-5 Y0-4 Y0-3
+         * Byte2            X0-11    1 X0-10 X0-9 X0-8 X0-7 X0-6 X0-5
+         * Byte3            X1-11    1  X0-4 X0-3    1 X0-2 X0-1 X0-0
+         * Byte4 TWO        X1-10  TWO  X1-9 X1-8 X1-7 X1-6 X1-5 X1-4
+         * Byte4 MULTI      X1-10  TWO  X1-9 X1-8 X1-7 X1-6 Y1-5    1
+         * Byte4 NEW        X1-10  TWO  X1-9 X1-8 X1-7 X1-6    0    0
+         * Byte5 TWO & NEW  Y1-10    0  Y1-9 Y1-8 Y1-7 Y1-6 Y1-5 Y1-4
+         * Byte5 MULTI      Y1-10    0  Y1-9 Y1-8 Y1-7 Y1-6  F-1  F-0
+         * L:         Left button
+         * R / M:     Non-clickpads: Right / Middle button
+         *            Clickpads: When > 2 fingers are down, and some fingers
+         *            are in the button area, then the 2 coordinates reported
+         *            are for fingers outside the button area and these report
+         *            extra fingers being present in the right / left button
+         *            area. Note these fingers are not added to the F field!
+         *            so if a TWO packet is received and R = 1 then there are
+         *            3 fingers down, etc.
+         * TWO:       1: Two touches present, byte 0/4/5 are in TWO fmt
+         *            0: If byte 4 bit 0 is 1, then byte 0/4/5 are in MULTI fmt
+         *               otherwise byte 0 bit 4 must be set and byte 0/4/5 are
+         *               in NEW fmt
+         * F:         Number of fingers - 3, 0 means 3 fingers, 1 means 4 ...
+         */
        mt[0].x = ((pkt[2] & 0x80) << 4);
        mt[0].x |= ((pkt[2] & 0x3F) << 5);
        mt[0].x |= ((pkt[3] & 0x30) >> 1);
@@ -919,18 +947,21 @@ static void alps_get_finger_coordinate_v7(struct input_mt_pos *mt,
 static int alps_get_mt_count(struct input_mt_pos *mt)
 {
-        int i;
+        int i, fingers = 0;
-        for (i = 0; i < MAX_TOUCHES && mt[i].x != 0 && mt[i].y != 0; i++)
+        for (i = 0; i < MAX_TOUCHES; i++) {
-                /* empty */;
+                if (mt[i].x != 0 || mt[i].y != 0)
+                        fingers++;
+        }
-        return i;
+        return fingers;
 }
 static int alps_decode_packet_v7(struct alps_fields *f,
                                  unsigned char *p,
                                  struct psmouse *psmouse)
 {
+        struct alps_data *priv = psmouse->private;
        unsigned char pkt_id;
        pkt_id = alps_get_packet_id_v7(p);
@@ -938,19 +969,52 @@ static int alps_decode_packet_v7(struct alps_fields *f,
                return 0;
        if (pkt_id == V7_PACKET_ID_UNKNOWN)
                return -1;
+        /*
+         * NEW packets are send to indicate a discontinuity in the finger
+         * coordinate reporting. Specifically a finger may have moved from
+         * slot 0 to 1 or vice versa. INPUT_MT_TRACK takes care of this for
+         * us.
+         *
+         * NEW packets have 3 problems:
+         * 1) They do not contain middle / right button info (on non clickpads)
+         *    this can be worked around by preserving the old button state
+         * 2) They do not contain an accurate fingercount, and they are
+         *    typically send when the number of fingers changes. We cannot use
+         *    the old finger count as that may mismatch with the amount of
+         *    touch coordinates we've available in the NEW packet
+         * 3) Their x data for the second touch is inaccurate leading to
+         *    a possible jump of the x coordinate by 16 units when the first
+         *    non NEW packet comes in
+         * Since problems 2 & 3 cannot be worked around, just ignore them.
+         */
+        if (pkt_id == V7_PACKET_ID_NEW)
+                return 1;
        alps_get_finger_coordinate_v7(f->mt, p, pkt_id);
-        if (pkt_id == V7_PACKET_ID_TWO || pkt_id == V7_PACKET_ID_MULTI) {
+        if (pkt_id == V7_PACKET_ID_TWO)
-                f->left = (p[0] & 0x80) >> 7;
+                f->fingers = alps_get_mt_count(f->mt);
+        else /* pkt_id == V7_PACKET_ID_MULTI */
+                f->fingers = 3 + (p[5] & 0x03);
+        f->left = (p[0] & 0x80) >> 7;
+        if (priv->flags & ALPS_BUTTONPAD) {
+                if (p[0] & 0x20)
+                        f->fingers++;
+                if (p[0] & 0x10)
+                        f->fingers++;
+        } else {
                f->right = (p[0] & 0x20) >> 5;
                f->middle = (p[0] & 0x10) >> 4;
        }
-        if (pkt_id == V7_PACKET_ID_TWO)
+        /* Sometimes a single touch is reported in mt[1] rather then mt[0] */
-                f->fingers = alps_get_mt_count(f->mt);
+        if (f->fingers == 1 && f->mt[0].x == 0 && f->mt[0].y == 0) {
-        else if (pkt_id == V7_PACKET_ID_MULTI)
+                f->mt[0].x = f->mt[1].x;
-                f->fingers = 3 + (p[5] & 0x03);
+                f->mt[0].y = f->mt[1].y;
+                f->mt[1].x = 0;
+                f->mt[1].y = 0;
+        }
        return 0;
 }
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index f2b978026407..6e22682c8255 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1097,6 +1097,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
 * Asus UX31               0x361f00        20, 15, 0e      clickpad
 * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
 * Avatar AVIU-145A2       0x361f00        ?               clickpad
+ * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
+ * Fujitsu LIFEBOOK E554   0x570f01        40, 14, 0c      2 hw buttons
 * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
 * Gigabyte U2442          0x450f01        58, 17, 0c      2 hw buttons
 * Lenovo L430             0x350f02        b9, 15, 0c      2 hw buttons (*)
@@ -1475,6 +1477,20 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
                },
        },
+        {
+                /* Fujitsu LIFEBOOK E554  does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E554"),
+                },
+        },
+        {
+                /* Fujitsu LIFEBOOK E544  does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E544"),
+                },
+        },
 #endif
        { }
 };
@@ -1520,6 +1536,8 @@ static int elantech_set_properties(struct elantech_data *etd)
                case 7:
                case 8:
                case 9:
+                case 10:
+                case 13:
                        etd->hw_version = 4;
                        break;
                default:
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index f9472920d986..23e26e0768b5 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -135,8 +135,9 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
                1232, 5710, 1156, 4696
        },
        {
-                (const char * const []){"LEN0034", "LEN0036", "LEN0039",
+                (const char * const []){"LEN0034", "LEN0036", "LEN0037",
-                                        "LEN2002", "LEN2004", NULL},
+                                        "LEN0039", "LEN2002", "LEN2004",
+                                        NULL},
                1024, 5112, 2024, 4832
        },
        {
@@ -165,7 +166,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
        "LEN0034", /* T431s, L440, L540, T540, W540, X1 Carbon 2nd */
        "LEN0035", /* X240 */
        "LEN0036", /* T440 */
-        "LEN0037",
+        "LEN0037", /* X1 Carbon 2nd */
        "LEN0038",
        "LEN0039", /* T440s */
        "LEN0041",
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 30c8b6998808..354d47ecd66a 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -227,6 +227,7 @@ TRACKPOINT_INT_ATTR(thresh, TP_THRESH, TP_DEF_THRESH);
 TRACKPOINT_INT_ATTR(upthresh, TP_UP_THRESH, TP_DEF_UP_THRESH);
 TRACKPOINT_INT_ATTR(ztime, TP_Z_TIME, TP_DEF_Z_TIME);
 TRACKPOINT_INT_ATTR(jenks, TP_JENKS_CURV, TP_DEF_JENKS_CURV);
+TRACKPOINT_INT_ATTR(drift_time, TP_DRIFT_TIME, TP_DEF_DRIFT_TIME);
 TRACKPOINT_BIT_ATTR(press_to_select, TP_TOGGLE_PTSON, TP_MASK_PTSON, 0,
                    TP_DEF_PTSON);
@@ -246,6 +247,7 @@ static struct attribute *trackpoint_attrs[] = {
        &psmouse_attr_upthresh.dattr.attr,
        &psmouse_attr_ztime.dattr.attr,
        &psmouse_attr_jenks.dattr.attr,
+        &psmouse_attr_drift_time.dattr.attr,
        &psmouse_attr_press_to_select.dattr.attr,
        &psmouse_attr_skipback.dattr.attr,
        &psmouse_attr_ext_dev.dattr.attr,
@@ -312,6 +314,7 @@ static int trackpoint_sync(struct psmouse *psmouse, bool in_power_on_state)
        TRACKPOINT_UPDATE(in_power_on_state, psmouse, tp, upthresh);
        TRACKPOINT_UPDATE(in_power_on_state, psmouse, tp, ztime);
        TRACKPOINT_UPDATE(in_power_on_state, psmouse, tp, jenks);
+        TRACKPOINT_UPDATE(in_power_on_state, psmouse, tp, drift_time);
        /* toggles */
        TRACKPOINT_UPDATE(in_power_on_state, psmouse, tp, press_to_select);
@@ -332,6 +335,7 @@ static void trackpoint_defaults(struct trackpoint_data *tp)
        TRACKPOINT_SET_POWER_ON_DEFAULT(tp, upthresh);
        TRACKPOINT_SET_POWER_ON_DEFAULT(tp, ztime);
        TRACKPOINT_SET_POWER_ON_DEFAULT(tp, jenks);
+        TRACKPOINT_SET_POWER_ON_DEFAULT(tp, drift_time);
        TRACKPOINT_SET_POWER_ON_DEFAULT(tp, inertia);
        /* toggles */
diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h
index ecd0547964a5..5617ed3a7d7a 100644
--- a/drivers/input/mouse/trackpoint.h
+++ b/drivers/input/mouse/trackpoint.h
@@ -70,6 +70,9 @@
 #define TP_UP_THRESH            0x5A    /* Used to generate a 'click' on Z-axis */
 #define TP_Z_TIME               0x5E    /* How sharp of a press */
 #define TP_JENKS_CURV           0x5D    /* Minimum curvature for double click */
+#define TP_DRIFT_TIME           0x5F    /* How long a 'hands off' condition */
+                                        /* must last (x*107ms) for drift */
+                                        /* correction to occur */
 /*
 * Toggling Flag bits
@@ -120,6 +123,7 @@
 #define TP_DEF_UP_THRESH        0xFF
 #define TP_DEF_Z_TIME           0x26
 #define TP_DEF_JENKS_CURV       0x87
+#define TP_DEF_DRIFT_TIME       0x05
 /* Toggles */
 #define TP_DEF_MB               0x00
@@ -137,6 +141,7 @@ struct trackpoint_data
        unsigned char draghys, mindrag;
        unsigned char thresh, upthresh;
        unsigned char ztime, jenks;
+        unsigned char drift_time;
        /* toggles */
        unsigned char press_to_select;
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index c66d1b53843e..c11556563ef0 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -152,6 +152,14 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
                },
        },
        {
+                /* Medion Akoya E7225 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Medion"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Akoya E7225"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+                },
+        },
+        {
                /* Blue FB5601 */
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "blue"),
@@ -415,6 +423,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
                },
        },
        {
+                /* Acer Aspire 7738 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"),
+                },
+        },
+        {
                /* Gericom Bellagio */
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
@@ -745,6 +760,35 @@ static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = {
        { }
 };
+/*
+ * Some laptops need keyboard reset before probing for the trackpad to get
+ * it detected, initialised & finally work.
+ */
+static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
+        {
+                /* Gigabyte P35 v2 - Elantech touchpad */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"),
+                },
+        },
+                {
+                /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X3"),
+                },
+        },
+        {
+                /* Gigabyte P34 - Elantech touchpad */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
+                },
+        },
+        { }
+};
 #endif /* CONFIG_X86 */
 #ifdef CONFIG_PNP
@@ -1040,6 +1084,9 @@ static int __init i8042_platform_init(void)
        if (dmi_check_system(i8042_dmi_dritek_table))
                i8042_dritek = true;
+        if (dmi_check_system(i8042_dmi_kbdreset_table))
+                i8042_kbdreset = true;
        /*
         * A20 was already enabled during early kernel init. But some buggy
         * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 924e4bf357fb..986a71c614b0 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -67,6 +67,10 @@ static bool i8042_notimeout;
 module_param_named(notimeout, i8042_notimeout, bool, 0);
 MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");
+static bool i8042_kbdreset;
+module_param_named(kbdreset, i8042_kbdreset, bool, 0);
+MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port");
 #ifdef CONFIG_X86
 static bool i8042_dritek;
 module_param_named(dritek, i8042_dritek, bool, 0);
@@ -790,6 +794,16 @@ static int __init i8042_check_aux(void)
                return -1;
 /*
+ * Reset keyboard (needed on some laptops to successfully detect
+ * touchpad, e.g., some Gigabyte laptop models with Elantech
+ * touchpads).
+ */
+        if (i8042_kbdreset) {
+                pr_warn("Attempting to reset device connected to KBD port\n");
+                i8042_kbd_write(NULL, (unsigned char) 0xff);
+        }
+/*
 * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and
 * used it for a PCI card or somethig else.
 */
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index bb070206223c..95ee92a91bd2 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -99,13 +99,9 @@
 #define MXT_T6_STATUS_COMSERR   (1 << 2)
 /* MXT_GEN_POWER_T7 field */
-struct t7_config {
+#define MXT_POWER_IDLEACQINT    0
-        u8 idle;
+#define MXT_POWER_ACTVACQINT    1
-        u8 active;
+#define MXT_POWER_ACTV2IDLETO   2
-} __packed;
-#define MXT_POWER_CFG_RUN               0
-#define MXT_POWER_CFG_DEEPSLEEP         1
 /* MXT_GEN_ACQUIRE_T8 field */
 #define MXT_ACQUIRE_CHRGTIME    0
@@ -117,6 +113,7 @@ struct t7_config {
 #define MXT_ACQUIRE_ATCHCALSTHR 7
 /* MXT_TOUCH_MULTI_T9 field */
+#define MXT_TOUCH_CTRL          0
 #define MXT_T9_ORIENT           9
 #define MXT_T9_RANGE            18
@@ -256,7 +253,6 @@ struct mxt_data {
        bool update_input;
        u8 last_message_count;
        u8 num_touchids;
-        struct t7_config t7_cfg;
        /* Cached parameters from object table */
        u16 T5_address;
@@ -672,6 +668,20 @@ static void mxt_proc_t6_messages(struct mxt_data *data, u8 *msg)
        data->t6_status = status;
 }
+static int mxt_write_object(struct mxt_data *data,
+                                 u8 type, u8 offset, u8 val)
+{
+        struct mxt_object *object;
+        u16 reg;
+        object = mxt_get_object(data, type);
+        if (!object || offset >= mxt_obj_size(object))
+                return -EINVAL;
+        reg = object->start_address;
+        return mxt_write_reg(data->client, reg + offset, val);
+}
 static void mxt_input_button(struct mxt_data *data, u8 *message)
 {
        struct input_dev *input = data->input_dev;
@@ -1742,60 +1752,6 @@ err_free_object_table:
        return error;
 }
-static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
-{
-        struct device *dev = &data->client->dev;
-        int error;
-        struct t7_config *new_config;
-        struct t7_config deepsleep = { .active = 0, .idle = 0 };
-        if (sleep == MXT_POWER_CFG_DEEPSLEEP)
-                new_config = &deepsleep;
-        else
-                new_config = &data->t7_cfg;
-        error = __mxt_write_reg(data->client, data->T7_address,
-                                sizeof(data->t7_cfg), new_config);
-        if (error)
-                return error;
-        dev_dbg(dev, "Set T7 ACTV:%d IDLE:%d\n",
-                new_config->active, new_config->idle);
-        return 0;
-}
-static int mxt_init_t7_power_cfg(struct mxt_data *data)
-{
-        struct device *dev = &data->client->dev;
-        int error;
-        bool retry = false;
-recheck:
-        error = __mxt_read_reg(data->client, data->T7_address,
-                                sizeof(data->t7_cfg), &data->t7_cfg);
-        if (error)
-                return error;
-        if (data->t7_cfg.active == 0 || data->t7_cfg.idle == 0) {
-                if (!retry) {
-                        dev_dbg(dev, "T7 cfg zero, resetting\n");
-                        mxt_soft_reset(data);
-                        retry = true;
-                        goto recheck;
-                } else {
-                        dev_dbg(dev, "T7 cfg zero after reset, overriding\n");
-                        data->t7_cfg.active = 20;
-                        data->t7_cfg.idle = 100;
-                        return mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
-                }
-        }
-        dev_dbg(dev, "Initialized power cfg: ACTV %d, IDLE %d\n",
-                data->t7_cfg.active, data->t7_cfg.idle);
-        return 0;
-}
 static int mxt_configure_objects(struct mxt_data *data,
                                 const struct firmware *cfg)
 {
@@ -1809,12 +1765,6 @@ static int mxt_configure_objects(struct mxt_data *data,
                        dev_warn(dev, "Error %d updating config\n", error);
        }
-        error = mxt_init_t7_power_cfg(data);
-        if (error) {
-                dev_err(dev, "Failed to initialize power cfg\n");
-                return error;
-        }
        error = mxt_initialize_t9_input_device(data);
        if (error)
                return error;
@@ -2093,15 +2043,16 @@ static const struct attribute_group mxt_attr_group = {
 static void mxt_start(struct mxt_data *data)
 {
-        mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
+        /* Touch enable */
+        mxt_write_object(data,
-        /* Recalibrate since chip has been in deep sleep */
+                        MXT_TOUCH_MULTI_T9, MXT_TOUCH_CTRL, 0x83);
-        mxt_t6_command(data, MXT_COMMAND_CALIBRATE, 1, false);
 }
 static void mxt_stop(struct mxt_data *data)
 {
-        mxt_set_t7_power_cfg(data, MXT_POWER_CFG_DEEPSLEEP);
+        /* Touch disable */
+        mxt_write_object(data,
+                        MXT_TOUCH_MULTI_T9, MXT_TOUCH_CTRL, 0);
 }
 static int mxt_input_open(struct input_dev *dev)
@@ -2266,6 +2217,8 @@ static int __maybe_unused mxt_resume(struct device *dev)
        struct mxt_data *data = i2c_get_clientdata(client);
        struct input_dev *input_dev = data->input_dev;
+        mxt_soft_reset(data);
        mutex_lock(&input_dev->mutex);
        if (input_dev->users)
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index 3793fcc7e5db..d4c24fb7704f 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -850,9 +850,11 @@ static int edt_ft5x06_ts_identify(struct i2c_client *client,
 }
 #define EDT_ATTR_CHECKSET(name, reg) \
+do {                                                            \
        if (pdata->name >= edt_ft5x06_attr_##name.limit_low &&          \
            pdata->name <= edt_ft5x06_attr_##name.limit_high)           \
-                edt_ft5x06_register_write(tsdata, reg, pdata->name)
+                edt_ft5x06_register_write(tsdata, reg, pdata->name);    \
+} while (0)
 #define EDT_GET_PROP(name, reg) {                               \
        u32 val;                                                \
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 98024856df07..59de6364a910 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -4284,7 +4284,6 @@ static int alloc_hpet_msi(unsigned int irq, unsigned int id)
 }
 struct irq_remap_ops amd_iommu_irq_ops = {
-        .supported              = amd_iommu_supported,
        .prepare                = amd_iommu_prepare,
        .enable                 = amd_iommu_enable,
        .disable                = amd_iommu_disable,
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index b0522f15730f..9a20248e7068 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -2014,9 +2014,6 @@ static bool detect_ivrs(void)
        /* Make sure ACS will be enabled during PCI probe */
        pci_request_acs();
-        if (!disable_irq_remap)
-                amd_iommu_irq_remap = true;
        return true;
 }
@@ -2123,12 +2120,14 @@ static int __init iommu_go_to_state(enum iommu_init_state state)
 #ifdef CONFIG_IRQ_REMAP
 int __init amd_iommu_prepare(void)
 {
-        return iommu_go_to_state(IOMMU_ACPI_FINISHED);
+        int ret;
-}
-int __init amd_iommu_supported(void)
+        amd_iommu_irq_remap = true;
-{
-        return amd_iommu_irq_remap ? 1 : 0;
+        ret = iommu_go_to_state(IOMMU_ACPI_FINISHED);
+        if (ret)
+                return ret;
+        return amd_iommu_irq_remap ? 0 : -ENODEV;
 }
 int __init amd_iommu_enable(void)
diff --git a/drivers/iommu/amd_iommu_proto.h b/drivers/iommu/amd_iommu_proto.h
index 95ed6deae47f..861af9d8338a 100644
--- a/drivers/iommu/amd_iommu_proto.h
+++ b/drivers/iommu/amd_iommu_proto.h
@@ -33,7 +33,6 @@ extern void amd_iommu_init_notifier(void);
 extern void amd_iommu_init_api(void);
 /* Needed for interrupt remapping */
-extern int amd_iommu_supported(void);
 extern int amd_iommu_prepare(void);
 extern int amd_iommu_enable(void);
 extern void amd_iommu_disable(void);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 1232336b960e..40dfbc0444c0 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4029,14 +4029,6 @@ static int device_notifier(struct notifier_block *nb,
        if (action != BUS_NOTIFY_REMOVED_DEVICE)
                return 0;
-        /*
-         * If the device is still attached to a device driver we can't
-         * tear down the domain yet as DMA mappings may still be in use.
-         * Wait for the BUS_NOTIFY_UNBOUND_DRIVER event to do that.
-         */
-        if (action == BUS_NOTIFY_DEL_DEVICE && dev->driver != NULL)
-                return 0;
        domain = find_domain(dev);
        if (!domain)
                return 0;
@@ -4428,6 +4420,10 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
                                domain_remove_one_dev_info(old_domain, dev);
                        else
                                domain_remove_dev_info(old_domain);
+                        if (!domain_type_is_vm_or_si(old_domain) &&
+                             list_empty(&old_domain->devices))
+                                domain_exit(old_domain);
                }
        }
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index a55b207b9425..14de1ab223c8 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -32,8 +32,9 @@ struct hpet_scope {
 };
 #define IR_X2APIC_MODE(mode) (mode ? (1 << 11) : 0)
-#define IRTE_DEST(dest) ((x2apic_mode) ? dest : dest << 8)
+#define IRTE_DEST(dest) ((eim_mode) ? dest : dest << 8)
+static int __read_mostly eim_mode;
 static struct ioapic_scope ir_ioapic[MAX_IO_APICS];
 static struct hpet_scope ir_hpet[MAX_HPET_TBS];
@@ -481,11 +482,11 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)
        if (iommu->ir_table)
                return 0;
-        ir_table = kzalloc(sizeof(struct ir_table), GFP_ATOMIC);
+        ir_table = kzalloc(sizeof(struct ir_table), GFP_KERNEL);
        if (!ir_table)
                return -ENOMEM;
-        pages = alloc_pages_node(iommu->node, GFP_ATOMIC | __GFP_ZERO,
+        pages = alloc_pages_node(iommu->node, GFP_KERNEL | __GFP_ZERO,
                                 INTR_REMAP_PAGE_ORDER);
        if (!pages) {
@@ -566,13 +567,27 @@ static int __init dmar_x2apic_optout(void)
        return dmar->flags & DMAR_X2APIC_OPT_OUT;
 }
-static int __init intel_irq_remapping_supported(void)
+static void __init intel_cleanup_irq_remapping(void)
+{
+        struct dmar_drhd_unit *drhd;
+        struct intel_iommu *iommu;
+        for_each_iommu(iommu, drhd) {
+                if (ecap_ir_support(iommu->ecap)) {
+                        iommu_disable_irq_remapping(iommu);
+                        intel_teardown_irq_remapping(iommu);
+                }
+        }
+        if (x2apic_supported())
+                pr_warn("Failed to enable irq remapping.  You are vulnerable to irq-injection attacks.\n");
+}
+static int __init intel_prepare_irq_remapping(void)
 {
        struct dmar_drhd_unit *drhd;
        struct intel_iommu *iommu;
-        if (disable_irq_remap)
-                return 0;
        if (irq_remap_broken) {
                printk(KERN_WARNING
                        "This system BIOS has enabled interrupt remapping\n"
@@ -581,38 +596,45 @@ static int __init intel_irq_remapping_supported(void)
                        "interrupt remapping is being disabled.  Please\n"
                        "contact your BIOS vendor for an update\n");
                add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
-                disable_irq_remap = 1;
+                return -ENODEV;
-                return 0;
        }
+        if (dmar_table_init() < 0)
+                return -ENODEV;
        if (!dmar_ir_support())
-                return 0;
+                return -ENODEV;
+        if (parse_ioapics_under_ir() != 1) {
+                printk(KERN_INFO "Not enabling interrupt remapping\n");
+                goto error;
+        }
+        /* First make sure all IOMMUs support IRQ remapping */
        for_each_iommu(iommu, drhd)
                if (!ecap_ir_support(iommu->ecap))
-                        return 0;
+                        goto error;
-        return 1;
+        /* Do the allocations early */
+        for_each_iommu(iommu, drhd)
+                if (intel_setup_irq_remapping(iommu))
+                        goto error;
+        return 0;
+error:
+        intel_cleanup_irq_remapping();
+        return -ENODEV;
 }
 static int __init intel_enable_irq_remapping(void)
 {
        struct dmar_drhd_unit *drhd;
        struct intel_iommu *iommu;
-        bool x2apic_present;
        int setup = 0;
        int eim = 0;
-        x2apic_present = x2apic_supported();
+        if (x2apic_supported()) {
-        if (parse_ioapics_under_ir() != 1) {
-                printk(KERN_INFO "Not enable interrupt remapping\n");
-                goto error;
-        }
-        if (x2apic_present) {
-                pr_info("Queued invalidation will be enabled to support x2apic and Intr-remapping.\n");
                eim = !dmar_x2apic_optout();
                if (!eim)
                        printk(KERN_WARNING
@@ -646,16 +668,15 @@ static int __init intel_enable_irq_remapping(void)
        /*
         * check for the Interrupt-remapping support
         */
-        for_each_iommu(iommu, drhd) {
+        for_each_iommu(iommu, drhd)
-                if (!ecap_ir_support(iommu->ecap))
-                        continue;
                if (eim && !ecap_eim_support(iommu->ecap)) {
                        printk(KERN_INFO "DRHD %Lx: EIM not supported by DRHD, "
                               " ecap %Lx\n", drhd->reg_base_addr, iommu->ecap);
-                        goto error;
+                        eim = 0;
                }
-        }
+        eim_mode = eim;
+        if (eim)
+                pr_info("Queued invalidation will be enabled to support x2apic and Intr-remapping.\n");
        /*
         * Enable queued invalidation for all the DRHD's.
@@ -675,12 +696,6 @@ static int __init intel_enable_irq_remapping(void)
         * Setup Interrupt-remapping for all the DRHD's now.
         */
        for_each_iommu(iommu, drhd) {
-                if (!ecap_ir_support(iommu->ecap))
-                        continue;
-                if (intel_setup_irq_remapping(iommu))
-                        goto error;
                iommu_set_irq_remapping(iommu, eim);
                setup = 1;
        }
@@ -702,15 +717,7 @@ static int __init intel_enable_irq_remapping(void)
        return eim ? IRQ_REMAP_X2APIC_MODE : IRQ_REMAP_XAPIC_MODE;
 error:
-        for_each_iommu(iommu, drhd)
+        intel_cleanup_irq_remapping();
-                if (ecap_ir_support(iommu->ecap)) {
-                        iommu_disable_irq_remapping(iommu);
-                        intel_teardown_irq_remapping(iommu);
-                }
-        if (x2apic_present)
-                pr_warn("Failed to enable irq remapping.  You are vulnerable to irq-injection attacks.\n");
        return -1;
 }
@@ -1199,8 +1206,7 @@ static int intel_alloc_hpet_msi(unsigned int irq, unsigned int id)
 }
 struct irq_remap_ops intel_irq_remap_ops = {
-        .supported              = intel_irq_remapping_supported,
+        .prepare                = intel_prepare_irq_remapping,
-        .prepare                = dmar_table_init,
        .enable                 = intel_enable_irq_remapping,
        .disable                = disable_irq_remapping,
        .reenable               = reenable_irq_remapping,
diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
index 68dfb0fd5ee9..748693192c20 100644
--- a/drivers/iommu/ipmmu-vmsa.c
+++ b/drivers/iommu/ipmmu-vmsa.c
@@ -558,7 +558,7 @@ static pmd_t *ipmmu_alloc_pmd(struct ipmmu_vmsa_device *mmu, pgd_t *pgd,
 static u64 ipmmu_page_prot(unsigned int prot, u64 type)
 {
-        u64 pgprot = ARM_VMSA_PTE_XN | ARM_VMSA_PTE_nG | ARM_VMSA_PTE_AF
+        u64 pgprot = ARM_VMSA_PTE_nG | ARM_VMSA_PTE_AF
                   | ARM_VMSA_PTE_SH_IS | ARM_VMSA_PTE_AP_UNPRIV
                   | ARM_VMSA_PTE_NS | type;
@@ -568,8 +568,8 @@ static u64 ipmmu_page_prot(unsigned int prot, u64 type)
        if (prot & IOMMU_CACHE)
                pgprot |= IMMAIR_ATTR_IDX_WBRWA << ARM_VMSA_PTE_ATTRINDX_SHIFT;
-        if (prot & IOMMU_EXEC)
+        if (prot & IOMMU_NOEXEC)
-                pgprot &= ~ARM_VMSA_PTE_XN;
+                pgprot |= ARM_VMSA_PTE_XN;
        else if (!(prot & (IOMMU_READ | IOMMU_WRITE)))
                /* If no access create a faulting entry to avoid TLB fills. */
                pgprot &= ~ARM_VMSA_PTE_PAGE;
diff --git a/drivers/iommu/irq_remapping.c b/drivers/iommu/irq_remapping.c
index 89c4846683be..390079ee1350 100644
--- a/drivers/iommu/irq_remapping.c
+++ b/drivers/iommu/irq_remapping.c
@@ -17,12 +17,11 @@
 #include "irq_remapping.h"
 int irq_remapping_enabled;
-int disable_irq_remap;
 int irq_remap_broken;
 int disable_sourceid_checking;
 int no_x2apic_optout;
+static int disable_irq_remap;
 static struct irq_remap_ops *remap_ops;
 static int msi_alloc_remapped_irq(struct pci_dev *pdev, int irq, int nvec);
@@ -194,45 +193,32 @@ static __init int setup_irqremap(char *str)
 }
 early_param("intremap", setup_irqremap);
-void __init setup_irq_remapping_ops(void)
-{
-        remap_ops = &intel_irq_remap_ops;
-#ifdef CONFIG_AMD_IOMMU
-        if (amd_iommu_irq_ops.prepare() == 0)
-                remap_ops = &amd_iommu_irq_ops;
-#endif
-}
 void set_irq_remapping_broken(void)
 {
        irq_remap_broken = 1;
 }
-int irq_remapping_supported(void)
+int __init irq_remapping_prepare(void)
 {
        if (disable_irq_remap)
-                return 0;
+                return -ENOSYS;
-        if (!remap_ops || !remap_ops->supported)
-                return 0;
-        return remap_ops->supported();
-}
-int __init irq_remapping_prepare(void)
+        if (intel_irq_remap_ops.prepare() == 0)
-{
+                remap_ops = &intel_irq_remap_ops;
-        if (!remap_ops || !remap_ops->prepare)
+        else if (IS_ENABLED(CONFIG_AMD_IOMMU) &&
-                return -ENODEV;
+                 amd_iommu_irq_ops.prepare() == 0)
+                remap_ops = &amd_iommu_irq_ops;
+        else
+                return -ENOSYS;
-        return remap_ops->prepare();
+        return 0;
 }
 int __init irq_remapping_enable(void)
 {
        int ret;
-        if (!remap_ops || !remap_ops->enable)
+        if (!remap_ops->enable)
                return -ENODEV;
        ret = remap_ops->enable();
@@ -245,22 +231,16 @@ int __init irq_remapping_enable(void)
 void irq_remapping_disable(void)
 {
-        if (!irq_remapping_enabled ||
+        if (irq_remapping_enabled && remap_ops->disable)
-            !remap_ops ||
+                remap_ops->disable();
-            !remap_ops->disable)
-                return;
-        remap_ops->disable();
 }
 int irq_remapping_reenable(int mode)
 {
-        if (!irq_remapping_enabled ||
+        if (irq_remapping_enabled && remap_ops->reenable)
-            !remap_ops ||
+                return remap_ops->reenable(mode);
-            !remap_ops->reenable)
-                return 0;
-        return remap_ops->reenable(mode);
+        return 0;
 }
 int __init irq_remap_enable_fault_handling(void)
@@ -268,7 +248,7 @@ int __init irq_remap_enable_fault_handling(void)
        if (!irq_remapping_enabled)
                return 0;
-        if (!remap_ops || !remap_ops->enable_faulting)
+        if (!remap_ops->enable_faulting)
                return -ENODEV;
        return remap_ops->enable_faulting();
@@ -279,7 +259,7 @@ int setup_ioapic_remapped_entry(int irq,
                                unsigned int destination, int vector,
                                struct io_apic_irq_attr *attr)
 {
-        if (!remap_ops || !remap_ops->setup_ioapic_entry)
+        if (!remap_ops->setup_ioapic_entry)
                return -ENODEV;
        return remap_ops->setup_ioapic_entry(irq, entry, destination,
@@ -289,8 +269,7 @@ int setup_ioapic_remapped_entry(int irq,
 static int set_remapped_irq_affinity(struct irq_data *data,
                                     const struct cpumask *mask, bool force)
 {
-        if (!config_enabled(CONFIG_SMP) || !remap_ops ||
+        if (!config_enabled(CONFIG_SMP) || !remap_ops->set_affinity)
-            !remap_ops->set_affinity)
                return 0;
        return remap_ops->set_affinity(data, mask, force);
@@ -300,10 +279,7 @@ void free_remapped_irq(int irq)
 {
        struct irq_cfg *cfg = irq_cfg(irq);
-        if (!remap_ops || !remap_ops->free_irq)
+        if (irq_remapped(cfg) && remap_ops->free_irq)
-                return;
-        if (irq_remapped(cfg))
                remap_ops->free_irq(irq);
 }
@@ -315,13 +291,13 @@ void compose_remapped_msi_msg(struct pci_dev *pdev,
        if (!irq_remapped(cfg))
                native_compose_msi_msg(pdev, irq, dest, msg, hpet_id);
-        else if (remap_ops && remap_ops->compose_msi_msg)
+        else if (remap_ops->compose_msi_msg)
                remap_ops->compose_msi_msg(pdev, irq, dest, msg, hpet_id);
 }
 static int msi_alloc_remapped_irq(struct pci_dev *pdev, int irq, int nvec)
 {
-        if (!remap_ops || !remap_ops->msi_alloc_irq)
+        if (!remap_ops->msi_alloc_irq)
                return -ENODEV;
        return remap_ops->msi_alloc_irq(pdev, irq, nvec);
@@ -330,7 +306,7 @@ static int msi_alloc_remapped_irq(struct pci_dev *pdev, int irq, int nvec)
 static int msi_setup_remapped_irq(struct pci_dev *pdev, unsigned int irq,
                                  int index, int sub_handle)
 {
-        if (!remap_ops || !remap_ops->msi_setup_irq)
+        if (!remap_ops->msi_setup_irq)
                return -ENODEV;
        return remap_ops->msi_setup_irq(pdev, irq, index, sub_handle);
@@ -340,7 +316,7 @@ int setup_hpet_msi_remapped(unsigned int irq, unsigned int id)
 {
        int ret;
-        if (!remap_ops || !remap_ops->alloc_hpet_msi)
+        if (!remap_ops->alloc_hpet_msi)
                return -ENODEV;
        ret = remap_ops->alloc_hpet_msi(irq, id);
diff --git a/drivers/iommu/irq_remapping.h b/drivers/iommu/irq_remapping.h
index fde250f86e60..c448eb48340a 100644
--- a/drivers/iommu/irq_remapping.h
+++ b/drivers/iommu/irq_remapping.h
@@ -31,16 +31,12 @@ struct cpumask;
 struct pci_dev;
 struct msi_msg;
-extern int disable_irq_remap;
 extern int irq_remap_broken;
 extern int disable_sourceid_checking;
 extern int no_x2apic_optout;
 extern int irq_remapping_enabled;
 struct irq_remap_ops {
-        /* Check whether Interrupt Remapping is supported */
-        int (*supported)(void);
        /* Initializes hardware and makes it ready for remapping interrupts */
        int  (*prepare)(void);
@@ -89,7 +85,6 @@ extern struct irq_remap_ops amd_iommu_irq_ops;
 #else  /* CONFIG_IRQ_REMAP */
 #define irq_remapping_enabled 0
-#define disable_irq_remap     1
 #define irq_remap_broken      0
 #endif /* CONFIG_IRQ_REMAP */
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index b2023af384b9..6a8b1ec4a48a 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1009,7 +1009,6 @@ static struct platform_driver rk_iommu_driver = {
        .remove = rk_iommu_remove,
        .driver = {
                   .name = "rk_iommu",
-                   .owner = THIS_MODULE,
                   .of_match_table = of_match_ptr(rk_iommu_dt_ids),
        },
 };
diff --git a/drivers/iommu/tegra-gart.c b/drivers/iommu/tegra-gart.c
index f722a0c466cf..c48da057dbb1 100644
--- a/drivers/iommu/tegra-gart.c
+++ b/drivers/iommu/tegra-gart.c
@@ -315,6 +315,7 @@ static const struct iommu_ops gart_iommu_ops = {
        .attach_dev     = gart_iommu_attach_dev,
        .detach_dev     = gart_iommu_detach_dev,
        .map            = gart_iommu_map,
+        .map_sg         = default_iommu_map_sg,
        .unmap          = gart_iommu_unmap,
        .iova_to_phys   = gart_iommu_iova_to_phys,
        .pgsize_bitmap  = GART_IOMMU_PGSIZES,
@@ -395,7 +396,7 @@ static int tegra_gart_probe(struct platform_device *pdev)
        do_gart_setup(gart, NULL);
        gart_handle = gart;
-        bus_set_iommu(&platform_bus_type, &gart_iommu_ops);
        return 0;
 }
diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
index d111ac779c40..63cd031b2c28 100644
--- a/drivers/irqchip/irq-atmel-aic-common.c
+++ b/drivers/irqchip/irq-atmel-aic-common.c
@@ -28,7 +28,7 @@
 #define AT91_AIC_IRQ_MIN_PRIORITY       0
 #define AT91_AIC_IRQ_MAX_PRIORITY       7
-#define AT91_AIC_SRCTYPE                GENMASK(7, 6)
+#define AT91_AIC_SRCTYPE                GENMASK(6, 5)
 #define AT91_AIC_SRCTYPE_LOW            (0 << 5)
 #define AT91_AIC_SRCTYPE_FALLING        (1 << 5)
 #define AT91_AIC_SRCTYPE_HIGH           (2 << 5)
@@ -74,7 +74,7 @@ int aic_common_set_type(struct irq_data *d, unsigned type, unsigned *val)
                return -EINVAL;
        }
-        *val &= AT91_AIC_SRCTYPE;
+        *val &= ~AT91_AIC_SRCTYPE;
        *val |= aic_type;
        return 0;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 86e4684adeb1..d8996bdf0f61 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1053,7 +1053,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         * of two entries. No, the architecture doesn't let you
         * express an ITT with a single entry.
         */
-        nr_ites = max(2, roundup_pow_of_two(nvecs));
+        nr_ites = max(2UL, roundup_pow_of_two(nvecs));
        sz = nr_ites * its->ite_size;
        sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
        itt = kmalloc(sz, GFP_KERNEL);
diff --git a/drivers/irqchip/irq-hip04.c b/drivers/irqchip/irq-hip04.c
index 29b8f21b74d0..6bc2deb73d53 100644
--- a/drivers/irqchip/irq-hip04.c
+++ b/drivers/irqchip/irq-hip04.c
@@ -381,7 +381,7 @@ hip04_of_init(struct device_node *node, struct device_node *parent)
         * It will be refined as each CPU probes its ID.
         */
        for (i = 0; i < NR_HIP04_CPU_IF; i++)
-                hip04_cpu_map[i] = 0xff;
+                hip04_cpu_map[i] = 0xffff;
        /*
         * Find out how many interrupts are supported.
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 2b0468e3df6a..56b96c63dc4b 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -37,6 +37,7 @@ static struct irq_domain *gic_irq_domain;
 static int gic_shared_intrs;
 static int gic_vpes;
 static unsigned int gic_cpu_pin;
+static unsigned int timer_cpu_pin;
 static struct irq_chip gic_level_irq_controller, gic_edge_irq_controller;
 static void __gic_irq_dispatch(void);
@@ -616,6 +617,8 @@ static int gic_local_irq_domain_map(struct irq_domain *d, unsigned int virq,
                        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_COMPARE_MAP), val);
                        break;
                case GIC_LOCAL_INT_TIMER:
+                        /* CONFIG_MIPS_CMP workaround (see __gic_init) */
+                        val = GIC_MAP_TO_PIN_MSK | timer_cpu_pin;
                        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_TIMER_MAP), val);
                        break;
                case GIC_LOCAL_INT_PERFCTR:
@@ -713,12 +716,36 @@ static void __init __gic_init(unsigned long gic_base_addr,
        if (cpu_has_veic) {
                /* Always use vector 1 in EIC mode */
                gic_cpu_pin = 0;
+                timer_cpu_pin = gic_cpu_pin;
                set_vi_handler(gic_cpu_pin + GIC_PIN_TO_VEC_OFFSET,
                               __gic_irq_dispatch);
        } else {
                gic_cpu_pin = cpu_vec - GIC_CPU_PIN_OFFSET;
                irq_set_chained_handler(MIPS_CPU_IRQ_BASE + cpu_vec,
                                        gic_irq_dispatch);
+                /*
+                 * With the CMP implementation of SMP (deprecated), other CPUs
+                 * are started by the bootloader and put into a timer based
+                 * waiting poll loop. We must not re-route those CPU's local
+                 * timer interrupts as the wait instruction will never finish,
+                 * so just handle whatever CPU interrupt it is routed to by
+                 * default.
+                 *
+                 * This workaround should be removed when CMP support is
+                 * dropped.
+                 */
+                if (IS_ENABLED(CONFIG_MIPS_CMP) &&
+                    gic_local_irq_is_routable(GIC_LOCAL_INT_TIMER)) {
+                        timer_cpu_pin = gic_read(GIC_REG(VPE_LOCAL,
+                                                         GIC_VPE_TIMER_MAP)) &
+                                        GIC_MAP_MSK;
+                        irq_set_chained_handler(MIPS_CPU_IRQ_BASE +
+                                                GIC_CPU_PIN_OFFSET +
+                                                timer_cpu_pin,
+                                                gic_irq_dispatch);
+                } else {
+                        timer_cpu_pin = gic_cpu_pin;
+                }
        }
        gic_irq_domain = irq_domain_add_simple(node, GIC_NUM_LOCAL_INTRS +
diff --git a/drivers/irqchip/irq-mtk-sysirq.c b/drivers/irqchip/irq-mtk-sysirq.c
index 7e342df6a62f..0b0d2c00a2df 100644
--- a/drivers/irqchip/irq-mtk-sysirq.c
+++ b/drivers/irqchip/irq-mtk-sysirq.c
@@ -137,9 +137,9 @@ static int __init mtk_sysirq_of_init(struct device_node *node,
                return -ENOMEM;
        chip_data->intpol_base = of_io_request_and_map(node, 0, "intpol");
-        if (!chip_data->intpol_base) {
+        if (IS_ERR(chip_data->intpol_base)) {
                pr_err("mtk_sysirq: unable to map sysirq register\n");
-                ret = -ENOMEM;
+                ret = PTR_ERR(chip_data->intpol_base);
                goto out_free;
        }
diff --git a/drivers/irqchip/irq-omap-intc.c b/drivers/irqchip/irq-omap-intc.c
index 28718d3e8281..c03f140acbae 100644
--- a/drivers/irqchip/irq-omap-intc.c
+++ b/drivers/irqchip/irq-omap-intc.c
@@ -263,7 +263,7 @@ static int __init omap_init_irq_of(struct device_node *node)
        return ret;
 }
-static int __init omap_init_irq_legacy(u32 base)
+static int __init omap_init_irq_legacy(u32 base, struct device_node *node)
 {
        int j, irq_base;
@@ -277,7 +277,7 @@ static int __init omap_init_irq_legacy(u32 base)
                irq_base = 0;
        }
-        domain = irq_domain_add_legacy(NULL, omap_nr_irqs, irq_base, 0,
+        domain = irq_domain_add_legacy(node, omap_nr_irqs, irq_base, 0,
                        &irq_domain_simple_ops, NULL);
        omap_irq_soft_reset();
@@ -301,10 +301,26 @@ static int __init omap_init_irq(u32 base, struct device_node *node)
 {
        int ret;
-        if (node)
+        /*
+         * FIXME legacy OMAP DMA driver sitting under arch/arm/plat-omap/dma.c
+         * depends is still not ready for linear IRQ domains; because of that
+         * we need to temporarily "blacklist" OMAP2 and OMAP3 devices from using
+         * linear IRQ Domain until that driver is finally fixed.
+         */
+        if (of_device_is_compatible(node, "ti,omap2-intc") ||
+                        of_device_is_compatible(node, "ti,omap3-intc")) {
+                struct resource res;
+                if (of_address_to_resource(node, 0, &res))
+                        return -ENOMEM;
+                base = res.start;
+                ret = omap_init_irq_legacy(base, node);
+        } else if (node) {
                ret = omap_init_irq_of(node);
-        else
+        } else {
-                ret = omap_init_irq_legacy(base);
+                ret = omap_init_irq_legacy(base, NULL);
+        }
        if (ret == 0)
                omap_irq_enable_protection();
diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c
index a82e542ffc21..d7c286656a25 100644
--- a/drivers/isdn/hardware/eicon/message.c
+++ b/drivers/isdn/hardware/eicon/message.c
@@ -1474,7 +1474,7 @@ static byte connect_res(dword Id, word Number, DIVA_CAPI_ADAPTER *a,
                                        add_ai(plci, &parms[5]);
                                        sig_req(plci, REJECT, 0);
                                }
-                                else if (Reject == 1 || Reject > 9)
+                                else if (Reject == 1 || Reject >= 9)
                                {
                                        add_ai(plci, &parms[5]);
                                        sig_req(plci, HANGUP, 0);
@@ -4880,7 +4880,7 @@ static void sig_ind(PLCI *plci)
        byte SS_Ind[] = "\x05\x02\x00\x02\x00\x00"; /* Hold_Ind struct*/
        byte CF_Ind[] = "\x09\x02\x00\x06\x00\x00\x00\x00\x00\x00";
        byte Interr_Err_Ind[] = "\x0a\x02\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-        byte CONF_Ind[] = "\x09\x16\x00\x06\x00\x00\0x00\0x00\0x00\0x00";
+        byte CONF_Ind[] = "\x09\x16\x00\x06\x00\x00\x00\x00\x00\x00";
        byte force_mt_info = false;
        byte dir;
        dword d;
diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
index 26515c27ea8c..25e419752a7b 100644
--- a/drivers/leds/leds-netxbig.c
+++ b/drivers/leds/leds-netxbig.c
@@ -330,18 +330,18 @@ create_netxbig_led(struct platform_device *pdev,
        led_dat->sata = 0;
        led_dat->cdev.brightness = LED_OFF;
        led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
-        /*
-         * If available, expose the SATA activity blink capability through
-         * a "sata" sysfs attribute.
-         */
-        if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE)
-                led_dat->cdev.groups = netxbig_led_groups;
        led_dat->mode_addr = template->mode_addr;
        led_dat->mode_val = template->mode_val;
        led_dat->bright_addr = template->bright_addr;
        led_dat->bright_max = (1 << pdata->gpio_ext->num_data) - 1;
        led_dat->timer = pdata->timer;
        led_dat->num_timer = pdata->num_timer;
+        /*
+         * If available, expose the SATA activity blink capability through
+         * a "sata" sysfs attribute.
+         */
+        if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE)
+                led_dat->cdev.groups = netxbig_led_groups;
        return led_classdev_register(&pdev->dev, &led_dat->cdev);
 }
diff --git a/drivers/mcb/mcb-internal.h b/drivers/mcb/mcb-internal.h
index f956ef26c0ce..fb7493dcfb79 100644
--- a/drivers/mcb/mcb-internal.h
+++ b/drivers/mcb/mcb-internal.h
@@ -7,6 +7,7 @@
 #define PCI_DEVICE_ID_MEN_CHAMELEON     0x4d45
 #define CHAMELEON_FILENAME_LEN          12
 #define CHAMELEONV2_MAGIC               0xabce
+#define CHAM_HEADER_SIZE                0x200
 enum chameleon_descriptor_type {
        CHAMELEON_DTYPE_GENERAL = 0x0,
diff --git a/drivers/mcb/mcb-pci.c b/drivers/mcb/mcb-pci.c
index b59181965643..5e1bd5db02c8 100644
--- a/drivers/mcb/mcb-pci.c
+++ b/drivers/mcb/mcb-pci.c
@@ -17,6 +17,7 @@
 struct priv {
        struct mcb_bus *bus;
+        phys_addr_t mapbase;
        void __iomem *base;
 };
@@ -31,8 +32,8 @@ static int mcb_pci_get_irq(struct mcb_device *mdev)
 static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
+        struct resource *res;
        struct priv *priv;
-        phys_addr_t mapbase;
        int ret;
        int num_cells;
        unsigned long flags;
@@ -47,19 +48,21 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                return -ENODEV;
        }
-        mapbase = pci_resource_start(pdev, 0);
+        priv->mapbase = pci_resource_start(pdev, 0);
-        if (!mapbase) {
+        if (!priv->mapbase) {
                dev_err(&pdev->dev, "No PCI resource\n");
                goto err_start;
        }
-        ret = pci_request_region(pdev, 0, KBUILD_MODNAME);
+        res = request_mem_region(priv->mapbase, CHAM_HEADER_SIZE,
-        if (ret) {
+                                 KBUILD_MODNAME);
-                dev_err(&pdev->dev, "Failed to request PCI BARs\n");
+        if (IS_ERR(res)) {
+                dev_err(&pdev->dev, "Failed to request PCI memory\n");
+                ret = PTR_ERR(res);
                goto err_start;
        }
-        priv->base = pci_iomap(pdev, 0, 0);
+        priv->base = ioremap(priv->mapbase, CHAM_HEADER_SIZE);
        if (!priv->base) {
                dev_err(&pdev->dev, "Cannot ioremap\n");
                ret = -ENOMEM;
@@ -84,7 +87,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        priv->bus->get_irq = mcb_pci_get_irq;
-        ret = chameleon_parse_cells(priv->bus, mapbase, priv->base);
+        ret = chameleon_parse_cells(priv->bus, priv->mapbase, priv->base);
        if (ret < 0)
                goto err_drvdata;
        num_cells = ret;
@@ -93,8 +96,10 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        mcb_bus_add_devices(priv->bus);
+        return 0;
 err_drvdata:
-        pci_iounmap(pdev, priv->base);
+        iounmap(priv->base);
 err_ioremap:
        pci_release_region(pdev, 0);
 err_start:
@@ -107,6 +112,10 @@ static void mcb_pci_remove(struct pci_dev *pdev)
        struct priv *priv = pci_get_drvdata(pdev);
        mcb_release_bus(priv->bus);
+        iounmap(priv->base);
+        release_region(priv->mapbase, CHAM_HEADER_SIZE);
+        pci_disable_device(pdev);
 }
 static const struct pci_device_id mcb_pci_tbl[] = {
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index 5bdedf6df153..c355a226a024 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -5,6 +5,7 @@
 menuconfig MD
        bool "Multiple devices driver support (RAID and LVM)"
        depends on BLOCK
+        select SRCU
        help
          Support multiple physical spindles through a single logical device.
          Required for RAID and logical volume management.
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index da3604e73e8a..1695ee5f3ffc 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -72,6 +72,19 @@ __acquires(bitmap->lock)
        /* this page has not been allocated yet */
        spin_unlock_irq(&bitmap->lock);
+        /* It is possible that this is being called inside a
+         * prepare_to_wait/finish_wait loop from raid5c:make_request().
+         * In general it is not permitted to sleep in that context as it
+         * can cause the loop to spin freely.
+         * That doesn't apply here as we can only reach this point
+         * once with any loop.
+         * When this function completes, either bp[page].map or
+         * bp[page].hijacked.  In either case, this function will
+         * abort before getting to this point again.  So there is
+         * no risk of a free-spin, and so it is safe to assert
+         * that sleeping here is allowed.
+         */
+        sched_annotate_sleep();
        mappage = kzalloc(PAGE_SIZE, GFP_NOIO);
        spin_lock_irq(&bitmap->lock);
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index 9fc616c2755e..c1c010498a21 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -94,6 +94,9 @@ struct cache_disk_superblock {
 } __packed;
 struct dm_cache_metadata {
+        atomic_t ref_count;
+        struct list_head list;
        struct block_device *bdev;
        struct dm_block_manager *bm;
        struct dm_space_map *metadata_sm;
@@ -669,10 +672,10 @@ static void unpack_value(__le64 value_le, dm_oblock_t *block, unsigned *flags)
 /*----------------------------------------------------------------*/
-struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
+static struct dm_cache_metadata *metadata_open(struct block_device *bdev,
-                                                 sector_t data_block_size,
+                                               sector_t data_block_size,
-                                                 bool may_format_device,
+                                               bool may_format_device,
-                                                 size_t policy_hint_size)
+                                               size_t policy_hint_size)
 {
        int r;
        struct dm_cache_metadata *cmd;
@@ -680,9 +683,10 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
        if (!cmd) {
                DMERR("could not allocate metadata struct");
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        }
+        atomic_set(&cmd->ref_count, 1);
        init_rwsem(&cmd->root_lock);
        cmd->bdev = bdev;
        cmd->data_block_size = data_block_size;
@@ -705,10 +709,96 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
        return cmd;
 }
+/*
+ * We keep a little list of ref counted metadata objects to prevent two
+ * different target instances creating separate bufio instances.  This is
+ * an issue if a table is reloaded before the suspend.
+ */
+static DEFINE_MUTEX(table_lock);
+static LIST_HEAD(table);
+static struct dm_cache_metadata *lookup(struct block_device *bdev)
+{
+        struct dm_cache_metadata *cmd;
+        list_for_each_entry(cmd, &table, list)
+                if (cmd->bdev == bdev) {
+                        atomic_inc(&cmd->ref_count);
+                        return cmd;
+                }
+        return NULL;
+}
+static struct dm_cache_metadata *lookup_or_open(struct block_device *bdev,
+                                                sector_t data_block_size,
+                                                bool may_format_device,
+                                                size_t policy_hint_size)
+{
+        struct dm_cache_metadata *cmd, *cmd2;
+        mutex_lock(&table_lock);
+        cmd = lookup(bdev);
+        mutex_unlock(&table_lock);
+        if (cmd)
+                return cmd;
+        cmd = metadata_open(bdev, data_block_size, may_format_device, policy_hint_size);
+        if (!IS_ERR(cmd)) {
+                mutex_lock(&table_lock);
+                cmd2 = lookup(bdev);
+                if (cmd2) {
+                        mutex_unlock(&table_lock);
+                        __destroy_persistent_data_objects(cmd);
+                        kfree(cmd);
+                        return cmd2;
+                }
+                list_add(&cmd->list, &table);
+                mutex_unlock(&table_lock);
+        }
+        return cmd;
+}
+static bool same_params(struct dm_cache_metadata *cmd, sector_t data_block_size)
+{
+        if (cmd->data_block_size != data_block_size) {
+                DMERR("data_block_size (%llu) different from that in metadata (%llu)\n",
+                      (unsigned long long) data_block_size,
+                      (unsigned long long) cmd->data_block_size);
+                return false;
+        }
+        return true;
+}
+struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
+                                                 sector_t data_block_size,
+                                                 bool may_format_device,
+                                                 size_t policy_hint_size)
+{
+        struct dm_cache_metadata *cmd = lookup_or_open(bdev, data_block_size,
+                                                       may_format_device, policy_hint_size);
+        if (!IS_ERR(cmd) && !same_params(cmd, data_block_size)) {
+                dm_cache_metadata_close(cmd);
+                return ERR_PTR(-EINVAL);
+        }
+        return cmd;
+}
 void dm_cache_metadata_close(struct dm_cache_metadata *cmd)
 {
-        __destroy_persistent_data_objects(cmd);
+        if (atomic_dec_and_test(&cmd->ref_count)) {
-        kfree(cmd);
+                mutex_lock(&table_lock);
+                list_del(&cmd->list);
+                mutex_unlock(&table_lock);
+                __destroy_persistent_data_objects(cmd);
+                kfree(cmd);
+        }
 }
 /*
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1e96d7889f51..e1650539cc2f 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -221,7 +221,13 @@ struct cache {
        struct list_head need_commit_migrations;
        sector_t migration_threshold;
        wait_queue_head_t migration_wait;
-        atomic_t nr_migrations;
+        atomic_t nr_allocated_migrations;
+        /*
+         * The number of in flight migrations that are performing
+         * background io. eg, promotion, writeback.
+         */
+        atomic_t nr_io_migrations;
        wait_queue_head_t quiescing_wait;
        atomic_t quiescing;
@@ -258,7 +264,6 @@ struct cache {
        struct dm_deferred_set *all_io_ds;
        mempool_t *migration_pool;
-        struct dm_cache_migration *next_migration;
        struct dm_cache_policy *policy;
        unsigned policy_nr_args;
@@ -350,10 +355,31 @@ static void free_prison_cell(struct cache *cache, struct dm_bio_prison_cell *cel
        dm_bio_prison_free_cell(cache->prison, cell);
 }
+static struct dm_cache_migration *alloc_migration(struct cache *cache)
+{
+        struct dm_cache_migration *mg;
+        mg = mempool_alloc(cache->migration_pool, GFP_NOWAIT);
+        if (mg) {
+                mg->cache = cache;
+                atomic_inc(&mg->cache->nr_allocated_migrations);
+        }
+        return mg;
+}
+static void free_migration(struct dm_cache_migration *mg)
+{
+        if (atomic_dec_and_test(&mg->cache->nr_allocated_migrations))
+                wake_up(&mg->cache->migration_wait);
+        mempool_free(mg, mg->cache->migration_pool);
+}
 static int prealloc_data_structs(struct cache *cache, struct prealloc *p)
 {
        if (!p->mg) {
-                p->mg = mempool_alloc(cache->migration_pool, GFP_NOWAIT);
+                p->mg = alloc_migration(cache);
                if (!p->mg)
                        return -ENOMEM;
        }
@@ -382,7 +408,7 @@ static void prealloc_free_structs(struct cache *cache, struct prealloc *p)
                free_prison_cell(cache, p->cell1);
        if (p->mg)
-                mempool_free(p->mg, cache->migration_pool);
+                free_migration(p->mg);
 }
 static struct dm_cache_migration *prealloc_get_migration(struct prealloc *p)
@@ -854,24 +880,14 @@ static void remap_to_origin_then_cache(struct cache *cache, struct bio *bio,
 * Migration covers moving data from the origin device to the cache, or
 * vice versa.
 *--------------------------------------------------------------*/
-static void free_migration(struct dm_cache_migration *mg)
+static void inc_io_migrations(struct cache *cache)
-{
-        mempool_free(mg, mg->cache->migration_pool);
-}
-static void inc_nr_migrations(struct cache *cache)
 {
-        atomic_inc(&cache->nr_migrations);
+        atomic_inc(&cache->nr_io_migrations);
 }
-static void dec_nr_migrations(struct cache *cache)
+static void dec_io_migrations(struct cache *cache)
 {
-        atomic_dec(&cache->nr_migrations);
+        atomic_dec(&cache->nr_io_migrations);
-        /*
-         * Wake the worker in case we're suspending the target.
-         */
-        wake_up(&cache->migration_wait);
 }
 static void __cell_defer(struct cache *cache, struct dm_bio_prison_cell *cell,
@@ -894,11 +910,10 @@ static void cell_defer(struct cache *cache, struct dm_bio_prison_cell *cell,
        wake_worker(cache);
 }
-static void cleanup_migration(struct dm_cache_migration *mg)
+static void free_io_migration(struct dm_cache_migration *mg)
 {
-        struct cache *cache = mg->cache;
+        dec_io_migrations(mg->cache);
        free_migration(mg);
-        dec_nr_migrations(cache);
 }
 static void migration_failure(struct dm_cache_migration *mg)
@@ -923,7 +938,7 @@ static void migration_failure(struct dm_cache_migration *mg)
                cell_defer(cache, mg->new_ocell, true);
        }
-        cleanup_migration(mg);
+        free_io_migration(mg);
 }
 static void migration_success_pre_commit(struct dm_cache_migration *mg)
@@ -934,7 +949,7 @@ static void migration_success_pre_commit(struct dm_cache_migration *mg)
        if (mg->writeback) {
                clear_dirty(cache, mg->old_oblock, mg->cblock);
                cell_defer(cache, mg->old_ocell, false);
-                cleanup_migration(mg);
+                free_io_migration(mg);
                return;
        } else if (mg->demote) {
@@ -944,14 +959,14 @@ static void migration_success_pre_commit(struct dm_cache_migration *mg)
                                             mg->old_oblock);
                        if (mg->promote)
                                cell_defer(cache, mg->new_ocell, true);
-                        cleanup_migration(mg);
+                        free_io_migration(mg);
                        return;
                }
        } else {
                if (dm_cache_insert_mapping(cache->cmd, mg->cblock, mg->new_oblock)) {
                        DMWARN_LIMIT("promotion failed; couldn't update on disk metadata");
                        policy_remove_mapping(cache->policy, mg->new_oblock);
-                        cleanup_migration(mg);
+                        free_io_migration(mg);
                        return;
                }
        }
@@ -984,7 +999,7 @@ static void migration_success_post_commit(struct dm_cache_migration *mg)
                } else {
                        if (mg->invalidate)
                                policy_remove_mapping(cache->policy, mg->old_oblock);
-                        cleanup_migration(mg);
+                        free_io_migration(mg);
                }
        } else {
@@ -999,7 +1014,7 @@ static void migration_success_post_commit(struct dm_cache_migration *mg)
                        bio_endio(mg->new_ocell->holder, 0);
                        cell_defer(cache, mg->new_ocell, false);
                }
-                cleanup_migration(mg);
+                free_io_migration(mg);
        }
 }
@@ -1251,7 +1266,7 @@ static void promote(struct cache *cache, struct prealloc *structs,
        mg->new_ocell = cell;
        mg->start_jiffies = jiffies;
-        inc_nr_migrations(cache);
+        inc_io_migrations(cache);
        quiesce_migration(mg);
 }
@@ -1275,7 +1290,7 @@ static void writeback(struct cache *cache, struct prealloc *structs,
        mg->new_ocell = NULL;
        mg->start_jiffies = jiffies;
-        inc_nr_migrations(cache);
+        inc_io_migrations(cache);
        quiesce_migration(mg);
 }
@@ -1302,7 +1317,7 @@ static void demote_then_promote(struct cache *cache, struct prealloc *structs,
        mg->new_ocell = new_ocell;
        mg->start_jiffies = jiffies;
-        inc_nr_migrations(cache);
+        inc_io_migrations(cache);
        quiesce_migration(mg);
 }
@@ -1330,7 +1345,7 @@ static void invalidate(struct cache *cache, struct prealloc *structs,
        mg->new_ocell = NULL;
        mg->start_jiffies = jiffies;
-        inc_nr_migrations(cache);
+        inc_io_migrations(cache);
        quiesce_migration(mg);
 }
@@ -1412,7 +1427,7 @@ static void process_discard_bio(struct cache *cache, struct prealloc *structs,
 static bool spare_migration_bandwidth(struct cache *cache)
 {
-        sector_t current_volume = (atomic_read(&cache->nr_migrations) + 1) *
+        sector_t current_volume = (atomic_read(&cache->nr_io_migrations) + 1) *
                cache->sectors_per_block;
        return current_volume < cache->migration_threshold;
 }
@@ -1764,7 +1779,7 @@ static void stop_quiescing(struct cache *cache)
 static void wait_for_migrations(struct cache *cache)
 {
-        wait_event(cache->migration_wait, !atomic_read(&cache->nr_migrations));
+        wait_event(cache->migration_wait, !atomic_read(&cache->nr_allocated_migrations));
 }
 static void stop_worker(struct cache *cache)
@@ -1876,9 +1891,6 @@ static void destroy(struct cache *cache)
 {
        unsigned i;
-        if (cache->next_migration)
-                mempool_free(cache->next_migration, cache->migration_pool);
        if (cache->migration_pool)
                mempool_destroy(cache->migration_pool);
@@ -2424,7 +2436,8 @@ static int cache_create(struct cache_args *ca, struct cache **result)
        INIT_LIST_HEAD(&cache->quiesced_migrations);
        INIT_LIST_HEAD(&cache->completed_migrations);
        INIT_LIST_HEAD(&cache->need_commit_migrations);
-        atomic_set(&cache->nr_migrations, 0);
+        atomic_set(&cache->nr_allocated_migrations, 0);
+        atomic_set(&cache->nr_io_migrations, 0);
        init_waitqueue_head(&cache->migration_wait);
        init_waitqueue_head(&cache->quiescing_wait);
@@ -2487,8 +2500,6 @@ static int cache_create(struct cache_args *ca, struct cache **result)
                goto bad;
        }
-        cache->next_migration = NULL;
        cache->need_tick_bio = true;
        cache->sized = false;
        cache->invalidate = false;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 8735543eacdb..07705ee181e3 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1127,6 +1127,24 @@ static void schedule_external_copy(struct thin_c *tc, dm_block_t virt_block,
                schedule_zero(tc, virt_block, data_dest, cell, bio);
 }
+static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
+static void check_for_space(struct pool *pool)
+{
+        int r;
+        dm_block_t nr_free;
+        if (get_pool_mode(pool) != PM_OUT_OF_DATA_SPACE)
+                return;
+        r = dm_pool_get_free_block_count(pool->pmd, &nr_free);
+        if (r)
+                return;
+        if (nr_free)
+                set_pool_mode(pool, PM_WRITE);
+}
 /*
 * A non-zero return indicates read_only or fail_io mode.
 * Many callers don't care about the return value.
@@ -1141,6 +1159,8 @@ static int commit(struct pool *pool)
        r = dm_pool_commit_metadata(pool->pmd);
        if (r)
                metadata_operation_failed(pool, "dm_pool_commit_metadata", r);
+        else
+                check_for_space(pool);
        return r;
 }
@@ -1159,8 +1179,6 @@ static void check_low_water_mark(struct pool *pool, dm_block_t free_blocks)
        }
 }
-static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
 static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
 {
        int r;
@@ -2155,7 +2173,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                pool->process_cell = process_cell_read_only;
                pool->process_discard_cell = process_discard_cell;
                pool->process_prepared_mapping = process_prepared_mapping;
-                pool->process_prepared_discard = process_prepared_discard_passdown;
+                pool->process_prepared_discard = process_prepared_discard;
                if (!pool->pf.error_if_no_space && no_space_timeout)
                        queue_delayed_work(pool->wq, &pool->no_space_timeout, no_space_timeout);
@@ -3367,6 +3385,12 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv)
        struct pool_c *pt = ti->private;
        struct pool *pool = pt->pool;
+        if (get_pool_mode(pool) >= PM_READ_ONLY) {
+                DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode",
+                      dm_device_name(pool->pool_md));
+                return -EINVAL;
+        }
        if (!strcasecmp(argv[0], "create_thin"))
                r = process_create_thin_mesg(argc, argv, pool);
@@ -3814,6 +3838,8 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
                r = -EINVAL;
                goto bad;
        }
+        atomic_set(&tc->refcount, 1);
+        init_completion(&tc->can_destroy);
        list_add_tail_rcu(&tc->list, &tc->pool->active_thins);
        spin_unlock_irqrestore(&tc->pool->lock, flags);
        /*
@@ -3826,9 +3852,6 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
        dm_put(pool_md);
-        atomic_set(&tc->refcount, 1);
-        init_completion(&tc->can_destroy);
        return 0;
 bad:
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 4c06585bf165..2caf5b374649 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -206,6 +206,9 @@ struct mapped_device {
        /* zero-length flush that will be cloned and submitted to targets */
        struct bio flush_bio;
+        /* the number of internal suspends */
+        unsigned internal_suspend_count;
        struct dm_stats stats;
 };
@@ -899,7 +902,7 @@ static void disable_write_same(struct mapped_device *md)
 static void clone_endio(struct bio *bio, int error)
 {
-        int r = 0;
+        int r = error;
        struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone);
        struct dm_io *io = tio->io;
        struct mapped_device *md = tio->io->md;
@@ -2928,7 +2931,7 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned suspend_fla
 {
        struct dm_table *map = NULL;
-        if (dm_suspended_internally_md(md))
+        if (md->internal_suspend_count++)
                return; /* nested internal suspend */
        if (dm_suspended_md(md)) {
@@ -2953,7 +2956,9 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned suspend_fla
 static void __dm_internal_resume(struct mapped_device *md)
 {
-        if (!dm_suspended_internally_md(md))
+        BUG_ON(!md->internal_suspend_count);
+        if (--md->internal_suspend_count)
                return; /* resume from nested internal suspend */
        if (dm_suspended_md(md))
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index c1b0d52bfcb0..b98765f6f77f 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3195,6 +3195,11 @@ static void handle_stripe_dirtying(struct r5conf *conf,
                                          (unsigned long long)sh->sector,
                                          rcw, qread, test_bit(STRIPE_DELAYED, &sh->state));
        }
+        if (rcw > disks && rmw > disks &&
+            !test_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
+                set_bit(STRIPE_DELAYED, &sh->state);
        /* now if nothing is locked, and if we have enough data,
         * we can start a write request
         */
diff --git a/drivers/media/pci/cx23885/cx23885-cards.c b/drivers/media/pci/cx23885/cx23885-cards.c
index db99ca2613ba..06931f6fa26c 100644
--- a/drivers/media/pci/cx23885/cx23885-cards.c
+++ b/drivers/media/pci/cx23885/cx23885-cards.c
@@ -614,7 +614,7 @@ struct cx23885_board cx23885_boards[] = {
                .portb          = CX23885_MPEG_DVB,
        },
        [CX23885_BOARD_HAUPPAUGE_HVR4400] = {
-                .name           = "Hauppauge WinTV-HVR4400",
+                .name           = "Hauppauge WinTV-HVR4400/HVR5500",
                .porta          = CX23885_ANALOG_VIDEO,
                .portb          = CX23885_MPEG_DVB,
                .portc          = CX23885_MPEG_DVB,
@@ -622,6 +622,10 @@ struct cx23885_board cx23885_boards[] = {
                .tuner_addr     = 0x60, /* 0xc0 >> 1 */
                .tuner_bus      = 1,
        },
+        [CX23885_BOARD_HAUPPAUGE_STARBURST] = {
+                .name           = "Hauppauge WinTV Starburst",
+                .portb          = CX23885_MPEG_DVB,
+        },
        [CX23885_BOARD_AVERMEDIA_HC81R] = {
                .name           = "AVerTV Hybrid Express Slim HC81R",
                .tuner_type     = TUNER_XC2028,
@@ -936,19 +940,19 @@ struct cx23885_subid cx23885_subids[] = {
        }, {
                .subvendor = 0x0070,
                .subdevice = 0xc108,
-                .card      = CX23885_BOARD_HAUPPAUGE_HVR4400,
+                .card      = CX23885_BOARD_HAUPPAUGE_HVR4400, /* Hauppauge WinTV HVR-4400 (Model 121xxx, Hybrid DVB-T/S2, IR) */
        }, {
                .subvendor = 0x0070,
                .subdevice = 0xc138,
-                .card      = CX23885_BOARD_HAUPPAUGE_HVR4400,
+                .card      = CX23885_BOARD_HAUPPAUGE_HVR4400, /* Hauppauge WinTV HVR-5500 (Model 121xxx, Hybrid DVB-T/C/S2, IR) */
        }, {
                .subvendor = 0x0070,
                .subdevice = 0xc12a,
-                .card      = CX23885_BOARD_HAUPPAUGE_HVR4400,
+                .card      = CX23885_BOARD_HAUPPAUGE_STARBURST, /* Hauppauge WinTV Starburst (Model 121x00, DVB-S2, IR) */
        }, {
                .subvendor = 0x0070,
                .subdevice = 0xc1f8,
-                .card      = CX23885_BOARD_HAUPPAUGE_HVR4400,
+                .card      = CX23885_BOARD_HAUPPAUGE_HVR4400, /* Hauppauge WinTV HVR-5500 (Model 121xxx, Hybrid DVB-T/C/S2, IR) */
        }, {
                .subvendor = 0x1461,
                .subdevice = 0xd939,
@@ -1545,8 +1549,9 @@ void cx23885_gpio_setup(struct cx23885_dev *dev)
                cx_write(GPIO_ISM, 0x00000000);/* INTERRUPTS active low*/
                break;
        case CX23885_BOARD_HAUPPAUGE_HVR4400:
+        case CX23885_BOARD_HAUPPAUGE_STARBURST:
                /* GPIO-8 tda10071 demod reset */
-                /* GPIO-9 si2165 demod reset */
+                /* GPIO-9 si2165 demod reset (only HVR4400/HVR5500)*/
                /* Put the parts into reset and back */
                cx23885_gpio_enable(dev, GPIO_8 | GPIO_9, 1);
@@ -1872,6 +1877,7 @@ void cx23885_card_setup(struct cx23885_dev *dev)
        case CX23885_BOARD_HAUPPAUGE_HVR1850:
        case CX23885_BOARD_HAUPPAUGE_HVR1290:
        case CX23885_BOARD_HAUPPAUGE_HVR4400:
+        case CX23885_BOARD_HAUPPAUGE_STARBURST:
        case CX23885_BOARD_HAUPPAUGE_IMPACTVCBE:
                if (dev->i2c_bus[0].i2c_rc == 0)
                        hauppauge_eeprom(dev, eeprom+0xc0);
@@ -1980,6 +1986,11 @@ void cx23885_card_setup(struct cx23885_dev *dev)
                ts2->ts_clk_en_val = 0x1; /* Enable TS_CLK */
                ts2->src_sel_val   = CX23885_SRC_SEL_PARALLEL_MPEG_VIDEO;
                break;
+        case CX23885_BOARD_HAUPPAUGE_STARBURST:
+                ts1->gen_ctrl_val  = 0xc; /* Serial bus + punctured clock */
+                ts1->ts_clk_en_val = 0x1; /* Enable TS_CLK */
+                ts1->src_sel_val   = CX23885_SRC_SEL_PARALLEL_MPEG_VIDEO;
+                break;
        case CX23885_BOARD_DVBSKY_T9580:
        case CX23885_BOARD_DVBSKY_T982:
                ts1->gen_ctrl_val  = 0x5; /* Parallel */
diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
index 1d9d0f86ca8c..1ad49946d7fa 100644
--- a/drivers/media/pci/cx23885/cx23885-core.c
+++ b/drivers/media/pci/cx23885/cx23885-core.c
@@ -2049,11 +2049,11 @@ static void cx23885_finidev(struct pci_dev *pci_dev)
        cx23885_shutdown(dev);
-        pci_disable_device(pci_dev);
        /* unregister stuff */
        free_irq(pci_dev->irq, dev);
+        pci_disable_device(pci_dev);
        cx23885_dev_unregister(dev);
        vb2_dma_sg_cleanup_ctx(dev->alloc_ctx);
        v4l2_ctrl_handler_free(&dev->ctrl_handler);
diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
index c47d18270cfc..a9c450d4b54e 100644
--- a/drivers/media/pci/cx23885/cx23885-dvb.c
+++ b/drivers/media/pci/cx23885/cx23885-dvb.c
@@ -1710,6 +1710,17 @@ static int dvb_register(struct cx23885_tsport *port)
                        break;
                }
                break;
+        case CX23885_BOARD_HAUPPAUGE_STARBURST:
+                i2c_bus = &dev->i2c_bus[0];
+                fe0->dvb.frontend = dvb_attach(tda10071_attach,
+                                                &hauppauge_tda10071_config,
+                                                &i2c_bus->i2c_adap);
+                if (fe0->dvb.frontend != NULL) {
+                        dvb_attach(a8293_attach, fe0->dvb.frontend,
+                                   &i2c_bus->i2c_adap,
+                                   &hauppauge_a8293_config);
+                }
+                break;
        case CX23885_BOARD_DVBSKY_T9580:
        case CX23885_BOARD_DVBSKY_S950:
                i2c_bus = &dev->i2c_bus[0];
diff --git a/drivers/media/pci/cx23885/cx23885.h b/drivers/media/pci/cx23885/cx23885.h
index f55cd12da0fd..36f2f96c40e4 100644
--- a/drivers/media/pci/cx23885/cx23885.h
+++ b/drivers/media/pci/cx23885/cx23885.h
@@ -99,6 +99,7 @@
 #define CX23885_BOARD_DVBSKY_S950              49
 #define CX23885_BOARD_DVBSKY_S952              50
 #define CX23885_BOARD_DVBSKY_T982              51
+#define CX23885_BOARD_HAUPPAUGE_STARBURST      52
 #define GPIO_0 0x00000001
 #define GPIO_1 0x00000002
diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c
index b463fe172d16..3fe9047ef466 100644
--- a/drivers/media/platform/omap3isp/ispvideo.c
+++ b/drivers/media/platform/omap3isp/ispvideo.c
@@ -602,10 +602,13 @@ isp_video_querycap(struct file *file, void *fh, struct v4l2_capability *cap)
        strlcpy(cap->card, video->video.name, sizeof(cap->card));
        strlcpy(cap->bus_info, "media", sizeof(cap->bus_info));
+        cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_VIDEO_OUTPUT
+                | V4L2_CAP_STREAMING | V4L2_CAP_DEVICE_CAPS;
        if (video->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
-                cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+                cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
        else
-                cap->capabilities = V4L2_CAP_VIDEO_OUTPUT | V4L2_CAP_STREAMING;
+                cap->device_caps = V4L2_CAP_VIDEO_OUTPUT | V4L2_CAP_STREAMING;
        return 0;
 }
diff --git a/drivers/media/platform/soc_camera/atmel-isi.c b/drivers/media/platform/soc_camera/atmel-isi.c
index 8efe40337608..6d885239b16a 100644
--- a/drivers/media/platform/soc_camera/atmel-isi.c
+++ b/drivers/media/platform/soc_camera/atmel-isi.c
@@ -760,8 +760,9 @@ static int isi_camera_querycap(struct soc_camera_host *ici,
 {
        strcpy(cap->driver, "atmel-isi");
        strcpy(cap->card, "Atmel Image Sensor Interface");
-        cap->capabilities = (V4L2_CAP_VIDEO_CAPTURE |
+        cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
-                                V4L2_CAP_STREAMING);
+        cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
        return 0;
 }
diff --git a/drivers/media/platform/soc_camera/mx2_camera.c b/drivers/media/platform/soc_camera/mx2_camera.c
index ce72bd26a6ac..192377f55840 100644
--- a/drivers/media/platform/soc_camera/mx2_camera.c
+++ b/drivers/media/platform/soc_camera/mx2_camera.c
@@ -1256,7 +1256,8 @@ static int mx2_camera_querycap(struct soc_camera_host *ici,
 {
        /* cap->name is set by the friendly caller:-> */
        strlcpy(cap->card, MX2_CAM_DRIVER_DESCRIPTION, sizeof(cap->card));
-        cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
        return 0;
 }
diff --git a/drivers/media/platform/soc_camera/mx3_camera.c b/drivers/media/platform/soc_camera/mx3_camera.c
index a60c3bb0e4cc..0b3299dee05d 100644
--- a/drivers/media/platform/soc_camera/mx3_camera.c
+++ b/drivers/media/platform/soc_camera/mx3_camera.c
@@ -967,7 +967,8 @@ static int mx3_camera_querycap(struct soc_camera_host *ici,
 {
        /* cap->name is set by the firendly caller:-> */
        strlcpy(cap->card, "i.MX3x Camera", sizeof(cap->card));
-        cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
        return 0;
 }
diff --git a/drivers/media/platform/soc_camera/omap1_camera.c b/drivers/media/platform/soc_camera/omap1_camera.c
index e6b93281f246..16f65ecb70a3 100644
--- a/drivers/media/platform/soc_camera/omap1_camera.c
+++ b/drivers/media/platform/soc_camera/omap1_camera.c
@@ -1427,7 +1427,8 @@ static int omap1_cam_querycap(struct soc_camera_host *ici,
 {
        /* cap->name is set by the friendly caller:-> */
        strlcpy(cap->card, "OMAP1 Camera", sizeof(cap->card));
-        cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
        return 0;
 }
diff --git a/drivers/media/platform/soc_camera/pxa_camera.c b/drivers/media/platform/soc_camera/pxa_camera.c
index 951226af0eba..8d6e343fec0f 100644
--- a/drivers/media/platform/soc_camera/pxa_camera.c
+++ b/drivers/media/platform/soc_camera/pxa_camera.c
@@ -1576,7 +1576,8 @@ static int pxa_camera_querycap(struct soc_camera_host *ici,
 {
        /* cap->name is set by the firendly caller:-> */
        strlcpy(cap->card, pxa_cam_driver_description, sizeof(cap->card));
-        cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
        return 0;
 }
diff --git a/drivers/media/platform/soc_camera/rcar_vin.c b/drivers/media/platform/soc_camera/rcar_vin.c
index 0c1f55648106..9f1473c0a0cf 100644
--- a/drivers/media/platform/soc_camera/rcar_vin.c
+++ b/drivers/media/platform/soc_camera/rcar_vin.c
@@ -1799,7 +1799,9 @@ static int rcar_vin_querycap(struct soc_camera_host *ici,
                             struct v4l2_capability *cap)
 {
        strlcpy(cap->card, "R_Car_VIN", sizeof(cap->card));
-        cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
        return 0;
 }
diff --git a/drivers/media/platform/soc_camera/sh_mobile_ceu_camera.c b/drivers/media/platform/soc_camera/sh_mobile_ceu_camera.c
index 8b27b3eb2b25..71787702d4a2 100644
--- a/drivers/media/platform/soc_camera/sh_mobile_ceu_camera.c
+++ b/drivers/media/platform/soc_camera/sh_mobile_ceu_camera.c
@@ -1652,7 +1652,9 @@ static int sh_mobile_ceu_querycap(struct soc_camera_host *ici,
                                  struct v4l2_capability *cap)
 {
        strlcpy(cap->card, "SuperH_Mobile_CEU", sizeof(cap->card));
-        cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+        cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
        return 0;
 }
diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index 0f345b1f9014..f327c49d7e09 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -2232,7 +2232,7 @@ static struct dvb_usb_device_properties cxusb_mygica_t230_properties = {
                {
                        "Mygica T230 DVB-T/T2/C",
                        { NULL },
-                        { &cxusb_table[22], NULL },
+                        { &cxusb_table[20], NULL },
                },
        }
 };
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
index 1b158f1167ed..536210b39428 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
@@ -89,16 +89,6 @@ static int vbi_nr[PVR_NUM] = {[0 ... PVR_NUM-1] = -1};
 module_param_array(vbi_nr, int, NULL, 0444);
 MODULE_PARM_DESC(vbi_nr, "Offset for device's vbi dev minor");
-static struct v4l2_capability pvr_capability ={
-        .driver         = "pvrusb2",
-        .card           = "Hauppauge WinTV pvr-usb2",
-        .bus_info       = "usb",
-        .version        = LINUX_VERSION_CODE,
-        .capabilities   = (V4L2_CAP_VIDEO_CAPTURE |
-                           V4L2_CAP_TUNER | V4L2_CAP_AUDIO | V4L2_CAP_RADIO |
-                           V4L2_CAP_READWRITE),
-};
 static struct v4l2_fmtdesc pvr_fmtdesc [] = {
        {
                .index          = 0,
@@ -160,10 +150,22 @@ static int pvr2_querycap(struct file *file, void *priv, struct v4l2_capability *
        struct pvr2_v4l2_fh *fh = file->private_data;
        struct pvr2_hdw *hdw = fh->channel.mc_head->hdw;
-        memcpy(cap, &pvr_capability, sizeof(struct v4l2_capability));
+        strlcpy(cap->driver, "pvrusb2", sizeof(cap->driver));
        strlcpy(cap->bus_info, pvr2_hdw_get_bus_info(hdw),
                        sizeof(cap->bus_info));
        strlcpy(cap->card, pvr2_hdw_get_desc(hdw), sizeof(cap->card));
+        cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TUNER |
+                            V4L2_CAP_AUDIO | V4L2_CAP_RADIO |
+                            V4L2_CAP_READWRITE | V4L2_CAP_DEVICE_CAPS;
+        switch (fh->pdi->devbase.vfl_type) {
+        case VFL_TYPE_GRABBER:
+                cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_AUDIO;
+                break;
+        case VFL_TYPE_RADIO:
+                cap->device_caps = V4L2_CAP_RADIO;
+                break;
+        }
+        cap->device_caps |= V4L2_CAP_TUNER | V4L2_CAP_READWRITE;
        return 0;
 }
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index d09a8916e940..bc08a829bc13 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -3146,27 +3146,26 @@ static int vb2_thread(void *data)
                        prequeue--;
                } else {
                        call_void_qop(q, wait_finish, q);
-                        ret = vb2_internal_dqbuf(q, &fileio->b, 0);
+                        if (!threadio->stop)
+                                ret = vb2_internal_dqbuf(q, &fileio->b, 0);
                        call_void_qop(q, wait_prepare, q);
                        dprintk(5, "file io: vb2_dqbuf result: %d\n", ret);
                }
-                if (threadio->stop)
+                if (ret || threadio->stop)
-                        break;
-                if (ret)
                        break;
                try_to_freeze();
                vb = q->bufs[fileio->b.index];
                if (!(fileio->b.flags & V4L2_BUF_FLAG_ERROR))
-                        ret = threadio->fnc(vb, threadio->priv);
+                        if (threadio->fnc(vb, threadio->priv))
-                if (ret)
+                                break;
-                        break;
                call_void_qop(q, wait_finish, q);
                if (set_timestamp)
                        v4l2_get_timestamp(&fileio->b.timestamp);
-                ret = vb2_internal_qbuf(q, &fileio->b);
+                if (!threadio->stop)
+                        ret = vb2_internal_qbuf(q, &fileio->b);
                call_void_qop(q, wait_prepare, q);
-                if (ret)
+                if (ret || threadio->stop)
                        break;
        }
@@ -3235,11 +3234,11 @@ int vb2_thread_stop(struct vb2_queue *q)
        threadio->stop = true;
        vb2_internal_streamoff(q, q->type);
        call_void_qop(q, wait_prepare, q);
+        err = kthread_stop(threadio->thread);
        q->fileio = NULL;
        fileio->req.count = 0;
        vb2_reqbufs(q, &fileio->req);
        kfree(fileio);
-        err = kthread_stop(threadio->thread);
        threadio->thread = NULL;
        kfree(threadio);
        q->fileio = NULL;
diff --git a/drivers/mfd/da9052-core.c b/drivers/mfd/da9052-core.c
index 52a0c2f6264f..ae498b53ee40 100644
--- a/drivers/mfd/da9052-core.c
+++ b/drivers/mfd/da9052-core.c
@@ -554,7 +554,8 @@ int da9052_device_init(struct da9052 *da9052, u8 chip_id)
                return ret;
        }
-        ret = mfd_add_devices(da9052->dev, -1, da9052_subdev_info,
+        ret = mfd_add_devices(da9052->dev, PLATFORM_DEVID_AUTO,
+                              da9052_subdev_info,
                              ARRAY_SIZE(da9052_subdev_info), NULL, 0, NULL);
        if (ret) {
                dev_err(da9052->dev, "mfd_add_devices failed: %d\n", ret);
diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
index dbdd0faeb6ce..210d1f85679e 100644
--- a/drivers/mfd/rtsx_usb.c
+++ b/drivers/mfd/rtsx_usb.c
@@ -681,21 +681,9 @@ static void rtsx_usb_disconnect(struct usb_interface *intf)
 #ifdef CONFIG_PM
 static int rtsx_usb_suspend(struct usb_interface *intf, pm_message_t message)
 {
-        struct rtsx_ucr *ucr =
-                (struct rtsx_ucr *)usb_get_intfdata(intf);
        dev_dbg(&intf->dev, "%s called with pm message 0x%04x\n",
                        __func__, message.event);
-        /*
-         * Call to make sure LED is off during suspend to save more power.
-         * It is NOT a permanent state and could be turned on anytime later.
-         * Thus no need to call turn_on when resunming.
-         */
-        mutex_lock(&ucr->dev_mutex);
-        rtsx_usb_turn_off_led(ucr);
-        mutex_unlock(&ucr->dev_mutex);
        return 0;
 }
diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index e2f9df1c0c36..2d7fae94c861 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -519,6 +519,7 @@ static const u8 stmpe1601_regs[] = {
        [STMPE_IDX_GPDR_LSB]    = STMPE1601_REG_GPIO_SET_DIR_LSB,
        [STMPE_IDX_GPRER_LSB]   = STMPE1601_REG_GPIO_RE_LSB,
        [STMPE_IDX_GPFER_LSB]   = STMPE1601_REG_GPIO_FE_LSB,
+        [STMPE_IDX_GPPUR_LSB]   = STMPE1601_REG_GPIO_PU_LSB,
        [STMPE_IDX_GPAFR_U_MSB] = STMPE1601_REG_GPIO_AF_U_MSB,
        [STMPE_IDX_IEGPIOR_LSB] = STMPE1601_REG_INT_EN_GPIO_MASK_LSB,
        [STMPE_IDX_ISGPIOR_MSB] = STMPE1601_REG_INT_STA_GPIO_MSB,
@@ -667,6 +668,7 @@ static const u8 stmpe1801_regs[] = {
        [STMPE_IDX_GPDR_LSB]    = STMPE1801_REG_GPIO_SET_DIR_LOW,
        [STMPE_IDX_GPRER_LSB]   = STMPE1801_REG_GPIO_RE_LOW,
        [STMPE_IDX_GPFER_LSB]   = STMPE1801_REG_GPIO_FE_LOW,
+        [STMPE_IDX_GPPUR_LSB]   = STMPE1801_REG_GPIO_PULL_UP_LOW,
        [STMPE_IDX_IEGPIOR_LSB] = STMPE1801_REG_INT_EN_GPIO_MASK_LOW,
        [STMPE_IDX_ISGPIOR_LSB] = STMPE1801_REG_INT_STA_GPIO_LOW,
 };
@@ -750,6 +752,8 @@ static const u8 stmpe24xx_regs[] = {
        [STMPE_IDX_GPDR_LSB]    = STMPE24XX_REG_GPDR_LSB,
        [STMPE_IDX_GPRER_LSB]   = STMPE24XX_REG_GPRER_LSB,
        [STMPE_IDX_GPFER_LSB]   = STMPE24XX_REG_GPFER_LSB,
+        [STMPE_IDX_GPPUR_LSB]   = STMPE24XX_REG_GPPUR_LSB,
+        [STMPE_IDX_GPPDR_LSB]   = STMPE24XX_REG_GPPDR_LSB,
        [STMPE_IDX_GPAFR_U_MSB] = STMPE24XX_REG_GPAFR_U_MSB,
        [STMPE_IDX_IEGPIOR_LSB] = STMPE24XX_REG_IEGPIOR_LSB,
        [STMPE_IDX_ISGPIOR_MSB] = STMPE24XX_REG_ISGPIOR_MSB,
diff --git a/drivers/mfd/stmpe.h b/drivers/mfd/stmpe.h
index bee0abf82040..84adb46b3e2f 100644
--- a/drivers/mfd/stmpe.h
+++ b/drivers/mfd/stmpe.h
@@ -188,6 +188,7 @@ int stmpe_remove(struct stmpe *stmpe);
 #define STMPE1601_REG_GPIO_ED_MSB               0x8A
 #define STMPE1601_REG_GPIO_RE_LSB               0x8D
 #define STMPE1601_REG_GPIO_FE_LSB               0x8F
+#define STMPE1601_REG_GPIO_PU_LSB               0x91
 #define STMPE1601_REG_GPIO_AF_U_MSB             0x92
 #define STMPE1601_SYS_CTRL_ENABLE_GPIO          (1 << 3)
@@ -276,6 +277,8 @@ int stmpe_remove(struct stmpe *stmpe);
 #define STMPE24XX_REG_GPEDR_MSB         0x8C
 #define STMPE24XX_REG_GPRER_LSB         0x91
 #define STMPE24XX_REG_GPFER_LSB         0x94
+#define STMPE24XX_REG_GPPUR_LSB         0x97
+#define STMPE24XX_REG_GPPDR_LSB         0x9a
 #define STMPE24XX_REG_GPAFR_U_MSB       0x9B
 #define STMPE24XX_SYS_CTRL_ENABLE_GPIO          (1 << 3)
diff --git a/drivers/mfd/tps65218.c b/drivers/mfd/tps65218.c
index 0d256cb002eb..d6b764349f9d 100644
--- a/drivers/mfd/tps65218.c
+++ b/drivers/mfd/tps65218.c
@@ -125,10 +125,21 @@ int tps65218_clear_bits(struct tps65218 *tps, unsigned int reg,
 }
 EXPORT_SYMBOL_GPL(tps65218_clear_bits);
+static const struct regmap_range tps65218_yes_ranges[] = {
+        regmap_reg_range(TPS65218_REG_INT1, TPS65218_REG_INT2),
+        regmap_reg_range(TPS65218_REG_STATUS, TPS65218_REG_STATUS),
+};
+static const struct regmap_access_table tps65218_volatile_table = {
+        .yes_ranges = tps65218_yes_ranges,
+        .n_yes_ranges = ARRAY_SIZE(tps65218_yes_ranges),
+};
 static struct regmap_config tps65218_regmap_config = {
        .reg_bits = 8,
        .val_bits = 8,
        .cache_type = REGCACHE_RBTREE,
+        .volatile_table = &tps65218_volatile_table,
 };
 static const struct regmap_irq tps65218_irqs[] = {
@@ -193,6 +204,7 @@ static struct regmap_irq_chip tps65218_irq_chip = {
        .num_regs = 2,
        .mask_base = TPS65218_REG_INT_MASK1,
+        .status_base = TPS65218_REG_INT1,
 };
 static const struct of_device_id of_tps65218_match_table[] = {
diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
index 51fd6b524371..d1b55fe62817 100644
--- a/drivers/misc/cxl/context.c
+++ b/drivers/misc/cxl/context.c
@@ -100,6 +100,46 @@ int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master,
        return 0;
 }
+static int cxl_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+        struct cxl_context *ctx = vma->vm_file->private_data;
+        unsigned long address = (unsigned long)vmf->virtual_address;
+        u64 area, offset;
+        offset = vmf->pgoff << PAGE_SHIFT;
+        pr_devel("%s: pe: %i address: 0x%lx offset: 0x%llx\n",
+                        __func__, ctx->pe, address, offset);
+        if (ctx->afu->current_mode == CXL_MODE_DEDICATED) {
+                area = ctx->afu->psn_phys;
+                if (offset > ctx->afu->adapter->ps_size)
+                        return VM_FAULT_SIGBUS;
+        } else {
+                area = ctx->psn_phys;
+                if (offset > ctx->psn_size)
+                        return VM_FAULT_SIGBUS;
+        }
+        mutex_lock(&ctx->status_mutex);
+        if (ctx->status != STARTED) {
+                mutex_unlock(&ctx->status_mutex);
+                pr_devel("%s: Context not started, failing problem state access\n", __func__);
+                return VM_FAULT_SIGBUS;
+        }
+        vm_insert_pfn(vma, address, (area + offset) >> PAGE_SHIFT);
+        mutex_unlock(&ctx->status_mutex);
+        return VM_FAULT_NOPAGE;
+}
+static const struct vm_operations_struct cxl_mmap_vmops = {
+        .fault = cxl_mmap_fault,
+};
 /*
 * Map a per-context mmio space into the given vma.
 */
@@ -108,26 +148,25 @@ int cxl_context_iomap(struct cxl_context *ctx, struct vm_area_struct *vma)
        u64 len = vma->vm_end - vma->vm_start;
        len = min(len, ctx->psn_size);
-        if (ctx->afu->current_mode == CXL_MODE_DEDICATED) {
+        if (ctx->afu->current_mode != CXL_MODE_DEDICATED) {
-                vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+                /* make sure there is a valid per process space for this AFU */
-                return vm_iomap_memory(vma, ctx->afu->psn_phys, ctx->afu->adapter->ps_size);
+                if ((ctx->master && !ctx->afu->psa) || (!ctx->afu->pp_psa)) {
-        }
+                        pr_devel("AFU doesn't support mmio space\n");
+                        return -EINVAL;
+                }
-        /* make sure there is a valid per process space for this AFU */
+                /* Can't mmap until the AFU is enabled */
-        if ((ctx->master && !ctx->afu->psa) || (!ctx->afu->pp_psa)) {
+                if (!ctx->afu->enabled)
-                pr_devel("AFU doesn't support mmio space\n");
+                        return -EBUSY;
-                return -EINVAL;
        }
-        /* Can't mmap until the AFU is enabled */
-        if (!ctx->afu->enabled)
-                return -EBUSY;
        pr_devel("%s: mmio physical: %llx pe: %i master:%i\n", __func__,
                 ctx->psn_phys, ctx->pe , ctx->master);
+        vma->vm_flags |= VM_IO | VM_PFNMAP;
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-        return vm_iomap_memory(vma, ctx->psn_phys, len);
+        vma->vm_ops = &cxl_mmap_vmops;
+        return 0;
 }
 /*
@@ -150,12 +189,6 @@ static void __detach_context(struct cxl_context *ctx)
        afu_release_irqs(ctx);
        flush_work(&ctx->fault_work); /* Only needed for dedicated process */
        wake_up_all(&ctx->wq);
-        /* Release Problem State Area mapping */
-        mutex_lock(&ctx->mapping_lock);
-        if (ctx->mapping)
-                unmap_mapping_range(ctx->mapping, 0, 0, 1);
-        mutex_unlock(&ctx->mapping_lock);
 }
 /*
@@ -184,6 +217,17 @@ void cxl_context_detach_all(struct cxl_afu *afu)
                 * created and torn down after the IDR removed
                 */
                __detach_context(ctx);
+                /*
+                 * We are force detaching - remove any active PSA mappings so
+                 * userspace cannot interfere with the card if it comes back.
+                 * Easiest way to exercise this is to unbind and rebind the
+                 * driver via sysfs while it is in use.
+                 */
+                mutex_lock(&ctx->mapping_lock);
+                if (ctx->mapping)
+                        unmap_mapping_range(ctx->mapping, 0, 0, 1);
+                mutex_unlock(&ctx->mapping_lock);
        }
        mutex_unlock(&afu->contexts_lock);
 }
diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
index e9f2f10dbb37..b15d8113877c 100644
--- a/drivers/misc/cxl/file.c
+++ b/drivers/misc/cxl/file.c
@@ -140,18 +140,20 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
        pr_devel("%s: pe: %i\n", __func__, ctx->pe);
-        mutex_lock(&ctx->status_mutex);
+        /* Do this outside the status_mutex to avoid a circular dependency with
-        if (ctx->status != OPENED) {
+         * the locking in cxl_mmap_fault() */
-                rc = -EIO;
-                goto out;
-        }
        if (copy_from_user(&work, uwork,
                           sizeof(struct cxl_ioctl_start_work))) {
                rc = -EFAULT;
                goto out;
        }
+        mutex_lock(&ctx->status_mutex);
+        if (ctx->status != OPENED) {
+                rc = -EIO;
+                goto out;
+        }
        /*
         * if any of the reserved fields are set or any of the unused
         * flags are set it's invalid
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index ff2755062b44..06ff0a2ec960 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -234,6 +234,18 @@ static int mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
        struct mei_me_hw *hw = to_me_hw(dev);
        u32 hcsr = mei_hcsr_read(hw);
+        /* H_RST may be found lit before reset is started,
+         * for example if preceding reset flow hasn't completed.
+         * In that case asserting H_RST will be ignored, therefore
+         * we need to clean H_RST bit to start a successful reset sequence.
+         */
+        if ((hcsr & H_RST) == H_RST) {
+                dev_warn(dev->dev, "H_RST is set = 0x%08X", hcsr);
+                hcsr &= ~H_RST;
+                mei_me_reg_write(hw, H_CSR, hcsr);
+                hcsr = mei_hcsr_read(hw);
+        }
        hcsr |= H_RST | H_IG | H_IS;
        if (intr_enable)
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 02ad79229f65..7466ce098e60 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -886,7 +886,7 @@ static int mmc_select_bus_width(struct mmc_card *card)
        unsigned idx, bus_width = 0;
        int err = 0;
-        if (!mmc_can_ext_csd(card) &&
+        if (!mmc_can_ext_csd(card) ||
            !(host->caps & (MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA)))
                return 0;
diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
index e3e56d35f0ee..970314e0aac8 100644
--- a/drivers/mmc/host/sdhci-acpi.c
+++ b/drivers/mmc/host/sdhci-acpi.c
@@ -247,6 +247,7 @@ static const struct sdhci_acpi_uid_slot sdhci_acpi_uids[] = {
        { "INT33BB"  , "3" , &sdhci_acpi_slot_int_sd },
        { "INT33C6"  , NULL, &sdhci_acpi_slot_int_sdio },
        { "INT3436"  , NULL, &sdhci_acpi_slot_int_sdio },
+        { "INT344D"  , NULL, &sdhci_acpi_slot_int_sdio },
        { "PNP0D40"  },
        { },
 };
@@ -257,6 +258,7 @@ static const struct acpi_device_id sdhci_acpi_ids[] = {
        { "INT33BB"  },
        { "INT33C6"  },
        { "INT3436"  },
+        { "INT344D"  },
        { "PNP0D40"  },
        { },
 };
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index 03427755b902..4f38554ce679 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -993,6 +993,31 @@ static const struct pci_device_id pci_ids[] = {
                .subdevice      = PCI_ANY_ID,
                .driver_data    = (kernel_ulong_t)&sdhci_intel_mrfl_mmc,
        },
+        {
+                .vendor         = PCI_VENDOR_ID_INTEL,
+                .device         = PCI_DEVICE_ID_INTEL_SPT_EMMC,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .driver_data    = (kernel_ulong_t)&sdhci_intel_byt_emmc,
+        },
+        {
+                .vendor         = PCI_VENDOR_ID_INTEL,
+                .device         = PCI_DEVICE_ID_INTEL_SPT_SDIO,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .driver_data    = (kernel_ulong_t)&sdhci_intel_byt_sdio,
+        },
+        {
+                .vendor         = PCI_VENDOR_ID_INTEL,
+                .device         = PCI_DEVICE_ID_INTEL_SPT_SD,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .driver_data    = (kernel_ulong_t)&sdhci_intel_byt_sd,
+        },
        {
                .vendor         = PCI_VENDOR_ID_O2,
                .device         = PCI_DEVICE_ID_O2_8120,
diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h
index d57c3d169914..1ec684d06d54 100644
--- a/drivers/mmc/host/sdhci-pci.h
+++ b/drivers/mmc/host/sdhci-pci.h
@@ -21,6 +21,9 @@
 #define PCI_DEVICE_ID_INTEL_CLV_EMMC0   0x08e5
 #define PCI_DEVICE_ID_INTEL_CLV_EMMC1   0x08e6
 #define PCI_DEVICE_ID_INTEL_QRK_SD      0x08A7
+#define PCI_DEVICE_ID_INTEL_SPT_EMMC    0x9d2b
+#define PCI_DEVICE_ID_INTEL_SPT_SDIO    0x9d2c
+#define PCI_DEVICE_ID_INTEL_SPT_SD      0x9d2d
 /*
 * PCI registers
diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
index 45238871192d..ca3424e7ef71 100644
--- a/drivers/mmc/host/sdhci-pxav3.c
+++ b/drivers/mmc/host/sdhci-pxav3.c
@@ -300,13 +300,6 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
        if (IS_ERR(host))
                return PTR_ERR(host);
-        if (of_device_is_compatible(np, "marvell,armada-380-sdhci")) {
-                ret = mv_conf_mbus_windows(pdev, mv_mbus_dram_info());
-                if (ret < 0)
-                        goto err_mbus_win;
-        }
        pltfm_host = sdhci_priv(host);
        pltfm_host->priv = pxa;
@@ -325,6 +318,12 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
        if (!IS_ERR(pxa->clk_core))
                clk_prepare_enable(pxa->clk_core);
+        if (of_device_is_compatible(np, "marvell,armada-380-sdhci")) {
+                ret = mv_conf_mbus_windows(pdev, mv_mbus_dram_info());
+                if (ret < 0)
+                        goto err_mbus_win;
+        }
        /* enable 1/8V DDR capable */
        host->mmc->caps |= MMC_CAP_1_8V_DDR;
@@ -396,11 +395,11 @@ err_add_host:
        pm_runtime_disable(&pdev->dev);
 err_of_parse:
 err_cd_req:
+err_mbus_win:
        clk_disable_unprepare(pxa->clk_io);
        if (!IS_ERR(pxa->clk_core))
                clk_disable_unprepare(pxa->clk_core);
 err_clk_get:
-err_mbus_win:
        sdhci_pltfm_free(pdev);
        return ret;
 }
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index cbb245b58538..f1a488ee432f 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -259,8 +259,6 @@ static void sdhci_reinit(struct sdhci_host *host)
                del_timer_sync(&host->tuning_timer);
                host->flags &= ~SDHCI_NEEDS_RETUNING;
-                host->mmc->max_blk_count =
-                        (host->quirks & SDHCI_QUIRK_NO_MULTIBLOCK) ? 1 : 65535;
        }
        sdhci_enable_card_detection(host);
 }
@@ -1273,6 +1271,12 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
                spin_unlock_irq(&host->lock);
                mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
                spin_lock_irq(&host->lock);
+                if (mode != MMC_POWER_OFF)
+                        sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
+                else
+                        sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
                return;
        }
@@ -1353,6 +1357,8 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
        sdhci_runtime_pm_get(host);
+        present = mmc_gpio_get_cd(host->mmc);
        spin_lock_irqsave(&host->lock, flags);
        WARN_ON(host->mrq != NULL);
@@ -1381,7 +1387,6 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
         *     zero: cd-gpio is used, and card is removed
         *     one: cd-gpio is used, and card is present
         */
-        present = mmc_gpio_get_cd(host->mmc);
        if (present < 0) {
                /* If polling, assume that the card is always present. */
                if (host->quirks & SDHCI_QUIRK_BROKEN_CARD_DETECTION)
@@ -1880,6 +1885,18 @@ static int sdhci_card_busy(struct mmc_host *mmc)
        return !(present_state & SDHCI_DATA_LVL_MASK);
 }
+static int sdhci_prepare_hs400_tuning(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+        struct sdhci_host *host = mmc_priv(mmc);
+        unsigned long flags;
+        spin_lock_irqsave(&host->lock, flags);
+        host->flags |= SDHCI_HS400_TUNING;
+        spin_unlock_irqrestore(&host->lock, flags);
+        return 0;
+}
 static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
        struct sdhci_host *host = mmc_priv(mmc);
@@ -1887,10 +1904,18 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
        int tuning_loop_counter = MAX_TUNING_LOOP;
        int err = 0;
        unsigned long flags;
+        unsigned int tuning_count = 0;
+        bool hs400_tuning;
        sdhci_runtime_pm_get(host);
        spin_lock_irqsave(&host->lock, flags);
+        hs400_tuning = host->flags & SDHCI_HS400_TUNING;
+        host->flags &= ~SDHCI_HS400_TUNING;
+        if (host->tuning_mode == SDHCI_TUNING_MODE_1)
+                tuning_count = host->tuning_count;
        /*
         * The Host Controller needs tuning only in case of SDR104 mode
         * and for SDR50 mode when Use Tuning for SDR50 is set in the
@@ -1899,8 +1924,20 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
         * tuning function has to be executed.
         */
        switch (host->timing) {
+        /* HS400 tuning is done in HS200 mode */
        case MMC_TIMING_MMC_HS400:
+                err = -EINVAL;
+                goto out_unlock;
        case MMC_TIMING_MMC_HS200:
+                /*
+                 * Periodic re-tuning for HS400 is not expected to be needed, so
+                 * disable it here.
+                 */
+                if (hs400_tuning)
+                        tuning_count = 0;
+                break;
        case MMC_TIMING_UHS_SDR104:
                break;
@@ -1911,9 +1948,7 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
                /* FALLTHROUGH */
        default:
-                spin_unlock_irqrestore(&host->lock, flags);
+                goto out_unlock;
-                sdhci_runtime_pm_put(host);
-                return 0;
        }
        if (host->ops->platform_execute_tuning) {
@@ -2037,24 +2072,11 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
        }
 out:
-        /*
+        host->flags &= ~SDHCI_NEEDS_RETUNING;
-         * If this is the very first time we are here, we start the retuning
-         * timer. Since only during the first time, SDHCI_NEEDS_RETUNING
+        if (tuning_count) {
-         * flag won't be set, we check this condition before actually starting
-         * the timer.
-         */
-        if (!(host->flags & SDHCI_NEEDS_RETUNING) && host->tuning_count &&
-            (host->tuning_mode == SDHCI_TUNING_MODE_1)) {
                host->flags |= SDHCI_USING_RETUNING_TIMER;
-                mod_timer(&host->tuning_timer, jiffies +
+                mod_timer(&host->tuning_timer, jiffies + tuning_count * HZ);
-                        host->tuning_count * HZ);
-                /* Tuning mode 1 limits the maximum data length to 4MB */
-                mmc->max_blk_count = (4 * 1024 * 1024) / mmc->max_blk_size;
-        } else if (host->flags & SDHCI_USING_RETUNING_TIMER) {
-                host->flags &= ~SDHCI_NEEDS_RETUNING;
-                /* Reload the new initial value for timer */
-                mod_timer(&host->tuning_timer, jiffies +
-                          host->tuning_count * HZ);
        }
        /*
@@ -2070,6 +2092,7 @@ out:
        sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
        sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
+out_unlock:
        spin_unlock_irqrestore(&host->lock, flags);
        sdhci_runtime_pm_put(host);
@@ -2110,15 +2133,18 @@ static void sdhci_card_event(struct mmc_host *mmc)
 {
        struct sdhci_host *host = mmc_priv(mmc);
        unsigned long flags;
+        int present;
        /* First check if client has provided their own card event */
        if (host->ops->card_event)
                host->ops->card_event(host);
+        present = sdhci_do_get_cd(host);
        spin_lock_irqsave(&host->lock, flags);
        /* Check host->mrq first in case we are runtime suspended */
-        if (host->mrq && !sdhci_do_get_cd(host)) {
+        if (host->mrq && !present) {
                pr_err("%s: Card removed during transfer!\n",
                        mmc_hostname(host->mmc));
                pr_err("%s: Resetting controller.\n",
@@ -2142,6 +2168,7 @@ static const struct mmc_host_ops sdhci_ops = {
        .hw_reset       = sdhci_hw_reset,
        .enable_sdio_irq = sdhci_enable_sdio_irq,
        .start_signal_voltage_switch    = sdhci_start_signal_voltage_switch,
+        .prepare_hs400_tuning           = sdhci_prepare_hs400_tuning,
        .execute_tuning                 = sdhci_execute_tuning,
        .card_event                     = sdhci_card_event,
        .card_busy      = sdhci_card_busy,
@@ -3260,8 +3287,9 @@ int sdhci_add_host(struct sdhci_host *host)
                mmc->max_segs = SDHCI_MAX_SEGS;
        /*
-         * Maximum number of sectors in one transfer. Limited by DMA boundary
+         * Maximum number of sectors in one transfer. Limited by SDMA boundary
-         * size (512KiB).
+         * size (512KiB). Note some tuning modes impose a 4MiB limit, but this
+         * is less anyway.
         */
        mmc->max_req_size = 524288;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index d6607ee9c855..84673ebcf428 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -197,6 +197,7 @@ config NETCONSOLE_DYNAMIC
 config NETPOLL
        def_bool NETCONSOLE
+        select SRCU
 config NET_POLL_CONTROLLER
        def_bool NETPOLL
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 184c434ae305..0dceba1a2ba1 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1648,7 +1648,7 @@ static int __bond_release_one(struct net_device *bond_dev,
        /* slave is not a slave or master is not master of this slave */
        if (!(slave_dev->flags & IFF_SLAVE) ||
            !netdev_has_upper_dev(slave_dev, bond_dev)) {
-                netdev_err(bond_dev, "cannot release %s\n",
+                netdev_dbg(bond_dev, "cannot release %s\n",
                           slave_dev->name);
                return -EINVAL;
        }
diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
index 5e40a8b68cbe..b3b922adc0e4 100644
--- a/drivers/net/caif/caif_hsi.c
+++ b/drivers/net/caif/caif_hsi.c
@@ -1415,7 +1415,6 @@ static int caif_hsi_newlink(struct net *src_net, struct net_device *dev,
        cfhsi = netdev_priv(dev);
        cfhsi_netlink_parms(data, cfhsi);
-        dev_net_set(cfhsi->ndev, src_net);
        get_ops = symbol_get(cfhsi_get_ops);
        if (!get_ops) {
diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c
index a5fefb9059c5..b306210b02b7 100644
--- a/drivers/net/caif/caif_virtio.c
+++ b/drivers/net/caif/caif_virtio.c
@@ -257,7 +257,6 @@ static int cfv_rx_poll(struct napi_struct *napi, int quota)
        struct vringh_kiov *riov = &cfv->ctx.riov;
        unsigned int skb_len;
-again:
        do {
                skb = NULL;
@@ -322,7 +321,6 @@ exit:
                    napi_schedule_prep(napi)) {
                        vringh_notify_disable_kern(cfv->vr_rx);
                        __napi_schedule(napi);
-                        goto again;
                }
                break;
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index f94a9fa60488..c672c4dcffac 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -615,6 +615,9 @@ static void c_can_stop(struct net_device *dev)
        c_can_irq_control(priv, false);
+        /* put ctrl to init on stop to end ongoing transmission */
+        priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_INIT);
        /* deactivate pins */
        pinctrl_pm_select_sleep_state(dev->dev.parent);
        priv->can.state = CAN_STATE_STOPPED;
diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index f363972cd77d..e36d10520e24 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -103,27 +103,34 @@ static void c_can_hw_raminit_syscon(const struct c_can_priv *priv, bool enable)
        mask = 1 << raminit->bits.start | 1 << raminit->bits.done;
        regmap_read(raminit->syscon, raminit->reg, &ctrl);
-        /* We clear the done and start bit first. The start bit is
+        /* We clear the start bit first. The start bit is
         * looking at the 0 -> transition, but is not self clearing;
-         * And we clear the init done bit as well.
         * NOTE: DONE must be written with 1 to clear it.
+         * We can't clear the DONE bit here using regmap_update_bits()
+         * as it will bypass the write if initial condition is START:0 DONE:1
+         * e.g. on DRA7 which needs START pulse.
         */
-        ctrl &= ~(1 << raminit->bits.start);
+        ctrl &= ~mask;  /* START = 0, DONE = 0 */
-        ctrl |= 1 << raminit->bits.done;
+        regmap_update_bits(raminit->syscon, raminit->reg, mask, ctrl);
-        regmap_write(raminit->syscon, raminit->reg, ctrl);
-        ctrl &= ~(1 << raminit->bits.done);
+        /* check if START bit is 0. Ignore DONE bit for now
-        c_can_hw_raminit_wait_syscon(priv, mask, ctrl);
+         * as it can be either 0 or 1.
+         */
+        c_can_hw_raminit_wait_syscon(priv, 1 << raminit->bits.start, ctrl);
        if (enable) {
-                /* Set start bit and wait for the done bit. */
+                /* Clear DONE bit & set START bit. */
                ctrl |= 1 << raminit->bits.start;
-                regmap_write(raminit->syscon, raminit->reg, ctrl);
+                /* DONE must be written with 1 to clear it */
+                ctrl |= 1 << raminit->bits.done;
+                regmap_update_bits(raminit->syscon, raminit->reg, mask, ctrl);
+                /* prevent further clearing of DONE bit */
+                ctrl &= ~(1 << raminit->bits.done);
                /* clear START bit if start pulse is needed */
                if (raminit->needs_pulse) {
                        ctrl &= ~(1 << raminit->bits.start);
-                        regmap_write(raminit->syscon, raminit->reg, ctrl);
+                        regmap_update_bits(raminit->syscon, raminit->reg,
+                                           mask, ctrl);
                }
                ctrl |= 1 << raminit->bits.done;
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 3ec8f6f25e5f..847c1f813261 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -807,10 +807,14 @@ static int can_changelink(struct net_device *dev,
                if (dev->flags & IFF_UP)
                        return -EBUSY;
                cm = nla_data(data[IFLA_CAN_CTRLMODE]);
-                if (cm->flags & ~priv->ctrlmode_supported)
+                /* check whether changed bits are allowed to be modified */
+                if (cm->mask & ~priv->ctrlmode_supported)
                        return -EOPNOTSUPP;
+                /* clear bits to be modified and copy the flag values */
                priv->ctrlmode &= ~cm->mask;
-                priv->ctrlmode |= cm->flags;
+                priv->ctrlmode |= (cm->flags & cm->mask);
                /* CAN_CTRLMODE_FD can only be set when driver supports FD */
                if (priv->ctrlmode & CAN_CTRLMODE_FD)
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index d7bc462aafdc..244529881be9 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -955,6 +955,11 @@ static struct net_device *alloc_m_can_dev(void)
        priv->can.data_bittiming_const = &m_can_data_bittiming_const;
        priv->can.do_set_mode = m_can_set_mode;
        priv->can.do_get_berr_counter = m_can_get_berr_counter;
+        /* CAN_CTRLMODE_FD_NON_ISO is fixed with M_CAN IP v3.0.1 */
+        priv->can.ctrlmode = CAN_CTRLMODE_FD_NON_ISO;
+        /* CAN_CTRLMODE_FD_NON_ISO can not be changed with M_CAN IP v3.0.1 */
        priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK |
                                        CAN_CTRLMODE_LISTENONLY |
                                        CAN_CTRLMODE_BERR_REPORTING |
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 541fb7a05625..7af379ca861b 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -520,10 +520,10 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
                skb = alloc_can_err_skb(priv->netdev, &cf);
                if (skb) {
                        cf->can_id |= CAN_ERR_RESTARTED;
-                        netif_rx(skb);
                        stats->rx_packets++;
                        stats->rx_bytes += cf->can_dlc;
+                        netif_rx(skb);
                } else {
                        netdev_err(priv->netdev,
                                   "No memory left for err_skb\n");
@@ -587,7 +587,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
                          usb_sndbulkpipe(dev->udev,
                                          dev->bulk_out->bEndpointAddress),
                          buf, msg->len,
-                          kvaser_usb_simple_msg_callback, priv);
+                          kvaser_usb_simple_msg_callback, netdev);
        usb_anchor_urb(urb, &priv->tx_submitted);
        err = usb_submit_urb(urb, GFP_ATOMIC);
@@ -662,11 +662,6 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
        priv = dev->nets[channel];
        stats = &priv->netdev->stats;
-        if (status & M16C_STATE_BUS_RESET) {
-                kvaser_usb_unlink_tx_urbs(priv);
-                return;
-        }
        skb = alloc_can_err_skb(priv->netdev, &cf);
        if (!skb) {
                stats->rx_dropped++;
@@ -677,7 +672,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
        netdev_dbg(priv->netdev, "Error status: 0x%02x\n", status);
-        if (status & M16C_STATE_BUS_OFF) {
+        if (status & (M16C_STATE_BUS_OFF | M16C_STATE_BUS_RESET)) {
                cf->can_id |= CAN_ERR_BUSOFF;
                priv->can.can_stats.bus_off++;
@@ -703,9 +698,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
                }
                new_state = CAN_STATE_ERROR_PASSIVE;
-        }
+        } else if (status & M16C_STATE_BUS_ERROR) {
-        if (status == M16C_STATE_BUS_ERROR) {
                if ((priv->can.state < CAN_STATE_ERROR_WARNING) &&
                    ((txerr >= 96) || (rxerr >= 96))) {
                        cf->can_id |= CAN_ERR_CRTL;
@@ -715,7 +708,8 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
                        priv->can.can_stats.error_warning++;
                        new_state = CAN_STATE_ERROR_WARNING;
-                } else if (priv->can.state > CAN_STATE_ERROR_ACTIVE) {
+                } else if ((priv->can.state > CAN_STATE_ERROR_ACTIVE) &&
+                           ((txerr < 96) && (rxerr < 96))) {
                        cf->can_id |= CAN_ERR_PROT;
                        cf->data[2] = CAN_ERR_PROT_ACTIVE;
@@ -770,10 +764,9 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
        priv->can.state = new_state;
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 static void kvaser_usb_rx_can_err(const struct kvaser_usb_net_priv *priv,
@@ -805,10 +798,9 @@ static void kvaser_usb_rx_can_err(const struct kvaser_usb_net_priv *priv,
                stats->rx_over_errors++;
                stats->rx_errors++;
-                netif_rx(skb);
                stats->rx_packets++;
                stats->rx_bytes += cf->can_dlc;
+                netif_rx(skb);
        }
 }
@@ -887,10 +879,9 @@ static void kvaser_usb_rx_can_msg(const struct kvaser_usb *dev,
                               cf->can_dlc);
        }
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 static void kvaser_usb_start_chip_reply(const struct kvaser_usb *dev,
@@ -1246,6 +1237,9 @@ static int kvaser_usb_close(struct net_device *netdev)
        if (err)
                netdev_warn(netdev, "Cannot stop device, error %d\n", err);
+        /* reset tx contexts */
+        kvaser_usb_unlink_tx_urbs(priv);
        priv->can.state = CAN_STATE_STOPPED;
        close_candev(priv->netdev);
@@ -1294,12 +1288,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
        if (!urb) {
                netdev_err(netdev, "No memory left for URBs\n");
                stats->tx_dropped++;
-                goto nourbmem;
+                dev_kfree_skb(skb);
+                return NETDEV_TX_OK;
        }
        buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC);
        if (!buf) {
                stats->tx_dropped++;
+                dev_kfree_skb(skb);
                goto nobufmem;
        }
@@ -1334,6 +1330,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                }
        }
+        /* This should never happen; it implies a flow control bug */
        if (!context) {
                netdev_warn(netdev, "cannot find free context\n");
                ret =  NETDEV_TX_BUSY;
@@ -1364,9 +1361,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
        if (unlikely(err)) {
                can_free_echo_skb(netdev, context->echo_index);
-                skb = NULL; /* set to NULL to avoid double free in
-                             * dev_kfree_skb(skb) */
                atomic_dec(&priv->active_tx_urbs);
                usb_unanchor_urb(urb);
@@ -1388,8 +1382,6 @@ releasebuf:
        kfree(buf);
 nobufmem:
        usb_free_urb(urb);
-nourbmem:
-        dev_kfree_skb(skb);
        return ret;
 }
@@ -1502,6 +1494,10 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
        struct kvaser_usb_net_priv *priv;
        int i, err;
+        err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
+        if (err)
+                return err;
        netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS);
        if (!netdev) {
                dev_err(&intf->dev, "Cannot alloc candev\n");
@@ -1588,7 +1584,7 @@ static int kvaser_usb_probe(struct usb_interface *intf,
 {
        struct kvaser_usb *dev;
        int err = -ENOMEM;
-        int i;
+        int i, retry = 3;
        dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL);
        if (!dev)
@@ -1606,10 +1602,15 @@ static int kvaser_usb_probe(struct usb_interface *intf,
        usb_set_intfdata(intf, dev);
-        for (i = 0; i < MAX_NET_DEVICES; i++)
+        /* On some x86 laptops, plugging a Kvaser device again after
-                kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, i);
+         * an unplug makes the firmware always ignore the very first
+         * command. For such a case, provide some room for retries
+         * instead of completely exiting the driver.
+         */
+        do {
+                err = kvaser_usb_get_software_info(dev);
+        } while (--retry && err == -ETIMEDOUT);
-        err = kvaser_usb_get_software_info(dev);
        if (err) {
                dev_err(&intf->dev,
                        "Cannot get software infos, error %d\n", err);
diff --git a/drivers/net/ethernet/8390/ne2k-pci.c b/drivers/net/ethernet/8390/ne2k-pci.c
index 89c8d9fc97de..57e97910c728 100644
--- a/drivers/net/ethernet/8390/ne2k-pci.c
+++ b/drivers/net/ethernet/8390/ne2k-pci.c
@@ -246,13 +246,13 @@ static int ne2k_pci_init_one(struct pci_dev *pdev,
        if (!ioaddr || ((pci_resource_flags (pdev, 0) & IORESOURCE_IO) == 0)) {
                dev_err(&pdev->dev, "no I/O resource at PCI BAR #0\n");
-                return -ENODEV;
+                goto err_out;
        }
        if (request_region (ioaddr, NE_IO_EXTENT, DRV_NAME) == NULL) {
                dev_err(&pdev->dev, "I/O resource 0x%x @ 0x%lx busy\n",
                        NE_IO_EXTENT, ioaddr);
-                return -EBUSY;
+                goto err_out;
        }
        reg0 = inb(ioaddr);
@@ -392,6 +392,8 @@ err_out_free_netdev:
        free_netdev (dev);
 err_out_free_res:
        release_region (ioaddr, NE_IO_EXTENT);
+err_out:
+        pci_disable_device(pdev);
        return -ENODEV;
 }
diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
index df76050d0a9d..eadcb053807e 100644
--- a/drivers/net/ethernet/Kconfig
+++ b/drivers/net/ethernet/Kconfig
@@ -156,18 +156,6 @@ source "drivers/net/ethernet/realtek/Kconfig"
 source "drivers/net/ethernet/renesas/Kconfig"
 source "drivers/net/ethernet/rdc/Kconfig"
 source "drivers/net/ethernet/rocker/Kconfig"
-config S6GMAC
-        tristate "S6105 GMAC ethernet support"
-        depends on XTENSA_VARIANT_S6000
-        select PHYLIB
-        ---help---
-          This driver supports the on chip ethernet device on the
-          S6105 xtensa processor.
-          To compile this driver as a module, choose M here. The module
-          will be called s6gmac.
 source "drivers/net/ethernet/samsung/Kconfig"
 source "drivers/net/ethernet/seeq/Kconfig"
 source "drivers/net/ethernet/silan/Kconfig"
diff --git a/drivers/net/ethernet/Makefile b/drivers/net/ethernet/Makefile
index bf56f8b36e90..1367afcd0a8b 100644
--- a/drivers/net/ethernet/Makefile
+++ b/drivers/net/ethernet/Makefile
@@ -66,7 +66,6 @@ obj-$(CONFIG_NET_VENDOR_REALTEK) += realtek/
 obj-$(CONFIG_SH_ETH) += renesas/
 obj-$(CONFIG_NET_VENDOR_RDC) += rdc/
 obj-$(CONFIG_NET_VENDOR_ROCKER) += rocker/
-obj-$(CONFIG_S6GMAC) += s6gmac.o
 obj-$(CONFIG_NET_VENDOR_SAMSUNG) += samsung/
 obj-$(CONFIG_NET_VENDOR_SEEQ) += seeq/
 obj-$(CONFIG_NET_VENDOR_SILAN) += silan/
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 1fcd5568a352..f3470d96837a 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -850,8 +850,10 @@ static int emac_probe(struct platform_device *pdev)
        }
        db->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(db->clk))
+        if (IS_ERR(db->clk)) {
+                ret = PTR_ERR(db->clk);
                goto out;
+        }
        clk_prepare_enable(db->clk);
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index 3498760dc22a..760c72c6e2ac 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -1170,10 +1170,6 @@ tx_request_irq_error:
 init_error:
        free_skbufs(dev);
 alloc_skbuf_error:
-        if (priv->phydev) {
-                phy_disconnect(priv->phydev);
-                priv->phydev = NULL;
-        }
 phy_error:
        return ret;
 }
@@ -1186,12 +1182,9 @@ static int tse_shutdown(struct net_device *dev)
        int ret;
        unsigned long int flags;
-        /* Stop and disconnect the PHY */
+        /* Stop the PHY */
-        if (priv->phydev) {
+        if (priv->phydev)
                phy_stop(priv->phydev);
-                phy_disconnect(priv->phydev);
-                priv->phydev = NULL;
-        }
        netif_stop_queue(dev);
        napi_disable(&priv->napi);
@@ -1525,6 +1518,10 @@ err_free_netdev:
 static int altera_tse_remove(struct platform_device *pdev)
 {
        struct net_device *ndev = platform_get_drvdata(pdev);
+        struct altera_tse_private *priv = netdev_priv(ndev);
+        if (priv->phydev)
+                phy_disconnect(priv->phydev);
        platform_set_drvdata(pdev, NULL);
        altera_tse_mdio_destroy(ndev);
diff --git a/drivers/net/ethernet/amd/Kconfig b/drivers/net/ethernet/amd/Kconfig
index 7a5e4aa5415e..77f1f6048ddd 100644
--- a/drivers/net/ethernet/amd/Kconfig
+++ b/drivers/net/ethernet/amd/Kconfig
@@ -45,7 +45,7 @@ config AMD8111_ETH
 config LANCE
        tristate "AMD LANCE and PCnet (AT1500 and NE2100) support"
-        depends on ISA && ISA_DMA_API
+        depends on ISA && ISA_DMA_API && !ARM
        ---help---
          If you have a network (Ethernet) card of this type, say Y and read
          the Ethernet-HOWTO, available from
@@ -142,7 +142,7 @@ config PCMCIA_NMCLAN
 config NI65
        tristate "NI6510 support"
-        depends on ISA && ISA_DMA_API
+        depends on ISA && ISA_DMA_API && !ARM
        ---help---
          If you have a network (Ethernet) card of this type, say Y and read
          the Ethernet-HOWTO, available from
diff --git a/drivers/net/ethernet/amd/nmclan_cs.c b/drivers/net/ethernet/amd/nmclan_cs.c
index 5b22764ba88d..27245efe9f50 100644
--- a/drivers/net/ethernet/amd/nmclan_cs.c
+++ b/drivers/net/ethernet/amd/nmclan_cs.c
@@ -952,6 +952,8 @@ static irqreturn_t mace_interrupt(int irq, void *dev_id)
  do {
    /* WARNING: MACE_IR is a READ/CLEAR port! */
    status = inb(ioaddr + AM2150_MACE_BASE + MACE_IR);
+    if (!(status & ~MACE_IMR_DEFAULT) && IntrCnt == MACE_MAX_IR_ITERATIONS)
+      return IRQ_NONE;
    pr_debug("mace_interrupt: irq 0x%X status 0x%X.\n", irq, status);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index 75b08c63d39f..29a09271b64a 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -767,16 +767,17 @@
 #define MTL_Q_RQOMR                     0x40
 #define MTL_Q_RQMPOCR                   0x44
 #define MTL_Q_RQDR                      0x4c
+#define MTL_Q_RQFCR                     0x50
 #define MTL_Q_IER                       0x70
 #define MTL_Q_ISR                       0x74
 /* MTL queue register entry bit positions and sizes */
+#define MTL_Q_RQFCR_RFA_INDEX           1
+#define MTL_Q_RQFCR_RFA_WIDTH           6
+#define MTL_Q_RQFCR_RFD_INDEX           17
+#define MTL_Q_RQFCR_RFD_WIDTH           6
 #define MTL_Q_RQOMR_EHFC_INDEX          7
 #define MTL_Q_RQOMR_EHFC_WIDTH          1
-#define MTL_Q_RQOMR_RFA_INDEX           8
-#define MTL_Q_RQOMR_RFA_WIDTH           3
-#define MTL_Q_RQOMR_RFD_INDEX           13
-#define MTL_Q_RQOMR_RFD_WIDTH           3
 #define MTL_Q_RQOMR_RQS_INDEX           16
 #define MTL_Q_RQOMR_RQS_WIDTH           9
 #define MTL_Q_RQOMR_RSF_INDEX           5
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 53f5f66ec2ee..4c66cd1d1e60 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -2079,10 +2079,10 @@ static void xgbe_config_flow_control_threshold(struct xgbe_prv_data *pdata)
        for (i = 0; i < pdata->rx_q_count; i++) {
                /* Activate flow control when less than 4k left in fifo */
-                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQOMR, RFA, 2);
+                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQFCR, RFA, 2);
                /* De-activate flow control when more than 6k left in fifo */
-                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQOMR, RFD, 4);
+                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQFCR, RFD, 4);
        }
 }
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 7bb5f07dbeef..e5ffb2ccb67d 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -523,6 +523,7 @@ void xgbe_get_all_hw_features(struct xgbe_prv_data *pdata)
        hw_feat->sph           = XGMAC_GET_BITS(mac_hfr1, MAC_HWF1R, SPHEN);
        hw_feat->tso           = XGMAC_GET_BITS(mac_hfr1, MAC_HWF1R, TSOEN);
        hw_feat->dma_debug     = XGMAC_GET_BITS(mac_hfr1, MAC_HWF1R, DBGMEMA);
+        hw_feat->rss           = XGMAC_GET_BITS(mac_hfr1, MAC_HWF1R, RSSEN);
        hw_feat->tc_cnt        = XGMAC_GET_BITS(mac_hfr1, MAC_HWF1R, NUMTC);
        hw_feat->hash_table_size = XGMAC_GET_BITS(mac_hfr1, MAC_HWF1R,
                                                  HASHTBLSZ);
@@ -552,13 +553,14 @@ void xgbe_get_all_hw_features(struct xgbe_prv_data *pdata)
                break;
        }
-        /* The Queue and Channel counts are zero based so increment them
+        /* The Queue, Channel and TC counts are zero based so increment them
         * to get the actual number
         */
        hw_feat->rx_q_cnt++;
        hw_feat->tx_q_cnt++;
        hw_feat->rx_ch_cnt++;
        hw_feat->tx_ch_cnt++;
+        hw_feat->tc_cnt++;
        DBGPR("<--xgbe_get_all_hw_features\n");
 }
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 83a50280bb70..793f3b73eeff 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -369,6 +369,8 @@ static int xgene_enet_process_ring(struct xgene_enet_desc_ring *ring,
                if (unlikely(xgene_enet_is_desc_slot_empty(raw_desc)))
                        break;
+                /* read fpqnum field after dataaddr field */
+                dma_rmb();
                if (is_rx_desc(raw_desc))
                        ret = xgene_enet_rx_frame(ring, raw_desc);
                else
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index e398eda07298..c8af3ce3ea38 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -184,15 +184,16 @@ static void alx_schedule_reset(struct alx_priv *alx)
        schedule_work(&alx->reset_wk);
 }
-static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
+static int alx_clean_rx_irq(struct alx_priv *alx, int budget)
 {
        struct alx_rx_queue *rxq = &alx->rxq;
        struct alx_rrd *rrd;
        struct alx_buffer *rxb;
        struct sk_buff *skb;
        u16 length, rfd_cleaned = 0;
+        int work = 0;
-        while (budget > 0) {
+        while (work < budget) {
                rrd = &rxq->rrd[rxq->rrd_read_idx];
                if (!(rrd->word3 & cpu_to_le32(1 << RRD_UPDATED_SHIFT)))
                        break;
@@ -203,7 +204,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
                    ALX_GET_FIELD(le32_to_cpu(rrd->word0),
                                  RRD_NOR) != 1) {
                        alx_schedule_reset(alx);
-                        return 0;
+                        return work;
                }
                rxb = &rxq->bufs[rxq->read_idx];
@@ -243,7 +244,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
                }
                napi_gro_receive(&alx->napi, skb);
-                budget--;
+                work++;
 next_pkt:
                if (++rxq->read_idx == alx->rx_ringsz)
@@ -258,21 +259,22 @@ next_pkt:
        if (rfd_cleaned)
                alx_refill_rx_ring(alx, GFP_ATOMIC);
-        return budget > 0;
+        return work;
 }
 static int alx_poll(struct napi_struct *napi, int budget)
 {
        struct alx_priv *alx = container_of(napi, struct alx_priv, napi);
        struct alx_hw *hw = &alx->hw;
-        bool complete = true;
        unsigned long flags;
+        bool tx_complete;
+        int work;
-        complete = alx_clean_tx_irq(alx) &&
+        tx_complete = alx_clean_tx_irq(alx);
-                   alx_clean_rx_irq(alx, budget);
+        work = alx_clean_rx_irq(alx, budget);
-        if (!complete)
+        if (!tx_complete || work == budget)
-                return 1;
+                return budget;
        napi_complete(&alx->napi);
@@ -284,7 +286,7 @@ static int alx_poll(struct napi_struct *napi, int budget)
        alx_post_write(hw);
-        return 0;
+        return work;
 }
 static irqreturn_t alx_intr_handle(struct alx_priv *alx, u32 intr)
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 05c6af6c418f..3007d95fbb9f 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -1167,10 +1167,10 @@ static int bgmac_poll(struct napi_struct *napi, int weight)
                bgmac->int_status = 0;
        }
-        if (handled < weight)
+        if (handled < weight) {
                napi_complete(napi);
+                bgmac_chip_intrs_on(bgmac);
-        bgmac_chip_intrs_on(bgmac);
+        }
        return handled;
 }
@@ -1515,6 +1515,8 @@ static int bgmac_probe(struct bcma_device *core)
        if (core->bus->sprom.boardflags_lo & BGMAC_BFL_ENETADM)
                bgmac_warn(bgmac, "Support for ADMtek ethernet switch not implemented\n");
+        netif_napi_add(net_dev, &bgmac->napi, bgmac_poll, BGMAC_WEIGHT);
        err = bgmac_mii_register(bgmac);
        if (err) {
                bgmac_err(bgmac, "Cannot register MDIO\n");
@@ -1529,8 +1531,6 @@ static int bgmac_probe(struct bcma_device *core)
        netif_carrier_off(net_dev);
-        netif_napi_add(net_dev, &bgmac->napi, bgmac_poll, BGMAC_WEIGHT);
        return 0;
 err_mii_unregister:
@@ -1549,9 +1549,9 @@ static void bgmac_remove(struct bcma_device *core)
 {
        struct bgmac *bgmac = bcma_get_drvdata(core);
-        netif_napi_del(&bgmac->napi);
        unregister_netdev(bgmac->net_dev);
        bgmac_mii_unregister(bgmac);
+        netif_napi_del(&bgmac->napi);
        bgmac_dma_free(bgmac);
        bcma_set_drvdata(core, NULL);
        free_netdev(bgmac->net_dev);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 1d1147c93d59..e468ed3f210f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3175,7 +3175,7 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
                }
 #endif
                if (!bnx2x_fp_lock_napi(fp))
-                        return work_done;
+                        return budget;
                for_each_cos_in_tx_queue(fp, cos)
                        if (bnx2x_tx_queue_has_work(fp->txdata_ptr[cos]))
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 9f5e38769a29..72eef9fc883e 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12553,9 +12553,11 @@ static int bnx2x_get_phys_port_id(struct net_device *netdev,
        return 0;
 }
-static bool bnx2x_gso_check(struct sk_buff *skb, struct net_device *dev)
+static netdev_features_t bnx2x_features_check(struct sk_buff *skb,
+                                              struct net_device *dev,
+                                              netdev_features_t features)
 {
-        return vxlan_gso_check(skb);
+        return vxlan_features_check(skb, features);
 }
 static const struct net_device_ops bnx2x_netdev_ops = {
@@ -12589,7 +12591,7 @@ static const struct net_device_ops bnx2x_netdev_ops = {
 #endif
        .ndo_get_phys_port_id   = bnx2x_get_phys_port_id,
        .ndo_set_vf_link_state  = bnx2x_set_vf_link_state,
-        .ndo_gso_check          = bnx2x_gso_check,
+        .ndo_features_check     = bnx2x_features_check,
 };
 static int bnx2x_set_coherency_mask(struct bnx2x *bp)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index bb48a610b72a..96bf01ba32dd 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -7413,6 +7413,8 @@ static inline void tg3_netif_start(struct tg3 *tp)
 }
 static void tg3_irq_quiesce(struct tg3 *tp)
+        __releases(tp->lock)
+        __acquires(tp->lock)
 {
        int i;
@@ -7421,8 +7423,12 @@ static void tg3_irq_quiesce(struct tg3 *tp)
        tp->irq_sync = 1;
        smp_mb();
+        spin_unlock_bh(&tp->lock);
        for (i = 0; i < tp->irq_cnt; i++)
                synchronize_irq(tp->napi[i].irq_vec);
+        spin_lock_bh(&tp->lock);
 }
 /* Fully shutdown all tg3 driver activity elsewhere in the system.
@@ -9018,6 +9024,8 @@ static void tg3_restore_clk(struct tg3 *tp)
 /* tp->lock is held. */
 static int tg3_chip_reset(struct tg3 *tp)
+        __releases(tp->lock)
+        __acquires(tp->lock)
 {
        u32 val;
        void (*write_op)(struct tg3 *, u32, u32);
@@ -9073,9 +9081,13 @@ static int tg3_chip_reset(struct tg3 *tp)
        }
        smp_mb();
+        tg3_full_unlock(tp);
        for (i = 0; i < tp->irq_cnt; i++)
                synchronize_irq(tp->napi[i].irq_vec);
+        tg3_full_lock(tp, 0);
        if (tg3_asic_rev(tp) == ASIC_REV_57780) {
                val = tr32(TG3_PCIE_LNKCTL) & ~TG3_PCIE_LNKCTL_L1_PLL_PD_EN;
                tw32(TG3_PCIE_LNKCTL, val | TG3_PCIE_LNKCTL_L1_PLL_PD_DIS);
@@ -10903,11 +10915,13 @@ static void tg3_timer(unsigned long __opaque)
 {
        struct tg3 *tp = (struct tg3 *) __opaque;
-        if (tp->irq_sync || tg3_flag(tp, RESET_TASK_PENDING))
-                goto restart_timer;
        spin_lock(&tp->lock);
+        if (tp->irq_sync || tg3_flag(tp, RESET_TASK_PENDING)) {
+                spin_unlock(&tp->lock);
+                goto restart_timer;
+        }
        if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
            tg3_flag(tp, 57765_CLASS))
                tg3_chk_missed_msi(tp);
@@ -11101,11 +11115,13 @@ static void tg3_reset_task(struct work_struct *work)
        struct tg3 *tp = container_of(work, struct tg3, reset_task);
        int err;
+        rtnl_lock();
        tg3_full_lock(tp, 0);
        if (!netif_running(tp->dev)) {
                tg3_flag_clear(tp, RESET_TASK_PENDING);
                tg3_full_unlock(tp);
+                rtnl_unlock();
                return;
        }
@@ -11138,6 +11154,7 @@ out:
                tg3_phy_start(tp);
        tg3_flag_clear(tp, RESET_TASK_PENDING);
+        rtnl_unlock();
 }
 static int tg3_request_irq(struct tg3 *tp, int irq_num)
@@ -17800,23 +17817,6 @@ static int tg3_init_one(struct pci_dev *pdev,
                goto err_out_apeunmap;
        }
-        /*
-         * Reset chip in case UNDI or EFI driver did not shutdown
-         * DMA self test will enable WDMAC and we'll see (spurious)
-         * pending DMA on the PCI bus at that point.
-         */
-        if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
-            (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
-                tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
-                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-        }
-        err = tg3_test_dma(tp);
-        if (err) {
-                dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
-                goto err_out_apeunmap;
-        }
        intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW;
        rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW;
        sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW;
@@ -17861,6 +17861,23 @@ static int tg3_init_one(struct pci_dev *pdev,
                        sndmbx += 0xc;
        }
+        /*
+         * Reset chip in case UNDI or EFI driver did not shutdown
+         * DMA self test will enable WDMAC and we'll see (spurious)
+         * pending DMA on the PCI bus at that point.
+         */
+        if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
+            (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
+                tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
+                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+        }
+        err = tg3_test_dma(tp);
+        if (err) {
+                dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
+                goto err_out_apeunmap;
+        }
        tg3_init_coal(tp);
        pci_set_drvdata(pdev, dev);
diff --git a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
index 7d6aa8c87df8..619083a860a4 100644
--- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
+++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
@@ -172,7 +172,7 @@ bnad_get_debug_drvinfo(struct bnad *bnad, void *buffer, u32 len)
        /* Retrieve flash partition info */
        fcomp.comp_status = 0;
-        init_completion(&fcomp.comp);
+        reinit_completion(&fcomp.comp);
        spin_lock_irqsave(&bnad->bna_lock, flags);
        ret = bfa_nw_flash_get_attr(&bnad->bna.flash, &drvinfo->flash_attr,
                                bnad_cb_completion, &fcomp);
diff --git a/drivers/net/ethernet/cadence/at91_ether.c b/drivers/net/ethernet/cadence/at91_ether.c
index 55eb7f2af2b4..7ef55f5fa664 100644
--- a/drivers/net/ethernet/cadence/at91_ether.c
+++ b/drivers/net/ethernet/cadence/at91_ether.c
@@ -340,7 +340,7 @@ static int __init at91ether_probe(struct platform_device *pdev)
                res = PTR_ERR(lp->pclk);
                goto err_free_dev;
        }
-        clk_enable(lp->pclk);
+        clk_prepare_enable(lp->pclk);
        lp->hclk = ERR_PTR(-ENOENT);
        lp->tx_clk = ERR_PTR(-ENOENT);
@@ -406,7 +406,7 @@ static int __init at91ether_probe(struct platform_device *pdev)
 err_out_unregister_netdev:
        unregister_netdev(dev);
 err_disable_clock:
-        clk_disable(lp->pclk);
+        clk_disable_unprepare(lp->pclk);
 err_free_dev:
        free_netdev(dev);
        return res;
@@ -424,7 +424,7 @@ static int at91ether_remove(struct platform_device *pdev)
        kfree(lp->mii_bus->irq);
        mdiobus_free(lp->mii_bus);
        unregister_netdev(dev);
-        clk_disable(lp->pclk);
+        clk_disable_unprepare(lp->pclk);
        free_netdev(dev);
        return 0;
@@ -440,7 +440,7 @@ static int at91ether_suspend(struct platform_device *pdev, pm_message_t mesg)
                netif_stop_queue(net_dev);
                netif_device_detach(net_dev);
-                clk_disable(lp->pclk);
+                clk_disable_unprepare(lp->pclk);
        }
        return 0;
 }
@@ -451,7 +451,7 @@ static int at91ether_resume(struct platform_device *pdev)
        struct macb *lp = netdev_priv(net_dev);
        if (netif_running(net_dev)) {
-                clk_enable(lp->pclk);
+                clk_prepare_enable(lp->pclk);
                netif_device_attach(net_dev);
                netif_start_queue(net_dev);
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index d00a751f0588..6049f70e110c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -96,6 +96,9 @@ struct port_info {
        s16 xact_addr_filt;             /* index of our MAC address filter */
        u16 rss_size;                   /* size of VI's RSS table slice */
        u8 pidx;                        /* index into adapter port[] */
+        s8 mdio_addr;
+        u8 port_type;                   /* firmware port type */
+        u8 mod_type;                    /* firmware module type */
        u8 port_id;                     /* physical port ID */
        u8 nqsets;                      /* # of "Queue Sets" */
        u8 first_qset;                  /* index of first "Queue Set" */
@@ -522,6 +525,7 @@ static inline struct adapter *netdev2adap(const struct net_device *dev)
 * is "contracted" to provide for the common code.
 */
 void t4vf_os_link_changed(struct adapter *, int, int);
+void t4vf_os_portmod_changed(struct adapter *, int);
 /*
 * SGE function prototype declarations.
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index aa74ec34a467..a936ee8958c7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -44,6 +44,7 @@
 #include <linux/etherdevice.h>
 #include <linux/debugfs.h>
 #include <linux/ethtool.h>
+#include <linux/mdio.h>
 #include "t4vf_common.h"
 #include "t4vf_defs.h"
@@ -210,6 +211,38 @@ void t4vf_os_link_changed(struct adapter *adapter, int pidx, int link_ok)
 }
 /*
+ * THe port module type has changed on the indicated "port" (Virtual
+ * Interface).
+ */
+void t4vf_os_portmod_changed(struct adapter *adapter, int pidx)
+{
+        static const char * const mod_str[] = {
+                NULL, "LR", "SR", "ER", "passive DA", "active DA", "LRM"
+        };
+        const struct net_device *dev = adapter->port[pidx];
+        const struct port_info *pi = netdev_priv(dev);
+        if (pi->mod_type == FW_PORT_MOD_TYPE_NONE)
+                dev_info(adapter->pdev_dev, "%s: port module unplugged\n",
+                         dev->name);
+        else if (pi->mod_type < ARRAY_SIZE(mod_str))
+                dev_info(adapter->pdev_dev, "%s: %s port module inserted\n",
+                         dev->name, mod_str[pi->mod_type]);
+        else if (pi->mod_type == FW_PORT_MOD_TYPE_NOTSUPPORTED)
+                dev_info(adapter->pdev_dev, "%s: unsupported optical port "
+                         "module inserted\n", dev->name);
+        else if (pi->mod_type == FW_PORT_MOD_TYPE_UNKNOWN)
+                dev_info(adapter->pdev_dev, "%s: unknown port module inserted,"
+                         "forcing TWINAX\n", dev->name);
+        else if (pi->mod_type == FW_PORT_MOD_TYPE_ERROR)
+                dev_info(adapter->pdev_dev, "%s: transceiver module error\n",
+                         dev->name);
+        else
+                dev_info(adapter->pdev_dev, "%s: unknown module type %d "
+                         "inserted\n", dev->name, pi->mod_type);
+}
+/*
 * Net device operations.
 * ======================
 */
@@ -1193,24 +1226,103 @@ static void cxgb4vf_poll_controller(struct net_device *dev)
 * state of the port to which we're linked.
 */
-/*
+static unsigned int t4vf_from_fw_linkcaps(enum fw_port_type type,
- * Return current port link settings.
+                                          unsigned int caps)
- */
+{
-static int cxgb4vf_get_settings(struct net_device *dev,
+        unsigned int v = 0;
-                                struct ethtool_cmd *cmd)
-{
+        if (type == FW_PORT_TYPE_BT_SGMII || type == FW_PORT_TYPE_BT_XFI ||
-        const struct port_info *pi = netdev_priv(dev);
+            type == FW_PORT_TYPE_BT_XAUI) {
+                v |= SUPPORTED_TP;
+                if (caps & FW_PORT_CAP_SPEED_100M)
+                        v |= SUPPORTED_100baseT_Full;
+                if (caps & FW_PORT_CAP_SPEED_1G)
+                        v |= SUPPORTED_1000baseT_Full;
+                if (caps & FW_PORT_CAP_SPEED_10G)
+                        v |= SUPPORTED_10000baseT_Full;
+        } else if (type == FW_PORT_TYPE_KX4 || type == FW_PORT_TYPE_KX) {
+                v |= SUPPORTED_Backplane;
+                if (caps & FW_PORT_CAP_SPEED_1G)
+                        v |= SUPPORTED_1000baseKX_Full;
+                if (caps & FW_PORT_CAP_SPEED_10G)
+                        v |= SUPPORTED_10000baseKX4_Full;
+        } else if (type == FW_PORT_TYPE_KR)
+                v |= SUPPORTED_Backplane | SUPPORTED_10000baseKR_Full;
+        else if (type == FW_PORT_TYPE_BP_AP)
+                v |= SUPPORTED_Backplane | SUPPORTED_10000baseR_FEC |
+                     SUPPORTED_10000baseKR_Full | SUPPORTED_1000baseKX_Full;
+        else if (type == FW_PORT_TYPE_BP4_AP)
+                v |= SUPPORTED_Backplane | SUPPORTED_10000baseR_FEC |
+                     SUPPORTED_10000baseKR_Full | SUPPORTED_1000baseKX_Full |
+                     SUPPORTED_10000baseKX4_Full;
+        else if (type == FW_PORT_TYPE_FIBER_XFI ||
+                 type == FW_PORT_TYPE_FIBER_XAUI ||
+                 type == FW_PORT_TYPE_SFP ||
+                 type == FW_PORT_TYPE_QSFP_10G ||
+                 type == FW_PORT_TYPE_QSA) {
+                v |= SUPPORTED_FIBRE;
+                if (caps & FW_PORT_CAP_SPEED_1G)
+                        v |= SUPPORTED_1000baseT_Full;
+                if (caps & FW_PORT_CAP_SPEED_10G)
+                        v |= SUPPORTED_10000baseT_Full;
+        } else if (type == FW_PORT_TYPE_BP40_BA ||
+                   type == FW_PORT_TYPE_QSFP) {
+                v |= SUPPORTED_40000baseSR4_Full;
+                v |= SUPPORTED_FIBRE;
+        }
+        if (caps & FW_PORT_CAP_ANEG)
+                v |= SUPPORTED_Autoneg;
+        return v;
+}
+static int cxgb4vf_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        const struct port_info *p = netdev_priv(dev);
+        if (p->port_type == FW_PORT_TYPE_BT_SGMII ||
+            p->port_type == FW_PORT_TYPE_BT_XFI ||
+            p->port_type == FW_PORT_TYPE_BT_XAUI)
+                cmd->port = PORT_TP;
+        else if (p->port_type == FW_PORT_TYPE_FIBER_XFI ||
+                 p->port_type == FW_PORT_TYPE_FIBER_XAUI)
+                cmd->port = PORT_FIBRE;
+        else if (p->port_type == FW_PORT_TYPE_SFP ||
+                 p->port_type == FW_PORT_TYPE_QSFP_10G ||
+                 p->port_type == FW_PORT_TYPE_QSA ||
+                 p->port_type == FW_PORT_TYPE_QSFP) {
+                if (p->mod_type == FW_PORT_MOD_TYPE_LR ||
+                    p->mod_type == FW_PORT_MOD_TYPE_SR ||
+                    p->mod_type == FW_PORT_MOD_TYPE_ER ||
+                    p->mod_type == FW_PORT_MOD_TYPE_LRM)
+                        cmd->port = PORT_FIBRE;
+                else if (p->mod_type == FW_PORT_MOD_TYPE_TWINAX_PASSIVE ||
+                         p->mod_type == FW_PORT_MOD_TYPE_TWINAX_ACTIVE)
+                        cmd->port = PORT_DA;
+                else
+                        cmd->port = PORT_OTHER;
+        } else
+                cmd->port = PORT_OTHER;
-        cmd->supported = pi->link_cfg.supported;
+        if (p->mdio_addr >= 0) {
-        cmd->advertising = pi->link_cfg.advertising;
+                cmd->phy_address = p->mdio_addr;
+                cmd->transceiver = XCVR_EXTERNAL;
+                cmd->mdio_support = p->port_type == FW_PORT_TYPE_BT_SGMII ?
+                        MDIO_SUPPORTS_C22 : MDIO_SUPPORTS_C45;
+        } else {
+                cmd->phy_address = 0;  /* not really, but no better option */
+                cmd->transceiver = XCVR_INTERNAL;
+                cmd->mdio_support = 0;
+        }
+        cmd->supported = t4vf_from_fw_linkcaps(p->port_type,
+                                               p->link_cfg.supported);
+        cmd->advertising = t4vf_from_fw_linkcaps(p->port_type,
+                                            p->link_cfg.advertising);
        ethtool_cmd_speed_set(cmd,
-                              netif_carrier_ok(dev) ? pi->link_cfg.speed : -1);
+                              netif_carrier_ok(dev) ? p->link_cfg.speed : 0);
        cmd->duplex = DUPLEX_FULL;
+        cmd->autoneg = p->link_cfg.autoneg;
-        cmd->port = (cmd->supported & SUPPORTED_TP) ? PORT_TP : PORT_FIBRE;
-        cmd->phy_address = pi->port_id;
-        cmd->transceiver = XCVR_EXTERNAL;
-        cmd->autoneg = pi->link_cfg.autoneg;
        cmd->maxtxpkt = 0;
        cmd->maxrxpkt = 0;
        return 0;
@@ -2318,7 +2430,7 @@ static void cfg_queues(struct adapter *adapter)
         */
        n10g = 0;
        for_each_port(adapter, pidx)
-                n10g += is_10g_port(&adap2pinfo(adapter, pidx)->link_cfg);
+                n10g += is_x_10g_port(&adap2pinfo(adapter, pidx)->link_cfg);
        /*
         * We default to 1 queue per non-10G port and up to # of cores queues
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
index 8d3237f5e364..b9debb4f29a3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
@@ -230,7 +230,7 @@ struct adapter_params {
 static inline bool is_10g_port(const struct link_config *lc)
 {
-        return (lc->supported & SUPPORTED_10000baseT_Full) != 0;
+        return (lc->supported & FW_PORT_CAP_SPEED_10G) != 0;
 }
 static inline bool is_x_10g_port(const struct link_config *lc)
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
index 02e8833b7797..60426cf890a7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
@@ -245,6 +245,10 @@ static int hash_mac_addr(const u8 *addr)
        return a & 0x3f;
 }
+#define ADVERT_MASK (FW_PORT_CAP_SPEED_100M | FW_PORT_CAP_SPEED_1G |\
+                     FW_PORT_CAP_SPEED_10G | FW_PORT_CAP_SPEED_40G | \
+                     FW_PORT_CAP_SPEED_100G | FW_PORT_CAP_ANEG)
 /**
 *      init_link_config - initialize a link's SW state
 *      @lc: structure holding the link state
@@ -259,8 +263,8 @@ static void init_link_config(struct link_config *lc, unsigned int caps)
        lc->requested_speed = 0;
        lc->speed = 0;
        lc->requested_fc = lc->fc = PAUSE_RX | PAUSE_TX;
-        if (lc->supported & SUPPORTED_Autoneg) {
+        if (lc->supported & FW_PORT_CAP_ANEG) {
-                lc->advertising = lc->supported;
+                lc->advertising = lc->supported & ADVERT_MASK;
                lc->autoneg = AUTONEG_ENABLE;
                lc->requested_fc |= PAUSE_AUTONEG;
        } else {
@@ -280,7 +284,6 @@ int t4vf_port_init(struct adapter *adapter, int pidx)
        struct fw_vi_cmd vi_cmd, vi_rpl;
        struct fw_port_cmd port_cmd, port_rpl;
        int v;
-        u32 word;
        /*
         * Execute a VI Read command to get our Virtual Interface information
@@ -319,19 +322,13 @@ int t4vf_port_init(struct adapter *adapter, int pidx)
        if (v)
                return v;
-        v = 0;
+        v = be32_to_cpu(port_rpl.u.info.lstatus_to_modtype);
-        word = be16_to_cpu(port_rpl.u.info.pcap);
+        pi->mdio_addr = (v & FW_PORT_CMD_MDIOCAP_F) ?
-        if (word & FW_PORT_CAP_SPEED_100M)
+                        FW_PORT_CMD_MDIOADDR_G(v) : -1;
-                v |= SUPPORTED_100baseT_Full;
+        pi->port_type = FW_PORT_CMD_PTYPE_G(v);
-        if (word & FW_PORT_CAP_SPEED_1G)
+        pi->mod_type = FW_PORT_MOD_TYPE_NA;
-                v |= SUPPORTED_1000baseT_Full;
-        if (word & FW_PORT_CAP_SPEED_10G)
+        init_link_config(&pi->link_cfg, be16_to_cpu(port_rpl.u.info.pcap));
-                v |= SUPPORTED_10000baseT_Full;
-        if (word & FW_PORT_CAP_SPEED_40G)
-                v |= SUPPORTED_40000baseSR4_Full;
-        if (word & FW_PORT_CAP_ANEG)
-                v |= SUPPORTED_Autoneg;
-        init_link_config(&pi->link_cfg, v);
        return 0;
 }
@@ -1491,7 +1488,7 @@ int t4vf_handle_fw_rpl(struct adapter *adapter, const __be64 *rpl)
                 */
                const struct fw_port_cmd *port_cmd =
                        (const struct fw_port_cmd *)rpl;
-                u32 word;
+                u32 stat, mod;
                int action, port_id, link_ok, speed, fc, pidx;
                /*
@@ -1509,21 +1506,21 @@ int t4vf_handle_fw_rpl(struct adapter *adapter, const __be64 *rpl)
                port_id = FW_PORT_CMD_PORTID_G(
                        be32_to_cpu(port_cmd->op_to_portid));
-                word = be32_to_cpu(port_cmd->u.info.lstatus_to_modtype);
+                stat = be32_to_cpu(port_cmd->u.info.lstatus_to_modtype);
-                link_ok = (word & FW_PORT_CMD_LSTATUS_F) != 0;
+                link_ok = (stat & FW_PORT_CMD_LSTATUS_F) != 0;
                speed = 0;
                fc = 0;
-                if (word & FW_PORT_CMD_RXPAUSE_F)
+                if (stat & FW_PORT_CMD_RXPAUSE_F)
                        fc |= PAUSE_RX;
-                if (word & FW_PORT_CMD_TXPAUSE_F)
+                if (stat & FW_PORT_CMD_TXPAUSE_F)
                        fc |= PAUSE_TX;
-                if (word & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_100M))
+                if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_100M))
                        speed = 100;
-                else if (word & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_1G))
+                else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_1G))
                        speed = 1000;
-                else if (word & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_10G))
+                else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_10G))
                        speed = 10000;
-                else if (word & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_40G))
+                else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_40G))
                        speed = 40000;
                /*
@@ -1540,12 +1537,21 @@ int t4vf_handle_fw_rpl(struct adapter *adapter, const __be64 *rpl)
                                continue;
                        lc = &pi->link_cfg;
+                        mod = FW_PORT_CMD_MODTYPE_G(stat);
+                        if (mod != pi->mod_type) {
+                                pi->mod_type = mod;
+                                t4vf_os_portmod_changed(adapter, pidx);
+                        }
                        if (link_ok != lc->link_ok || speed != lc->speed ||
                            fc != lc->fc) {
                                /* something changed */
                                lc->link_ok = link_ok;
                                lc->speed = speed;
                                lc->fc = fc;
+                                lc->supported =
+                                        be16_to_cpu(port_cmd->u.info.pcap);
                                t4vf_os_link_changed(adapter, pidx, link_ok);
                        }
                }
diff --git a/drivers/net/ethernet/cirrus/Kconfig b/drivers/net/ethernet/cirrus/Kconfig
index 7403dff8f14a..905ac5f5d9a6 100644
--- a/drivers/net/ethernet/cirrus/Kconfig
+++ b/drivers/net/ethernet/cirrus/Kconfig
@@ -32,7 +32,8 @@ config CS89x0
          will be called cs89x0.
 config CS89x0_PLATFORM
-        bool "CS89x0 platform driver support"
+        bool "CS89x0 platform driver support" if HAS_IOPORT_MAP
+        default !HAS_IOPORT_MAP
        depends on CS89x0
        help
          Say Y to compile the cs89x0 driver as a platform driver. This
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 868d0f605d60..e356afa44e7d 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1060,10 +1060,14 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                                     PKT_HASH_TYPE_L4 : PKT_HASH_TYPE_L3);
                }
-                if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc) {
+                /* Hardware does not provide whole packet checksum. It only
-                        skb->csum = htons(checksum);
+                 * provides pseudo checksum. Since hw validates the packet
-                        skb->ip_summed = CHECKSUM_COMPLETE;
+                 * checksum but not provide us the checksum value. use
-                }
+                 * CHECSUM_UNNECESSARY.
+                 */
+                if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok &&
+                    ipv4_csum_ok)
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
                if (vlan_stripped)
                        __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_tci);
@@ -1331,7 +1335,7 @@ static int enic_poll_msix_rq(struct napi_struct *napi, int budget)
        int err;
        if (!enic_poll_lock_napi(&enic->rq[rq]))
-                return work_done;
+                return budget;
        /* Service RQ
         */
@@ -1612,7 +1616,7 @@ static int enic_open(struct net_device *netdev)
                if (vnic_rq_desc_used(&enic->rq[i]) == 0) {
                        netdev_err(netdev, "Unable to alloc receive buffers\n");
                        err = -ENOMEM;
-                        goto err_out_notify_unset;
+                        goto err_out_free_rq;
                }
        }
@@ -1645,7 +1649,9 @@ static int enic_open(struct net_device *netdev)
        return 0;
-err_out_notify_unset:
+err_out_free_rq:
+        for (i = 0; i < enic->rq_count; i++)
+                vnic_rq_clean(&enic->rq[i], enic_free_rq_buf);
        enic_dev_notify_unset(enic);
 err_out_free_intr:
        enic_free_intr(enic);
diff --git a/drivers/net/ethernet/dnet.c b/drivers/net/ethernet/dnet.c
index a379c3e4b57f..13d00a38a5bd 100644
--- a/drivers/net/ethernet/dnet.c
+++ b/drivers/net/ethernet/dnet.c
@@ -398,13 +398,8 @@ static int dnet_poll(struct napi_struct *napi, int budget)
                 * break out of while loop if there are no more
                 * packets waiting
                 */
-                if (!(dnet_readl(bp, RX_FIFO_WCNT) >> 16)) {
+                if (!(dnet_readl(bp, RX_FIFO_WCNT) >> 16))
-                        napi_complete(napi);
+                        break;
-                        int_enable = dnet_readl(bp, INTR_ENB);
-                        int_enable |= DNET_INTR_SRC_RX_CMDFIFOAF;
-                        dnet_writel(bp, int_enable, INTR_ENB);
-                        return 0;
-                }
                cmd_word = dnet_readl(bp, RX_LEN_FIFO);
                pkt_len = cmd_word & 0xFFFF;
@@ -433,20 +428,17 @@ static int dnet_poll(struct napi_struct *napi, int budget)
                               "size %u.\n", dev->name, pkt_len);
        }
-        budget -= npackets;
        if (npackets < budget) {
                /* We processed all packets available.  Tell NAPI it can
-                 * stop polling then re-enable rx interrupts */
+                 * stop polling then re-enable rx interrupts.
+                 */
                napi_complete(napi);
                int_enable = dnet_readl(bp, INTR_ENB);
                int_enable |= DNET_INTR_SRC_RX_CMDFIFOAF;
                dnet_writel(bp, int_enable, INTR_ENB);
-                return 0;
        }
-        /* There are still packets waiting */
+        return npackets;
-        return 1;
 }
 static irqreturn_t dnet_interrupt(int irq, void *dev_id)
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 196073110e32..d48806b5cd88 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -4383,8 +4383,9 @@ static int be_ndo_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,
 * distinguish various types of transports (VxLAN, GRE, NVGRE ..). So, offload
 * is expected to work across all types of IP tunnels once exported. Skyhawk
 * supports offloads for either VxLAN or NVGRE, exclusively. So we export VxLAN
- * offloads in hw_enc_features only when a VxLAN port is added. Note this only
+ * offloads in hw_enc_features only when a VxLAN port is added. If other (non
- * ensures that other tunnels work fine while VxLAN offloads are not enabled.
+ * VxLAN) tunnels are configured while VxLAN offloads are enabled, offloads for
+ * those other tunnels are unexported on the fly through ndo_features_check().
 *
 * Skyhawk supports VxLAN offloads only for one UDP dport. So, if the stack
 * adds more than one port, disable offloads and don't re-enable them again
@@ -4459,9 +4460,45 @@ done:
        adapter->vxlan_port_count--;
 }
-static bool be_gso_check(struct sk_buff *skb, struct net_device *dev)
+static netdev_features_t be_features_check(struct sk_buff *skb,
+                                           struct net_device *dev,
+                                           netdev_features_t features)
 {
-        return vxlan_gso_check(skb);
+        struct be_adapter *adapter = netdev_priv(dev);
+        u8 l4_hdr = 0;
+        /* The code below restricts offload features for some tunneled packets.
+         * Offload features for normal (non tunnel) packets are unchanged.
+         */
+        if (!skb->encapsulation ||
+            !(adapter->flags & BE_FLAGS_VXLAN_OFFLOADS))
+                return features;
+        /* It's an encapsulated packet and VxLAN offloads are enabled. We
+         * should disable tunnel offload features if it's not a VxLAN packet,
+         * as tunnel offloads have been enabled only for VxLAN. This is done to
+         * allow other tunneled traffic like GRE work fine while VxLAN
+         * offloads are configured in Skyhawk-R.
+         */
+        switch (vlan_get_protocol(skb)) {
+        case htons(ETH_P_IP):
+                l4_hdr = ip_hdr(skb)->protocol;
+                break;
+        case htons(ETH_P_IPV6):
+                l4_hdr = ipv6_hdr(skb)->nexthdr;
+                break;
+        default:
+                return features;
+        }
+        if (l4_hdr != IPPROTO_UDP ||
+            skb->inner_protocol_type != ENCAP_TYPE_ETHER ||
+            skb->inner_protocol != htons(ETH_P_TEB) ||
+            skb_inner_mac_header(skb) - skb_transport_header(skb) !=
+            sizeof(struct udphdr) + sizeof(struct vxlanhdr))
+                return features & ~(NETIF_F_ALL_CSUM | NETIF_F_GSO_MASK);
+        return features;
 }
 #endif
@@ -4492,7 +4529,7 @@ static const struct net_device_ops be_netdev_ops = {
 #ifdef CONFIG_BE2NET_VXLAN
        .ndo_add_vxlan_port     = be_add_vxlan_port,
        .ndo_del_vxlan_port     = be_del_vxlan_port,
-        .ndo_gso_check          = be_gso_check,
+        .ndo_features_check     = be_features_check,
 #endif
 };
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 469691ad4a1e..40132929daf7 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -424,6 +424,8 @@ struct bufdesc_ex {
 * (40ns * 6).
 */
 #define FEC_QUIRK_BUG_CAPTURE           (1 << 10)
+/* Controller has only one MDIO bus */
+#define FEC_QUIRK_SINGLE_MDIO           (1 << 11)
 struct fec_enet_priv_tx_q {
        int index;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 5ebdf8dc8a31..bba87775419d 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -91,7 +91,8 @@ static struct platform_device_id fec_devtype[] = {
                .driver_data = 0,
        }, {
                .name = "imx28-fec",
-                .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_SWAP_FRAME,
+                .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_SWAP_FRAME |
+                                FEC_QUIRK_SINGLE_MDIO,
        }, {
                .name = "imx6q-fec",
                .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
@@ -1937,7 +1938,7 @@ static int fec_enet_mii_init(struct platform_device *pdev)
        int err = -ENXIO, i;
        /*
-         * The dual fec interfaces are not equivalent with enet-mac.
+         * The i.MX28 dual fec interfaces are not equal.
         * Here are the differences:
         *
         *  - fec0 supports MII & RMII modes while fec1 only supports RMII
@@ -1952,7 +1953,7 @@ static int fec_enet_mii_init(struct platform_device *pdev)
         * mdio interface in board design, and need to be configured by
         * fec0 mii_bus.
         */
-        if ((fep->quirks & FEC_QUIRK_ENET_MAC) && fep->dev_id > 0) {
+        if ((fep->quirks & FEC_QUIRK_SINGLE_MDIO) && fep->dev_id > 0) {
                /* fec1 uses fec0 mii_bus */
                if (mii_cnt && fec0_mii_bus) {
                        fep->mii_bus = fec0_mii_bus;
@@ -2015,7 +2016,7 @@ static int fec_enet_mii_init(struct platform_device *pdev)
        mii_cnt++;
        /* save fec0 mii_bus */
-        if (fep->quirks & FEC_QUIRK_ENET_MAC)
+        if (fep->quirks & FEC_QUIRK_SINGLE_MDIO)
                fec0_mii_bus = fep->mii_bus;
        return 0;
@@ -3129,6 +3130,7 @@ fec_probe(struct platform_device *pdev)
                pdev->id_entry = of_id->data;
        fep->quirks = pdev->id_entry->driver_data;
+        fep->netdev = ndev;
        fep->num_rx_queues = num_rx_qs;
        fep->num_tx_queues = num_tx_qs;
diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c
index 3e1a9c1a67a9..fda12fb32ec7 100644
--- a/drivers/net/ethernet/freescale/gianfar_ethtool.c
+++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c
@@ -1586,7 +1586,7 @@ static int gfar_write_filer_table(struct gfar_private *priv,
                return -EBUSY;
        /* Fill regular entries */
-        for (; i < MAX_FILER_IDX - 1 && (tab->fe[i].ctrl | tab->fe[i].ctrl);
+        for (; i < MAX_FILER_IDX - 1 && (tab->fe[i].ctrl | tab->fe[i].prop);
             i++)
                gfar_write_filer(priv, i, tab->fe[i].ctrl, tab->fe[i].prop);
        /* Fill the rest with fall-troughs */
diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
index 5b8300a32bf5..4d61ef50b465 100644
--- a/drivers/net/ethernet/intel/Kconfig
+++ b/drivers/net/ethernet/intel/Kconfig
@@ -281,6 +281,17 @@ config I40E_DCB
          If unsure, say N.
+config I40E_FCOE
+        bool "Fibre Channel over Ethernet (FCoE)"
+        default n
+        depends on I40E && DCB && FCOE
+        ---help---
+          Say Y here if you want to use Fibre Channel over Ethernet (FCoE)
+          in the driver. This will create new netdev for exclusive FCoE
+          use with XL710 FCoE offloads enabled.
+          If unsure, say N.
 config I40EVF
        tristate "Intel(R) XL710 X710 Virtual Function Ethernet support"
        depends on PCI_MSI
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index 781065eb5431..e9c3a87e5b11 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -1543,7 +1543,7 @@ static int e100_phy_init(struct nic *nic)
                mdio_write(netdev, nic->mii.phy_id, MII_BMCR, bmcr);
        } else if ((nic->mac >= mac_82550_D102) || ((nic->flags & ich) &&
           (mdio_read(netdev, nic->mii.phy_id, MII_TPISTATUS) & 0x8000) &&
-                !(nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) {
+                (nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) {
                /* enable/disable MDI/MDI-X auto-switching. */
                mdio_write(netdev, nic->mii.phy_id, MII_NCONFIG,
                                nic->mii.force_media ? 0 : NCONFIG_AUTO_SWITCH);
diff --git a/drivers/net/ethernet/intel/i40e/Makefile b/drivers/net/ethernet/intel/i40e/Makefile
index 4b94ddb29c24..c40581999121 100644
--- a/drivers/net/ethernet/intel/i40e/Makefile
+++ b/drivers/net/ethernet/intel/i40e/Makefile
@@ -44,4 +44,4 @@ i40e-objs := i40e_main.o \
        i40e_virtchnl_pf.o
 i40e-$(CONFIG_I40E_DCB) += i40e_dcb.o i40e_dcb_nl.o
-i40e-$(CONFIG_FCOE:m=y) += i40e_fcoe.o
+i40e-$(CONFIG_I40E_FCOE) += i40e_fcoe.o
diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
index 433a55886ad2..cb0de455683e 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
@@ -829,7 +829,7 @@ static void i40e_dbg_dump_desc(int cnt, int vsi_seid, int ring_id, int desc_n,
                if (desc_n >= ring->count || desc_n < 0) {
                        dev_info(&pf->pdev->dev,
                                 "descriptor %d not found\n", desc_n);
-                        return;
+                        goto out;
                }
                if (!is_rx_ring) {
                        txd = I40E_TX_DESC(ring, desc_n);
@@ -855,6 +855,8 @@ static void i40e_dbg_dump_desc(int cnt, int vsi_seid, int ring_id, int desc_n,
        } else {
                dev_info(&pf->pdev->dev, "dump desc rx/tx <vsi_seid> <ring_id> [<desc_n>]\n");
        }
+out:
        kfree(ring);
 }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_osdep.h b/drivers/net/ethernet/intel/i40e/i40e_osdep.h
index 045b5c4b98b3..ad802dd0f67a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_osdep.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_osdep.h
@@ -78,7 +78,7 @@ do {                                                            \
 } while (0)
 typedef enum i40e_status_code i40e_status;
-#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
+#ifdef CONFIG_I40E_FCOE
 #define I40E_FCOE
-#endif /* CONFIG_FCOE or CONFIG_FCOE_MODULE */
+#endif
 #endif /* _I40E_OSDEP_H_ */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 04b441460bbd..cecb340898fe 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -658,6 +658,8 @@ static inline u32 i40e_get_head(struct i40e_ring *tx_ring)
        return le32_to_cpu(*(volatile __le32 *)head);
 }
+#define WB_STRIDE 0x3
 /**
 * i40e_clean_tx_irq - Reclaim resources after transmit completes
 * @tx_ring:  tx ring to clean
@@ -759,6 +761,18 @@ static bool i40e_clean_tx_irq(struct i40e_ring *tx_ring, int budget)
        tx_ring->q_vector->tx.total_bytes += total_bytes;
        tx_ring->q_vector->tx.total_packets += total_packets;
+        /* check to see if there are any non-cache aligned descriptors
+         * waiting to be written back, and kick the hardware to force
+         * them to be written back in case of napi polling
+         */
+        if (budget &&
+            !((i & WB_STRIDE) == WB_STRIDE) &&
+            !test_bit(__I40E_DOWN, &tx_ring->vsi->state) &&
+            (I40E_DESC_UNUSED(tx_ring) != tx_ring->count))
+                tx_ring->arm_wb = true;
+        else
+                tx_ring->arm_wb = false;
        if (check_for_tx_hang(tx_ring) && i40e_check_tx_hang(tx_ring)) {
                /* schedule immediate reset if we believe we hung */
                dev_info(tx_ring->dev, "Detected Tx Unit Hang\n"
@@ -777,13 +791,16 @@ static bool i40e_clean_tx_irq(struct i40e_ring *tx_ring, int budget)
                netif_stop_subqueue(tx_ring->netdev, tx_ring->queue_index);
                dev_info(tx_ring->dev,
-                         "tx hang detected on queue %d, resetting adapter\n",
+                         "tx hang detected on queue %d, reset requested\n",
                         tx_ring->queue_index);
-                tx_ring->netdev->netdev_ops->ndo_tx_timeout(tx_ring->netdev);
+                /* do not fire the reset immediately, wait for the stack to
+                 * decide we are truly stuck, also prevents every queue from
+                 * simultaneously requesting a reset
+                 */
-                /* the adapter is about to reset, no point in enabling stuff */
+                /* the adapter is about to reset, no point in enabling polling */
-                return true;
+                budget = 1;
        }
        netdev_tx_completed_queue(netdev_get_tx_queue(tx_ring->netdev,
@@ -806,7 +823,25 @@ static bool i40e_clean_tx_irq(struct i40e_ring *tx_ring, int budget)
                }
        }
-        return budget > 0;
+        return !!budget;
+}
+/**
+ * i40e_force_wb - Arm hardware to do a wb on noncache aligned descriptors
+ * @vsi: the VSI we care about
+ * @q_vector: the vector  on which to force writeback
+ *
+ **/
+static void i40e_force_wb(struct i40e_vsi *vsi, struct i40e_q_vector *q_vector)
+{
+        u32 val = I40E_PFINT_DYN_CTLN_INTENA_MASK |
+                  I40E_PFINT_DYN_CTLN_SWINT_TRIG_MASK |
+                  I40E_PFINT_DYN_CTLN_SW_ITR_INDX_ENA_MASK
+                  /* allow 00 to be written to the index */;
+        wr32(&vsi->back->hw,
+             I40E_PFINT_DYN_CTLN(q_vector->v_idx + vsi->base_vector - 1),
+             val);
 }
 /**
@@ -1290,9 +1325,7 @@ static inline void i40e_rx_checksum(struct i40e_vsi *vsi,
         * so the total length of IPv4 header is IHL*4 bytes
         * The UDP_0 bit *may* bet set if the *inner* header is UDP
         */
-        if (ipv4_tunnel &&
+        if (ipv4_tunnel) {
-            (decoded.inner_prot != I40E_RX_PTYPE_INNER_PROT_UDP) &&
-            !(rx_status & (1 << I40E_RX_DESC_STATUS_UDP_0_SHIFT))) {
                skb->transport_header = skb->mac_header +
                                        sizeof(struct ethhdr) +
                                        (ip_hdr(skb)->ihl * 4);
@@ -1302,15 +1335,19 @@ static inline void i40e_rx_checksum(struct i40e_vsi *vsi,
                                          skb->protocol == htons(ETH_P_8021AD))
                                          ? VLAN_HLEN : 0;
-                rx_udp_csum = udp_csum(skb);
+                if ((ip_hdr(skb)->protocol == IPPROTO_UDP) &&
-                iph = ip_hdr(skb);
+                    (udp_hdr(skb)->check != 0)) {
-                csum = csum_tcpudp_magic(
+                        rx_udp_csum = udp_csum(skb);
-                                iph->saddr, iph->daddr,
+                        iph = ip_hdr(skb);
-                                (skb->len - skb_transport_offset(skb)),
+                        csum = csum_tcpudp_magic(
-                                IPPROTO_UDP, rx_udp_csum);
+                                        iph->saddr, iph->daddr,
+                                        (skb->len - skb_transport_offset(skb)),
+                                        IPPROTO_UDP, rx_udp_csum);
-                if (udp_hdr(skb)->check != csum)
+                        if (udp_hdr(skb)->check != csum)
-                        goto checksum_fail;
+                                goto checksum_fail;
+                } /* else its GRE and so no outer UDP header */
        }
        skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1581,6 +1618,7 @@ int i40e_napi_poll(struct napi_struct *napi, int budget)
        struct i40e_vsi *vsi = q_vector->vsi;
        struct i40e_ring *ring;
        bool clean_complete = true;
+        bool arm_wb = false;
        int budget_per_ring;
        if (test_bit(__I40E_DOWN, &vsi->state)) {
@@ -1591,8 +1629,10 @@ int i40e_napi_poll(struct napi_struct *napi, int budget)
        /* Since the actual Tx work is minimal, we can give the Tx a larger
         * budget and be more aggressive about cleaning up the Tx descriptors.
         */
-        i40e_for_each_ring(ring, q_vector->tx)
+        i40e_for_each_ring(ring, q_vector->tx) {
                clean_complete &= i40e_clean_tx_irq(ring, vsi->work_limit);
+                arm_wb |= ring->arm_wb;
+        }
        /* We attempt to distribute budget to each Rx queue fairly, but don't
         * allow the budget to go below 1 because that would exit polling early.
@@ -1603,8 +1643,11 @@ int i40e_napi_poll(struct napi_struct *napi, int budget)
                clean_complete &= i40e_clean_rx_irq(ring, budget_per_ring);
        /* If work not completed, return budget and polling will return */
-        if (!clean_complete)
+        if (!clean_complete) {
+                if (arm_wb)
+                        i40e_force_wb(vsi, q_vector);
                return budget;
+        }
        /* Work is done so exit the polling mode and re-enable the interrupt */
        napi_complete(napi);
@@ -1840,17 +1883,16 @@ static int i40e_tso(struct i40e_ring *tx_ring, struct sk_buff *skb,
        if (err < 0)
                return err;
-        if (protocol == htons(ETH_P_IP)) {
+        iph = skb->encapsulation ? inner_ip_hdr(skb) : ip_hdr(skb);
-                iph = skb->encapsulation ? inner_ip_hdr(skb) : ip_hdr(skb);
+        ipv6h = skb->encapsulation ? inner_ipv6_hdr(skb) : ipv6_hdr(skb);
+        if (iph->version == 4) {
                tcph = skb->encapsulation ? inner_tcp_hdr(skb) : tcp_hdr(skb);
                iph->tot_len = 0;
                iph->check = 0;
                tcph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
                                                 0, IPPROTO_TCP, 0);
-        } else if (skb_is_gso_v6(skb)) {
+        } else if (ipv6h->version == 6) {
-                ipv6h = skb->encapsulation ? inner_ipv6_hdr(skb)
-                                           : ipv6_hdr(skb);
                tcph = skb->encapsulation ? inner_tcp_hdr(skb) : tcp_hdr(skb);
                ipv6h->payload_len = 0;
                tcph->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
@@ -1946,13 +1988,9 @@ static void i40e_tx_enable_csum(struct sk_buff *skb, u32 tx_flags,
                                         I40E_TX_CTX_EXT_IP_IPV4_NO_CSUM;
                        }
                } else if (tx_flags & I40E_TX_FLAGS_IPV6) {
-                        if (tx_flags & I40E_TX_FLAGS_TSO) {
+                        *cd_tunneling |= I40E_TX_CTX_EXT_IP_IPV6;
-                                *cd_tunneling |= I40E_TX_CTX_EXT_IP_IPV6;
+                        if (tx_flags & I40E_TX_FLAGS_TSO)
                                ip_hdr(skb)->check = 0;
-                        } else {
-                                *cd_tunneling |=
-                                         I40E_TX_CTX_EXT_IP_IPV4_NO_CSUM;
-                        }
                }
                /* Now set the ctx descriptor fields */
@@ -1962,7 +2000,10 @@ static void i40e_tx_enable_csum(struct sk_buff *skb, u32 tx_flags,
                                   ((skb_inner_network_offset(skb) -
                                        skb_transport_offset(skb)) >> 1) <<
                                   I40E_TXD_CTX_QW0_NATLEN_SHIFT;
+                if (this_ip_hdr->version == 6) {
+                        tx_flags &= ~I40E_TX_FLAGS_IPV4;
+                        tx_flags |= I40E_TX_FLAGS_IPV6;
+                }
        } else {
                network_hdr_len = skb_network_header_len(skb);
                this_ip_hdr = ip_hdr(skb);
@@ -2198,7 +2239,6 @@ static void i40e_tx_map(struct i40e_ring *tx_ring, struct sk_buff *skb,
        /* Place RS bit on last descriptor of any packet that spans across the
         * 4th descriptor (WB_STRIDE aka 0x3) in a 64B cacheline.
         */
-#define WB_STRIDE 0x3
        if (((i & WB_STRIDE) != WB_STRIDE) &&
            (first <= &tx_ring->tx_bi[i]) &&
            (first >= &tx_ring->tx_bi[i & ~WB_STRIDE])) {
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.h b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
index e60d3accb2e2..18b00231d2f1 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
@@ -241,6 +241,7 @@ struct i40e_ring {
        unsigned long last_rx_timestamp;
        bool ring_active;               /* is ring online or not */
+        bool arm_wb;            /* do something to arm write back */
        /* stats structs */
        struct i40e_queue_stats stats;
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index 051ea94bdcd3..0f69ef81751a 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -1125,7 +1125,7 @@ static s32 igb_acquire_swfw_sync_82575(struct e1000_hw *hw, u16 mask)
        u32 swmask = mask;
        u32 fwmask = mask << 16;
        s32 ret_val = 0;
-        s32 i = 0, timeout = 200; /* FIXME: find real value to use here */
+        s32 i = 0, timeout = 200;
        while (i < timeout) {
                if (igb_get_hw_semaphore(hw)) {
diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index 63c807c9b21c..edea13b0ee85 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -1907,7 +1907,8 @@ static void igbvf_watchdog_task(struct work_struct *work)
 static int igbvf_tso(struct igbvf_adapter *adapter,
                     struct igbvf_ring *tx_ring,
-                     struct sk_buff *skb, u32 tx_flags, u8 *hdr_len)
+                     struct sk_buff *skb, u32 tx_flags, u8 *hdr_len,
+                     __be16 protocol)
 {
        struct e1000_adv_tx_context_desc *context_desc;
        struct igbvf_buffer *buffer_info;
@@ -1927,7 +1928,7 @@ static int igbvf_tso(struct igbvf_adapter *adapter,
        l4len = tcp_hdrlen(skb);
        *hdr_len += l4len;
-        if (skb->protocol == htons(ETH_P_IP)) {
+        if (protocol == htons(ETH_P_IP)) {
                struct iphdr *iph = ip_hdr(skb);
                iph->tot_len = 0;
                iph->check = 0;
@@ -1958,7 +1959,7 @@ static int igbvf_tso(struct igbvf_adapter *adapter,
        /* ADV DTYP TUCMD MKRLOC/ISCSIHEDLEN */
        tu_cmd |= (E1000_TXD_CMD_DEXT | E1000_ADVTXD_DTYP_CTXT);
-        if (skb->protocol == htons(ETH_P_IP))
+        if (protocol == htons(ETH_P_IP))
                tu_cmd |= E1000_ADVTXD_TUCMD_IPV4;
        tu_cmd |= E1000_ADVTXD_TUCMD_L4T_TCP;
@@ -1984,7 +1985,8 @@ static int igbvf_tso(struct igbvf_adapter *adapter,
 static inline bool igbvf_tx_csum(struct igbvf_adapter *adapter,
                                 struct igbvf_ring *tx_ring,
-                                 struct sk_buff *skb, u32 tx_flags)
+                                 struct sk_buff *skb, u32 tx_flags,
+                                 __be16 protocol)
 {
        struct e1000_adv_tx_context_desc *context_desc;
        unsigned int i;
@@ -2011,7 +2013,7 @@ static inline bool igbvf_tx_csum(struct igbvf_adapter *adapter,
                tu_cmd |= (E1000_TXD_CMD_DEXT | E1000_ADVTXD_DTYP_CTXT);
                if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                        switch (skb->protocol) {
+                        switch (protocol) {
                        case htons(ETH_P_IP):
                                tu_cmd |= E1000_ADVTXD_TUCMD_IPV4;
                                if (ip_hdr(skb)->protocol == IPPROTO_TCP)
@@ -2211,6 +2213,7 @@ static netdev_tx_t igbvf_xmit_frame_ring_adv(struct sk_buff *skb,
        u8 hdr_len = 0;
        int count = 0;
        int tso = 0;
+        __be16 protocol = vlan_get_protocol(skb);
        if (test_bit(__IGBVF_DOWN, &adapter->state)) {
                dev_kfree_skb_any(skb);
@@ -2239,13 +2242,13 @@ static netdev_tx_t igbvf_xmit_frame_ring_adv(struct sk_buff *skb,
                tx_flags |= (vlan_tx_tag_get(skb) << IGBVF_TX_FLAGS_VLAN_SHIFT);
        }
-        if (skb->protocol == htons(ETH_P_IP))
+        if (protocol == htons(ETH_P_IP))
                tx_flags |= IGBVF_TX_FLAGS_IPV4;
        first = tx_ring->next_to_use;
        tso = skb_is_gso(skb) ?
-                igbvf_tso(adapter, tx_ring, skb, tx_flags, &hdr_len) : 0;
+                igbvf_tso(adapter, tx_ring, skb, tx_flags, &hdr_len, protocol) : 0;
        if (unlikely(tso < 0)) {
                dev_kfree_skb_any(skb);
                return NETDEV_TX_OK;
@@ -2253,7 +2256,7 @@ static netdev_tx_t igbvf_xmit_frame_ring_adv(struct sk_buff *skb,
        if (tso)
                tx_flags |= IGBVF_TX_FLAGS_TSO;
-        else if (igbvf_tx_csum(adapter, tx_ring, skb, tx_flags) &&
+        else if (igbvf_tx_csum(adapter, tx_ring, skb, tx_flags, protocol) &&
                 (skb->ip_summed == CHECKSUM_PARTIAL))
                tx_flags |= IGBVF_TX_FLAGS_CSUM;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 2ed2c7de2304..67b02bde179e 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -7227,11 +7227,11 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
                if (!vhdr)
                        goto out_drop;
-                protocol = vhdr->h_vlan_encapsulated_proto;
                tx_flags |= ntohs(vhdr->h_vlan_TCI) <<
                                  IXGBE_TX_FLAGS_VLAN_SHIFT;
                tx_flags |= IXGBE_TX_FLAGS_SW_VLAN;
        }
+        protocol = vlan_get_protocol(skb);
        if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
            adapter->ptp_clock &&
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 62a0d8e0f17d..38c7a0be8197 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -3099,7 +3099,7 @@ static int ixgbevf_tso(struct ixgbevf_ring *tx_ring,
        /* ADV DTYP TUCMD MKRLOC/ISCSIHEDLEN */
        type_tucmd = IXGBE_ADVTXD_TUCMD_L4T_TCP;
-        if (skb->protocol == htons(ETH_P_IP)) {
+        if (first->protocol == htons(ETH_P_IP)) {
                struct iphdr *iph = ip_hdr(skb);
                iph->tot_len = 0;
                iph->check = 0;
@@ -3156,7 +3156,7 @@ static void ixgbevf_tx_csum(struct ixgbevf_ring *tx_ring,
        if (skb->ip_summed == CHECKSUM_PARTIAL) {
                u8 l4_hdr = 0;
-                switch (skb->protocol) {
+                switch (first->protocol) {
                case htons(ETH_P_IP):
                        vlan_macip_lens |= skb_network_header_len(skb);
                        type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4;
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index a62fc38f045e..1c75829eb166 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -192,6 +192,10 @@ static char mv643xx_eth_driver_version[] = "1.4";
 #define IS_TSO_HEADER(txq, addr) \
        ((addr >= txq->tso_hdrs_dma) && \
         (addr < txq->tso_hdrs_dma + txq->tx_ring_size * TSO_HEADER_SIZE))
+#define DESC_DMA_MAP_SINGLE 0
+#define DESC_DMA_MAP_PAGE 1
 /*
 * RX/TX descriptors.
 */
@@ -362,6 +366,7 @@ struct tx_queue {
        dma_addr_t tso_hdrs_dma;
        struct tx_desc *tx_desc_area;
+        char *tx_desc_mapping; /* array to track the type of the dma mapping */
        dma_addr_t tx_desc_dma;
        int tx_desc_area_size;
@@ -750,6 +755,7 @@ txq_put_data_tso(struct net_device *dev, struct tx_queue *txq,
        if (txq->tx_curr_desc == txq->tx_ring_size)
                txq->tx_curr_desc = 0;
        desc = &txq->tx_desc_area[tx_index];
+        txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;
        desc->l4i_chk = 0;
        desc->byte_cnt = length;
@@ -879,14 +885,13 @@ static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
                skb_frag_t *this_frag;
                int tx_index;
                struct tx_desc *desc;
-                void *addr;
                this_frag = &skb_shinfo(skb)->frags[frag];
-                addr = page_address(this_frag->page.p) + this_frag->page_offset;
                tx_index = txq->tx_curr_desc++;
                if (txq->tx_curr_desc == txq->tx_ring_size)
                        txq->tx_curr_desc = 0;
                desc = &txq->tx_desc_area[tx_index];
+                txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_PAGE;
                /*
                 * The last fragment will generate an interrupt
@@ -902,8 +907,9 @@ static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
                desc->l4i_chk = 0;
                desc->byte_cnt = skb_frag_size(this_frag);
-                desc->buf_ptr = dma_map_single(mp->dev->dev.parent, addr,
+                desc->buf_ptr = skb_frag_dma_map(mp->dev->dev.parent,
-                                               desc->byte_cnt, DMA_TO_DEVICE);
+                                                 this_frag, 0, desc->byte_cnt,
+                                                 DMA_TO_DEVICE);
        }
 }
@@ -936,6 +942,7 @@ static int txq_submit_skb(struct tx_queue *txq, struct sk_buff *skb,
        if (txq->tx_curr_desc == txq->tx_ring_size)
                txq->tx_curr_desc = 0;
        desc = &txq->tx_desc_area[tx_index];
+        txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;
        if (nr_frags) {
                txq_submit_frag_skb(txq, skb);
@@ -1047,9 +1054,12 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                int tx_index;
                struct tx_desc *desc;
                u32 cmd_sts;
+                char desc_dma_map;
                tx_index = txq->tx_used_desc;
                desc = &txq->tx_desc_area[tx_index];
+                desc_dma_map = txq->tx_desc_mapping[tx_index];
                cmd_sts = desc->cmd_sts;
                if (cmd_sts & BUFFER_OWNED_BY_DMA) {
@@ -1065,9 +1075,19 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                reclaimed++;
                txq->tx_desc_count--;
-                if (!IS_TSO_HEADER(txq, desc->buf_ptr))
+                if (!IS_TSO_HEADER(txq, desc->buf_ptr)) {
-                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
-                                         desc->byte_cnt, DMA_TO_DEVICE);
+                        if (desc_dma_map == DESC_DMA_MAP_PAGE)
+                                dma_unmap_page(mp->dev->dev.parent,
+                                               desc->buf_ptr,
+                                               desc->byte_cnt,
+                                               DMA_TO_DEVICE);
+                        else
+                                dma_unmap_single(mp->dev->dev.parent,
+                                                 desc->buf_ptr,
+                                                 desc->byte_cnt,
+                                                 DMA_TO_DEVICE);
+                }
                if (cmd_sts & TX_ENABLE_INTERRUPT) {
                        struct sk_buff *skb = __skb_dequeue(&txq->tx_skb);
@@ -1996,6 +2016,7 @@ static int txq_init(struct mv643xx_eth_private *mp, int index)
        struct tx_queue *txq = mp->txq + index;
        struct tx_desc *tx_desc;
        int size;
+        int ret;
        int i;
        txq->index = index;
@@ -2048,18 +2069,34 @@ static int txq_init(struct mv643xx_eth_private *mp, int index)
                                        nexti * sizeof(struct tx_desc);
        }
+        txq->tx_desc_mapping = kcalloc(txq->tx_ring_size, sizeof(char),
+                                       GFP_KERNEL);
+        if (!txq->tx_desc_mapping) {
+                ret = -ENOMEM;
+                goto err_free_desc_area;
+        }
        /* Allocate DMA buffers for TSO MAC/IP/TCP headers */
        txq->tso_hdrs = dma_alloc_coherent(mp->dev->dev.parent,
                                           txq->tx_ring_size * TSO_HEADER_SIZE,
                                           &txq->tso_hdrs_dma, GFP_KERNEL);
        if (txq->tso_hdrs == NULL) {
-                dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
+                ret = -ENOMEM;
-                                  txq->tx_desc_area, txq->tx_desc_dma);
+                goto err_free_desc_mapping;
-                return -ENOMEM;
        }
        skb_queue_head_init(&txq->tx_skb);
        return 0;
+err_free_desc_mapping:
+        kfree(txq->tx_desc_mapping);
+err_free_desc_area:
+        if (index == 0 && size <= mp->tx_desc_sram_size)
+                iounmap(txq->tx_desc_area);
+        else
+                dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
+                                  txq->tx_desc_area, txq->tx_desc_dma);
+        return ret;
 }
 static void txq_deinit(struct tx_queue *txq)
@@ -2077,6 +2114,8 @@ static void txq_deinit(struct tx_queue *txq)
        else
                dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
                                  txq->tx_desc_area, txq->tx_desc_dma);
+        kfree(txq->tx_desc_mapping);
        if (txq->tso_hdrs)
                dma_free_coherent(mp->dev->dev.parent,
                                  txq->tx_ring_size * TSO_HEADER_SIZE,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 190cbd931f6b..ac6a8f1eea6c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -475,7 +475,8 @@ static int mlx4_en_tunnel_steer_add(struct mlx4_en_priv *priv, unsigned char *ad
 {
        int err;
-        if (priv->mdev->dev->caps.tunnel_offload_mode != MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
+        if (priv->mdev->dev->caps.tunnel_offload_mode != MLX4_TUNNEL_OFFLOAD_MODE_VXLAN ||
+            priv->mdev->dev->caps.dmfs_high_steer_mode == MLX4_STEERING_DMFS_A0_STATIC)
                return 0; /* do nothing */
        err = mlx4_tunnel_steer_add(priv->mdev->dev, addr, priv->port, qpn,
@@ -2365,9 +2366,11 @@ static void mlx4_en_del_vxlan_port(struct  net_device *dev,
        queue_work(priv->mdev->workqueue, &priv->vxlan_del_task);
 }
-static bool mlx4_en_gso_check(struct sk_buff *skb, struct net_device *dev)
+static netdev_features_t mlx4_en_features_check(struct sk_buff *skb,
+                                                struct net_device *dev,
+                                                netdev_features_t features)
 {
-        return vxlan_gso_check(skb);
+        return vxlan_features_check(skb, features);
 }
 #endif
@@ -2400,7 +2403,7 @@ static const struct net_device_ops mlx4_netdev_ops = {
 #ifdef CONFIG_MLX4_EN_VXLAN
        .ndo_add_vxlan_port     = mlx4_en_add_vxlan_port,
        .ndo_del_vxlan_port     = mlx4_en_del_vxlan_port,
-        .ndo_gso_check          = mlx4_en_gso_check,
+        .ndo_features_check     = mlx4_en_features_check,
 #endif
 };
@@ -2434,7 +2437,7 @@ static const struct net_device_ops mlx4_netdev_ops_master = {
 #ifdef CONFIG_MLX4_EN_VXLAN
        .ndo_add_vxlan_port     = mlx4_en_add_vxlan_port,
        .ndo_del_vxlan_port     = mlx4_en_del_vxlan_port,
-        .ndo_gso_check          = mlx4_en_gso_check,
+        .ndo_features_check     = mlx4_en_features_check,
 #endif
 };
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index a308d41e4de0..e3357bf523df 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -962,7 +962,17 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
                tx_desc->ctrl.owner_opcode = op_own;
                if (send_doorbell) {
                        wmb();
-                        iowrite32(ring->doorbell_qpn,
+                        /* Since there is no iowrite*_native() that writes the
+                         * value as is, without byteswapping - using the one
+                         * the doesn't do byteswapping in the relevant arch
+                         * endianness.
+                         */
+#if defined(__LITTLE_ENDIAN)
+                        iowrite32(
+#else
+                        iowrite32be(
+#endif
+                                  ring->doorbell_qpn,
                                  ring->bf.uar->map + MLX4_SEND_DOORBELL);
                } else {
                        ring->xmit_more++;
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 943cbd47d832..6e08352ec994 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1744,8 +1744,7 @@ static void choose_tunnel_offload_mode(struct mlx4_dev *dev,
                                       struct mlx4_dev_cap *dev_cap)
 {
        if (dev->caps.steering_mode == MLX4_STEERING_MODE_DEVICE_MANAGED &&
-            dev_cap->flags2 & MLX4_DEV_CAP_FLAG2_VXLAN_OFFLOADS &&
+            dev_cap->flags2 & MLX4_DEV_CAP_FLAG2_VXLAN_OFFLOADS)
-            dev->caps.dmfs_high_steer_mode != MLX4_STEERING_DMFS_A0_STATIC)
                dev->caps.tunnel_offload_mode = MLX4_TUNNEL_OFFLOAD_MODE_VXLAN;
        else
                dev->caps.tunnel_offload_mode = MLX4_TUNNEL_OFFLOAD_MODE_NONE;
@@ -1829,7 +1828,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                err = mlx4_dev_cap(dev, &dev_cap);
                if (err) {
                        mlx4_err(dev, "QUERY_DEV_CAP command failed, aborting\n");
-                        goto err_stop_fw;
+                        return err;
                }
                choose_steering_mode(dev, &dev_cap);
@@ -1860,7 +1859,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                                             &init_hca);
                if ((long long) icm_size < 0) {
                        err = icm_size;
-                        goto err_stop_fw;
+                        return err;
                }
                dev->caps.max_fmr_maps = (1 << (32 - ilog2(dev->caps.num_mpts))) - 1;
@@ -1874,7 +1873,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                err = mlx4_init_icm(dev, &dev_cap, &init_hca, icm_size);
                if (err)
-                        goto err_stop_fw;
+                        return err;
                err = mlx4_INIT_HCA(dev, &init_hca);
                if (err) {
@@ -1886,7 +1885,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                        err = mlx4_query_func(dev, &dev_cap);
                        if (err < 0) {
                                mlx4_err(dev, "QUERY_FUNC command failed, aborting.\n");
-                                goto err_stop_fw;
+                                goto err_close;
                        } else if (err & MLX4_QUERY_FUNC_NUM_SYS_EQS) {
                                dev->caps.num_eqs = dev_cap.max_eqs;
                                dev->caps.reserved_eqs = dev_cap.reserved_eqs;
@@ -2006,11 +2005,6 @@ err_free_icm:
        if (!mlx4_is_slave(dev))
                mlx4_free_icms(dev);
-err_stop_fw:
-        if (!mlx4_is_slave(dev)) {
-                mlx4_UNMAP_FA(dev);
-                mlx4_free_icm(dev, priv->fw.fw_icm, 0);
-        }
        return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index bdd4eea2247c..210691c89b6c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -235,7 +235,8 @@ do {									\
 extern int mlx4_log_num_mgm_entry_size;
 extern int log_mtts_per_seg;
-#define MLX4_MAX_NUM_SLAVES     (MLX4_MAX_NUM_PF + MLX4_MAX_NUM_VF)
+#define MLX4_MAX_NUM_SLAVES     (min(MLX4_MAX_NUM_PF + MLX4_MAX_NUM_VF, \
+                                     MLX4_MFUNC_MAX))
 #define ALL_SLAVES 0xff
 struct mlx4_bitmap {
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index d6f549685c0f..7094a9c70fd5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -584,6 +584,7 @@ EXPORT_SYMBOL_GPL(mlx4_mr_free);
 void mlx4_mr_rereg_mem_cleanup(struct mlx4_dev *dev, struct mlx4_mr *mr)
 {
        mlx4_mtt_cleanup(dev, &mr->mtt);
+        mr->mtt.order = -1;
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_rereg_mem_cleanup);
@@ -593,14 +594,14 @@ int mlx4_mr_rereg_mem_write(struct mlx4_dev *dev, struct mlx4_mr *mr,
 {
        int err;
-        mpt_entry->start       = cpu_to_be64(iova);
-        mpt_entry->length      = cpu_to_be64(size);
-        mpt_entry->entity_size = cpu_to_be32(page_shift);
        err = mlx4_mtt_init(dev, npages, page_shift, &mr->mtt);
        if (err)
                return err;
+        mpt_entry->start       = cpu_to_be64(mr->iova);
+        mpt_entry->length      = cpu_to_be64(mr->size);
+        mpt_entry->entity_size = cpu_to_be32(mr->mtt.page_shift);
        mpt_entry->pd_flags &= cpu_to_be32(MLX4_MPT_PD_MASK |
                                           MLX4_MPT_PD_FLAG_EN_INV);
        mpt_entry->flags    &= cpu_to_be32(MLX4_MPT_FLAG_FREE |
diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
index f1ebed6c63b1..2fa6ae026e4f 100644
--- a/drivers/net/ethernet/micrel/ksz884x.c
+++ b/drivers/net/ethernet/micrel/ksz884x.c
@@ -2303,12 +2303,6 @@ static inline int port_chk_force_flow_ctrl(struct ksz_hw *hw, int p)
 /* Spanning Tree */
-static inline void port_cfg_dis_learn(struct ksz_hw *hw, int p, int set)
-{
-        port_cfg(hw, p,
-                KS8842_PORT_CTRL_2_OFFSET, PORT_LEARN_DISABLE, set);
-}
 static inline void port_cfg_rx(struct ksz_hw *hw, int p, int set)
 {
        port_cfg(hw, p,
diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
index af099057f0e9..71af98bb72cb 100644
--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
@@ -4033,8 +4033,10 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        (void)pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
        mgp->cmd = dma_alloc_coherent(&pdev->dev, sizeof(*mgp->cmd),
                                      &mgp->cmd_bus, GFP_KERNEL);
-        if (mgp->cmd == NULL)
+        if (!mgp->cmd) {
+                status = -ENOMEM;
                goto abort_with_enabled;
+        }
        mgp->board_span = pci_resource_len(pdev, 0);
        mgp->iomem_base = pci_resource_start(pdev, 0);
diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c
index f5e4b820128b..db0c7a9aee60 100644
--- a/drivers/net/ethernet/neterion/s2io.c
+++ b/drivers/net/ethernet/neterion/s2io.c
@@ -6987,7 +6987,9 @@ static int s2io_add_isr(struct s2io_nic *sp)
                        if (sp->s2io_entries[i].in_use == MSIX_FLG) {
                                if (sp->s2io_entries[i].type ==
                                    MSIX_RING_TYPE) {
-                                        sprintf(sp->desc[i], "%s:MSI-X-%d-RX",
+                                        snprintf(sp->desc[i],
+                                                sizeof(sp->desc[i]),
+                                                "%s:MSI-X-%d-RX",
                                                dev->name, i);
                                        err = request_irq(sp->entries[i].vector,
                                                          s2io_msix_ring_handle,
@@ -6996,7 +6998,9 @@ static int s2io_add_isr(struct s2io_nic *sp)
                                                          sp->s2io_entries[i].arg);
                                } else if (sp->s2io_entries[i].type ==
                                           MSIX_ALARM_TYPE) {
-                                        sprintf(sp->desc[i], "%s:MSI-X-%d-TX",
+                                        snprintf(sp->desc[i],
+                                                sizeof(sp->desc[i]),
+                                                "%s:MSI-X-%d-TX",
                                                dev->name, i);
                                        err = request_irq(sp->entries[i].vector,
                                                          s2io_msix_fifo_handle,
@@ -8154,7 +8158,8 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
                          "%s: UDP Fragmentation Offload(UFO) enabled\n",
                          dev->name);
        /* Initialize device name */
-        sprintf(sp->name, "%s Neterion %s", dev->name, sp->product_name);
+        snprintf(sp->name, sizeof(sp->name), "%s Neterion %s", dev->name,
+                 sp->product_name);
        if (vlan_tag_strip)
                sp->vlan_strip_flag = 1;
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 613037584d08..c531c8ae1be4 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -2388,7 +2388,10 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
        work_done = netxen_process_rcv_ring(sds_ring, budget);
-        if ((work_done < budget) && tx_complete) {
+        if (!tx_complete)
+                work_done = budget;
+        if (work_done < budget) {
                napi_complete(&sds_ring->napi);
                if (test_bit(__NX_DEV_UP, &adapter->state))
                        netxen_nic_enable_int(sds_ring);
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index c2f09af5c25b..4847713211ca 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -146,10 +146,7 @@ static int ql_wait_for_drvr_lock(struct ql3_adapter *qdev)
 {
        int i = 0;
-        while (i < 10) {
+        do {
-                if (i)
-                        ssleep(1);
                if (ql_sem_lock(qdev,
                                QL_DRVR_SEM_MASK,
                                (QL_RESOURCE_BITS_BASE_CODE | (qdev->mac_index)
@@ -158,7 +155,8 @@ static int ql_wait_for_drvr_lock(struct ql3_adapter *qdev)
                                      "driver lock acquired\n");
                        return 1;
                }
-        }
+                ssleep(1);
+        } while (++i < 10);
        netdev_err(qdev->ndev, "Timed out waiting for driver lock...\n");
        return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 18e5de72e9b4..4e1f58cf19ce 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -967,7 +967,12 @@ static int qlcnic_poll(struct napi_struct *napi, int budget)
        tx_complete = qlcnic_process_cmd_ring(adapter, tx_ring,
                                              budget);
        work_done = qlcnic_process_rcv_ring(sds_ring, budget);
-        if ((work_done < budget) && tx_complete) {
+        /* Check if we need a repoll */
+        if (!tx_complete)
+                work_done = budget;
+        if (work_done < budget) {
                napi_complete(&sds_ring->napi);
                if (test_bit(__QLCNIC_DEV_UP, &adapter->state)) {
                        qlcnic_enable_sds_intr(adapter, sds_ring);
@@ -992,6 +997,9 @@ static int qlcnic_tx_poll(struct napi_struct *napi, int budget)
                napi_complete(&tx_ring->napi);
                if (test_bit(__QLCNIC_DEV_UP, &adapter->state))
                        qlcnic_enable_tx_intr(adapter, tx_ring);
+        } else {
+                /* As qlcnic_process_cmd_ring() returned 0, we need a repoll*/
+                work_done = budget;
        }
        return work_done;
@@ -1950,7 +1958,12 @@ static int qlcnic_83xx_msix_sriov_vf_poll(struct napi_struct *napi, int budget)
        tx_complete = qlcnic_process_cmd_ring(adapter, tx_ring, budget);
        work_done = qlcnic_83xx_process_rcv_ring(sds_ring, budget);
-        if ((work_done < budget) && tx_complete) {
+        /* Check if we need a repoll */
+        if (!tx_complete)
+                work_done = budget;
+        if (work_done < budget) {
                napi_complete(&sds_ring->napi);
                qlcnic_enable_sds_intr(adapter, sds_ring);
        }
@@ -1973,7 +1986,12 @@ static int qlcnic_83xx_poll(struct napi_struct *napi, int budget)
        tx_complete = qlcnic_process_cmd_ring(adapter, tx_ring, budget);
        work_done = qlcnic_83xx_process_rcv_ring(sds_ring, budget);
-        if ((work_done < budget) && tx_complete) {
+        /* Check if we need a repoll */
+        if (!tx_complete)
+                work_done = budget;
+        if (work_done < budget) {
                napi_complete(&sds_ring->napi);
                qlcnic_enable_sds_intr(adapter, sds_ring);
        }
@@ -1995,6 +2013,9 @@ static int qlcnic_83xx_msix_tx_poll(struct napi_struct *napi, int budget)
                napi_complete(&tx_ring->napi);
                if (test_bit(__QLCNIC_DEV_UP , &adapter->state))
                        qlcnic_enable_tx_intr(adapter, tx_ring);
+        } else {
+                /* need a repoll */
+                work_done = budget;
        }
        return work_done;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 1aa25b13ace1..2528c3fb6b90 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -505,9 +505,11 @@ static void qlcnic_del_vxlan_port(struct net_device *netdev,
        adapter->flags |= QLCNIC_DEL_VXLAN_PORT;
 }
-static bool qlcnic_gso_check(struct sk_buff *skb, struct net_device *dev)
+static netdev_features_t qlcnic_features_check(struct sk_buff *skb,
+                                               struct net_device *dev,
+                                               netdev_features_t features)
 {
-        return vxlan_gso_check(skb);
+        return vxlan_features_check(skb, features);
 }
 #endif
@@ -532,7 +534,7 @@ static const struct net_device_ops qlcnic_netdev_ops = {
 #ifdef CONFIG_QLCNIC_VXLAN
        .ndo_add_vxlan_port     = qlcnic_add_vxlan_port,
        .ndo_del_vxlan_port     = qlcnic_del_vxlan_port,
-        .ndo_gso_check          = qlcnic_gso_check,
+        .ndo_features_check     = qlcnic_features_check,
 #endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
        .ndo_poll_controller = qlcnic_poll_controller,
@@ -2603,6 +2605,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        } else {
                dev_err(&pdev->dev,
                        "%s: failed. Please Reboot\n", __func__);
+                err = -ENODEV;
                goto err_out_free_hw;
        }
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 6c904a6cad2a..ef5aed3b1225 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -2351,23 +2351,29 @@ static int qlge_update_hw_vlan_features(struct net_device *ndev,
 {
        struct ql_adapter *qdev = netdev_priv(ndev);
        int status = 0;
+        bool need_restart = netif_running(ndev);
-        status = ql_adapter_down(qdev);
+        if (need_restart) {
-        if (status) {
+                status = ql_adapter_down(qdev);
-                netif_err(qdev, link, qdev->ndev,
+                if (status) {
-                          "Failed to bring down the adapter\n");
+                        netif_err(qdev, link, qdev->ndev,
-                return status;
+                                  "Failed to bring down the adapter\n");
+                        return status;
+                }
        }
        /* update the features with resent change */
        ndev->features = features;
-        status = ql_adapter_up(qdev);
+        if (need_restart) {
-        if (status) {
+                status = ql_adapter_up(qdev);
-                netif_err(qdev, link, qdev->ndev,
+                if (status) {
-                          "Failed to bring up the adapter\n");
+                        netif_err(qdev, link, qdev->ndev,
-                return status;
+                                  "Failed to bring up the adapter\n");
+                        return status;
+                }
        }
        return status;
 }
diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c
index 6d0b9dfac313..78bb4ceb1cdd 100644
--- a/drivers/net/ethernet/realtek/8139too.c
+++ b/drivers/net/ethernet/realtek/8139too.c
@@ -787,10 +787,10 @@ static struct net_device *rtl8139_init_board(struct pci_dev *pdev)
        if (rc)
                goto err_out;
+        disable_dev_on_err = 1;
        rc = pci_request_regions (pdev, DRV_NAME);
        if (rc)
                goto err_out;
-        disable_dev_on_err = 1;
        pci_set_master (pdev);
@@ -1110,6 +1110,7 @@ static int rtl8139_init_one(struct pci_dev *pdev,
        return 0;
 err_out:
+        netif_napi_del(&tp->napi);
        __rtl8139_cleanup_dev (dev);
        pci_disable_device (pdev);
        return i;
@@ -1124,6 +1125,7 @@ static void rtl8139_remove_one(struct pci_dev *pdev)
        assert (dev != NULL);
        cancel_delayed_work_sync(&tp->thread);
+        netif_napi_del(&tp->napi);
        unregister_netdev (dev);
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index c29ba80ae02b..04283fe0e6a7 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -396,6 +396,9 @@ static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = {
        [TSU_ADRL31]    = 0x01fc,
 };
+static void sh_eth_rcv_snd_disable(struct net_device *ndev);
+static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev);
 static bool sh_eth_is_gether(struct sh_eth_private *mdp)
 {
        return mdp->reg_offset == sh_eth_offset_gigabit;
@@ -473,6 +476,7 @@ static struct sh_eth_cpu_data r8a777x_data = {
        .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
                          EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE |
                          EESR_ECI,
+        .fdr_value      = 0x00000f0f,
        .apr            = 1,
        .mpr            = 1,
@@ -495,6 +499,9 @@ static struct sh_eth_cpu_data r8a779x_data = {
        .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
                          EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE |
                          EESR_ECI,
+        .fdr_value      = 0x00000f0f,
+        .trscer_err_mask = DESC_I_RINT8,
        .apr            = 1,
        .mpr            = 1,
@@ -856,6 +863,9 @@ static void sh_eth_set_default_cpu_data(struct sh_eth_cpu_data *cd)
        if (!cd->eesr_err_check)
                cd->eesr_err_check = DEFAULT_EESR_ERR_CHECK;
+        if (!cd->trscer_err_mask)
+                cd->trscer_err_mask = DEFAULT_TRSCER_ERR_MASK;
 }
 static int sh_eth_check_reset(struct net_device *ndev)
@@ -1113,6 +1123,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
        int rx_ringsize = sizeof(*rxdesc) * mdp->num_rx_ring;
        int tx_ringsize = sizeof(*txdesc) * mdp->num_tx_ring;
        int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
+        dma_addr_t dma_addr;
        mdp->cur_rx = 0;
        mdp->cur_tx = 0;
@@ -1126,7 +1137,6 @@ static void sh_eth_ring_format(struct net_device *ndev)
                /* skb */
                mdp->rx_skbuff[i] = NULL;
                skb = netdev_alloc_skb(ndev, skbuff_size);
-                mdp->rx_skbuff[i] = skb;
                if (skb == NULL)
                        break;
                sh_eth_set_receive_align(skb);
@@ -1135,9 +1145,15 @@ static void sh_eth_ring_format(struct net_device *ndev)
                rxdesc = &mdp->rx_ring[i];
                /* The size of the buffer is a multiple of 16 bytes. */
                rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
-                dma_map_single(&ndev->dev, skb->data, rxdesc->buffer_length,
+                dma_addr = dma_map_single(&ndev->dev, skb->data,
-                               DMA_FROM_DEVICE);
+                                          rxdesc->buffer_length,
-                rxdesc->addr = virt_to_phys(skb->data);
+                                          DMA_FROM_DEVICE);
+                if (dma_mapping_error(&ndev->dev, dma_addr)) {
+                        kfree_skb(skb);
+                        break;
+                }
+                mdp->rx_skbuff[i] = skb;
+                rxdesc->addr = dma_addr;
                rxdesc->status = cpu_to_edmac(mdp, RD_RACT | RD_RFP);
                /* Rx descriptor address set */
@@ -1294,7 +1310,7 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start)
        /* Frame recv control (enable multiple-packets per rx irq) */
        sh_eth_write(ndev, RMCR_RNC, RMCR);
-        sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER);
+        sh_eth_write(ndev, mdp->cd->trscer_err_mask, TRSCER);
        if (mdp->cd->bculr)
                sh_eth_write(ndev, 0x800, BCULR);       /* Burst sycle set */
@@ -1309,8 +1325,10 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start)
                     RFLR);
        sh_eth_write(ndev, sh_eth_read(ndev, EESR), EESR);
-        if (start)
+        if (start) {
+                mdp->irq_enabled = true;
                sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
+        }
        /* PAUSE Prohibition */
        val = (sh_eth_read(ndev, ECMR) & ECMR_DM) |
@@ -1349,6 +1367,33 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start)
        return ret;
 }
+static void sh_eth_dev_exit(struct net_device *ndev)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+        int i;
+        /* Deactivate all TX descriptors, so DMA should stop at next
+         * packet boundary if it's currently running
+         */
+        for (i = 0; i < mdp->num_tx_ring; i++)
+                mdp->tx_ring[i].status &= ~cpu_to_edmac(mdp, TD_TACT);
+        /* Disable TX FIFO egress to MAC */
+        sh_eth_rcv_snd_disable(ndev);
+        /* Stop RX DMA at next packet boundary */
+        sh_eth_write(ndev, 0, EDRRR);
+        /* Aside from TX DMA, we can't tell when the hardware is
+         * really stopped, so we need to reset to make sure.
+         * Before doing that, wait for long enough to *probably*
+         * finish transmitting the last packet and poll stats.
+         */
+        msleep(2); /* max frame time at 10 Mbps < 1250 us */
+        sh_eth_get_stats(ndev);
+        sh_eth_reset(ndev);
+}
 /* free Tx skb function */
 static int sh_eth_txfree(struct net_device *ndev)
 {
@@ -1393,6 +1438,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
        u16 pkt_len = 0;
        u32 desc_status;
        int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
+        dma_addr_t dma_addr;
        boguscnt = min(boguscnt, *quota);
        limit = boguscnt;
@@ -1440,9 +1486,9 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                        mdp->rx_skbuff[entry] = NULL;
                        if (mdp->cd->rpadir)
                                skb_reserve(skb, NET_IP_ALIGN);
-                        dma_sync_single_for_cpu(&ndev->dev, rxdesc->addr,
+                        dma_unmap_single(&ndev->dev, rxdesc->addr,
-                                                ALIGN(mdp->rx_buf_sz, 16),
+                                         ALIGN(mdp->rx_buf_sz, 16),
-                                                DMA_FROM_DEVICE);
+                                         DMA_FROM_DEVICE);
                        skb_put(skb, pkt_len);
                        skb->protocol = eth_type_trans(skb, ndev);
                        netif_receive_skb(skb);
@@ -1462,15 +1508,20 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                if (mdp->rx_skbuff[entry] == NULL) {
                        skb = netdev_alloc_skb(ndev, skbuff_size);
-                        mdp->rx_skbuff[entry] = skb;
                        if (skb == NULL)
                                break;  /* Better luck next round. */
                        sh_eth_set_receive_align(skb);
-                        dma_map_single(&ndev->dev, skb->data,
+                        dma_addr = dma_map_single(&ndev->dev, skb->data,
-                                       rxdesc->buffer_length, DMA_FROM_DEVICE);
+                                                  rxdesc->buffer_length,
+                                                  DMA_FROM_DEVICE);
+                        if (dma_mapping_error(&ndev->dev, dma_addr)) {
+                                kfree_skb(skb);
+                                break;
+                        }
+                        mdp->rx_skbuff[entry] = skb;
                        skb_checksum_none_assert(skb);
-                        rxdesc->addr = virt_to_phys(skb->data);
+                        rxdesc->addr = dma_addr;
                }
                if (entry >= mdp->num_rx_ring - 1)
                        rxdesc->status |=
@@ -1566,7 +1617,6 @@ ignore_link:
                if (intr_status & EESR_RFRMER) {
                        /* Receive Frame Overflow int */
                        ndev->stats.rx_frame_errors++;
-                        netif_err(mdp, rx_err, ndev, "Receive Abort\n");
                }
        }
@@ -1585,13 +1635,11 @@ ignore_link:
        if (intr_status & EESR_RDE) {
                /* Receive Descriptor Empty int */
                ndev->stats.rx_over_errors++;
-                netif_err(mdp, rx_err, ndev, "Receive Descriptor Empty\n");
        }
        if (intr_status & EESR_RFE) {
                /* Receive FIFO Overflow int */
                ndev->stats.rx_fifo_errors++;
-                netif_err(mdp, rx_err, ndev, "Receive FIFO Overflow\n");
        }
        if (!mdp->cd->no_ade && (intr_status & EESR_ADE)) {
@@ -1646,7 +1694,12 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
        if (intr_status & (EESR_RX_CHECK | cd->tx_check | cd->eesr_err_check))
                ret = IRQ_HANDLED;
        else
-                goto other_irq;
+                goto out;
+        if (!likely(mdp->irq_enabled)) {
+                sh_eth_write(ndev, 0, EESIPR);
+                goto out;
+        }
        if (intr_status & EESR_RX_CHECK) {
                if (napi_schedule_prep(&mdp->napi)) {
@@ -1677,7 +1730,7 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
                sh_eth_error(ndev, intr_status);
        }
-other_irq:
+out:
        spin_unlock(&mdp->lock);
        return ret;
@@ -1705,7 +1758,8 @@ static int sh_eth_poll(struct napi_struct *napi, int budget)
        napi_complete(napi);
        /* Reenable Rx interrupts */
-        sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
+        if (mdp->irq_enabled)
+                sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
 out:
        return budget - quota;
 }
@@ -1820,6 +1874,9 @@ static int sh_eth_get_settings(struct net_device *ndev,
        unsigned long flags;
        int ret;
+        if (!mdp->phydev)
+                return -ENODEV;
        spin_lock_irqsave(&mdp->lock, flags);
        ret = phy_ethtool_gset(mdp->phydev, ecmd);
        spin_unlock_irqrestore(&mdp->lock, flags);
@@ -1834,6 +1891,9 @@ static int sh_eth_set_settings(struct net_device *ndev,
        unsigned long flags;
        int ret;
+        if (!mdp->phydev)
+                return -ENODEV;
        spin_lock_irqsave(&mdp->lock, flags);
        /* disable tx and rx */
@@ -1868,6 +1928,9 @@ static int sh_eth_nway_reset(struct net_device *ndev)
        unsigned long flags;
        int ret;
+        if (!mdp->phydev)
+                return -ENODEV;
        spin_lock_irqsave(&mdp->lock, flags);
        ret = phy_start_aneg(mdp->phydev);
        spin_unlock_irqrestore(&mdp->lock, flags);
@@ -1952,40 +2015,50 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
                return -EINVAL;
        if (netif_running(ndev)) {
+                netif_device_detach(ndev);
                netif_tx_disable(ndev);
-                /* Disable interrupts by clearing the interrupt mask. */
-                sh_eth_write(ndev, 0x0000, EESIPR);
+                /* Serialise with the interrupt handler and NAPI, then
-                /* Stop the chip's Tx and Rx processes. */
+                 * disable interrupts.  We have to clear the
-                sh_eth_write(ndev, 0, EDTRR);
+                 * irq_enabled flag first to ensure that interrupts
-                sh_eth_write(ndev, 0, EDRRR);
+                 * won't be re-enabled.
+                 */
+                mdp->irq_enabled = false;
                synchronize_irq(ndev->irq);
-        }
+                napi_synchronize(&mdp->napi);
+                sh_eth_write(ndev, 0x0000, EESIPR);
-        /* Free all the skbuffs in the Rx queue. */
+                sh_eth_dev_exit(ndev);
-        sh_eth_ring_free(ndev);
-        /* Free DMA buffer */
+                /* Free all the skbuffs in the Rx queue. */
-        sh_eth_free_dma_buffer(mdp);
+                sh_eth_ring_free(ndev);
+                /* Free DMA buffer */
+                sh_eth_free_dma_buffer(mdp);
+        }
        /* Set new parameters */
        mdp->num_rx_ring = ring->rx_pending;
        mdp->num_tx_ring = ring->tx_pending;
-        ret = sh_eth_ring_init(ndev);
-        if (ret < 0) {
-                netdev_err(ndev, "%s: sh_eth_ring_init failed.\n", __func__);
-                return ret;
-        }
-        ret = sh_eth_dev_init(ndev, false);
-        if (ret < 0) {
-                netdev_err(ndev, "%s: sh_eth_dev_init failed.\n", __func__);
-                return ret;
-        }
        if (netif_running(ndev)) {
+                ret = sh_eth_ring_init(ndev);
+                if (ret < 0) {
+                        netdev_err(ndev, "%s: sh_eth_ring_init failed.\n",
+                                   __func__);
+                        return ret;
+                }
+                ret = sh_eth_dev_init(ndev, false);
+                if (ret < 0) {
+                        netdev_err(ndev, "%s: sh_eth_dev_init failed.\n",
+                                   __func__);
+                        return ret;
+                }
+                mdp->irq_enabled = true;
                sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
                /* Setting the Rx mode will start the Rx process. */
                sh_eth_write(ndev, EDRRR_R, EDRRR);
-                netif_wake_queue(ndev);
+                netif_device_attach(ndev);
        }
        return 0;
@@ -2101,6 +2174,9 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        }
        spin_unlock_irqrestore(&mdp->lock, flags);
+        if (skb_padto(skb, ETH_ZLEN))
+                return NETDEV_TX_OK;
        entry = mdp->cur_tx % mdp->num_tx_ring;
        mdp->tx_skbuff[entry] = skb;
        txdesc = &mdp->tx_ring[entry];
@@ -2110,10 +2186,11 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                                 skb->len + 2);
        txdesc->addr = dma_map_single(&ndev->dev, skb->data, skb->len,
                                      DMA_TO_DEVICE);
-        if (skb->len < ETH_ZLEN)
+        if (dma_mapping_error(&ndev->dev, txdesc->addr)) {
-                txdesc->buffer_length = ETH_ZLEN;
+                kfree_skb(skb);
-        else
+                return NETDEV_TX_OK;
-                txdesc->buffer_length = skb->len;
+        }
+        txdesc->buffer_length = skb->len;
        if (entry >= mdp->num_tx_ring - 1)
                txdesc->status |= cpu_to_edmac(mdp, TD_TACT | TD_TDLE);
@@ -2165,24 +2242,26 @@ static int sh_eth_close(struct net_device *ndev)
        netif_stop_queue(ndev);
-        /* Disable interrupts by clearing the interrupt mask. */
+        /* Serialise with the interrupt handler and NAPI, then disable
+         * interrupts.  We have to clear the irq_enabled flag first to
+         * ensure that interrupts won't be re-enabled.
+         */
+        mdp->irq_enabled = false;
+        synchronize_irq(ndev->irq);
+        napi_disable(&mdp->napi);
        sh_eth_write(ndev, 0x0000, EESIPR);
-        /* Stop the chip's Tx and Rx processes. */
+        sh_eth_dev_exit(ndev);
-        sh_eth_write(ndev, 0, EDTRR);
-        sh_eth_write(ndev, 0, EDRRR);
-        sh_eth_get_stats(ndev);
        /* PHY Disconnect */
        if (mdp->phydev) {
                phy_stop(mdp->phydev);
                phy_disconnect(mdp->phydev);
+                mdp->phydev = NULL;
        }
        free_irq(ndev->irq, ndev);
-        napi_disable(&mdp->napi);
        /* Free all the skbuffs in the Rx queue. */
        sh_eth_ring_free(ndev);
@@ -2410,7 +2489,7 @@ static int sh_eth_tsu_purge_all(struct net_device *ndev)
        struct sh_eth_private *mdp = netdev_priv(ndev);
        int i, ret;
-        if (unlikely(!mdp->cd->tsu))
+        if (!mdp->cd->tsu)
                return 0;
        for (i = 0; i < SH_ETH_TSU_CAM_ENTRIES; i++) {
@@ -2433,7 +2512,7 @@ static void sh_eth_tsu_purge_mcast(struct net_device *ndev)
        void *reg_offset = sh_eth_tsu_get_offset(mdp, TSU_ADRH0);
        int i;
-        if (unlikely(!mdp->cd->tsu))
+        if (!mdp->cd->tsu)
                return;
        for (i = 0; i < SH_ETH_TSU_CAM_ENTRIES; i++, reg_offset += 8) {
@@ -2443,8 +2522,8 @@ static void sh_eth_tsu_purge_mcast(struct net_device *ndev)
        }
 }
-/* Multicast reception directions set */
+/* Update promiscuous flag and multicast filter */
-static void sh_eth_set_multicast_list(struct net_device *ndev)
+static void sh_eth_set_rx_mode(struct net_device *ndev)
 {
        struct sh_eth_private *mdp = netdev_priv(ndev);
        u32 ecmr_bits;
@@ -2455,7 +2534,9 @@ static void sh_eth_set_multicast_list(struct net_device *ndev)
        /* Initial condition is MCT = 1, PRM = 0.
         * Depending on ndev->flags, set PRM or clear MCT
         */
-        ecmr_bits = (sh_eth_read(ndev, ECMR) & ~ECMR_PRM) | ECMR_MCT;
+        ecmr_bits = sh_eth_read(ndev, ECMR) & ~ECMR_PRM;
+        if (mdp->cd->tsu)
+                ecmr_bits |= ECMR_MCT;
        if (!(ndev->flags & IFF_MULTICAST)) {
                sh_eth_tsu_purge_mcast(ndev);
@@ -2484,9 +2565,6 @@ static void sh_eth_set_multicast_list(struct net_device *ndev)
                                }
                        }
                }
-        } else {
-                /* Normal, unicast/broadcast-only mode. */
-                ecmr_bits = (ecmr_bits & ~ECMR_PRM) | ECMR_MCT;
        }
        /* update the ethernet mode */
@@ -2694,6 +2772,7 @@ static const struct net_device_ops sh_eth_netdev_ops = {
        .ndo_stop               = sh_eth_close,
        .ndo_start_xmit         = sh_eth_start_xmit,
        .ndo_get_stats          = sh_eth_get_stats,
+        .ndo_set_rx_mode        = sh_eth_set_rx_mode,
        .ndo_tx_timeout         = sh_eth_tx_timeout,
        .ndo_do_ioctl           = sh_eth_do_ioctl,
        .ndo_validate_addr      = eth_validate_addr,
@@ -2706,7 +2785,7 @@ static const struct net_device_ops sh_eth_netdev_ops_tsu = {
        .ndo_stop               = sh_eth_close,
        .ndo_start_xmit         = sh_eth_start_xmit,
        .ndo_get_stats          = sh_eth_get_stats,
-        .ndo_set_rx_mode        = sh_eth_set_multicast_list,
+        .ndo_set_rx_mode        = sh_eth_set_rx_mode,
        .ndo_vlan_rx_add_vid    = sh_eth_vlan_rx_add_vid,
        .ndo_vlan_rx_kill_vid   = sh_eth_vlan_rx_kill_vid,
        .ndo_tx_timeout         = sh_eth_tx_timeout,
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index 22301bf9c21d..332d3c16d483 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -369,6 +369,8 @@ enum DESC_I_BIT {
        DESC_I_RINT1 = 0x0001,
 };
+#define DEFAULT_TRSCER_ERR_MASK (DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2)
 /* RPADIR */
 enum RPADIR_BIT {
        RPADIR_PADS1 = 0x20000, RPADIR_PADS0 = 0x10000,
@@ -470,6 +472,9 @@ struct sh_eth_cpu_data {
        unsigned long tx_check;
        unsigned long eesr_err_check;
+        /* Error mask */
+        unsigned long trscer_err_mask;
        /* hardware features */
        unsigned long irq_flags; /* IRQ configuration flags */
        unsigned no_psr:1;      /* EtherC DO NOT have PSR */
@@ -508,6 +513,7 @@ struct sh_eth_private {
        u32 rx_buf_sz;                  /* Based on MTU+slack. */
        int edmac_endian;
        struct napi_struct napi;
+        bool irq_enabled;
        /* MII transceiver section. */
        u32 phy_id;                     /* PHY ID */
        struct mii_bus *mii_bus;        /* MDIO bus control */
diff --git a/drivers/net/ethernet/s6gmac.c b/drivers/net/ethernet/s6gmac.c
deleted file mode 100644
index f537cbea20e5..000000000000
--- a/drivers/net/ethernet/s6gmac.c
+++ /dev/null
@@ -1,1058 +0,0 @@
-/*
- * Ethernet driver for S6105 on chip network device
- * (c)2008 emlix GmbH http://www.emlix.com
- * Authors:     Oskar Schirmer <oskar@scara.com>
- *              Daniel Gloeckner <dg@emlix.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/interrupt.h>
-#include <linux/types.h>
-#include <linux/delay.h>
-#include <linux/spinlock.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/if.h>
-#include <linux/stddef.h>
-#include <linux/mii.h>
-#include <linux/phy.h>
-#include <linux/platform_device.h>
-#include <variant/hardware.h>
-#include <variant/dmac.h>
-#define DRV_NAME "s6gmac"
-#define DRV_PRMT DRV_NAME ": "
-/* register declarations */
-#define S6_GMAC_MACCONF1        0x000
-#define S6_GMAC_MACCONF1_TXENA          0
-#define S6_GMAC_MACCONF1_SYNCTX         1
-#define S6_GMAC_MACCONF1_RXENA          2
-#define S6_GMAC_MACCONF1_SYNCRX         3
-#define S6_GMAC_MACCONF1_TXFLOWCTRL     4
-#define S6_GMAC_MACCONF1_RXFLOWCTRL     5
-#define S6_GMAC_MACCONF1_LOOPBACK       8
-#define S6_GMAC_MACCONF1_RESTXFUNC      16
-#define S6_GMAC_MACCONF1_RESRXFUNC      17
-#define S6_GMAC_MACCONF1_RESTXMACCTRL   18
-#define S6_GMAC_MACCONF1_RESRXMACCTRL   19
-#define S6_GMAC_MACCONF1_SIMULRES       30
-#define S6_GMAC_MACCONF1_SOFTRES        31
-#define S6_GMAC_MACCONF2        0x004
-#define S6_GMAC_MACCONF2_FULL           0
-#define S6_GMAC_MACCONF2_CRCENA         1
-#define S6_GMAC_MACCONF2_PADCRCENA      2
-#define S6_GMAC_MACCONF2_LENGTHFCHK     4
-#define S6_GMAC_MACCONF2_HUGEFRAMENA    5
-#define S6_GMAC_MACCONF2_IFMODE         8
-#define S6_GMAC_MACCONF2_IFMODE_NIBBLE          1
-#define S6_GMAC_MACCONF2_IFMODE_BYTE            2
-#define S6_GMAC_MACCONF2_IFMODE_MASK            3
-#define S6_GMAC_MACCONF2_PREAMBLELEN    12
-#define S6_GMAC_MACCONF2_PREAMBLELEN_MASK       0x0F
-#define S6_GMAC_MACIPGIFG       0x008
-#define S6_GMAC_MACIPGIFG_B2BINTERPGAP  0
-#define S6_GMAC_MACIPGIFG_B2BINTERPGAP_MASK     0x7F
-#define S6_GMAC_MACIPGIFG_MINIFGENFORCE 8
-#define S6_GMAC_MACIPGIFG_B2BINTERPGAP2 16
-#define S6_GMAC_MACIPGIFG_B2BINTERPGAP1 24
-#define S6_GMAC_MACHALFDUPLEX   0x00C
-#define S6_GMAC_MACHALFDUPLEX_COLLISWIN 0
-#define S6_GMAC_MACHALFDUPLEX_COLLISWIN_MASK    0x3F
-#define S6_GMAC_MACHALFDUPLEX_RETXMAX   12
-#define S6_GMAC_MACHALFDUPLEX_RETXMAX_MASK      0x0F
-#define S6_GMAC_MACHALFDUPLEX_EXCESSDEF 16
-#define S6_GMAC_MACHALFDUPLEX_NOBACKOFF 17
-#define S6_GMAC_MACHALFDUPLEX_BPNOBCKOF 18
-#define S6_GMAC_MACHALFDUPLEX_ALTBEBENA 19
-#define S6_GMAC_MACHALFDUPLEX_ALTBEBTRN 20
-#define S6_GMAC_MACHALFDUPLEX_ALTBEBTR_MASK     0x0F
-#define S6_GMAC_MACMAXFRAMELEN  0x010
-#define S6_GMAC_MACMIICONF      0x020
-#define S6_GMAC_MACMIICONF_CSEL         0
-#define S6_GMAC_MACMIICONF_CSEL_DIV10           0
-#define S6_GMAC_MACMIICONF_CSEL_DIV12           1
-#define S6_GMAC_MACMIICONF_CSEL_DIV14           2
-#define S6_GMAC_MACMIICONF_CSEL_DIV18           3
-#define S6_GMAC_MACMIICONF_CSEL_DIV24           4
-#define S6_GMAC_MACMIICONF_CSEL_DIV34           5
-#define S6_GMAC_MACMIICONF_CSEL_DIV68           6
-#define S6_GMAC_MACMIICONF_CSEL_DIV168          7
-#define S6_GMAC_MACMIICONF_CSEL_MASK            7
-#define S6_GMAC_MACMIICONF_PREAMBLESUPR 4
-#define S6_GMAC_MACMIICONF_SCANAUTOINCR 5
-#define S6_GMAC_MACMIICMD       0x024
-#define S6_GMAC_MACMIICMD_READ          0
-#define S6_GMAC_MACMIICMD_SCAN          1
-#define S6_GMAC_MACMIIADDR      0x028
-#define S6_GMAC_MACMIIADDR_REG          0
-#define S6_GMAC_MACMIIADDR_REG_MASK             0x1F
-#define S6_GMAC_MACMIIADDR_PHY          8
-#define S6_GMAC_MACMIIADDR_PHY_MASK             0x1F
-#define S6_GMAC_MACMIICTRL      0x02C
-#define S6_GMAC_MACMIISTAT      0x030
-#define S6_GMAC_MACMIIINDI      0x034
-#define S6_GMAC_MACMIIINDI_BUSY         0
-#define S6_GMAC_MACMIIINDI_SCAN         1
-#define S6_GMAC_MACMIIINDI_INVAL        2
-#define S6_GMAC_MACINTERFSTAT   0x03C
-#define S6_GMAC_MACINTERFSTAT_LINKFAIL  3
-#define S6_GMAC_MACINTERFSTAT_EXCESSDEF 9
-#define S6_GMAC_MACSTATADDR1    0x040
-#define S6_GMAC_MACSTATADDR2    0x044
-#define S6_GMAC_FIFOCONF0       0x048
-#define S6_GMAC_FIFOCONF0_HSTRSTWT      0
-#define S6_GMAC_FIFOCONF0_HSTRSTSR      1
-#define S6_GMAC_FIFOCONF0_HSTRSTFR      2
-#define S6_GMAC_FIFOCONF0_HSTRSTST      3
-#define S6_GMAC_FIFOCONF0_HSTRSTFT      4
-#define S6_GMAC_FIFOCONF0_WTMENREQ      8
-#define S6_GMAC_FIFOCONF0_SRFENREQ      9
-#define S6_GMAC_FIFOCONF0_FRFENREQ      10
-#define S6_GMAC_FIFOCONF0_STFENREQ      11
-#define S6_GMAC_FIFOCONF0_FTFENREQ      12
-#define S6_GMAC_FIFOCONF0_WTMENRPLY     16
-#define S6_GMAC_FIFOCONF0_SRFENRPLY     17
-#define S6_GMAC_FIFOCONF0_FRFENRPLY     18
-#define S6_GMAC_FIFOCONF0_STFENRPLY     19
-#define S6_GMAC_FIFOCONF0_FTFENRPLY     20
-#define S6_GMAC_FIFOCONF1       0x04C
-#define S6_GMAC_FIFOCONF2       0x050
-#define S6_GMAC_FIFOCONF2_CFGLWM        0
-#define S6_GMAC_FIFOCONF2_CFGHWM        16
-#define S6_GMAC_FIFOCONF3       0x054
-#define S6_GMAC_FIFOCONF3_CFGFTTH       0
-#define S6_GMAC_FIFOCONF3_CFGHWMFT      16
-#define S6_GMAC_FIFOCONF4       0x058
-#define S6_GMAC_FIFOCONF_RSV_PREVDROP   0
-#define S6_GMAC_FIFOCONF_RSV_RUNT       1
-#define S6_GMAC_FIFOCONF_RSV_FALSECAR   2
-#define S6_GMAC_FIFOCONF_RSV_CODEERR    3
-#define S6_GMAC_FIFOCONF_RSV_CRCERR     4
-#define S6_GMAC_FIFOCONF_RSV_LENGTHERR  5
-#define S6_GMAC_FIFOCONF_RSV_LENRANGE   6
-#define S6_GMAC_FIFOCONF_RSV_OK         7
-#define S6_GMAC_FIFOCONF_RSV_MULTICAST  8
-#define S6_GMAC_FIFOCONF_RSV_BROADCAST  9
-#define S6_GMAC_FIFOCONF_RSV_DRIBBLE    10
-#define S6_GMAC_FIFOCONF_RSV_CTRLFRAME  11
-#define S6_GMAC_FIFOCONF_RSV_PAUSECTRL  12
-#define S6_GMAC_FIFOCONF_RSV_UNOPCODE   13
-#define S6_GMAC_FIFOCONF_RSV_VLANTAG    14
-#define S6_GMAC_FIFOCONF_RSV_LONGEVENT  15
-#define S6_GMAC_FIFOCONF_RSV_TRUNCATED  16
-#define S6_GMAC_FIFOCONF_RSV_MASK               0x3FFFF
-#define S6_GMAC_FIFOCONF5       0x05C
-#define S6_GMAC_FIFOCONF5_DROPLT64      18
-#define S6_GMAC_FIFOCONF5_CFGBYTM       19
-#define S6_GMAC_FIFOCONF5_RXDROPSIZE    20
-#define S6_GMAC_FIFOCONF5_RXDROPSIZE_MASK       0xF
-#define S6_GMAC_STAT_REGS       0x080
-#define S6_GMAC_STAT_SIZE_MIN           12
-#define S6_GMAC_STATTR64        0x080
-#define S6_GMAC_STATTR64_SIZE           18
-#define S6_GMAC_STATTR127       0x084
-#define S6_GMAC_STATTR127_SIZE          18
-#define S6_GMAC_STATTR255       0x088
-#define S6_GMAC_STATTR255_SIZE          18
-#define S6_GMAC_STATTR511       0x08C
-#define S6_GMAC_STATTR511_SIZE          18
-#define S6_GMAC_STATTR1K        0x090
-#define S6_GMAC_STATTR1K_SIZE           18
-#define S6_GMAC_STATTRMAX       0x094
-#define S6_GMAC_STATTRMAX_SIZE          18
-#define S6_GMAC_STATTRMGV       0x098
-#define S6_GMAC_STATTRMGV_SIZE          18
-#define S6_GMAC_STATRBYT        0x09C
-#define S6_GMAC_STATRBYT_SIZE           24
-#define S6_GMAC_STATRPKT        0x0A0
-#define S6_GMAC_STATRPKT_SIZE           18
-#define S6_GMAC_STATRFCS        0x0A4
-#define S6_GMAC_STATRFCS_SIZE           12
-#define S6_GMAC_STATRMCA        0x0A8
-#define S6_GMAC_STATRMCA_SIZE           18
-#define S6_GMAC_STATRBCA        0x0AC
-#define S6_GMAC_STATRBCA_SIZE           22
-#define S6_GMAC_STATRXCF        0x0B0
-#define S6_GMAC_STATRXCF_SIZE           18
-#define S6_GMAC_STATRXPF        0x0B4
-#define S6_GMAC_STATRXPF_SIZE           12
-#define S6_GMAC_STATRXUO        0x0B8
-#define S6_GMAC_STATRXUO_SIZE           12
-#define S6_GMAC_STATRALN        0x0BC
-#define S6_GMAC_STATRALN_SIZE           12
-#define S6_GMAC_STATRFLR        0x0C0
-#define S6_GMAC_STATRFLR_SIZE           16
-#define S6_GMAC_STATRCDE        0x0C4
-#define S6_GMAC_STATRCDE_SIZE           12
-#define S6_GMAC_STATRCSE        0x0C8
-#define S6_GMAC_STATRCSE_SIZE           12
-#define S6_GMAC_STATRUND        0x0CC
-#define S6_GMAC_STATRUND_SIZE           12
-#define S6_GMAC_STATROVR        0x0D0
-#define S6_GMAC_STATROVR_SIZE           12
-#define S6_GMAC_STATRFRG        0x0D4
-#define S6_GMAC_STATRFRG_SIZE           12
-#define S6_GMAC_STATRJBR        0x0D8
-#define S6_GMAC_STATRJBR_SIZE           12
-#define S6_GMAC_STATRDRP        0x0DC
-#define S6_GMAC_STATRDRP_SIZE           12
-#define S6_GMAC_STATTBYT        0x0E0
-#define S6_GMAC_STATTBYT_SIZE           24
-#define S6_GMAC_STATTPKT        0x0E4
-#define S6_GMAC_STATTPKT_SIZE           18
-#define S6_GMAC_STATTMCA        0x0E8
-#define S6_GMAC_STATTMCA_SIZE           18
-#define S6_GMAC_STATTBCA        0x0EC
-#define S6_GMAC_STATTBCA_SIZE           18
-#define S6_GMAC_STATTXPF        0x0F0
-#define S6_GMAC_STATTXPF_SIZE           12
-#define S6_GMAC_STATTDFR        0x0F4
-#define S6_GMAC_STATTDFR_SIZE           12
-#define S6_GMAC_STATTEDF        0x0F8
-#define S6_GMAC_STATTEDF_SIZE           12
-#define S6_GMAC_STATTSCL        0x0FC
-#define S6_GMAC_STATTSCL_SIZE           12
-#define S6_GMAC_STATTMCL        0x100
-#define S6_GMAC_STATTMCL_SIZE           12
-#define S6_GMAC_STATTLCL        0x104
-#define S6_GMAC_STATTLCL_SIZE           12
-#define S6_GMAC_STATTXCL        0x108
-#define S6_GMAC_STATTXCL_SIZE           12
-#define S6_GMAC_STATTNCL        0x10C
-#define S6_GMAC_STATTNCL_SIZE           13
-#define S6_GMAC_STATTPFH        0x110
-#define S6_GMAC_STATTPFH_SIZE           12
-#define S6_GMAC_STATTDRP        0x114
-#define S6_GMAC_STATTDRP_SIZE           12
-#define S6_GMAC_STATTJBR        0x118
-#define S6_GMAC_STATTJBR_SIZE           12
-#define S6_GMAC_STATTFCS        0x11C
-#define S6_GMAC_STATTFCS_SIZE           12
-#define S6_GMAC_STATTXCF        0x120
-#define S6_GMAC_STATTXCF_SIZE           12
-#define S6_GMAC_STATTOVR        0x124
-#define S6_GMAC_STATTOVR_SIZE           12
-#define S6_GMAC_STATTUND        0x128
-#define S6_GMAC_STATTUND_SIZE           12
-#define S6_GMAC_STATTFRG        0x12C
-#define S6_GMAC_STATTFRG_SIZE           12
-#define S6_GMAC_STATCARRY(n)    (0x130 + 4*(n))
-#define S6_GMAC_STATCARRYMSK(n) (0x138 + 4*(n))
-#define S6_GMAC_STATCARRY1_RDRP         0
-#define S6_GMAC_STATCARRY1_RJBR         1
-#define S6_GMAC_STATCARRY1_RFRG         2
-#define S6_GMAC_STATCARRY1_ROVR         3
-#define S6_GMAC_STATCARRY1_RUND         4
-#define S6_GMAC_STATCARRY1_RCSE         5
-#define S6_GMAC_STATCARRY1_RCDE         6
-#define S6_GMAC_STATCARRY1_RFLR         7
-#define S6_GMAC_STATCARRY1_RALN         8
-#define S6_GMAC_STATCARRY1_RXUO         9
-#define S6_GMAC_STATCARRY1_RXPF         10
-#define S6_GMAC_STATCARRY1_RXCF         11
-#define S6_GMAC_STATCARRY1_RBCA         12
-#define S6_GMAC_STATCARRY1_RMCA         13
-#define S6_GMAC_STATCARRY1_RFCS         14
-#define S6_GMAC_STATCARRY1_RPKT         15
-#define S6_GMAC_STATCARRY1_RBYT         16
-#define S6_GMAC_STATCARRY1_TRMGV        25
-#define S6_GMAC_STATCARRY1_TRMAX        26
-#define S6_GMAC_STATCARRY1_TR1K         27
-#define S6_GMAC_STATCARRY1_TR511        28
-#define S6_GMAC_STATCARRY1_TR255        29
-#define S6_GMAC_STATCARRY1_TR127        30
-#define S6_GMAC_STATCARRY1_TR64         31
-#define S6_GMAC_STATCARRY2_TDRP         0
-#define S6_GMAC_STATCARRY2_TPFH         1
-#define S6_GMAC_STATCARRY2_TNCL         2
-#define S6_GMAC_STATCARRY2_TXCL         3
-#define S6_GMAC_STATCARRY2_TLCL         4
-#define S6_GMAC_STATCARRY2_TMCL         5
-#define S6_GMAC_STATCARRY2_TSCL         6
-#define S6_GMAC_STATCARRY2_TEDF         7
-#define S6_GMAC_STATCARRY2_TDFR         8
-#define S6_GMAC_STATCARRY2_TXPF         9
-#define S6_GMAC_STATCARRY2_TBCA         10
-#define S6_GMAC_STATCARRY2_TMCA         11
-#define S6_GMAC_STATCARRY2_TPKT         12
-#define S6_GMAC_STATCARRY2_TBYT         13
-#define S6_GMAC_STATCARRY2_TFRG         14
-#define S6_GMAC_STATCARRY2_TUND         15
-#define S6_GMAC_STATCARRY2_TOVR         16
-#define S6_GMAC_STATCARRY2_TXCF         17
-#define S6_GMAC_STATCARRY2_TFCS         18
-#define S6_GMAC_STATCARRY2_TJBR         19
-#define S6_GMAC_HOST_PBLKCTRL   0x140
-#define S6_GMAC_HOST_PBLKCTRL_TXENA     0
-#define S6_GMAC_HOST_PBLKCTRL_RXENA     1
-#define S6_GMAC_HOST_PBLKCTRL_TXSRES    2
-#define S6_GMAC_HOST_PBLKCTRL_RXSRES    3
-#define S6_GMAC_HOST_PBLKCTRL_TXBSIZ    8
-#define S6_GMAC_HOST_PBLKCTRL_RXBSIZ    12
-#define S6_GMAC_HOST_PBLKCTRL_SIZ_16            4
-#define S6_GMAC_HOST_PBLKCTRL_SIZ_32            5
-#define S6_GMAC_HOST_PBLKCTRL_SIZ_64            6
-#define S6_GMAC_HOST_PBLKCTRL_SIZ_128           7
-#define S6_GMAC_HOST_PBLKCTRL_SIZ_MASK          0xF
-#define S6_GMAC_HOST_PBLKCTRL_STATENA   16
-#define S6_GMAC_HOST_PBLKCTRL_STATAUTOZ 17
-#define S6_GMAC_HOST_PBLKCTRL_STATCLEAR 18
-#define S6_GMAC_HOST_PBLKCTRL_RGMII     19
-#define S6_GMAC_HOST_INTMASK    0x144
-#define S6_GMAC_HOST_INTSTAT    0x148
-#define S6_GMAC_HOST_INT_TXBURSTOVER    3
-#define S6_GMAC_HOST_INT_TXPREWOVER     4
-#define S6_GMAC_HOST_INT_RXBURSTUNDER   5
-#define S6_GMAC_HOST_INT_RXPOSTRFULL    6
-#define S6_GMAC_HOST_INT_RXPOSTRUNDER   7
-#define S6_GMAC_HOST_RXFIFOHWM  0x14C
-#define S6_GMAC_HOST_CTRLFRAMXP 0x150
-#define S6_GMAC_HOST_DSTADDRLO(n) (0x160 + 8*(n))
-#define S6_GMAC_HOST_DSTADDRHI(n) (0x164 + 8*(n))
-#define S6_GMAC_HOST_DSTMASKLO(n) (0x180 + 8*(n))
-#define S6_GMAC_HOST_DSTMASKHI(n) (0x184 + 8*(n))
-#define S6_GMAC_BURST_PREWR     0x1B0
-#define S6_GMAC_BURST_PREWR_LEN         0
-#define S6_GMAC_BURST_PREWR_LEN_MASK            ((1 << 20) - 1)
-#define S6_GMAC_BURST_PREWR_CFE         20
-#define S6_GMAC_BURST_PREWR_PPE         21
-#define S6_GMAC_BURST_PREWR_FCS         22
-#define S6_GMAC_BURST_PREWR_PAD         23
-#define S6_GMAC_BURST_POSTRD    0x1D0
-#define S6_GMAC_BURST_POSTRD_LEN        0
-#define S6_GMAC_BURST_POSTRD_LEN_MASK           ((1 << 20) - 1)
-#define S6_GMAC_BURST_POSTRD_DROP       20
-/* data handling */
-#define S6_NUM_TX_SKB   8       /* must be larger than TX fifo size */
-#define S6_NUM_RX_SKB   16
-#define S6_MAX_FRLEN    1536
-struct s6gmac {
-        u32 reg;
-        u32 tx_dma;
-        u32 rx_dma;
-        u32 io;
-        u8 tx_chan;
-        u8 rx_chan;
-        spinlock_t lock;
-        u8 tx_skb_i, tx_skb_o;
-        u8 rx_skb_i, rx_skb_o;
-        struct sk_buff *tx_skb[S6_NUM_TX_SKB];
-        struct sk_buff *rx_skb[S6_NUM_RX_SKB];
-        unsigned long carry[sizeof(struct net_device_stats) / sizeof(long)];
-        unsigned long stats[sizeof(struct net_device_stats) / sizeof(long)];
-        struct phy_device *phydev;
-        struct {
-                struct mii_bus *bus;
-                int irq[PHY_MAX_ADDR];
-        } mii;
-        struct {
-                unsigned int mbit;
-                u8 giga;
-                u8 isup;
-                u8 full;
-        } link;
-};
-static void s6gmac_rx_fillfifo(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        struct sk_buff *skb;
-        while ((((u8)(pd->rx_skb_i - pd->rx_skb_o)) < S6_NUM_RX_SKB) &&
-               (!s6dmac_fifo_full(pd->rx_dma, pd->rx_chan)) &&
-               (skb = netdev_alloc_skb(dev, S6_MAX_FRLEN + 2))) {
-                pd->rx_skb[(pd->rx_skb_i++) % S6_NUM_RX_SKB] = skb;
-                s6dmac_put_fifo_cache(pd->rx_dma, pd->rx_chan,
-                        pd->io, (u32)skb->data, S6_MAX_FRLEN);
-        }
-}
-static void s6gmac_rx_interrupt(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        u32 pfx;
-        struct sk_buff *skb;
-        while (((u8)(pd->rx_skb_i - pd->rx_skb_o)) >
-                        s6dmac_pending_count(pd->rx_dma, pd->rx_chan)) {
-                skb = pd->rx_skb[(pd->rx_skb_o++) % S6_NUM_RX_SKB];
-                pfx = readl(pd->reg + S6_GMAC_BURST_POSTRD);
-                if (pfx & (1 << S6_GMAC_BURST_POSTRD_DROP)) {
-                        dev_kfree_skb_irq(skb);
-                } else {
-                        skb_put(skb, (pfx >> S6_GMAC_BURST_POSTRD_LEN)
-                                & S6_GMAC_BURST_POSTRD_LEN_MASK);
-                        skb->protocol = eth_type_trans(skb, dev);
-                        skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        netif_rx(skb);
-                }
-        }
-}
-static void s6gmac_tx_interrupt(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        while (((u8)(pd->tx_skb_i - pd->tx_skb_o)) >
-                        s6dmac_pending_count(pd->tx_dma, pd->tx_chan)) {
-                dev_kfree_skb_irq(pd->tx_skb[(pd->tx_skb_o++) % S6_NUM_TX_SKB]);
-        }
-        if (!s6dmac_fifo_full(pd->tx_dma, pd->tx_chan))
-                netif_wake_queue(dev);
-}
-struct s6gmac_statinf {
-        unsigned reg_size : 4; /* 0: unused */
-        unsigned reg_off : 6;
-        unsigned net_index : 6;
-};
-#define S6_STATS_B (8 * sizeof(u32))
-#define S6_STATS_C(b, r, f) [b] = { \
-        BUILD_BUG_ON_ZERO(r##_SIZE < S6_GMAC_STAT_SIZE_MIN) + \
-        BUILD_BUG_ON_ZERO((r##_SIZE - (S6_GMAC_STAT_SIZE_MIN - 1)) \
-                        >= (1<<4)) + \
-        r##_SIZE - (S6_GMAC_STAT_SIZE_MIN - 1), \
-        BUILD_BUG_ON_ZERO(((unsigned)((r - S6_GMAC_STAT_REGS) / sizeof(u32))) \
-                        >= ((1<<6)-1)) + \
-        (r - S6_GMAC_STAT_REGS) / sizeof(u32), \
-        BUILD_BUG_ON_ZERO((offsetof(struct net_device_stats, f)) \
-                        % sizeof(unsigned long)) + \
-        BUILD_BUG_ON_ZERO((((unsigned)(offsetof(struct net_device_stats, f)) \
-                        / sizeof(unsigned long)) >= (1<<6))) + \
-        BUILD_BUG_ON_ZERO((sizeof(((struct net_device_stats *)0)->f) \
-                        != sizeof(unsigned long))) + \
-        (offsetof(struct net_device_stats, f)) / sizeof(unsigned long)},
-static const struct s6gmac_statinf statinf[2][S6_STATS_B] = { {
-        S6_STATS_C(S6_GMAC_STATCARRY1_RBYT, S6_GMAC_STATRBYT, rx_bytes)
-        S6_STATS_C(S6_GMAC_STATCARRY1_RPKT, S6_GMAC_STATRPKT, rx_packets)
-        S6_STATS_C(S6_GMAC_STATCARRY1_RFCS, S6_GMAC_STATRFCS, rx_crc_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY1_RMCA, S6_GMAC_STATRMCA, multicast)
-        S6_STATS_C(S6_GMAC_STATCARRY1_RALN, S6_GMAC_STATRALN, rx_frame_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY1_RFLR, S6_GMAC_STATRFLR, rx_length_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY1_RCDE, S6_GMAC_STATRCDE, rx_missed_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY1_RUND, S6_GMAC_STATRUND, rx_length_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY1_ROVR, S6_GMAC_STATROVR, rx_length_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY1_RFRG, S6_GMAC_STATRFRG, rx_crc_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY1_RJBR, S6_GMAC_STATRJBR, rx_crc_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY1_RDRP, S6_GMAC_STATRDRP, rx_dropped)
-}, {
-        S6_STATS_C(S6_GMAC_STATCARRY2_TBYT, S6_GMAC_STATTBYT, tx_bytes)
-        S6_STATS_C(S6_GMAC_STATCARRY2_TPKT, S6_GMAC_STATTPKT, tx_packets)
-        S6_STATS_C(S6_GMAC_STATCARRY2_TEDF, S6_GMAC_STATTEDF, tx_aborted_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY2_TXCL, S6_GMAC_STATTXCL, tx_aborted_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY2_TNCL, S6_GMAC_STATTNCL, collisions)
-        S6_STATS_C(S6_GMAC_STATCARRY2_TDRP, S6_GMAC_STATTDRP, tx_dropped)
-        S6_STATS_C(S6_GMAC_STATCARRY2_TJBR, S6_GMAC_STATTJBR, tx_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY2_TFCS, S6_GMAC_STATTFCS, tx_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY2_TOVR, S6_GMAC_STATTOVR, tx_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY2_TUND, S6_GMAC_STATTUND, tx_errors)
-        S6_STATS_C(S6_GMAC_STATCARRY2_TFRG, S6_GMAC_STATTFRG, tx_errors)
-} };
-static void s6gmac_stats_collect(struct s6gmac *pd,
-                const struct s6gmac_statinf *inf)
-{
-        int b;
-        for (b = 0; b < S6_STATS_B; b++) {
-                if (inf[b].reg_size) {
-                        pd->stats[inf[b].net_index] +=
-                                readl(pd->reg + S6_GMAC_STAT_REGS
-                                        + sizeof(u32) * inf[b].reg_off);
-                }
-        }
-}
-static void s6gmac_stats_carry(struct s6gmac *pd,
-                const struct s6gmac_statinf *inf, u32 mask)
-{
-        int b;
-        while (mask) {
-                b = fls(mask) - 1;
-                mask &= ~(1 << b);
-                pd->carry[inf[b].net_index] += (1 << inf[b].reg_size);
-        }
-}
-static inline u32 s6gmac_stats_pending(struct s6gmac *pd, int carry)
-{
-        int r = readl(pd->reg + S6_GMAC_STATCARRY(carry)) &
-                ~readl(pd->reg + S6_GMAC_STATCARRYMSK(carry));
-        return r;
-}
-static inline void s6gmac_stats_interrupt(struct s6gmac *pd, int carry)
-{
-        u32 mask;
-        mask = s6gmac_stats_pending(pd, carry);
-        if (mask) {
-                writel(mask, pd->reg + S6_GMAC_STATCARRY(carry));
-                s6gmac_stats_carry(pd, &statinf[carry][0], mask);
-        }
-}
-static irqreturn_t s6gmac_interrupt(int irq, void *dev_id)
-{
-        struct net_device *dev = (struct net_device *)dev_id;
-        struct s6gmac *pd = netdev_priv(dev);
-        if (!dev)
-                return IRQ_NONE;
-        spin_lock(&pd->lock);
-        if (s6dmac_termcnt_irq(pd->rx_dma, pd->rx_chan))
-                s6gmac_rx_interrupt(dev);
-        s6gmac_rx_fillfifo(dev);
-        if (s6dmac_termcnt_irq(pd->tx_dma, pd->tx_chan))
-                s6gmac_tx_interrupt(dev);
-        s6gmac_stats_interrupt(pd, 0);
-        s6gmac_stats_interrupt(pd, 1);
-        spin_unlock(&pd->lock);
-        return IRQ_HANDLED;
-}
-static inline void s6gmac_set_dstaddr(struct s6gmac *pd, int n,
-        u32 addrlo, u32 addrhi, u32 masklo, u32 maskhi)
-{
-        writel(addrlo, pd->reg + S6_GMAC_HOST_DSTADDRLO(n));
-        writel(addrhi, pd->reg + S6_GMAC_HOST_DSTADDRHI(n));
-        writel(masklo, pd->reg + S6_GMAC_HOST_DSTMASKLO(n));
-        writel(maskhi, pd->reg + S6_GMAC_HOST_DSTMASKHI(n));
-}
-static inline void s6gmac_stop_device(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        writel(0, pd->reg + S6_GMAC_MACCONF1);
-}
-static inline void s6gmac_init_device(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        int is_rgmii = !!(pd->phydev->supported
-                & (SUPPORTED_1000baseT_Full | SUPPORTED_1000baseT_Half));
-#if 0
-        writel(1 << S6_GMAC_MACCONF1_SYNCTX |
-                1 << S6_GMAC_MACCONF1_SYNCRX |
-                1 << S6_GMAC_MACCONF1_TXFLOWCTRL |
-                1 << S6_GMAC_MACCONF1_RXFLOWCTRL |
-                1 << S6_GMAC_MACCONF1_RESTXFUNC |
-                1 << S6_GMAC_MACCONF1_RESRXFUNC |
-                1 << S6_GMAC_MACCONF1_RESTXMACCTRL |
-                1 << S6_GMAC_MACCONF1_RESRXMACCTRL,
-                pd->reg + S6_GMAC_MACCONF1);
-#endif
-        writel(1 << S6_GMAC_MACCONF1_SOFTRES, pd->reg + S6_GMAC_MACCONF1);
-        udelay(1000);
-        writel(1 << S6_GMAC_MACCONF1_TXENA | 1 << S6_GMAC_MACCONF1_RXENA,
-                pd->reg + S6_GMAC_MACCONF1);
-        writel(1 << S6_GMAC_HOST_PBLKCTRL_TXSRES |
-                1 << S6_GMAC_HOST_PBLKCTRL_RXSRES,
-                pd->reg + S6_GMAC_HOST_PBLKCTRL);
-        writel(S6_GMAC_HOST_PBLKCTRL_SIZ_128 << S6_GMAC_HOST_PBLKCTRL_TXBSIZ |
-                S6_GMAC_HOST_PBLKCTRL_SIZ_128 << S6_GMAC_HOST_PBLKCTRL_RXBSIZ |
-                1 << S6_GMAC_HOST_PBLKCTRL_STATENA |
-                1 << S6_GMAC_HOST_PBLKCTRL_STATCLEAR |
-                is_rgmii << S6_GMAC_HOST_PBLKCTRL_RGMII,
-                pd->reg + S6_GMAC_HOST_PBLKCTRL);
-        writel(1 << S6_GMAC_MACCONF1_TXENA |
-                1 << S6_GMAC_MACCONF1_RXENA |
-                (dev->flags & IFF_LOOPBACK ? 1 : 0)
-                        << S6_GMAC_MACCONF1_LOOPBACK,
-                pd->reg + S6_GMAC_MACCONF1);
-        writel(dev->mtu && (dev->mtu < (S6_MAX_FRLEN - ETH_HLEN-ETH_FCS_LEN)) ?
-                        dev->mtu+ETH_HLEN+ETH_FCS_LEN : S6_MAX_FRLEN,
-                pd->reg + S6_GMAC_MACMAXFRAMELEN);
-        writel((pd->link.full ? 1 : 0) << S6_GMAC_MACCONF2_FULL |
-                1 << S6_GMAC_MACCONF2_PADCRCENA |
-                1 << S6_GMAC_MACCONF2_LENGTHFCHK |
-                (pd->link.giga ?
-                        S6_GMAC_MACCONF2_IFMODE_BYTE :
-                        S6_GMAC_MACCONF2_IFMODE_NIBBLE)
-                        << S6_GMAC_MACCONF2_IFMODE |
-                7 << S6_GMAC_MACCONF2_PREAMBLELEN,
-                pd->reg + S6_GMAC_MACCONF2);
-        writel(0, pd->reg + S6_GMAC_MACSTATADDR1);
-        writel(0, pd->reg + S6_GMAC_MACSTATADDR2);
-        writel(1 << S6_GMAC_FIFOCONF0_WTMENREQ |
-                1 << S6_GMAC_FIFOCONF0_SRFENREQ |
-                1 << S6_GMAC_FIFOCONF0_FRFENREQ |
-                1 << S6_GMAC_FIFOCONF0_STFENREQ |
-                1 << S6_GMAC_FIFOCONF0_FTFENREQ,
-                pd->reg + S6_GMAC_FIFOCONF0);
-        writel(128 << S6_GMAC_FIFOCONF3_CFGFTTH |
-                128 << S6_GMAC_FIFOCONF3_CFGHWMFT,
-                pd->reg + S6_GMAC_FIFOCONF3);
-        writel((S6_GMAC_FIFOCONF_RSV_MASK & ~(
-                        1 << S6_GMAC_FIFOCONF_RSV_RUNT |
-                        1 << S6_GMAC_FIFOCONF_RSV_CRCERR |
-                        1 << S6_GMAC_FIFOCONF_RSV_OK |
-                        1 << S6_GMAC_FIFOCONF_RSV_DRIBBLE |
-                        1 << S6_GMAC_FIFOCONF_RSV_CTRLFRAME |
-                        1 << S6_GMAC_FIFOCONF_RSV_PAUSECTRL |
-                        1 << S6_GMAC_FIFOCONF_RSV_UNOPCODE |
-                        1 << S6_GMAC_FIFOCONF_RSV_TRUNCATED)) |
-                1 << S6_GMAC_FIFOCONF5_DROPLT64 |
-                pd->link.giga << S6_GMAC_FIFOCONF5_CFGBYTM |
-                1 << S6_GMAC_FIFOCONF5_RXDROPSIZE,
-                pd->reg + S6_GMAC_FIFOCONF5);
-        writel(1 << S6_GMAC_FIFOCONF_RSV_RUNT |
-                1 << S6_GMAC_FIFOCONF_RSV_CRCERR |
-                1 << S6_GMAC_FIFOCONF_RSV_DRIBBLE |
-                1 << S6_GMAC_FIFOCONF_RSV_CTRLFRAME |
-                1 << S6_GMAC_FIFOCONF_RSV_PAUSECTRL |
-                1 << S6_GMAC_FIFOCONF_RSV_UNOPCODE |
-                1 << S6_GMAC_FIFOCONF_RSV_TRUNCATED,
-                pd->reg + S6_GMAC_FIFOCONF4);
-        s6gmac_set_dstaddr(pd, 0,
-                0xFFFFFFFF, 0x0000FFFF, 0xFFFFFFFF, 0x0000FFFF);
-        s6gmac_set_dstaddr(pd, 1,
-                dev->dev_addr[5] |
-                dev->dev_addr[4] << 8 |
-                dev->dev_addr[3] << 16 |
-                dev->dev_addr[2] << 24,
-                dev->dev_addr[1] |
-                dev->dev_addr[0] << 8,
-                0xFFFFFFFF, 0x0000FFFF);
-        s6gmac_set_dstaddr(pd, 2,
-                0x00000000, 0x00000100, 0x00000000, 0x00000100);
-        s6gmac_set_dstaddr(pd, 3,
-                0x00000000, 0x00000000, 0x00000000, 0x00000000);
-        writel(1 << S6_GMAC_HOST_PBLKCTRL_TXENA |
-                1 << S6_GMAC_HOST_PBLKCTRL_RXENA |
-                S6_GMAC_HOST_PBLKCTRL_SIZ_128 << S6_GMAC_HOST_PBLKCTRL_TXBSIZ |
-                S6_GMAC_HOST_PBLKCTRL_SIZ_128 << S6_GMAC_HOST_PBLKCTRL_RXBSIZ |
-                1 << S6_GMAC_HOST_PBLKCTRL_STATENA |
-                1 << S6_GMAC_HOST_PBLKCTRL_STATCLEAR |
-                is_rgmii << S6_GMAC_HOST_PBLKCTRL_RGMII,
-                pd->reg + S6_GMAC_HOST_PBLKCTRL);
-}
-static void s6mii_enable(struct s6gmac *pd)
-{
-        writel(readl(pd->reg + S6_GMAC_MACCONF1) &
-                ~(1 << S6_GMAC_MACCONF1_SOFTRES),
-                pd->reg + S6_GMAC_MACCONF1);
-        writel((readl(pd->reg + S6_GMAC_MACMIICONF)
-                & ~(S6_GMAC_MACMIICONF_CSEL_MASK << S6_GMAC_MACMIICONF_CSEL))
-                | (S6_GMAC_MACMIICONF_CSEL_DIV168 << S6_GMAC_MACMIICONF_CSEL),
-                pd->reg + S6_GMAC_MACMIICONF);
-}
-static int s6mii_busy(struct s6gmac *pd, int tmo)
-{
-        while (readl(pd->reg + S6_GMAC_MACMIIINDI)) {
-                if (--tmo == 0)
-                        return -ETIME;
-                udelay(64);
-        }
-        return 0;
-}
-static int s6mii_read(struct mii_bus *bus, int phy_addr, int regnum)
-{
-        struct s6gmac *pd = bus->priv;
-        s6mii_enable(pd);
-        if (s6mii_busy(pd, 256))
-                return -ETIME;
-        writel(phy_addr << S6_GMAC_MACMIIADDR_PHY |
-                regnum << S6_GMAC_MACMIIADDR_REG,
-                pd->reg + S6_GMAC_MACMIIADDR);
-        writel(1 << S6_GMAC_MACMIICMD_READ, pd->reg + S6_GMAC_MACMIICMD);
-        writel(0, pd->reg + S6_GMAC_MACMIICMD);
-        if (s6mii_busy(pd, 256))
-                return -ETIME;
-        return (u16)readl(pd->reg + S6_GMAC_MACMIISTAT);
-}
-static int s6mii_write(struct mii_bus *bus, int phy_addr, int regnum, u16 value)
-{
-        struct s6gmac *pd = bus->priv;
-        s6mii_enable(pd);
-        if (s6mii_busy(pd, 256))
-                return -ETIME;
-        writel(phy_addr << S6_GMAC_MACMIIADDR_PHY |
-                regnum << S6_GMAC_MACMIIADDR_REG,
-                pd->reg + S6_GMAC_MACMIIADDR);
-        writel(value, pd->reg + S6_GMAC_MACMIICTRL);
-        if (s6mii_busy(pd, 256))
-                return -ETIME;
-        return 0;
-}
-static int s6mii_reset(struct mii_bus *bus)
-{
-        struct s6gmac *pd = bus->priv;
-        s6mii_enable(pd);
-        if (s6mii_busy(pd, PHY_INIT_TIMEOUT))
-                return -ETIME;
-        return 0;
-}
-static void s6gmac_set_rgmii_txclock(struct s6gmac *pd)
-{
-        u32 pllsel = readl(S6_REG_GREG1 + S6_GREG1_PLLSEL);
-        pllsel &= ~(S6_GREG1_PLLSEL_GMAC_MASK << S6_GREG1_PLLSEL_GMAC);
-        switch (pd->link.mbit) {
-        case 10:
-                pllsel |= S6_GREG1_PLLSEL_GMAC_2500KHZ << S6_GREG1_PLLSEL_GMAC;
-                break;
-        case 100:
-                pllsel |= S6_GREG1_PLLSEL_GMAC_25MHZ << S6_GREG1_PLLSEL_GMAC;
-                break;
-        case 1000:
-                pllsel |= S6_GREG1_PLLSEL_GMAC_125MHZ << S6_GREG1_PLLSEL_GMAC;
-                break;
-        default:
-                return;
-        }
-        writel(pllsel, S6_REG_GREG1 + S6_GREG1_PLLSEL);
-}
-static inline void s6gmac_linkisup(struct net_device *dev, int isup)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        struct phy_device *phydev = pd->phydev;
-        pd->link.full = phydev->duplex;
-        pd->link.giga = (phydev->speed == 1000);
-        if (pd->link.mbit != phydev->speed) {
-                pd->link.mbit = phydev->speed;
-                s6gmac_set_rgmii_txclock(pd);
-        }
-        pd->link.isup = isup;
-        if (isup)
-                netif_carrier_on(dev);
-        phy_print_status(phydev);
-}
-static void s6gmac_adjust_link(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        struct phy_device *phydev = pd->phydev;
-        if (pd->link.isup &&
-                        (!phydev->link ||
-                        (pd->link.mbit != phydev->speed) ||
-                        (pd->link.full != phydev->duplex))) {
-                pd->link.isup = 0;
-                netif_tx_disable(dev);
-                if (!phydev->link) {
-                        netif_carrier_off(dev);
-                        phy_print_status(phydev);
-                }
-        }
-        if (!pd->link.isup && phydev->link) {
-                if (pd->link.full != phydev->duplex) {
-                        u32 maccfg = readl(pd->reg + S6_GMAC_MACCONF2);
-                        if (phydev->duplex)
-                                maccfg |= 1 << S6_GMAC_MACCONF2_FULL;
-                        else
-                                maccfg &= ~(1 << S6_GMAC_MACCONF2_FULL);
-                        writel(maccfg, pd->reg + S6_GMAC_MACCONF2);
-                }
-                if (pd->link.giga != (phydev->speed == 1000)) {
-                        u32 fifocfg = readl(pd->reg + S6_GMAC_FIFOCONF5);
-                        u32 maccfg = readl(pd->reg + S6_GMAC_MACCONF2);
-                        maccfg &= ~(S6_GMAC_MACCONF2_IFMODE_MASK
-                                     << S6_GMAC_MACCONF2_IFMODE);
-                        if (phydev->speed == 1000) {
-                                fifocfg |= 1 << S6_GMAC_FIFOCONF5_CFGBYTM;
-                                maccfg |= S6_GMAC_MACCONF2_IFMODE_BYTE
-                                           << S6_GMAC_MACCONF2_IFMODE;
-                        } else {
-                                fifocfg &= ~(1 << S6_GMAC_FIFOCONF5_CFGBYTM);
-                                maccfg |= S6_GMAC_MACCONF2_IFMODE_NIBBLE
-                                           << S6_GMAC_MACCONF2_IFMODE;
-                        }
-                        writel(fifocfg, pd->reg + S6_GMAC_FIFOCONF5);
-                        writel(maccfg, pd->reg + S6_GMAC_MACCONF2);
-                }
-                if (!s6dmac_fifo_full(pd->tx_dma, pd->tx_chan))
-                        netif_wake_queue(dev);
-                s6gmac_linkisup(dev, 1);
-        }
-}
-static inline int s6gmac_phy_start(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        int i = 0;
-        struct phy_device *p = NULL;
-        while ((i < PHY_MAX_ADDR) && (!(p = pd->mii.bus->phy_map[i])))
-                i++;
-        p = phy_connect(dev, dev_name(&p->dev), &s6gmac_adjust_link,
-                        PHY_INTERFACE_MODE_RGMII);
-        if (IS_ERR(p)) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
-                return PTR_ERR(p);
-        }
-        p->supported &= PHY_GBIT_FEATURES;
-        p->advertising = p->supported;
-        pd->phydev = p;
-        return 0;
-}
-static inline void s6gmac_init_stats(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        u32 mask;
-        mask =  1 << S6_GMAC_STATCARRY1_RDRP |
-                1 << S6_GMAC_STATCARRY1_RJBR |
-                1 << S6_GMAC_STATCARRY1_RFRG |
-                1 << S6_GMAC_STATCARRY1_ROVR |
-                1 << S6_GMAC_STATCARRY1_RUND |
-                1 << S6_GMAC_STATCARRY1_RCDE |
-                1 << S6_GMAC_STATCARRY1_RFLR |
-                1 << S6_GMAC_STATCARRY1_RALN |
-                1 << S6_GMAC_STATCARRY1_RMCA |
-                1 << S6_GMAC_STATCARRY1_RFCS |
-                1 << S6_GMAC_STATCARRY1_RPKT |
-                1 << S6_GMAC_STATCARRY1_RBYT;
-        writel(mask, pd->reg + S6_GMAC_STATCARRY(0));
-        writel(~mask, pd->reg + S6_GMAC_STATCARRYMSK(0));
-        mask =  1 << S6_GMAC_STATCARRY2_TDRP |
-                1 << S6_GMAC_STATCARRY2_TNCL |
-                1 << S6_GMAC_STATCARRY2_TXCL |
-                1 << S6_GMAC_STATCARRY2_TEDF |
-                1 << S6_GMAC_STATCARRY2_TPKT |
-                1 << S6_GMAC_STATCARRY2_TBYT |
-                1 << S6_GMAC_STATCARRY2_TFRG |
-                1 << S6_GMAC_STATCARRY2_TUND |
-                1 << S6_GMAC_STATCARRY2_TOVR |
-                1 << S6_GMAC_STATCARRY2_TFCS |
-                1 << S6_GMAC_STATCARRY2_TJBR;
-        writel(mask, pd->reg + S6_GMAC_STATCARRY(1));
-        writel(~mask, pd->reg + S6_GMAC_STATCARRYMSK(1));
-}
-static inline void s6gmac_init_dmac(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        s6dmac_disable_chan(pd->tx_dma, pd->tx_chan);
-        s6dmac_disable_chan(pd->rx_dma, pd->rx_chan);
-        s6dmac_disable_error_irqs(pd->tx_dma, 1 << S6_HIFDMA_GMACTX);
-        s6dmac_disable_error_irqs(pd->rx_dma, 1 << S6_HIFDMA_GMACRX);
-}
-static int s6gmac_tx(struct sk_buff *skb, struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        unsigned long flags;
-        spin_lock_irqsave(&pd->lock, flags);
-        writel(skb->len << S6_GMAC_BURST_PREWR_LEN |
-                0 << S6_GMAC_BURST_PREWR_CFE |
-                1 << S6_GMAC_BURST_PREWR_PPE |
-                1 << S6_GMAC_BURST_PREWR_FCS |
-                ((skb->len < ETH_ZLEN) ? 1 : 0) << S6_GMAC_BURST_PREWR_PAD,
-                pd->reg + S6_GMAC_BURST_PREWR);
-        s6dmac_put_fifo_cache(pd->tx_dma, pd->tx_chan,
-                (u32)skb->data, pd->io, skb->len);
-        if (s6dmac_fifo_full(pd->tx_dma, pd->tx_chan))
-                netif_stop_queue(dev);
-        if (((u8)(pd->tx_skb_i - pd->tx_skb_o)) >= S6_NUM_TX_SKB) {
-                printk(KERN_ERR "GMAC BUG: skb tx ring overflow [%x, %x]\n",
-                        pd->tx_skb_o, pd->tx_skb_i);
-                BUG();
-        }
-        pd->tx_skb[(pd->tx_skb_i++) % S6_NUM_TX_SKB] = skb;
-        spin_unlock_irqrestore(&pd->lock, flags);
-        return 0;
-}
-static void s6gmac_tx_timeout(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        unsigned long flags;
-        spin_lock_irqsave(&pd->lock, flags);
-        s6gmac_tx_interrupt(dev);
-        spin_unlock_irqrestore(&pd->lock, flags);
-}
-static int s6gmac_open(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        unsigned long flags;
-        phy_read_status(pd->phydev);
-        spin_lock_irqsave(&pd->lock, flags);
-        pd->link.mbit = 0;
-        s6gmac_linkisup(dev, pd->phydev->link);
-        s6gmac_init_device(dev);
-        s6gmac_init_stats(dev);
-        s6gmac_init_dmac(dev);
-        s6gmac_rx_fillfifo(dev);
-        s6dmac_enable_chan(pd->rx_dma, pd->rx_chan,
-                2, 1, 0, 1, 0, 0, 0, 7, -1, 2, 0, 1);
-        s6dmac_enable_chan(pd->tx_dma, pd->tx_chan,
-                2, 0, 1, 0, 0, 0, 0, 7, -1, 2, 0, 1);
-        writel(0 << S6_GMAC_HOST_INT_TXBURSTOVER |
-                0 << S6_GMAC_HOST_INT_TXPREWOVER |
-                0 << S6_GMAC_HOST_INT_RXBURSTUNDER |
-                0 << S6_GMAC_HOST_INT_RXPOSTRFULL |
-                0 << S6_GMAC_HOST_INT_RXPOSTRUNDER,
-                pd->reg + S6_GMAC_HOST_INTMASK);
-        spin_unlock_irqrestore(&pd->lock, flags);
-        phy_start(pd->phydev);
-        netif_start_queue(dev);
-        return 0;
-}
-static int s6gmac_stop(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        unsigned long flags;
-        netif_stop_queue(dev);
-        phy_stop(pd->phydev);
-        spin_lock_irqsave(&pd->lock, flags);
-        s6gmac_init_dmac(dev);
-        s6gmac_stop_device(dev);
-        while (pd->tx_skb_i != pd->tx_skb_o)
-                dev_kfree_skb(pd->tx_skb[(pd->tx_skb_o++) % S6_NUM_TX_SKB]);
-        while (pd->rx_skb_i != pd->rx_skb_o)
-                dev_kfree_skb(pd->rx_skb[(pd->rx_skb_o++) % S6_NUM_RX_SKB]);
-        spin_unlock_irqrestore(&pd->lock, flags);
-        return 0;
-}
-static struct net_device_stats *s6gmac_stats(struct net_device *dev)
-{
-        struct s6gmac *pd = netdev_priv(dev);
-        struct net_device_stats *st = (struct net_device_stats *)&pd->stats;
-        int i;
-        do {
-                unsigned long flags;
-                spin_lock_irqsave(&pd->lock, flags);
-                for (i = 0; i < ARRAY_SIZE(pd->stats); i++)
-                        pd->stats[i] =
-                                pd->carry[i] << (S6_GMAC_STAT_SIZE_MIN - 1);
-                s6gmac_stats_collect(pd, &statinf[0][0]);
-                s6gmac_stats_collect(pd, &statinf[1][0]);
-                i = s6gmac_stats_pending(pd, 0) |
-                        s6gmac_stats_pending(pd, 1);
-                spin_unlock_irqrestore(&pd->lock, flags);
-        } while (i);
-        st->rx_errors = st->rx_crc_errors +
-                        st->rx_frame_errors +
-                        st->rx_length_errors +
-                        st->rx_missed_errors;
-        st->tx_errors += st->tx_aborted_errors;
-        return st;
-}
-static int s6gmac_probe(struct platform_device *pdev)
-{
-        struct net_device *dev;
-        struct s6gmac *pd;
-        int res;
-        unsigned long i;
-        struct mii_bus *mb;
-        dev = alloc_etherdev(sizeof(*pd));
-        if (!dev)
-                return -ENOMEM;
-        dev->open = s6gmac_open;
-        dev->stop = s6gmac_stop;
-        dev->hard_start_xmit = s6gmac_tx;
-        dev->tx_timeout = s6gmac_tx_timeout;
-        dev->watchdog_timeo = HZ;
-        dev->get_stats = s6gmac_stats;
-        dev->irq = platform_get_irq(pdev, 0);
-        pd = netdev_priv(dev);
-        memset(pd, 0, sizeof(*pd));
-        spin_lock_init(&pd->lock);
-        pd->reg = platform_get_resource(pdev, IORESOURCE_MEM, 0)->start;
-        i = platform_get_resource(pdev, IORESOURCE_DMA, 0)->start;
-        pd->tx_dma = DMA_MASK_DMAC(i);
-        pd->tx_chan = DMA_INDEX_CHNL(i);
-        i = platform_get_resource(pdev, IORESOURCE_DMA, 1)->start;
-        pd->rx_dma = DMA_MASK_DMAC(i);
-        pd->rx_chan = DMA_INDEX_CHNL(i);
-        pd->io = platform_get_resource(pdev, IORESOURCE_IO, 0)->start;
-        res = request_irq(dev->irq, s6gmac_interrupt, 0, dev->name, dev);
-        if (res) {
-                printk(KERN_ERR DRV_PRMT "irq request failed: %d\n", dev->irq);
-                goto errirq;
-        }
-        res = register_netdev(dev);
-        if (res) {
-                printk(KERN_ERR DRV_PRMT "error registering device %s\n",
-                        dev->name);
-                goto errdev;
-        }
-        mb = mdiobus_alloc();
-        if (!mb) {
-                printk(KERN_ERR DRV_PRMT "error allocating mii bus\n");
-                res = -ENOMEM;
-                goto errmii;
-        }
-        mb->name = "s6gmac_mii";
-        mb->read = s6mii_read;
-        mb->write = s6mii_write;
-        mb->reset = s6mii_reset;
-        mb->priv = pd;
-        snprintf(mb->id, MII_BUS_ID_SIZE, "%s-%x", pdev->name, pdev->id);
-        mb->phy_mask = ~(1 << 0);
-        mb->irq = &pd->mii.irq[0];
-        for (i = 0; i < PHY_MAX_ADDR; i++) {
-                int n = platform_get_irq(pdev, i + 1);
-                if (n < 0)
-                        n = PHY_POLL;
-                pd->mii.irq[i] = n;
-        }
-        mdiobus_register(mb);
-        pd->mii.bus = mb;
-        res = s6gmac_phy_start(dev);
-        if (res)
-                return res;
-        platform_set_drvdata(pdev, dev);
-        return 0;
-errmii:
-        unregister_netdev(dev);
-errdev:
-        free_irq(dev->irq, dev);
-errirq:
-        free_netdev(dev);
-        return res;
-}
-static int s6gmac_remove(struct platform_device *pdev)
-{
-        struct net_device *dev = platform_get_drvdata(pdev);
-        if (dev) {
-                struct s6gmac *pd = netdev_priv(dev);
-                mdiobus_unregister(pd->mii.bus);
-                unregister_netdev(dev);
-                free_irq(dev->irq, dev);
-                free_netdev(dev);
-        }
-        return 0;
-}
-static struct platform_driver s6gmac_driver = {
-        .probe = s6gmac_probe,
-        .remove = s6gmac_remove,
-        .driver = {
-                .name = "s6gmac",
-        },
-};
-module_platform_driver(s6gmac_driver);
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("S6105 on chip Ethernet driver");
-MODULE_AUTHOR("Oskar Schirmer <oskar@scara.com>");
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
index 698494481d18..b1a271853d85 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
@@ -474,13 +474,19 @@ static int init_rx_ring(struct net_device *dev, u8 queue_no,
        /* allocate memory for RX skbuff array */
        rx_ring->rx_skbuff_dma = kmalloc_array(rx_rsize,
                                               sizeof(dma_addr_t), GFP_KERNEL);
-        if (rx_ring->rx_skbuff_dma == NULL)
+        if (!rx_ring->rx_skbuff_dma) {
-                goto dmamem_err;
+                dma_free_coherent(priv->device,
+                                  rx_rsize * sizeof(struct sxgbe_rx_norm_desc),
+                                  rx_ring->dma_rx, rx_ring->dma_rx_phy);
+                goto error;
+        }
        rx_ring->rx_skbuff = kmalloc_array(rx_rsize,
                                           sizeof(struct sk_buff *), GFP_KERNEL);
-        if (rx_ring->rx_skbuff == NULL)
+        if (!rx_ring->rx_skbuff) {
-                goto rxbuff_err;
+                kfree(rx_ring->rx_skbuff_dma);
+                goto error;
+        }
        /* initialise the buffers */
        for (desc_index = 0; desc_index < rx_rsize; desc_index++) {
@@ -502,13 +508,6 @@ static int init_rx_ring(struct net_device *dev, u8 queue_no,
 err_init_rx_buffers:
        while (--desc_index >= 0)
                free_rx_ring(priv->device, rx_ring, desc_index);
-        kfree(rx_ring->rx_skbuff);
-rxbuff_err:
-        kfree(rx_ring->rx_skbuff_dma);
-dmamem_err:
-        dma_free_coherent(priv->device,
-                          rx_rsize * sizeof(struct sxgbe_rx_norm_desc),
-                          rx_ring->dma_rx, rx_ring->dma_rx_phy);
 error:
        return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c
index 866560ea9e18..b02eed12bfc5 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c
@@ -108,10 +108,6 @@ static int sxgbe_platform_probe(struct platform_device *pdev)
                }
        }
-        /* Get MAC address if available (DT) */
-        if (mac)
-                ether_addr_copy(priv->dev->dev_addr, mac);
        priv = sxgbe_drv_probe(&(pdev->dev), plat_dat, addr);
        if (!priv) {
                pr_err("%s: main driver probe failed\n", __func__);
@@ -125,6 +121,10 @@ static int sxgbe_platform_probe(struct platform_device *pdev)
                goto err_drv_remove;
        }
+        /* Get MAC address if available (DT) */
+        if (mac)
+                ether_addr_copy(priv->dev->dev_addr, mac);
        /* Get the TX/RX IRQ numbers */
        for (i = 0, chan = 1; i < SXGBE_TX_QUEUES; i++) {
                priv->txq[i]->irq_no = irq_of_parse_and_map(node, chan++);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 118a427d1942..cf62ff4c8c56 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1671,7 +1671,7 @@ static void stmmac_init_tx_coalesce(struct stmmac_priv *priv)
 *  0 on success and an appropriate (-)ve integer as defined in errno.h
 *  file on failure.
 */
-static int stmmac_hw_setup(struct net_device *dev)
+static int stmmac_hw_setup(struct net_device *dev, bool init_ptp)
 {
        struct stmmac_priv *priv = netdev_priv(dev);
        int ret;
@@ -1708,9 +1708,11 @@ static int stmmac_hw_setup(struct net_device *dev)
        stmmac_mmc_setup(priv);
-        ret = stmmac_init_ptp(priv);
+        if (init_ptp) {
-        if (ret && ret != -EOPNOTSUPP)
+                ret = stmmac_init_ptp(priv);
-                pr_warn("%s: failed PTP initialisation\n", __func__);
+                if (ret && ret != -EOPNOTSUPP)
+                        pr_warn("%s: failed PTP initialisation\n", __func__);
+        }
 #ifdef CONFIG_DEBUG_FS
        ret = stmmac_init_fs(dev);
@@ -1787,7 +1789,7 @@ static int stmmac_open(struct net_device *dev)
                goto init_error;
        }
-        ret = stmmac_hw_setup(dev);
+        ret = stmmac_hw_setup(dev, true);
        if (ret < 0) {
                pr_err("%s: Hw setup failed\n", __func__);
                goto init_error;
@@ -2776,6 +2778,9 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
 * @addr: iobase memory address
 * Description: this is the main probe function used to
 * call the alloc_etherdev, allocate the priv structure.
+ * Return:
+ * on success the new private structure is returned, otherwise the error
+ * pointer.
 */
 struct stmmac_priv *stmmac_dvr_probe(struct device *device,
                                     struct plat_stmmacenet_data *plat_dat,
@@ -2787,7 +2792,7 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
        ndev = alloc_etherdev(sizeof(struct stmmac_priv));
        if (!ndev)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        SET_NETDEV_DEV(ndev, device);
@@ -3036,7 +3041,7 @@ int stmmac_resume(struct net_device *ndev)
        netif_device_attach(ndev);
        init_dma_desc_rings(ndev, GFP_ATOMIC);
-        stmmac_hw_setup(ndev);
+        stmmac_hw_setup(ndev, false);
        stmmac_init_tx_coalesce(priv);
        napi_enable(&priv->napi);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 4032b170fe24..3039de2465ba 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -430,7 +430,6 @@ static struct platform_driver stmmac_pltfr_driver = {
        .remove = stmmac_pltfr_remove,
        .driver = {
                   .name = STMMAC_RESOURCE_NAME,
-                   .owner = THIS_MODULE,
                   .pm = &stmmac_pltfr_pm_ops,
                   .of_match_table = of_match_ptr(stmmac_dt_ids),
        },
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index 45c408ef67d0..3699b98d5b2c 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -1119,6 +1119,7 @@ static inline struct sk_buff *vnet_skb_shape(struct sk_buff *skb, int ncookies)
                        skb_shinfo(nskb)->gso_size = skb_shinfo(skb)->gso_size;
                        skb_shinfo(nskb)->gso_type = skb_shinfo(skb)->gso_type;
                }
+                nskb->queue_mapping = skb->queue_mapping;
                dev_kfree_skb(skb);
                skb = nskb;
        }
@@ -1201,6 +1202,7 @@ static int vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb)
                segs = skb_gso_segment(skb, dev->features & ~NETIF_F_TSO);
        if (IS_ERR(segs)) {
                dev->stats.tx_dropped++;
+                dev_kfree_skb_any(skb);
                return NETDEV_TX_OK;
        }
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index c560f9aeb55d..a39131f494ec 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -610,7 +610,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                        /* Clear all mcast from ALE */
                        cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS <<
-                                                 priv->host_port);
+                                                 priv->host_port, -1);
                        /* Flood All Unicast Packets to Host port */
                        cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
@@ -634,6 +634,12 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
 static void cpsw_ndo_set_rx_mode(struct net_device *ndev)
 {
        struct cpsw_priv *priv = netdev_priv(ndev);
+        int vid;
+        if (priv->data.dual_emac)
+                vid = priv->slaves[priv->emac_port].port_vlan;
+        else
+                vid = priv->data.default_vlan;
        if (ndev->flags & IFF_PROMISC) {
                /* Enable promiscuous mode */
@@ -649,7 +655,8 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)
        cpsw_ale_set_allmulti(priv->ale, priv->ndev->flags & IFF_ALLMULTI);
        /* Clear all mcast from ALE */
-        cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port);
+        cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port,
+                                 vid);
        if (!netdev_mc_empty(ndev)) {
                struct netdev_hw_addr *ha;
@@ -757,6 +764,14 @@ requeue:
 static irqreturn_t cpsw_interrupt(int irq, void *dev_id)
 {
        struct cpsw_priv *priv = dev_id;
+        int value = irq - priv->irqs_table[0];
+        /* NOTICE: Ending IRQ here. The trick with the 'value' variable above
+         * is to make sure we will always write the correct value to the EOI
+         * register. Namely 0 for RX_THRESH Interrupt, 1 for RX Interrupt, 2
+         * for TX Interrupt and 3 for MISC Interrupt.
+         */
+        cpdma_ctlr_eoi(priv->dma, value);
        cpsw_intr_disable(priv);
        if (priv->irq_enabled == true) {
@@ -786,8 +801,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
        int                     num_tx, num_rx;
        num_tx = cpdma_chan_process(priv->txch, 128);
-        if (num_tx)
-                cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
        num_rx = cpdma_chan_process(priv->rxch, budget);
        if (num_rx < budget) {
@@ -795,7 +808,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
                napi_complete(napi);
                cpsw_intr_enable(priv);
-                cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
                prim_cpsw = cpsw_get_slave_priv(priv, 0);
                if (prim_cpsw->irq_enabled == false) {
                        prim_cpsw->irq_enabled = true;
@@ -1310,8 +1322,6 @@ static int cpsw_ndo_open(struct net_device *ndev)
        napi_enable(&priv->napi);
        cpdma_ctlr_start(priv->dma);
        cpsw_intr_enable(priv);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
        prim_cpsw = cpsw_get_slave_priv(priv, 0);
        if (prim_cpsw->irq_enabled == false) {
@@ -1578,9 +1588,6 @@ static void cpsw_ndo_tx_timeout(struct net_device *ndev)
        cpdma_chan_start(priv->txch);
        cpdma_ctlr_int_ctrl(priv->dma, true);
        cpsw_intr_enable(priv);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
 }
 static int cpsw_ndo_set_mac_address(struct net_device *ndev, void *p)
@@ -1620,9 +1627,6 @@ static void cpsw_ndo_poll_controller(struct net_device *ndev)
        cpsw_interrupt(ndev->irq, priv);
        cpdma_ctlr_int_ctrl(priv->dma, true);
        cpsw_intr_enable(priv);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
 }
 #endif
@@ -1630,16 +1634,24 @@ static inline int cpsw_add_vlan_ale_entry(struct cpsw_priv *priv,
                                unsigned short vid)
 {
        int ret;
-        int unreg_mcast_mask;
+        int unreg_mcast_mask = 0;
+        u32 port_mask;
-        if (priv->ndev->flags & IFF_ALLMULTI)
+        if (priv->data.dual_emac) {
-                unreg_mcast_mask = ALE_ALL_PORTS;
+                port_mask = (1 << (priv->emac_port + 1)) | ALE_PORT_HOST;
-        else
-                unreg_mcast_mask = ALE_PORT_1 | ALE_PORT_2;
+                if (priv->ndev->flags & IFF_ALLMULTI)
+                        unreg_mcast_mask = port_mask;
+        } else {
+                port_mask = ALE_ALL_PORTS;
-        ret = cpsw_ale_add_vlan(priv->ale, vid,
+                if (priv->ndev->flags & IFF_ALLMULTI)
-                                ALE_ALL_PORTS << priv->host_port,
+                        unreg_mcast_mask = ALE_ALL_PORTS;
-                                0, ALE_ALL_PORTS << priv->host_port,
+                else
+                        unreg_mcast_mask = ALE_PORT_1 | ALE_PORT_2;
+        }
+        ret = cpsw_ale_add_vlan(priv->ale, vid, port_mask, 0, port_mask,
                                unreg_mcast_mask << priv->host_port);
        if (ret != 0)
                return ret;
@@ -1650,8 +1662,7 @@ static inline int cpsw_add_vlan_ale_entry(struct cpsw_priv *priv,
                goto clean_vid;
        ret = cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast,
-                                 ALE_ALL_PORTS << priv->host_port,
+                                 port_mask, ALE_VLAN, vid, 0);
-                                 ALE_VLAN, vid, 0);
        if (ret != 0)
                goto clean_vlan_ucast;
        return 0;
@@ -1672,6 +1683,19 @@ static int cpsw_ndo_vlan_rx_add_vid(struct net_device *ndev,
        if (vid == priv->data.default_vlan)
                return 0;
+        if (priv->data.dual_emac) {
+                /* In dual EMAC, reserved VLAN id should not be used for
+                 * creating VLAN interfaces as this can break the dual
+                 * EMAC port separation
+                 */
+                int i;
+                for (i = 0; i < priv->data.slaves; i++) {
+                        if (vid == priv->slaves[i].port_vlan)
+                                return -EINVAL;
+                }
+        }
        dev_info(priv->dev, "Adding vlanid %d to vlan filter\n", vid);
        return cpsw_add_vlan_ale_entry(priv, vid);
 }
@@ -1685,6 +1709,15 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev,
        if (vid == priv->data.default_vlan)
                return 0;
+        if (priv->data.dual_emac) {
+                int i;
+                for (i = 0; i < priv->data.slaves; i++) {
+                        if (vid == priv->slaves[i].port_vlan)
+                                return -EINVAL;
+                }
+        }
        dev_info(priv->dev, "removing vlanid %d from vlan filter\n", vid);
        ret = cpsw_ale_del_vlan(priv->ale, vid, 0);
        if (ret != 0)
diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
index 097ebe7077ac..5246b3a18ff8 100644
--- a/drivers/net/ethernet/ti/cpsw_ale.c
+++ b/drivers/net/ethernet/ti/cpsw_ale.c
@@ -234,7 +234,7 @@ static void cpsw_ale_flush_mcast(struct cpsw_ale *ale, u32 *ale_entry,
                cpsw_ale_set_entry_type(ale_entry, ALE_TYPE_FREE);
 }
-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask)
+int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid)
 {
        u32 ale_entry[ALE_ENTRY_WORDS];
        int ret, idx;
@@ -245,6 +245,14 @@ int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask)
                if (ret != ALE_TYPE_ADDR && ret != ALE_TYPE_VLAN_ADDR)
                        continue;
+                /* if vid passed is -1 then remove all multicast entry from
+                 * the table irrespective of vlan id, if a valid vlan id is
+                 * passed then remove only multicast added to that vlan id.
+                 * if vlan id doesn't match then move on to next entry.
+                 */
+                if (vid != -1 && cpsw_ale_get_vlan_id(ale_entry) != vid)
+                        continue;
                if (cpsw_ale_get_mcast(ale_entry)) {
                        u8 addr[6];
diff --git a/drivers/net/ethernet/ti/cpsw_ale.h b/drivers/net/ethernet/ti/cpsw_ale.h
index c0d4127aa549..af1e7ecd87c6 100644
--- a/drivers/net/ethernet/ti/cpsw_ale.h
+++ b/drivers/net/ethernet/ti/cpsw_ale.h
@@ -92,7 +92,7 @@ void cpsw_ale_stop(struct cpsw_ale *ale);
 int cpsw_ale_set_ageout(struct cpsw_ale *ale, int ageout);
 int cpsw_ale_flush(struct cpsw_ale *ale, int port_mask);
-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask);
+int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid);
 int cpsw_ale_add_ucast(struct cpsw_ale *ale, u8 *addr, int port,
                       int flags, u16 vid);
 int cpsw_ale_del_ucast(struct cpsw_ale *ale, u8 *addr, int port,
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index ea712512c7d1..5fae4354722c 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -62,6 +62,7 @@
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_device.h>
+#include <linux/of_mdio.h>
 #include <linux/of_irq.h>
 #include <linux/of_net.h>
@@ -343,9 +344,7 @@ struct emac_priv {
        u32 multicast_hash_cnt[EMAC_NUM_MULTICAST_BITS];
        u32 rx_addr_type;
        const char *phy_id;
-#ifdef CONFIG_OF
        struct device_node *phy_node;
-#endif
        struct phy_device *phydev;
        spinlock_t lock;
        /*platform specific members*/
@@ -922,6 +921,16 @@ static void emac_int_disable(struct emac_priv *priv)
                if (priv->int_disable)
                        priv->int_disable();
+                /* NOTE: Rx Threshold and Misc interrupts are not enabled */
+                /* ack rxen only then a new pulse will be generated */
+                emac_write(EMAC_DM646X_MACEOIVECTOR,
+                        EMAC_DM646X_MAC_EOI_C0_RXEN);
+                /* ack txen- only then a new pulse will be generated */
+                emac_write(EMAC_DM646X_MACEOIVECTOR,
+                        EMAC_DM646X_MAC_EOI_C0_TXEN);
                local_irq_restore(flags);
        } else {
@@ -951,15 +960,6 @@ static void emac_int_enable(struct emac_priv *priv)
                 * register */
                /* NOTE: Rx Threshold and Misc interrupts are not enabled */
-                /* ack rxen only then a new pulse will be generated */
-                emac_write(EMAC_DM646X_MACEOIVECTOR,
-                        EMAC_DM646X_MAC_EOI_C0_RXEN);
-                /* ack txen- only then a new pulse will be generated */
-                emac_write(EMAC_DM646X_MACEOIVECTOR,
-                        EMAC_DM646X_MAC_EOI_C0_TXEN);
        } else {
                /* Set DM644x control registers for interrupt control */
                emac_ctrl_write(EMAC_CTRL_EWCTL, 0x1);
@@ -1537,7 +1537,13 @@ static int emac_dev_open(struct net_device *ndev)
        int i = 0;
        struct emac_priv *priv = netdev_priv(ndev);
-        pm_runtime_get(&priv->pdev->dev);
+        ret = pm_runtime_get_sync(&priv->pdev->dev);
+        if (ret < 0) {
+                pm_runtime_put_noidle(&priv->pdev->dev);
+                dev_err(&priv->pdev->dev, "%s: failed to get_sync(%d)\n",
+                        __func__, ret);
+                return ret;
+        }
        netif_carrier_off(ndev);
        for (cnt = 0; cnt < ETH_ALEN; cnt++)
@@ -1596,8 +1602,20 @@ static int emac_dev_open(struct net_device *ndev)
        cpdma_ctlr_start(priv->dma);
        priv->phydev = NULL;
+        if (priv->phy_node) {
+                priv->phydev = of_phy_connect(ndev, priv->phy_node,
+                                              &emac_adjust_link, 0, 0);
+                if (!priv->phydev) {
+                        dev_err(emac_dev, "could not connect to phy %s\n",
+                                priv->phy_node->full_name);
+                        ret = -ENODEV;
+                        goto err;
+                }
+        }
        /* use the first phy on the bus if pdata did not give us a phy id */
-        if (!priv->phy_id) {
+        if (!priv->phydev && !priv->phy_id) {
                struct device *phy;
                phy = bus_find_device(&mdio_bus_type, NULL, NULL,
@@ -1606,7 +1624,7 @@ static int emac_dev_open(struct net_device *ndev)
                        priv->phy_id = dev_name(phy);
        }
-        if (priv->phy_id && *priv->phy_id) {
+        if (!priv->phydev && priv->phy_id && *priv->phy_id) {
                priv->phydev = phy_connect(ndev, priv->phy_id,
                                           &emac_adjust_link,
                                           PHY_INTERFACE_MODE_MII);
@@ -1627,7 +1645,9 @@ static int emac_dev_open(struct net_device *ndev)
                        "(mii_bus:phy_addr=%s, id=%x)\n",
                        priv->phydev->drv->name, dev_name(&priv->phydev->dev),
                        priv->phydev->phy_id);
-        } else {
+        }
+        if (!priv->phydev) {
                /* No PHY , fix the link, speed and duplex settings */
                dev_notice(emac_dev, "no phy, defaulting to 100/full\n");
                priv->link = 1;
@@ -1724,6 +1744,15 @@ static struct net_device_stats *emac_dev_getnetstats(struct net_device *ndev)
        struct emac_priv *priv = netdev_priv(ndev);
        u32 mac_control;
        u32 stats_clear_mask;
+        int err;
+        err = pm_runtime_get_sync(&priv->pdev->dev);
+        if (err < 0) {
+                pm_runtime_put_noidle(&priv->pdev->dev);
+                dev_err(&priv->pdev->dev, "%s: failed to get_sync(%d)\n",
+                        __func__, err);
+                return &ndev->stats;
+        }
        /* update emac hardware stats and reset the registers*/
@@ -1766,6 +1795,8 @@ static struct net_device_stats *emac_dev_getnetstats(struct net_device *ndev)
        ndev->stats.tx_fifo_errors += emac_read(EMAC_TXUNDERRUN);
        emac_write(EMAC_TXUNDERRUN, stats_clear_mask);
+        pm_runtime_put(&priv->pdev->dev);
        return &ndev->stats;
 }
@@ -1859,7 +1890,7 @@ davinci_emac_of_get_pdata(struct platform_device *pdev, struct emac_priv *priv)
 static int davinci_emac_probe(struct platform_device *pdev)
 {
        int rc = 0;
-        struct resource *res;
+        struct resource *res, *res_ctrl;
        struct net_device *ndev;
        struct emac_priv *priv;
        unsigned long hw_ram_addr;
@@ -1876,6 +1907,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
                return -EBUSY;
        }
        emac_bus_frequency = clk_get_rate(emac_clk);
+        devm_clk_put(&pdev->dev, emac_clk);
        /* TODO: Probe PHY here if possible */
@@ -1917,11 +1949,20 @@ static int davinci_emac_probe(struct platform_device *pdev)
                rc = PTR_ERR(priv->remap_addr);
                goto no_pdata;
        }
+        res_ctrl = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        if (res_ctrl) {
+                priv->ctrl_base =
+                        devm_ioremap_resource(&pdev->dev, res_ctrl);
+                if (IS_ERR(priv->ctrl_base))
+                        goto no_pdata;
+        } else {
+                priv->ctrl_base = priv->remap_addr + pdata->ctrl_mod_reg_offset;
+        }
        priv->emac_base = priv->remap_addr + pdata->ctrl_reg_offset;
        ndev->base_addr = (unsigned long)priv->remap_addr;
-        priv->ctrl_base = priv->remap_addr + pdata->ctrl_mod_reg_offset;
        hw_ram_addr = pdata->hw_ram_addr;
        if (!hw_ram_addr)
                hw_ram_addr = (u32 __force)res->start + pdata->ctrl_ram_offset;
@@ -1980,12 +2021,22 @@ static int davinci_emac_probe(struct platform_device *pdev)
        ndev->ethtool_ops = &ethtool_ops;
        netif_napi_add(ndev, &priv->napi, emac_poll, EMAC_POLL_WEIGHT);
+        pm_runtime_enable(&pdev->dev);
+        rc = pm_runtime_get_sync(&pdev->dev);
+        if (rc < 0) {
+                pm_runtime_put_noidle(&pdev->dev);
+                dev_err(&pdev->dev, "%s: failed to get_sync(%d)\n",
+                        __func__, rc);
+                goto no_cpdma_chan;
+        }
        /* register the network device */
        SET_NETDEV_DEV(ndev, &pdev->dev);
        rc = register_netdev(ndev);
        if (rc) {
                dev_err(&pdev->dev, "error in register_netdev\n");
                rc = -ENODEV;
+                pm_runtime_put(&pdev->dev);
                goto no_cpdma_chan;
        }
@@ -1995,9 +2046,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
                           "(regs: %p, irq: %d)\n",
                           (void *)priv->emac_base_phys, ndev->irq);
        }
+        pm_runtime_put(&pdev->dev);
-        pm_runtime_enable(&pdev->dev);
-        pm_runtime_resume(&pdev->dev);
        return 0;
@@ -2071,9 +2120,14 @@ static const struct emac_platform_data am3517_emac_data = {
        .hw_ram_addr            = 0x01e20000,
 };
+static const struct emac_platform_data dm816_emac_data = {
+        .version                = EMAC_VERSION_2,
+};
 static const struct of_device_id davinci_emac_of_match[] = {
        {.compatible = "ti,davinci-dm6467-emac", },
        {.compatible = "ti,am3517-emac", .data = &am3517_emac_data, },
+        {.compatible = "ti,dm816-emac", .data = &dm816_emac_data, },
        {},
 };
 MODULE_DEVICE_TABLE(of, davinci_emac_of_match);
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 9c2d91ea0af4..dbcbf0c5bcfa 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -1043,6 +1043,7 @@ static int temac_of_probe(struct platform_device *op)
        lp->regs = of_iomap(op->dev.of_node, 0);
        if (!lp->regs) {
                dev_err(&op->dev, "could not map temac regs.\n");
+                rc = -ENOMEM;
                goto nodev;
        }
@@ -1062,6 +1063,7 @@ static int temac_of_probe(struct platform_device *op)
        np = of_parse_phandle(op->dev.of_node, "llink-connected", 0);
        if (!np) {
                dev_err(&op->dev, "could not find DMA node\n");
+                rc = -ENODEV;
                goto err_iounmap;
        }
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet.h b/drivers/net/ethernet/xilinx/xilinx_axienet.h
index 44b8d2bad8c3..4c9b4fa1d3c1 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet.h
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet.h
@@ -388,7 +388,6 @@ struct axidma_bd {
 * @dma_err_tasklet: Tasklet structure to process Axi DMA errors
 * @tx_irq:     Axidma TX IRQ number
 * @rx_irq:     Axidma RX IRQ number
- * @temac_type: axienet type to identify between soft and hard temac
 * @phy_type:   Phy type to identify between MII/GMII/RGMII/SGMII/1000 Base-X
 * @options:    AxiEthernet option word
 * @last_link:  Phy link state in which the PHY was negotiated earlier
@@ -431,7 +430,6 @@ struct axienet_local {
        int tx_irq;
        int rx_irq;
-        u32 temac_type;
        u32 phy_type;
        u32 options;                    /* Current options word */
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 4ea2d4e6f1d1..a6d2860b712c 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1501,6 +1501,7 @@ static int axienet_of_probe(struct platform_device *op)
        lp->regs = of_iomap(op->dev.of_node, 0);
        if (!lp->regs) {
                dev_err(&op->dev, "could not map Axi Ethernet regs.\n");
+                ret = -ENOMEM;
                goto nodev;
        }
        /* Setup checksum offload, but default to off if not specified */
@@ -1555,10 +1556,6 @@ static int axienet_of_probe(struct platform_device *op)
                if ((be32_to_cpup(p)) >= 0x4000)
                        lp->jumbo_support = 1;
        }
-        p = (__be32 *) of_get_property(op->dev.of_node, "xlnx,temac-type",
-                                       NULL);
-        if (p)
-                lp->temac_type = be32_to_cpup(p);
        p = (__be32 *) of_get_property(op->dev.of_node, "xlnx,phy-type", NULL);
        if (p)
                lp->phy_type = be32_to_cpup(p);
@@ -1567,6 +1564,7 @@ static int axienet_of_probe(struct platform_device *op)
        np = of_parse_phandle(op->dev.of_node, "axistream-connected", 0);
        if (!np) {
                dev_err(&op->dev, "could not find DMA node\n");
+                ret = -ENODEV;
                goto err_iounmap;
        }
        lp->dma_regs = of_iomap(np, 0);
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 24858799c204..9d4ce388510a 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -1109,6 +1109,7 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
        res = platform_get_resource(ofdev, IORESOURCE_IRQ, 0);
        if (!res) {
                dev_err(dev, "no IRQ found\n");
+                rc = -ENXIO;
                goto error;
        }
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 2f48f790c9b4..384ca4f4de4a 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -590,6 +590,7 @@ struct nvsp_message {
 #define NETVSC_RECEIVE_BUFFER_ID                0xcafe
+#define NETVSC_SEND_BUFFER_ID                   0
 #define NETVSC_PACKET_SIZE                      4096
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index dd867e6cabd6..7cd4eb38abfa 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -161,8 +161,8 @@ static int netvsc_destroy_buf(struct netvsc_device *net_device)
        /* Deal with the send buffer we may have setup.
         * If we got a  send section size, it means we received a
-         * SendsendBufferComplete msg (ie sent
+         * NVSP_MSG1_TYPE_SEND_SEND_BUF_COMPLETE msg (ie sent
-         * NvspMessage1TypeSendReceiveBuffer msg) therefore, we need
+         * NVSP_MSG1_TYPE_SEND_SEND_BUF msg) therefore, we need
         * to send a revoke msg here
         */
        if (net_device->send_section_size) {
@@ -172,7 +172,8 @@ static int netvsc_destroy_buf(struct netvsc_device *net_device)
                revoke_packet->hdr.msg_type =
                        NVSP_MSG1_TYPE_REVOKE_SEND_BUF;
-                revoke_packet->msg.v1_msg.revoke_recv_buf.id = 0;
+                revoke_packet->msg.v1_msg.revoke_send_buf.id =
+                        NETVSC_SEND_BUFFER_ID;
                ret = vmbus_sendpacket(net_device->dev->channel,
                                       revoke_packet,
@@ -204,7 +205,7 @@ static int netvsc_destroy_buf(struct netvsc_device *net_device)
                net_device->send_buf_gpadl_handle = 0;
        }
        if (net_device->send_buf) {
-                /* Free up the receive buffer */
+                /* Free up the send buffer */
                vfree(net_device->send_buf);
                net_device->send_buf = NULL;
        }
@@ -339,9 +340,9 @@ static int netvsc_init_buf(struct hv_device *device)
        init_packet = &net_device->channel_init_pkt;
        memset(init_packet, 0, sizeof(struct nvsp_message));
        init_packet->hdr.msg_type = NVSP_MSG1_TYPE_SEND_SEND_BUF;
-        init_packet->msg.v1_msg.send_recv_buf.gpadl_handle =
+        init_packet->msg.v1_msg.send_send_buf.gpadl_handle =
                net_device->send_buf_gpadl_handle;
-        init_packet->msg.v1_msg.send_recv_buf.id = 0;
+        init_packet->msg.v1_msg.send_send_buf.id = NETVSC_SEND_BUFFER_ID;
        /* Send the gpadl notification request */
        ret = vmbus_sendpacket(device->channel, init_packet,
@@ -364,7 +365,7 @@ static int netvsc_init_buf(struct hv_device *device)
                netdev_err(ndev, "Unable to complete send buffer "
                           "initialization with NetVsp - status %d\n",
                           init_packet->msg.v1_msg.
-                           send_recv_buf_complete.status);
+                           send_send_buf_complete.status);
                ret = -EINVAL;
                goto cleanup;
        }
@@ -715,7 +716,7 @@ int netvsc_send(struct hv_device *device,
        u64 req_id;
        unsigned int section_index = NETVSC_INVALID_INDEX;
        u32 msg_size = 0;
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
        u16 q_idx = packet->q_idx;
@@ -742,8 +743,6 @@ int netvsc_send(struct hv_device *device,
                                                           packet);
                        skb = (struct sk_buff *)
                              (unsigned long)packet->send_completion_tid;
-                        if (skb)
-                                dev_kfree_skb_any(skb);
                        packet->page_buf_cnt = 0;
                }
        }
@@ -809,6 +808,13 @@ int netvsc_send(struct hv_device *device,
                           packet, ret);
        }
+        if (ret != 0) {
+                if (section_index != NETVSC_INVALID_INDEX)
+                        netvsc_free_send_slot(net_device, section_index);
+        } else if (skb) {
+                dev_kfree_skb_any(skb);
+        }
        return ret;
 }
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index a14d87783245..2e195289ddf4 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -377,9 +377,11 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
        };
        dst = ip6_route_output(dev_net(dev), NULL, &fl6);
-        if (IS_ERR(dst))
+        if (dst->error) {
+                ret = dst->error;
+                dst_release(dst);
                goto err;
+        }
        skb_dst_drop(skb);
        skb_dst_set(skb, dst);
        err = ip6_local_out(skb);
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 7df221788cd4..919f4fccc322 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -17,7 +17,6 @@
 #include <linux/fs.h>
 #include <linux/uio.h>
-#include <net/ipv6.h>
 #include <net/net_namespace.h>
 #include <net/rtnetlink.h>
 #include <net/sock.h>
@@ -81,7 +80,7 @@ static struct cdev macvtap_cdev;
 static const struct proto_ops macvtap_socket_ops;
 #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
-                      NETIF_F_TSO6)
+                      NETIF_F_TSO6 | NETIF_F_UFO)
 #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO)
 #define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG)
@@ -586,11 +585,7 @@ static int macvtap_skb_from_vnet_hdr(struct macvtap_queue *q,
                        gso_type = SKB_GSO_TCPV6;
                        break;
                case VIRTIO_NET_HDR_GSO_UDP:
-                        pr_warn_once("macvtap: %s: using disabled UFO feature; please fix this program\n",
-                                     current->comm);
                        gso_type = SKB_GSO_UDP;
-                        if (skb->protocol == htons(ETH_P_IPV6))
-                                ipv6_proxy_select_ident(skb);
                        break;
                default:
                        return -EINVAL;
@@ -636,6 +631,8 @@ static void macvtap_skb_to_vnet_hdr(struct macvtap_queue *q,
                        vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                else if (sinfo->gso_type & SKB_GSO_TCPV6)
                        vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
+                else if (sinfo->gso_type & SKB_GSO_UDP)
+                        vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP;
                else
                        BUG();
                if (sinfo->gso_type & SKB_GSO_TCP_ECN)
@@ -965,6 +962,9 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg)
                        if (arg & TUN_F_TSO6)
                                feature_mask |= NETIF_F_TSO6;
                }
+                if (arg & TUN_F_UFO)
+                        feature_mask |= NETIF_F_UFO;
        }
        /* tun/tap driver inverts the usage for TSO offloads, where
@@ -975,7 +975,7 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg)
         * When user space turns off TSO, we turn off GSO/LRO so that
         * user-space will not receive TSO frames.
         */
-        if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6))
+        if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_UFO))
                features |= RX_OFFLOADS;
        else
                features &= ~RX_OFFLOADS;
@@ -1090,7 +1090,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
        case TUNSETOFFLOAD:
                /* let the user check for future flags */
                if (arg & ~(TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 |
-                            TUN_F_TSO_ECN))
+                            TUN_F_TSO_ECN | TUN_F_UFO))
                        return -EINVAL;
                rtnl_lock();
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index c530de1e63f5..3ad8ca76196d 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -88,6 +88,7 @@ struct kszphy_priv {
 static const struct kszphy_type ksz8021_type = {
        .led_mode_reg           = MII_KSZPHY_CTRL_2,
+        .has_broadcast_disable  = true,
        .has_rmii_ref_clk_sel   = true,
 };
@@ -258,19 +259,6 @@ static int kszphy_config_init(struct phy_device *phydev)
        return 0;
 }
-static int ksz8021_config_init(struct phy_device *phydev)
-{
-        int rc;
-        rc = kszphy_config_init(phydev);
-        if (rc)
-                return rc;
-        rc = kszphy_broadcast_disable(phydev);
-        return rc < 0 ? rc : 0;
-}
 static int ksz9021_load_values_from_of(struct phy_device *phydev,
                                       struct device_node *of_node, u16 reg,
                                       char *field1, char *field2,
@@ -584,7 +572,7 @@ static struct phy_driver ksphy_driver[] = {
        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
        .driver_data    = &ksz8021_type,
        .probe          = kszphy_probe,
-        .config_init    = ksz8021_config_init,
+        .config_init    = kszphy_config_init,
        .config_aneg    = genphy_config_aneg,
        .read_status    = genphy_read_status,
        .ack_interrupt  = kszphy_ack_interrupt,
@@ -601,7 +589,7 @@ static struct phy_driver ksphy_driver[] = {
        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
        .driver_data    = &ksz8021_type,
        .probe          = kszphy_probe,
-        .config_init    = ksz8021_config_init,
+        .config_init    = kszphy_config_init,
        .config_aneg    = genphy_config_aneg,
        .read_status    = genphy_read_status,
        .ack_interrupt  = kszphy_ack_interrupt,
diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c
index 602c625d95d5..b5edc7f96a39 100644
--- a/drivers/net/ppp/ppp_deflate.c
+++ b/drivers/net/ppp/ppp_deflate.c
@@ -246,7 +246,7 @@ static int z_compress(void *arg, unsigned char *rptr, unsigned char *obuf,
        /*
         * See if we managed to reduce the size of the packet.
         */
-        if (olen < isize) {
+        if (olen < isize && olen <= osize) {
                state->stats.comp_bytes += olen;
                state->stats.comp_packets++;
        } else {
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 93e224217e24..f7ff493f1e73 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -629,6 +629,7 @@ static int team_change_mode(struct team *team, const char *kind)
 static void team_notify_peers_work(struct work_struct *work)
 {
        struct team *team;
+        int val;
        team = container_of(work, struct team, notify_peers.dw.work);
@@ -636,9 +637,14 @@ static void team_notify_peers_work(struct work_struct *work)
                schedule_delayed_work(&team->notify_peers.dw, 0);
                return;
        }
+        val = atomic_dec_if_positive(&team->notify_peers.count_pending);
+        if (val < 0) {
+                rtnl_unlock();
+                return;
+        }
        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, team->dev);
        rtnl_unlock();
-        if (!atomic_dec_and_test(&team->notify_peers.count_pending))
+        if (val)
                schedule_delayed_work(&team->notify_peers.dw,
                                      msecs_to_jiffies(team->notify_peers.interval));
 }
@@ -669,6 +675,7 @@ static void team_notify_peers_fini(struct team *team)
 static void team_mcast_rejoin_work(struct work_struct *work)
 {
        struct team *team;
+        int val;
        team = container_of(work, struct team, mcast_rejoin.dw.work);
@@ -676,9 +683,14 @@ static void team_mcast_rejoin_work(struct work_struct *work)
                schedule_delayed_work(&team->mcast_rejoin.dw, 0);
                return;
        }
+        val = atomic_dec_if_positive(&team->mcast_rejoin.count_pending);
+        if (val < 0) {
+                rtnl_unlock();
+                return;
+        }
        call_netdevice_notifiers(NETDEV_RESEND_IGMP, team->dev);
        rtnl_unlock();
-        if (!atomic_dec_and_test(&team->mcast_rejoin.count_pending))
+        if (val)
                schedule_delayed_work(&team->mcast_rejoin.dw,
                                      msecs_to_jiffies(team->mcast_rejoin.interval));
 }
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 8c8dc16839a7..10f9e4021b5a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -65,7 +65,6 @@
 #include <linux/nsproxy.h>
 #include <linux/virtio_net.h>
 #include <linux/rcupdate.h>
-#include <net/ipv6.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
@@ -187,7 +186,7 @@ struct tun_struct {
        struct net_device       *dev;
        netdev_features_t       set_features;
 #define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
-                          NETIF_F_TSO6)
+                          NETIF_F_TSO6|NETIF_F_UFO)
        int                     vnet_hdr_sz;
        int                     sndbuf;
@@ -1167,8 +1166,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                break;
        }
-        skb_reset_network_header(skb);
        if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
                pr_debug("GSO!\n");
                switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
@@ -1179,20 +1176,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
                        break;
                case VIRTIO_NET_HDR_GSO_UDP:
-                {
-                        static bool warned;
-                        if (!warned) {
-                                warned = true;
-                                netdev_warn(tun->dev,
-                                            "%s: using disabled UFO feature; please fix this program\n",
-                                            current->comm);
-                        }
                        skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
-                        if (skb->protocol == htons(ETH_P_IPV6))
-                                ipv6_proxy_select_ident(skb);
                        break;
-                }
                default:
                        tun->dev->stats.rx_frame_errors++;
                        kfree_skb(skb);
@@ -1221,6 +1206,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
        }
+        skb_reset_network_header(skb);
        skb_probe_transport_header(skb, 0);
        rxhash = skb_get_hash(skb);
@@ -1298,6 +1284,8 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                                gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                        else if (sinfo->gso_type & SKB_GSO_TCPV6)
                                gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
+                        else if (sinfo->gso_type & SKB_GSO_UDP)
+                                gso.gso_type = VIRTIO_NET_HDR_GSO_UDP;
                        else {
                                pr_err("unexpected GSO type: "
                                       "0x%x, gso_size %d, hdr_len %d\n",
@@ -1746,6 +1734,11 @@ static int set_offload(struct tun_struct *tun, unsigned long arg)
                                features |= NETIF_F_TSO6;
                        arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
                }
+                if (arg & TUN_F_UFO) {
+                        features |= NETIF_F_UFO;
+                        arg &= ~TUN_F_UFO;
+                }
        }
        /* This gives the user a way to test for new features in future by
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index dcb6d33141e0..1e9cdca37014 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -1276,7 +1276,7 @@ static int usb_start_wait_urb(struct urb *urb, int timeout, int* actual_length)
        awd.done = 0;
        urb->context = &awd;
-        status = usb_submit_urb(urb, GFP_NOIO);
+        status = usb_submit_urb(urb, GFP_ATOMIC);
        if (status) {
                // something went wrong
                usb_free_urb(urb);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index b8a82b86f909..602dc6668c3a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -56,6 +56,8 @@ struct qmi_wwan_state {
 /* default ethernet address used by the modem */
 static const u8 default_modem_addr[ETH_ALEN] = {0x02, 0x50, 0xf3};
+static const u8 buggy_fw_addr[ETH_ALEN] = {0x00, 0xa0, 0xc6, 0x00, 0x00, 0x00};
 /* Make up an ethernet header if the packet doesn't have one.
 *
 * A firmware bug common among several devices cause them to send raw
@@ -332,10 +334,12 @@ next_desc:
                usb_driver_release_interface(driver, info->data);
        }
-        /* Never use the same address on both ends of the link, even
+        /* Never use the same address on both ends of the link, even if the
-         * if the buggy firmware told us to.
+         * buggy firmware told us to. Or, if device is assigned the well-known
+         * buggy firmware MAC address, replace it with a random address,
         */
-        if (ether_addr_equal(dev->net->dev_addr, default_modem_addr))
+        if (ether_addr_equal(dev->net->dev_addr, default_modem_addr) ||
+            ether_addr_equal(dev->net->dev_addr, buggy_fw_addr))
                eth_hw_addr_random(dev->net);
        /* make MAC addr easily distinguishable from an IP header */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 2d1c77e81836..bf405f134d3a 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -833,9 +833,6 @@ static void ocp_write_word(struct r8152 *tp, u16 type, u16 index, u32 data)
                index &= ~3;
        }
-        generic_ocp_read(tp, index, sizeof(tmp), &tmp, type);
-        data |= __le32_to_cpu(tmp) & ~mask;
        tmp = __cpu_to_le32(data);
        generic_ocp_write(tp, index, byen, sizeof(tmp), &tmp, type);
@@ -874,9 +871,6 @@ static void ocp_write_byte(struct r8152 *tp, u16 type, u16 index, u32 data)
                index &= ~3;
        }
-        generic_ocp_read(tp, index, sizeof(tmp), &tmp, type);
-        data |= __le32_to_cpu(tmp) & ~mask;
        tmp = __cpu_to_le32(data);
        generic_ocp_write(tp, index, byen, sizeof(tmp), &tmp, type);
@@ -926,12 +920,6 @@ static void sram_write(struct r8152 *tp, u16 addr, u16 data)
        ocp_reg_write(tp, OCP_SRAM_DATA, data);
 }
-static u16 sram_read(struct r8152 *tp, u16 addr)
-{
-        ocp_reg_write(tp, OCP_SRAM_ADDR, addr);
-        return ocp_reg_read(tp, OCP_SRAM_DATA);
-}
 static int read_mii_word(struct net_device *netdev, int phy_id, int reg)
 {
        struct r8152 *tp = netdev_priv(netdev);
@@ -1897,6 +1885,22 @@ static void _rtl8152_set_rx_mode(struct net_device *netdev)
        netif_wake_queue(netdev);
 }
+static netdev_features_t
+rtl8152_features_check(struct sk_buff *skb, struct net_device *dev,
+                       netdev_features_t features)
+{
+        u32 mss = skb_shinfo(skb)->gso_size;
+        int max_offset = mss ? GTTCPHO_MAX : TCPHO_MAX;
+        int offset = skb_transport_offset(skb);
+        if ((mss || skb->ip_summed == CHECKSUM_PARTIAL) && offset > max_offset)
+                features &= ~(NETIF_F_ALL_CSUM | NETIF_F_GSO_MASK);
+        else if ((skb->len + sizeof(struct tx_desc)) > agg_buf_sz)
+                features &= ~NETIF_F_GSO_MASK;
+        return features;
+}
 static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb,
                                      struct net_device *netdev)
 {
@@ -2502,24 +2506,18 @@ static void r8153_hw_phy_cfg(struct r8152 *tp)
        data = ocp_reg_read(tp, OCP_POWER_CFG);
        data |= EN_10M_PLLOFF;
        ocp_reg_write(tp, OCP_POWER_CFG, data);
-        data = sram_read(tp, SRAM_IMPEDANCE);
+        sram_write(tp, SRAM_IMPEDANCE, 0x0b13);
-        data &= ~RX_DRIVING_MASK;
-        sram_write(tp, SRAM_IMPEDANCE, data);
        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_PHY_PWR);
        ocp_data |= PFM_PWM_SWITCH;
        ocp_write_word(tp, MCU_TYPE_PLA, PLA_PHY_PWR, ocp_data);
-        data = sram_read(tp, SRAM_LPF_CFG);
+        /* Enable LPF corner auto tune */
-        data |= LPF_AUTO_TUNE;
+        sram_write(tp, SRAM_LPF_CFG, 0xf70f);
-        sram_write(tp, SRAM_LPF_CFG, data);
-        data = sram_read(tp, SRAM_10M_AMP1);
+        /* Adjust 10M Amplitude */
-        data |= GDAC_IB_UPALL;
+        sram_write(tp, SRAM_10M_AMP1, 0x00af);
-        sram_write(tp, SRAM_10M_AMP1, data);
+        sram_write(tp, SRAM_10M_AMP2, 0x0208);
-        data = sram_read(tp, SRAM_10M_AMP2);
-        data |= AMP_DN;
-        sram_write(tp, SRAM_10M_AMP2, data);
        set_bit(PHY_RESET, &tp->flags);
 }
@@ -3706,6 +3704,7 @@ static const struct net_device_ops rtl8152_netdev_ops = {
        .ndo_set_mac_address    = rtl8152_set_mac_address,
        .ndo_change_mtu         = rtl8152_change_mtu,
        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_features_check     = rtl8152_features_check,
 };
 static void r8152b_get_version(struct r8152 *tp)
diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
index 99b69af14274..4a1e9c489f1f 100644
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -77,7 +77,7 @@ static int wait_phy_eeprom_ready(struct usbnet *dev, int phy)
                int ret;
                udelay(1);
-                ret = sr_read_reg(dev, EPCR, &tmp);
+                ret = sr_read_reg(dev, SR_EPCR, &tmp);
                if (ret < 0)
                        return ret;
@@ -98,15 +98,15 @@ static int sr_share_read_word(struct usbnet *dev, int phy, u8 reg,
        mutex_lock(&dev->phy_mutex);
-        sr_write_reg(dev, EPAR, phy ? (reg | EPAR_PHY_ADR) : reg);
+        sr_write_reg(dev, SR_EPAR, phy ? (reg | EPAR_PHY_ADR) : reg);
-        sr_write_reg(dev, EPCR, phy ? (EPCR_EPOS | EPCR_ERPRR) : EPCR_ERPRR);
+        sr_write_reg(dev, SR_EPCR, phy ? (EPCR_EPOS | EPCR_ERPRR) : EPCR_ERPRR);
        ret = wait_phy_eeprom_ready(dev, phy);
        if (ret < 0)
                goto out_unlock;
-        sr_write_reg(dev, EPCR, 0x0);
+        sr_write_reg(dev, SR_EPCR, 0x0);
-        ret = sr_read(dev, EPDR, 2, value);
+        ret = sr_read(dev, SR_EPDR, 2, value);
        netdev_dbg(dev->net, "read shared %d 0x%02x returned 0x%04x, %d\n",
                   phy, reg, *value, ret);
@@ -123,19 +123,19 @@ static int sr_share_write_word(struct usbnet *dev, int phy, u8 reg,
        mutex_lock(&dev->phy_mutex);
-        ret = sr_write(dev, EPDR, 2, &value);
+        ret = sr_write(dev, SR_EPDR, 2, &value);
        if (ret < 0)
                goto out_unlock;
-        sr_write_reg(dev, EPAR, phy ? (reg | EPAR_PHY_ADR) : reg);
+        sr_write_reg(dev, SR_EPAR, phy ? (reg | EPAR_PHY_ADR) : reg);
-        sr_write_reg(dev, EPCR, phy ? (EPCR_WEP | EPCR_EPOS | EPCR_ERPRW) :
+        sr_write_reg(dev, SR_EPCR, phy ? (EPCR_WEP | EPCR_EPOS | EPCR_ERPRW) :
                    (EPCR_WEP | EPCR_ERPRW));
        ret = wait_phy_eeprom_ready(dev, phy);
        if (ret < 0)
                goto out_unlock;
-        sr_write_reg(dev, EPCR, 0x0);
+        sr_write_reg(dev, SR_EPCR, 0x0);
 out_unlock:
        mutex_unlock(&dev->phy_mutex);
@@ -188,7 +188,7 @@ static int sr_mdio_read(struct net_device *netdev, int phy_id, int loc)
        if (loc == MII_BMSR) {
                u8 value;
-                sr_read_reg(dev, NSR, &value);
+                sr_read_reg(dev, SR_NSR, &value);
                if (value & NSR_LINKST)
                        rc = 1;
        }
@@ -228,7 +228,7 @@ static u32 sr9700_get_link(struct net_device *netdev)
        int rc = 0;
        /* Get the Link Status directly */
-        sr_read_reg(dev, NSR, &value);
+        sr_read_reg(dev, SR_NSR, &value);
        if (value & NSR_LINKST)
                rc = 1;
@@ -281,8 +281,8 @@ static void sr9700_set_multicast(struct net_device *netdev)
                }
        }
-        sr_write_async(dev, MAR, SR_MCAST_SIZE, hashes);
+        sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes);
-        sr_write_reg_async(dev, RCR, rx_ctl);
+        sr_write_reg_async(dev, SR_RCR, rx_ctl);
 }
 static int sr9700_set_mac_address(struct net_device *netdev, void *p)
@@ -297,7 +297,7 @@ static int sr9700_set_mac_address(struct net_device *netdev, void *p)
        }
        memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len);
-        sr_write_async(dev, PAR, 6, netdev->dev_addr);
+        sr_write_async(dev, SR_PAR, 6, netdev->dev_addr);
        return 0;
 }
@@ -340,7 +340,7 @@ static int sr9700_bind(struct usbnet *dev, struct usb_interface *intf)
        mii->phy_id_mask = 0x1f;
        mii->reg_num_mask = 0x1f;
-        sr_write_reg(dev, NCR, NCR_RST);
+        sr_write_reg(dev, SR_NCR, NCR_RST);
        udelay(20);
        /* read MAC
@@ -348,17 +348,17 @@ static int sr9700_bind(struct usbnet *dev, struct usb_interface *intf)
         * EEPROM automatically to PAR. In case there is no EEPROM externally,
         * a default MAC address is stored in PAR for making chip work properly.
         */
-        if (sr_read(dev, PAR, ETH_ALEN, netdev->dev_addr) < 0) {
+        if (sr_read(dev, SR_PAR, ETH_ALEN, netdev->dev_addr) < 0) {
                netdev_err(netdev, "Error reading MAC address\n");
                ret = -ENODEV;
                goto out;
        }
        /* power up and reset phy */
-        sr_write_reg(dev, PRR, PRR_PHY_RST);
+        sr_write_reg(dev, SR_PRR, PRR_PHY_RST);
        /* at least 10ms, here 20ms for safe */
        mdelay(20);
-        sr_write_reg(dev, PRR, 0);
+        sr_write_reg(dev, SR_PRR, 0);
        /* at least 1ms, here 2ms for reading right register */
        udelay(2 * 1000);
diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h
index fd687c575e74..258b030277e7 100644
--- a/drivers/net/usb/sr9700.h
+++ b/drivers/net/usb/sr9700.h
@@ -14,13 +14,13 @@
 /* sr9700 spec. register table on Linux platform */
 /* Network Control Reg */
-#define NCR                     0x00
+#define SR_NCR                  0x00
 #define         NCR_RST                 (1 << 0)
 #define         NCR_LBK                 (3 << 1)
 #define         NCR_FDX                 (1 << 3)
 #define         NCR_WAKEEN              (1 << 6)
 /* Network Status Reg */
-#define NSR                     0x01
+#define SR_NSR                  0x01
 #define         NSR_RXRDY               (1 << 0)
 #define         NSR_RXOV                (1 << 1)
 #define         NSR_TX1END              (1 << 2)
@@ -30,7 +30,7 @@
 #define         NSR_LINKST              (1 << 6)
 #define         NSR_SPEED               (1 << 7)
 /* Tx Control Reg */
-#define TCR                     0x02
+#define SR_TCR                  0x02
 #define         TCR_CRC_DIS             (1 << 1)
 #define         TCR_PAD_DIS             (1 << 2)
 #define         TCR_LC_CARE             (1 << 3)
@@ -38,7 +38,7 @@
 #define         TCR_EXCECM              (1 << 5)
 #define         TCR_LF_EN               (1 << 6)
 /* Tx Status Reg for Packet Index 1 */
-#define TSR1            0x03
+#define SR_TSR1         0x03
 #define         TSR1_EC                 (1 << 2)
 #define         TSR1_COL                (1 << 3)
 #define         TSR1_LC                 (1 << 4)
@@ -46,7 +46,7 @@
 #define         TSR1_LOC                (1 << 6)
 #define         TSR1_TLF                (1 << 7)
 /* Tx Status Reg for Packet Index 2 */
-#define TSR2            0x04
+#define SR_TSR2         0x04
 #define         TSR2_EC                 (1 << 2)
 #define         TSR2_COL                (1 << 3)
 #define         TSR2_LC                 (1 << 4)
@@ -54,7 +54,7 @@
 #define         TSR2_LOC                (1 << 6)
 #define         TSR2_TLF                (1 << 7)
 /* Rx Control Reg*/
-#define RCR                     0x05
+#define SR_RCR                  0x05
 #define         RCR_RXEN                (1 << 0)
 #define         RCR_PRMSC               (1 << 1)
 #define         RCR_RUNT                (1 << 2)
@@ -62,87 +62,87 @@
 #define         RCR_DIS_CRC             (1 << 4)
 #define         RCR_DIS_LONG    (1 << 5)
 /* Rx Status Reg */
-#define RSR                     0x06
+#define SR_RSR                  0x06
 #define         RSR_AE                  (1 << 2)
 #define         RSR_MF                  (1 << 6)
 #define         RSR_RF                  (1 << 7)
 /* Rx Overflow Counter Reg */
-#define ROCR            0x07
+#define SR_ROCR         0x07
 #define         ROCR_ROC                (0x7F << 0)
 #define         ROCR_RXFU               (1 << 7)
 /* Back Pressure Threshold Reg */
-#define BPTR            0x08
+#define SR_BPTR         0x08
 #define         BPTR_JPT                (0x0F << 0)
 #define         BPTR_BPHW               (0x0F << 4)
 /* Flow Control Threshold Reg */
-#define FCTR            0x09
+#define SR_FCTR         0x09
 #define         FCTR_LWOT               (0x0F << 0)
 #define         FCTR_HWOT               (0x0F << 4)
 /* rx/tx Flow Control Reg */
-#define FCR                     0x0A
+#define SR_FCR                  0x0A
 #define         FCR_FLCE                (1 << 0)
 #define         FCR_BKPA                (1 << 4)
 #define         FCR_TXPEN               (1 << 5)
 #define         FCR_TXPF                (1 << 6)
 #define         FCR_TXP0                (1 << 7)
 /* Eeprom & Phy Control Reg */
-#define EPCR            0x0B
+#define SR_EPCR         0x0B
 #define         EPCR_ERRE               (1 << 0)
 #define         EPCR_ERPRW              (1 << 1)
 #define         EPCR_ERPRR              (1 << 2)
 #define         EPCR_EPOS               (1 << 3)
 #define         EPCR_WEP                (1 << 4)
 /* Eeprom & Phy Address Reg */
-#define EPAR            0x0C
+#define SR_EPAR         0x0C
 #define         EPAR_EROA               (0x3F << 0)
 #define         EPAR_PHY_ADR_MASK       (0x03 << 6)
 #define         EPAR_PHY_ADR            (0x01 << 6)
 /* Eeprom &     Phy Data Reg */
-#define EPDR            0x0D    /* 0x0D ~ 0x0E for Data Reg Low & High */
+#define SR_EPDR         0x0D    /* 0x0D ~ 0x0E for Data Reg Low & High */
 /* Wakeup Control Reg */
-#define WCR                     0x0F
+#define SR_WCR                  0x0F
 #define         WCR_MAGICST             (1 << 0)
 #define         WCR_LINKST              (1 << 2)
 #define         WCR_MAGICEN             (1 << 3)
 #define         WCR_LINKEN              (1 << 5)
 /* Physical Address Reg */
-#define PAR                     0x10    /* 0x10 ~ 0x15 6 bytes for PAR */
+#define SR_PAR                  0x10    /* 0x10 ~ 0x15 6 bytes for PAR */
 /* Multicast Address Reg */
-#define MAR                     0x16    /* 0x16 ~ 0x1D 8 bytes for MAR */
+#define SR_MAR                  0x16    /* 0x16 ~ 0x1D 8 bytes for MAR */
 /* 0x1e unused */
 /* Phy Reset Reg */
-#define PRR                     0x1F
+#define SR_PRR                  0x1F
 #define         PRR_PHY_RST             (1 << 0)
 /* Tx sdram Write Pointer Address Low */
-#define TWPAL           0x20
+#define SR_TWPAL                0x20
 /* Tx sdram Write Pointer Address High */
-#define TWPAH           0x21
+#define SR_TWPAH                0x21
 /* Tx sdram Read Pointer Address Low */
-#define TRPAL           0x22
+#define SR_TRPAL                0x22
 /* Tx sdram Read Pointer Address High */
-#define TRPAH           0x23
+#define SR_TRPAH                0x23
 /* Rx sdram Write Pointer Address Low */
-#define RWPAL           0x24
+#define SR_RWPAL                0x24
 /* Rx sdram Write Pointer Address High */
-#define RWPAH           0x25
+#define SR_RWPAH                0x25
 /* Rx sdram Read Pointer Address Low */
-#define RRPAL           0x26
+#define SR_RRPAL                0x26
 /* Rx sdram Read Pointer Address High */
-#define RRPAH           0x27
+#define SR_RRPAH                0x27
 /* Vendor ID register */
-#define VID                     0x28    /* 0x28 ~ 0x29 2 bytes for VID */
+#define SR_VID                  0x28    /* 0x28 ~ 0x29 2 bytes for VID */
 /* Product ID register */
-#define PID                     0x2A    /* 0x2A ~ 0x2B 2 bytes for PID */
+#define SR_PID                  0x2A    /* 0x2A ~ 0x2B 2 bytes for PID */
 /* CHIP Revision register */
-#define CHIPR           0x2C
+#define SR_CHIPR                0x2C
 /* 0x2D --> 0xEF unused */
 /* USB Device Address */
-#define USBDA           0xF0
+#define SR_USBDA                0xF0
 #define         USBDA_USBFA             (0x7F << 0)
 /* RX packet Counter Reg */
-#define RXC                     0xF1
+#define SR_RXC                  0xF1
 /* Tx packet Counter & USB Status Reg */
-#define TXC_USBS        0xF2
+#define SR_TXC_USBS             0xF2
 #define         TXC_USBS_TXC0           (1 << 0)
 #define         TXC_USBS_TXC1           (1 << 1)
 #define         TXC_USBS_TXC2           (1 << 2)
@@ -150,7 +150,7 @@
 #define         TXC_USBS_SUSFLAG        (1 << 6)
 #define         TXC_USBS_RXFAULT        (1 << 7)
 /* USB Control register */
-#define USBC            0xF4
+#define SR_USBC                 0xF4
 #define         USBC_EP3NAK             (1 << 4)
 #define         USBC_EP3ACK             (1 << 5)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index b8bd7191572d..059fdf1bf5ee 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -490,17 +490,8 @@ static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
                        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
                        break;
                case VIRTIO_NET_HDR_GSO_UDP:
-                {
-                        static bool warned;
-                        if (!warned) {
-                                warned = true;
-                                netdev_warn(dev,
-                                            "host using disabled UFO feature; please fix it\n");
-                        }
                        skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
                        break;
-                }
                case VIRTIO_NET_HDR_GSO_TCPV6:
                        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
                        break;
@@ -760,7 +751,6 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
                container_of(napi, struct receive_queue, napi);
        unsigned int r, received = 0;
-again:
        received += virtnet_receive(rq, budget - received);
        /* Out of packets? */
@@ -771,7 +761,6 @@ again:
                    napi_schedule_prep(napi)) {
                        virtqueue_disable_cb(rq->vq);
                        __napi_schedule(napi);
-                        goto again;
                }
        }
@@ -890,6 +879,8 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb)
                        hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
                        hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
+                else if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
+                        hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_UDP;
                else
                        BUG();
                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCP_ECN)
@@ -1750,7 +1741,7 @@ static int virtnet_probe(struct virtio_device *vdev)
                        dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
                if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
-                        dev->hw_features |= NETIF_F_TSO
+                        dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
                                | NETIF_F_TSO_ECN | NETIF_F_TSO6;
                }
                /* Individual feature bits: what can host handle? */
@@ -1760,9 +1751,11 @@ static int virtnet_probe(struct virtio_device *vdev)
                        dev->hw_features |= NETIF_F_TSO6;
                if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_ECN))
                        dev->hw_features |= NETIF_F_TSO_ECN;
+                if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_UFO))
+                        dev->hw_features |= NETIF_F_UFO;
                if (gso)
-                        dev->features |= dev->hw_features & NETIF_F_ALL_TSO;
+                        dev->features |= dev->hw_features & (NETIF_F_ALL_TSO|NETIF_F_UFO);
                /* (!csum && gso) case will be fixed by register_netdev() */
        }
        if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_CSUM))
@@ -1800,7 +1793,8 @@ static int virtnet_probe(struct virtio_device *vdev)
        /* If we can receive ANY GSO packets, we must allocate large ones. */
        if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
-            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) ||
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO))
                vi->big_packets = true;
        if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
@@ -1996,9 +1990,9 @@ static struct virtio_device_id id_table[] = {
 static unsigned int features[] = {
        VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM,
        VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
-        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_TSO6,
+        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
        VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
-        VIRTIO_NET_F_GUEST_ECN,
+        VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO,
        VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ,
        VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN,
        VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 49d9f2291998..a8c755dcab14 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1579,8 +1579,10 @@ static int vxlan6_xmit_skb(struct vxlan_sock *vs,
        bool udp_sum = !udp_get_no_check6_tx(vs->sock->sk);
        skb = udp_tunnel_handle_offloads(skb, udp_sum);
-        if (IS_ERR(skb))
+        if (IS_ERR(skb)) {
-                return -EINVAL;
+                err = -EINVAL;
+                goto err;
+        }
        skb_scrub_packet(skb, xnet);
@@ -1590,12 +1592,16 @@ static int vxlan6_xmit_skb(struct vxlan_sock *vs,
        /* Need space for new headers (invalidates iph ptr) */
        err = skb_cow_head(skb, min_headroom);
-        if (unlikely(err))
+        if (unlikely(err)) {
-                return err;
+                kfree_skb(skb);
+                goto err;
+        }
        skb = vlan_hwaccel_push_inside(skb);
-        if (WARN_ON(!skb))
+        if (WARN_ON(!skb)) {
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto err;
+        }
        vxh = (struct vxlanhdr *) __skb_push(skb, sizeof(*vxh));
        vxh->vx_flags = htonl(VXLAN_FLAGS);
@@ -1606,6 +1612,9 @@ static int vxlan6_xmit_skb(struct vxlan_sock *vs,
        udp_tunnel6_xmit_skb(vs->sock, dst, skb, dev, saddr, daddr, prio,
                             ttl, src_port, dst_port);
        return 0;
+err:
+        dst_release(dst);
+        return err;
 }
 #endif
@@ -1621,7 +1630,7 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
        skb = udp_tunnel_handle_offloads(skb, udp_sum);
        if (IS_ERR(skb))
-                return -EINVAL;
+                return PTR_ERR(skb);
        min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
                        + VXLAN_HLEN + sizeof(struct iphdr)
@@ -1629,8 +1638,10 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
        /* Need space for new headers (invalidates iph ptr) */
        err = skb_cow_head(skb, min_headroom);
-        if (unlikely(err))
+        if (unlikely(err)) {
+                kfree_skb(skb);
                return err;
+        }
        skb = vlan_hwaccel_push_inside(skb);
        if (WARN_ON(!skb))
@@ -1776,9 +1787,12 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                                     tos, ttl, df, src_port, dst_port,
                                     htonl(vni << 8),
                                     !net_eq(vxlan->net, dev_net(vxlan->dev)));
+                if (err < 0) {
-                if (err < 0)
+                        /* skb is already freed. */
+                        skb = NULL;
                        goto rt_tx_error;
+                }
                iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
 #if IS_ENABLED(CONFIG_IPV6)
        } else {
@@ -2418,10 +2432,10 @@ static void vxlan_sock_work(struct work_struct *work)
        dev_put(vxlan->dev);
 }
-static int vxlan_newlink(struct net *net, struct net_device *dev,
+static int vxlan_newlink(struct net *src_net, struct net_device *dev,
                         struct nlattr *tb[], struct nlattr *data[])
 {
-        struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+        struct vxlan_net *vn = net_generic(src_net, vxlan_net_id);
        struct vxlan_dev *vxlan = netdev_priv(dev);
        struct vxlan_rdst *dst = &vxlan->default_dst;
        __u32 vni;
@@ -2431,7 +2445,7 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
        if (!data[IFLA_VXLAN_ID])
                return -EINVAL;
-        vxlan->net = dev_net(dev);
+        vxlan->net = src_net;
        vni = nla_get_u32(data[IFLA_VXLAN_ID]);
        dst->remote_vni = vni;
@@ -2467,7 +2481,7 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
        if (data[IFLA_VXLAN_LINK] &&
            (dst->remote_ifindex = nla_get_u32(data[IFLA_VXLAN_LINK]))) {
                struct net_device *lowerdev
-                         = __dev_get_by_index(net, dst->remote_ifindex);
+                         = __dev_get_by_index(src_net, dst->remote_ifindex);
                if (!lowerdev) {
                        pr_info("ifindex %d does not exist\n", dst->remote_ifindex);
@@ -2543,7 +2557,7 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
            nla_get_u8(data[IFLA_VXLAN_UDP_ZERO_CSUM6_RX]))
                vxlan->flags |= VXLAN_F_UDP_ZERO_CSUM6_RX;
-        if (vxlan_find_vni(net, vni, use_ipv6 ? AF_INET6 : AF_INET,
+        if (vxlan_find_vni(src_net, vni, use_ipv6 ? AF_INET6 : AF_INET,
                           vxlan->dst_port)) {
                pr_info("duplicate VNI %u\n", vni);
                return -EEXIST;
diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig
index 94e234975c61..a2fdd15f285a 100644
--- a/drivers/net/wan/Kconfig
+++ b/drivers/net/wan/Kconfig
@@ -25,7 +25,7 @@ if WAN
 # There is no way to detect a comtrol sv11 - force it modular for now.
 config HOSTESS_SV11
        tristate "Comtrol Hostess SV-11 support"
-        depends on ISA && m && ISA_DMA_API && INET && HDLC
+        depends on ISA && m && ISA_DMA_API && INET && HDLC && VIRT_TO_BUS
        help
          Driver for Comtrol Hostess SV-11 network card which
          operates on low speed synchronous serial links at up to
@@ -37,7 +37,7 @@ config HOSTESS_SV11
 # The COSA/SRP driver has not been tested as non-modular yet.
 config COSA
        tristate "COSA/SRP sync serial boards support"
-        depends on ISA && m && ISA_DMA_API && HDLC
+        depends on ISA && m && ISA_DMA_API && HDLC && VIRT_TO_BUS
        ---help---
          Driver for COSA and SRP synchronous serial boards.
@@ -87,7 +87,7 @@ config LANMEDIA
 # There is no way to detect a Sealevel board. Force it modular
 config SEALEVEL_4021
        tristate "Sealevel Systems 4021 support"
-        depends on ISA && m && ISA_DMA_API && INET && HDLC
+        depends on ISA && m && ISA_DMA_API && INET && HDLC && VIRT_TO_BUS
        help
          This is a driver for the Sealevel Systems ACB 56 serial I/O adapter.
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 9a72640237cb..62b0bf4fdf6b 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -285,6 +285,7 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
        __ath_cancel_work(sc);
+        disable_irq(sc->irq);
        tasklet_disable(&sc->intr_tq);
        tasklet_disable(&sc->bcon_tasklet);
        spin_lock_bh(&sc->sc_pcu_lock);
@@ -331,6 +332,7 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
                r = -EIO;
 out:
+        enable_irq(sc->irq);
        spin_unlock_bh(&sc->sc_pcu_lock);
        tasklet_enable(&sc->bcon_tasklet);
        tasklet_enable(&sc->intr_tq);
@@ -512,9 +514,6 @@ irqreturn_t ath_isr(int irq, void *dev)
        if (!ah || test_bit(ATH_OP_INVALID, &common->op_flags))
                return IRQ_NONE;
-        if (!AR_SREV_9100(ah) && test_bit(ATH_OP_HW_RESET, &common->op_flags))
-                return IRQ_NONE;
        /* shared irq, not for us */
        if (!ath9k_hw_intrpend(ah))
                return IRQ_NONE;
@@ -529,7 +528,7 @@ irqreturn_t ath_isr(int irq, void *dev)
        ath9k_debug_sync_cause(sc, sync_cause);
        status &= ah->imask;    /* discard unasked-for bits */
-        if (AR_SREV_9100(ah) && test_bit(ATH_OP_HW_RESET, &common->op_flags))
+        if (test_bit(ATH_OP_HW_RESET, &common->op_flags))
                return IRQ_HANDLED;
        /*
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 3c06e9365949..9880dae2a569 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -1070,7 +1070,7 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
         */
        if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
            ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
-             (sdiodev->pdata->oob_irq_supported)))
+             (sdiodev->pdata && sdiodev->pdata->oob_irq_supported)))
                bus_if->wowl_supported = true;
 #endif
@@ -1167,7 +1167,7 @@ static int brcmf_ops_sdio_resume(struct device *dev)
        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
        brcmf_dbg(SDIO, "Enter\n");
-        if (sdiodev->pdata->oob_irq_supported)
+        if (sdiodev->pdata && sdiodev->pdata->oob_irq_supported)
                disable_irq_wake(sdiodev->pdata->oob_irq_nr);
        brcmf_sdio_wd_timer(sdiodev->bus, BRCMF_WD_POLL_MS);
        atomic_set(&sdiodev->suspend, false);
diff --git a/drivers/net/wireless/ipw2x00/Kconfig b/drivers/net/wireless/ipw2x00/Kconfig
index 91c0cb3c368e..21de4fe6cf2d 100644
--- a/drivers/net/wireless/ipw2x00/Kconfig
+++ b/drivers/net/wireless/ipw2x00/Kconfig
@@ -65,7 +65,8 @@ config IPW2100_DEBUG
 config IPW2200
        tristate "Intel PRO/Wireless 2200BG and 2915ABG Network Connection"
-        depends on PCI && CFG80211 && CFG80211_WEXT
+        depends on PCI && CFG80211
+        select CFG80211_WEXT
        select WIRELESS_EXT
        select WEXT_SPY
        select WEXT_PRIV
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index e5be2d21868f..a5f9198d5747 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -69,8 +69,8 @@
 #include "iwl-agn-hw.h"
 /* Highest firmware API version supported */
-#define IWL7260_UCODE_API_MAX   10
+#define IWL7260_UCODE_API_MAX   12
-#define IWL3160_UCODE_API_MAX   10
+#define IWL3160_UCODE_API_MAX   12
 /* Oldest version we won't warn about */
 #define IWL7260_UCODE_API_OK    10
@@ -105,7 +105,7 @@
 #define IWL7265_MODULE_FIRMWARE(api) IWL7265_FW_PRE __stringify(api) ".ucode"
 #define IWL7265D_FW_PRE "iwlwifi-7265D-"
-#define IWL7265D_MODULE_FIRMWARE(api) IWL7265_FW_PRE __stringify(api) ".ucode"
+#define IWL7265D_MODULE_FIRMWARE(api) IWL7265D_FW_PRE __stringify(api) ".ucode"
 #define NVM_HW_SECTION_NUM_FAMILY_7000          0
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index bf0a95cb7153..3668fc57e770 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -69,7 +69,7 @@
 #include "iwl-agn-hw.h"
 /* Highest firmware API version supported */
-#define IWL8000_UCODE_API_MAX   10
+#define IWL8000_UCODE_API_MAX   12
 /* Oldest version we won't warn about */
 #define IWL8000_UCODE_API_OK    10
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 38de1513e4de..850b85a47806 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1323,10 +1323,10 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
 try_again:
        /* try next, if any */
-        kfree(pieces);
        release_firmware(ucode_raw);
        if (iwl_request_firmware(drv, false))
                goto out_unbind;
+        kfree(pieces);
        return;
 out_free_fw:
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index 9564ae173d06..1f7f15eb86da 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -310,6 +310,7 @@ static inline unsigned int FH_MEM_CBBC_QUEUE(unsigned int chnl)
 #define FH_RSSR_CHNL0_RX_STATUS_CHNL_IDLE       (0x01000000)
 #define FH_MEM_TFDIB_REG1_ADDR_BITSHIFT 28
+#define FH_MEM_TB_MAX_LENGTH                    (0x00020000)
 /* TFDB  Area - TFDs buffer table */
 #define FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK      (0xFFFFFFFF)
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-file.h b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
index f2a047f6bb3e..660ddb1b7d8a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-file.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
@@ -243,6 +243,10 @@ enum iwl_ucode_tlv_flag {
 * @IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF: ucode supports disabling dummy notif.
 * @IWL_UCODE_TLV_API_FRAGMENTED_SCAN: This ucode supports active dwell time
 *      longer than the passive one, which is essential for fragmented scan.
+ * @IWL_UCODE_TLV_API_BASIC_DWELL: use only basic dwell time in scan command,
+ *      regardless of the band or the number of the probes. FW will calculate
+ *      the actual dwell time.
+ * @IWL_UCODE_TLV_API_SINGLE_SCAN_EBS: EBS is supported for single scans too.
 */
 enum iwl_ucode_tlv_api {
        IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID     = BIT(0),
@@ -253,6 +257,8 @@ enum iwl_ucode_tlv_api {
        IWL_UCODE_TLV_API_LMAC_SCAN             = BIT(6),
        IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF     = BIT(7),
        IWL_UCODE_TLV_API_FRAGMENTED_SCAN       = BIT(8),
+        IWL_UCODE_TLV_API_BASIC_DWELL           = BIT(13),
+        IWL_UCODE_TLV_API_SINGLE_SCAN_EBS       = BIT(16),
 };
 /**
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 1f2acf47bfb2..cfc0e65b34a5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -653,8 +653,11 @@ enum iwl_scan_channel_flags {
 };
 /* iwl_scan_channel_opt - CHANNEL_OPTIMIZATION_API_S
- * @flags: enum iwl_scan_channel_flgs
+ * @flags: enum iwl_scan_channel_flags
- * @non_ebs_ratio: how many regular scan iteration before EBS
+ * @non_ebs_ratio: defines the ratio of number of scan iterations where EBS is
+ *      involved.
+ *      1 - EBS is disabled.
+ *      2 - every second scan will be full scan(and so on).
 */
 struct iwl_scan_channel_opt {
        __le16 flags;
@@ -672,6 +675,7 @@ struct iwl_scan_channel_opt {
 * @IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED: all passive scans will be fragmented
 * @IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED: insert WFA vendor-specific TPC report
 *      and DS parameter set IEs into probe requests.
+ * @IWL_MVM_LMAC_SCAN_FLAG_MATCH: Send match found notification on matches
 */
 enum iwl_mvm_lmac_scan_flags {
        IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL         = BIT(0),
@@ -681,6 +685,7 @@ enum iwl_mvm_lmac_scan_flags {
        IWL_MVM_LMAC_SCAN_FLAG_MULTIPLE_SSIDS   = BIT(4),
        IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED       = BIT(5),
        IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED     = BIT(6),
+        IWL_MVM_LMAC_SCAN_FLAG_MATCH            = BIT(9),
 };
 enum iwl_scan_priority {
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 31a5b3f4266c..20915587c820 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -1004,8 +1004,13 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
 {
        lockdep_assert_held(&mvm->mutex);
-        /* disallow low power states when the FW is down */
+        /*
-        iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
+         * Disallow low power states when the FW is down by taking
+         * the UCODE_DOWN ref. in case of ongoing hw restart the
+         * ref is already taken, so don't take it again.
+         */
+        if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
+                iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
        /* async_handlers_wk is now blocked */
@@ -1023,6 +1028,12 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
        /* the fw is stopped, the aux sta is dead: clean up driver state */
        iwl_mvm_del_aux_sta(mvm);
+        /*
+         * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete()
+         * won't be called in this case).
+         */
+        clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
        mvm->ucode_loaded = false;
 }
@@ -3332,18 +3343,16 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
                msk |= mvmsta->tfd_queue_msk;
        }
-        if (drop) {
+        msk &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]);
-                if (iwl_mvm_flush_tx_path(mvm, msk, true))
-                        IWL_ERR(mvm, "flush request fail\n");
-                mutex_unlock(&mvm->mutex);
-        } else {
-                mutex_unlock(&mvm->mutex);
-                /* this can take a while, and we may need/want other operations
+        if (iwl_mvm_flush_tx_path(mvm, msk, true))
-                 * to succeed while doing this, so do it without the mutex held
+                IWL_ERR(mvm, "flush request fail\n");
-                 */
+        mutex_unlock(&mvm->mutex);
-                iwl_trans_wait_tx_queue_empty(mvm->trans, msk);
-        }
+        /* this can take a while, and we may need/want other operations
+         * to succeed while doing this, so do it without the mutex held
+         */
+        iwl_trans_wait_tx_queue_empty(mvm->trans, msk);
 }
 const struct ieee80211_ops iwl_mvm_hw_ops = {
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index e5294d01181e..844bf7c4c8de 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -72,6 +72,8 @@
 #define IWL_PLCP_QUIET_THRESH 1
 #define IWL_ACTIVE_QUIET_TIME 10
+#define IWL_DENSE_EBS_SCAN_RATIO 5
+#define IWL_SPARSE_EBS_SCAN_RATIO 1
 struct iwl_mvm_scan_params {
        u32 max_out_time;
@@ -171,15 +173,21 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_ssid_ie *cmd_ssid,
 * already included in the probe template, so we need to set only
 * req->n_ssids - 1 bits in addition to the first bit.
 */
-static u16 iwl_mvm_get_active_dwell(enum ieee80211_band band, int n_ssids)
+static u16 iwl_mvm_get_active_dwell(struct iwl_mvm *mvm,
+                                    enum ieee80211_band band, int n_ssids)
 {
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_BASIC_DWELL)
+                return 10;
        if (band == IEEE80211_BAND_2GHZ)
                return 20  + 3 * (n_ssids + 1);
        return 10  + 2 * (n_ssids + 1);
 }
-static u16 iwl_mvm_get_passive_dwell(enum ieee80211_band band)
+static u16 iwl_mvm_get_passive_dwell(struct iwl_mvm *mvm,
+                                     enum ieee80211_band band)
 {
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_BASIC_DWELL)
+                        return 110;
        return band == IEEE80211_BAND_2GHZ ? 100 + 20 : 100 + 10;
 }
@@ -331,7 +339,8 @@ static void iwl_mvm_scan_calc_params(struct iwl_mvm *mvm,
                 */
                if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
                        u32 passive_dwell =
-                                iwl_mvm_get_passive_dwell(IEEE80211_BAND_2GHZ);
+                                iwl_mvm_get_passive_dwell(mvm,
+                                                          IEEE80211_BAND_2GHZ);
                        params->max_out_time = passive_dwell;
                } else {
                        params->passive_fragmented = true;
@@ -348,8 +357,8 @@ not_bound:
                        params->dwell[band].passive = frag_passive_dwell;
                else
                        params->dwell[band].passive =
-                                iwl_mvm_get_passive_dwell(band);
+                                iwl_mvm_get_passive_dwell(mvm, band);
-                params->dwell[band].active = iwl_mvm_get_active_dwell(band,
+                params->dwell[band].active = iwl_mvm_get_active_dwell(mvm, band,
                                                                      n_ssids);
        }
 }
@@ -1098,6 +1107,12 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
                return iwl_umac_scan_stop(mvm, IWL_UMAC_SCAN_UID_SCHED_SCAN,
                                          notify);
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return 0;
+        if (iwl_mvm_is_radio_killed(mvm))
+                goto out;
        if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
            (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN) ||
             mvm->scan_status != IWL_MVM_SCAN_OS)) {
@@ -1134,6 +1149,7 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
        if (mvm->scan_status == IWL_MVM_SCAN_OS)
                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
+out:
        mvm->scan_status = IWL_MVM_SCAN_NONE;
        if (notify) {
@@ -1290,18 +1306,6 @@ iwl_mvm_build_generic_unified_scan_cmd(struct iwl_mvm *mvm,
        cmd->scan_prio = cpu_to_le32(IWL_SCAN_PRIORITY_HIGH);
        cmd->iter_num = cpu_to_le32(1);
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT &&
-            mvm->last_ebs_successful) {
-                cmd->channel_opt[0].flags =
-                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
-                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
-                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
-                cmd->channel_opt[1].flags =
-                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
-                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
-                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
-        }
        if (iwl_mvm_rrm_scan_needed(mvm))
                cmd->scan_flags |=
                        cpu_to_le32(IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED);
@@ -1376,6 +1380,22 @@ int iwl_mvm_unified_scan_lmac(struct iwl_mvm *mvm,
        cmd->schedule[1].iterations = 0;
        cmd->schedule[1].full_scan_mul = 0;
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_SINGLE_SCAN_EBS &&
+            mvm->last_ebs_successful) {
+                cmd->channel_opt[0].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[0].non_ebs_ratio =
+                        cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
+                cmd->channel_opt[1].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[1].non_ebs_ratio =
+                        cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
+        }
        for (i = 1; i <= req->req.n_ssids; i++)
                ssid_bitmap |= BIT(i);
@@ -1448,6 +1468,8 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
        if (iwl_mvm_scan_pass_all(mvm, req))
                flags |= IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL;
+        else
+                flags |= IWL_MVM_LMAC_SCAN_FLAG_MATCH;
        if (req->n_ssids == 1 && req->ssids[0].ssid_len != 0)
                flags |= IWL_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION;
@@ -1474,6 +1496,22 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
        cmd->schedule[1].iterations = 0xff;
        cmd->schedule[1].full_scan_mul = IWL_FULL_SCAN_MULTIPLIER;
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT &&
+            mvm->last_ebs_successful) {
+                cmd->channel_opt[0].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[0].non_ebs_ratio =
+                        cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
+                cmd->channel_opt[1].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[1].non_ebs_ratio =
+                        cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
+        }
        iwl_mvm_lmac_scan_cfg_channels(mvm, req->channels, req->n_channels,
                                       ssid_bitmap, cmd);
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 4f15d9decc81..c59d07567d90 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -90,8 +90,6 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
        if (ieee80211_is_probe_resp(fc))
                tx_flags |= TX_CMD_FLG_TSF;
-        else if (ieee80211_is_back_req(fc))
-                tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
        if (ieee80211_has_morefrags(fc))
                tx_flags |= TX_CMD_FLG_MORE_FRAG;
@@ -100,6 +98,15 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
                u8 *qc = ieee80211_get_qos_ctl(hdr);
                tx_cmd->tid_tspec = qc[0] & 0xf;
                tx_flags &= ~TX_CMD_FLG_SEQ_CTL;
+        } else if (ieee80211_is_back_req(fc)) {
+                struct ieee80211_bar *bar = (void *)skb->data;
+                u16 control = le16_to_cpu(bar->control);
+                tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
+                tx_cmd->tid_tspec = (control &
+                                     IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
+                        IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
+                WARN_ON_ONCE(tx_cmd->tid_tspec >= IWL_MAX_TID_COUNT);
        } else {
                tx_cmd->tid_tspec = IWL_TID_NON_QOS;
                if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)
@@ -108,8 +115,12 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
                        tx_flags &= ~TX_CMD_FLG_SEQ_CTL;
        }
-        /* tid_tspec will default to 0 = BE when QOS isn't enabled */
+        /* Default to 0 (BE) when tid_spec is set to IWL_TID_NON_QOS */
-        ac = tid_to_mac80211_ac[tx_cmd->tid_tspec];
+        if (tx_cmd->tid_tspec < IWL_MAX_TID_COUNT)
+                ac = tid_to_mac80211_ac[tx_cmd->tid_tspec];
+        else
+                ac = tid_to_mac80211_ac[0];
        tx_flags |= iwl_mvm_bt_coex_tx_prio(mvm, hdr, info, ac) <<
                        TX_CMD_FLG_BT_PRIO_POS;
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index e56e77ef5d2e..917431e30f74 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -665,7 +665,7 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
        if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
                return false;
-        if (!mvm->cfg->rx_with_siso_diversity)
+        if (mvm->cfg->rx_with_siso_diversity)
                return false;
        ieee80211_iterate_active_interfaces_atomic(
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 3ee8e3848876..d5aadb00dd9e 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -367,7 +367,11 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 /* 3165 Series */
        {IWL_PCI_DEVICE(0x3165, 0x4010, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3165, 0x4012, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3165, 0x4110, iwl3165_2ac_cfg)},
        {IWL_PCI_DEVICE(0x3165, 0x4210, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3165, 0x4410, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3165, 0x4510, iwl3165_2ac_cfg)},
 /* 7265 Series */
        {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
@@ -523,8 +527,10 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        else if (cfg == &iwl7265_n_cfg)
                cfg_7265d = &iwl7265d_n_cfg;
        if (cfg_7265d &&
-            (iwl_trans->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_7265D)
+            (iwl_trans->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_7265D) {
                cfg = cfg_7265d;
+                iwl_trans->cfg = cfg_7265d;
+        }
 #endif
        pci_set_drvdata(pdev, iwl_trans);
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 5d79a1f44b8e..523fe0c88dcb 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -614,7 +614,7 @@ static int iwl_pcie_load_section(struct iwl_trans *trans, u8 section_num,
 {
        u8 *v_addr;
        dma_addr_t p_addr;
-        u32 offset, chunk_sz = section->len;
+        u32 offset, chunk_sz = min_t(u32, FH_MEM_TB_MAX_LENGTH, section->len);
        int ret = 0;
        IWL_DEBUG_FW(trans, "[%d] uCode section being loaded...\n",
@@ -1012,16 +1012,21 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
        /* Stop the device, and put it in low power state */
        iwl_pcie_apm_stop(trans);
-        /* Upon stop, the APM issues an interrupt if HW RF kill is set.
+        /* stop and reset the on-board processor */
-         * Clean again the interrupt here
+        iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
+        udelay(20);
+        /*
+         * Upon stop, the APM issues an interrupt if HW RF kill is set.
+         * This is a bug in certain verions of the hardware.
+         * Certain devices also keep sending HW RF kill interrupt all
+         * the time, unless the interrupt is ACKed even if the interrupt
+         * should be masked. Re-ACK all the interrupts here.
         */
        spin_lock(&trans_pcie->irq_lock);
        iwl_disable_interrupts(trans);
        spin_unlock(&trans_pcie->irq_lock);
-        /* stop and reset the on-board processor */
-        iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-        udelay(20);
        /* clear all status bits */
        clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 846a2e6e34d8..c70efb9a6e78 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -666,7 +666,8 @@ tx_status_ok:
 }
 static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
-                                    u8 *entry, int rxring_idx, int desc_idx)
+                                    struct sk_buff *new_skb, u8 *entry,
+                                    int rxring_idx, int desc_idx)
 {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
@@ -674,11 +675,15 @@ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
        u8 tmp_one = 1;
        struct sk_buff *skb;
+        if (likely(new_skb)) {
+                skb = new_skb;
+                goto remap;
+        }
        skb = dev_alloc_skb(rtlpci->rxbuffersize);
        if (!skb)
                return 0;
-        rtlpci->rx_ring[rxring_idx].rx_buf[desc_idx] = skb;
+remap:
        /* just set skb->cb to mapping addr for pci_unmap_single use */
        *((dma_addr_t *)skb->cb) =
                pci_map_single(rtlpci->pdev, skb_tail_pointer(skb),
@@ -686,6 +691,7 @@ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
        bufferaddress = *((dma_addr_t *)skb->cb);
        if (pci_dma_mapping_error(rtlpci->pdev, bufferaddress))
                return 0;
+        rtlpci->rx_ring[rxring_idx].rx_buf[desc_idx] = skb;
        if (rtlpriv->use_new_trx_flow) {
                rtlpriv->cfg->ops->set_desc(hw, (u8 *)entry, false,
                                            HW_DESC_RX_PREPARE,
@@ -781,6 +787,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                /*rx pkt */
                struct sk_buff *skb = rtlpci->rx_ring[rxring_idx].rx_buf[
                                      rtlpci->rx_ring[rxring_idx].idx];
+                struct sk_buff *new_skb;
                if (rtlpriv->use_new_trx_flow) {
                        rx_remained_cnt =
@@ -807,6 +814,13 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                pci_unmap_single(rtlpci->pdev, *((dma_addr_t *)skb->cb),
                                 rtlpci->rxbuffersize, PCI_DMA_FROMDEVICE);
+                /* get a new skb - if fail, old one will be reused */
+                new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
+                if (unlikely(!new_skb)) {
+                        pr_err("Allocation of new skb failed in %s\n",
+                               __func__);
+                        goto no_new;
+                }
                if (rtlpriv->use_new_trx_flow) {
                        buffer_desc =
                          &rtlpci->rx_ring[rxring_idx].buffer_desc
@@ -911,14 +925,16 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                        schedule_work(&rtlpriv->works.lps_change_work);
                }
 end:
+                skb = new_skb;
+no_new:
                if (rtlpriv->use_new_trx_flow) {
-                        _rtl_pci_init_one_rxdesc(hw, (u8 *)buffer_desc,
+                        _rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
                                                 rxring_idx,
-                                               rtlpci->rx_ring[rxring_idx].idx);
+                                                 rtlpci->rx_ring[rxring_idx].idx);
                } else {
-                        _rtl_pci_init_one_rxdesc(hw, (u8 *)pdesc, rxring_idx,
+                        _rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
+                                                 rxring_idx,
                                                 rtlpci->rx_ring[rxring_idx].idx);
                        if (rtlpci->rx_ring[rxring_idx].idx ==
                            rtlpci->rxringcount - 1)
                                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc,
@@ -1307,7 +1323,7 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw, int rxring_idx)
                rtlpci->rx_ring[rxring_idx].idx = 0;
                for (i = 0; i < rtlpci->rxringcount; i++) {
                        entry = &rtlpci->rx_ring[rxring_idx].buffer_desc[i];
-                        if (!_rtl_pci_init_one_rxdesc(hw, (u8 *)entry,
+                        if (!_rtl_pci_init_one_rxdesc(hw, NULL, (u8 *)entry,
                                                      rxring_idx, i))
                                return -ENOMEM;
                }
@@ -1332,7 +1348,7 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw, int rxring_idx)
                for (i = 0; i < rtlpci->rxringcount; i++) {
                        entry = &rtlpci->rx_ring[rxring_idx].desc[i];
-                        if (!_rtl_pci_init_one_rxdesc(hw, (u8 *)entry,
+                        if (!_rtl_pci_init_one_rxdesc(hw, NULL, (u8 *)entry,
                                                      rxring_idx, i))
                                return -ENOMEM;
                }
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 9259a732e8a4..037f74f0fcf6 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -578,6 +578,7 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
                goto err_rx_unbind;
        }
        queue->task = task;
+        get_task_struct(task);
        task = kthread_create(xenvif_dealloc_kthread,
                              (void *)queue, "%s-dealloc", queue->name);
@@ -634,6 +635,7 @@ void xenvif_disconnect(struct xenvif *vif)
                if (queue->task) {
                        kthread_stop(queue->task);
+                        put_task_struct(queue->task);
                        queue->task = NULL;
                }
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 908e65e9b821..c8ce701a7efb 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -2109,8 +2109,7 @@ int xenvif_kthread_guest_rx(void *data)
                 */
                if (unlikely(vif->disabled && queue->id == 0)) {
                        xenvif_carrier_off(vif);
-                        xenvif_rx_queue_purge(queue);
+                        break;
-                        continue;
                }
                if (!skb_queue_empty(&queue->rx_queue))
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index efbaf2ae1999..794204e34fba 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -737,6 +737,7 @@ static void connect(struct backend_info *be)
                }
                queue->remaining_credit = credit_bytes;
+                queue->credit_usec = credit_usec;
                err = connect_rings(be, queue);
                if (err) {
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 22bcb4e12e2a..d8c10764f130 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -88,10 +88,8 @@ struct netfront_cb {
 #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
 struct netfront_stats {
-        u64                     rx_packets;
+        u64                     packets;
-        u64                     tx_packets;
+        u64                     bytes;
-        u64                     rx_bytes;
-        u64                     tx_bytes;
        struct u64_stats_sync   syncp;
 };
@@ -160,7 +158,8 @@ struct netfront_info {
        struct netfront_queue *queues;
        /* Statistics */
-        struct netfront_stats __percpu *stats;
+        struct netfront_stats __percpu *rx_stats;
+        struct netfront_stats __percpu *tx_stats;
        atomic_t rx_gso_checksum_fixup;
 };
@@ -565,7 +564,7 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        unsigned short id;
        struct netfront_info *np = netdev_priv(dev);
-        struct netfront_stats *stats = this_cpu_ptr(np->stats);
+        struct netfront_stats *tx_stats = this_cpu_ptr(np->tx_stats);
        struct xen_netif_tx_request *tx;
        char *data = skb->data;
        RING_IDX i;
@@ -672,10 +671,10 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        if (notify)
                notify_remote_via_irq(queue->tx_irq);
-        u64_stats_update_begin(&stats->syncp);
+        u64_stats_update_begin(&tx_stats->syncp);
-        stats->tx_bytes += skb->len;
+        tx_stats->bytes += skb->len;
-        stats->tx_packets++;
+        tx_stats->packets++;
-        u64_stats_update_end(&stats->syncp);
+        u64_stats_update_end(&tx_stats->syncp);
        /* Note: It is not safe to access skb after xennet_tx_buf_gc()! */
        xennet_tx_buf_gc(queue);
@@ -931,7 +930,7 @@ static int checksum_setup(struct net_device *dev, struct sk_buff *skb)
 static int handle_incoming_queue(struct netfront_queue *queue,
                                 struct sk_buff_head *rxq)
 {
-        struct netfront_stats *stats = this_cpu_ptr(queue->info->stats);
+        struct netfront_stats *rx_stats = this_cpu_ptr(queue->info->rx_stats);
        int packets_dropped = 0;
        struct sk_buff *skb;
@@ -952,10 +951,10 @@ static int handle_incoming_queue(struct netfront_queue *queue,
                        continue;
                }
-                u64_stats_update_begin(&stats->syncp);
+                u64_stats_update_begin(&rx_stats->syncp);
-                stats->rx_packets++;
+                rx_stats->packets++;
-                stats->rx_bytes += skb->len;
+                rx_stats->bytes += skb->len;
-                u64_stats_update_end(&stats->syncp);
+                u64_stats_update_end(&rx_stats->syncp);
                /* Pass it up. */
                napi_gro_receive(&queue->napi, skb);
@@ -1079,18 +1078,22 @@ static struct rtnl_link_stats64 *xennet_get_stats64(struct net_device *dev,
        int cpu;
        for_each_possible_cpu(cpu) {
-                struct netfront_stats *stats = per_cpu_ptr(np->stats, cpu);
+                struct netfront_stats *rx_stats = per_cpu_ptr(np->rx_stats, cpu);
+                struct netfront_stats *tx_stats = per_cpu_ptr(np->tx_stats, cpu);
                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
                unsigned int start;
                do {
-                        start = u64_stats_fetch_begin_irq(&stats->syncp);
+                        start = u64_stats_fetch_begin_irq(&tx_stats->syncp);
+                        tx_packets = tx_stats->packets;
+                        tx_bytes = tx_stats->bytes;
+                } while (u64_stats_fetch_retry_irq(&tx_stats->syncp, start));
-                        rx_packets = stats->rx_packets;
+                do {
-                        tx_packets = stats->tx_packets;
+                        start = u64_stats_fetch_begin_irq(&rx_stats->syncp);
-                        rx_bytes = stats->rx_bytes;
+                        rx_packets = rx_stats->packets;
-                        tx_bytes = stats->tx_bytes;
+                        rx_bytes = rx_stats->bytes;
-                } while (u64_stats_fetch_retry_irq(&stats->syncp, start));
+                } while (u64_stats_fetch_retry_irq(&rx_stats->syncp, start));
                tot->rx_packets += rx_packets;
                tot->tx_packets += tx_packets;
@@ -1275,6 +1278,15 @@ static const struct net_device_ops xennet_netdev_ops = {
 #endif
 };
+static void xennet_free_netdev(struct net_device *netdev)
+{
+        struct netfront_info *np = netdev_priv(netdev);
+        free_percpu(np->rx_stats);
+        free_percpu(np->tx_stats);
+        free_netdev(netdev);
+}
 static struct net_device *xennet_create_dev(struct xenbus_device *dev)
 {
        int err;
@@ -1295,8 +1307,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
        np->queues = NULL;
        err = -ENOMEM;
-        np->stats = netdev_alloc_pcpu_stats(struct netfront_stats);
+        np->rx_stats = netdev_alloc_pcpu_stats(struct netfront_stats);
-        if (np->stats == NULL)
+        if (np->rx_stats == NULL)
+                goto exit;
+        np->tx_stats = netdev_alloc_pcpu_stats(struct netfront_stats);
+        if (np->tx_stats == NULL)
                goto exit;
        netdev->netdev_ops      = &xennet_netdev_ops;
@@ -1327,7 +1342,7 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
        return netdev;
 exit:
-        free_netdev(netdev);
+        xennet_free_netdev(netdev);
        return ERR_PTR(err);
 }
@@ -1369,7 +1384,7 @@ static int netfront_probe(struct xenbus_device *dev,
        return 0;
 fail:
-        free_netdev(netdev);
+        xennet_free_netdev(netdev);
        dev_set_drvdata(&dev->dev, NULL);
        return err;
 }
@@ -2189,9 +2204,7 @@ static int xennet_remove(struct xenbus_device *dev)
                info->queues = NULL;
        }
-        free_percpu(info->stats);
+        xennet_free_netdev(info->netdev);
-        free_netdev(info->netdev);
        return 0;
 }
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index ea63fbd228ed..352b4f28f82c 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -114,17 +114,6 @@ static int of_overlay_apply_single_device_node(struct of_overlay *ov,
                ret = of_overlay_apply_one(ov, tchild, child);
                if (ret)
                        return ret;
-                /* The properties are already copied, now do the child nodes */
-                for_each_child_of_node(child, grandchild) {
-                        ret = of_overlay_apply_single_device_node(ov, tchild, grandchild);
-                        if (ret) {
-                                pr_err("%s: Failed to apply single node @%s/%s\n",
-                                        __func__, tchild->full_name,
-                                        grandchild->name);
-                                return ret;
-                        }
-                }
        }
        return ret;
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 5b33c6a21807..b0d50d70a8a1 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -188,7 +188,7 @@ static void of_dma_configure(struct device *dev)
                size = dev->coherent_dma_mask;
        } else {
                offset = PFN_DOWN(paddr - dma_addr);
-                dev_dbg(dev, "dma_pfn_offset(%#08lx)\n", dev->dma_pfn_offset);
+                dev_dbg(dev, "dma_pfn_offset(%#08lx)\n", offset);
        }
        dev->dma_pfn_offset = offset;
@@ -566,6 +566,10 @@ static int of_platform_notify(struct notifier_block *nb,
                if (!of_node_check_flag(rd->dn->parent, OF_POPULATED_BUS))
                        return NOTIFY_OK;       /* not for us */
+                /* already populated? (driver using of_populate manually) */
+                if (of_node_check_flag(rd->dn, OF_POPULATED))
+                        return NOTIFY_OK;
                /* pdev_parent may be NULL when no bus platform device */
                pdev_parent = of_find_device_by_node(rd->dn->parent);
                pdev = of_platform_device_create(rd->dn, NULL,
@@ -581,6 +585,11 @@ static int of_platform_notify(struct notifier_block *nb,
                break;
        case OF_RECONFIG_CHANGE_REMOVE:
+                /* already depopulated? */
+                if (!of_node_check_flag(rd->dn, OF_POPULATED))
+                        return NOTIFY_OK;
                /* find our device by node */
                pdev = of_find_device_by_node(rd->dn);
                if (pdev == NULL)
diff --git a/drivers/of/unittest-data/tests-overlay.dtsi b/drivers/of/unittest-data/tests-overlay.dtsi
index 75976da22b2e..a2b687d5f324 100644
--- a/drivers/of/unittest-data/tests-overlay.dtsi
+++ b/drivers/of/unittest-data/tests-overlay.dtsi
@@ -176,5 +176,60 @@
                        };
                };
+                overlay10 {
+                        fragment@0 {
+                                target-path = "/testcase-data/overlay-node/test-bus";
+                                __overlay__ {
+                                        /* suppress DTC warning */
+                                        #address-cells = <1>;
+                                        #size-cells = <0>;
+                                        test-selftest10 {
+                                                compatible = "selftest";
+                                                status = "okay";
+                                                reg = <10>;
+                                                #address-cells = <1>;
+                                                #size-cells = <0>;
+                                                test-selftest101 {
+                                                        compatible = "selftest";
+                                                        status = "okay";
+                                                        reg = <1>;
+                                                };
+                                        };
+                                };
+                        };
+                };
+                overlay11 {
+                        fragment@0 {
+                                target-path = "/testcase-data/overlay-node/test-bus";
+                                __overlay__ {
+                                        /* suppress DTC warning */
+                                        #address-cells = <1>;
+                                        #size-cells = <0>;
+                                        test-selftest11 {
+                                                compatible = "selftest";
+                                                status = "okay";
+                                                reg = <11>;
+                                                #address-cells = <1>;
+                                                #size-cells = <0>;
+                                                test-selftest111 {
+                                                        compatible = "selftest";
+                                                        status = "okay";
+                                                        reg = <1>;
+                                                };
+                                        };
+                                };
+                        };
+                };
        };
 };
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 844838e11ef1..41a4a138f53b 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -978,6 +978,9 @@ static int selftest_probe(struct platform_device *pdev)
        }
        dev_dbg(dev, "%s for node @%s\n", __func__, np->full_name);
+        of_platform_populate(np, NULL, NULL, &pdev->dev);
        return 0;
 }
@@ -1385,6 +1388,39 @@ static void of_selftest_overlay_8(void)
        selftest(1, "overlay test %d passed\n", 8);
 }
+/* test insertion of a bus with parent devices */
+static void of_selftest_overlay_10(void)
+{
+        int ret;
+        char *child_path;
+        /* device should disable */
+        ret = of_selftest_apply_overlay_check(10, 10, 0, 1);
+        if (selftest(ret == 0, "overlay test %d failed; overlay application\n", 10))
+                return;
+        child_path = kasprintf(GFP_KERNEL, "%s/test-selftest101",
+                        selftest_path(10));
+        if (selftest(child_path, "overlay test %d failed; kasprintf\n", 10))
+                return;
+        ret = of_path_platform_device_exists(child_path);
+        kfree(child_path);
+        if (selftest(ret, "overlay test %d failed; no child device\n", 10))
+                return;
+}
+/* test insertion of a bus with parent devices (and revert) */
+static void of_selftest_overlay_11(void)
+{
+        int ret;
+        /* device should disable */
+        ret = of_selftest_apply_revert_overlay_check(11, 11, 0, 1);
+        if (selftest(ret == 0, "overlay test %d failed; overlay application\n", 11))
+                return;
+}
 static void __init of_selftest_overlay(void)
 {
        struct device_node *bus_np = NULL;
@@ -1433,6 +1469,9 @@ static void __init of_selftest_overlay(void)
        of_selftest_overlay_6();
        of_selftest_overlay_8();
+        of_selftest_overlay_10();
+        of_selftest_overlay_11();
 out:
        of_node_put(bus_np);
 }
diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
index 37e71ff6408d..dceb9ddfd99a 100644
--- a/drivers/parisc/lba_pci.c
+++ b/drivers/parisc/lba_pci.c
@@ -694,9 +694,8 @@ lba_fixup_bus(struct pci_bus *bus)
                int i;
                /* PCI-PCI Bridge */
                pci_read_bridge_bases(bus);
-                for (i = PCI_BRIDGE_RESOURCES; i < PCI_NUM_RESOURCES; i++) {
+                for (i = PCI_BRIDGE_RESOURCES; i < PCI_NUM_RESOURCES; i++)
-                        pci_claim_resource(bus->self, i);
+                        pci_claim_bridge_resource(bus->self, i);
-                }
        } else {
                /* Host-PCI Bridge */
                int err;
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 73aef51a28f0..8fb16188cd82 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -228,6 +228,49 @@ int pci_bus_alloc_resource(struct pci_bus *bus, struct resource *res,
 }
 EXPORT_SYMBOL(pci_bus_alloc_resource);
+/*
+ * The @idx resource of @dev should be a PCI-PCI bridge window.  If this
+ * resource fits inside a window of an upstream bridge, do nothing.  If it
+ * overlaps an upstream window but extends outside it, clip the resource so
+ * it fits completely inside.
+ */
+bool pci_bus_clip_resource(struct pci_dev *dev, int idx)
+{
+        struct pci_bus *bus = dev->bus;
+        struct resource *res = &dev->resource[idx];
+        struct resource orig_res = *res;
+        struct resource *r;
+        int i;
+        pci_bus_for_each_resource(bus, r, i) {
+                resource_size_t start, end;
+                if (!r)
+                        continue;
+                if (resource_type(res) != resource_type(r))
+                        continue;
+                start = max(r->start, res->start);
+                end = min(r->end, res->end);
+                if (start > end)
+                        continue;       /* no overlap */
+                if (res->start == start && res->end == end)
+                        return false;   /* no change */
+                res->start = start;
+                res->end = end;
+                dev_printk(KERN_DEBUG, &dev->dev, "%pR clipped to %pR\n",
+                                 &orig_res, res);
+                return true;
+        }
+        return false;
+}
 void __weak pcibios_resource_survey_bus(struct pci_bus *bus) { }
 /**
diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
index df781cdf13c1..17ca98657a28 100644
--- a/drivers/pci/host/pcie-designware.c
+++ b/drivers/pci/host/pcie-designware.c
@@ -283,6 +283,9 @@ static int dw_msi_setup_irq(struct msi_controller *chip, struct pci_dev *pdev,
        struct msi_msg msg;
        struct pcie_port *pp = sys_to_pcie(pdev->bus->sysdata);
+        if (desc->msi_attrib.is_msix)
+                return -EINVAL;
        irq = assign_irq(1, desc, &pos);
        if (irq < 0)
                return irq;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index cab05f31223f..e9d4fd861ba1 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3271,7 +3271,8 @@ static int pci_parent_bus_reset(struct pci_dev *dev, int probe)
 {
        struct pci_dev *pdev;
-        if (pci_is_root_bus(dev->bus) || dev->subordinate || !dev->bus->self)
+        if (pci_is_root_bus(dev->bus) || dev->subordinate ||
+            !dev->bus->self || dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)
                return -ENOTTY;
        list_for_each_entry(pdev, &dev->bus->devices, bus_list)
@@ -3305,7 +3306,8 @@ static int pci_dev_reset_slot_function(struct pci_dev *dev, int probe)
 {
        struct pci_dev *pdev;
-        if (dev->subordinate || !dev->slot)
+        if (dev->subordinate || !dev->slot ||
+            dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)
                return -ENOTTY;
        list_for_each_entry(pdev, &dev->bus->devices, bus_list)
@@ -3557,6 +3559,20 @@ int pci_try_reset_function(struct pci_dev *dev)
 }
 EXPORT_SYMBOL_GPL(pci_try_reset_function);
+/* Do any devices on or below this bus prevent a bus reset? */
+static bool pci_bus_resetable(struct pci_bus *bus)
+{
+        struct pci_dev *dev;
+        list_for_each_entry(dev, &bus->devices, bus_list) {
+                if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET ||
+                    (dev->subordinate && !pci_bus_resetable(dev->subordinate)))
+                        return false;
+        }
+        return true;
+}
 /* Lock devices from the top of the tree down */
 static void pci_bus_lock(struct pci_bus *bus)
 {
@@ -3607,6 +3623,22 @@ unlock:
        return 0;
 }
+/* Do any devices on or below this slot prevent a bus reset? */
+static bool pci_slot_resetable(struct pci_slot *slot)
+{
+        struct pci_dev *dev;
+        list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+                if (!dev->slot || dev->slot != slot)
+                        continue;
+                if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET ||
+                    (dev->subordinate && !pci_bus_resetable(dev->subordinate)))
+                        return false;
+        }
+        return true;
+}
 /* Lock devices from the top of the tree down */
 static void pci_slot_lock(struct pci_slot *slot)
 {
@@ -3728,7 +3760,7 @@ static int pci_slot_reset(struct pci_slot *slot, int probe)
 {
        int rc;
-        if (!slot)
+        if (!slot || !pci_slot_resetable(slot))
                return -ENOTTY;
        if (!probe)
@@ -3820,7 +3852,7 @@ EXPORT_SYMBOL_GPL(pci_try_reset_slot);
 static int pci_bus_reset(struct pci_bus *bus, int probe)
 {
-        if (!bus->self)
+        if (!bus->self || !pci_bus_resetable(bus))
                return -ENOTTY;
        if (probe)
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 8aff29a804ff..d54632a1db43 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -208,6 +208,7 @@ void __pci_bus_size_bridges(struct pci_bus *bus,
 void __pci_bus_assign_resources(const struct pci_bus *bus,
                                struct list_head *realloc_head,
                                struct list_head *fail_head);
+bool pci_bus_clip_resource(struct pci_dev *dev, int idx);
 /**
 * pci_ari_enabled - query ARI forwarding status
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index ed6f89b6efe5..903d5078b5ed 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -324,18 +324,52 @@ static void quirk_s3_64M(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3,      PCI_DEVICE_ID_S3_868,           quirk_s3_64M);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3,      PCI_DEVICE_ID_S3_968,           quirk_s3_64M);
+static void quirk_io(struct pci_dev *dev, int pos, unsigned size,
+                     const char *name)
+{
+        u32 region;
+        struct pci_bus_region bus_region;
+        struct resource *res = dev->resource + pos;
+        pci_read_config_dword(dev, PCI_BASE_ADDRESS_0 + (pos << 2), &region);
+        if (!region)
+                return;
+        res->name = pci_name(dev);
+        res->flags = region & ~PCI_BASE_ADDRESS_IO_MASK;
+        res->flags |=
+                (IORESOURCE_IO | IORESOURCE_PCI_FIXED | IORESOURCE_SIZEALIGN);
+        region &= ~(size - 1);
+        /* Convert from PCI bus to resource space */
+        bus_region.start = region;
+        bus_region.end = region + size - 1;
+        pcibios_bus_to_resource(dev->bus, res, &bus_region);
+        dev_info(&dev->dev, FW_BUG "%s quirk: reg 0x%x: %pR\n",
+                 name, PCI_BASE_ADDRESS_0 + (pos << 2), res);
+}
 /*
 * Some CS5536 BIOSes (for example, the Soekris NET5501 board w/ comBIOS
 * ver. 1.33  20070103) don't set the correct ISA PCI region header info.
 * BAR0 should be 8 bytes; instead, it may be set to something like 8k
 * (which conflicts w/ BAR1's memory range).
+ *
+ * CS553x's ISA PCI BARs may also be read-only (ref:
+ * https://bugzilla.kernel.org/show_bug.cgi?id=85991 - Comment #4 forward).
 */
 static void quirk_cs5536_vsa(struct pci_dev *dev)
 {
+        static char *name = "CS5536 ISA bridge";
        if (pci_resource_len(dev, 0) != 8) {
-                struct resource *res = &dev->resource[0];
+                quirk_io(dev, 0,   8, name);    /* SMB */
-                res->end = res->start + 8 - 1;
+                quirk_io(dev, 1, 256, name);    /* GPIO */
-                dev_info(&dev->dev, "CS5536 ISA bridge bug detected (incorrect header); workaround applied\n");
+                quirk_io(dev, 2,  64, name);    /* MFGPT */
+                dev_info(&dev->dev, "%s bug detected (incorrect header); workaround applied\n",
+                         name);
        }
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA, quirk_cs5536_vsa);
@@ -3028,6 +3062,20 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_REALTEK, 0x8169,
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID,
                         quirk_broken_intx_masking);
+static void quirk_no_bus_reset(struct pci_dev *dev)
+{
+        dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
+}
+/*
+ * Atheros AR93xx chips do not behave after a bus reset.  The device will
+ * throw a Link Down error on AER-capable systems and regardless of AER,
+ * config space of the device is never accessible again and typically
+ * causes the system to hang or reset when access is attempted.
+ * http://www.spinics.net/lists/linux-pci/msg34797.html
+ */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
 #ifdef CONFIG_ACPI
 /*
 * Apple: Shutdown Cactus Ridge Thunderbolt controller.
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 0482235eee92..e3e17f3c0f0f 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -530,9 +530,8 @@ EXPORT_SYMBOL(pci_setup_cardbus);
   config space writes, so it's quite possible that an I/O window of
   the bridge will have some undesirable address (e.g. 0) after the
   first write. Ditto 64-bit prefetchable MMIO.  */
-static void pci_setup_bridge_io(struct pci_bus *bus)
+static void pci_setup_bridge_io(struct pci_dev *bridge)
 {
-        struct pci_dev *bridge = bus->self;
        struct resource *res;
        struct pci_bus_region region;
        unsigned long io_mask;
@@ -545,7 +544,7 @@ static void pci_setup_bridge_io(struct pci_bus *bus)
                io_mask = PCI_IO_1K_RANGE_MASK;
        /* Set up the top and bottom of the PCI I/O segment for this bus. */
-        res = bus->resource[0];
+        res = &bridge->resource[PCI_BRIDGE_RESOURCES + 0];
        pcibios_resource_to_bus(bridge->bus, &region, res);
        if (res->flags & IORESOURCE_IO) {
                pci_read_config_word(bridge, PCI_IO_BASE, &l);
@@ -568,15 +567,14 @@ static void pci_setup_bridge_io(struct pci_bus *bus)
        pci_write_config_dword(bridge, PCI_IO_BASE_UPPER16, io_upper16);
 }
-static void pci_setup_bridge_mmio(struct pci_bus *bus)
+static void pci_setup_bridge_mmio(struct pci_dev *bridge)
 {
-        struct pci_dev *bridge = bus->self;
        struct resource *res;
        struct pci_bus_region region;
        u32 l;
        /* Set up the top and bottom of the PCI Memory segment for this bus. */
-        res = bus->resource[1];
+        res = &bridge->resource[PCI_BRIDGE_RESOURCES + 1];
        pcibios_resource_to_bus(bridge->bus, &region, res);
        if (res->flags & IORESOURCE_MEM) {
                l = (region.start >> 16) & 0xfff0;
@@ -588,9 +586,8 @@ static void pci_setup_bridge_mmio(struct pci_bus *bus)
        pci_write_config_dword(bridge, PCI_MEMORY_BASE, l);
 }
-static void pci_setup_bridge_mmio_pref(struct pci_bus *bus)
+static void pci_setup_bridge_mmio_pref(struct pci_dev *bridge)
 {
-        struct pci_dev *bridge = bus->self;
        struct resource *res;
        struct pci_bus_region region;
        u32 l, bu, lu;
@@ -602,7 +599,7 @@ static void pci_setup_bridge_mmio_pref(struct pci_bus *bus)
        /* Set up PREF base/limit. */
        bu = lu = 0;
-        res = bus->resource[2];
+        res = &bridge->resource[PCI_BRIDGE_RESOURCES + 2];
        pcibios_resource_to_bus(bridge->bus, &region, res);
        if (res->flags & IORESOURCE_PREFETCH) {
                l = (region.start >> 16) & 0xfff0;
@@ -630,13 +627,13 @@ static void __pci_setup_bridge(struct pci_bus *bus, unsigned long type)
                 &bus->busn_res);
        if (type & IORESOURCE_IO)
-                pci_setup_bridge_io(bus);
+                pci_setup_bridge_io(bridge);
        if (type & IORESOURCE_MEM)
-                pci_setup_bridge_mmio(bus);
+                pci_setup_bridge_mmio(bridge);
        if (type & IORESOURCE_PREFETCH)
-                pci_setup_bridge_mmio_pref(bus);
+                pci_setup_bridge_mmio_pref(bridge);
        pci_write_config_word(bridge, PCI_BRIDGE_CONTROL, bus->bridge_ctl);
 }
@@ -649,6 +646,41 @@ void pci_setup_bridge(struct pci_bus *bus)
        __pci_setup_bridge(bus, type);
 }
+int pci_claim_bridge_resource(struct pci_dev *bridge, int i)
+{
+        if (i < PCI_BRIDGE_RESOURCES || i > PCI_BRIDGE_RESOURCE_END)
+                return 0;
+        if (pci_claim_resource(bridge, i) == 0)
+                return 0;       /* claimed the window */
+        if ((bridge->class >> 8) != PCI_CLASS_BRIDGE_PCI)
+                return 0;
+        if (!pci_bus_clip_resource(bridge, i))
+                return -EINVAL; /* clipping didn't change anything */
+        switch (i - PCI_BRIDGE_RESOURCES) {
+        case 0:
+                pci_setup_bridge_io(bridge);
+                break;
+        case 1:
+                pci_setup_bridge_mmio(bridge);
+                break;
+        case 2:
+                pci_setup_bridge_mmio_pref(bridge);
+                break;
+        default:
+                return -EINVAL;
+        }
+        if (pci_claim_resource(bridge, i) == 0)
+                return 0;       /* claimed a smaller window */
+        return -EINVAL;
+}
 /* Check whether the bridge supports optional I/O and
   prefetchable memory ranges. If not, the respective
   base/limit registers must be read-only and read as 0. */
diff --git a/drivers/phy/phy-miphy28lp.c b/drivers/phy/phy-miphy28lp.c
index e34da13885e8..27fa62ce6136 100644
--- a/drivers/phy/phy-miphy28lp.c
+++ b/drivers/phy/phy-miphy28lp.c
@@ -1050,7 +1050,8 @@ static int miphy28lp_init(struct phy *phy)
                ret = miphy28lp_init_usb3(miphy_phy);
                break;
        default:
-                return -EINVAL;
+                ret = -EINVAL;
+                break;
        }
        mutex_unlock(&miphy_dev->miphy_mutex);
diff --git a/drivers/phy/phy-omap-control.c b/drivers/phy/phy-omap-control.c
index c96e8183a8ff..efe724f97e02 100644
--- a/drivers/phy/phy-omap-control.c
+++ b/drivers/phy/phy-omap-control.c
@@ -29,10 +29,9 @@
 /**
 * omap_control_pcie_pcs - set the PCS delay count
 * @dev: the control module device
- * @id: index of the pcie PHY (should be 1 or 2)
 * @delay: 8 bit delay value
 */
-void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay)
+void omap_control_pcie_pcs(struct device *dev, u8 delay)
 {
        u32 val;
        struct omap_control_phy *control_phy;
@@ -55,8 +54,8 @@ void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay)
        val = readl(control_phy->pcie_pcs);
        val &= ~(OMAP_CTRL_PCIE_PCS_MASK <<
-                (id * OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT));
+                OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT);
-        val |= delay << (id * OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT);
+        val |= (delay << OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT);
        writel(val, control_phy->pcie_pcs);
 }
 EXPORT_SYMBOL_GPL(omap_control_pcie_pcs);
diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
index fb02a67c9181..a2b08f3ccb03 100644
--- a/drivers/phy/phy-sun4i-usb.c
+++ b/drivers/phy/phy-sun4i-usb.c
@@ -244,7 +244,8 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
        else
                data->num_phys = 3;
-        if (of_device_is_compatible(np, "allwinner,sun4i-a10-usb-phy"))
+        if (of_device_is_compatible(np, "allwinner,sun4i-a10-usb-phy") ||
+            of_device_is_compatible(np, "allwinner,sun6i-a31-usb-phy"))
                data->disc_thresh = 3;
        else
                data->disc_thresh = 2;
diff --git a/drivers/phy/phy-ti-pipe3.c b/drivers/phy/phy-ti-pipe3.c
index 1387b4d4afe3..465de2c800f2 100644
--- a/drivers/phy/phy-ti-pipe3.c
+++ b/drivers/phy/phy-ti-pipe3.c
@@ -82,7 +82,6 @@ struct ti_pipe3 {
        struct clk              *refclk;
        struct clk              *div_clk;
        struct pipe3_dpll_map   *dpll_map;
-        u8                      id;
 };
 static struct pipe3_dpll_map dpll_map_usb[] = {
@@ -217,8 +216,13 @@ static int ti_pipe3_init(struct phy *x)
        u32 val;
        int ret = 0;
+        /*
+         * Set pcie_pcs register to 0x96 for proper functioning of phy
+         * as recommended in AM572x TRM SPRUHZ6, section 18.5.2.2, table
+         * 18-1804.
+         */
        if (of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-pcie")) {
-                omap_control_pcie_pcs(phy->control_dev, phy->id, 0xF1);
+                omap_control_pcie_pcs(phy->control_dev, 0x96);
                return 0;
        }
@@ -347,8 +351,6 @@ static int ti_pipe3_probe(struct platform_device *pdev)
        }
        if (of_device_is_compatible(node, "ti,phy-pipe3-pcie")) {
-                if (of_property_read_u8(node, "id", &phy->id) < 0)
-                        phy->id = 1;
                clk = devm_clk_get(phy->dev, "dpll_ref");
                if (IS_ERR(clk)) {
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index e4f65510c87e..89dca77ca038 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1801,14 +1801,15 @@ void pinctrl_unregister(struct pinctrl_dev *pctldev)
        if (pctldev == NULL)
                return;
-        mutex_lock(&pinctrldev_list_mutex);
        mutex_lock(&pctldev->mutex);
        pinctrl_remove_device_debugfs(pctldev);
+        mutex_unlock(&pctldev->mutex);
        if (!IS_ERR(pctldev->p))
                pinctrl_put(pctldev->p);
+        mutex_lock(&pinctrldev_list_mutex);
+        mutex_lock(&pctldev->mutex);
        /* TODO: check that no pinmuxes are still active? */
        list_del(&pctldev->node);
        /* Destroy descriptor tree */
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index dfd021e8268f..f4cd0b9b2438 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -177,7 +177,7 @@ struct at91_pinctrl {
        struct device           *dev;
        struct pinctrl_dev      *pctl;
-        int                     nbanks;
+        int                     nactive_banks;
        uint32_t                *mux_mask;
        int                     nmux;
@@ -653,12 +653,18 @@ static int pin_check_config(struct at91_pinctrl *info, const char *name,
        int mux;
        /* check if it's a valid config */
-        if (pin->bank >= info->nbanks) {
+        if (pin->bank >= gpio_banks) {
                dev_err(info->dev, "%s: pin conf %d bank_id %d >= nbanks %d\n",
-                        name, index, pin->bank, info->nbanks);
+                        name, index, pin->bank, gpio_banks);
                return -EINVAL;
        }
+        if (!gpio_chips[pin->bank]) {
+                dev_err(info->dev, "%s: pin conf %d bank_id %d not enabled\n",
+                        name, index, pin->bank);
+                return -ENXIO;
+        }
        if (pin->pin >= MAX_NB_GPIO_PER_BANK) {
                dev_err(info->dev, "%s: pin conf %d pin_bank_id %d >= %d\n",
                        name, index, pin->pin, MAX_NB_GPIO_PER_BANK);
@@ -981,7 +987,8 @@ static void at91_pinctrl_child_count(struct at91_pinctrl *info,
        for_each_child_of_node(np, child) {
                if (of_device_is_compatible(child, gpio_compat)) {
-                        info->nbanks++;
+                        if (of_device_is_available(child))
+                                info->nactive_banks++;
                } else {
                        info->nfunctions++;
                        info->ngroups += of_get_child_count(child);
@@ -1003,11 +1010,11 @@ static int at91_pinctrl_mux_mask(struct at91_pinctrl *info,
        }
        size /= sizeof(*list);
-        if (!size || size % info->nbanks) {
+        if (!size || size % gpio_banks) {
-                dev_err(info->dev, "wrong mux mask array should be by %d\n", info->nbanks);
+                dev_err(info->dev, "wrong mux mask array should be by %d\n", gpio_banks);
                return -EINVAL;
        }
-        info->nmux = size / info->nbanks;
+        info->nmux = size / gpio_banks;
        info->mux_mask = devm_kzalloc(info->dev, sizeof(u32) * size, GFP_KERNEL);
        if (!info->mux_mask) {
@@ -1131,7 +1138,7 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev,
                of_match_device(at91_pinctrl_of_match, &pdev->dev)->data;
        at91_pinctrl_child_count(info, np);
-        if (info->nbanks < 1) {
+        if (gpio_banks < 1) {
                dev_err(&pdev->dev, "you need to specify at least one gpio-controller\n");
                return -EINVAL;
        }
@@ -1144,7 +1151,7 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev,
        dev_dbg(&pdev->dev, "mux-mask\n");
        tmp = info->mux_mask;
-        for (i = 0; i < info->nbanks; i++) {
+        for (i = 0; i < gpio_banks; i++) {
                for (j = 0; j < info->nmux; j++, tmp++) {
                        dev_dbg(&pdev->dev, "%d:%d\t0x%x\n", i, j, tmp[0]);
                }
@@ -1162,7 +1169,7 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev,
        if (!info->groups)
                return -ENOMEM;
-        dev_dbg(&pdev->dev, "nbanks = %d\n", info->nbanks);
+        dev_dbg(&pdev->dev, "nbanks = %d\n", gpio_banks);
        dev_dbg(&pdev->dev, "nfunctions = %d\n", info->nfunctions);
        dev_dbg(&pdev->dev, "ngroups = %d\n", info->ngroups);
@@ -1185,7 +1192,7 @@ static int at91_pinctrl_probe(struct platform_device *pdev)
 {
        struct at91_pinctrl *info;
        struct pinctrl_pin_desc *pdesc;
-        int ret, i, j, k;
+        int ret, i, j, k, ngpio_chips_enabled = 0;
        info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
        if (!info)
@@ -1200,23 +1207,27 @@ static int at91_pinctrl_probe(struct platform_device *pdev)
         * to obtain references to the struct gpio_chip * for them, and we
         * need this to proceed.
         */
-        for (i = 0; i < info->nbanks; i++) {
+        for (i = 0; i < gpio_banks; i++)
-                if (!gpio_chips[i]) {
+                if (gpio_chips[i])
-                        dev_warn(&pdev->dev, "GPIO chip %d not registered yet\n", i);
+                        ngpio_chips_enabled++;
-                        devm_kfree(&pdev->dev, info);
-                        return -EPROBE_DEFER;
+        if (ngpio_chips_enabled < info->nactive_banks) {
-                }
+                dev_warn(&pdev->dev,
+                         "All GPIO chips are not registered yet (%d/%d)\n",
+                         ngpio_chips_enabled, info->nactive_banks);
+                devm_kfree(&pdev->dev, info);
+                return -EPROBE_DEFER;
        }
        at91_pinctrl_desc.name = dev_name(&pdev->dev);
-        at91_pinctrl_desc.npins = info->nbanks * MAX_NB_GPIO_PER_BANK;
+        at91_pinctrl_desc.npins = gpio_banks * MAX_NB_GPIO_PER_BANK;
        at91_pinctrl_desc.pins = pdesc =
                devm_kzalloc(&pdev->dev, sizeof(*pdesc) * at91_pinctrl_desc.npins, GFP_KERNEL);
        if (!at91_pinctrl_desc.pins)
                return -ENOMEM;
-        for (i = 0 , k = 0; i < info->nbanks; i++) {
+        for (i = 0, k = 0; i < gpio_banks; i++) {
                for (j = 0; j < MAX_NB_GPIO_PER_BANK; j++, k++) {
                        pdesc->number = k;
                        pdesc->name = kasprintf(GFP_KERNEL, "pio%c%d", i + 'A', j);
@@ -1234,8 +1245,9 @@ static int at91_pinctrl_probe(struct platform_device *pdev)
        }
        /* We will handle a range of GPIO pins */
-        for (i = 0; i < info->nbanks; i++)
+        for (i = 0; i < gpio_banks; i++)
-                pinctrl_add_gpio_range(info->pctl, &gpio_chips[i]->range);
+                if (gpio_chips[i])
+                        pinctrl_add_gpio_range(info->pctl, &gpio_chips[i]->range);
        dev_info(&pdev->dev, "initialized AT91 pinctrl driver\n");
@@ -1613,9 +1625,10 @@ static void gpio_irq_handler(unsigned irq, struct irq_desc *desc)
 static int at91_gpio_of_irq_setup(struct platform_device *pdev,
                                  struct at91_gpio_chip *at91_gpio)
 {
+        struct gpio_chip        *gpiochip_prev = NULL;
        struct at91_gpio_chip   *prev = NULL;
        struct irq_data         *d = irq_get_irq_data(at91_gpio->pioc_virq);
-        int ret;
+        int ret, i;
        at91_gpio->pioc_hwirq = irqd_to_hwirq(d);
@@ -1641,24 +1654,33 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
                return ret;
        }
-        /* Setup chained handler */
-        if (at91_gpio->pioc_idx)
-                prev = gpio_chips[at91_gpio->pioc_idx - 1];
        /* The top level handler handles one bank of GPIOs, except
         * on some SoC it can handle up to three...
         * We only set up the handler for the first of the list.
         */
-        if (prev && prev->next == at91_gpio)
+        gpiochip_prev = irq_get_handler_data(at91_gpio->pioc_virq);
+        if (!gpiochip_prev) {
+                /* Then register the chain on the parent IRQ */
+                gpiochip_set_chained_irqchip(&at91_gpio->chip,
+                                             &gpio_irqchip,
+                                             at91_gpio->pioc_virq,
+                                             gpio_irq_handler);
                return 0;
+        }
-        /* Then register the chain on the parent IRQ */
+        prev = container_of(gpiochip_prev, struct at91_gpio_chip, chip);
-        gpiochip_set_chained_irqchip(&at91_gpio->chip,
-                                     &gpio_irqchip,
-                                     at91_gpio->pioc_virq,
-                                     gpio_irq_handler);
-        return 0;
+        /* we can only have 2 banks before */
+        for (i = 0; i < 2; i++) {
+                if (prev->next) {
+                        prev = prev->next;
+                } else {
+                        prev->next = at91_gpio;
+                        return 0;
+                }
+        }
+        return -EINVAL;
 }
 /* This structure is replicated for each GPIO block allocated at probe time */
@@ -1675,24 +1697,6 @@ static struct gpio_chip at91_gpio_template = {
        .ngpio                  = MAX_NB_GPIO_PER_BANK,
 };
-static void at91_gpio_probe_fixup(void)
-{
-        unsigned i;
-        struct at91_gpio_chip *at91_gpio, *last = NULL;
-        for (i = 0; i < gpio_banks; i++) {
-                at91_gpio = gpio_chips[i];
-                /*
-                 * GPIO controller are grouped on some SoC:
-                 * PIOC, PIOD and PIOE can share the same IRQ line
-                 */
-                if (last && last->pioc_virq == at91_gpio->pioc_virq)
-                        last->next = at91_gpio;
-                last = at91_gpio;
-        }
-}
 static struct of_device_id at91_gpio_of_match[] = {
        { .compatible = "atmel,at91sam9x5-gpio", .data = &at91sam9x5_ops, },
        { .compatible = "atmel,at91rm9200-gpio", .data = &at91rm9200_ops },
@@ -1805,8 +1809,6 @@ static int at91_gpio_probe(struct platform_device *pdev)
        gpio_chips[alias_idx] = at91_chip;
        gpio_banks = max(gpio_banks, alias_idx + 1);
-        at91_gpio_probe_fixup();
        ret = at91_gpio_of_irq_setup(pdev, at91_chip);
        if (ret)
                goto irq_setup_err;
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index ba74f0aa60c7..43eacc924b7e 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -89,6 +89,7 @@ struct rockchip_iomux {
 * @reg_pull: optional separate register for additional pull settings
 * @clk: clock of the gpio bank
 * @irq: interrupt of the gpio bank
+ * @saved_enables: Saved content of GPIO_INTEN at suspend time.
 * @pin_base: first pin number
 * @nr_pins: number of pins in this bank
 * @name: name of the bank
@@ -107,6 +108,7 @@ struct rockchip_pin_bank {
        struct regmap                   *regmap_pull;
        struct clk                      *clk;
        int                             irq;
+        u32                             saved_enables;
        u32                             pin_base;
        u8                              nr_pins;
        char                            *name;
@@ -1396,10 +1398,7 @@ static void rockchip_irq_demux(unsigned int irq, struct irq_desc *desc)
 {
        struct irq_chip *chip = irq_get_chip(irq);
        struct rockchip_pin_bank *bank = irq_get_handler_data(irq);
-        u32 polarity = 0, data = 0;
        u32 pend;
-        bool edge_changed = false;
-        unsigned long flags;
        dev_dbg(bank->drvdata->dev, "got irq for bank %s\n", bank->name);
@@ -1407,12 +1406,6 @@ static void rockchip_irq_demux(unsigned int irq, struct irq_desc *desc)
        pend = readl_relaxed(bank->reg_base + GPIO_INT_STATUS);
-        if (bank->toggle_edge_mode) {
-                polarity = readl_relaxed(bank->reg_base +
-                                         GPIO_INT_POLARITY);
-                data = readl_relaxed(bank->reg_base + GPIO_EXT_PORT);
-        }
        while (pend) {
                unsigned int virq;
@@ -1432,27 +1425,31 @@ static void rockchip_irq_demux(unsigned int irq, struct irq_desc *desc)
                 * needs manual intervention.
                 */
                if (bank->toggle_edge_mode & BIT(irq)) {
-                        if (data & BIT(irq))
+                        u32 data, data_old, polarity;
-                                polarity &= ~BIT(irq);
+                        unsigned long flags;
-                        else
-                                polarity |= BIT(irq);
-                        edge_changed = true;
+                        data = readl_relaxed(bank->reg_base + GPIO_EXT_PORT);
-                }
+                        do {
+                                spin_lock_irqsave(&bank->slock, flags);
-                generic_handle_irq(virq);
+                                polarity = readl_relaxed(bank->reg_base +
-        }
+                                                         GPIO_INT_POLARITY);
+                                if (data & BIT(irq))
+                                        polarity &= ~BIT(irq);
+                                else
+                                        polarity |= BIT(irq);
+                                writel(polarity,
+                                       bank->reg_base + GPIO_INT_POLARITY);
-        if (bank->toggle_edge_mode && edge_changed) {
+                                spin_unlock_irqrestore(&bank->slock, flags);
-                /* Interrupt params should only be set with ints disabled */
-                spin_lock_irqsave(&bank->slock, flags);
-                data = readl_relaxed(bank->reg_base + GPIO_INTEN);
+                                data_old = data;
-                writel_relaxed(0, bank->reg_base + GPIO_INTEN);
+                                data = readl_relaxed(bank->reg_base +
-                writel(polarity, bank->reg_base + GPIO_INT_POLARITY);
+                                                     GPIO_EXT_PORT);
-                writel(data, bank->reg_base + GPIO_INTEN);
+                        } while ((data & BIT(irq)) != (data_old & BIT(irq)));
+                }
-                spin_unlock_irqrestore(&bank->slock, flags);
+                generic_handle_irq(virq);
        }
        chained_irq_exit(chip, desc);
@@ -1543,6 +1540,51 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type)
        return 0;
 }
+static void rockchip_irq_suspend(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        struct rockchip_pin_bank *bank = gc->private;
+        bank->saved_enables = irq_reg_readl(gc, GPIO_INTEN);
+        irq_reg_writel(gc, gc->wake_active, GPIO_INTEN);
+}
+static void rockchip_irq_resume(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        struct rockchip_pin_bank *bank = gc->private;
+        irq_reg_writel(gc, bank->saved_enables, GPIO_INTEN);
+}
+static void rockchip_irq_disable(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        u32 val;
+        irq_gc_lock(gc);
+        val = irq_reg_readl(gc, GPIO_INTEN);
+        val &= ~d->mask;
+        irq_reg_writel(gc, val, GPIO_INTEN);
+        irq_gc_unlock(gc);
+}
+static void rockchip_irq_enable(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        u32 val;
+        irq_gc_lock(gc);
+        val = irq_reg_readl(gc, GPIO_INTEN);
+        val |= d->mask;
+        irq_reg_writel(gc, val, GPIO_INTEN);
+        irq_gc_unlock(gc);
+}
 static int rockchip_interrupts_register(struct platform_device *pdev,
                                                struct rockchip_pinctrl *info)
 {
@@ -1581,12 +1623,16 @@ static int rockchip_interrupts_register(struct platform_device *pdev,
                gc = irq_get_domain_generic_chip(bank->domain, 0);
                gc->reg_base = bank->reg_base;
                gc->private = bank;
-                gc->chip_types[0].regs.mask = GPIO_INTEN;
+                gc->chip_types[0].regs.mask = GPIO_INTMASK;
                gc->chip_types[0].regs.ack = GPIO_PORTS_EOI;
                gc->chip_types[0].chip.irq_ack = irq_gc_ack_set_bit;
-                gc->chip_types[0].chip.irq_mask = irq_gc_mask_clr_bit;
+                gc->chip_types[0].chip.irq_mask = irq_gc_mask_set_bit;
-                gc->chip_types[0].chip.irq_unmask = irq_gc_mask_set_bit;
+                gc->chip_types[0].chip.irq_unmask = irq_gc_mask_clr_bit;
+                gc->chip_types[0].chip.irq_enable = rockchip_irq_enable;
+                gc->chip_types[0].chip.irq_disable = rockchip_irq_disable;
                gc->chip_types[0].chip.irq_set_wake = irq_gc_set_wake;
+                gc->chip_types[0].chip.irq_suspend = rockchip_irq_suspend;
+                gc->chip_types[0].chip.irq_resume = rockchip_irq_resume;
                gc->chip_types[0].chip.irq_set_type = rockchip_irq_set_type;
                gc->wake_enabled = IRQ_MSK(bank->nr_pins);
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index 7c9d51382248..9e5ec00084bb 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -1012,8 +1012,10 @@ static void st_pinconf_dbg_show(struct pinctrl_dev *pctldev,
                                   struct seq_file *s, unsigned pin_id)
 {
        unsigned long config;
-        st_pinconf_get(pctldev, pin_id, &config);
+        mutex_unlock(&pctldev->mutex);
+        st_pinconf_get(pctldev, pin_id, &config);
+        mutex_lock(&pctldev->mutex);
        seq_printf(s, "[OE:%ld,PU:%ld,OD:%ld]\n"
                "\t\t[retime:%ld,invclk:%ld,clknotdat:%ld,"
                "de:%ld,rt-clk:%ld,rt-delay:%ld]",
@@ -1443,6 +1445,7 @@ static struct gpio_chip st_gpio_template = {
 static struct irq_chip st_gpio_irqchip = {
        .name           = "GPIO",
+        .irq_disable    = st_gpio_irq_mask,
        .irq_mask       = st_gpio_irq_mask,
        .irq_unmask     = st_gpio_irq_unmask,
        .irq_set_type   = st_gpio_irq_set_type,
diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c
index c5cef59f5965..779950c62e53 100644
--- a/drivers/pinctrl/pinctrl-xway.c
+++ b/drivers/pinctrl/pinctrl-xway.c
@@ -798,10 +798,8 @@ static int pinmux_xway_probe(struct platform_device *pdev)
        /* load the gpio chip */
        xway_chip.dev = &pdev->dev;
-        of_gpiochip_add(&xway_chip);
        ret = gpiochip_add(&xway_chip);
        if (ret) {
-                of_gpiochip_remove(&xway_chip);
                dev_err(&pdev->dev, "Failed to register gpio chip\n");
                return ret;
        }
diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index e730935fa457..ed7017df065d 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -865,10 +865,10 @@ static int msm_ps_hold_restart(struct notifier_block *nb, unsigned long action,
 static void msm_pinctrl_setup_pm_reset(struct msm_pinctrl *pctrl)
 {
-        int i = 0;
+        int i;
        const struct msm_function *func = pctrl->soc->functions;
-        for (; i <= pctrl->soc->nfunctions; i++)
+        for (i = 0; i < pctrl->soc->nfunctions; i++)
                if (!strcmp(func[i].name, "ps_hold")) {
                        pctrl->restart_nb.notifier_call = msm_ps_hold_restart;
                        pctrl->restart_nb.priority = 128;
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index 9411eae39a4e..3d21efe11d7b 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -2,11 +2,9 @@
 *  Driver for Dell laptop extras
 *
 *  Copyright (c) Red Hat <mjg@redhat.com>
- *  Copyright (c) 2014 Gabriele Mazzotta <gabriele.mzt@gmail.com>
- *  Copyright (c) 2014 Pali Rohár <pali.rohar@gmail.com>
 *
- *  Based on documentation in the libsmbios package:
+ *  Based on documentation in the libsmbios package, Copyright (C) 2005 Dell
- *  Copyright (C) 2005-2014 Dell Inc.
+ *  Inc.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License version 2 as
@@ -34,13 +32,6 @@
 #include "../../firmware/dcdbas.h"
 #define BRIGHTNESS_TOKEN 0x7d
-#define KBD_LED_OFF_TOKEN 0x01E1
-#define KBD_LED_ON_TOKEN 0x01E2
-#define KBD_LED_AUTO_TOKEN 0x01E3
-#define KBD_LED_AUTO_25_TOKEN 0x02EA
-#define KBD_LED_AUTO_50_TOKEN 0x02EB
-#define KBD_LED_AUTO_75_TOKEN 0x02EC
-#define KBD_LED_AUTO_100_TOKEN 0x02F6
 /* This structure will be modified by the firmware when we enter
 * system management mode, hence the volatiles */
@@ -71,13 +62,6 @@ struct calling_interface_structure {
 struct quirk_entry {
        u8 touchpad_led;
-        int needs_kbd_timeouts;
-        /*
-         * Ordered list of timeouts expressed in seconds.
-         * The list must end with -1
-         */
-        int kbd_timeouts[];
 };
 static struct quirk_entry *quirks;
@@ -92,15 +76,6 @@ static int __init dmi_matched(const struct dmi_system_id *dmi)
        return 1;
 }
-/*
- * These values come from Windows utility provided by Dell. If any other value
- * is used then BIOS silently set timeout to 0 without any error message.
- */
-static struct quirk_entry quirk_dell_xps13_9333 = {
-        .needs_kbd_timeouts = 1,
-        .kbd_timeouts = { 0, 5, 15, 60, 5 * 60, 15 * 60, -1 },
-};
 static int da_command_address;
 static int da_command_code;
 static int da_num_tokens;
@@ -292,15 +267,6 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
                },
                .driver_data = &quirk_dell_vostro_v130,
        },
-        {
-                .callback = dmi_matched,
-                .ident = "Dell XPS13 9333",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS13 9333"),
-                },
-                .driver_data = &quirk_dell_xps13_9333,
-        },
        { }
 };
@@ -365,29 +331,17 @@ static void __init find_tokens(const struct dmi_header *dm, void *dummy)
        }
 }
-static int find_token_id(int tokenid)
+static int find_token_location(int tokenid)
 {
        int i;
        for (i = 0; i < da_num_tokens; i++) {
                if (da_tokens[i].tokenID == tokenid)
-                        return i;
+                        return da_tokens[i].location;
        }
        return -1;
 }
-static int find_token_location(int tokenid)
-{
-        int id;
-        id = find_token_id(tokenid);
-        if (id == -1)
-                return -1;
-        return da_tokens[id].location;
-}
 static struct calling_interface_buffer *
 dell_send_request(struct calling_interface_buffer *buffer, int class,
                  int select)
@@ -408,20 +362,6 @@ dell_send_request(struct calling_interface_buffer *buffer, int class,
        return buffer;
 }
-static inline int dell_smi_error(int value)
-{
-        switch (value) {
-        case 0: /* Completed successfully */
-                return 0;
-        case -1: /* Completed with error */
-                return -EIO;
-        case -2: /* Function not supported */
-                return -ENXIO;
-        default: /* Unknown error */
-                return -EINVAL;
-        }
-}
 /* Derived from information in DellWirelessCtl.cpp:
   Class 17, select 11 is radio control. It returns an array of 32-bit values.
@@ -776,7 +716,7 @@ static int dell_send_intensity(struct backlight_device *bd)
        else
                dell_send_request(buffer, 1, 1);
- out:
+out:
        release_buffer();
        return ret;
 }
@@ -800,7 +740,7 @@ static int dell_get_intensity(struct backlight_device *bd)
        ret = buffer->output[1];
- out:
+out:
        release_buffer();
        return ret;
 }
@@ -849,984 +789,6 @@ static void touchpad_led_exit(void)
        led_classdev_unregister(&touchpad_led);
 }
-/*
- * Derived from information in smbios-keyboard-ctl:
- *
- * cbClass 4
- * cbSelect 11
- * Keyboard illumination
- * cbArg1 determines the function to be performed
- *
- * cbArg1 0x0 = Get Feature Information
- *  cbRES1         Standard return codes (0, -1, -2)
- *  cbRES2, word0  Bitmap of user-selectable modes
- *     bit 0     Always off (All systems)
- *     bit 1     Always on (Travis ATG, Siberia)
- *     bit 2     Auto: ALS-based On; ALS-based Off (Travis ATG)
- *     bit 3     Auto: ALS- and input-activity-based On; input-activity based Off
- *     bit 4     Auto: Input-activity-based On; input-activity based Off
- *     bit 5     Auto: Input-activity-based On (illumination level 25%); input-activity based Off
- *     bit 6     Auto: Input-activity-based On (illumination level 50%); input-activity based Off
- *     bit 7     Auto: Input-activity-based On (illumination level 75%); input-activity based Off
- *     bit 8     Auto: Input-activity-based On (illumination level 100%); input-activity based Off
- *     bits 9-15 Reserved for future use
- *  cbRES2, byte2  Reserved for future use
- *  cbRES2, byte3  Keyboard illumination type
- *     0         Reserved
- *     1         Tasklight
- *     2         Backlight
- *     3-255     Reserved for future use
- *  cbRES3, byte0  Supported auto keyboard illumination trigger bitmap.
- *     bit 0     Any keystroke
- *     bit 1     Touchpad activity
- *     bit 2     Pointing stick
- *     bit 3     Any mouse
- *     bits 4-7  Reserved for future use
- *  cbRES3, byte1  Supported timeout unit bitmap
- *     bit 0     Seconds
- *     bit 1     Minutes
- *     bit 2     Hours
- *     bit 3     Days
- *     bits 4-7  Reserved for future use
- *  cbRES3, byte2  Number of keyboard light brightness levels
- *  cbRES4, byte0  Maximum acceptable seconds value (0 if seconds not supported).
- *  cbRES4, byte1  Maximum acceptable minutes value (0 if minutes not supported).
- *  cbRES4, byte2  Maximum acceptable hours value (0 if hours not supported).
- *  cbRES4, byte3  Maximum acceptable days value (0 if days not supported)
- *
- * cbArg1 0x1 = Get Current State
- *  cbRES1         Standard return codes (0, -1, -2)
- *  cbRES2, word0  Bitmap of current mode state
- *     bit 0     Always off (All systems)
- *     bit 1     Always on (Travis ATG, Siberia)
- *     bit 2     Auto: ALS-based On; ALS-based Off (Travis ATG)
- *     bit 3     Auto: ALS- and input-activity-based On; input-activity based Off
- *     bit 4     Auto: Input-activity-based On; input-activity based Off
- *     bit 5     Auto: Input-activity-based On (illumination level 25%); input-activity based Off
- *     bit 6     Auto: Input-activity-based On (illumination level 50%); input-activity based Off
- *     bit 7     Auto: Input-activity-based On (illumination level 75%); input-activity based Off
- *     bit 8     Auto: Input-activity-based On (illumination level 100%); input-activity based Off
- *     bits 9-15 Reserved for future use
- *     Note: Only One bit can be set
- *  cbRES2, byte2  Currently active auto keyboard illumination triggers.
- *     bit 0     Any keystroke
- *     bit 1     Touchpad activity
- *     bit 2     Pointing stick
- *     bit 3     Any mouse
- *     bits 4-7  Reserved for future use
- *  cbRES2, byte3  Current Timeout
- *     bits 7:6  Timeout units indicator:
- *     00b       Seconds
- *     01b       Minutes
- *     10b       Hours
- *     11b       Days
- *     bits 5:0  Timeout value (0-63) in sec/min/hr/day
- *     NOTE: A value of 0 means always on (no timeout) if any bits of RES3 byte
- *     are set upon return from the [Get feature information] call.
- *  cbRES3, byte0  Current setting of ALS value that turns the light on or off.
- *  cbRES3, byte1  Current ALS reading
- *  cbRES3, byte2  Current keyboard light level.
- *
- * cbArg1 0x2 = Set New State
- *  cbRES1         Standard return codes (0, -1, -2)
- *  cbArg2, word0  Bitmap of current mode state
- *     bit 0     Always off (All systems)
- *     bit 1     Always on (Travis ATG, Siberia)
- *     bit 2     Auto: ALS-based On; ALS-based Off (Travis ATG)
- *     bit 3     Auto: ALS- and input-activity-based On; input-activity based Off
- *     bit 4     Auto: Input-activity-based On; input-activity based Off
- *     bit 5     Auto: Input-activity-based On (illumination level 25%); input-activity based Off
- *     bit 6     Auto: Input-activity-based On (illumination level 50%); input-activity based Off
- *     bit 7     Auto: Input-activity-based On (illumination level 75%); input-activity based Off
- *     bit 8     Auto: Input-activity-based On (illumination level 100%); input-activity based Off
- *     bits 9-15 Reserved for future use
- *     Note: Only One bit can be set
- *  cbArg2, byte2  Desired auto keyboard illumination triggers. Must remain inactive to allow
- *                 keyboard to turn off automatically.
- *     bit 0     Any keystroke
- *     bit 1     Touchpad activity
- *     bit 2     Pointing stick
- *     bit 3     Any mouse
- *     bits 4-7  Reserved for future use
- *  cbArg2, byte3  Desired Timeout
- *     bits 7:6  Timeout units indicator:
- *     00b       Seconds
- *     01b       Minutes
- *     10b       Hours
- *     11b       Days
- *     bits 5:0  Timeout value (0-63) in sec/min/hr/day
- *  cbArg3, byte0  Desired setting of ALS value that turns the light on or off.
- *  cbArg3, byte2  Desired keyboard light level.
- */
-enum kbd_timeout_unit {
-        KBD_TIMEOUT_SECONDS = 0,
-        KBD_TIMEOUT_MINUTES,
-        KBD_TIMEOUT_HOURS,
-        KBD_TIMEOUT_DAYS,
-};
-enum kbd_mode_bit {
-        KBD_MODE_BIT_OFF = 0,
-        KBD_MODE_BIT_ON,
-        KBD_MODE_BIT_ALS,
-        KBD_MODE_BIT_TRIGGER_ALS,
-        KBD_MODE_BIT_TRIGGER,
-        KBD_MODE_BIT_TRIGGER_25,
-        KBD_MODE_BIT_TRIGGER_50,
-        KBD_MODE_BIT_TRIGGER_75,
-        KBD_MODE_BIT_TRIGGER_100,
-};
-#define kbd_is_als_mode_bit(bit) \
-        ((bit) == KBD_MODE_BIT_ALS || (bit) == KBD_MODE_BIT_TRIGGER_ALS)
-#define kbd_is_trigger_mode_bit(bit) \
-        ((bit) >= KBD_MODE_BIT_TRIGGER_ALS && (bit) <= KBD_MODE_BIT_TRIGGER_100)
-#define kbd_is_level_mode_bit(bit) \
-        ((bit) >= KBD_MODE_BIT_TRIGGER_25 && (bit) <= KBD_MODE_BIT_TRIGGER_100)
-struct kbd_info {
-        u16 modes;
-        u8 type;
-        u8 triggers;
-        u8 levels;
-        u8 seconds;
-        u8 minutes;
-        u8 hours;
-        u8 days;
-};
-struct kbd_state {
-        u8 mode_bit;
-        u8 triggers;
-        u8 timeout_value;
-        u8 timeout_unit;
-        u8 als_setting;
-        u8 als_value;
-        u8 level;
-};
-static const int kbd_tokens[] = {
-        KBD_LED_OFF_TOKEN,
-        KBD_LED_AUTO_25_TOKEN,
-        KBD_LED_AUTO_50_TOKEN,
-        KBD_LED_AUTO_75_TOKEN,
-        KBD_LED_AUTO_100_TOKEN,
-        KBD_LED_ON_TOKEN,
-};
-static u16 kbd_token_bits;
-static struct kbd_info kbd_info;
-static bool kbd_als_supported;
-static bool kbd_triggers_supported;
-static u8 kbd_mode_levels[16];
-static int kbd_mode_levels_count;
-static u8 kbd_previous_level;
-static u8 kbd_previous_mode_bit;
-static bool kbd_led_present;
-/*
- * NOTE: there are three ways to set the keyboard backlight level.
- * First, via kbd_state.mode_bit (assigning KBD_MODE_BIT_TRIGGER_* value).
- * Second, via kbd_state.level (assigning numerical value <= kbd_info.levels).
- * Third, via SMBIOS tokens (KBD_LED_* in kbd_tokens)
- *
- * There are laptops which support only one of these methods. If we want to
- * support as many machines as possible we need to implement all three methods.
- * The first two methods use the kbd_state structure. The third uses SMBIOS
- * tokens. If kbd_info.levels == 0, the machine does not support setting the
- * keyboard backlight level via kbd_state.level.
- */
-static int kbd_get_info(struct kbd_info *info)
-{
-        u8 units;
-        int ret;
-        get_buffer();
-        buffer->input[0] = 0x0;
-        dell_send_request(buffer, 4, 11);
-        ret = buffer->output[0];
-        if (ret) {
-                ret = dell_smi_error(ret);
-                goto out;
-        }
-        info->modes = buffer->output[1] & 0xFFFF;
-        info->type = (buffer->output[1] >> 24) & 0xFF;
-        info->triggers = buffer->output[2] & 0xFF;
-        units = (buffer->output[2] >> 8) & 0xFF;
-        info->levels = (buffer->output[2] >> 16) & 0xFF;
-        if (units & BIT(0))
-                info->seconds = (buffer->output[3] >> 0) & 0xFF;
-        if (units & BIT(1))
-                info->minutes = (buffer->output[3] >> 8) & 0xFF;
-        if (units & BIT(2))
-                info->hours = (buffer->output[3] >> 16) & 0xFF;
-        if (units & BIT(3))
-                info->days = (buffer->output[3] >> 24) & 0xFF;
- out:
-        release_buffer();
-        return ret;
-}
-static unsigned int kbd_get_max_level(void)
-{
-        if (kbd_info.levels != 0)
-                return kbd_info.levels;
-        if (kbd_mode_levels_count > 0)
-                return kbd_mode_levels_count - 1;
-        return 0;
-}
-static int kbd_get_level(struct kbd_state *state)
-{
-        int i;
-        if (kbd_info.levels != 0)
-                return state->level;
-        if (kbd_mode_levels_count > 0) {
-                for (i = 0; i < kbd_mode_levels_count; ++i)
-                        if (kbd_mode_levels[i] == state->mode_bit)
-                                return i;
-                return 0;
-        }
-        return -EINVAL;
-}
-static int kbd_set_level(struct kbd_state *state, u8 level)
-{
-        if (kbd_info.levels != 0) {
-                if (level != 0)
-                        kbd_previous_level = level;
-                if (state->level == level)
-                        return 0;
-                state->level = level;
-                if (level != 0 && state->mode_bit == KBD_MODE_BIT_OFF)
-                        state->mode_bit = kbd_previous_mode_bit;
-                else if (level == 0 && state->mode_bit != KBD_MODE_BIT_OFF) {
-                        kbd_previous_mode_bit = state->mode_bit;
-                        state->mode_bit = KBD_MODE_BIT_OFF;
-                }
-                return 0;
-        }
-        if (kbd_mode_levels_count > 0 && level < kbd_mode_levels_count) {
-                if (level != 0)
-                        kbd_previous_level = level;
-                state->mode_bit = kbd_mode_levels[level];
-                return 0;
-        }
-        return -EINVAL;
-}
-static int kbd_get_state(struct kbd_state *state)
-{
-        int ret;
-        get_buffer();
-        buffer->input[0] = 0x1;
-        dell_send_request(buffer, 4, 11);
-        ret = buffer->output[0];
-        if (ret) {
-                ret = dell_smi_error(ret);
-                goto out;
-        }
-        state->mode_bit = ffs(buffer->output[1] & 0xFFFF);
-        if (state->mode_bit != 0)
-                state->mode_bit--;
-        state->triggers = (buffer->output[1] >> 16) & 0xFF;
-        state->timeout_value = (buffer->output[1] >> 24) & 0x3F;
-        state->timeout_unit = (buffer->output[1] >> 30) & 0x3;
-        state->als_setting = buffer->output[2] & 0xFF;
-        state->als_value = (buffer->output[2] >> 8) & 0xFF;
-        state->level = (buffer->output[2] >> 16) & 0xFF;
- out:
-        release_buffer();
-        return ret;
-}
-static int kbd_set_state(struct kbd_state *state)
-{
-        int ret;
-        get_buffer();
-        buffer->input[0] = 0x2;
-        buffer->input[1] = BIT(state->mode_bit) & 0xFFFF;
-        buffer->input[1] |= (state->triggers & 0xFF) << 16;
-        buffer->input[1] |= (state->timeout_value & 0x3F) << 24;
-        buffer->input[1] |= (state->timeout_unit & 0x3) << 30;
-        buffer->input[2] = state->als_setting & 0xFF;
-        buffer->input[2] |= (state->level & 0xFF) << 16;
-        dell_send_request(buffer, 4, 11);
-        ret = buffer->output[0];
-        release_buffer();
-        return dell_smi_error(ret);
-}
-static int kbd_set_state_safe(struct kbd_state *state, struct kbd_state *old)
-{
-        int ret;
-        ret = kbd_set_state(state);
-        if (ret == 0)
-                return 0;
-        /*
-         * When setting the new state fails,try to restore the previous one.
-         * This is needed on some machines where BIOS sets a default state when
-         * setting a new state fails. This default state could be all off.
-         */
-        if (kbd_set_state(old))
-                pr_err("Setting old previous keyboard state failed\n");
-        return ret;
-}
-static int kbd_set_token_bit(u8 bit)
-{
-        int id;
-        int ret;
-        if (bit >= ARRAY_SIZE(kbd_tokens))
-                return -EINVAL;
-        id = find_token_id(kbd_tokens[bit]);
-        if (id == -1)
-                return -EINVAL;
-        get_buffer();
-        buffer->input[0] = da_tokens[id].location;
-        buffer->input[1] = da_tokens[id].value;
-        dell_send_request(buffer, 1, 0);
-        ret = buffer->output[0];
-        release_buffer();
-        return dell_smi_error(ret);
-}
-static int kbd_get_token_bit(u8 bit)
-{
-        int id;
-        int ret;
-        int val;
-        if (bit >= ARRAY_SIZE(kbd_tokens))
-                return -EINVAL;
-        id = find_token_id(kbd_tokens[bit]);
-        if (id == -1)
-                return -EINVAL;
-        get_buffer();
-        buffer->input[0] = da_tokens[id].location;
-        dell_send_request(buffer, 0, 0);
-        ret = buffer->output[0];
-        val = buffer->output[1];
-        release_buffer();
-        if (ret)
-                return dell_smi_error(ret);
-        return (val == da_tokens[id].value);
-}
-static int kbd_get_first_active_token_bit(void)
-{
-        int i;
-        int ret;
-        for (i = 0; i < ARRAY_SIZE(kbd_tokens); ++i) {
-                ret = kbd_get_token_bit(i);
-                if (ret == 1)
-                        return i;
-        }
-        return ret;
-}
-static int kbd_get_valid_token_counts(void)
-{
-        return hweight16(kbd_token_bits);
-}
-static inline int kbd_init_info(void)
-{
-        struct kbd_state state;
-        int ret;
-        int i;
-        ret = kbd_get_info(&kbd_info);
-        if (ret)
-                return ret;
-        kbd_get_state(&state);
-        /* NOTE: timeout value is stored in 6 bits so max value is 63 */
-        if (kbd_info.seconds > 63)
-                kbd_info.seconds = 63;
-        if (kbd_info.minutes > 63)
-                kbd_info.minutes = 63;
-        if (kbd_info.hours > 63)
-                kbd_info.hours = 63;
-        if (kbd_info.days > 63)
-                kbd_info.days = 63;
-        /* NOTE: On tested machines ON mode did not work and caused
-         *       problems (turned backlight off) so do not use it
-         */
-        kbd_info.modes &= ~BIT(KBD_MODE_BIT_ON);
-        kbd_previous_level = kbd_get_level(&state);
-        kbd_previous_mode_bit = state.mode_bit;
-        if (kbd_previous_level == 0 && kbd_get_max_level() != 0)
-                kbd_previous_level = 1;
-        if (kbd_previous_mode_bit == KBD_MODE_BIT_OFF) {
-                kbd_previous_mode_bit =
-                        ffs(kbd_info.modes & ~BIT(KBD_MODE_BIT_OFF));
-                if (kbd_previous_mode_bit != 0)
-                        kbd_previous_mode_bit--;
-        }
-        if (kbd_info.modes & (BIT(KBD_MODE_BIT_ALS) |
-                              BIT(KBD_MODE_BIT_TRIGGER_ALS)))
-                kbd_als_supported = true;
-        if (kbd_info.modes & (
-            BIT(KBD_MODE_BIT_TRIGGER_ALS) | BIT(KBD_MODE_BIT_TRIGGER) |
-            BIT(KBD_MODE_BIT_TRIGGER_25) | BIT(KBD_MODE_BIT_TRIGGER_50) |
-            BIT(KBD_MODE_BIT_TRIGGER_75) | BIT(KBD_MODE_BIT_TRIGGER_100)
-           ))
-                kbd_triggers_supported = true;
-        /* kbd_mode_levels[0] is reserved, see below */
-        for (i = 0; i < 16; ++i)
-                if (kbd_is_level_mode_bit(i) && (BIT(i) & kbd_info.modes))
-                        kbd_mode_levels[1 + kbd_mode_levels_count++] = i;
-        /*
-         * Find the first supported mode and assign to kbd_mode_levels[0].
-         * This should be 0 (off), but we cannot depend on the BIOS to
-         * support 0.
-         */
-        if (kbd_mode_levels_count > 0) {
-                for (i = 0; i < 16; ++i) {
-                        if (BIT(i) & kbd_info.modes) {
-                                kbd_mode_levels[0] = i;
-                                break;
-                        }
-                }
-                kbd_mode_levels_count++;
-        }
-        return 0;
-}
-static inline void kbd_init_tokens(void)
-{
-        int i;
-        for (i = 0; i < ARRAY_SIZE(kbd_tokens); ++i)
-                if (find_token_id(kbd_tokens[i]) != -1)
-                        kbd_token_bits |= BIT(i);
-}
-static void kbd_init(void)
-{
-        int ret;
-        ret = kbd_init_info();
-        kbd_init_tokens();
-        if (kbd_token_bits != 0 || ret == 0)
-                kbd_led_present = true;
-}
-static ssize_t kbd_led_timeout_store(struct device *dev,
-                                     struct device_attribute *attr,
-                                     const char *buf, size_t count)
-{
-        struct kbd_state new_state;
-        struct kbd_state state;
-        bool convert;
-        int value;
-        int ret;
-        char ch;
-        u8 unit;
-        int i;
-        ret = sscanf(buf, "%d %c", &value, &ch);
-        if (ret < 1)
-                return -EINVAL;
-        else if (ret == 1)
-                ch = 's';
-        if (value < 0)
-                return -EINVAL;
-        convert = false;
-        switch (ch) {
-        case 's':
-                if (value > kbd_info.seconds)
-                        convert = true;
-                unit = KBD_TIMEOUT_SECONDS;
-                break;
-        case 'm':
-                if (value > kbd_info.minutes)
-                        convert = true;
-                unit = KBD_TIMEOUT_MINUTES;
-                break;
-        case 'h':
-                if (value > kbd_info.hours)
-                        convert = true;
-                unit = KBD_TIMEOUT_HOURS;
-                break;
-        case 'd':
-                if (value > kbd_info.days)
-                        convert = true;
-                unit = KBD_TIMEOUT_DAYS;
-                break;
-        default:
-                return -EINVAL;
-        }
-        if (quirks && quirks->needs_kbd_timeouts)
-                convert = true;
-        if (convert) {
-                /* Convert value from current units to seconds */
-                switch (unit) {
-                case KBD_TIMEOUT_DAYS:
-                        value *= 24;
-                case KBD_TIMEOUT_HOURS:
-                        value *= 60;
-                case KBD_TIMEOUT_MINUTES:
-                        value *= 60;
-                        unit = KBD_TIMEOUT_SECONDS;
-                }
-                if (quirks && quirks->needs_kbd_timeouts) {
-                        for (i = 0; quirks->kbd_timeouts[i] != -1; i++) {
-                                if (value <= quirks->kbd_timeouts[i]) {
-                                        value = quirks->kbd_timeouts[i];
-                                        break;
-                                }
-                        }
-                }
-                if (value <= kbd_info.seconds && kbd_info.seconds) {
-                        unit = KBD_TIMEOUT_SECONDS;
-                } else if (value / 60 <= kbd_info.minutes && kbd_info.minutes) {
-                        value /= 60;
-                        unit = KBD_TIMEOUT_MINUTES;
-                } else if (value / (60 * 60) <= kbd_info.hours && kbd_info.hours) {
-                        value /= (60 * 60);
-                        unit = KBD_TIMEOUT_HOURS;
-                } else if (value / (60 * 60 * 24) <= kbd_info.days && kbd_info.days) {
-                        value /= (60 * 60 * 24);
-                        unit = KBD_TIMEOUT_DAYS;
-                } else {
-                        return -EINVAL;
-                }
-        }
-        ret = kbd_get_state(&state);
-        if (ret)
-                return ret;
-        new_state = state;
-        new_state.timeout_value = value;
-        new_state.timeout_unit = unit;
-        ret = kbd_set_state_safe(&new_state, &state);
-        if (ret)
-                return ret;
-        return count;
-}
-static ssize_t kbd_led_timeout_show(struct device *dev,
-                                    struct device_attribute *attr, char *buf)
-{
-        struct kbd_state state;
-        int ret;
-        int len;
-        ret = kbd_get_state(&state);
-        if (ret)
-                return ret;
-        len = sprintf(buf, "%d", state.timeout_value);
-        switch (state.timeout_unit) {
-        case KBD_TIMEOUT_SECONDS:
-                return len + sprintf(buf+len, "s\n");
-        case KBD_TIMEOUT_MINUTES:
-                return len + sprintf(buf+len, "m\n");
-        case KBD_TIMEOUT_HOURS:
-                return len + sprintf(buf+len, "h\n");
-        case KBD_TIMEOUT_DAYS:
-                return len + sprintf(buf+len, "d\n");
-        default:
-                return -EINVAL;
-        }
-        return len;
-}
-static DEVICE_ATTR(stop_timeout, S_IRUGO | S_IWUSR,
-                   kbd_led_timeout_show, kbd_led_timeout_store);
-static const char * const kbd_led_triggers[] = {
-        "keyboard",
-        "touchpad",
-        /*"trackstick"*/ NULL, /* NOTE: trackstick is just alias for touchpad */
-        "mouse",
-};
-static ssize_t kbd_led_triggers_store(struct device *dev,
-                                      struct device_attribute *attr,
-                                      const char *buf, size_t count)
-{
-        struct kbd_state new_state;
-        struct kbd_state state;
-        bool triggers_enabled = false;
-        bool als_enabled = false;
-        bool disable_als = false;
-        bool enable_als = false;
-        int trigger_bit = -1;
-        char trigger[21];
-        int i, ret;
-        ret = sscanf(buf, "%20s", trigger);
-        if (ret != 1)
-                return -EINVAL;
-        if (trigger[0] != '+' && trigger[0] != '-')
-                return -EINVAL;
-        ret = kbd_get_state(&state);
-        if (ret)
-                return ret;
-        if (kbd_als_supported)
-                als_enabled = kbd_is_als_mode_bit(state.mode_bit);
-        if (kbd_triggers_supported)
-                triggers_enabled = kbd_is_trigger_mode_bit(state.mode_bit);
-        if (kbd_als_supported) {
-                if (strcmp(trigger, "+als") == 0) {
-                        if (als_enabled)
-                                return count;
-                        enable_als = true;
-                } else if (strcmp(trigger, "-als") == 0) {
-                        if (!als_enabled)
-                                return count;
-                        disable_als = true;
-                }
-        }
-        if (enable_als || disable_als) {
-                new_state = state;
-                if (enable_als) {
-                        if (triggers_enabled)
-                                new_state.mode_bit = KBD_MODE_BIT_TRIGGER_ALS;
-                        else
-                                new_state.mode_bit = KBD_MODE_BIT_ALS;
-                } else {
-                        if (triggers_enabled) {
-                                new_state.mode_bit = KBD_MODE_BIT_TRIGGER;
-                                kbd_set_level(&new_state, kbd_previous_level);
-                        } else {
-                                new_state.mode_bit = KBD_MODE_BIT_ON;
-                        }
-                }
-                if (!(kbd_info.modes & BIT(new_state.mode_bit)))
-                        return -EINVAL;
-                ret = kbd_set_state_safe(&new_state, &state);
-                if (ret)
-                        return ret;
-                kbd_previous_mode_bit = new_state.mode_bit;
-                return count;
-        }
-        if (kbd_triggers_supported) {
-                for (i = 0; i < ARRAY_SIZE(kbd_led_triggers); ++i) {
-                        if (!(kbd_info.triggers & BIT(i)))
-                                continue;
-                        if (!kbd_led_triggers[i])
-                                continue;
-                        if (strcmp(trigger+1, kbd_led_triggers[i]) != 0)
-                                continue;
-                        if (trigger[0] == '+' &&
-                            triggers_enabled && (state.triggers & BIT(i)))
-                                return count;
-                        if (trigger[0] == '-' &&
-                            (!triggers_enabled || !(state.triggers & BIT(i))))
-                                return count;
-                        trigger_bit = i;
-                        break;
-                }
-        }
-        if (trigger_bit != -1) {
-                new_state = state;
-                if (trigger[0] == '+')
-                        new_state.triggers |= BIT(trigger_bit);
-                else {
-                        new_state.triggers &= ~BIT(trigger_bit);
-                        /* NOTE: trackstick bit (2) must be disabled when
-                         *       disabling touchpad bit (1), otherwise touchpad
-                         *       bit (1) will not be disabled */
-                        if (trigger_bit == 1)
-                                new_state.triggers &= ~BIT(2);
-                }
-                if ((kbd_info.triggers & new_state.triggers) !=
-                    new_state.triggers)
-                        return -EINVAL;
-                if (new_state.triggers && !triggers_enabled) {
-                        if (als_enabled)
-                                new_state.mode_bit = KBD_MODE_BIT_TRIGGER_ALS;
-                        else {
-                                new_state.mode_bit = KBD_MODE_BIT_TRIGGER;
-                                kbd_set_level(&new_state, kbd_previous_level);
-                        }
-                } else if (new_state.triggers == 0) {
-                        if (als_enabled)
-                                new_state.mode_bit = KBD_MODE_BIT_ALS;
-                        else
-                                kbd_set_level(&new_state, 0);
-                }
-                if (!(kbd_info.modes & BIT(new_state.mode_bit)))
-                        return -EINVAL;
-                ret = kbd_set_state_safe(&new_state, &state);
-                if (ret)
-                        return ret;
-                if (new_state.mode_bit != KBD_MODE_BIT_OFF)
-                        kbd_previous_mode_bit = new_state.mode_bit;
-                return count;
-        }
-        return -EINVAL;
-}
-static ssize_t kbd_led_triggers_show(struct device *dev,
-                                     struct device_attribute *attr, char *buf)
-{
-        struct kbd_state state;
-        bool triggers_enabled;
-        int level, i, ret;
-        int len = 0;
-        ret = kbd_get_state(&state);
-        if (ret)
-                return ret;
-        len = 0;
-        if (kbd_triggers_supported) {
-                triggers_enabled = kbd_is_trigger_mode_bit(state.mode_bit);
-                level = kbd_get_level(&state);
-                for (i = 0; i < ARRAY_SIZE(kbd_led_triggers); ++i) {
-                        if (!(kbd_info.triggers & BIT(i)))
-                                continue;
-                        if (!kbd_led_triggers[i])
-                                continue;
-                        if ((triggers_enabled || level <= 0) &&
-                            (state.triggers & BIT(i)))
-                                buf[len++] = '+';
-                        else
-                                buf[len++] = '-';
-                        len += sprintf(buf+len, "%s ", kbd_led_triggers[i]);
-                }
-        }
-        if (kbd_als_supported) {
-                if (kbd_is_als_mode_bit(state.mode_bit))
-                        len += sprintf(buf+len, "+als ");
-                else
-                        len += sprintf(buf+len, "-als ");
-        }
-        if (len)
-                buf[len - 1] = '\n';
-        return len;
-}
-static DEVICE_ATTR(start_triggers, S_IRUGO | S_IWUSR,
-                   kbd_led_triggers_show, kbd_led_triggers_store);
-static ssize_t kbd_led_als_store(struct device *dev,
-                                 struct device_attribute *attr,
-                                 const char *buf, size_t count)
-{
-        struct kbd_state state;
-        struct kbd_state new_state;
-        u8 setting;
-        int ret;
-        ret = kstrtou8(buf, 10, &setting);
-        if (ret)
-                return ret;
-        ret = kbd_get_state(&state);
-        if (ret)
-                return ret;
-        new_state = state;
-        new_state.als_setting = setting;
-        ret = kbd_set_state_safe(&new_state, &state);
-        if (ret)
-                return ret;
-        return count;
-}
-static ssize_t kbd_led_als_show(struct device *dev,
-                                struct device_attribute *attr, char *buf)
-{
-        struct kbd_state state;
-        int ret;
-        ret = kbd_get_state(&state);
-        if (ret)
-                return ret;
-        return sprintf(buf, "%d\n", state.als_setting);
-}
-static DEVICE_ATTR(als_setting, S_IRUGO | S_IWUSR,
-                   kbd_led_als_show, kbd_led_als_store);
-static struct attribute *kbd_led_attrs[] = {
-        &dev_attr_stop_timeout.attr,
-        &dev_attr_start_triggers.attr,
-        &dev_attr_als_setting.attr,
-        NULL,
-};
-ATTRIBUTE_GROUPS(kbd_led);
-static enum led_brightness kbd_led_level_get(struct led_classdev *led_cdev)
-{
-        int ret;
-        u16 num;
-        struct kbd_state state;
-        if (kbd_get_max_level()) {
-                ret = kbd_get_state(&state);
-                if (ret)
-                        return 0;
-                ret = kbd_get_level(&state);
-                if (ret < 0)
-                        return 0;
-                return ret;
-        }
-        if (kbd_get_valid_token_counts()) {
-                ret = kbd_get_first_active_token_bit();
-                if (ret < 0)
-                        return 0;
-                for (num = kbd_token_bits; num != 0 && ret > 0; --ret)
-                        num &= num - 1; /* clear the first bit set */
-                if (num == 0)
-                        return 0;
-                return ffs(num) - 1;
-        }
-        pr_warn("Keyboard brightness level control not supported\n");
-        return 0;
-}
-static void kbd_led_level_set(struct led_classdev *led_cdev,
-                              enum led_brightness value)
-{
-        struct kbd_state state;
-        struct kbd_state new_state;
-        u16 num;
-        if (kbd_get_max_level()) {
-                if (kbd_get_state(&state))
-                        return;
-                new_state = state;
-                if (kbd_set_level(&new_state, value))
-                        return;
-                kbd_set_state_safe(&new_state, &state);
-                return;
-        }
-        if (kbd_get_valid_token_counts()) {
-                for (num = kbd_token_bits; num != 0 && value > 0; --value)
-                        num &= num - 1; /* clear the first bit set */
-                if (num == 0)
-                        return;
-                kbd_set_token_bit(ffs(num) - 1);
-                return;
-        }
-        pr_warn("Keyboard brightness level control not supported\n");
-}
-static struct led_classdev kbd_led = {
-        .name           = "dell::kbd_backlight",
-        .brightness_set = kbd_led_level_set,
-        .brightness_get = kbd_led_level_get,
-        .groups         = kbd_led_groups,
-};
-static int __init kbd_led_init(struct device *dev)
-{
-        kbd_init();
-        if (!kbd_led_present)
-                return -ENODEV;
-        kbd_led.max_brightness = kbd_get_max_level();
-        if (!kbd_led.max_brightness) {
-                kbd_led.max_brightness = kbd_get_valid_token_counts();
-                if (kbd_led.max_brightness)
-                        kbd_led.max_brightness--;
-        }
-        return led_classdev_register(dev, &kbd_led);
-}
-static void brightness_set_exit(struct led_classdev *led_cdev,
-                                enum led_brightness value)
-{
-        /* Don't change backlight level on exit */
-};
-static void kbd_led_exit(void)
-{
-        if (!kbd_led_present)
-                return;
-        kbd_led.brightness_set = brightness_set_exit;
-        led_classdev_unregister(&kbd_led);
-}
 static int __init dell_init(void)
 {
        int max_intensity = 0;
@@ -1879,8 +841,6 @@ static int __init dell_init(void)
        if (quirks && quirks->touchpad_led)
                touchpad_led_init(&platform_device->dev);
-        kbd_led_init(&platform_device->dev);
        dell_laptop_dir = debugfs_create_dir("dell_laptop", NULL);
        if (dell_laptop_dir != NULL)
                debugfs_create_file("rfkill", 0444, dell_laptop_dir, NULL,
@@ -1948,7 +908,6 @@ static void __exit dell_exit(void)
        debugfs_remove_recursive(dell_laptop_dir);
        if (quirks && quirks->touchpad_led)
                touchpad_led_exit();
-        kbd_led_exit();
        i8042_remove_filter(dell_laptop_i8042_filter);
        cancel_delayed_work_sync(&dell_rfkill_work);
        backlight_device_unregister(dell_backlight_device);
@@ -1965,7 +924,5 @@ module_init(dell_init);
 module_exit(dell_exit);
 MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>");
-MODULE_AUTHOR("Gabriele Mazzotta <gabriele.mzt@gmail.com>");
-MODULE_AUTHOR("Pali Rohár <pali.rohar@gmail.com>");
 MODULE_DESCRIPTION("Dell laptop driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index c71443c4f265..97b5e4ee1ca4 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -1041,6 +1041,7 @@ static const struct x86_cpu_id rapl_ids[] = {
        RAPL_CPU(0x45, rapl_defaults_core),/* Haswell ULT */
        RAPL_CPU(0x4C, rapl_defaults_atom),/* Braswell */
        RAPL_CPU(0x4A, rapl_defaults_atom),/* Tangier */
+        RAPL_CPU(0x56, rapl_defaults_core),/* Future Xeon */
        RAPL_CPU(0x5A, rapl_defaults_atom),/* Annidale */
        {}
 };
diff --git a/drivers/regulator/Kconfig b/drivers/regulator/Kconfig
index c3a60b57a865..a6f116aa5235 100644
--- a/drivers/regulator/Kconfig
+++ b/drivers/regulator/Kconfig
@@ -414,6 +414,14 @@ config REGULATOR_MAX77802
          Exynos5420/Exynos5800 SoCs to control various voltages.
          It includes support for control of voltage and ramp speed.
+config REGULATOR_MAX77843
+        tristate "Maxim 77843 regulator"
+        depends on MFD_MAX77843
+        help
+          This driver controls a Maxim 77843 regulator.
+          The regulator include two 'SAFEOUT' for USB(Universal Serial Bus)
+          This is suitable for Exynos5433 SoC chips.
 config REGULATOR_MC13XXX_CORE
        tristate
@@ -433,6 +441,15 @@ config REGULATOR_MC13892
          Say y here to support the regulators found on the Freescale MC13892
          PMIC.
+config REGULATOR_MT6397
+        tristate "MediaTek MT6397 PMIC"
+        depends on MFD_MT6397
+        help
+          Say y here to select this option to enable the power regulator of
+          MediaTek MT6397 PMIC.
+          This driver supports the control of different power rails of device
+          through regulator interface.
 config REGULATOR_PALMAS
        tristate "TI Palmas PMIC Regulators"
        depends on MFD_PALMAS
diff --git a/drivers/regulator/Makefile b/drivers/regulator/Makefile
index 1f28ebfc6f3a..2c4da15e1545 100644
--- a/drivers/regulator/Makefile
+++ b/drivers/regulator/Makefile
@@ -55,9 +55,11 @@ obj-$(CONFIG_REGULATOR_MAX8998) += max8998.o
 obj-$(CONFIG_REGULATOR_MAX77686) += max77686.o
 obj-$(CONFIG_REGULATOR_MAX77693) += max77693.o
 obj-$(CONFIG_REGULATOR_MAX77802) += max77802.o
+obj-$(CONFIG_REGULATOR_MAX77843) += max77843.o
 obj-$(CONFIG_REGULATOR_MC13783) += mc13783-regulator.o
 obj-$(CONFIG_REGULATOR_MC13892) += mc13892-regulator.o
 obj-$(CONFIG_REGULATOR_MC13XXX_CORE) +=  mc13xxx-regulator-core.o
+obj-$(CONFIG_REGULATOR_MT6397)  += mt6397-regulator.o
 obj-$(CONFIG_REGULATOR_QCOM_RPM) += qcom_rpm-regulator.o
 obj-$(CONFIG_REGULATOR_PALMAS) += palmas-regulator.o
 obj-$(CONFIG_REGULATOR_PFUZE100) += pfuze100-regulator.o
diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
index f23d7e1f2ee7..e4331f5e5d7d 100644
--- a/drivers/regulator/axp20x-regulator.c
+++ b/drivers/regulator/axp20x-regulator.c
@@ -32,11 +32,13 @@
 #define AXP20X_FREQ_DCDC_MASK           0x0f
-#define AXP20X_DESC_IO(_id, _supply, _min, _max, _step, _vreg, _vmask, _ereg,   \
+#define AXP20X_DESC_IO(_id, _match, _supply, _min, _max, _step, _vreg, _vmask,  \
-                       _emask, _enable_val, _disable_val)                       \
+                       _ereg, _emask, _enable_val, _disable_val)                \
        [AXP20X_##_id] = {                                                      \
                .name           = #_id,                                         \
                .supply_name    = (_supply),                                    \
+                .of_match       = of_match_ptr(_match),                         \
+                .regulators_node = of_match_ptr("regulators"),                  \
                .type           = REGULATOR_VOLTAGE,                            \
                .id             = AXP20X_##_id,                                 \
                .n_voltages     = (((_max) - (_min)) / (_step) + 1),            \
@@ -52,11 +54,13 @@
                .ops            = &axp20x_ops,                                  \
        }
-#define AXP20X_DESC(_id, _supply, _min, _max, _step, _vreg, _vmask, _ereg,      \
+#define AXP20X_DESC(_id, _match, _supply, _min, _max, _step, _vreg, _vmask,     \
-                    _emask)                                                     \
+                    _ereg, _emask)                                              \
        [AXP20X_##_id] = {                                                      \
                .name           = #_id,                                         \
                .supply_name    = (_supply),                                    \
+                .of_match       = of_match_ptr(_match),                         \
+                .regulators_node = of_match_ptr("regulators"),                  \
                .type           = REGULATOR_VOLTAGE,                            \
                .id             = AXP20X_##_id,                                 \
                .n_voltages     = (((_max) - (_min)) / (_step) + 1),            \
@@ -70,10 +74,12 @@
                .ops            = &axp20x_ops,                                  \
        }
-#define AXP20X_DESC_FIXED(_id, _supply, _volt)                                  \
+#define AXP20X_DESC_FIXED(_id, _match, _supply, _volt)                          \
        [AXP20X_##_id] = {                                                      \
                .name           = #_id,                                         \
                .supply_name    = (_supply),                                    \
+                .of_match       = of_match_ptr(_match),                         \
+                .regulators_node = of_match_ptr("regulators"),                  \
                .type           = REGULATOR_VOLTAGE,                            \
                .id             = AXP20X_##_id,                                 \
                .n_voltages     = 1,                                            \
@@ -82,10 +88,13 @@
                .ops            = &axp20x_ops_fixed                             \
        }
-#define AXP20X_DESC_TABLE(_id, _supply, _table, _vreg, _vmask, _ereg, _emask)   \
+#define AXP20X_DESC_TABLE(_id, _match, _supply, _table, _vreg, _vmask, _ereg,   \
+                          _emask)                                               \
        [AXP20X_##_id] = {                                                      \
                .name           = #_id,                                         \
                .supply_name    = (_supply),                                    \
+                .of_match       = of_match_ptr(_match),                         \
+                .regulators_node = of_match_ptr("regulators"),                  \
                .type           = REGULATOR_VOLTAGE,                            \
                .id             = AXP20X_##_id,                                 \
                .n_voltages     = ARRAY_SIZE(_table),                           \
@@ -127,36 +136,20 @@ static struct regulator_ops axp20x_ops = {
 };
 static const struct regulator_desc axp20x_regulators[] = {
-        AXP20X_DESC(DCDC2, "vin2", 700, 2275, 25, AXP20X_DCDC2_V_OUT, 0x3f,
+        AXP20X_DESC(DCDC2, "dcdc2", "vin2", 700, 2275, 25, AXP20X_DCDC2_V_OUT,
-                    AXP20X_PWR_OUT_CTRL, 0x10),
+                    0x3f, AXP20X_PWR_OUT_CTRL, 0x10),
-        AXP20X_DESC(DCDC3, "vin3", 700, 3500, 25, AXP20X_DCDC3_V_OUT, 0x7f,
+        AXP20X_DESC(DCDC3, "dcdc3", "vin3", 700, 3500, 25, AXP20X_DCDC3_V_OUT,
-                    AXP20X_PWR_OUT_CTRL, 0x02),
+                    0x7f, AXP20X_PWR_OUT_CTRL, 0x02),
-        AXP20X_DESC_FIXED(LDO1, "acin", 1300),
+        AXP20X_DESC_FIXED(LDO1, "ldo1", "acin", 1300),
-        AXP20X_DESC(LDO2, "ldo24in", 1800, 3300, 100, AXP20X_LDO24_V_OUT, 0xf0,
+        AXP20X_DESC(LDO2, "ldo2", "ldo24in", 1800, 3300, 100,
-                    AXP20X_PWR_OUT_CTRL, 0x04),
+                    AXP20X_LDO24_V_OUT, 0xf0, AXP20X_PWR_OUT_CTRL, 0x04),
-        AXP20X_DESC(LDO3, "ldo3in", 700, 3500, 25, AXP20X_LDO3_V_OUT, 0x7f,
+        AXP20X_DESC(LDO3, "ldo3", "ldo3in", 700, 3500, 25, AXP20X_LDO3_V_OUT,
-                    AXP20X_PWR_OUT_CTRL, 0x40),
+                    0x7f, AXP20X_PWR_OUT_CTRL, 0x40),
-        AXP20X_DESC_TABLE(LDO4, "ldo24in", axp20x_ldo4_data, AXP20X_LDO24_V_OUT, 0x0f,
+        AXP20X_DESC_TABLE(LDO4, "ldo4", "ldo24in", axp20x_ldo4_data,
-                          AXP20X_PWR_OUT_CTRL, 0x08),
+                          AXP20X_LDO24_V_OUT, 0x0f, AXP20X_PWR_OUT_CTRL, 0x08),
-        AXP20X_DESC_IO(LDO5, "ldo5in", 1800, 3300, 100, AXP20X_LDO5_V_OUT, 0xf0,
+        AXP20X_DESC_IO(LDO5, "ldo5", "ldo5in", 1800, 3300, 100,
-                       AXP20X_GPIO0_CTRL, 0x07, AXP20X_IO_ENABLED,
+                       AXP20X_LDO5_V_OUT, 0xf0, AXP20X_GPIO0_CTRL, 0x07,
-                       AXP20X_IO_DISABLED),
+                       AXP20X_IO_ENABLED, AXP20X_IO_DISABLED),
-};
-#define AXP_MATCH(_name, _id) \
-        [AXP20X_##_id] = { \
-                .name           = #_name, \
-                .driver_data    = (void *) &axp20x_regulators[AXP20X_##_id], \
-        }
-static struct of_regulator_match axp20x_matches[] = {
-        AXP_MATCH(dcdc2, DCDC2),
-        AXP_MATCH(dcdc3, DCDC3),
-        AXP_MATCH(ldo1, LDO1),
-        AXP_MATCH(ldo2, LDO2),
-        AXP_MATCH(ldo3, LDO3),
-        AXP_MATCH(ldo4, LDO4),
-        AXP_MATCH(ldo5, LDO5),
 };
 static int axp20x_set_dcdc_freq(struct platform_device *pdev, u32 dcdcfreq)
@@ -193,13 +186,6 @@ static int axp20x_regulator_parse_dt(struct platform_device *pdev)
        if (!regulators) {
                dev_warn(&pdev->dev, "regulators node not found\n");
        } else {
-                ret = of_regulator_match(&pdev->dev, regulators, axp20x_matches,
-                                         ARRAY_SIZE(axp20x_matches));
-                if (ret < 0) {
-                        dev_err(&pdev->dev, "Error parsing regulator init data: %d\n", ret);
-                        return ret;
-                }
                dcdcfreq = 1500;
                of_property_read_u32(regulators, "x-powers,dcdc-freq", &dcdcfreq);
                ret = axp20x_set_dcdc_freq(pdev, dcdcfreq);
@@ -233,23 +219,17 @@ static int axp20x_regulator_probe(struct platform_device *pdev)
 {
        struct regulator_dev *rdev;
        struct axp20x_dev *axp20x = dev_get_drvdata(pdev->dev.parent);
-        struct regulator_config config = { };
+        struct regulator_config config = {
-        struct regulator_init_data *init_data;
+                .dev = pdev->dev.parent,
+                .regmap = axp20x->regmap,
+        };
        int ret, i;
        u32 workmode;
-        ret = axp20x_regulator_parse_dt(pdev);
+        /* This only sets the dcdc freq. Ignore any errors */
-        if (ret)
+        axp20x_regulator_parse_dt(pdev);
-                return ret;
        for (i = 0; i < AXP20X_REG_ID_MAX; i++) {
-                init_data = axp20x_matches[i].init_data;
-                config.dev = pdev->dev.parent;
-                config.init_data = init_data;
-                config.regmap = axp20x->regmap;
-                config.of_node = axp20x_matches[i].of_node;
                rdev = devm_regulator_register(&pdev->dev, &axp20x_regulators[i],
                                               &config);
                if (IS_ERR(rdev)) {
@@ -259,7 +239,8 @@ static int axp20x_regulator_probe(struct platform_device *pdev)
                        return PTR_ERR(rdev);
                }
-                ret = of_property_read_u32(axp20x_matches[i].of_node, "x-powers,dcdc-workmode",
+                ret = of_property_read_u32(rdev->dev.of_node,
+                                           "x-powers,dcdc-workmode",
                                           &workmode);
                if (!ret) {
                        if (axp20x_set_dcdc_workmode(rdev, i, workmode))
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index e225711bb8bc..b899947d839d 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -632,49 +632,34 @@ static ssize_t regulator_bypass_show(struct device *dev,
 static DEVICE_ATTR(bypass, 0444,
                   regulator_bypass_show, NULL);
-/*
- * These are the only attributes are present for all regulators.
- * Other attributes are a function of regulator functionality.
- */
-static struct attribute *regulator_dev_attrs[] = {
-        &dev_attr_name.attr,
-        &dev_attr_num_users.attr,
-        &dev_attr_type.attr,
-        NULL,
-};
-ATTRIBUTE_GROUPS(regulator_dev);
-static void regulator_dev_release(struct device *dev)
-{
-        struct regulator_dev *rdev = dev_get_drvdata(dev);
-        kfree(rdev);
-}
-static struct class regulator_class = {
-        .name = "regulator",
-        .dev_release = regulator_dev_release,
-        .dev_groups = regulator_dev_groups,
-};
 /* Calculate the new optimum regulator operating mode based on the new total
 * consumer load. All locks held by caller */
-static void drms_uA_update(struct regulator_dev *rdev)
+static int drms_uA_update(struct regulator_dev *rdev)
 {
        struct regulator *sibling;
        int current_uA = 0, output_uV, input_uV, err;
        unsigned int mode;
+        /*
+         * first check to see if we can set modes at all, otherwise just
+         * tell the consumer everything is OK.
+         */
        err = regulator_check_drms(rdev);
-        if (err < 0 || !rdev->desc->ops->get_optimum_mode ||
+        if (err < 0)
-            (!rdev->desc->ops->get_voltage &&
+                return 0;
-             !rdev->desc->ops->get_voltage_sel) ||
-            !rdev->desc->ops->set_mode)
+        if (!rdev->desc->ops->get_optimum_mode)
-                return;
+                return 0;
+        if (!rdev->desc->ops->set_mode)
+                return -EINVAL;
        /* get output voltage */
        output_uV = _regulator_get_voltage(rdev);
-        if (output_uV <= 0)
+        if (output_uV <= 0) {
-                return;
+                rdev_err(rdev, "invalid output voltage found\n");
+                return -EINVAL;
+        }
        /* get input voltage */
        input_uV = 0;
@@ -682,8 +667,10 @@ static void drms_uA_update(struct regulator_dev *rdev)
                input_uV = regulator_get_voltage(rdev->supply);
        if (input_uV <= 0)
                input_uV = rdev->constraints->input_uV;
-        if (input_uV <= 0)
+        if (input_uV <= 0) {
-                return;
+                rdev_err(rdev, "invalid input voltage found\n");
+                return -EINVAL;
+        }
        /* calc total requested load */
        list_for_each_entry(sibling, &rdev->consumer_list, list)
@@ -695,8 +682,17 @@ static void drms_uA_update(struct regulator_dev *rdev)
        /* check the new mode is allowed */
        err = regulator_mode_constrain(rdev, &mode);
-        if (err == 0)
+        if (err < 0) {
-                rdev->desc->ops->set_mode(rdev, mode);
+                rdev_err(rdev, "failed to get optimum mode @ %d uA %d -> %d uV\n",
+                         current_uA, input_uV, output_uV);
+                return err;
+        }
+        err = rdev->desc->ops->set_mode(rdev, mode);
+        if (err < 0)
+                rdev_err(rdev, "failed to set optimum mode %x\n", mode);
+        return err;
 }
 static int suspend_set_state(struct regulator_dev *rdev,
@@ -1488,7 +1484,7 @@ struct regulator *regulator_get_optional(struct device *dev, const char *id)
 }
 EXPORT_SYMBOL_GPL(regulator_get_optional);
-/* Locks held by regulator_put() */
+/* regulator_list_mutex lock held by regulator_put() */
 static void _regulator_put(struct regulator *regulator)
 {
        struct regulator_dev *rdev;
@@ -1503,12 +1499,14 @@ static void _regulator_put(struct regulator *regulator)
        /* remove any sysfs entries */
        if (regulator->dev)
                sysfs_remove_link(&rdev->dev.kobj, regulator->supply_name);
+        mutex_lock(&rdev->mutex);
        kfree(regulator->supply_name);
        list_del(&regulator->list);
        kfree(regulator);
        rdev->open_count--;
        rdev->exclusive = 0;
+        mutex_unlock(&rdev->mutex);
        module_put(rdev->owner);
 }
@@ -3024,75 +3022,13 @@ EXPORT_SYMBOL_GPL(regulator_get_mode);
 int regulator_set_optimum_mode(struct regulator *regulator, int uA_load)
 {
        struct regulator_dev *rdev = regulator->rdev;
-        struct regulator *consumer;
+        int ret;
-        int ret, output_uV, input_uV = 0, total_uA_load = 0;
-        unsigned int mode;
-        if (rdev->supply)
-                input_uV = regulator_get_voltage(rdev->supply);
        mutex_lock(&rdev->mutex);
-        /*
-         * first check to see if we can set modes at all, otherwise just
-         * tell the consumer everything is OK.
-         */
        regulator->uA_load = uA_load;
-        ret = regulator_check_drms(rdev);
+        ret = drms_uA_update(rdev);
-        if (ret < 0) {
-                ret = 0;
-                goto out;
-        }
-        if (!rdev->desc->ops->get_optimum_mode)
-                goto out;
-        /*
-         * we can actually do this so any errors are indicators of
-         * potential real failure.
-         */
-        ret = -EINVAL;
-        if (!rdev->desc->ops->set_mode)
-                goto out;
-        /* get output voltage */
-        output_uV = _regulator_get_voltage(rdev);
-        if (output_uV <= 0) {
-                rdev_err(rdev, "invalid output voltage found\n");
-                goto out;
-        }
-        /* No supply? Use constraint voltage */
-        if (input_uV <= 0)
-                input_uV = rdev->constraints->input_uV;
-        if (input_uV <= 0) {
-                rdev_err(rdev, "invalid input voltage found\n");
-                goto out;
-        }
-        /* calc total requested load for this regulator */
-        list_for_each_entry(consumer, &rdev->consumer_list, list)
-                total_uA_load += consumer->uA_load;
-        mode = rdev->desc->ops->get_optimum_mode(rdev,
-                                                 input_uV, output_uV,
-                                                 total_uA_load);
-        ret = regulator_mode_constrain(rdev, &mode);
-        if (ret < 0) {
-                rdev_err(rdev, "failed to get optimum mode @ %d uA %d -> %d uV\n",
-                         total_uA_load, input_uV, output_uV);
-                goto out;
-        }
-        ret = rdev->desc->ops->set_mode(rdev, mode);
-        if (ret < 0) {
-                rdev_err(rdev, "failed to set optimum mode %x\n", mode);
-                goto out;
-        }
-        ret = mode;
-out:
        mutex_unlock(&rdev->mutex);
        return ret;
 }
 EXPORT_SYMBOL_GPL(regulator_set_optimum_mode);
@@ -3434,126 +3370,136 @@ int regulator_mode_to_status(unsigned int mode)
 }
 EXPORT_SYMBOL_GPL(regulator_mode_to_status);
+static struct attribute *regulator_dev_attrs[] = {
+        &dev_attr_name.attr,
+        &dev_attr_num_users.attr,
+        &dev_attr_type.attr,
+        &dev_attr_microvolts.attr,
+        &dev_attr_microamps.attr,
+        &dev_attr_opmode.attr,
+        &dev_attr_state.attr,
+        &dev_attr_status.attr,
+        &dev_attr_bypass.attr,
+        &dev_attr_requested_microamps.attr,
+        &dev_attr_min_microvolts.attr,
+        &dev_attr_max_microvolts.attr,
+        &dev_attr_min_microamps.attr,
+        &dev_attr_max_microamps.attr,
+        &dev_attr_suspend_standby_state.attr,
+        &dev_attr_suspend_mem_state.attr,
+        &dev_attr_suspend_disk_state.attr,
+        &dev_attr_suspend_standby_microvolts.attr,
+        &dev_attr_suspend_mem_microvolts.attr,
+        &dev_attr_suspend_disk_microvolts.attr,
+        &dev_attr_suspend_standby_mode.attr,
+        &dev_attr_suspend_mem_mode.attr,
+        &dev_attr_suspend_disk_mode.attr,
+        NULL
+};
 /*
 * To avoid cluttering sysfs (and memory) with useless state, only
 * create attributes that can be meaningfully displayed.
 */
-static int add_regulator_attributes(struct regulator_dev *rdev)
+static umode_t regulator_attr_is_visible(struct kobject *kobj,
+                                         struct attribute *attr, int idx)
 {
-        struct device *dev = &rdev->dev;
+        struct device *dev = kobj_to_dev(kobj);
+        struct regulator_dev *rdev = container_of(dev, struct regulator_dev, dev);
        const struct regulator_ops *ops = rdev->desc->ops;
-        int status = 0;
+        umode_t mode = attr->mode;
+        /* these three are always present */
+        if (attr == &dev_attr_name.attr ||
+            attr == &dev_attr_num_users.attr ||
+            attr == &dev_attr_type.attr)
+                return mode;
        /* some attributes need specific methods to be displayed */
-        if ((ops->get_voltage && ops->get_voltage(rdev) >= 0) ||
+        if (attr == &dev_attr_microvolts.attr) {
-            (ops->get_voltage_sel && ops->get_voltage_sel(rdev) >= 0) ||
+                if ((ops->get_voltage && ops->get_voltage(rdev) >= 0) ||
-            (ops->list_voltage && ops->list_voltage(rdev, 0) >= 0) ||
+                    (ops->get_voltage_sel && ops->get_voltage_sel(rdev) >= 0) ||
-                (rdev->desc->fixed_uV && (rdev->desc->n_voltages == 1))) {
+                    (ops->list_voltage && ops->list_voltage(rdev, 0) >= 0) ||
-                status = device_create_file(dev, &dev_attr_microvolts);
+                    (rdev->desc->fixed_uV && rdev->desc->n_voltages == 1))
-                if (status < 0)
+                        return mode;
-                        return status;
+                return 0;
-        }
-        if (ops->get_current_limit) {
-                status = device_create_file(dev, &dev_attr_microamps);
-                if (status < 0)
-                        return status;
-        }
-        if (ops->get_mode) {
-                status = device_create_file(dev, &dev_attr_opmode);
-                if (status < 0)
-                        return status;
-        }
-        if (rdev->ena_pin || ops->is_enabled) {
-                status = device_create_file(dev, &dev_attr_state);
-                if (status < 0)
-                        return status;
-        }
-        if (ops->get_status) {
-                status = device_create_file(dev, &dev_attr_status);
-                if (status < 0)
-                        return status;
-        }
-        if (ops->get_bypass) {
-                status = device_create_file(dev, &dev_attr_bypass);
-                if (status < 0)
-                        return status;
        }
+        if (attr == &dev_attr_microamps.attr)
+                return ops->get_current_limit ? mode : 0;
+        if (attr == &dev_attr_opmode.attr)
+                return ops->get_mode ? mode : 0;
+        if (attr == &dev_attr_state.attr)
+                return (rdev->ena_pin || ops->is_enabled) ? mode : 0;
+        if (attr == &dev_attr_status.attr)
+                return ops->get_status ? mode : 0;
+        if (attr == &dev_attr_bypass.attr)
+                return ops->get_bypass ? mode : 0;
        /* some attributes are type-specific */
-        if (rdev->desc->type == REGULATOR_CURRENT) {
+        if (attr == &dev_attr_requested_microamps.attr)
-                status = device_create_file(dev, &dev_attr_requested_microamps);
+                return rdev->desc->type == REGULATOR_CURRENT ? mode : 0;
-                if (status < 0)
-                        return status;
-        }
        /* all the other attributes exist to support constraints;
         * don't show them if there are no constraints, or if the
         * relevant supporting methods are missing.
         */
        if (!rdev->constraints)
-                return status;
+                return 0;
        /* constraints need specific supporting methods */
-        if (ops->set_voltage || ops->set_voltage_sel) {
+        if (attr == &dev_attr_min_microvolts.attr ||
-                status = device_create_file(dev, &dev_attr_min_microvolts);
+            attr == &dev_attr_max_microvolts.attr)
-                if (status < 0)
+                return (ops->set_voltage || ops->set_voltage_sel) ? mode : 0;
-                        return status;
-                status = device_create_file(dev, &dev_attr_max_microvolts);
+        if (attr == &dev_attr_min_microamps.attr ||
-                if (status < 0)
+            attr == &dev_attr_max_microamps.attr)
-                        return status;
+                return ops->set_current_limit ? mode : 0;
-        }
-        if (ops->set_current_limit) {
+        if (attr == &dev_attr_suspend_standby_state.attr ||
-                status = device_create_file(dev, &dev_attr_min_microamps);
+            attr == &dev_attr_suspend_mem_state.attr ||
-                if (status < 0)
+            attr == &dev_attr_suspend_disk_state.attr)
-                        return status;
+                return mode;
-                status = device_create_file(dev, &dev_attr_max_microamps);
-                if (status < 0)
+        if (attr == &dev_attr_suspend_standby_microvolts.attr ||
-                        return status;
+            attr == &dev_attr_suspend_mem_microvolts.attr ||
-        }
+            attr == &dev_attr_suspend_disk_microvolts.attr)
+                return ops->set_suspend_voltage ? mode : 0;
-        status = device_create_file(dev, &dev_attr_suspend_standby_state);
-        if (status < 0)
+        if (attr == &dev_attr_suspend_standby_mode.attr ||
-                return status;
+            attr == &dev_attr_suspend_mem_mode.attr ||
-        status = device_create_file(dev, &dev_attr_suspend_mem_state);
+            attr == &dev_attr_suspend_disk_mode.attr)
-        if (status < 0)
+                return ops->set_suspend_mode ? mode : 0;
-                return status;
-        status = device_create_file(dev, &dev_attr_suspend_disk_state);
+        return mode;
-        if (status < 0)
+}
-                return status;
+static const struct attribute_group regulator_dev_group = {
+        .attrs = regulator_dev_attrs,
+        .is_visible = regulator_attr_is_visible,
+};
+static const struct attribute_group *regulator_dev_groups[] = {
+        &regulator_dev_group,
+        NULL
+};
-        if (ops->set_suspend_voltage) {
+static void regulator_dev_release(struct device *dev)
-                status = device_create_file(dev,
+{
-                                &dev_attr_suspend_standby_microvolts);
+        struct regulator_dev *rdev = dev_get_drvdata(dev);
-                if (status < 0)
+        kfree(rdev);
-                        return status;
-                status = device_create_file(dev,
-                                &dev_attr_suspend_mem_microvolts);
-                if (status < 0)
-                        return status;
-                status = device_create_file(dev,
-                                &dev_attr_suspend_disk_microvolts);
-                if (status < 0)
-                        return status;
-        }
-        if (ops->set_suspend_mode) {
-                status = device_create_file(dev,
-                                &dev_attr_suspend_standby_mode);
-                if (status < 0)
-                        return status;
-                status = device_create_file(dev,
-                                &dev_attr_suspend_mem_mode);
-                if (status < 0)
-                        return status;
-                status = device_create_file(dev,
-                                &dev_attr_suspend_disk_mode);
-                if (status < 0)
-                        return status;
-        }
-        return status;
 }
+static struct class regulator_class = {
+        .name = "regulator",
+        .dev_release = regulator_dev_release,
+        .dev_groups = regulator_dev_groups,
+};
 static void rdev_init_debugfs(struct regulator_dev *rdev)
 {
        rdev->debugfs = debugfs_create_dir(rdev_get_name(rdev), debugfs_root);
@@ -3573,7 +3519,7 @@ static void rdev_init_debugfs(struct regulator_dev *rdev)
 /**
 * regulator_register - register regulator
 * @regulator_desc: regulator to register
- * @config: runtime configuration for regulator
+ * @cfg: runtime configuration for regulator
 *
 * Called by regulator drivers to register a regulator.
 * Returns a valid pointer to struct regulator_dev on success
@@ -3581,20 +3527,21 @@ static void rdev_init_debugfs(struct regulator_dev *rdev)
 */
 struct regulator_dev *
 regulator_register(const struct regulator_desc *regulator_desc,
-                   const struct regulator_config *config)
+                   const struct regulator_config *cfg)
 {
        const struct regulation_constraints *constraints = NULL;
        const struct regulator_init_data *init_data;
-        static atomic_t regulator_no = ATOMIC_INIT(0);
+        struct regulator_config *config = NULL;
+        static atomic_t regulator_no = ATOMIC_INIT(-1);
        struct regulator_dev *rdev;
        struct device *dev;
        int ret, i;
        const char *supply = NULL;
-        if (regulator_desc == NULL || config == NULL)
+        if (regulator_desc == NULL || cfg == NULL)
                return ERR_PTR(-EINVAL);
-        dev = config->dev;
+        dev = cfg->dev;
        WARN_ON(!dev);
        if (regulator_desc->name == NULL || regulator_desc->ops == NULL)
@@ -3624,7 +3571,17 @@ regulator_register(const struct regulator_desc *regulator_desc,
        if (rdev == NULL)
                return ERR_PTR(-ENOMEM);
-        init_data = regulator_of_get_init_data(dev, regulator_desc,
+        /*
+         * Duplicate the config so the driver could override it after
+         * parsing init data.
+         */
+        config = kmemdup(cfg, sizeof(*cfg), GFP_KERNEL);
+        if (config == NULL) {
+                kfree(rdev);
+                return ERR_PTR(-ENOMEM);
+        }
+        init_data = regulator_of_get_init_data(dev, regulator_desc, config,
                                               &rdev->dev.of_node);
        if (!init_data) {
                init_data = config->init_data;
@@ -3658,8 +3615,8 @@ regulator_register(const struct regulator_desc *regulator_desc,
        /* register with sysfs */
        rdev->dev.class = &regulator_class;
        rdev->dev.parent = dev;
-        dev_set_name(&rdev->dev, "regulator.%d",
+        dev_set_name(&rdev->dev, "regulator.%lu",
-                     atomic_inc_return(&regulator_no) - 1);
+                    (unsigned long) atomic_inc_return(&regulator_no));
        ret = device_register(&rdev->dev);
        if (ret != 0) {
                put_device(&rdev->dev);
@@ -3692,11 +3649,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
        if (ret < 0)
                goto scrub;
-        /* add attributes supported by this regulator */
-        ret = add_regulator_attributes(rdev);
-        if (ret < 0)
-                goto scrub;
        if (init_data && init_data->supply_regulator)
                supply = init_data->supply_regulator;
        else if (regulator_desc->supply_name)
@@ -3752,6 +3704,7 @@ add_dev:
        rdev_init_debugfs(rdev);
 out:
        mutex_unlock(&regulator_list_mutex);
+        kfree(config);
        return rdev;
 unset_supplies:
diff --git a/drivers/regulator/da9211-regulator.c b/drivers/regulator/da9211-regulator.c
index c78d2106d6cb..01343419555e 100644
--- a/drivers/regulator/da9211-regulator.c
+++ b/drivers/regulator/da9211-regulator.c
@@ -24,6 +24,7 @@
 #include <linux/regmap.h>
 #include <linux/irq.h>
 #include <linux/interrupt.h>
+#include <linux/of_gpio.h>
 #include <linux/regulator/of_regulator.h>
 #include <linux/regulator/da9211.h>
 #include "da9211-regulator.h"
@@ -276,7 +277,10 @@ static struct da9211_pdata *da9211_parse_regulators_dt(
                        continue;
                pdata->init_data[n] = da9211_matches[i].init_data;
+                pdata->reg_node[n] = da9211_matches[i].of_node;
+                pdata->gpio_ren[n] =
+                        of_get_named_gpio(da9211_matches[i].of_node,
+                                "enable-gpios", 0);
                n++;
        }
@@ -364,7 +368,15 @@ static int da9211_regulator_init(struct da9211 *chip)
                config.dev = chip->dev;
                config.driver_data = chip;
                config.regmap = chip->regmap;
-                config.of_node = chip->dev->of_node;
+                config.of_node = chip->pdata->reg_node[i];
+                if (gpio_is_valid(chip->pdata->gpio_ren[i])) {
+                        config.ena_gpio = chip->pdata->gpio_ren[i];
+                        config.ena_gpio_initialized = true;
+                } else {
+                        config.ena_gpio = -EINVAL;
+                        config.ena_gpio_initialized = false;
+                }
                chip->rdev[i] = devm_regulator_register(chip->dev,
                        &da9211_regulators[i], &config);
diff --git a/drivers/regulator/fan53555.c b/drivers/regulator/fan53555.c
index 6c43ab2d5121..3c25db89a021 100644
--- a/drivers/regulator/fan53555.c
+++ b/drivers/regulator/fan53555.c
@@ -147,7 +147,7 @@ static unsigned int fan53555_get_mode(struct regulator_dev *rdev)
                return REGULATOR_MODE_NORMAL;
 }
-static int slew_rates[] = {
+static const int slew_rates[] = {
        64000,
        32000,
        16000,
@@ -296,7 +296,7 @@ static int fan53555_regulator_register(struct fan53555_device_info *di,
        return PTR_ERR_OR_ZERO(di->rdev);
 }
-static struct regmap_config fan53555_regmap_config = {
+static const struct regmap_config fan53555_regmap_config = {
        .reg_bits = 8,
        .val_bits = 8,
 };
diff --git a/drivers/regulator/internal.h b/drivers/regulator/internal.h
index 80ba2a35a04b..c74ac8734023 100644
--- a/drivers/regulator/internal.h
+++ b/drivers/regulator/internal.h
@@ -38,11 +38,13 @@ struct regulator {
 #ifdef CONFIG_OF
 struct regulator_init_data *regulator_of_get_init_data(struct device *dev,
                                 const struct regulator_desc *desc,
+                                 struct regulator_config *config,
                                 struct device_node **node);
 #else
 static inline struct regulator_init_data *
 regulator_of_get_init_data(struct device *dev,
                           const struct regulator_desc *desc,
+                           struct regulator_config *config,
                           struct device_node **node)
 {
        return NULL;
diff --git a/drivers/regulator/isl9305.c b/drivers/regulator/isl9305.c
index 92fefd98da58..6e3a15fe00f1 100644
--- a/drivers/regulator/isl9305.c
+++ b/drivers/regulator/isl9305.c
@@ -177,8 +177,10 @@ static int isl9305_i2c_probe(struct i2c_client *i2c,
 #ifdef CONFIG_OF
 static const struct of_device_id isl9305_dt_ids[] = {
-        { .compatible = "isl,isl9305" },
+        { .compatible = "isl,isl9305" }, /* for backward compat., don't use */
-        { .compatible = "isl,isl9305h" },
+        { .compatible = "isil,isl9305" },
+        { .compatible = "isl,isl9305h" }, /* for backward compat., don't use */
+        { .compatible = "isil,isl9305h" },
        {},
 };
 #endif
diff --git a/drivers/regulator/lp872x.c b/drivers/regulator/lp872x.c
index 021d64d856bb..3de328ab41f3 100644
--- a/drivers/regulator/lp872x.c
+++ b/drivers/regulator/lp872x.c
@@ -106,7 +106,6 @@ struct lp872x {
        struct device *dev;
        enum lp872x_id chipid;
        struct lp872x_platform_data *pdata;
-        struct regulator_dev **regulators;
        int num_regulators;
        enum lp872x_dvs_state dvs_pin;
        int dvs_gpio;
@@ -801,8 +800,6 @@ static int lp872x_regulator_register(struct lp872x *lp)
                        dev_err(lp->dev, "regulator register err");
                        return PTR_ERR(rdev);
                }
-                *(lp->regulators + i) = rdev;
        }
        return 0;
@@ -906,7 +903,7 @@ static struct lp872x_platform_data
 static int lp872x_probe(struct i2c_client *cl, const struct i2c_device_id *id)
 {
        struct lp872x *lp;
-        int ret, size, num_regulators;
+        int ret;
        const int lp872x_num_regulators[] = {
                [LP8720] = LP8720_NUM_REGULATORS,
                [LP8725] = LP8725_NUM_REGULATORS,
@@ -918,38 +915,27 @@ static int lp872x_probe(struct i2c_client *cl, const struct i2c_device_id *id)
        lp = devm_kzalloc(&cl->dev, sizeof(struct lp872x), GFP_KERNEL);
        if (!lp)
-                goto err_mem;
+                return -ENOMEM;
-        num_regulators = lp872x_num_regulators[id->driver_data];
-        size = sizeof(struct regulator_dev *) * num_regulators;
-        lp->regulators = devm_kzalloc(&cl->dev, size, GFP_KERNEL);
+        lp->num_regulators = lp872x_num_regulators[id->driver_data];
-        if (!lp->regulators)
-                goto err_mem;
        lp->regmap = devm_regmap_init_i2c(cl, &lp872x_regmap_config);
        if (IS_ERR(lp->regmap)) {
                ret = PTR_ERR(lp->regmap);
                dev_err(&cl->dev, "regmap init i2c err: %d\n", ret);
-                goto err_dev;
+                return ret;
        }
        lp->dev = &cl->dev;
        lp->pdata = dev_get_platdata(&cl->dev);
        lp->chipid = id->driver_data;
-        lp->num_regulators = num_regulators;
        i2c_set_clientdata(cl, lp);
        ret = lp872x_config(lp);
        if (ret)
-                goto err_dev;
+                return ret;
        return lp872x_regulator_register(lp);
-err_mem:
-        return -ENOMEM;
-err_dev:
-        return ret;
 }
 static const struct of_device_id lp872x_dt_ids[] = {
diff --git a/drivers/regulator/max14577.c b/drivers/regulator/max14577.c
index bf9a44c5fdd2..b3678d289619 100644
--- a/drivers/regulator/max14577.c
+++ b/drivers/regulator/max14577.c
@@ -103,6 +103,8 @@ static struct regulator_ops max14577_charger_ops = {
 static const struct regulator_desc max14577_supported_regulators[] = {
        [MAX14577_SAFEOUT] = {
                .name           = "SAFEOUT",
+                .of_match       = of_match_ptr("SAFEOUT"),
+                .regulators_node = of_match_ptr("regulators"),
                .id             = MAX14577_SAFEOUT,
                .ops            = &max14577_safeout_ops,
                .type           = REGULATOR_VOLTAGE,
@@ -114,6 +116,8 @@ static const struct regulator_desc max14577_supported_regulators[] = {
        },
        [MAX14577_CHARGER] = {
                .name           = "CHARGER",
+                .of_match       = of_match_ptr("CHARGER"),
+                .regulators_node = of_match_ptr("regulators"),
                .id             = MAX14577_CHARGER,
                .ops            = &max14577_charger_ops,
                .type           = REGULATOR_CURRENT,
@@ -137,6 +141,8 @@ static struct regulator_ops max77836_ldo_ops = {
 static const struct regulator_desc max77836_supported_regulators[] = {
        [MAX14577_SAFEOUT] = {
                .name           = "SAFEOUT",
+                .of_match       = of_match_ptr("SAFEOUT"),
+                .regulators_node = of_match_ptr("regulators"),
                .id             = MAX14577_SAFEOUT,
                .ops            = &max14577_safeout_ops,
                .type           = REGULATOR_VOLTAGE,
@@ -148,6 +154,8 @@ static const struct regulator_desc max77836_supported_regulators[] = {
        },
        [MAX14577_CHARGER] = {
                .name           = "CHARGER",
+                .of_match       = of_match_ptr("CHARGER"),
+                .regulators_node = of_match_ptr("regulators"),
                .id             = MAX14577_CHARGER,
                .ops            = &max14577_charger_ops,
                .type           = REGULATOR_CURRENT,
@@ -157,6 +165,8 @@ static const struct regulator_desc max77836_supported_regulators[] = {
        },
        [MAX77836_LDO1] = {
                .name           = "LDO1",
+                .of_match       = of_match_ptr("LDO1"),
+                .regulators_node = of_match_ptr("regulators"),
                .id             = MAX77836_LDO1,
                .ops            = &max77836_ldo_ops,
                .type           = REGULATOR_VOLTAGE,
@@ -171,6 +181,8 @@ static const struct regulator_desc max77836_supported_regulators[] = {
        },
        [MAX77836_LDO2] = {
                .name           = "LDO2",
+                .of_match       = of_match_ptr("LDO2"),
+                .regulators_node = of_match_ptr("regulators"),
                .id             = MAX77836_LDO2,
                .ops            = &max77836_ldo_ops,
                .type           = REGULATOR_VOLTAGE,
@@ -198,43 +210,6 @@ static struct of_regulator_match max77836_regulator_matches[] = {
        { .name = "LDO2", },
 };
-static int max14577_regulator_dt_parse_pdata(struct platform_device *pdev,
-                enum maxim_device_type dev_type)
-{
-        int ret;
-        struct device_node *np;
-        struct of_regulator_match *regulator_matches;
-        unsigned int regulator_matches_size;
-        np = of_get_child_by_name(pdev->dev.parent->of_node, "regulators");
-        if (!np) {
-                dev_err(&pdev->dev, "Failed to get child OF node for regulators\n");
-                return -EINVAL;
-        }
-        switch (dev_type) {
-        case MAXIM_DEVICE_TYPE_MAX77836:
-                regulator_matches = max77836_regulator_matches;
-                regulator_matches_size = ARRAY_SIZE(max77836_regulator_matches);
-                break;
-        case MAXIM_DEVICE_TYPE_MAX14577:
-        default:
-                regulator_matches = max14577_regulator_matches;
-                regulator_matches_size = ARRAY_SIZE(max14577_regulator_matches);
-        }
-        ret = of_regulator_match(&pdev->dev, np, regulator_matches,
-                        regulator_matches_size);
-        if (ret < 0)
-                dev_err(&pdev->dev, "Error parsing regulator init data: %d\n", ret);
-        else
-                ret = 0;
-        of_node_put(np);
-        return ret;
-}
 static inline struct regulator_init_data *match_init_data(int index,
                enum maxim_device_type dev_type)
 {
@@ -261,11 +236,6 @@ static inline struct device_node *match_of_node(int index,
        }
 }
 #else /* CONFIG_OF */
-static int max14577_regulator_dt_parse_pdata(struct platform_device *pdev,
-                enum maxim_device_type dev_type)
-{
-        return 0;
-}
 static inline struct regulator_init_data *match_init_data(int index,
                enum maxim_device_type dev_type)
 {
@@ -308,16 +278,12 @@ static int max14577_regulator_probe(struct platform_device *pdev)
 {
        struct max14577 *max14577 = dev_get_drvdata(pdev->dev.parent);
        struct max14577_platform_data *pdata = dev_get_platdata(max14577->dev);
-        int i, ret;
+        int i, ret = 0;
        struct regulator_config config = {};
        const struct regulator_desc *supported_regulators;
        unsigned int supported_regulators_size;
        enum maxim_device_type dev_type = max14577->dev_type;
-        ret = max14577_regulator_dt_parse_pdata(pdev, dev_type);
-        if (ret)
-                return ret;
        switch (dev_type) {
        case MAXIM_DEVICE_TYPE_MAX77836:
                supported_regulators = max77836_supported_regulators;
@@ -329,7 +295,7 @@ static int max14577_regulator_probe(struct platform_device *pdev)
                supported_regulators_size = ARRAY_SIZE(max14577_supported_regulators);
        }
-        config.dev = &pdev->dev;
+        config.dev = max14577->dev;
        config.driver_data = max14577;
        for (i = 0; i < supported_regulators_size; i++) {
diff --git a/drivers/regulator/max77686.c b/drivers/regulator/max77686.c
index 10d206266ac2..15fb1416bfbd 100644
--- a/drivers/regulator/max77686.c
+++ b/drivers/regulator/max77686.c
@@ -26,6 +26,7 @@
 #include <linux/bug.h>
 #include <linux/err.h>
 #include <linux/gpio.h>
+#include <linux/of_gpio.h>
 #include <linux/slab.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/driver.h>
@@ -46,6 +47,11 @@
 #define MAX77686_DVS_UVSTEP     12500
 /*
+ * Value for configuring buck[89] and LDO{20,21,22} as GPIO control.
+ * It is the same as 'off' for other regulators.
+ */
+#define MAX77686_GPIO_CONTROL           0x0
+/*
 * Values used for configuring LDOs and bucks.
 * Forcing low power mode: LDO1, 3-5, 9, 13, 17-26
 */
@@ -82,6 +88,8 @@ enum max77686_ramp_rate {
 };
 struct max77686_data {
+        u64 gpio_enabled:MAX77686_REGULATORS;
        /* Array indexed by regulator id */
        unsigned int opmode[MAX77686_REGULATORS];
 };
@@ -100,6 +108,26 @@ static unsigned int max77686_get_opmode_shift(int id)
        }
 }
+/*
+ * When regulator is configured for GPIO control then it
+ * replaces "normal" mode. Any change from low power mode to normal
+ * should actually change to GPIO control.
+ * Map normal mode to proper value for such regulators.
+ */
+static unsigned int max77686_map_normal_mode(struct max77686_data *max77686,
+                                             int id)
+{
+        switch (id) {
+        case MAX77686_BUCK8:
+        case MAX77686_BUCK9:
+        case MAX77686_LDO20 ... MAX77686_LDO22:
+                if (max77686->gpio_enabled & (1 << id))
+                        return MAX77686_GPIO_CONTROL;
+        }
+        return MAX77686_NORMAL;
+}
 /* Some BUCKs and LDOs supports Normal[ON/OFF] mode during suspend */
 static int max77686_set_suspend_disable(struct regulator_dev *rdev)
 {
@@ -136,7 +164,7 @@ static int max77686_set_suspend_mode(struct regulator_dev *rdev,
                val = MAX77686_LDO_LOWPOWER_PWRREQ;
                break;
        case REGULATOR_MODE_NORMAL:                     /* ON in Normal Mode */
-                val = MAX77686_NORMAL;
+                val = max77686_map_normal_mode(max77686, id);
                break;
        default:
                pr_warn("%s: regulator_suspend_mode : 0x%x not supported\n",
@@ -160,7 +188,7 @@ static int max77686_ldo_set_suspend_mode(struct regulator_dev *rdev,
 {
        unsigned int val;
        struct max77686_data *max77686 = rdev_get_drvdata(rdev);
-        int ret;
+        int ret, id = rdev_get_id(rdev);
        switch (mode) {
        case REGULATOR_MODE_STANDBY:                    /* switch off */
@@ -170,7 +198,7 @@ static int max77686_ldo_set_suspend_mode(struct regulator_dev *rdev,
                val = MAX77686_LDO_LOWPOWER_PWRREQ;
                break;
        case REGULATOR_MODE_NORMAL:                     /* ON in Normal Mode */
-                val = MAX77686_NORMAL;
+                val = max77686_map_normal_mode(max77686, id);
                break;
        default:
                pr_warn("%s: regulator_suspend_mode : 0x%x not supported\n",
@@ -184,7 +212,7 @@ static int max77686_ldo_set_suspend_mode(struct regulator_dev *rdev,
        if (ret)
                return ret;
-        max77686->opmode[rdev_get_id(rdev)] = val;
+        max77686->opmode[id] = val;
        return 0;
 }
@@ -197,7 +225,7 @@ static int max77686_enable(struct regulator_dev *rdev)
        shift = max77686_get_opmode_shift(id);
        if (max77686->opmode[id] == MAX77686_OFF_PWRREQ)
-                max77686->opmode[id] = MAX77686_NORMAL;
+                max77686->opmode[id] = max77686_map_normal_mode(max77686, id);
        return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
                                  rdev->desc->enable_mask,
@@ -229,6 +257,36 @@ static int max77686_set_ramp_delay(struct regulator_dev *rdev, int ramp_delay)
                                  MAX77686_RAMP_RATE_MASK, ramp_value << 6);
 }
+static int max77686_of_parse_cb(struct device_node *np,
+                const struct regulator_desc *desc,
+                struct regulator_config *config)
+{
+        struct max77686_data *max77686 = config->driver_data;
+        switch (desc->id) {
+        case MAX77686_BUCK8:
+        case MAX77686_BUCK9:
+        case MAX77686_LDO20 ... MAX77686_LDO22:
+                config->ena_gpio = of_get_named_gpio(np,
+                                        "maxim,ena-gpios", 0);
+                config->ena_gpio_flags = GPIOF_OUT_INIT_HIGH;
+                config->ena_gpio_initialized = true;
+                break;
+        default:
+                return 0;
+        }
+        if (gpio_is_valid(config->ena_gpio)) {
+                max77686->gpio_enabled |= (1 << desc->id);
+                return regmap_update_bits(config->regmap, desc->enable_reg,
+                                          desc->enable_mask,
+                                          MAX77686_GPIO_CONTROL);
+        }
+        return 0;
+}
 static struct regulator_ops max77686_ops = {
        .list_voltage           = regulator_list_voltage_linear,
        .map_voltage            = regulator_map_voltage_linear,
@@ -283,6 +341,7 @@ static struct regulator_ops max77686_buck_dvs_ops = {
        .name           = "LDO"#num,                                    \
        .of_match       = of_match_ptr("LDO"#num),                      \
        .regulators_node        = of_match_ptr("voltage-regulators"),   \
+        .of_parse_cb    = max77686_of_parse_cb,                         \
        .id             = MAX77686_LDO##num,                            \
        .ops            = &max77686_ops,                                \
        .type           = REGULATOR_VOLTAGE,                            \
@@ -355,6 +414,7 @@ static struct regulator_ops max77686_buck_dvs_ops = {
        .name           = "BUCK"#num,                                   \
        .of_match       = of_match_ptr("BUCK"#num),                     \
        .regulators_node        = of_match_ptr("voltage-regulators"),   \
+        .of_parse_cb    = max77686_of_parse_cb,                         \
        .id             = MAX77686_BUCK##num,                           \
        .ops            = &max77686_ops,                                \
        .type           = REGULATOR_VOLTAGE,                            \
diff --git a/drivers/regulator/max77843.c b/drivers/regulator/max77843.c
new file mode 100644
index 000000000000..c132ef527cdd
--- /dev/null
+++ b/drivers/regulator/max77843.c
@@ -0,0 +1,227 @@
+/*
+ * max77843.c - Regulator driver for the Maxim MAX77843
+ *
+ * Copyright (C) 2015 Samsung Electronics
+ * Author: Jaewon Kim <jaewon02.kim@samsung.com>
+ * Author: Beomho Seo <beomho.seo@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/mfd/max77843-private.h>
+#include <linux/regulator/of_regulator.h>
+enum max77843_regulator_type {
+        MAX77843_SAFEOUT1 = 0,
+        MAX77843_SAFEOUT2,
+        MAX77843_CHARGER,
+        MAX77843_NUM,
+};
+static const unsigned int max77843_safeout_voltage_table[] = {
+        4850000,
+        4900000,
+        4950000,
+        3300000,
+};
+static int max77843_reg_is_enabled(struct regulator_dev *rdev)
+{
+        struct regmap *regmap = rdev->regmap;
+        int ret;
+        unsigned int reg;
+        ret = regmap_read(regmap, rdev->desc->enable_reg, &reg);
+        if (ret) {
+                dev_err(&rdev->dev, "Fialed to read charger register\n");
+                return ret;
+        }
+        return (reg & rdev->desc->enable_mask) == rdev->desc->enable_mask;
+}
+static int max77843_reg_get_current_limit(struct regulator_dev *rdev)
+{
+        struct regmap *regmap = rdev->regmap;
+        unsigned int chg_min_uA = rdev->constraints->min_uA;
+        unsigned int chg_max_uA = rdev->constraints->max_uA;
+        unsigned int val;
+        int ret;
+        unsigned int reg, sel;
+        ret = regmap_read(regmap, MAX77843_CHG_REG_CHG_CNFG_02, &reg);
+        if (ret) {
+                dev_err(&rdev->dev, "Failed to read charger register\n");
+                return ret;
+        }
+        sel = reg & MAX77843_CHG_FAST_CHG_CURRENT_MASK;
+        if (sel < 0x03)
+                sel = 0;
+        else
+                sel -= 2;
+        val = chg_min_uA + MAX77843_CHG_FAST_CHG_CURRENT_STEP * sel;
+        if (val > chg_max_uA)
+                return -EINVAL;
+        return val;
+}
+static int max77843_reg_set_current_limit(struct regulator_dev *rdev,
+                int min_uA, int max_uA)
+{
+        struct regmap *regmap = rdev->regmap;
+        unsigned int chg_min_uA = rdev->constraints->min_uA;
+        int sel = 0;
+        while (chg_min_uA + MAX77843_CHG_FAST_CHG_CURRENT_STEP * sel < min_uA)
+                sel++;
+        if (chg_min_uA + MAX77843_CHG_FAST_CHG_CURRENT_STEP * sel > max_uA)
+                return -EINVAL;
+        sel += 2;
+        return regmap_write(regmap, MAX77843_CHG_REG_CHG_CNFG_02, sel);
+}
+static struct regulator_ops max77843_charger_ops = {
+        .is_enabled             = max77843_reg_is_enabled,
+        .enable                 = regulator_enable_regmap,
+        .disable                = regulator_disable_regmap,
+        .get_current_limit      = max77843_reg_get_current_limit,
+        .set_current_limit      = max77843_reg_set_current_limit,
+};
+static struct regulator_ops max77843_regulator_ops = {
+        .is_enabled             = regulator_is_enabled_regmap,
+        .enable                 = regulator_enable_regmap,
+        .disable                = regulator_disable_regmap,
+        .list_voltage           = regulator_list_voltage_table,
+        .get_voltage_sel        = regulator_get_voltage_sel_regmap,
+        .set_voltage_sel        = regulator_set_voltage_sel_regmap,
+};
+static const struct regulator_desc max77843_supported_regulators[] = {
+        [MAX77843_SAFEOUT1] = {
+                .name           = "SAFEOUT1",
+                .id             = MAX77843_SAFEOUT1,
+                .ops            = &max77843_regulator_ops,
+                .of_match       = of_match_ptr("SAFEOUT1"),
+                .regulators_node = of_match_ptr("regulators"),
+                .type           = REGULATOR_VOLTAGE,
+                .owner          = THIS_MODULE,
+                .n_voltages     = ARRAY_SIZE(max77843_safeout_voltage_table),
+                .volt_table     = max77843_safeout_voltage_table,
+                .enable_reg     = MAX77843_SYS_REG_SAFEOUTCTRL,
+                .enable_mask    = MAX77843_REG_SAFEOUTCTRL_ENSAFEOUT1,
+                .vsel_reg       = MAX77843_SYS_REG_SAFEOUTCTRL,
+                .vsel_mask      = MAX77843_REG_SAFEOUTCTRL_SAFEOUT1_MASK,
+        },
+        [MAX77843_SAFEOUT2] = {
+                .name           = "SAFEOUT2",
+                .id             = MAX77843_SAFEOUT2,
+                .ops            = &max77843_regulator_ops,
+                .of_match       = of_match_ptr("SAFEOUT2"),
+                .regulators_node = of_match_ptr("regulators"),
+                .type           = REGULATOR_VOLTAGE,
+                .owner          = THIS_MODULE,
+                .n_voltages     = ARRAY_SIZE(max77843_safeout_voltage_table),
+                .volt_table     = max77843_safeout_voltage_table,
+                .enable_reg     = MAX77843_SYS_REG_SAFEOUTCTRL,
+                .enable_mask    = MAX77843_REG_SAFEOUTCTRL_ENSAFEOUT2,
+                .vsel_reg       = MAX77843_SYS_REG_SAFEOUTCTRL,
+                .vsel_mask      = MAX77843_REG_SAFEOUTCTRL_SAFEOUT2_MASK,
+        },
+        [MAX77843_CHARGER] = {
+                .name           = "CHARGER",
+                .id             = MAX77843_CHARGER,
+                .ops            = &max77843_charger_ops,
+                .of_match       = of_match_ptr("CHARGER"),
+                .regulators_node = of_match_ptr("regulators"),
+                .type           = REGULATOR_CURRENT,
+                .owner          = THIS_MODULE,
+                .enable_reg     = MAX77843_CHG_REG_CHG_CNFG_00,
+                .enable_mask    = MAX77843_CHG_MASK,
+        },
+};
+static struct regmap *max77843_get_regmap(struct max77843 *max77843, int reg_id)
+{
+        switch (reg_id) {
+        case MAX77843_SAFEOUT1:
+        case MAX77843_SAFEOUT2:
+                return max77843->regmap;
+        case MAX77843_CHARGER:
+                return max77843->regmap_chg;
+        default:
+                return max77843->regmap;
+        }
+}
+static int max77843_regulator_probe(struct platform_device *pdev)
+{
+        struct max77843 *max77843 = dev_get_drvdata(pdev->dev.parent);
+        struct regulator_config config = {};
+        int i;
+        config.dev = max77843->dev;
+        config.driver_data = max77843;
+        for (i = 0; i < ARRAY_SIZE(max77843_supported_regulators); i++) {
+                struct regulator_dev *regulator;
+                config.regmap = max77843_get_regmap(max77843,
+                                max77843_supported_regulators[i].id);
+                regulator = devm_regulator_register(&pdev->dev,
+                                &max77843_supported_regulators[i], &config);
+                if (IS_ERR(regulator)) {
+                        dev_err(&pdev->dev,
+                                        "Failed to regiser regulator-%d\n", i);
+                        return PTR_ERR(regulator);
+                }
+        }
+        return 0;
+}
+static const struct platform_device_id max77843_regulator_id[] = {
+        { "max77843-regulator", },
+        { /* sentinel */ },
+};
+static struct platform_driver max77843_regulator_driver = {
+        .driver = {
+                .name = "max77843-regulator",
+        },
+        .probe          = max77843_regulator_probe,
+        .id_table       = max77843_regulator_id,
+};
+static int __init max77843_regulator_init(void)
+{
+        return platform_driver_register(&max77843_regulator_driver);
+}
+subsys_initcall(max77843_regulator_init);
+static void __exit max77843_regulator_exit(void)
+{
+        platform_driver_unregister(&max77843_regulator_driver);
+}
+module_exit(max77843_regulator_exit);
+MODULE_AUTHOR("Jaewon Kim <jaewon02.kim@samsung.com>");
+MODULE_AUTHOR("Beomho Seo <beomho.seo@samsung.com>");
+MODULE_DESCRIPTION("Maxim MAX77843 regulator driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/regulator/max8649.c b/drivers/regulator/max8649.c
index c8bddcc8f911..81229579ece9 100644
--- a/drivers/regulator/max8649.c
+++ b/drivers/regulator/max8649.c
@@ -115,7 +115,7 @@ static unsigned int max8649_get_mode(struct regulator_dev *rdev)
        return REGULATOR_MODE_NORMAL;
 }
-static struct regulator_ops max8649_dcdc_ops = {
+static const struct regulator_ops max8649_dcdc_ops = {
        .set_voltage_sel = regulator_set_voltage_sel_regmap,
        .get_voltage_sel = regulator_get_voltage_sel_regmap,
        .list_voltage   = regulator_list_voltage_linear,
@@ -143,7 +143,7 @@ static struct regulator_desc dcdc_desc = {
        .enable_is_inverted = true,
 };
-static struct regmap_config max8649_regmap_config = {
+static const struct regmap_config max8649_regmap_config = {
        .reg_bits = 8,
        .val_bits = 8,
 };
diff --git a/drivers/regulator/mt6397-regulator.c b/drivers/regulator/mt6397-regulator.c
new file mode 100644
index 000000000000..a5b2f4762677
--- /dev/null
+++ b/drivers/regulator/mt6397-regulator.c
@@ -0,0 +1,332 @@
+/*
+ * Copyright (c) 2014 MediaTek Inc.
+ * Author: Flora Fu <flora.fu@mediatek.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+#include <linux/mfd/mt6397/core.h>
+#include <linux/mfd/mt6397/registers.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/regulator/mt6397-regulator.h>
+#include <linux/regulator/of_regulator.h>
+/*
+ * MT6397 regulators' information
+ *
+ * @desc: standard fields of regulator description.
+ * @qi: Mask for query enable signal status of regulators
+ * @vselon_reg: Register sections for hardware control mode of bucks
+ * @vselctrl_reg: Register for controlling the buck control mode.
+ * @vselctrl_mask: Mask for query buck's voltage control mode.
+ */
+struct mt6397_regulator_info {
+        struct regulator_desc desc;
+        u32 qi;
+        u32 vselon_reg;
+        u32 vselctrl_reg;
+        u32 vselctrl_mask;
+};
+#define MT6397_BUCK(match, vreg, min, max, step, volt_ranges, enreg,    \
+                vosel, vosel_mask, voselon, vosel_ctrl)                 \
+[MT6397_ID_##vreg] = {                                                  \
+        .desc = {                                                       \
+                .name = #vreg,                                          \
+                .of_match = of_match_ptr(match),                        \
+                .ops = &mt6397_volt_range_ops,                          \
+                .type = REGULATOR_VOLTAGE,                              \
+                .id = MT6397_ID_##vreg,                                 \
+                .owner = THIS_MODULE,                                   \
+                .n_voltages = (max - min)/step + 1,                     \
+                .linear_ranges = volt_ranges,                           \
+                .n_linear_ranges = ARRAY_SIZE(volt_ranges),             \
+                .vsel_reg = vosel,                                      \
+                .vsel_mask = vosel_mask,                                \
+                .enable_reg = enreg,                                    \
+                .enable_mask = BIT(0),                                  \
+        },                                                              \
+        .qi = BIT(13),                                                  \
+        .vselon_reg = voselon,                                          \
+        .vselctrl_reg = vosel_ctrl,                                     \
+        .vselctrl_mask = BIT(1),                                        \
+}
+#define MT6397_LDO(match, vreg, ldo_volt_table, enreg, enbit, vosel,    \
+                vosel_mask)                                             \
+[MT6397_ID_##vreg] = {                                                  \
+        .desc = {                                                       \
+                .name = #vreg,                                          \
+                .of_match = of_match_ptr(match),                        \
+                .ops = &mt6397_volt_table_ops,                          \
+                .type = REGULATOR_VOLTAGE,                              \
+                .id = MT6397_ID_##vreg,                                 \
+                .owner = THIS_MODULE,                                   \
+                .n_voltages = ARRAY_SIZE(ldo_volt_table),               \
+                .volt_table = ldo_volt_table,                           \
+                .vsel_reg = vosel,                                      \
+                .vsel_mask = vosel_mask,                                \
+                .enable_reg = enreg,                                    \
+                .enable_mask = BIT(enbit),                              \
+        },                                                              \
+        .qi = BIT(15),                                                  \
+}
+#define MT6397_REG_FIXED(match, vreg, enreg, enbit, volt)               \
+[MT6397_ID_##vreg] = {                                                  \
+        .desc = {                                                       \
+                .name = #vreg,                                          \
+                .of_match = of_match_ptr(match),                        \
+                .ops = &mt6397_volt_fixed_ops,                          \
+                .type = REGULATOR_VOLTAGE,                              \
+                .id = MT6397_ID_##vreg,                                 \
+                .owner = THIS_MODULE,                                   \
+                .n_voltages = 1,                                        \
+                .enable_reg = enreg,                                    \
+                .enable_mask = BIT(enbit),                              \
+                .min_uV = volt,                                         \
+        },                                                              \
+        .qi = BIT(15),                                                  \
+}
+static const struct regulator_linear_range buck_volt_range1[] = {
+        REGULATOR_LINEAR_RANGE(700000, 0, 0x7f, 6250),
+};
+static const struct regulator_linear_range buck_volt_range2[] = {
+        REGULATOR_LINEAR_RANGE(800000, 0, 0x7f, 6250),
+};
+static const struct regulator_linear_range buck_volt_range3[] = {
+        REGULATOR_LINEAR_RANGE(1500000, 0, 0x1f, 20000),
+};
+static const u32 ldo_volt_table1[] = {
+        1500000, 1800000, 2500000, 2800000,
+};
+static const u32 ldo_volt_table2[] = {
+        1800000, 3300000,
+};
+static const u32 ldo_volt_table3[] = {
+        3000000, 3300000,
+};
+static const u32 ldo_volt_table4[] = {
+        1220000, 1300000, 1500000, 1800000, 2500000, 2800000, 3000000, 3300000,
+};
+static const u32 ldo_volt_table5[] = {
+        1200000, 1300000, 1500000, 1800000, 2500000, 2800000, 3000000, 3300000,
+};
+static const u32 ldo_volt_table5_v2[] = {
+        1200000, 1000000, 1500000, 1800000, 2500000, 2800000, 3000000, 3300000,
+};
+static const u32 ldo_volt_table6[] = {
+        1200000, 1300000, 1500000, 1800000, 2500000, 2800000, 3000000, 2000000,
+};
+static const u32 ldo_volt_table7[] = {
+        1300000, 1500000, 1800000, 2000000, 2500000, 2800000, 3000000, 3300000,
+};
+static int mt6397_get_status(struct regulator_dev *rdev)
+{
+        int ret;
+        u32 regval;
+        struct mt6397_regulator_info *info = rdev_get_drvdata(rdev);
+        ret = regmap_read(rdev->regmap, info->desc.enable_reg, &regval);
+        if (ret != 0) {
+                dev_err(&rdev->dev, "Failed to get enable reg: %d\n", ret);
+                return ret;
+        }
+        return (regval & info->qi) ? REGULATOR_STATUS_ON : REGULATOR_STATUS_OFF;
+}
+static struct regulator_ops mt6397_volt_range_ops = {
+        .list_voltage = regulator_list_voltage_linear_range,
+        .map_voltage = regulator_map_voltage_linear_range,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
+        .set_voltage_time_sel = regulator_set_voltage_time_sel,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+        .is_enabled = regulator_is_enabled_regmap,
+        .get_status = mt6397_get_status,
+};
+static struct regulator_ops mt6397_volt_table_ops = {
+        .list_voltage = regulator_list_voltage_table,
+        .map_voltage = regulator_map_voltage_iterate,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
+        .set_voltage_time_sel = regulator_set_voltage_time_sel,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+        .is_enabled = regulator_is_enabled_regmap,
+        .get_status = mt6397_get_status,
+};
+static struct regulator_ops mt6397_volt_fixed_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+        .is_enabled = regulator_is_enabled_regmap,
+        .get_status = mt6397_get_status,
+};
+/* The array is indexed by id(MT6397_ID_XXX) */
+static struct mt6397_regulator_info mt6397_regulators[] = {
+        MT6397_BUCK("buck_vpca15", VPCA15, 700000, 1493750, 6250,
+                buck_volt_range1, MT6397_VCA15_CON7, MT6397_VCA15_CON9, 0x7f,
+                MT6397_VCA15_CON10, MT6397_VCA15_CON5),
+        MT6397_BUCK("buck_vpca7", VPCA7, 700000, 1493750, 6250,
+                buck_volt_range1, MT6397_VPCA7_CON7, MT6397_VPCA7_CON9, 0x7f,
+                MT6397_VPCA7_CON10, MT6397_VPCA7_CON5),
+        MT6397_BUCK("buck_vsramca15", VSRAMCA15, 700000, 1493750, 6250,
+                buck_volt_range1, MT6397_VSRMCA15_CON7, MT6397_VSRMCA15_CON9,
+                0x7f, MT6397_VSRMCA15_CON10, MT6397_VSRMCA15_CON5),
+        MT6397_BUCK("buck_vsramca7", VSRAMCA7, 700000, 1493750, 6250,
+                buck_volt_range1, MT6397_VSRMCA7_CON7, MT6397_VSRMCA7_CON9,
+                0x7f, MT6397_VSRMCA7_CON10, MT6397_VSRMCA7_CON5),
+        MT6397_BUCK("buck_vcore", VCORE, 700000, 1493750, 6250,
+                buck_volt_range1, MT6397_VCORE_CON7, MT6397_VCORE_CON9, 0x7f,
+                MT6397_VCORE_CON10, MT6397_VCORE_CON5),
+        MT6397_BUCK("buck_vgpu", VGPU, 700000, 1493750, 6250, buck_volt_range1,
+                MT6397_VGPU_CON7, MT6397_VGPU_CON9, 0x7f,
+                MT6397_VGPU_CON10, MT6397_VGPU_CON5),
+        MT6397_BUCK("buck_vdrm", VDRM, 800000, 1593750, 6250, buck_volt_range2,
+                MT6397_VDRM_CON7, MT6397_VDRM_CON9, 0x7f,
+                MT6397_VDRM_CON10, MT6397_VDRM_CON5),
+        MT6397_BUCK("buck_vio18", VIO18, 1500000, 2120000, 20000,
+                buck_volt_range3, MT6397_VIO18_CON7, MT6397_VIO18_CON9, 0x1f,
+                MT6397_VIO18_CON10, MT6397_VIO18_CON5),
+        MT6397_REG_FIXED("ldo_vtcxo", VTCXO, MT6397_ANALDO_CON0, 10, 2800000),
+        MT6397_REG_FIXED("ldo_va28", VA28, MT6397_ANALDO_CON1, 14, 2800000),
+        MT6397_LDO("ldo_vcama", VCAMA, ldo_volt_table1,
+                MT6397_ANALDO_CON2, 15, MT6397_ANALDO_CON6, 0xC0),
+        MT6397_REG_FIXED("ldo_vio28", VIO28, MT6397_DIGLDO_CON0, 14, 2800000),
+        MT6397_REG_FIXED("ldo_vusb", VUSB, MT6397_DIGLDO_CON1, 14, 3300000),
+        MT6397_LDO("ldo_vmc", VMC, ldo_volt_table2,
+                MT6397_DIGLDO_CON2, 12, MT6397_DIGLDO_CON29, 0x10),
+        MT6397_LDO("ldo_vmch", VMCH, ldo_volt_table3,
+                MT6397_DIGLDO_CON3, 14, MT6397_DIGLDO_CON17, 0x80),
+        MT6397_LDO("ldo_vemc3v3", VEMC3V3, ldo_volt_table3,
+                MT6397_DIGLDO_CON4, 14, MT6397_DIGLDO_CON18, 0x10),
+        MT6397_LDO("ldo_vgp1", VGP1, ldo_volt_table4,
+                MT6397_DIGLDO_CON5, 15, MT6397_DIGLDO_CON19, 0xE0),
+        MT6397_LDO("ldo_vgp2", VGP2, ldo_volt_table5,
+                MT6397_DIGLDO_CON6, 15, MT6397_DIGLDO_CON20, 0xE0),
+        MT6397_LDO("ldo_vgp3", VGP3, ldo_volt_table5,
+                MT6397_DIGLDO_CON7, 15, MT6397_DIGLDO_CON21, 0xE0),
+        MT6397_LDO("ldo_vgp4", VGP4, ldo_volt_table5,
+                MT6397_DIGLDO_CON8, 15, MT6397_DIGLDO_CON22, 0xE0),
+        MT6397_LDO("ldo_vgp5", VGP5, ldo_volt_table6,
+                MT6397_DIGLDO_CON9, 15, MT6397_DIGLDO_CON23, 0xE0),
+        MT6397_LDO("ldo_vgp6", VGP6, ldo_volt_table5,
+                MT6397_DIGLDO_CON10, 15, MT6397_DIGLDO_CON33, 0xE0),
+        MT6397_LDO("ldo_vibr", VIBR, ldo_volt_table7,
+                MT6397_DIGLDO_CON24, 15, MT6397_DIGLDO_CON25, 0xE00),
+};
+static int mt6397_set_buck_vosel_reg(struct platform_device *pdev)
+{
+        struct mt6397_chip *mt6397 = dev_get_drvdata(pdev->dev.parent);
+        int i;
+        u32 regval;
+        for (i = 0; i < MT6397_MAX_REGULATOR; i++) {
+                if (mt6397_regulators[i].vselctrl_reg) {
+                        if (regmap_read(mt6397->regmap,
+                                mt6397_regulators[i].vselctrl_reg,
+                                &regval) < 0) {
+                                dev_err(&pdev->dev,
+                                        "Failed to read buck ctrl\n");
+                                return -EIO;
+                        }
+                        if (regval & mt6397_regulators[i].vselctrl_mask) {
+                                mt6397_regulators[i].desc.vsel_reg =
+                                mt6397_regulators[i].vselon_reg;
+                        }
+                }
+        }
+        return 0;
+}
+static int mt6397_regulator_probe(struct platform_device *pdev)
+{
+        struct mt6397_chip *mt6397 = dev_get_drvdata(pdev->dev.parent);
+        struct regulator_config config = {};
+        struct regulator_dev *rdev;
+        int i;
+        u32 reg_value, version;
+        /* Query buck controller to select activated voltage register part */
+        if (mt6397_set_buck_vosel_reg(pdev))
+                return -EIO;
+        /* Read PMIC chip revision to update constraints and voltage table */
+        if (regmap_read(mt6397->regmap, MT6397_CID, &reg_value) < 0) {
+                dev_err(&pdev->dev, "Failed to read Chip ID\n");
+                return -EIO;
+        }
+        dev_info(&pdev->dev, "Chip ID = 0x%x\n", reg_value);
+        version = (reg_value & 0xFF);
+        switch (version) {
+        case MT6397_REGULATOR_ID91:
+                mt6397_regulators[MT6397_ID_VGP2].desc.volt_table =
+                ldo_volt_table5_v2;
+                break;
+        default:
+                break;
+        }
+        for (i = 0; i < MT6397_MAX_REGULATOR; i++) {
+                config.dev = &pdev->dev;
+                config.driver_data = &mt6397_regulators[i];
+                config.regmap = mt6397->regmap;
+                rdev = devm_regulator_register(&pdev->dev,
+                                &mt6397_regulators[i].desc, &config);
+                if (IS_ERR(rdev)) {
+                        dev_err(&pdev->dev, "failed to register %s\n",
+                                mt6397_regulators[i].desc.name);
+                        return PTR_ERR(rdev);
+                }
+        }
+        return 0;
+}
+static struct platform_driver mt6397_regulator_driver = {
+        .driver = {
+                .name = "mt6397-regulator",
+        },
+        .probe = mt6397_regulator_probe,
+};
+module_platform_driver(mt6397_regulator_driver);
+MODULE_AUTHOR("Flora Fu <flora.fu@mediatek.com>");
+MODULE_DESCRIPTION("Regulator Driver for MediaTek MT6397 PMIC");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:mt6397-regulator");
diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
index 91eaaf010524..24e812c48d93 100644
--- a/drivers/regulator/of_regulator.c
+++ b/drivers/regulator/of_regulator.c
@@ -270,6 +270,7 @@ EXPORT_SYMBOL_GPL(of_regulator_match);
 struct regulator_init_data *regulator_of_get_init_data(struct device *dev,
                                            const struct regulator_desc *desc,
+                                            struct regulator_config *config,
                                            struct device_node **node)
 {
        struct device_node *search, *child;
@@ -307,6 +308,16 @@ struct regulator_init_data *regulator_of_get_init_data(struct device *dev,
                        break;
                }
+                if (desc->of_parse_cb) {
+                        if (desc->of_parse_cb(child, desc, config)) {
+                                dev_err(dev,
+                                        "driver callback failed to parse DT for regulator %s\n",
+                                        child->name);
+                                init_data = NULL;
+                                break;
+                        }
+                }
                of_node_get(child);
                *node = child;
                break;
diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
index c879dff597ee..8cc8d1877c44 100644
--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -56,7 +56,7 @@
 #define PFUZE100_VGEN5VOL       0x70
 #define PFUZE100_VGEN6VOL       0x71
-enum chips { PFUZE100, PFUZE200 };
+enum chips { PFUZE100, PFUZE200, PFUZE3000 = 3 };
 struct pfuze_regulator {
        struct regulator_desc desc;
@@ -80,9 +80,18 @@ static const int pfuze100_vsnvs[] = {
        1000000, 1100000, 1200000, 1300000, 1500000, 1800000, 3000000,
 };
+static const int pfuze3000_sw2lo[] = {
+        1500000, 1550000, 1600000, 1650000, 1700000, 1750000, 1800000, 1850000,
+};
+static const int pfuze3000_sw2hi[] = {
+        2500000, 2800000, 2850000, 3000000, 3100000, 3150000, 3200000, 3300000,
+};
 static const struct i2c_device_id pfuze_device_id[] = {
        {.name = "pfuze100", .driver_data = PFUZE100},
        {.name = "pfuze200", .driver_data = PFUZE200},
+        {.name = "pfuze3000", .driver_data = PFUZE3000},
        { }
 };
 MODULE_DEVICE_TABLE(i2c, pfuze_device_id);
@@ -90,6 +99,7 @@ MODULE_DEVICE_TABLE(i2c, pfuze_device_id);
 static const struct of_device_id pfuze_dt_ids[] = {
        { .compatible = "fsl,pfuze100", .data = (void *)PFUZE100},
        { .compatible = "fsl,pfuze200", .data = (void *)PFUZE200},
+        { .compatible = "fsl,pfuze3000", .data = (void *)PFUZE3000},
        { }
 };
 MODULE_DEVICE_TABLE(of, pfuze_dt_ids);
@@ -219,6 +229,60 @@ static struct regulator_ops pfuze100_swb_regulator_ops = {
                .stby_mask = 0x20,      \
        }
+#define PFUZE3000_VCC_REG(_chip, _name, base, min, max, step)   {       \
+        .desc = {       \
+                .name = #_name, \
+                .n_voltages = ((max) - (min)) / (step) + 1,     \
+                .ops = &pfuze100_ldo_regulator_ops,     \
+                .type = REGULATOR_VOLTAGE,      \
+                .id = _chip ## _ ## _name,      \
+                .owner = THIS_MODULE,   \
+                .min_uV = (min),        \
+                .uV_step = (step),      \
+                .vsel_reg = (base),     \
+                .vsel_mask = 0x3,       \
+                .enable_reg = (base),   \
+                .enable_mask = 0x10,    \
+        },      \
+        .stby_reg = (base),     \
+        .stby_mask = 0x20,      \
+}
+#define PFUZE3000_SW2_REG(_chip, _name, base, min, max, step)   {       \
+        .desc = {       \
+                .name = #_name,\
+                .n_voltages = ((max) - (min)) / (step) + 1,     \
+                .ops = &pfuze100_sw_regulator_ops,      \
+                .type = REGULATOR_VOLTAGE,      \
+                .id = _chip ## _ ## _name,      \
+                .owner = THIS_MODULE,   \
+                .min_uV = (min),        \
+                .uV_step = (step),      \
+                .vsel_reg = (base) + PFUZE100_VOL_OFFSET,       \
+                .vsel_mask = 0x7,       \
+        },      \
+        .stby_reg = (base) + PFUZE100_STANDBY_OFFSET,   \
+        .stby_mask = 0x7,       \
+}
+#define PFUZE3000_SW3_REG(_chip, _name, base, min, max, step)   {       \
+        .desc = {       \
+                .name = #_name,\
+                .n_voltages = ((max) - (min)) / (step) + 1,     \
+                .ops = &pfuze100_sw_regulator_ops,      \
+                .type = REGULATOR_VOLTAGE,      \
+                .id = _chip ## _ ## _name,      \
+                .owner = THIS_MODULE,   \
+                .min_uV = (min),        \
+                .uV_step = (step),      \
+                .vsel_reg = (base) + PFUZE100_VOL_OFFSET,       \
+                .vsel_mask = 0xf,       \
+        },      \
+        .stby_reg = (base) + PFUZE100_STANDBY_OFFSET,   \
+        .stby_mask = 0xf,       \
+}
 /* PFUZE100 */
 static struct pfuze_regulator pfuze100_regulators[] = {
        PFUZE100_SW_REG(PFUZE100, SW1AB, PFUZE100_SW1ABVOL, 300000, 1875000, 25000),
@@ -254,6 +318,22 @@ static struct pfuze_regulator pfuze200_regulators[] = {
        PFUZE100_VGEN_REG(PFUZE200, VGEN6, PFUZE100_VGEN6VOL, 1800000, 3300000, 100000),
 };
+static struct pfuze_regulator pfuze3000_regulators[] = {
+        PFUZE100_SW_REG(PFUZE3000, SW1A, PFUZE100_SW1ABVOL, 700000, 1475000, 25000),
+        PFUZE100_SW_REG(PFUZE3000, SW1B, PFUZE100_SW1CVOL, 700000, 1475000, 25000),
+        PFUZE100_SWB_REG(PFUZE3000, SW2, PFUZE100_SW2VOL, 0x7, pfuze3000_sw2lo),
+        PFUZE3000_SW3_REG(PFUZE3000, SW3, PFUZE100_SW3AVOL, 900000, 1650000, 50000),
+        PFUZE100_SWB_REG(PFUZE3000, SWBST, PFUZE100_SWBSTCON1, 0x3, pfuze100_swbst),
+        PFUZE100_SWB_REG(PFUZE3000, VSNVS, PFUZE100_VSNVSVOL, 0x7, pfuze100_vsnvs),
+        PFUZE100_FIXED_REG(PFUZE3000, VREFDDR, PFUZE100_VREFDDRCON, 750000),
+        PFUZE100_VGEN_REG(PFUZE3000, VLDO1, PFUZE100_VGEN1VOL, 1800000, 3300000, 100000),
+        PFUZE100_VGEN_REG(PFUZE3000, VLDO2, PFUZE100_VGEN2VOL, 800000, 1550000, 50000),
+        PFUZE3000_VCC_REG(PFUZE3000, VCCSD, PFUZE100_VGEN3VOL, 2850000, 3300000, 150000),
+        PFUZE3000_VCC_REG(PFUZE3000, V33, PFUZE100_VGEN4VOL, 2850000, 3300000, 150000),
+        PFUZE100_VGEN_REG(PFUZE3000, VLDO3, PFUZE100_VGEN5VOL, 1800000, 3300000, 100000),
+        PFUZE100_VGEN_REG(PFUZE3000, VLDO4, PFUZE100_VGEN6VOL, 1800000, 3300000, 100000),
+};
 static struct pfuze_regulator *pfuze_regulators;
 #ifdef CONFIG_OF
@@ -294,6 +374,24 @@ static struct of_regulator_match pfuze200_matches[] = {
        { .name = "vgen6",      },
 };
+/* PFUZE3000 */
+static struct of_regulator_match pfuze3000_matches[] = {
+        { .name = "sw1a",       },
+        { .name = "sw1b",       },
+        { .name = "sw2",        },
+        { .name = "sw3",        },
+        { .name = "swbst",      },
+        { .name = "vsnvs",      },
+        { .name = "vrefddr",    },
+        { .name = "vldo1",      },
+        { .name = "vldo2",      },
+        { .name = "vccsd",      },
+        { .name = "v33",        },
+        { .name = "vldo3",      },
+        { .name = "vldo4",      },
+};
 static struct of_regulator_match *pfuze_matches;
 static int pfuze_parse_regulators_dt(struct pfuze_chip *chip)
@@ -313,6 +411,11 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip)
        }
        switch (chip->chip_id) {
+        case PFUZE3000:
+                pfuze_matches = pfuze3000_matches;
+                ret = of_regulator_match(dev, parent, pfuze3000_matches,
+                                         ARRAY_SIZE(pfuze3000_matches));
+                break;
        case PFUZE200:
                pfuze_matches = pfuze200_matches;
                ret = of_regulator_match(dev, parent, pfuze200_matches,
@@ -378,7 +481,8 @@ static int pfuze_identify(struct pfuze_chip *pfuze_chip)
                 * as ID=8 in PFUZE100
                 */
                dev_info(pfuze_chip->dev, "Assuming misprogrammed ID=0x8");
-        } else if ((value & 0x0f) != pfuze_chip->chip_id) {
+        } else if ((value & 0x0f) != pfuze_chip->chip_id &&
+                   (value & 0xf0) >> 4 != pfuze_chip->chip_id) {
                /* device id NOT match with your setting */
                dev_warn(pfuze_chip->dev, "Illegal ID: %x\n", value);
                return -ENODEV;
@@ -417,7 +521,7 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
        int i, ret;
        const struct of_device_id *match;
        u32 regulator_num;
-        u32 sw_check_start, sw_check_end;
+        u32 sw_check_start, sw_check_end, sw_hi = 0x40;
        pfuze_chip = devm_kzalloc(&client->dev, sizeof(*pfuze_chip),
                        GFP_KERNEL);
@@ -458,13 +562,19 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
        /* use the right regulators after identify the right device */
        switch (pfuze_chip->chip_id) {
+        case PFUZE3000:
+                pfuze_regulators = pfuze3000_regulators;
+                regulator_num = ARRAY_SIZE(pfuze3000_regulators);
+                sw_check_start = PFUZE3000_SW2;
+                sw_check_end = PFUZE3000_SW2;
+                sw_hi = 1 << 3;
+                break;
        case PFUZE200:
                pfuze_regulators = pfuze200_regulators;
                regulator_num = ARRAY_SIZE(pfuze200_regulators);
                sw_check_start = PFUZE200_SW2;
                sw_check_end = PFUZE200_SW3B;
                break;
        case PFUZE100:
        default:
                pfuze_regulators = pfuze100_regulators;
@@ -474,7 +584,8 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
                break;
        }
        dev_info(&client->dev, "pfuze%s found.\n",
-                (pfuze_chip->chip_id == PFUZE100) ? "100" : "200");
+                (pfuze_chip->chip_id == PFUZE100) ? "100" :
+                ((pfuze_chip->chip_id == PFUZE200) ? "200" : "3000"));
        memcpy(pfuze_chip->regulator_descs, pfuze_regulators,
                sizeof(pfuze_chip->regulator_descs));
@@ -498,10 +609,15 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
                /* SW2~SW4 high bit check and modify the voltage value table */
                if (i >= sw_check_start && i <= sw_check_end) {
                        regmap_read(pfuze_chip->regmap, desc->vsel_reg, &val);
-                        if (val & 0x40) {
+                        if (val & sw_hi) {
-                                desc->min_uV = 800000;
+                                if (pfuze_chip->chip_id == PFUZE3000) {
-                                desc->uV_step = 50000;
+                                        desc->volt_table = pfuze3000_sw2hi;
-                                desc->n_voltages = 51;
+                                        desc->n_voltages = ARRAY_SIZE(pfuze3000_sw2hi);
+                                } else {
+                                        desc->min_uV = 800000;
+                                        desc->uV_step = 50000;
+                                        desc->n_voltages = 51;
+                                }
                        }
                }
diff --git a/drivers/regulator/qcom_rpm-regulator.c b/drivers/regulator/qcom_rpm-regulator.c
index 8364ff331a81..e8647f7cf25e 100644
--- a/drivers/regulator/qcom_rpm-regulator.c
+++ b/drivers/regulator/qcom_rpm-regulator.c
@@ -227,9 +227,11 @@ static int rpm_reg_set_mV_sel(struct regulator_dev *rdev,
                return uV;
        mutex_lock(&vreg->lock);
-        vreg->uV = uV;
        if (vreg->is_enabled)
-                ret = rpm_reg_write(vreg, req, vreg->uV / 1000);
+                ret = rpm_reg_write(vreg, req, uV / 1000);
+        if (!ret)
+                vreg->uV = uV;
        mutex_unlock(&vreg->lock);
        return ret;
@@ -252,9 +254,11 @@ static int rpm_reg_set_uV_sel(struct regulator_dev *rdev,
                return uV;
        mutex_lock(&vreg->lock);
-        vreg->uV = uV;
        if (vreg->is_enabled)
-                ret = rpm_reg_write(vreg, req, vreg->uV);
+                ret = rpm_reg_write(vreg, req, uV);
+        if (!ret)
+                vreg->uV = uV;
        mutex_unlock(&vreg->lock);
        return ret;
@@ -674,6 +678,7 @@ static int rpm_reg_probe(struct platform_device *pdev)
        vreg->desc.owner = THIS_MODULE;
        vreg->desc.type = REGULATOR_VOLTAGE;
        vreg->desc.name = pdev->dev.of_node->name;
+        vreg->desc.supply_name = "vin";
        vreg->rpm = dev_get_drvdata(pdev->dev.parent);
        if (!vreg->rpm) {
@@ -768,7 +773,7 @@ static int rpm_reg_probe(struct platform_device *pdev)
                        break;
                }
-                if (force_mode < 0) {
+                if (force_mode == -1) {
                        dev_err(&pdev->dev, "invalid force mode\n");
                        return -EINVAL;
                }
diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
index c94a3e0f3b91..1f93b752a81c 100644
--- a/drivers/regulator/rk808-regulator.c
+++ b/drivers/regulator/rk808-regulator.c
@@ -97,7 +97,7 @@ static int rk808_set_ramp_delay(struct regulator_dev *rdev, int ramp_delay)
                                  RK808_RAMP_RATE_MASK, ramp_value);
 }
-int rk808_set_suspend_voltage(struct regulator_dev *rdev, int uv)
+static int rk808_set_suspend_voltage(struct regulator_dev *rdev, int uv)
 {
        unsigned int reg;
        int sel = regulator_map_voltage_linear_range(rdev, uv, uv);
@@ -112,7 +112,7 @@ int rk808_set_suspend_voltage(struct regulator_dev *rdev, int uv)
                                  sel);
 }
-int rk808_set_suspend_enable(struct regulator_dev *rdev)
+static int rk808_set_suspend_enable(struct regulator_dev *rdev)
 {
        unsigned int reg;
@@ -123,7 +123,7 @@ int rk808_set_suspend_enable(struct regulator_dev *rdev)
                                  0);
 }
-int rk808_set_suspend_disable(struct regulator_dev *rdev)
+static int rk808_set_suspend_disable(struct regulator_dev *rdev)
 {
        unsigned int reg;
diff --git a/drivers/regulator/rt5033-regulator.c b/drivers/regulator/rt5033-regulator.c
index 870cc49438db..96d2c18e051a 100644
--- a/drivers/regulator/rt5033-regulator.c
+++ b/drivers/regulator/rt5033-regulator.c
@@ -36,6 +36,8 @@ static struct regulator_ops rt5033_buck_ops = {
 static const struct regulator_desc rt5033_supported_regulators[] = {
        [RT5033_BUCK] = {
                .name           = "BUCK",
+                .of_match       = of_match_ptr("BUCK"),
+                .regulators_node = of_match_ptr("regulators"),
                .id             = RT5033_BUCK,
                .ops            = &rt5033_buck_ops,
                .type           = REGULATOR_VOLTAGE,
@@ -50,6 +52,8 @@ static const struct regulator_desc rt5033_supported_regulators[] = {
        },
        [RT5033_LDO] = {
                .name           = "LDO",
+                .of_match       = of_match_ptr("LDO"),
+                .regulators_node = of_match_ptr("regulators"),
                .id             = RT5033_LDO,
                .ops            = &rt5033_buck_ops,
                .type           = REGULATOR_VOLTAGE,
@@ -64,6 +68,8 @@ static const struct regulator_desc rt5033_supported_regulators[] = {
        },
        [RT5033_SAFE_LDO] = {
                .name           = "SAFE_LDO",
+                .of_match       = of_match_ptr("SAFE_LDO"),
+                .regulators_node = of_match_ptr("regulators"),
                .id             = RT5033_SAFE_LDO,
                .ops            = &rt5033_safe_ldo_ops,
                .type           = REGULATOR_VOLTAGE,
@@ -81,7 +87,7 @@ static int rt5033_regulator_probe(struct platform_device *pdev)
        int ret, i;
        struct regulator_config config = {};
-        config.dev = &pdev->dev;
+        config.dev = rt5033->dev;
        config.driver_data = rt5033;
        for (i = 0; i < ARRAY_SIZE(rt5033_supported_regulators); i++) {
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index c1444c3d84c2..ff828117798f 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -405,6 +405,40 @@ static struct regulator_ops s2mps14_reg_ops;
        .enable_mask    = S2MPS14_ENABLE_MASK                   \
 }
+#define regulator_desc_s2mps13_buck7(num, min, step, min_sel) { \
+        .name           = "BUCK"#num,                           \
+        .id             = S2MPS13_BUCK##num,                    \
+        .ops            = &s2mps14_reg_ops,                     \
+        .type           = REGULATOR_VOLTAGE,                    \
+        .owner          = THIS_MODULE,                          \
+        .min_uV         = min,                                  \
+        .uV_step        = step,                                 \
+        .linear_min_sel = min_sel,                              \
+        .n_voltages     = S2MPS14_BUCK_N_VOLTAGES,              \
+        .ramp_delay     = S2MPS13_BUCK_RAMP_DELAY,              \
+        .vsel_reg       = S2MPS13_REG_B1OUT + (num) * 2 - 1,    \
+        .vsel_mask      = S2MPS14_BUCK_VSEL_MASK,               \
+        .enable_reg     = S2MPS13_REG_B1CTRL + (num - 1) * 2,   \
+        .enable_mask    = S2MPS14_ENABLE_MASK                   \
+}
+#define regulator_desc_s2mps13_buck8_10(num, min, step, min_sel) {      \
+        .name           = "BUCK"#num,                           \
+        .id             = S2MPS13_BUCK##num,                    \
+        .ops            = &s2mps14_reg_ops,                     \
+        .type           = REGULATOR_VOLTAGE,                    \
+        .owner          = THIS_MODULE,                          \
+        .min_uV         = min,                                  \
+        .uV_step        = step,                                 \
+        .linear_min_sel = min_sel,                              \
+        .n_voltages     = S2MPS14_BUCK_N_VOLTAGES,              \
+        .ramp_delay     = S2MPS13_BUCK_RAMP_DELAY,              \
+        .vsel_reg       = S2MPS13_REG_B1OUT + (num) * 2 - 1,    \
+        .vsel_mask      = S2MPS14_BUCK_VSEL_MASK,               \
+        .enable_reg     = S2MPS13_REG_B1CTRL + (num) * 2 - 1,   \
+        .enable_mask    = S2MPS14_ENABLE_MASK                   \
+}
 static const struct regulator_desc s2mps13_regulators[] = {
        regulator_desc_s2mps13_ldo(1,  MIN_800_MV,  STEP_12_5_MV, 0x00),
        regulator_desc_s2mps13_ldo(2,  MIN_1400_MV, STEP_50_MV,   0x0C),
@@ -452,10 +486,10 @@ static const struct regulator_desc s2mps13_regulators[] = {
        regulator_desc_s2mps13_buck(4,  MIN_500_MV,  STEP_6_25_MV, 0x10),
        regulator_desc_s2mps13_buck(5,  MIN_500_MV,  STEP_6_25_MV, 0x10),
        regulator_desc_s2mps13_buck(6,  MIN_500_MV,  STEP_6_25_MV, 0x10),
-        regulator_desc_s2mps13_buck(7,  MIN_500_MV,  STEP_6_25_MV, 0x10),
+        regulator_desc_s2mps13_buck7(7,  MIN_500_MV,  STEP_6_25_MV, 0x10),
-        regulator_desc_s2mps13_buck(8,  MIN_1000_MV, STEP_12_5_MV, 0x20),
+        regulator_desc_s2mps13_buck8_10(8,  MIN_1000_MV, STEP_12_5_MV, 0x20),
-        regulator_desc_s2mps13_buck(9,  MIN_1000_MV, STEP_12_5_MV, 0x20),
+        regulator_desc_s2mps13_buck8_10(9,  MIN_1000_MV, STEP_12_5_MV, 0x20),
-        regulator_desc_s2mps13_buck(10, MIN_500_MV,  STEP_6_25_MV, 0x10),
+        regulator_desc_s2mps13_buck8_10(10, MIN_500_MV,  STEP_6_25_MV, 0x10),
 };
 static int s2mps14_regulator_enable(struct regulator_dev *rdev)
@@ -570,7 +604,7 @@ static struct regulator_ops s2mps14_reg_ops = {
        .enable_mask    = S2MPS14_ENABLE_MASK           \
 }
-#define regulator_desc_s2mps14_buck(num, min, step) {           \
+#define regulator_desc_s2mps14_buck(num, min, step, min_sel) {  \
        .name           = "BUCK"#num,                           \
        .id             = S2MPS14_BUCK##num,                    \
        .ops            = &s2mps14_reg_ops,                     \
@@ -579,7 +613,7 @@ static struct regulator_ops s2mps14_reg_ops = {
        .min_uV         = min,                                  \
        .uV_step        = step,                                 \
        .n_voltages     = S2MPS14_BUCK_N_VOLTAGES,              \
-        .linear_min_sel = S2MPS14_BUCK1235_START_SEL,           \
+        .linear_min_sel = min_sel,                              \
        .ramp_delay     = S2MPS14_BUCK_RAMP_DELAY,              \
        .vsel_reg       = S2MPS14_REG_B1CTRL2 + (num - 1) * 2,  \
        .vsel_mask      = S2MPS14_BUCK_VSEL_MASK,               \
@@ -613,11 +647,16 @@ static const struct regulator_desc s2mps14_regulators[] = {
        regulator_desc_s2mps14_ldo(23, MIN_800_MV, STEP_25_MV),
        regulator_desc_s2mps14_ldo(24, MIN_1800_MV, STEP_25_MV),
        regulator_desc_s2mps14_ldo(25, MIN_1800_MV, STEP_25_MV),
-        regulator_desc_s2mps14_buck(1, MIN_600_MV, STEP_6_25_MV),
+        regulator_desc_s2mps14_buck(1, MIN_600_MV, STEP_6_25_MV,
-        regulator_desc_s2mps14_buck(2, MIN_600_MV, STEP_6_25_MV),
+                                    S2MPS14_BUCK1235_START_SEL),
-        regulator_desc_s2mps14_buck(3, MIN_600_MV, STEP_6_25_MV),
+        regulator_desc_s2mps14_buck(2, MIN_600_MV, STEP_6_25_MV,
-        regulator_desc_s2mps14_buck(4, MIN_1400_MV, STEP_12_5_MV),
+                                    S2MPS14_BUCK1235_START_SEL),
-        regulator_desc_s2mps14_buck(5, MIN_600_MV, STEP_6_25_MV),
+        regulator_desc_s2mps14_buck(3, MIN_600_MV, STEP_6_25_MV,
+                                    S2MPS14_BUCK1235_START_SEL),
+        regulator_desc_s2mps14_buck(4, MIN_1400_MV, STEP_12_5_MV,
+                                    S2MPS14_BUCK4_START_SEL),
+        regulator_desc_s2mps14_buck(5, MIN_600_MV, STEP_6_25_MV,
+                                    S2MPS14_BUCK1235_START_SEL),
 };
 static int s2mps14_pmic_enable_ext_control(struct s2mps11_info *s2mps11,
diff --git a/drivers/regulator/tps65023-regulator.c b/drivers/regulator/tps65023-regulator.c
index 7380af8bd50d..b941e564b3f3 100644
--- a/drivers/regulator/tps65023-regulator.c
+++ b/drivers/regulator/tps65023-regulator.c
@@ -173,7 +173,7 @@ static int tps65023_dcdc_set_voltage_sel(struct regulator_dev *dev,
 }
 /* Operations permitted on VDCDCx */
-static struct regulator_ops tps65023_dcdc_ops = {
+static const struct regulator_ops tps65023_dcdc_ops = {
        .is_enabled = regulator_is_enabled_regmap,
        .enable = regulator_enable_regmap,
        .disable = regulator_disable_regmap,
@@ -184,7 +184,7 @@ static struct regulator_ops tps65023_dcdc_ops = {
 };
 /* Operations permitted on LDOx */
-static struct regulator_ops tps65023_ldo_ops = {
+static const struct regulator_ops tps65023_ldo_ops = {
        .is_enabled = regulator_is_enabled_regmap,
        .enable = regulator_enable_regmap,
        .disable = regulator_disable_regmap,
@@ -194,7 +194,7 @@ static struct regulator_ops tps65023_ldo_ops = {
        .map_voltage = regulator_map_voltage_ascend,
 };
-static struct regmap_config tps65023_regmap_config = {
+static const struct regmap_config tps65023_regmap_config = {
        .reg_bits = 8,
        .val_bits = 8,
 };
diff --git a/drivers/reset/reset-sunxi.c b/drivers/reset/reset-sunxi.c
index eebc52cb6984..3d95c87160b3 100644
--- a/drivers/reset/reset-sunxi.c
+++ b/drivers/reset/reset-sunxi.c
@@ -102,6 +102,8 @@ static int sunxi_reset_init(struct device_node *np)
                goto err_alloc;
        }
+        spin_lock_init(&data->lock);
        data->rcdev.owner = THIS_MODULE;
        data->rcdev.nr_resets = size * 32;
        data->rcdev.ops = &sunxi_reset_ops;
@@ -157,6 +159,8 @@ static int sunxi_reset_probe(struct platform_device *pdev)
        if (IS_ERR(data->membase))
                return PTR_ERR(data->membase);
+        spin_lock_init(&data->lock);
        data->rcdev.owner = THIS_MODULE;
        data->rcdev.nr_resets = resource_size(res) * 32;
        data->rcdev.ops = &sunxi_reset_ops;
diff --git a/drivers/rtc/hctosys.c b/drivers/rtc/hctosys.c
index 4aa60d74004e..6c719f23520a 100644
--- a/drivers/rtc/hctosys.c
+++ b/drivers/rtc/hctosys.c
@@ -26,7 +26,7 @@ static int __init rtc_hctosys(void)
 {
        int err = -ENODEV;
        struct rtc_time tm;
-        struct timespec tv = {
+        struct timespec64 tv64 = {
                .tv_nsec = NSEC_PER_SEC >> 1,
        };
        struct rtc_device *rtc = rtc_class_open(CONFIG_RTC_HCTOSYS_DEVICE);
@@ -45,25 +45,17 @@ static int __init rtc_hctosys(void)
        }
-        err = rtc_valid_tm(&tm);
+        tv64.tv_sec = rtc_tm_to_time64(&tm);
-        if (err) {
-                dev_err(rtc->dev.parent,
-                        "hctosys: invalid date/time\n");
-                goto err_invalid;
-        }
-        rtc_tm_to_time(&tm, &tv.tv_sec);
-        err = do_settimeofday(&tv);
+        err = do_settimeofday64(&tv64);
        dev_info(rtc->dev.parent,
                "setting system clock to "
-                "%d-%02d-%02d %02d:%02d:%02d UTC (%u)\n",
+                "%d-%02d-%02d %02d:%02d:%02d UTC (%lld)\n",
                tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
                tm.tm_hour, tm.tm_min, tm.tm_sec,
-                (unsigned int) tv.tv_sec);
+                (long long) tv64.tv_sec);
-err_invalid:
 err_read:
        rtc_class_close(rtc);
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 45bfc28ee3aa..37215cf983e9 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -73,10 +73,8 @@ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm)
        else if (rtc->ops->set_time)
                err = rtc->ops->set_time(rtc->dev.parent, tm);
        else if (rtc->ops->set_mmss) {
-                unsigned long secs;
+                time64_t secs64 = rtc_tm_to_time64(tm);
-                err = rtc_tm_to_time(tm, &secs);
+                err = rtc->ops->set_mmss(rtc->dev.parent, secs64);
-                if (err == 0)
-                        err = rtc->ops->set_mmss(rtc->dev.parent, secs);
        } else
                err = -EINVAL;
@@ -105,7 +103,7 @@ int rtc_set_mmss(struct rtc_device *rtc, unsigned long secs)
                err = rtc->ops->read_time(rtc->dev.parent, &old);
                if (err == 0) {
-                        rtc_time_to_tm(secs, &new);
+                        rtc_time64_to_tm(secs, &new);
                        /*
                         * avoid writing when we're going to change the day of
@@ -157,7 +155,7 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
        int err;
        struct rtc_time before, now;
        int first_time = 1;
-        unsigned long t_now, t_alm;
+        time64_t t_now, t_alm;
        enum { none, day, month, year } missing = none;
        unsigned days;
@@ -258,8 +256,8 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
        }
        /* with luck, no rollover is needed */
-        rtc_tm_to_time(&now, &t_now);
+        t_now = rtc_tm_to_time64(&now);
-        rtc_tm_to_time(&alarm->time, &t_alm);
+        t_alm = rtc_tm_to_time64(&alarm->time);
        if (t_now < t_alm)
                goto done;
@@ -273,7 +271,7 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
        case day:
                dev_dbg(&rtc->dev, "alarm rollover: %s\n", "day");
                t_alm += 24 * 60 * 60;
-                rtc_time_to_tm(t_alm, &alarm->time);
+                rtc_time64_to_tm(t_alm, &alarm->time);
                break;
        /* Month rollover ... if it's the 31th, an alarm on the 3rd will
@@ -346,19 +344,19 @@ EXPORT_SYMBOL_GPL(rtc_read_alarm);
 static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
 {
        struct rtc_time tm;
-        long now, scheduled;
+        time64_t now, scheduled;
        int err;
        err = rtc_valid_tm(&alarm->time);
        if (err)
                return err;
-        rtc_tm_to_time(&alarm->time, &scheduled);
+        scheduled = rtc_tm_to_time64(&alarm->time);
        /* Make sure we're not setting alarms in the past */
        err = __rtc_read_time(rtc, &tm);
        if (err)
                return err;
-        rtc_tm_to_time(&tm, &now);
+        now = rtc_tm_to_time64(&tm);
        if (scheduled <= now)
                return -ETIME;
        /*
diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
index d04939369251..799c34bcb26f 100644
--- a/drivers/rtc/rtc-dev.c
+++ b/drivers/rtc/rtc-dev.c
@@ -304,12 +304,12 @@ static long rtc_dev_ioctl(struct file *file,
                 * Not supported here.
                 */
                {
-                        unsigned long now, then;
+                        time64_t now, then;
                        err = rtc_read_time(rtc, &tm);
                        if (err < 0)
                                return err;
-                        rtc_tm_to_time(&tm, &now);
+                        now = rtc_tm_to_time64(&tm);
                        alarm.time.tm_mday = tm.tm_mday;
                        alarm.time.tm_mon = tm.tm_mon;
@@ -317,11 +317,11 @@ static long rtc_dev_ioctl(struct file *file,
                        err  = rtc_valid_tm(&alarm.time);
                        if (err < 0)
                                return err;
-                        rtc_tm_to_time(&alarm.time, &then);
+                        then = rtc_tm_to_time64(&alarm.time);
                        /* alarm may need to wrap into tomorrow */
                        if (then < now) {
-                                rtc_time_to_tm(now + 24 * 60 * 60, &tm);
+                                rtc_time64_to_tm(now + 24 * 60 * 60, &tm);
                                alarm.time.tm_mday = tm.tm_mday;
                                alarm.time.tm_mon = tm.tm_mon;
                                alarm.time.tm_year = tm.tm_year;
diff --git a/drivers/rtc/rtc-efi.c b/drivers/rtc/rtc-efi.c
index b37b0c80bd5a..cb989cd00b14 100644
--- a/drivers/rtc/rtc-efi.c
+++ b/drivers/rtc/rtc-efi.c
@@ -218,6 +218,7 @@ static int __init efi_rtc_probe(struct platform_device *dev)
        if (IS_ERR(rtc))
                return PTR_ERR(rtc);
+        rtc->uie_unsupported = 1;
        platform_set_drvdata(dev, rtc);
        return 0;
diff --git a/drivers/rtc/rtc-s5m.c b/drivers/rtc/rtc-s5m.c
index b5e7c4670205..89ac1d5083c6 100644
--- a/drivers/rtc/rtc-s5m.c
+++ b/drivers/rtc/rtc-s5m.c
@@ -832,6 +832,7 @@ static SIMPLE_DEV_PM_OPS(s5m_rtc_pm_ops, s5m_rtc_suspend, s5m_rtc_resume);
 static const struct platform_device_id s5m_rtc_id[] = {
        { "s5m-rtc",            S5M8767X },
        { "s2mps14-rtc",        S2MPS14X },
+        { },
 };
 static struct platform_driver s5m_rtc_driver = {
diff --git a/drivers/rtc/systohc.c b/drivers/rtc/systohc.c
index bf3e242ccc5c..eb71872d0361 100644
--- a/drivers/rtc/systohc.c
+++ b/drivers/rtc/systohc.c
@@ -20,16 +20,16 @@
 *
 * If temporary failure is indicated the caller should try again 'soon'
 */
-int rtc_set_ntp_time(struct timespec now)
+int rtc_set_ntp_time(struct timespec64 now)
 {
        struct rtc_device *rtc;
        struct rtc_time tm;
        int err = -ENODEV;
        if (now.tv_nsec < (NSEC_PER_SEC >> 1))
-                rtc_time_to_tm(now.tv_sec, &tm);
+                rtc_time64_to_tm(now.tv_sec, &tm);
        else
-                rtc_time_to_tm(now.tv_sec + 1, &tm);
+                rtc_time64_to_tm(now.tv_sec + 1, &tm);
        rtc = rtc_class_open(CONFIG_RTC_HCTOSYS_DEVICE);
        if (rtc) {
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 91e97ec01418..4d41bf75c233 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -1163,9 +1163,13 @@ static inline int ap_test_config_card_id(unsigned int id)
 */
 static inline int ap_test_config_domain(unsigned int domain)
 {
-        if (!ap_configuration)
+        if (!ap_configuration)    /* QCI not supported */
-                return 1;
+                if (domain < 16)
-        return ap_test_config(ap_configuration->aqm, domain);
+                        return 1; /* then domains 0...15 are configured */
+                else
+                        return 0;
+        else
+                return ap_test_config(ap_configuration->aqm, domain);
 }
 /**
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index f407e3763432..642c77c76b84 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1784,6 +1784,8 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel,
        QETH_DBF_TEXT(SETUP, 2, "idxanswr");
        card = CARD_FROM_CDEV(channel->ccwdev);
        iob = qeth_get_buffer(channel);
+        if (!iob)
+                return -ENOMEM;
        iob->callback = idx_reply_cb;
        memcpy(&channel->ccw, READ_CCW, sizeof(struct ccw1));
        channel->ccw.count = QETH_BUFSIZE;
@@ -1834,6 +1836,8 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
        QETH_DBF_TEXT(SETUP, 2, "idxactch");
        iob = qeth_get_buffer(channel);
+        if (!iob)
+                return -ENOMEM;
        iob->callback = idx_reply_cb;
        memcpy(&channel->ccw, WRITE_CCW, sizeof(struct ccw1));
        channel->ccw.count = IDX_ACTIVATE_SIZE;
@@ -2021,10 +2025,36 @@ void qeth_prepare_control_data(struct qeth_card *card, int len,
 }
 EXPORT_SYMBOL_GPL(qeth_prepare_control_data);
+/**
+ * qeth_send_control_data() -   send control command to the card
+ * @card:                       qeth_card structure pointer
+ * @len:                        size of the command buffer
+ * @iob:                        qeth_cmd_buffer pointer
+ * @reply_cb:                   callback function pointer
+ * @cb_card:                    pointer to the qeth_card structure
+ * @cb_reply:                   pointer to the qeth_reply structure
+ * @cb_cmd:                     pointer to the original iob for non-IPA
+ *                              commands, or to the qeth_ipa_cmd structure
+ *                              for the IPA commands.
+ * @reply_param:                private pointer passed to the callback
+ *
+ * Returns the value of the `return_code' field of the response
+ * block returned from the hardware, or other error indication.
+ * Value of zero indicates successful execution of the command.
+ *
+ * Callback function gets called one or more times, with cb_cmd
+ * pointing to the response returned by the hardware. Callback
+ * function must return non-zero if more reply blocks are expected,
+ * and zero if the last or only reply block is received. Callback
+ * function can get the value of the reply_param pointer from the
+ * field 'param' of the structure qeth_reply.
+ */
 int qeth_send_control_data(struct qeth_card *card, int len,
                struct qeth_cmd_buffer *iob,
-                int (*reply_cb)(struct qeth_card *, struct qeth_reply *,
+                int (*reply_cb)(struct qeth_card *cb_card,
-                        unsigned long),
+                                struct qeth_reply *cb_reply,
+                                unsigned long cb_cmd),
                void *reply_param)
 {
        int rc;
@@ -2914,9 +2944,16 @@ struct qeth_cmd_buffer *qeth_get_ipacmd_buffer(struct qeth_card *card,
        struct qeth_cmd_buffer *iob;
        struct qeth_ipa_cmd *cmd;
-        iob = qeth_wait_for_buffer(&card->write);
+        iob = qeth_get_buffer(&card->write);
-        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
+        if (iob) {
-        qeth_fill_ipacmd_header(card, cmd, ipacmd, prot);
+                cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
+                qeth_fill_ipacmd_header(card, cmd, ipacmd, prot);
+        } else {
+                dev_warn(&card->gdev->dev,
+                         "The qeth driver ran out of channel command buffers\n");
+                QETH_DBF_MESSAGE(1, "%s The qeth driver ran out of channel command buffers",
+                                 dev_name(&card->gdev->dev));
+        }
        return iob;
 }
@@ -2932,6 +2969,12 @@ void qeth_prepare_ipa_cmd(struct qeth_card *card, struct qeth_cmd_buffer *iob,
 }
 EXPORT_SYMBOL_GPL(qeth_prepare_ipa_cmd);
+/**
+ * qeth_send_ipa_cmd() - send an IPA command
+ *
+ * See qeth_send_control_data() for explanation of the arguments.
+ */
 int qeth_send_ipa_cmd(struct qeth_card *card, struct qeth_cmd_buffer *iob,
                int (*reply_cb)(struct qeth_card *, struct qeth_reply*,
                        unsigned long),
@@ -2968,6 +3011,8 @@ int qeth_send_startlan(struct qeth_card *card)
        QETH_DBF_TEXT(SETUP, 2, "strtlan");
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_STARTLAN, 0);
+        if (!iob)
+                return -ENOMEM;
        rc = qeth_send_ipa_cmd(card, iob, NULL, NULL);
        return rc;
 }
@@ -3013,11 +3058,13 @@ static struct qeth_cmd_buffer *qeth_get_adapter_cmd(struct qeth_card *card,
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETADAPTERPARMS,
                                     QETH_PROT_IPV4);
-        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
+        if (iob) {
-        cmd->data.setadapterparms.hdr.cmdlength = cmdlen;
+                cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
-        cmd->data.setadapterparms.hdr.command_code = command;
+                cmd->data.setadapterparms.hdr.cmdlength = cmdlen;
-        cmd->data.setadapterparms.hdr.used_total = 1;
+                cmd->data.setadapterparms.hdr.command_code = command;
-        cmd->data.setadapterparms.hdr.seq_no = 1;
+                cmd->data.setadapterparms.hdr.used_total = 1;
+                cmd->data.setadapterparms.hdr.seq_no = 1;
+        }
        return iob;
 }
@@ -3030,6 +3077,8 @@ int qeth_query_setadapterparms(struct qeth_card *card)
        QETH_CARD_TEXT(card, 3, "queryadp");
        iob = qeth_get_adapter_cmd(card, IPA_SETADP_QUERY_COMMANDS_SUPPORTED,
                                   sizeof(struct qeth_ipacmd_setadpparms));
+        if (!iob)
+                return -ENOMEM;
        rc = qeth_send_ipa_cmd(card, iob, qeth_query_setadapterparms_cb, NULL);
        return rc;
 }
@@ -3080,6 +3129,8 @@ int qeth_query_ipassists(struct qeth_card *card, enum qeth_prot_versions prot)
        QETH_DBF_TEXT_(SETUP, 2, "qipassi%i", prot);
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_QIPASSIST, prot);
+        if (!iob)
+                return -ENOMEM;
        rc = qeth_send_ipa_cmd(card, iob, qeth_query_ipassists_cb, NULL);
        return rc;
 }
@@ -3119,6 +3170,8 @@ int qeth_query_switch_attributes(struct qeth_card *card,
                return -ENOMEDIUM;
        iob = qeth_get_adapter_cmd(card, IPA_SETADP_QUERY_SWITCH_ATTRIBUTES,
                                sizeof(struct qeth_ipacmd_setadpparms_hdr));
+        if (!iob)
+                return -ENOMEM;
        return qeth_send_ipa_cmd(card, iob,
                                qeth_query_switch_attributes_cb, sw_info);
 }
@@ -3146,6 +3199,8 @@ static int qeth_query_setdiagass(struct qeth_card *card)
        QETH_DBF_TEXT(SETUP, 2, "qdiagass");
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SET_DIAG_ASS, 0);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        cmd->data.diagass.subcmd_len = 16;
        cmd->data.diagass.subcmd = QETH_DIAGS_CMD_QUERY;
@@ -3197,6 +3252,8 @@ int qeth_hw_trap(struct qeth_card *card, enum qeth_diags_trap_action action)
        QETH_DBF_TEXT(SETUP, 2, "diagtrap");
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SET_DIAG_ASS, 0);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        cmd->data.diagass.subcmd_len = 80;
        cmd->data.diagass.subcmd = QETH_DIAGS_CMD_TRAP;
@@ -4162,6 +4219,8 @@ void qeth_setadp_promisc_mode(struct qeth_card *card)
        iob = qeth_get_adapter_cmd(card, IPA_SETADP_SET_PROMISC_MODE,
                        sizeof(struct qeth_ipacmd_setadpparms));
+        if (!iob)
+                return;
        cmd = (struct qeth_ipa_cmd *)(iob->data + IPA_PDU_HEADER_SIZE);
        cmd->data.setadapterparms.data.mode = mode;
        qeth_send_ipa_cmd(card, iob, qeth_setadp_promisc_mode_cb, NULL);
@@ -4232,6 +4291,8 @@ int qeth_setadpparms_change_macaddr(struct qeth_card *card)
        iob = qeth_get_adapter_cmd(card, IPA_SETADP_ALTER_MAC_ADDRESS,
                                   sizeof(struct qeth_ipacmd_setadpparms));
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        cmd->data.setadapterparms.data.change_addr.cmd = CHANGE_ADDR_READ_MAC;
        cmd->data.setadapterparms.data.change_addr.addr_size = OSA_ADDR_LEN;
@@ -4345,6 +4406,8 @@ static int qeth_setadpparms_set_access_ctrl(struct qeth_card *card,
        iob = qeth_get_adapter_cmd(card, IPA_SETADP_SET_ACCESS_CONTROL,
                                   sizeof(struct qeth_ipacmd_setadpparms_hdr) +
                                   sizeof(struct qeth_set_access_ctrl));
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        access_ctrl_req = &cmd->data.setadapterparms.data.set_access_ctrl;
        access_ctrl_req->subcmd_code = isolation;
@@ -4588,6 +4651,10 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
        iob = qeth_get_adapter_cmd(card, IPA_SETADP_SET_SNMP_CONTROL,
                                   QETH_SNMP_SETADP_CMDLENGTH + req_len);
+        if (!iob) {
+                rc = -ENOMEM;
+                goto out;
+        }
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        memcpy(&cmd->data.setadapterparms.data.snmp, &ureq->cmd, req_len);
        rc = qeth_send_ipa_snmp_cmd(card, iob, QETH_SETADP_BASE_LEN + req_len,
@@ -4599,7 +4666,7 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
                if (copy_to_user(udata, qinfo.udata, qinfo.udata_len))
                        rc = -EFAULT;
        }
+out:
        kfree(ureq);
        kfree(qinfo.udata);
        return rc;
@@ -4670,6 +4737,10 @@ int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
        iob = qeth_get_adapter_cmd(card, IPA_SETADP_QUERY_OAT,
                                   sizeof(struct qeth_ipacmd_setadpparms_hdr) +
                                   sizeof(struct qeth_query_oat));
+        if (!iob) {
+                rc = -ENOMEM;
+                goto out_free;
+        }
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        oat_req = &cmd->data.setadapterparms.data.query_oat;
        oat_req->subcmd_code = oat_data.command;
@@ -4735,6 +4806,8 @@ static int qeth_query_card_info(struct qeth_card *card,
                return -EOPNOTSUPP;
        iob = qeth_get_adapter_cmd(card, IPA_SETADP_QUERY_CARD_INFO,
                sizeof(struct qeth_ipacmd_setadpparms_hdr));
+        if (!iob)
+                return -ENOMEM;
        return qeth_send_ipa_cmd(card, iob, qeth_query_card_info_cb,
                                        (void *)carrier_info);
 }
@@ -5060,11 +5133,23 @@ retriable:
        card->options.adp.supported_funcs = 0;
        card->options.sbp.supported_funcs = 0;
        card->info.diagass_support = 0;
-        qeth_query_ipassists(card, QETH_PROT_IPV4);
+        rc = qeth_query_ipassists(card, QETH_PROT_IPV4);
-        if (qeth_is_supported(card, IPA_SETADAPTERPARMS))
+        if (rc == -ENOMEM)
-                qeth_query_setadapterparms(card);
+                goto out;
-        if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST))
+        if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) {
-                qeth_query_setdiagass(card);
+                rc = qeth_query_setadapterparms(card);
+                if (rc < 0) {
+                        QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+                        goto out;
+                }
+        }
+        if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) {
+                rc = qeth_query_setdiagass(card);
+                if (rc < 0) {
+                        QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
+                        goto out;
+                }
+        }
        return 0;
 out:
        dev_warn(&card->gdev->dev, "The qeth device driver failed to recover "
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index d02cd1a67943..ce87ae72edbd 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -27,10 +27,7 @@ static int qeth_l2_set_offline(struct ccwgroup_device *);
 static int qeth_l2_stop(struct net_device *);
 static int qeth_l2_send_delmac(struct qeth_card *, __u8 *);
 static int qeth_l2_send_setdelmac(struct qeth_card *, __u8 *,
-                           enum qeth_ipa_cmds,
+                           enum qeth_ipa_cmds);
-                           int (*reply_cb) (struct qeth_card *,
-                                            struct qeth_reply*,
-                                            unsigned long));
 static void qeth_l2_set_multicast_list(struct net_device *);
 static int qeth_l2_recover(void *);
 static void qeth_bridgeport_query_support(struct qeth_card *card);
@@ -130,56 +127,71 @@ static struct net_device *qeth_l2_netdev_by_devno(unsigned char *read_dev_no)
        return ndev;
 }
-static int qeth_l2_send_setgroupmac_cb(struct qeth_card *card,
+static int qeth_setdel_makerc(struct qeth_card *card, int retcode)
-                                struct qeth_reply *reply,
-                                unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        int rc;
-        __u8 *mac;
-        QETH_CARD_TEXT(card, 2, "L2Sgmacb");
+        if (retcode)
-        cmd = (struct qeth_ipa_cmd *) data;
+                QETH_CARD_TEXT_(card, 2, "err%04x", retcode);
-        mac = &cmd->data.setdelmac.mac[0];
+        switch (retcode) {
-        /* MAC already registered, needed in couple/uncouple case */
+        case IPA_RC_SUCCESS:
-        if (cmd->hdr.return_code ==  IPA_RC_L2_DUP_MAC) {
+                rc = 0;
-                QETH_DBF_MESSAGE(2, "Group MAC %pM already existing on %s \n",
+                break;
-                          mac, QETH_CARD_IFNAME(card));
+        case IPA_RC_L2_UNSUPPORTED_CMD:
-                cmd->hdr.return_code = 0;
+                rc = -ENOSYS;
+                break;
+        case IPA_RC_L2_ADDR_TABLE_FULL:
+                rc = -ENOSPC;
+                break;
+        case IPA_RC_L2_DUP_MAC:
+        case IPA_RC_L2_DUP_LAYER3_MAC:
+                rc = -EEXIST;
+                break;
+        case IPA_RC_L2_MAC_NOT_AUTH_BY_HYP:
+        case IPA_RC_L2_MAC_NOT_AUTH_BY_ADP:
+                rc = -EPERM;
+                break;
+        case IPA_RC_L2_MAC_NOT_FOUND:
+                rc = -ENOENT;
+                break;
+        case -ENOMEM:
+                rc = -ENOMEM;
+                break;
+        default:
+                rc = -EIO;
+                break;
        }
-        if (cmd->hdr.return_code)
+        return rc;
-                QETH_DBF_MESSAGE(2, "Could not set group MAC %pM on %s: %x\n",
-                          mac, QETH_CARD_IFNAME(card), cmd->hdr.return_code);
-        return 0;
 }
 static int qeth_l2_send_setgroupmac(struct qeth_card *card, __u8 *mac)
 {
-        QETH_CARD_TEXT(card, 2, "L2Sgmac");
+        int rc;
-        return qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETGMAC,
-                                          qeth_l2_send_setgroupmac_cb);
-}
-static int qeth_l2_send_delgroupmac_cb(struct qeth_card *card,
-                                struct qeth_reply *reply,
-                                unsigned long data)
-{
-        struct qeth_ipa_cmd *cmd;
-        __u8 *mac;
-        QETH_CARD_TEXT(card, 2, "L2Dgmacb");
+        QETH_CARD_TEXT(card, 2, "L2Sgmac");
-        cmd = (struct qeth_ipa_cmd *) data;
+        rc = qeth_setdel_makerc(card, qeth_l2_send_setdelmac(card, mac,
-        mac = &cmd->data.setdelmac.mac[0];
+                                        IPA_CMD_SETGMAC));
-        if (cmd->hdr.return_code)
+        if (rc == -EEXIST)
-                QETH_DBF_MESSAGE(2, "Could not delete group MAC %pM on %s: %x\n",
+                QETH_DBF_MESSAGE(2, "Group MAC %pM already existing on %s\n",
-                          mac, QETH_CARD_IFNAME(card), cmd->hdr.return_code);
+                        mac, QETH_CARD_IFNAME(card));
-        return 0;
+        else if (rc)
+                QETH_DBF_MESSAGE(2, "Could not set group MAC %pM on %s: %d\n",
+                        mac, QETH_CARD_IFNAME(card), rc);
+        return rc;
 }
 static int qeth_l2_send_delgroupmac(struct qeth_card *card, __u8 *mac)
 {
+        int rc;
        QETH_CARD_TEXT(card, 2, "L2Dgmac");
-        return qeth_l2_send_setdelmac(card, mac, IPA_CMD_DELGMAC,
+        rc = qeth_setdel_makerc(card, qeth_l2_send_setdelmac(card, mac,
-                                          qeth_l2_send_delgroupmac_cb);
+                                        IPA_CMD_DELGMAC));
+        if (rc)
+                QETH_DBF_MESSAGE(2,
+                        "Could not delete group MAC %pM on %s: %d\n",
+                        mac, QETH_CARD_IFNAME(card), rc);
+        return rc;
 }
 static void qeth_l2_add_mc(struct qeth_card *card, __u8 *mac, int vmac)
@@ -197,10 +209,11 @@ static void qeth_l2_add_mc(struct qeth_card *card, __u8 *mac, int vmac)
        mc->is_vmac = vmac;
        if (vmac) {
-                rc = qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETVMAC,
+                rc = qeth_setdel_makerc(card,
-                                        NULL);
+                        qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETVMAC));
        } else {
-                rc = qeth_l2_send_setgroupmac(card, mac);
+                rc = qeth_setdel_makerc(card,
+                        qeth_l2_send_setgroupmac(card, mac));
        }
        if (!rc)
@@ -218,7 +231,7 @@ static void qeth_l2_del_all_mc(struct qeth_card *card, int del)
                if (del) {
                        if (mc->is_vmac)
                                qeth_l2_send_setdelmac(card, mc->mc_addr,
-                                        IPA_CMD_DELVMAC, NULL);
+                                        IPA_CMD_DELVMAC);
                        else
                                qeth_l2_send_delgroupmac(card, mc->mc_addr);
                }
@@ -291,6 +304,8 @@ static int qeth_l2_send_setdelvlan(struct qeth_card *card, __u16 i,
        QETH_CARD_TEXT_(card, 4, "L2sdv%x", ipacmd);
        iob = qeth_get_ipacmd_buffer(card, ipacmd, QETH_PROT_IPV4);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        cmd->data.setdelvlan.vlan_id = i;
        return qeth_send_ipa_cmd(card, iob,
@@ -313,6 +328,7 @@ static int qeth_l2_vlan_rx_add_vid(struct net_device *dev,
 {
        struct qeth_card *card = dev->ml_priv;
        struct qeth_vlan_vid *id;
+        int rc;
        QETH_CARD_TEXT_(card, 4, "aid:%d", vid);
        if (!vid)
@@ -328,7 +344,11 @@ static int qeth_l2_vlan_rx_add_vid(struct net_device *dev,
        id = kmalloc(sizeof(struct qeth_vlan_vid), GFP_ATOMIC);
        if (id) {
                id->vid = vid;
-                qeth_l2_send_setdelvlan(card, vid, IPA_CMD_SETVLAN);
+                rc = qeth_l2_send_setdelvlan(card, vid, IPA_CMD_SETVLAN);
+                if (rc) {
+                        kfree(id);
+                        return rc;
+                }
                spin_lock_bh(&card->vlanlock);
                list_add_tail(&id->list, &card->vid_list);
                spin_unlock_bh(&card->vlanlock);
@@ -343,6 +363,7 @@ static int qeth_l2_vlan_rx_kill_vid(struct net_device *dev,
 {
        struct qeth_vlan_vid *id, *tmpid = NULL;
        struct qeth_card *card = dev->ml_priv;
+        int rc = 0;
        QETH_CARD_TEXT_(card, 4, "kid:%d", vid);
        if (card->info.type == QETH_CARD_TYPE_OSM) {
@@ -363,11 +384,11 @@ static int qeth_l2_vlan_rx_kill_vid(struct net_device *dev,
        }
        spin_unlock_bh(&card->vlanlock);
        if (tmpid) {
-                qeth_l2_send_setdelvlan(card, vid, IPA_CMD_DELVLAN);
+                rc = qeth_l2_send_setdelvlan(card, vid, IPA_CMD_DELVLAN);
                kfree(tmpid);
        }
        qeth_l2_set_multicast_list(card->dev);
-        return 0;
+        return rc;
 }
 static int qeth_l2_stop_card(struct qeth_card *card, int recovery_mode)
@@ -539,91 +560,62 @@ out:
 }
 static int qeth_l2_send_setdelmac(struct qeth_card *card, __u8 *mac,
-                           enum qeth_ipa_cmds ipacmd,
+                           enum qeth_ipa_cmds ipacmd)
-                           int (*reply_cb) (struct qeth_card *,
-                                            struct qeth_reply*,
-                                            unsigned long))
 {
        struct qeth_ipa_cmd *cmd;
        struct qeth_cmd_buffer *iob;
        QETH_CARD_TEXT(card, 2, "L2sdmac");
        iob = qeth_get_ipacmd_buffer(card, ipacmd, QETH_PROT_IPV4);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        cmd->data.setdelmac.mac_length = OSA_ADDR_LEN;
        memcpy(&cmd->data.setdelmac.mac, mac, OSA_ADDR_LEN);
-        return qeth_send_ipa_cmd(card, iob, reply_cb, NULL);
+        return qeth_send_ipa_cmd(card, iob, NULL, NULL);
 }
-static int qeth_l2_send_setmac_cb(struct qeth_card *card,
+static int qeth_l2_send_setmac(struct qeth_card *card, __u8 *mac)
-                           struct qeth_reply *reply,
-                           unsigned long data)
 {
-        struct qeth_ipa_cmd *cmd;
+        int rc;
-        QETH_CARD_TEXT(card, 2, "L2Smaccb");
+        QETH_CARD_TEXT(card, 2, "L2Setmac");
-        cmd = (struct qeth_ipa_cmd *) data;
+        rc = qeth_setdel_makerc(card, qeth_l2_send_setdelmac(card, mac,
-        if (cmd->hdr.return_code) {
+                                        IPA_CMD_SETVMAC));
-                QETH_CARD_TEXT_(card, 2, "L2er%x", cmd->hdr.return_code);
+        if (rc == 0) {
+                card->info.mac_bits |= QETH_LAYER2_MAC_REGISTERED;
+                memcpy(card->dev->dev_addr, mac, OSA_ADDR_LEN);
+                dev_info(&card->gdev->dev,
+                        "MAC address %pM successfully registered on device %s\n",
+                        card->dev->dev_addr, card->dev->name);
+        } else {
                card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
-                switch (cmd->hdr.return_code) {
+                switch (rc) {
-                case IPA_RC_L2_DUP_MAC:
+                case -EEXIST:
-                case IPA_RC_L2_DUP_LAYER3_MAC:
                        dev_warn(&card->gdev->dev,
-                                "MAC address %pM already exists\n",
+                                "MAC address %pM already exists\n", mac);
-                                cmd->data.setdelmac.mac);
                        break;
-                case IPA_RC_L2_MAC_NOT_AUTH_BY_HYP:
+                case -EPERM:
-                case IPA_RC_L2_MAC_NOT_AUTH_BY_ADP:
                        dev_warn(&card->gdev->dev,
-                                "MAC address %pM is not authorized\n",
+                                "MAC address %pM is not authorized\n", mac);
-                                cmd->data.setdelmac.mac);
-                        break;
-                default:
                        break;
                }
-        } else {
-                card->info.mac_bits |= QETH_LAYER2_MAC_REGISTERED;
-                memcpy(card->dev->dev_addr, cmd->data.setdelmac.mac,
-                       OSA_ADDR_LEN);
-                dev_info(&card->gdev->dev,
-                        "MAC address %pM successfully registered on device %s\n",
-                        card->dev->dev_addr, card->dev->name);
-        }
-        return 0;
-}
-static int qeth_l2_send_setmac(struct qeth_card *card, __u8 *mac)
-{
-        QETH_CARD_TEXT(card, 2, "L2Setmac");
-        return qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETVMAC,
-                                          qeth_l2_send_setmac_cb);
-}
-static int qeth_l2_send_delmac_cb(struct qeth_card *card,
-                           struct qeth_reply *reply,
-                           unsigned long data)
-{
-        struct qeth_ipa_cmd *cmd;
-        QETH_CARD_TEXT(card, 2, "L2Dmaccb");
-        cmd = (struct qeth_ipa_cmd *) data;
-        if (cmd->hdr.return_code) {
-                QETH_CARD_TEXT_(card, 2, "err%d", cmd->hdr.return_code);
-                return 0;
        }
-        card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
+        return rc;
-        return 0;
 }
 static int qeth_l2_send_delmac(struct qeth_card *card, __u8 *mac)
 {
+        int rc;
        QETH_CARD_TEXT(card, 2, "L2Delmac");
        if (!(card->info.mac_bits & QETH_LAYER2_MAC_REGISTERED))
                return 0;
-        return qeth_l2_send_setdelmac(card, mac, IPA_CMD_DELVMAC,
+        rc = qeth_setdel_makerc(card, qeth_l2_send_setdelmac(card, mac,
-                                          qeth_l2_send_delmac_cb);
+                                        IPA_CMD_DELVMAC));
+        if (rc == 0)
+                card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
+        return rc;
 }
 static int qeth_l2_request_initial_mac(struct qeth_card *card)
@@ -651,7 +643,7 @@ static int qeth_l2_request_initial_mac(struct qeth_card *card)
                if (rc) {
                        QETH_DBF_MESSAGE(2, "couldn't get MAC address on "
                                "device %s: x%x\n", CARD_BUS_ID(card), rc);
-                        QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
+                        QETH_DBF_TEXT_(SETUP, 2, "1err%04x", rc);
                        return rc;
                }
                QETH_DBF_HEX(SETUP, 2, card->dev->dev_addr, OSA_ADDR_LEN);
@@ -687,7 +679,7 @@ static int qeth_l2_set_mac_address(struct net_device *dev, void *p)
                return -ERESTARTSYS;
        }
        rc = qeth_l2_send_delmac(card, &card->dev->dev_addr[0]);
-        if (!rc || (rc == IPA_RC_L2_MAC_NOT_FOUND))
+        if (!rc || (rc == -ENOENT))
                rc = qeth_l2_send_setmac(card, addr->sa_data);
        return rc ? -EINVAL : 0;
 }
@@ -996,7 +988,7 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
        recover_flag = card->state;
        rc = qeth_core_hardsetup_card(card);
        if (rc) {
-                QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
+                QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc);
                rc = -ENODEV;
                goto out_remove;
        }
@@ -1730,6 +1722,8 @@ static void qeth_bridgeport_query_support(struct qeth_card *card)
        QETH_CARD_TEXT(card, 2, "brqsuppo");
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETBRIDGEPORT, 0);
+        if (!iob)
+                return;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        cmd->data.sbp.hdr.cmdlength =
                sizeof(struct qeth_ipacmd_sbp_hdr) +
@@ -1805,6 +1799,8 @@ int qeth_bridgeport_query_ports(struct qeth_card *card,
        if (!(card->options.sbp.supported_funcs & IPA_SBP_QUERY_BRIDGE_PORTS))
                return -EOPNOTSUPP;
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETBRIDGEPORT, 0);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        cmd->data.sbp.hdr.cmdlength =
                sizeof(struct qeth_ipacmd_sbp_hdr);
@@ -1817,9 +1813,7 @@ int qeth_bridgeport_query_ports(struct qeth_card *card,
        if (rc)
                return rc;
        rc = qeth_bridgeport_makerc(card, &cbctl, IPA_SBP_QUERY_BRIDGE_PORTS);
-        if (rc)
+        return rc;
-                return rc;
-        return 0;
 }
 EXPORT_SYMBOL_GPL(qeth_bridgeport_query_ports);
@@ -1873,6 +1867,8 @@ int qeth_bridgeport_setrole(struct qeth_card *card, enum qeth_sbp_roles role)
        if (!(card->options.sbp.supported_funcs & setcmd))
                return -EOPNOTSUPP;
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETBRIDGEPORT, 0);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        cmd->data.sbp.hdr.cmdlength = cmdlength;
        cmd->data.sbp.hdr.command_code = setcmd;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 625227ad16ee..e2a0ee845399 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -549,6 +549,8 @@ static int qeth_l3_send_setdelmc(struct qeth_card *card,
        QETH_CARD_TEXT(card, 4, "setdelmc");
        iob = qeth_get_ipacmd_buffer(card, ipacmd, addr->proto);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        memcpy(&cmd->data.setdelipm.mac, addr->mac, OSA_ADDR_LEN);
        if (addr->proto == QETH_PROT_IPV6)
@@ -588,6 +590,8 @@ static int qeth_l3_send_setdelip(struct qeth_card *card,
        QETH_CARD_TEXT_(card, 4, "flags%02X", flags);
        iob = qeth_get_ipacmd_buffer(card, ipacmd, addr->proto);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        if (addr->proto == QETH_PROT_IPV6) {
                memcpy(cmd->data.setdelip6.ip_addr, &addr->u.a6.addr,
@@ -616,6 +620,8 @@ static int qeth_l3_send_setrouting(struct qeth_card *card,
        QETH_CARD_TEXT(card, 4, "setroutg");
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETRTG, prot);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        cmd->data.setrtg.type = (type);
        rc = qeth_send_ipa_cmd(card, iob, NULL, NULL);
@@ -1049,12 +1055,14 @@ static struct qeth_cmd_buffer *qeth_l3_get_setassparms_cmd(
        QETH_CARD_TEXT(card, 4, "getasscm");
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETASSPARMS, prot);
-        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
+        if (iob) {
-        cmd->data.setassparms.hdr.assist_no = ipa_func;
+                cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
-        cmd->data.setassparms.hdr.length = 8 + len;
+                cmd->data.setassparms.hdr.assist_no = ipa_func;
-        cmd->data.setassparms.hdr.command_code = cmd_code;
+                cmd->data.setassparms.hdr.length = 8 + len;
-        cmd->data.setassparms.hdr.return_code = 0;
+                cmd->data.setassparms.hdr.command_code = cmd_code;
-        cmd->data.setassparms.hdr.seq_no = 0;
+                cmd->data.setassparms.hdr.return_code = 0;
+                cmd->data.setassparms.hdr.seq_no = 0;
+        }
        return iob;
 }
@@ -1090,6 +1098,8 @@ static int qeth_l3_send_simple_setassparms_ipv6(struct qeth_card *card,
        QETH_CARD_TEXT(card, 4, "simassp6");
        iob = qeth_l3_get_setassparms_cmd(card, ipa_func, cmd_code,
                                       0, QETH_PROT_IPV6);
+        if (!iob)
+                return -ENOMEM;
        rc = qeth_l3_send_setassparms(card, iob, 0, 0,
                                   qeth_l3_default_setassparms_cb, NULL);
        return rc;
@@ -1108,6 +1118,8 @@ static int qeth_l3_send_simple_setassparms(struct qeth_card *card,
                length = sizeof(__u32);
        iob = qeth_l3_get_setassparms_cmd(card, ipa_func, cmd_code,
                                       length, QETH_PROT_IPV4);
+        if (!iob)
+                return -ENOMEM;
        rc = qeth_l3_send_setassparms(card, iob, length, data,
                                   qeth_l3_default_setassparms_cb, NULL);
        return rc;
@@ -1494,6 +1506,8 @@ static int qeth_l3_iqd_read_initial_mac(struct qeth_card *card)
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_CREATE_ADDR,
                                     QETH_PROT_IPV6);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        *((__u16 *) &cmd->data.create_destroy_addr.unique_id[6]) =
                        card->info.unique_id;
@@ -1537,6 +1551,8 @@ static int qeth_l3_get_unique_id(struct qeth_card *card)
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_CREATE_ADDR,
                                     QETH_PROT_IPV6);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        *((__u16 *) &cmd->data.create_destroy_addr.unique_id[6]) =
                        card->info.unique_id;
@@ -1611,6 +1627,8 @@ qeth_diags_trace(struct qeth_card *card, enum qeth_diags_trace_cmds diags_cmd)
        QETH_DBF_TEXT(SETUP, 2, "diagtrac");
        iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SET_DIAG_ASS, 0);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        cmd->data.diagass.subcmd_len = 16;
        cmd->data.diagass.subcmd = QETH_DIAGS_CMD_TRACE;
@@ -2442,6 +2460,8 @@ static int qeth_l3_query_arp_cache_info(struct qeth_card *card,
                        IPA_CMD_ASS_ARP_QUERY_INFO,
                        sizeof(struct qeth_arp_query_data) - sizeof(char),
                        prot);
+        if (!iob)
+                return -ENOMEM;
        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
        cmd->data.setassparms.data.query_arp.request_bits = 0x000F;
        cmd->data.setassparms.data.query_arp.reply_bits = 0;
@@ -2535,6 +2555,8 @@ static int qeth_l3_arp_add_entry(struct qeth_card *card,
                                       IPA_CMD_ASS_ARP_ADD_ENTRY,
                                       sizeof(struct qeth_arp_cache_entry),
                                       QETH_PROT_IPV4);
+        if (!iob)
+                return -ENOMEM;
        rc = qeth_l3_send_setassparms(card, iob,
                                   sizeof(struct qeth_arp_cache_entry),
                                   (unsigned long) entry,
@@ -2574,6 +2596,8 @@ static int qeth_l3_arp_remove_entry(struct qeth_card *card,
                                       IPA_CMD_ASS_ARP_REMOVE_ENTRY,
                                       12,
                                       QETH_PROT_IPV4);
+        if (!iob)
+                return -ENOMEM;
        rc = qeth_l3_send_setassparms(card, iob,
                                   12, (unsigned long)buf,
                                   qeth_l3_default_setassparms_cb, NULL);
@@ -3262,6 +3286,8 @@ static const struct net_device_ops qeth_l3_osa_netdev_ops = {
 static int qeth_l3_setup_netdev(struct qeth_card *card)
 {
+        int rc;
        if (card->info.type == QETH_CARD_TYPE_OSD ||
            card->info.type == QETH_CARD_TYPE_OSX) {
                if ((card->info.link_type == QETH_LINK_TYPE_LANE_TR) ||
@@ -3293,7 +3319,9 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
                        return -ENODEV;
                card->dev->flags |= IFF_NOARP;
                card->dev->netdev_ops = &qeth_l3_netdev_ops;
-                qeth_l3_iqd_read_initial_mac(card);
+                rc = qeth_l3_iqd_read_initial_mac(card);
+                if (rc)
+                        return rc;
                if (card->options.hsuid[0])
                        memcpy(card->dev->perm_addr, card->options.hsuid, 9);
        } else
@@ -3360,7 +3388,7 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
        recover_flag = card->state;
        rc = qeth_core_hardsetup_card(card);
        if (rc) {
-                QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
+                QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc);
                rc = -ENODEV;
                goto out_remove;
        }
@@ -3401,7 +3429,7 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
 contin:
        rc = qeth_l3_setadapter_parms(card);
        if (rc)
-                QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
+                QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc);
        if (!card->options.sniffer) {
                rc = qeth_l3_start_ipassists(card);
                if (rc) {
@@ -3410,10 +3438,10 @@ contin:
                }
                rc = qeth_l3_setrouting_v4(card);
                if (rc)
-                        QETH_DBF_TEXT_(SETUP, 2, "4err%d", rc);
+                        QETH_DBF_TEXT_(SETUP, 2, "4err%04x", rc);
                rc = qeth_l3_setrouting_v6(card);
                if (rc)
-                        QETH_DBF_TEXT_(SETUP, 2, "5err%d", rc);
+                        QETH_DBF_TEXT_(SETUP, 2, "5err%04x", rc);
        }
        netif_tx_disable(card->dev);
diff --git a/drivers/scsi/device_handler/scsi_dh.c b/drivers/scsi/device_handler/scsi_dh.c
index 1dba62c5cf6a..1efebc9eedfb 100644
--- a/drivers/scsi/device_handler/scsi_dh.c
+++ b/drivers/scsi/device_handler/scsi_dh.c
@@ -136,11 +136,12 @@ static void __detach_handler (struct kref *kref)
        struct scsi_device_handler *scsi_dh = scsi_dh_data->scsi_dh;
        struct scsi_device *sdev = scsi_dh_data->sdev;
+        scsi_dh->detach(sdev);
        spin_lock_irq(sdev->request_queue->queue_lock);
        sdev->scsi_dh_data = NULL;
        spin_unlock_irq(sdev->request_queue->queue_lock);
-        scsi_dh->detach(sdev);
        sdev_printk(KERN_NOTICE, sdev, "%s: Detached\n", scsi_dh->name);
        module_put(scsi_dh->module);
 }
diff --git a/drivers/scsi/fnic/fnic.h b/drivers/scsi/fnic/fnic.h
index 3b73b96619e2..26270c351624 100644
--- a/drivers/scsi/fnic/fnic.h
+++ b/drivers/scsi/fnic/fnic.h
@@ -39,7 +39,7 @@
 #define DRV_NAME                "fnic"
 #define DRV_DESCRIPTION         "Cisco FCoE HBA Driver"
-#define DRV_VERSION             "1.6.0.16"
+#define DRV_VERSION             "1.6.0.17"
 #define PFX                     DRV_NAME ": "
 #define DFX                     DRV_NAME "%d: "
diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
index 2097de42a147..155b286f1a9d 100644
--- a/drivers/scsi/fnic/fnic_scsi.c
+++ b/drivers/scsi/fnic/fnic_scsi.c
@@ -1892,6 +1892,21 @@ int fnic_abort_cmd(struct scsi_cmnd *sc)
                goto fnic_abort_cmd_end;
        }
+        /* IO out of order */
+        if (!(CMD_FLAGS(sc) & (FNIC_IO_ABORTED | FNIC_IO_DONE))) {
+                spin_unlock_irqrestore(io_lock, flags);
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                        "Issuing Host reset due to out of order IO\n");
+                if (fnic_host_reset(sc) == FAILED) {
+                        FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                                "fnic_host_reset failed.\n");
+                }
+                ret = FAILED;
+                goto fnic_abort_cmd_end;
+        }
        CMD_STATE(sc) = FNIC_IOREQ_ABTS_COMPLETE;
        /*
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index df4e27cd996a..9219953ee949 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -683,6 +683,7 @@ static void ipr_init_ipr_cmnd(struct ipr_cmnd *ipr_cmd,
        ipr_reinit_ipr_cmnd(ipr_cmd);
        ipr_cmd->u.scratch = 0;
        ipr_cmd->sibling = NULL;
+        ipr_cmd->eh_comp = NULL;
        ipr_cmd->fast_done = fast_done;
        init_timer(&ipr_cmd->timer);
 }
@@ -848,6 +849,8 @@ static void ipr_scsi_eh_done(struct ipr_cmnd *ipr_cmd)
        scsi_dma_unmap(ipr_cmd->scsi_cmd);
        scsi_cmd->scsi_done(scsi_cmd);
+        if (ipr_cmd->eh_comp)
+                complete(ipr_cmd->eh_comp);
        list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
 }
@@ -4811,6 +4814,84 @@ static int ipr_slave_alloc(struct scsi_device *sdev)
        return rc;
 }
+/**
+ * ipr_match_lun - Match function for specified LUN
+ * @ipr_cmd:    ipr command struct
+ * @device:             device to match (sdev)
+ *
+ * Returns:
+ *      1 if command matches sdev / 0 if command does not match sdev
+ **/
+static int ipr_match_lun(struct ipr_cmnd *ipr_cmd, void *device)
+{
+        if (ipr_cmd->scsi_cmd && ipr_cmd->scsi_cmd->device == device)
+                return 1;
+        return 0;
+}
+/**
+ * ipr_wait_for_ops - Wait for matching commands to complete
+ * @ipr_cmd:    ipr command struct
+ * @device:             device to match (sdev)
+ * @match:              match function to use
+ *
+ * Returns:
+ *      SUCCESS / FAILED
+ **/
+static int ipr_wait_for_ops(struct ipr_ioa_cfg *ioa_cfg, void *device,
+                            int (*match)(struct ipr_cmnd *, void *))
+{
+        struct ipr_cmnd *ipr_cmd;
+        int wait;
+        unsigned long flags;
+        struct ipr_hrr_queue *hrrq;
+        signed long timeout = IPR_ABORT_TASK_TIMEOUT;
+        DECLARE_COMPLETION_ONSTACK(comp);
+        ENTER;
+        do {
+                wait = 0;
+                for_each_hrrq(hrrq, ioa_cfg) {
+                        spin_lock_irqsave(hrrq->lock, flags);
+                        list_for_each_entry(ipr_cmd, &hrrq->hrrq_pending_q, queue) {
+                                if (match(ipr_cmd, device)) {
+                                        ipr_cmd->eh_comp = &comp;
+                                        wait++;
+                                }
+                        }
+                        spin_unlock_irqrestore(hrrq->lock, flags);
+                }
+                if (wait) {
+                        timeout = wait_for_completion_timeout(&comp, timeout);
+                        if (!timeout) {
+                                wait = 0;
+                                for_each_hrrq(hrrq, ioa_cfg) {
+                                        spin_lock_irqsave(hrrq->lock, flags);
+                                        list_for_each_entry(ipr_cmd, &hrrq->hrrq_pending_q, queue) {
+                                                if (match(ipr_cmd, device)) {
+                                                        ipr_cmd->eh_comp = NULL;
+                                                        wait++;
+                                                }
+                                        }
+                                        spin_unlock_irqrestore(hrrq->lock, flags);
+                                }
+                                if (wait)
+                                        dev_err(&ioa_cfg->pdev->dev, "Timed out waiting for aborted commands\n");
+                                LEAVE;
+                                return wait ? FAILED : SUCCESS;
+                        }
+                }
+        } while (wait);
+        LEAVE;
+        return SUCCESS;
+}
 static int ipr_eh_host_reset(struct scsi_cmnd *cmd)
 {
        struct ipr_ioa_cfg *ioa_cfg;
@@ -5030,11 +5111,17 @@ static int __ipr_eh_dev_reset(struct scsi_cmnd *scsi_cmd)
 static int ipr_eh_dev_reset(struct scsi_cmnd *cmd)
 {
        int rc;
+        struct ipr_ioa_cfg *ioa_cfg;
+        ioa_cfg = (struct ipr_ioa_cfg *) cmd->device->host->hostdata;
        spin_lock_irq(cmd->device->host->host_lock);
        rc = __ipr_eh_dev_reset(cmd);
        spin_unlock_irq(cmd->device->host->host_lock);
+        if (rc == SUCCESS)
+                rc = ipr_wait_for_ops(ioa_cfg, cmd->device, ipr_match_lun);
        return rc;
 }
@@ -5234,13 +5321,18 @@ static int ipr_eh_abort(struct scsi_cmnd *scsi_cmd)
 {
        unsigned long flags;
        int rc;
+        struct ipr_ioa_cfg *ioa_cfg;
        ENTER;
+        ioa_cfg = (struct ipr_ioa_cfg *) scsi_cmd->device->host->hostdata;
        spin_lock_irqsave(scsi_cmd->device->host->host_lock, flags);
        rc = ipr_cancel_op(scsi_cmd);
        spin_unlock_irqrestore(scsi_cmd->device->host->host_lock, flags);
+        if (rc == SUCCESS)
+                rc = ipr_wait_for_ops(ioa_cfg, scsi_cmd->device, ipr_match_lun);
        LEAVE;
        return rc;
 }
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index b4f3eec51bc9..ec03b42fa2b9 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1606,6 +1606,7 @@ struct ipr_cmnd {
                struct scsi_device *sdev;
        } u;
+        struct completion *eh_comp;
        struct ipr_hrr_queue *hrrq;
        struct ipr_ioa_cfg *ioa_cfg;
 };
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 12ca291c1380..cce1cbc1a927 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -734,7 +734,9 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
         * Return target busy if we've received a non-zero retry_delay_timer
         * in a FCP_RSP.
         */
-        if (time_after(jiffies, fcport->retry_delay_timestamp))
+        if (fcport->retry_delay_timestamp == 0) {
+                /* retry delay not set */
+        } else if (time_after(jiffies, fcport->retry_delay_timestamp))
                fcport->retry_delay_timestamp = 0;
        else
                goto qc24_target_busy;
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index e02885451425..9b3829931f40 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -986,9 +986,9 @@ int scsi_device_get(struct scsi_device *sdev)
                return -ENXIO;
        if (!get_device(&sdev->sdev_gendev))
                return -ENXIO;
-        /* We can fail this if we're doing SCSI operations
+        /* We can fail try_module_get if we're doing SCSI operations
         * from module exit (like cache flush) */
-        try_module_get(sdev->host->hostt->module);
+        __module_get(sdev->host->hostt->module);
        return 0;
 }
@@ -1004,14 +1004,7 @@ EXPORT_SYMBOL(scsi_device_get);
 */
 void scsi_device_put(struct scsi_device *sdev)
 {
-#ifdef CONFIG_MODULE_UNLOAD
+        module_put(sdev->host->hostt->module);
-        struct module *module = sdev->host->hostt->module;
-        /* The module refcount will be zero if scsi_device_get()
-         * was called from a module removal routine */
-        if (module && module_refcount(module) != 0)
-                module_put(module);
-#endif
        put_device(&sdev->sdev_gendev);
 }
 EXPORT_SYMBOL(scsi_device_put);
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 7b8b51bc29b4..4aca1b0378c2 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1623,7 +1623,7 @@ resp_rsup_opcodes(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
        req_opcode = cmd[3];
        req_sa = get_unaligned_be16(cmd + 4);
        alloc_len = get_unaligned_be32(cmd + 6);
-        if (alloc_len < 4 && alloc_len > 0xffff) {
+        if (alloc_len < 4 || alloc_len > 0xffff) {
                mk_sense_invalid_fld(scp, SDEB_IN_CDB, 6, -1);
                return check_condition_result;
        }
@@ -1631,7 +1631,7 @@ resp_rsup_opcodes(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
                a_len = 8192;
        else
                a_len = alloc_len;
-        arr = kzalloc((a_len < 256) ? 320 : a_len + 64, GFP_KERNEL);
+        arr = kzalloc((a_len < 256) ? 320 : a_len + 64, GFP_ATOMIC);
        if (NULL == arr) {
                mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
                                INSUFF_RES_ASCQ);
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index e42fff6e8c10..8afb01604d51 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -1041,7 +1041,7 @@ retry:
                }
                /* signal not to enter either branch of the if () below */
                timeleft = 0;
-                rtn = NEEDS_RETRY;
+                rtn = FAILED;
        } else {
                timeleft = wait_for_completion_timeout(&done, timeout);
                rtn = SUCCESS;
@@ -1081,7 +1081,7 @@ retry:
                        rtn = FAILED;
                        break;
                }
-        } else if (!rtn) {
+        } else if (rtn != FAILED) {
                scsi_abort_eh_cmnd(scmd);
                rtn = FAILED;
        }
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 9ea95dd3e260..17bb541f7cc2 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -591,7 +591,6 @@ static void scsi_free_sgtable(struct scsi_data_buffer *sdb, bool mq)
 static int scsi_alloc_sgtable(struct scsi_data_buffer *sdb, int nents, bool mq)
 {
        struct scatterlist *first_chunk = NULL;
-        gfp_t gfp_mask = mq ? GFP_NOIO : GFP_ATOMIC;
        int ret;
        BUG_ON(!nents);
@@ -606,7 +605,7 @@ static int scsi_alloc_sgtable(struct scsi_data_buffer *sdb, int nents, bool mq)
        }
        ret = __sg_alloc_table(&sdb->table, nents, SCSI_MAX_SG_SEGMENTS,
-                               first_chunk, gfp_mask, scsi_sg_alloc);
+                               first_chunk, GFP_ATOMIC, scsi_sg_alloc);
        if (unlikely(ret))
                scsi_free_sgtable(sdb, mq);
        return ret;
@@ -1144,7 +1143,17 @@ int scsi_init_io(struct scsi_cmnd *cmd)
                struct scsi_data_buffer *prot_sdb = cmd->prot_sdb;
                int ivecs, count;
-                BUG_ON(prot_sdb == NULL);
+                if (prot_sdb == NULL) {
+                        /*
+                         * This can happen if someone (e.g. multipath)
+                         * queues a command to a device on an adapter
+                         * that does not support DIX.
+                         */
+                        WARN_ON_ONCE(1);
+                        error = BLKPREP_KILL;
+                        goto err_exit;
+                }
                ivecs = blk_rq_count_integrity_sg(rq->q, rq->bio);
                if (scsi_alloc_sgtable(prot_sdb, ivecs, is_mq)) {
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index fedab3c21ddf..05ea0d49a3a3 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2623,8 +2623,9 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
                                sd_config_discard(sdkp, SD_LBP_WS16);
                } else {        /* LBP VPD page tells us what to use */
+                        if (sdkp->lbpu && sdkp->max_unmap_blocks && !sdkp->lbprz)
-                        if (sdkp->lbpws)
+                                sd_config_discard(sdkp, SD_LBP_UNMAP);
+                        else if (sdkp->lbpws)
                                sd_config_discard(sdkp, SD_LBP_WS16);
                        else if (sdkp->lbpws10)
                                sd_config_discard(sdkp, SD_LBP_WS10);
@@ -2799,9 +2800,11 @@ static int sd_revalidate_disk(struct gendisk *disk)
         */
        sd_set_flush_flag(sdkp);
-        max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue),
+        max_xfer = sdkp->max_xfer_blocks;
-                                sdkp->max_xfer_blocks);
        max_xfer <<= ilog2(sdp->sector_size) - 9;
+        max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue),
+                                max_xfer);
        blk_queue_max_hw_sectors(sdkp->disk->queue, max_xfer);
        set_capacity(disk, sdkp->capacity);
        sd_config_write_same(sdkp);
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 99829985c1a1..95ccedabba4f 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -185,6 +185,16 @@ config SPI_DAVINCI
        help
          SPI master controller for DaVinci/DA8x/OMAP-L/AM1x SPI modules.
+config SPI_DLN2
+       tristate "Diolan DLN-2 USB SPI adapter"
+       depends on MFD_DLN2
+       help
+         If you say yes to this option, support will be included for Diolan
+         DLN2, a USB to SPI interface.
+         This driver can also be built as a module.  If so, the module
+         will be called spi-dln2.
 config SPI_EFM32
        tristate "EFM32 SPI controller"
        depends on OF && ARM && (ARCH_EFM32 || COMPILE_TEST)
@@ -279,7 +289,7 @@ config SPI_FSL_CPM
        depends on FSL_SOC
 config SPI_FSL_SPI
-        bool "Freescale SPI controller and Aeroflex Gaisler GRLIB SPI controller"
+        tristate "Freescale SPI controller and Aeroflex Gaisler GRLIB SPI controller"
        depends on OF
        select SPI_FSL_LIB
        select SPI_FSL_CPM if FSL_SOC
@@ -292,7 +302,6 @@ config SPI_FSL_SPI
 config SPI_FSL_DSPI
        tristate "Freescale DSPI controller"
-        select SPI_BITBANG
        select REGMAP_MMIO
        depends on SOC_VF610 || COMPILE_TEST
        help
@@ -300,7 +309,7 @@ config SPI_FSL_DSPI
          mode. VF610 platform uses the controller.
 config SPI_FSL_ESPI
-        bool "Freescale eSPI controller"
+        tristate "Freescale eSPI controller"
        depends on FSL_SOC
        select SPI_FSL_LIB
        help
@@ -460,7 +469,6 @@ config SPI_S3C24XX_FIQ
 config SPI_S3C64XX
        tristate "Samsung S3C64XX series type SPI"
        depends on (PLAT_SAMSUNG || ARCH_EXYNOS)
-        select S3C64XX_PL080 if ARCH_S3C64XX
        help
          SPI driver for Samsung S3C64XX and newer SoCs.
@@ -503,6 +511,13 @@ config SPI_SIRF
        help
          SPI driver for CSR SiRFprimaII SoCs
+config SPI_ST_SSC4
+        tristate "STMicroelectronics SPI SSC-based driver"
+        depends on ARCH_STI
+        help
+          STMicroelectronics SoCs support for SPI. If you say yes to
+          this option, support will be included for the SSC driven SPI.
 config SPI_SUN4I
        tristate "Allwinner A10 SoCs SPI controller"
        depends on ARCH_SUNXI || COMPILE_TEST
@@ -595,7 +610,6 @@ config SPI_XTENSA_XTFPGA
          16 bit words in SPI mode 0, automatically asserting CS on transfer
          start and deasserting on end.
 config SPI_NUC900
        tristate "Nuvoton NUC900 series SPI"
        depends on ARCH_W90X900
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index 6b9d2ac629cc..d8cbf654976b 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -27,6 +27,7 @@ obj-$(CONFIG_SPI_CADENCE)		+= spi-cadence.o
 obj-$(CONFIG_SPI_CLPS711X)              += spi-clps711x.o
 obj-$(CONFIG_SPI_COLDFIRE_QSPI)         += spi-coldfire-qspi.o
 obj-$(CONFIG_SPI_DAVINCI)               += spi-davinci.o
+obj-$(CONFIG_SPI_DLN2)                  += spi-dln2.o
 obj-$(CONFIG_SPI_DESIGNWARE)            += spi-dw.o
 obj-$(CONFIG_SPI_DW_MMIO)               += spi-dw-mmio.o
 obj-$(CONFIG_SPI_DW_PCI)                += spi-dw-midpci.o
@@ -76,6 +77,7 @@ obj-$(CONFIG_SPI_SH_HSPI)		+= spi-sh-hspi.o
 obj-$(CONFIG_SPI_SH_MSIOF)              += spi-sh-msiof.o
 obj-$(CONFIG_SPI_SH_SCI)                += spi-sh-sci.o
 obj-$(CONFIG_SPI_SIRF)          += spi-sirf.o
+obj-$(CONFIG_SPI_ST_SSC4)               += spi-st-ssc4.o
 obj-$(CONFIG_SPI_SUN4I)                 += spi-sun4i.o
 obj-$(CONFIG_SPI_SUN6I)                 += spi-sun6i.o
 obj-$(CONFIG_SPI_TEGRA114)              += spi-tegra114.o
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 23d8f5f56579..9af7841f2e8c 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1046,6 +1046,7 @@ static int atmel_spi_one_transfer(struct spi_master *master,
        struct atmel_spi_device *asd;
        int                     timeout;
        int                     ret;
+        unsigned long           dma_timeout;
        as = spi_master_get_devdata(master);
@@ -1103,15 +1104,12 @@ static int atmel_spi_one_transfer(struct spi_master *master,
                /* interrupts are disabled, so free the lock for schedule */
                atmel_spi_unlock(as);
-                ret = wait_for_completion_timeout(&as->xfer_completion,
+                dma_timeout = wait_for_completion_timeout(&as->xfer_completion,
-                                                        SPI_DMA_TIMEOUT);
+                                                          SPI_DMA_TIMEOUT);
                atmel_spi_lock(as);
-                if (WARN_ON(ret == 0)) {
+                if (WARN_ON(dma_timeout == 0)) {
-                        dev_err(&spi->dev,
+                        dev_err(&spi->dev, "spi transfer timeout\n");
-                                "spi trasfer timeout, err %d\n", ret);
                        as->done_status = -EIO;
-                } else {
-                        ret = 0;
                }
                if (as->done_status)
diff --git a/drivers/spi/spi-au1550.c b/drivers/spi/spi-au1550.c
index 326f47973684..f45e085c01a6 100644
--- a/drivers/spi/spi-au1550.c
+++ b/drivers/spi/spi-au1550.c
@@ -15,10 +15,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 #include <linux/init.h>
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 98aab457b24d..419a782ab6d5 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -17,10 +17,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */
 #include <linux/clk.h>
diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index c20530982e26..e73e2b052c9c 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the
- * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 */
 #include <linux/kernel.h>
diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
index dc7d2c2d643e..5ef6638d5e8a 100644
--- a/drivers/spi/spi-bitbang.c
+++ b/drivers/spi/spi-bitbang.c
@@ -10,10 +10,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 #include <linux/spinlock.h>
diff --git a/drivers/spi/spi-butterfly.c b/drivers/spi/spi-butterfly.c
index ee4f91ccd8fd..9a95862986c8 100644
--- a/drivers/spi/spi-butterfly.c
+++ b/drivers/spi/spi-butterfly.c
@@ -12,10 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #include <linux/kernel.h>
 #include <linux/init.h>
diff --git a/drivers/spi/spi-coldfire-qspi.c b/drivers/spi/spi-coldfire-qspi.c
index 41b5dc4445f6..688956ff5095 100644
--- a/drivers/spi/spi-coldfire-qspi.c
+++ b/drivers/spi/spi-coldfire-qspi.c
@@ -12,11 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA
- *
 */
 #include <linux/kernel.h>
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index b3707badb1e5..5e991065f5b0 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 #include <linux/interrupt.h>
diff --git a/drivers/spi/spi-dln2.c b/drivers/spi/spi-dln2.c
new file mode 100644
index 000000000000..3b7d91d94fea
--- /dev/null
+++ b/drivers/spi/spi-dln2.c
@@ -0,0 +1,881 @@
+/*
+ * Driver for the Diolan DLN-2 USB-SPI adapter
+ *
+ * Copyright (c) 2014 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/mfd/dln2.h>
+#include <linux/spi/spi.h>
+#include <linux/pm_runtime.h>
+#include <asm/unaligned.h>
+#define DLN2_SPI_MODULE_ID              0x02
+#define DLN2_SPI_CMD(cmd)               DLN2_CMD(cmd, DLN2_SPI_MODULE_ID)
+/* SPI commands */
+#define DLN2_SPI_GET_PORT_COUNT                 DLN2_SPI_CMD(0x00)
+#define DLN2_SPI_ENABLE                         DLN2_SPI_CMD(0x11)
+#define DLN2_SPI_DISABLE                        DLN2_SPI_CMD(0x12)
+#define DLN2_SPI_IS_ENABLED                     DLN2_SPI_CMD(0x13)
+#define DLN2_SPI_SET_MODE                       DLN2_SPI_CMD(0x14)
+#define DLN2_SPI_GET_MODE                       DLN2_SPI_CMD(0x15)
+#define DLN2_SPI_SET_FRAME_SIZE                 DLN2_SPI_CMD(0x16)
+#define DLN2_SPI_GET_FRAME_SIZE                 DLN2_SPI_CMD(0x17)
+#define DLN2_SPI_SET_FREQUENCY                  DLN2_SPI_CMD(0x18)
+#define DLN2_SPI_GET_FREQUENCY                  DLN2_SPI_CMD(0x19)
+#define DLN2_SPI_READ_WRITE                     DLN2_SPI_CMD(0x1A)
+#define DLN2_SPI_READ                           DLN2_SPI_CMD(0x1B)
+#define DLN2_SPI_WRITE                          DLN2_SPI_CMD(0x1C)
+#define DLN2_SPI_SET_DELAY_BETWEEN_SS           DLN2_SPI_CMD(0x20)
+#define DLN2_SPI_GET_DELAY_BETWEEN_SS           DLN2_SPI_CMD(0x21)
+#define DLN2_SPI_SET_DELAY_AFTER_SS             DLN2_SPI_CMD(0x22)
+#define DLN2_SPI_GET_DELAY_AFTER_SS             DLN2_SPI_CMD(0x23)
+#define DLN2_SPI_SET_DELAY_BETWEEN_FRAMES       DLN2_SPI_CMD(0x24)
+#define DLN2_SPI_GET_DELAY_BETWEEN_FRAMES       DLN2_SPI_CMD(0x25)
+#define DLN2_SPI_SET_SS                         DLN2_SPI_CMD(0x26)
+#define DLN2_SPI_GET_SS                         DLN2_SPI_CMD(0x27)
+#define DLN2_SPI_RELEASE_SS                     DLN2_SPI_CMD(0x28)
+#define DLN2_SPI_SS_VARIABLE_ENABLE             DLN2_SPI_CMD(0x2B)
+#define DLN2_SPI_SS_VARIABLE_DISABLE            DLN2_SPI_CMD(0x2C)
+#define DLN2_SPI_SS_VARIABLE_IS_ENABLED         DLN2_SPI_CMD(0x2D)
+#define DLN2_SPI_SS_AAT_ENABLE                  DLN2_SPI_CMD(0x2E)
+#define DLN2_SPI_SS_AAT_DISABLE                 DLN2_SPI_CMD(0x2F)
+#define DLN2_SPI_SS_AAT_IS_ENABLED              DLN2_SPI_CMD(0x30)
+#define DLN2_SPI_SS_BETWEEN_FRAMES_ENABLE       DLN2_SPI_CMD(0x31)
+#define DLN2_SPI_SS_BETWEEN_FRAMES_DISABLE      DLN2_SPI_CMD(0x32)
+#define DLN2_SPI_SS_BETWEEN_FRAMES_IS_ENABLED   DLN2_SPI_CMD(0x33)
+#define DLN2_SPI_SET_CPHA                       DLN2_SPI_CMD(0x34)
+#define DLN2_SPI_GET_CPHA                       DLN2_SPI_CMD(0x35)
+#define DLN2_SPI_SET_CPOL                       DLN2_SPI_CMD(0x36)
+#define DLN2_SPI_GET_CPOL                       DLN2_SPI_CMD(0x37)
+#define DLN2_SPI_SS_MULTI_ENABLE                DLN2_SPI_CMD(0x38)
+#define DLN2_SPI_SS_MULTI_DISABLE               DLN2_SPI_CMD(0x39)
+#define DLN2_SPI_SS_MULTI_IS_ENABLED            DLN2_SPI_CMD(0x3A)
+#define DLN2_SPI_GET_SUPPORTED_MODES            DLN2_SPI_CMD(0x40)
+#define DLN2_SPI_GET_SUPPORTED_CPHA_VALUES      DLN2_SPI_CMD(0x41)
+#define DLN2_SPI_GET_SUPPORTED_CPOL_VALUES      DLN2_SPI_CMD(0x42)
+#define DLN2_SPI_GET_SUPPORTED_FRAME_SIZES      DLN2_SPI_CMD(0x43)
+#define DLN2_SPI_GET_SS_COUNT                   DLN2_SPI_CMD(0x44)
+#define DLN2_SPI_GET_MIN_FREQUENCY              DLN2_SPI_CMD(0x45)
+#define DLN2_SPI_GET_MAX_FREQUENCY              DLN2_SPI_CMD(0x46)
+#define DLN2_SPI_GET_MIN_DELAY_BETWEEN_SS       DLN2_SPI_CMD(0x47)
+#define DLN2_SPI_GET_MAX_DELAY_BETWEEN_SS       DLN2_SPI_CMD(0x48)
+#define DLN2_SPI_GET_MIN_DELAY_AFTER_SS         DLN2_SPI_CMD(0x49)
+#define DLN2_SPI_GET_MAX_DELAY_AFTER_SS         DLN2_SPI_CMD(0x4A)
+#define DLN2_SPI_GET_MIN_DELAY_BETWEEN_FRAMES   DLN2_SPI_CMD(0x4B)
+#define DLN2_SPI_GET_MAX_DELAY_BETWEEN_FRAMES   DLN2_SPI_CMD(0x4C)
+#define DLN2_SPI_MAX_XFER_SIZE                  256
+#define DLN2_SPI_BUF_SIZE                       (DLN2_SPI_MAX_XFER_SIZE + 16)
+#define DLN2_SPI_ATTR_LEAVE_SS_LOW              BIT(0)
+#define DLN2_TRANSFERS_WAIT_COMPLETE            1
+#define DLN2_TRANSFERS_CANCEL                   0
+#define DLN2_RPM_AUTOSUSPEND_TIMEOUT            2000
+struct dln2_spi {
+        struct platform_device *pdev;
+        struct spi_master *master;
+        u8 port;
+        /*
+         * This buffer will be used mainly for read/write operations. Since
+         * they're quite large, we cannot use the stack. Protection is not
+         * needed because all SPI communication is serialized by the SPI core.
+         */
+        void *buf;
+        u8 bpw;
+        u32 speed;
+        u16 mode;
+        u8 cs;
+};
+/*
+ * Enable/Disable SPI module. The disable command will wait for transfers to
+ * complete first.
+ */
+static int dln2_spi_enable(struct dln2_spi *dln2, bool enable)
+{
+        u16 cmd;
+        struct {
+                u8 port;
+                u8 wait_for_completion;
+        } tx;
+        unsigned len = sizeof(tx);
+        tx.port = dln2->port;
+        if (enable) {
+                cmd = DLN2_SPI_ENABLE;
+                len -= sizeof(tx.wait_for_completion);
+        } else {
+                tx.wait_for_completion = DLN2_TRANSFERS_WAIT_COMPLETE;
+                cmd = DLN2_SPI_DISABLE;
+        }
+        return dln2_transfer_tx(dln2->pdev, cmd, &tx, len);
+}
+/*
+ * Select/unselect multiple CS lines. The selected lines will be automatically
+ * toggled LOW/HIGH by the board firmware during transfers, provided they're
+ * enabled first.
+ *
+ * Ex: cs_mask = 0x03 -> CS0 & CS1 will be selected and the next WR/RD operation
+ *                       will toggle the lines LOW/HIGH automatically.
+ */
+static int dln2_spi_cs_set(struct dln2_spi *dln2, u8 cs_mask)
+{
+        struct {
+                u8 port;
+                u8 cs;
+        } tx;
+        tx.port = dln2->port;
+        /*
+         * According to Diolan docs, "a slave device can be selected by changing
+         * the corresponding bit value to 0". The rest must be set to 1. Hence
+         * the bitwise NOT in front.
+         */
+        tx.cs = ~cs_mask;
+        return dln2_transfer_tx(dln2->pdev, DLN2_SPI_SET_SS, &tx, sizeof(tx));
+}
+/*
+ * Select one CS line. The other lines will be un-selected.
+ */
+static int dln2_spi_cs_set_one(struct dln2_spi *dln2, u8 cs)
+{
+        return dln2_spi_cs_set(dln2, BIT(cs));
+}
+/*
+ * Enable/disable CS lines for usage. The module has to be disabled first.
+ */
+static int dln2_spi_cs_enable(struct dln2_spi *dln2, u8 cs_mask, bool enable)
+{
+        struct {
+                u8 port;
+                u8 cs;
+        } tx;
+        u16 cmd;
+        tx.port = dln2->port;
+        tx.cs = cs_mask;
+        cmd = enable ? DLN2_SPI_SS_MULTI_ENABLE : DLN2_SPI_SS_MULTI_DISABLE;
+        return dln2_transfer_tx(dln2->pdev, cmd, &tx, sizeof(tx));
+}
+static int dln2_spi_cs_enable_all(struct dln2_spi *dln2, bool enable)
+{
+        u8 cs_mask = GENMASK(dln2->master->num_chipselect - 1, 0);
+        return dln2_spi_cs_enable(dln2, cs_mask, enable);
+}
+static int dln2_spi_get_cs_num(struct dln2_spi *dln2, u16 *cs_num)
+{
+        int ret;
+        struct {
+                u8 port;
+        } tx;
+        struct {
+                __le16 cs_count;
+        } rx;
+        unsigned rx_len = sizeof(rx);
+        tx.port = dln2->port;
+        ret = dln2_transfer(dln2->pdev, DLN2_SPI_GET_SS_COUNT, &tx, sizeof(tx),
+                            &rx, &rx_len);
+        if (ret < 0)
+                return ret;
+        if (rx_len < sizeof(rx))
+                return -EPROTO;
+        *cs_num = le16_to_cpu(rx.cs_count);
+        dev_dbg(&dln2->pdev->dev, "cs_num = %d\n", *cs_num);
+        return 0;
+}
+static int dln2_spi_get_speed(struct dln2_spi *dln2, u16 cmd, u32 *freq)
+{
+        int ret;
+        struct {
+                u8 port;
+        } tx;
+        struct {
+                __le32 speed;
+        } rx;
+        unsigned rx_len = sizeof(rx);
+        tx.port = dln2->port;
+        ret = dln2_transfer(dln2->pdev, cmd, &tx, sizeof(tx), &rx, &rx_len);
+        if (ret < 0)
+                return ret;
+        if (rx_len < sizeof(rx))
+                return -EPROTO;
+        *freq = le32_to_cpu(rx.speed);
+        return 0;
+}
+/*
+ * Get bus min/max frequencies.
+ */
+static int dln2_spi_get_speed_range(struct dln2_spi *dln2, u32 *fmin, u32 *fmax)
+{
+        int ret;
+        ret = dln2_spi_get_speed(dln2, DLN2_SPI_GET_MIN_FREQUENCY, fmin);
+        if (ret < 0)
+                return ret;
+        ret = dln2_spi_get_speed(dln2, DLN2_SPI_GET_MAX_FREQUENCY, fmax);
+        if (ret < 0)
+                return ret;
+        dev_dbg(&dln2->pdev->dev, "freq_min = %d, freq_max = %d\n",
+                *fmin, *fmax);
+        return 0;
+}
+/*
+ * Set the bus speed. The module will automatically round down to the closest
+ * available frequency and returns it. The module has to be disabled first.
+ */
+static int dln2_spi_set_speed(struct dln2_spi *dln2, u32 speed)
+{
+        int ret;
+        struct {
+                u8 port;
+                __le32 speed;
+        } __packed tx;
+        struct {
+                __le32 speed;
+        } rx;
+        int rx_len = sizeof(rx);
+        tx.port = dln2->port;
+        tx.speed = cpu_to_le32(speed);
+        ret = dln2_transfer(dln2->pdev, DLN2_SPI_SET_FREQUENCY, &tx, sizeof(tx),
+                            &rx, &rx_len);
+        if (ret < 0)
+                return ret;
+        if (rx_len < sizeof(rx))
+                return -EPROTO;
+        return 0;
+}
+/*
+ * Change CPOL & CPHA. The module has to be disabled first.
+ */
+static int dln2_spi_set_mode(struct dln2_spi *dln2, u8 mode)
+{
+        struct {
+                u8 port;
+                u8 mode;
+        } tx;
+        tx.port = dln2->port;
+        tx.mode = mode;
+        return dln2_transfer_tx(dln2->pdev, DLN2_SPI_SET_MODE, &tx, sizeof(tx));
+}
+/*
+ * Change frame size. The module has to be disabled first.
+ */
+static int dln2_spi_set_bpw(struct dln2_spi *dln2, u8 bpw)
+{
+        struct {
+                u8 port;
+                u8 bpw;
+        } tx;
+        tx.port = dln2->port;
+        tx.bpw = bpw;
+        return dln2_transfer_tx(dln2->pdev, DLN2_SPI_SET_FRAME_SIZE,
+                                &tx, sizeof(tx));
+}
+static int dln2_spi_get_supported_frame_sizes(struct dln2_spi *dln2,
+                                              u32 *bpw_mask)
+{
+        int ret;
+        struct {
+                u8 port;
+        } tx;
+        struct {
+                u8 count;
+                u8 frame_sizes[36];
+        } *rx = dln2->buf;
+        unsigned rx_len = sizeof(*rx);
+        int i;
+        tx.port = dln2->port;
+        ret = dln2_transfer(dln2->pdev, DLN2_SPI_GET_SUPPORTED_FRAME_SIZES,
+                            &tx, sizeof(tx), rx, &rx_len);
+        if (ret < 0)
+                return ret;
+        if (rx_len < sizeof(*rx))
+                return -EPROTO;
+        if (rx->count > ARRAY_SIZE(rx->frame_sizes))
+                return -EPROTO;
+        *bpw_mask = 0;
+        for (i = 0; i < rx->count; i++)
+                *bpw_mask |= BIT(rx->frame_sizes[i] - 1);
+        dev_dbg(&dln2->pdev->dev, "bpw_mask = 0x%X\n", *bpw_mask);
+        return 0;
+}
+/*
+ * Copy the data to DLN2 buffer and change the byte order to LE, requested by
+ * DLN2 module. SPI core makes sure that the data length is a multiple of word
+ * size.
+ */
+static int dln2_spi_copy_to_buf(u8 *dln2_buf, const u8 *src, u16 len, u8 bpw)
+{
+#ifdef __LITTLE_ENDIAN
+        memcpy(dln2_buf, src, len);
+#else
+        if (bpw <= 8) {
+                memcpy(dln2_buf, src, len);
+        } else if (bpw <= 16) {
+                __le16 *d = (__le16 *)dln2_buf;
+                u16 *s = (u16 *)src;
+                len = len / 2;
+                while (len--)
+                        *d++ = cpu_to_le16p(s++);
+        } else {
+                __le32 *d = (__le32 *)dln2_buf;
+                u32 *s = (u32 *)src;
+                len = len / 4;
+                while (len--)
+                        *d++ = cpu_to_le32p(s++);
+        }
+#endif
+        return 0;
+}
+/*
+ * Copy the data from DLN2 buffer and convert to CPU byte order since the DLN2
+ * buffer is LE ordered. SPI core makes sure that the data length is a multiple
+ * of word size. The RX dln2_buf is 2 byte aligned so, for BE, we have to make
+ * sure we avoid unaligned accesses for 32 bit case.
+ */
+static int dln2_spi_copy_from_buf(u8 *dest, const u8 *dln2_buf, u16 len, u8 bpw)
+{
+#ifdef __LITTLE_ENDIAN
+        memcpy(dest, dln2_buf, len);
+#else
+        if (bpw <= 8) {
+                memcpy(dest, dln2_buf, len);
+        } else if (bpw <= 16) {
+                u16 *d = (u16 *)dest;
+                __le16 *s = (__le16 *)dln2_buf;
+                len = len / 2;
+                while (len--)
+                        *d++ = le16_to_cpup(s++);
+        } else {
+                u32 *d = (u32 *)dest;
+                __le32 *s = (__le32 *)dln2_buf;
+                len = len / 4;
+                while (len--)
+                        *d++ = get_unaligned_le32(s++);
+        }
+#endif
+        return 0;
+}
+/*
+ * Perform one write operation.
+ */
+static int dln2_spi_write_one(struct dln2_spi *dln2, const u8 *data,
+                              u16 data_len, u8 attr)
+{
+        struct {
+                u8 port;
+                __le16 size;
+                u8 attr;
+                u8 buf[DLN2_SPI_MAX_XFER_SIZE];
+        } __packed *tx = dln2->buf;
+        unsigned tx_len;
+        BUILD_BUG_ON(sizeof(*tx) > DLN2_SPI_BUF_SIZE);
+        if (data_len > DLN2_SPI_MAX_XFER_SIZE)
+                return -EINVAL;
+        tx->port = dln2->port;
+        tx->size = cpu_to_le16(data_len);
+        tx->attr = attr;
+        dln2_spi_copy_to_buf(tx->buf, data, data_len, dln2->bpw);
+        tx_len = sizeof(*tx) + data_len - DLN2_SPI_MAX_XFER_SIZE;
+        return dln2_transfer_tx(dln2->pdev, DLN2_SPI_WRITE, tx, tx_len);
+}
+/*
+ * Perform one read operation.
+ */
+static int dln2_spi_read_one(struct dln2_spi *dln2, u8 *data,
+                             u16 data_len, u8 attr)
+{
+        int ret;
+        struct {
+                u8 port;
+                __le16 size;
+                u8 attr;
+        } __packed tx;
+        struct {
+                __le16 size;
+                u8 buf[DLN2_SPI_MAX_XFER_SIZE];
+        } __packed *rx = dln2->buf;
+        unsigned rx_len = sizeof(*rx);
+        BUILD_BUG_ON(sizeof(*rx) > DLN2_SPI_BUF_SIZE);
+        if (data_len > DLN2_SPI_MAX_XFER_SIZE)
+                return -EINVAL;
+        tx.port = dln2->port;
+        tx.size = cpu_to_le16(data_len);
+        tx.attr = attr;
+        ret = dln2_transfer(dln2->pdev, DLN2_SPI_READ, &tx, sizeof(tx),
+                            rx, &rx_len);
+        if (ret < 0)
+                return ret;
+        if (rx_len < sizeof(rx->size) + data_len)
+                return -EPROTO;
+        if (le16_to_cpu(rx->size) != data_len)
+                return -EPROTO;
+        dln2_spi_copy_from_buf(data, rx->buf, data_len, dln2->bpw);
+        return 0;
+}
+/*
+ * Perform one write & read operation.
+ */
+static int dln2_spi_read_write_one(struct dln2_spi *dln2, const u8 *tx_data,
+                                   u8 *rx_data, u16 data_len, u8 attr)
+{
+        int ret;
+        struct {
+                u8 port;
+                __le16 size;
+                u8 attr;
+                u8 buf[DLN2_SPI_MAX_XFER_SIZE];
+        } __packed *tx;
+        struct {
+                __le16 size;
+                u8 buf[DLN2_SPI_MAX_XFER_SIZE];
+        } __packed *rx;
+        unsigned tx_len, rx_len;
+        BUILD_BUG_ON(sizeof(*tx) > DLN2_SPI_BUF_SIZE ||
+                     sizeof(*rx) > DLN2_SPI_BUF_SIZE);
+        if (data_len > DLN2_SPI_MAX_XFER_SIZE)
+                return -EINVAL;
+        /*
+         * Since this is a pseudo full-duplex communication, we're perfectly
+         * safe to use the same buffer for both tx and rx. When DLN2 sends the
+         * response back, with the rx data, we don't need the tx buffer anymore.
+         */
+        tx = dln2->buf;
+        rx = dln2->buf;
+        tx->port = dln2->port;
+        tx->size = cpu_to_le16(data_len);
+        tx->attr = attr;
+        dln2_spi_copy_to_buf(tx->buf, tx_data, data_len, dln2->bpw);
+        tx_len = sizeof(*tx) + data_len - DLN2_SPI_MAX_XFER_SIZE;
+        rx_len = sizeof(*rx);
+        ret = dln2_transfer(dln2->pdev, DLN2_SPI_READ_WRITE, tx, tx_len,
+                            rx, &rx_len);
+        if (ret < 0)
+                return ret;
+        if (rx_len < sizeof(rx->size) + data_len)
+                return -EPROTO;
+        if (le16_to_cpu(rx->size) != data_len)
+                return -EPROTO;
+        dln2_spi_copy_from_buf(rx_data, rx->buf, data_len, dln2->bpw);
+        return 0;
+}
+/*
+ * Read/Write wrapper. It will automatically split an operation into multiple
+ * single ones due to device buffer constraints.
+ */
+static int dln2_spi_rdwr(struct dln2_spi *dln2, const u8 *tx_data,
+                         u8 *rx_data, u16 data_len, u8 attr) {
+        int ret;
+        u16 len;
+        u8 temp_attr;
+        u16 remaining = data_len;
+        u16 offset;
+        do {
+                if (remaining > DLN2_SPI_MAX_XFER_SIZE) {
+                        len = DLN2_SPI_MAX_XFER_SIZE;
+                        temp_attr = DLN2_SPI_ATTR_LEAVE_SS_LOW;
+                } else {
+                        len = remaining;
+                        temp_attr = attr;
+                }
+                offset = data_len - remaining;
+                if (tx_data && rx_data) {
+                        ret = dln2_spi_read_write_one(dln2,
+                                                      tx_data + offset,
+                                                      rx_data + offset,
+                                                      len, temp_attr);
+                } else if (tx_data) {
+                        ret = dln2_spi_write_one(dln2,
+                                                 tx_data + offset,
+                                                 len, temp_attr);
+                } else if (rx_data) {
+                        ret = dln2_spi_read_one(dln2,
+                                                rx_data + offset,
+                                                len, temp_attr);
+                 } else {
+                        return -EINVAL;
+                 }
+                if (ret < 0)
+                        return ret;
+                remaining -= len;
+        } while (remaining);
+        return 0;
+}
+static int dln2_spi_prepare_message(struct spi_master *master,
+                                    struct spi_message *message)
+{
+        int ret;
+        struct dln2_spi *dln2 = spi_master_get_devdata(master);
+        struct spi_device *spi = message->spi;
+        if (dln2->cs != spi->chip_select) {
+                ret = dln2_spi_cs_set_one(dln2, spi->chip_select);
+                if (ret < 0)
+                        return ret;
+                dln2->cs = spi->chip_select;
+        }
+        return 0;
+}
+static int dln2_spi_transfer_setup(struct dln2_spi *dln2, u32 speed,
+                                   u8 bpw, u8 mode)
+{
+        int ret;
+        bool bus_setup_change;
+        bus_setup_change = dln2->speed != speed || dln2->mode != mode ||
+                           dln2->bpw != bpw;
+        if (!bus_setup_change)
+                return 0;
+        ret = dln2_spi_enable(dln2, false);
+        if (ret < 0)
+                return ret;
+        if (dln2->speed != speed) {
+                ret = dln2_spi_set_speed(dln2, speed);
+                if (ret < 0)
+                        return ret;
+                dln2->speed = speed;
+        }
+        if (dln2->mode != mode) {
+                ret = dln2_spi_set_mode(dln2, mode & 0x3);
+                if (ret < 0)
+                        return ret;
+                dln2->mode = mode;
+        }
+        if (dln2->bpw != bpw) {
+                ret = dln2_spi_set_bpw(dln2, bpw);
+                if (ret < 0)
+                        return ret;
+                dln2->bpw = bpw;
+        }
+        return dln2_spi_enable(dln2, true);
+}
+static int dln2_spi_transfer_one(struct spi_master *master,
+                                 struct spi_device *spi,
+                                 struct spi_transfer *xfer)
+{
+        struct dln2_spi *dln2 = spi_master_get_devdata(master);
+        int status;
+        u8 attr = 0;
+        status = dln2_spi_transfer_setup(dln2, xfer->speed_hz,
+                                         xfer->bits_per_word,
+                                         spi->mode);
+        if (status < 0) {
+                dev_err(&dln2->pdev->dev, "Cannot setup transfer\n");
+                return status;
+        }
+        if (!xfer->cs_change && !spi_transfer_is_last(master, xfer))
+                attr = DLN2_SPI_ATTR_LEAVE_SS_LOW;
+        status = dln2_spi_rdwr(dln2, xfer->tx_buf, xfer->rx_buf,
+                               xfer->len, attr);
+        if (status < 0)
+                dev_err(&dln2->pdev->dev, "write/read failed!\n");
+        return status;
+}
+static int dln2_spi_probe(struct platform_device *pdev)
+{
+        struct spi_master *master;
+        struct dln2_spi *dln2;
+        struct dln2_platform_data *pdata = dev_get_platdata(&pdev->dev);
+        int ret;
+        master = spi_alloc_master(&pdev->dev, sizeof(*dln2));
+        if (!master)
+                return -ENOMEM;
+        platform_set_drvdata(pdev, master);
+        dln2 = spi_master_get_devdata(master);
+        dln2->buf = devm_kmalloc(&pdev->dev, DLN2_SPI_BUF_SIZE, GFP_KERNEL);
+        if (!dln2->buf) {
+                ret = -ENOMEM;
+                goto exit_free_master;
+        }
+        dln2->master = master;
+        dln2->pdev = pdev;
+        dln2->port = pdata->port;
+        /* cs/mode can never be 0xff, so the first transfer will set them */
+        dln2->cs = 0xff;
+        dln2->mode = 0xff;
+        /* disable SPI module before continuing with the setup */
+        ret = dln2_spi_enable(dln2, false);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Failed to disable SPI module\n");
+                goto exit_free_master;
+        }
+        ret = dln2_spi_get_cs_num(dln2, &master->num_chipselect);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Failed to get number of CS pins\n");
+                goto exit_free_master;
+        }
+        ret = dln2_spi_get_speed_range(dln2,
+                                       &master->min_speed_hz,
+                                       &master->max_speed_hz);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Failed to read bus min/max freqs\n");
+                goto exit_free_master;
+        }
+        ret = dln2_spi_get_supported_frame_sizes(dln2,
+                                                 &master->bits_per_word_mask);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Failed to read supported frame sizes\n");
+                goto exit_free_master;
+        }
+        ret = dln2_spi_cs_enable_all(dln2, true);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Failed to enable CS pins\n");
+                goto exit_free_master;
+        }
+        master->bus_num = -1;
+        master->mode_bits = SPI_CPOL | SPI_CPHA;
+        master->prepare_message = dln2_spi_prepare_message;
+        master->transfer_one = dln2_spi_transfer_one;
+        master->auto_runtime_pm = true;
+        /* enable SPI module, we're good to go */
+        ret = dln2_spi_enable(dln2, true);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Failed to enable SPI module\n");
+                goto exit_free_master;
+        }
+        pm_runtime_set_autosuspend_delay(&pdev->dev,
+                                         DLN2_RPM_AUTOSUSPEND_TIMEOUT);
+        pm_runtime_use_autosuspend(&pdev->dev);
+        pm_runtime_set_active(&pdev->dev);
+        pm_runtime_enable(&pdev->dev);
+        ret = devm_spi_register_master(&pdev->dev, master);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Failed to register master\n");
+                goto exit_register;
+        }
+        return ret;
+exit_register:
+        pm_runtime_disable(&pdev->dev);
+        pm_runtime_set_suspended(&pdev->dev);
+        if (dln2_spi_enable(dln2, false) < 0)
+                dev_err(&pdev->dev, "Failed to disable SPI module\n");
+exit_free_master:
+        spi_master_put(master);
+        return ret;
+}
+static int dln2_spi_remove(struct platform_device *pdev)
+{
+        struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+        struct dln2_spi *dln2 = spi_master_get_devdata(master);
+        pm_runtime_disable(&pdev->dev);
+        if (dln2_spi_enable(dln2, false) < 0)
+                dev_err(&pdev->dev, "Failed to disable SPI module\n");
+        return 0;
+}
+#ifdef CONFIG_PM_SLEEP
+static int dln2_spi_suspend(struct device *dev)
+{
+        int ret;
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct dln2_spi *dln2 = spi_master_get_devdata(master);
+        ret = spi_master_suspend(master);
+        if (ret < 0)
+                return ret;
+        if (!pm_runtime_suspended(dev)) {
+                ret = dln2_spi_enable(dln2, false);
+                if (ret < 0)
+                        return ret;
+        }
+        /*
+         * USB power may be cut off during sleep. Resetting the following
+         * parameters will force the board to be set up before first transfer.
+         */
+        dln2->cs = 0xff;
+        dln2->speed = 0;
+        dln2->bpw = 0;
+        dln2->mode = 0xff;
+        return 0;
+}
+static int dln2_spi_resume(struct device *dev)
+{
+        int ret;
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct dln2_spi *dln2 = spi_master_get_devdata(master);
+        if (!pm_runtime_suspended(dev)) {
+                ret = dln2_spi_cs_enable_all(dln2, true);
+                if (ret < 0)
+                        return ret;
+                ret = dln2_spi_enable(dln2, true);
+                if (ret < 0)
+                        return ret;
+        }
+        return spi_master_resume(master);
+}
+#endif /* CONFIG_PM_SLEEP */
+#ifdef CONFIG_PM
+static int dln2_spi_runtime_suspend(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct dln2_spi *dln2 = spi_master_get_devdata(master);
+        return dln2_spi_enable(dln2, false);
+}
+static int dln2_spi_runtime_resume(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct dln2_spi *dln2 = spi_master_get_devdata(master);
+        return  dln2_spi_enable(dln2, true);
+}
+#endif /* CONFIG_PM */
+static const struct dev_pm_ops dln2_spi_pm = {
+        SET_SYSTEM_SLEEP_PM_OPS(dln2_spi_suspend, dln2_spi_resume)
+        SET_RUNTIME_PM_OPS(dln2_spi_runtime_suspend,
+                           dln2_spi_runtime_resume, NULL)
+};
+static struct platform_driver spi_dln2_driver = {
+        .driver = {
+                .name   = "dln2-spi",
+                .pm     = &dln2_spi_pm,
+        },
+        .probe          = dln2_spi_probe,
+        .remove         = dln2_spi_remove,
+};
+module_platform_driver(spi_dln2_driver);
+MODULE_DESCRIPTION("Driver for the Diolan DLN2 SPI master interface");
+MODULE_AUTHOR("Laurentiu Palcu <laurentiu.palcu@intel.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:dln2-spi");
diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
index 7281316a5ecb..a0197fd4e95c 100644
--- a/drivers/spi/spi-dw-mid.c
+++ b/drivers/spi/spi-dw-mid.c
@@ -247,9 +247,9 @@ static struct dw_spi_dma_ops mid_dma_ops = {
 /* Some specific info for SPI0 controller on Intel MID */
-/* HW info for MRST CLk Control Unit, one 32b reg */
+/* HW info for MRST Clk Control Unit, 32b reg per controller */
 #define MRST_SPI_CLK_BASE       100000000       /* 100m */
-#define MRST_CLK_SPI0_REG       0xff11d86c
+#define MRST_CLK_SPI_REG        0xff11d86c
 #define CLK_SPI_BDIV_OFFSET     0
 #define CLK_SPI_BDIV_MASK       0x00000007
 #define CLK_SPI_CDIV_OFFSET     9
@@ -261,17 +261,17 @@ int dw_spi_mid_init(struct dw_spi *dws)
        void __iomem *clk_reg;
        u32 clk_cdiv;
-        clk_reg = ioremap_nocache(MRST_CLK_SPI0_REG, 16);
+        clk_reg = ioremap_nocache(MRST_CLK_SPI_REG, 16);
        if (!clk_reg)
                return -ENOMEM;
-        /* get SPI controller operating freq info */
+        /* Get SPI controller operating freq info */
-        clk_cdiv  = (readl(clk_reg) & CLK_SPI_CDIV_MASK) >> CLK_SPI_CDIV_OFFSET;
+        clk_cdiv = readl(clk_reg + dws->bus_num * sizeof(u32));
+        clk_cdiv &= CLK_SPI_CDIV_MASK;
+        clk_cdiv >>= CLK_SPI_CDIV_OFFSET;
        dws->max_freq = MRST_SPI_CLK_BASE / (clk_cdiv + 1);
-        iounmap(clk_reg);
-        dws->num_cs = 16;
+        iounmap(clk_reg);
-        dws->fifo_len = 40;     /* FIFO has 40 words buffer */
 #ifdef CONFIG_SPI_DW_MID_DMA
        dws->dma_priv = kzalloc(sizeof(struct mid_dma), GFP_KERNEL);
diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c
index ba68da12cdf0..5ba331047cbe 100644
--- a/drivers/spi/spi-dw-pci.c
+++ b/drivers/spi/spi-dw-pci.c
@@ -30,10 +30,20 @@ struct dw_spi_pci {
 struct spi_pci_desc {
        int     (*setup)(struct dw_spi *);
+        u16     num_cs;
+        u16     bus_num;
 };
-static struct spi_pci_desc spi_pci_mid_desc = {
+static struct spi_pci_desc spi_pci_mid_desc_1 = {
        .setup = dw_spi_mid_init,
+        .num_cs = 32,
+        .bus_num = 0,
+};
+static struct spi_pci_desc spi_pci_mid_desc_2 = {
+        .setup = dw_spi_mid_init,
+        .num_cs = 4,
+        .bus_num = 1,
 };
 static int spi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@@ -65,18 +75,23 @@ static int spi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        dws->regs = pcim_iomap_table(pdev)[pci_bar];
-        dws->bus_num = 0;
-        dws->num_cs = 4;
        dws->irq = pdev->irq;
        /*
         * Specific handling for paltforms, like dma setup,
         * clock rate, FIFO depth.
         */
-        if (desc && desc->setup) {
+        if (desc) {
-                ret = desc->setup(dws);
+                dws->num_cs = desc->num_cs;
-                if (ret)
+                dws->bus_num = desc->bus_num;
-                        return ret;
+                if (desc->setup) {
+                        ret = desc->setup(dws);
+                        if (ret)
+                                return ret;
+                }
+        } else {
+                return -ENODEV;
        }
        ret = dw_spi_add_host(&pdev->dev, dws);
@@ -121,7 +136,14 @@ static SIMPLE_DEV_PM_OPS(dw_spi_pm_ops, spi_suspend, spi_resume);
 static const struct pci_device_id pci_ids[] = {
        /* Intel MID platform SPI controller 0 */
-        { PCI_VDEVICE(INTEL, 0x0800), (kernel_ulong_t)&spi_pci_mid_desc},
+        /*
+         * The access to the device 8086:0801 is disabled by HW, since it's
+         * exclusively used by SCU to communicate with MSIC.
+         */
+        /* Intel MID platform SPI controller 1 */
+        { PCI_VDEVICE(INTEL, 0x0800), (kernel_ulong_t)&spi_pci_mid_desc_1},
+        /* Intel MID platform SPI controller 2 */
+        { PCI_VDEVICE(INTEL, 0x0812), (kernel_ulong_t)&spi_pci_mid_desc_2},
        {},
 };
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index d0d5542efc06..5a97a62b298a 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -608,7 +608,7 @@ static void dw_spi_cleanup(struct spi_device *spi)
 }
 /* Restart the controller, disable all interrupts, clean rx fifo */
-static void spi_hw_init(struct dw_spi *dws)
+static void spi_hw_init(struct device *dev, struct dw_spi *dws)
 {
        spi_enable_chip(dws, 0);
        spi_mask_intr(dws, 0xff);
@@ -621,14 +621,15 @@ static void spi_hw_init(struct dw_spi *dws)
        if (!dws->fifo_len) {
                u32 fifo;
-                for (fifo = 2; fifo <= 257; fifo++) {
+                for (fifo = 2; fifo <= 256; fifo++) {
                        dw_writew(dws, DW_SPI_TXFLTR, fifo);
                        if (fifo != dw_readw(dws, DW_SPI_TXFLTR))
                                break;
                }
-                dws->fifo_len = (fifo == 257) ? 0 : fifo;
                dw_writew(dws, DW_SPI_TXFLTR, 0);
+                dws->fifo_len = (fifo == 2) ? 0 : fifo - 1;
+                dev_dbg(dev, "Detected FIFO size: %u bytes\n", dws->fifo_len);
        }
 }
@@ -668,12 +669,12 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws)
        master->dev.of_node = dev->of_node;
        /* Basic HW init */
-        spi_hw_init(dws);
+        spi_hw_init(dev, dws);
        if (dws->dma_ops && dws->dma_ops->dma_init) {
                ret = dws->dma_ops->dma_init(dws);
                if (ret) {
-                        dev_warn(&master->dev, "DMA init failed\n");
+                        dev_warn(dev, "DMA init failed\n");
                        dws->dma_inited = 0;
                }
        }
@@ -731,7 +732,7 @@ int dw_spi_resume_host(struct dw_spi *dws)
 {
        int ret;
-        spi_hw_init(dws);
+        spi_hw_init(&dws->master->dev, dws);
        ret = spi_master_resume(dws->master);
        if (ret)
                dev_err(&dws->master->dev, "fail to start queue (%d)\n", ret);
diff --git a/drivers/spi/spi-falcon.c b/drivers/spi/spi-falcon.c
index 912b9037e9cf..286b2c81fc6b 100644
--- a/drivers/spi/spi-falcon.c
+++ b/drivers/spi/spi-falcon.c
@@ -353,16 +353,6 @@ static int falcon_sflash_setup(struct spi_device *spi)
        return 0;
 }
-static int falcon_sflash_prepare_xfer(struct spi_master *master)
-{
-        return 0;
-}
-static int falcon_sflash_unprepare_xfer(struct spi_master *master)
-{
-        return 0;
-}
 static int falcon_sflash_xfer_one(struct spi_master *master,
                                        struct spi_message *m)
 {
@@ -420,9 +410,7 @@ static int falcon_sflash_probe(struct platform_device *pdev)
        master->mode_bits = SPI_MODE_3;
        master->flags = SPI_MASTER_HALF_DUPLEX;
        master->setup = falcon_sflash_setup;
-        master->prepare_transfer_hardware = falcon_sflash_prepare_xfer;
        master->transfer_one_message = falcon_sflash_xfer_one;
-        master->unprepare_transfer_hardware = falcon_sflash_unprepare_xfer;
        master->dev.of_node = pdev->dev.of_node;
        ret = devm_spi_register_master(&pdev->dev, master);
diff --git a/drivers/spi/spi-fsl-cpm.c b/drivers/spi/spi-fsl-cpm.c
index e85ab1cb17a2..9c46a3058743 100644
--- a/drivers/spi/spi-fsl-cpm.c
+++ b/drivers/spi/spi-fsl-cpm.c
@@ -20,6 +20,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/fsl_devices.h>
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/of_address.h>
 #include <linux/spi/spi.h>
 #include <linux/types.h>
@@ -68,6 +69,7 @@ void fsl_spi_cpm_reinit_txrx(struct mpc8xxx_spi *mspi)
                }
        }
 }
+EXPORT_SYMBOL_GPL(fsl_spi_cpm_reinit_txrx);
 static void fsl_spi_cpm_bufs_start(struct mpc8xxx_spi *mspi)
 {
@@ -162,6 +164,7 @@ err_rx_dma:
                dma_unmap_single(dev, mspi->tx_dma, t->len, DMA_TO_DEVICE);
        return -ENOMEM;
 }
+EXPORT_SYMBOL_GPL(fsl_spi_cpm_bufs);
 void fsl_spi_cpm_bufs_complete(struct mpc8xxx_spi *mspi)
 {
@@ -174,6 +177,7 @@ void fsl_spi_cpm_bufs_complete(struct mpc8xxx_spi *mspi)
                dma_unmap_single(dev, mspi->rx_dma, t->len, DMA_FROM_DEVICE);
        mspi->xfer_in_progress = NULL;
 }
+EXPORT_SYMBOL_GPL(fsl_spi_cpm_bufs_complete);
 void fsl_spi_cpm_irq(struct mpc8xxx_spi *mspi, u32 events)
 {
@@ -198,6 +202,7 @@ void fsl_spi_cpm_irq(struct mpc8xxx_spi *mspi, u32 events)
        else
                complete(&mspi->done);
 }
+EXPORT_SYMBOL_GPL(fsl_spi_cpm_irq);
 static void *fsl_spi_alloc_dummy_rx(void)
 {
@@ -375,6 +380,7 @@ err_pram:
        fsl_spi_free_dummy_rx();
        return -ENOMEM;
 }
+EXPORT_SYMBOL_GPL(fsl_spi_cpm_init);
 void fsl_spi_cpm_free(struct mpc8xxx_spi *mspi)
 {
@@ -389,3 +395,6 @@ void fsl_spi_cpm_free(struct mpc8xxx_spi *mspi)
        cpm_muram_free(cpm_muram_offset(mspi->pram));
        fsl_spi_free_dummy_rx();
 }
+EXPORT_SYMBOL_GPL(fsl_spi_cpm_free);
+MODULE_LICENSE("GPL");
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 4cda994d3f40..d1a39249704a 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -106,7 +106,7 @@ struct chip_data {
 };
 struct fsl_dspi {
-        struct spi_bitbang      bitbang;
+        struct spi_master       *master;
        struct platform_device  *pdev;
        struct regmap           *regmap;
@@ -114,6 +114,7 @@ struct fsl_dspi {
        struct clk              *clk;
        struct spi_transfer     *cur_transfer;
+        struct spi_message      *cur_msg;
        struct chip_data        *cur_chip;
        size_t                  len;
        void                    *tx;
@@ -123,6 +124,7 @@ struct fsl_dspi {
        char                    dataflags;
        u8                      cs;
        u16                     void_write_data;
+        u32                     cs_change;
        wait_queue_head_t       waitq;
        u32                     waitflags;
@@ -225,6 +227,8 @@ static int dspi_transfer_write(struct fsl_dspi *dspi)
                if (dspi->len == 0 || tx_count == DSPI_FIFO_SIZE - 1) {
                        /* last transfer in the transfer */
                        dspi_pushr |= SPI_PUSHR_EOQ;
+                        if ((dspi->cs_change) && (!dspi->len))
+                                dspi_pushr &= ~SPI_PUSHR_CONT;
                } else if (tx_word && (dspi->len == 1))
                        dspi_pushr |= SPI_PUSHR_EOQ;
@@ -246,6 +250,7 @@ static int dspi_transfer_read(struct fsl_dspi *dspi)
        int rx_count = 0;
        int rx_word = is_double_byte_mode(dspi);
        u16 d;
        while ((dspi->rx < dspi->rx_end)
                        && (rx_count < DSPI_FIFO_SIZE)) {
                if (rx_word) {
@@ -276,86 +281,89 @@ static int dspi_transfer_read(struct fsl_dspi *dspi)
        return rx_count;
 }
-static int dspi_txrx_transfer(struct spi_device *spi, struct spi_transfer *t)
+static int dspi_transfer_one_message(struct spi_master *master,
+                struct spi_message *message)
 {
-        struct fsl_dspi *dspi = spi_master_get_devdata(spi->master);
+        struct fsl_dspi *dspi = spi_master_get_devdata(master);
-        dspi->cur_transfer = t;
+        struct spi_device *spi = message->spi;
-        dspi->cur_chip = spi_get_ctldata(spi);
+        struct spi_transfer *transfer;
-        dspi->cs = spi->chip_select;
+        int status = 0;
-        dspi->void_write_data = dspi->cur_chip->void_write_data;
+        message->actual_length = 0;
-        dspi->dataflags = 0;
+        list_for_each_entry(transfer, &message->transfers, transfer_list) {
-        dspi->tx = (void *)t->tx_buf;
+                dspi->cur_transfer = transfer;
-        dspi->tx_end = dspi->tx + t->len;
+                dspi->cur_msg = message;
-        dspi->rx = t->rx_buf;
+                dspi->cur_chip = spi_get_ctldata(spi);
-        dspi->rx_end = dspi->rx + t->len;
+                dspi->cs = spi->chip_select;
-        dspi->len = t->len;
+                if (dspi->cur_transfer->transfer_list.next
+                                == &dspi->cur_msg->transfers)
-        if (!dspi->rx)
+                        transfer->cs_change = 1;
-                dspi->dataflags |= TRAN_STATE_RX_VOID;
+                dspi->cs_change = transfer->cs_change;
+                dspi->void_write_data = dspi->cur_chip->void_write_data;
-        if (!dspi->tx)
-                dspi->dataflags |= TRAN_STATE_TX_VOID;
+                dspi->dataflags = 0;
+                dspi->tx = (void *)transfer->tx_buf;
-        regmap_write(dspi->regmap, SPI_MCR, dspi->cur_chip->mcr_val);
+                dspi->tx_end = dspi->tx + transfer->len;
-        regmap_write(dspi->regmap, SPI_CTAR(dspi->cs), dspi->cur_chip->ctar_val);
+                dspi->rx = transfer->rx_buf;
-        regmap_write(dspi->regmap, SPI_RSER, SPI_RSER_EOQFE);
+                dspi->rx_end = dspi->rx + transfer->len;
+                dspi->len = transfer->len;
-        if (t->speed_hz)
+                if (!dspi->rx)
+                        dspi->dataflags |= TRAN_STATE_RX_VOID;
+                if (!dspi->tx)
+                        dspi->dataflags |= TRAN_STATE_TX_VOID;
+                regmap_write(dspi->regmap, SPI_MCR, dspi->cur_chip->mcr_val);
+                regmap_update_bits(dspi->regmap, SPI_MCR,
+                                SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF,
+                                SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF);
                regmap_write(dspi->regmap, SPI_CTAR(dspi->cs),
                                dspi->cur_chip->ctar_val);
+                if (transfer->speed_hz)
+                        regmap_write(dspi->regmap, SPI_CTAR(dspi->cs),
+                                        dspi->cur_chip->ctar_val);
-        dspi_transfer_write(dspi);
+                regmap_write(dspi->regmap, SPI_RSER, SPI_RSER_EOQFE);
+                message->actual_length += dspi_transfer_write(dspi);
-        if (wait_event_interruptible(dspi->waitq, dspi->waitflags))
+                if (wait_event_interruptible(dspi->waitq, dspi->waitflags))
-                dev_err(&dspi->pdev->dev, "wait transfer complete fail!\n");
+                        dev_err(&dspi->pdev->dev, "wait transfer complete fail!\n");
-        dspi->waitflags = 0;
+                dspi->waitflags = 0;
-        return t->len - dspi->len;
-}
-static void dspi_chipselect(struct spi_device *spi, int value)
+                if (transfer->delay_usecs)
-{
+                        udelay(transfer->delay_usecs);
-        struct fsl_dspi *dspi = spi_master_get_devdata(spi->master);
-        unsigned int pushr;
-        regmap_read(dspi->regmap, SPI_PUSHR, &pushr);
-        switch (value) {
-        case BITBANG_CS_ACTIVE:
-                pushr |= SPI_PUSHR_CONT;
-                break;
-        case BITBANG_CS_INACTIVE:
-                pushr &= ~SPI_PUSHR_CONT;
-                break;
        }
-        regmap_write(dspi->regmap, SPI_PUSHR, pushr);
+        message->status = status;
+        spi_finalize_current_message(master);
+        return status;
 }
-static int dspi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
+static int dspi_setup(struct spi_device *spi)
 {
        struct chip_data *chip;
        struct fsl_dspi *dspi = spi_master_get_devdata(spi->master);
        unsigned char br = 0, pbr = 0, fmsz = 0;
+        if ((spi->bits_per_word >= 4) && (spi->bits_per_word <= 16)) {
+                fmsz = spi->bits_per_word - 1;
+        } else {
+                pr_err("Invalid wordsize\n");
+                return -ENODEV;
+        }
        /* Only alloc on first setup */
        chip = spi_get_ctldata(spi);
        if (chip == NULL) {
-                chip = devm_kzalloc(&spi->dev, sizeof(struct chip_data),
+                chip = kzalloc(sizeof(struct chip_data), GFP_KERNEL);
-                                    GFP_KERNEL);
                if (!chip)
                        return -ENOMEM;
        }
        chip->mcr_val = SPI_MCR_MASTER | SPI_MCR_PCSIS |
                SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF;
-        if ((spi->bits_per_word >= 4) && (spi->bits_per_word <= 16)) {
-                fmsz = spi->bits_per_word - 1;
-        } else {
-                pr_err("Invalid wordsize\n");
-                return -ENODEV;
-        }
        chip->void_write_data = 0;
@@ -374,34 +382,34 @@ static int dspi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
        return 0;
 }
-static int dspi_setup(struct spi_device *spi)
+static void dspi_cleanup(struct spi_device *spi)
 {
-        if (!spi->max_speed_hz)
+        struct chip_data *chip = spi_get_ctldata((struct spi_device *)spi);
-                return -EINVAL;
+        dev_dbg(&spi->dev, "spi_device %u.%u cleanup\n",
+                        spi->master->bus_num, spi->chip_select);
-        return dspi_setup_transfer(spi, NULL);
+        kfree(chip);
 }
 static irqreturn_t dspi_interrupt(int irq, void *dev_id)
 {
        struct fsl_dspi *dspi = (struct fsl_dspi *)dev_id;
-        regmap_write(dspi->regmap, SPI_SR, SPI_SR_EOQF);
+        struct spi_message *msg = dspi->cur_msg;
+        regmap_write(dspi->regmap, SPI_SR, SPI_SR_EOQF);
        dspi_transfer_read(dspi);
        if (!dspi->len) {
                if (dspi->dataflags & TRAN_STATE_WORD_ODD_NUM)
                        regmap_update_bits(dspi->regmap, SPI_CTAR(dspi->cs),
-                                SPI_FRAME_BITS_MASK, SPI_FRAME_BITS(16));
+                        SPI_FRAME_BITS_MASK, SPI_FRAME_BITS(16));
                dspi->waitflags = 1;
                wake_up_interruptible(&dspi->waitq);
-        } else {
+        } else
-                dspi_transfer_write(dspi);
+                msg->actual_length += dspi_transfer_write(dspi);
-                return IRQ_HANDLED;
-        }
        return IRQ_HANDLED;
 }
@@ -460,13 +468,14 @@ static int dspi_probe(struct platform_device *pdev)
        dspi = spi_master_get_devdata(master);
        dspi->pdev = pdev;
-        dspi->bitbang.master = master;
+        dspi->master = master;
-        dspi->bitbang.chipselect = dspi_chipselect;
-        dspi->bitbang.setup_transfer = dspi_setup_transfer;
+        master->transfer = NULL;
-        dspi->bitbang.txrx_bufs = dspi_txrx_transfer;
+        master->setup = dspi_setup;
-        dspi->bitbang.master->setup = dspi_setup;
+        master->transfer_one_message = dspi_transfer_one_message;
-        dspi->bitbang.master->dev.of_node = pdev->dev.of_node;
+        master->dev.of_node = pdev->dev.of_node;
+        master->cleanup = dspi_cleanup;
        master->mode_bits = SPI_CPOL | SPI_CPHA;
        master->bits_per_word_mask = SPI_BPW_MASK(4) | SPI_BPW_MASK(8) |
                                        SPI_BPW_MASK(16);
@@ -525,7 +534,7 @@ static int dspi_probe(struct platform_device *pdev)
        init_waitqueue_head(&dspi->waitq);
        platform_set_drvdata(pdev, master);
-        ret = spi_bitbang_start(&dspi->bitbang);
+        ret = spi_register_master(master);
        if (ret != 0) {
                dev_err(&pdev->dev, "Problem registering DSPI master\n");
                goto out_clk_put;
@@ -547,9 +556,9 @@ static int dspi_remove(struct platform_device *pdev)
        struct fsl_dspi *dspi = spi_master_get_devdata(master);
        /* Disconnect from the SPI framework */
-        spi_bitbang_stop(&dspi->bitbang);
        clk_disable_unprepare(dspi->clk);
-        spi_master_put(dspi->bitbang.master);
+        spi_unregister_master(dspi->master);
+        spi_master_put(dspi->master);
        return 0;
 }
diff --git a/drivers/spi/spi-fsl-lib.c b/drivers/spi/spi-fsl-lib.c
index 446b737e1532..cb35d2f0d0e6 100644
--- a/drivers/spi/spi-fsl-lib.c
+++ b/drivers/spi/spi-fsl-lib.c
@@ -21,6 +21,7 @@
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/module.h>
 #include <linux/of_platform.h>
 #include <linux/spi/spi.h>
 #ifdef CONFIG_FSL_SOC
@@ -35,7 +36,8 @@ void mpc8xxx_spi_rx_buf_##type(u32 data, struct mpc8xxx_spi *mpc8xxx_spi) \
        type *rx = mpc8xxx_spi->rx;                                       \
        *rx++ = (type)(data >> mpc8xxx_spi->rx_shift);                    \
        mpc8xxx_spi->rx = rx;                                             \
-}
+}                                                                         \
+EXPORT_SYMBOL_GPL(mpc8xxx_spi_rx_buf_##type);
 #define MPC8XXX_SPI_TX_BUF(type)                                \
 u32 mpc8xxx_spi_tx_buf_##type(struct mpc8xxx_spi *mpc8xxx_spi)  \
@@ -47,7 +49,8 @@ u32 mpc8xxx_spi_tx_buf_##type(struct mpc8xxx_spi *mpc8xxx_spi)	\
        data = *tx++ << mpc8xxx_spi->tx_shift;                  \
        mpc8xxx_spi->tx = tx;                                   \
        return data;                                            \
-}
+}                                                               \
+EXPORT_SYMBOL_GPL(mpc8xxx_spi_tx_buf_##type);
 MPC8XXX_SPI_RX_BUF(u8)
 MPC8XXX_SPI_RX_BUF(u16)
@@ -60,6 +63,7 @@ struct mpc8xxx_spi_probe_info *to_of_pinfo(struct fsl_spi_platform_data *pdata)
 {
        return container_of(pdata, struct mpc8xxx_spi_probe_info, pdata);
 }
+EXPORT_SYMBOL_GPL(to_of_pinfo);
 const char *mpc8xxx_spi_strmode(unsigned int flags)
 {
@@ -75,6 +79,7 @@ const char *mpc8xxx_spi_strmode(unsigned int flags)
        }
        return "CPU";
 }
+EXPORT_SYMBOL_GPL(mpc8xxx_spi_strmode);
 void mpc8xxx_spi_probe(struct device *dev, struct resource *mem,
                        unsigned int irq)
@@ -102,13 +107,12 @@ void mpc8xxx_spi_probe(struct device *dev, struct resource *mem,
        mpc8xxx_spi->rx_shift = 0;
        mpc8xxx_spi->tx_shift = 0;
-        init_completion(&mpc8xxx_spi->done);
        master->bus_num = pdata->bus_num;
        master->num_chipselect = pdata->max_chipselect;
        init_completion(&mpc8xxx_spi->done);
 }
+EXPORT_SYMBOL_GPL(mpc8xxx_spi_probe);
 int mpc8xxx_spi_remove(struct device *dev)
 {
@@ -127,6 +131,7 @@ int mpc8xxx_spi_remove(struct device *dev)
        return 0;
 }
+EXPORT_SYMBOL_GPL(mpc8xxx_spi_remove);
 int of_mpc8xxx_spi_probe(struct platform_device *ofdev)
 {
@@ -173,3 +178,6 @@ int of_mpc8xxx_spi_probe(struct platform_device *ofdev)
        return 0;
 }
+EXPORT_SYMBOL_GPL(of_mpc8xxx_spi_probe);
+MODULE_LICENSE("GPL");
diff --git a/drivers/spi/spi-fsl-lib.h b/drivers/spi/spi-fsl-lib.h
index b4ed04e8862f..1326a392adca 100644
--- a/drivers/spi/spi-fsl-lib.h
+++ b/drivers/spi/spi-fsl-lib.h
@@ -28,7 +28,7 @@ struct mpc8xxx_spi {
        /* rx & tx bufs from the spi_transfer */
        const void *tx;
        void *rx;
-#ifdef CONFIG_SPI_FSL_ESPI
+#if IS_ENABLED(CONFIG_SPI_FSL_ESPI)
        int len;
 #endif
@@ -68,7 +68,7 @@ struct mpc8xxx_spi {
        unsigned int flags;
-#ifdef CONFIG_SPI_FSL_SPI
+#if IS_ENABLED(CONFIG_SPI_FSL_SPI)
        int type;
        int native_chipselects;
        u8 max_bits_per_word;
diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
index aee4e7589568..1c34c9314c8a 100644
--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -12,10 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -92,7 +88,7 @@ struct spi_gpio {
 /*----------------------------------------------------------------------*/
-static inline struct spi_gpio * __pure
+static inline struct spi_gpio *__pure
 spi_to_spi_gpio(const struct spi_device *spi)
 {
        const struct spi_bitbang        *bang;
@@ -103,7 +99,7 @@ spi_to_spi_gpio(const struct spi_device *spi)
        return spi_gpio;
 }
-static inline struct spi_gpio_platform_data * __pure
+static inline struct spi_gpio_platform_data *__pure
 spi_to_pdata(const struct spi_device *spi)
 {
        return &spi_to_spi_gpio(spi)->pdata;
diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index b410499cddca..c01567d53581 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -160,16 +160,16 @@ static unsigned int spfi_pio_write32(struct img_spfi *spfi, const u32 *buf,
        unsigned int count = 0;
        u32 status;
-        while (count < max) {
+        while (count < max / 4) {
                spfi_writel(spfi, SPFI_INTERRUPT_SDFUL, SPFI_INTERRUPT_CLEAR);
                status = spfi_readl(spfi, SPFI_INTERRUPT_STATUS);
                if (status & SPFI_INTERRUPT_SDFUL)
                        break;
-                spfi_writel(spfi, buf[count / 4], SPFI_TX_32BIT_VALID_DATA);
+                spfi_writel(spfi, buf[count], SPFI_TX_32BIT_VALID_DATA);
-                count += 4;
+                count++;
        }
-        return count;
+        return count * 4;
 }
 static unsigned int spfi_pio_write8(struct img_spfi *spfi, const u8 *buf,
@@ -196,17 +196,17 @@ static unsigned int spfi_pio_read32(struct img_spfi *spfi, u32 *buf,
        unsigned int count = 0;
        u32 status;
-        while (count < max) {
+        while (count < max / 4) {
                spfi_writel(spfi, SPFI_INTERRUPT_GDEX32BIT,
                            SPFI_INTERRUPT_CLEAR);
                status = spfi_readl(spfi, SPFI_INTERRUPT_STATUS);
                if (!(status & SPFI_INTERRUPT_GDEX32BIT))
                        break;
-                buf[count / 4] = spfi_readl(spfi, SPFI_RX_32BIT_VALID_DATA);
+                buf[count] = spfi_readl(spfi, SPFI_RX_32BIT_VALID_DATA);
-                count += 4;
+                count++;
        }
-        return count;
+        return count * 4;
 }
 static unsigned int spfi_pio_read8(struct img_spfi *spfi, u8 *buf,
@@ -251,17 +251,15 @@ static int img_spfi_start_pio(struct spi_master *master,
               time_before(jiffies, timeout)) {
                unsigned int tx_count, rx_count;
-                switch (xfer->bits_per_word) {
+                if (tx_bytes >= 4)
-                case 32:
                        tx_count = spfi_pio_write32(spfi, tx_buf, tx_bytes);
-                        rx_count = spfi_pio_read32(spfi, rx_buf, rx_bytes);
+                else
-                        break;
-                case 8:
-                default:
                        tx_count = spfi_pio_write8(spfi, tx_buf, tx_bytes);
+                if (rx_bytes >= 4)
+                        rx_count = spfi_pio_read32(spfi, rx_buf, rx_bytes);
+                else
                        rx_count = spfi_pio_read8(spfi, rx_buf, rx_bytes);
-                        break;
-                }
                tx_buf += tx_count;
                rx_buf += rx_count;
@@ -331,17 +329,14 @@ static int img_spfi_start_dma(struct spi_master *master,
        if (xfer->rx_buf) {
                rxconf.direction = DMA_DEV_TO_MEM;
-                switch (xfer->bits_per_word) {
+                if (xfer->len % 4 == 0) {
-                case 32:
                        rxconf.src_addr = spfi->phys + SPFI_RX_32BIT_VALID_DATA;
                        rxconf.src_addr_width = 4;
                        rxconf.src_maxburst = 4;
-                        break;
+                } else {
-                case 8:
-                default:
                        rxconf.src_addr = spfi->phys + SPFI_RX_8BIT_VALID_DATA;
                        rxconf.src_addr_width = 1;
-                        rxconf.src_maxburst = 1;
+                        rxconf.src_maxburst = 4;
                }
                dmaengine_slave_config(spfi->rx_ch, &rxconf);
@@ -358,18 +353,14 @@ static int img_spfi_start_dma(struct spi_master *master,
        if (xfer->tx_buf) {
                txconf.direction = DMA_MEM_TO_DEV;
-                switch (xfer->bits_per_word) {
+                if (xfer->len % 4 == 0) {
-                case 32:
                        txconf.dst_addr = spfi->phys + SPFI_TX_32BIT_VALID_DATA;
                        txconf.dst_addr_width = 4;
                        txconf.dst_maxburst = 4;
-                        break;
+                } else {
-                case 8:
-                default:
                        txconf.dst_addr = spfi->phys + SPFI_TX_8BIT_VALID_DATA;
                        txconf.dst_addr_width = 1;
-                        txconf.dst_maxburst = 1;
+                        txconf.dst_maxburst = 4;
-                        break;
                }
                dmaengine_slave_config(spfi->tx_ch, &txconf);
@@ -390,14 +381,14 @@ static int img_spfi_start_dma(struct spi_master *master,
                dma_async_issue_pending(spfi->rx_ch);
        }
+        spfi_start(spfi);
        if (xfer->tx_buf) {
                spfi->tx_dma_busy = true;
                dmaengine_submit(txdesc);
                dma_async_issue_pending(spfi->tx_ch);
        }
-        spfi_start(spfi);
        return 1;
 stop_dma:
@@ -508,9 +499,7 @@ static void img_spfi_set_cs(struct spi_device *spi, bool enable)
 static bool img_spfi_can_dma(struct spi_master *master, struct spi_device *spi,
                             struct spi_transfer *xfer)
 {
-        if (xfer->bits_per_word == 8 && xfer->len > SPFI_8BIT_FIFO_SIZE)
+        if (xfer->len > SPFI_32BIT_FIFO_SIZE)
-                return true;
-        if (xfer->bits_per_word == 32 && xfer->len > SPFI_32BIT_FIFO_SIZE)
                return true;
        return false;
 }
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 961b97d43b43..6fea4af51c41 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -89,7 +89,6 @@ struct spi_imx_data {
        struct completion xfer_done;
        void __iomem *base;
-        int irq;
        struct clk *clk_per;
        struct clk *clk_ipg;
        unsigned long spi_clk;
@@ -823,6 +822,10 @@ static int spi_imx_sdma_init(struct device *dev, struct spi_imx_data *spi_imx,
        struct dma_slave_config slave_config = {};
        int ret;
+        /* use pio mode for i.mx6dl chip TKT238285 */
+        if (of_machine_is_compatible("fsl,imx6dl"))
+                return 0;
        /* Prepare for TX DMA: */
        master->dma_tx = dma_request_slave_channel(dev, "tx");
        if (!master->dma_tx) {
@@ -892,6 +895,7 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
 {
        struct dma_async_tx_descriptor *desc_tx = NULL, *desc_rx = NULL;
        int ret;
+        unsigned long timeout;
        u32 dma;
        int left;
        struct spi_master *master = spi_imx->bitbang.master;
@@ -939,17 +943,17 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
        dma_async_issue_pending(master->dma_tx);
        dma_async_issue_pending(master->dma_rx);
        /* Wait SDMA to finish the data transfer.*/
-        ret = wait_for_completion_timeout(&spi_imx->dma_tx_completion,
+        timeout = wait_for_completion_timeout(&spi_imx->dma_tx_completion,
                                                IMX_DMA_TIMEOUT);
-        if (!ret) {
+        if (!timeout) {
                pr_warn("%s %s: I/O Error in DMA TX\n",
                        dev_driver_string(&master->dev),
                        dev_name(&master->dev));
                dmaengine_terminate_all(master->dma_tx);
        } else {
-                ret = wait_for_completion_timeout(&spi_imx->dma_rx_completion,
+                timeout = wait_for_completion_timeout(
-                                IMX_DMA_TIMEOUT);
+                                &spi_imx->dma_rx_completion, IMX_DMA_TIMEOUT);
-                if (!ret) {
+                if (!timeout) {
                        pr_warn("%s %s: I/O Error in DMA RX\n",
                                dev_driver_string(&master->dev),
                                dev_name(&master->dev));
@@ -964,9 +968,9 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
        spi_imx->dma_finished = 1;
        spi_imx->devtype_data->trigger(spi_imx);
-        if (!ret)
+        if (!timeout)
                ret = -ETIMEDOUT;
-        else if (ret > 0)
+        else
                ret = transfer->len;
        return ret;
@@ -1076,7 +1080,7 @@ static int spi_imx_probe(struct platform_device *pdev)
        struct spi_master *master;
        struct spi_imx_data *spi_imx;
        struct resource *res;
-        int i, ret, num_cs;
+        int i, ret, num_cs, irq;
        if (!np && !mxc_platform_info) {
                dev_err(&pdev->dev, "can't get the platform data\n");
@@ -1143,16 +1147,16 @@ static int spi_imx_probe(struct platform_device *pdev)
                goto out_master_put;
        }
-        spi_imx->irq = platform_get_irq(pdev, 0);
+        irq = platform_get_irq(pdev, 0);
-        if (spi_imx->irq < 0) {
+        if (irq < 0) {
-                ret = spi_imx->irq;
+                ret = irq;
                goto out_master_put;
        }
-        ret = devm_request_irq(&pdev->dev, spi_imx->irq, spi_imx_isr, 0,
+        ret = devm_request_irq(&pdev->dev, irq, spi_imx_isr, 0,
                               dev_name(&pdev->dev), spi_imx);
        if (ret) {
-                dev_err(&pdev->dev, "can't get irq%d: %d\n", spi_imx->irq, ret);
+                dev_err(&pdev->dev, "can't get irq%d: %d\n", irq, ret);
                goto out_master_put;
        }
diff --git a/drivers/spi/spi-lm70llp.c b/drivers/spi/spi-lm70llp.c
index 41c5765be746..ba72347cb99d 100644
--- a/drivers/spi/spi-lm70llp.c
+++ b/drivers/spi/spi-lm70llp.c
@@ -12,10 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #include <linux/init.h>
diff --git a/drivers/spi/spi-meson-spifc.c b/drivers/spi/spi-meson-spifc.c
index 1bbac0378bf7..5468fc70dbf8 100644
--- a/drivers/spi/spi-meson-spifc.c
+++ b/drivers/spi/spi-meson-spifc.c
@@ -85,7 +85,7 @@ struct meson_spifc {
        struct device *dev;
 };
-static struct regmap_config spifc_regmap_config = {
+static const struct regmap_config spifc_regmap_config = {
        .reg_bits = 32,
        .val_bits = 32,
        .reg_stride = 4,
diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index 4045a1e580e1..5b0e9a3e83f6 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -282,9 +282,8 @@ static int mxs_spi_txrx_dma(struct mxs_spi *spi,
        dmaengine_submit(desc);
        dma_async_issue_pending(ssp->dmach);
-        ret = wait_for_completion_timeout(&spi->c,
+        if (!wait_for_completion_timeout(&spi->c,
-                                msecs_to_jiffies(SSP_TIMEOUT));
+                                         msecs_to_jiffies(SSP_TIMEOUT))) {
-        if (!ret) {
                dev_err(ssp->dev, "DMA transfer timeout\n");
                ret = -ETIMEDOUT;
                dmaengine_terminate_all(ssp->dmach);
diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c
index 79399ae9c84c..d890d309dff9 100644
--- a/drivers/spi/spi-omap-100k.c
+++ b/drivers/spi/spi-omap-100k.c
@@ -16,11 +16,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- *
 */
 #include <linux/kernel.h>
 #include <linux/init.h>
diff --git a/drivers/spi/spi-omap-uwire.c b/drivers/spi/spi-omap-uwire.c
index daf1ada5cd11..3c0844457c07 100644
--- a/drivers/spi/spi-omap-uwire.c
+++ b/drivers/spi/spi-omap-uwire.c
@@ -28,10 +28,6 @@
 * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #include <linux/kernel.h>
 #include <linux/init.h>
diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
index 3bc3cbabbbc0..4df8942058de 100644
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -14,11 +14,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- *
 */
 #include <linux/kernel.h>
diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c
index 3dec9e0b99b8..861664776672 100644
--- a/drivers/spi/spi-orion.c
+++ b/drivers/spi/spi-orion.c
@@ -28,7 +28,12 @@
 /* Runtime PM autosuspend timeout: PM is fairly light on this driver */
 #define SPI_AUTOSUSPEND_TIMEOUT         200
-#define ORION_NUM_CHIPSELECTS           1 /* only one slave is supported*/
+/* Some SoCs using this driver support up to 8 chip selects.
+ * It is up to the implementer to only use the chip selects
+ * that are available.
+ */
+#define ORION_NUM_CHIPSELECTS           8
 #define ORION_SPI_WAIT_RDY_MAX_LOOP     2000 /* in usec */
 #define ORION_SPI_IF_CTRL_REG           0x00
@@ -44,6 +49,10 @@
 #define ARMADA_SPI_CLK_PRESCALE_MASK    0xDF
 #define ORION_SPI_MODE_MASK             (ORION_SPI_MODE_CPOL | \
                                         ORION_SPI_MODE_CPHA)
+#define ORION_SPI_CS_MASK       0x1C
+#define ORION_SPI_CS_SHIFT      2
+#define ORION_SPI_CS(cs)        ((cs << ORION_SPI_CS_SHIFT) & \
+                                        ORION_SPI_CS_MASK)
 enum orion_spi_type {
        ORION_SPI,
@@ -215,9 +224,18 @@ orion_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
        return 0;
 }
-static void orion_spi_set_cs(struct orion_spi *orion_spi, int enable)
+static void orion_spi_set_cs(struct spi_device *spi, bool enable)
 {
-        if (enable)
+        struct orion_spi *orion_spi;
+        orion_spi = spi_master_get_devdata(spi->master);
+        orion_spi_clrbits(orion_spi, ORION_SPI_IF_CTRL_REG, ORION_SPI_CS_MASK);
+        orion_spi_setbits(orion_spi, ORION_SPI_IF_CTRL_REG,
+                                ORION_SPI_CS(spi->chip_select));
+        /* Chip select logic is inverted from spi_set_cs */
+        if (!enable)
                orion_spi_setbits(orion_spi, ORION_SPI_IF_CTRL_REG, 0x1);
        else
                orion_spi_clrbits(orion_spi, ORION_SPI_IF_CTRL_REG, 0x1);
@@ -332,64 +350,31 @@ out:
        return xfer->len - count;
 }
-static int orion_spi_transfer_one_message(struct spi_master *master,
+static int orion_spi_transfer_one(struct spi_master *master,
-                                           struct spi_message *m)
+                                        struct spi_device *spi,
+                                        struct spi_transfer *t)
 {
-        struct orion_spi *orion_spi = spi_master_get_devdata(master);
-        struct spi_device *spi = m->spi;
-        struct spi_transfer *t = NULL;
-        int par_override = 0;
        int status = 0;
-        int cs_active = 0;
-        /* Load defaults */
-        status = orion_spi_setup_transfer(spi, NULL);
+        status = orion_spi_setup_transfer(spi, t);
        if (status < 0)
-                goto msg_done;
+                return status;
-        list_for_each_entry(t, &m->transfers, transfer_list) {
-                if (par_override || t->speed_hz || t->bits_per_word) {
-                        par_override = 1;
-                        status = orion_spi_setup_transfer(spi, t);
-                        if (status < 0)
-                                break;
-                        if (!t->speed_hz && !t->bits_per_word)
-                                par_override = 0;
-                }
-                if (!cs_active) {
-                        orion_spi_set_cs(orion_spi, 1);
-                        cs_active = 1;
-                }
-                if (t->len)
+        if (t->len)
-                        m->actual_length += orion_spi_write_read(spi, t);
+                orion_spi_write_read(spi, t);
-                if (t->delay_usecs)
+        return status;
-                        udelay(t->delay_usecs);
+}
-                if (t->cs_change) {
-                        orion_spi_set_cs(orion_spi, 0);
-                        cs_active = 0;
-                }
-        }
-msg_done:
-        if (cs_active)
-                orion_spi_set_cs(orion_spi, 0);
-        m->status = status;
-        spi_finalize_current_message(master);
-        return 0;
+static int orion_spi_setup(struct spi_device *spi)
+{
+        return orion_spi_setup_transfer(spi, NULL);
 }
 static int orion_spi_reset(struct orion_spi *orion_spi)
 {
        /* Verify that the CS is deasserted */
-        orion_spi_set_cs(orion_spi, 0);
+        orion_spi_clrbits(orion_spi, ORION_SPI_IF_CTRL_REG, 0x1);
        return 0;
 }
@@ -442,9 +427,10 @@ static int orion_spi_probe(struct platform_device *pdev)
        /* we support only mode 0, and no options */
        master->mode_bits = SPI_CPHA | SPI_CPOL;
+        master->set_cs = orion_spi_set_cs;
-        master->transfer_one_message = orion_spi_transfer_one_message;
+        master->transfer_one = orion_spi_transfer_one;
        master->num_chipselect = ORION_NUM_CHIPSELECTS;
+        master->setup = orion_spi_setup;
        master->bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16);
        master->auto_runtime_pm = true;
diff --git a/drivers/spi/spi-pxa2xx-dma.c b/drivers/spi/spi-pxa2xx-dma.c
index 62a9297e96ac..66a173939be8 100644
--- a/drivers/spi/spi-pxa2xx-dma.c
+++ b/drivers/spi/spi-pxa2xx-dma.c
@@ -111,23 +111,24 @@ static void pxa2xx_spi_dma_transfer_complete(struct driver_data *drv_data,
         * by using ->dma_running.
         */
        if (atomic_dec_and_test(&drv_data->dma_running)) {
-                void __iomem *reg = drv_data->ioaddr;
                /*
                 * If the other CPU is still handling the ROR interrupt we
                 * might not know about the error yet. So we re-check the
                 * ROR bit here before we clear the status register.
                 */
                if (!error) {
-                        u32 status = read_SSSR(reg) & drv_data->mask_sr;
+                        u32 status = pxa2xx_spi_read(drv_data, SSSR)
+                                     & drv_data->mask_sr;
                        error = status & SSSR_ROR;
                }
                /* Clear status & disable interrupts */
-                write_SSCR1(read_SSCR1(reg) & ~drv_data->dma_cr1, reg);
+                pxa2xx_spi_write(drv_data, SSCR1,
+                                 pxa2xx_spi_read(drv_data, SSCR1)
+                                 & ~drv_data->dma_cr1);
                write_SSSR_CS(drv_data, drv_data->clear_sr);
                if (!pxa25x_ssp_comp(drv_data))
-                        write_SSTO(0, reg);
+                        pxa2xx_spi_write(drv_data, SSTO, 0);
                if (!error) {
                        pxa2xx_spi_unmap_dma_buffers(drv_data);
@@ -139,7 +140,9 @@ static void pxa2xx_spi_dma_transfer_complete(struct driver_data *drv_data,
                        msg->state = pxa2xx_spi_next_transfer(drv_data);
                } else {
                        /* In case we got an error we disable the SSP now */
-                        write_SSCR0(read_SSCR0(reg) & ~SSCR0_SSE, reg);
+                        pxa2xx_spi_write(drv_data, SSCR0,
+                                         pxa2xx_spi_read(drv_data, SSCR0)
+                                         & ~SSCR0_SSE);
                        msg->state = ERROR_STATE;
                }
@@ -247,7 +250,7 @@ irqreturn_t pxa2xx_spi_dma_transfer(struct driver_data *drv_data)
 {
        u32 status;
-        status = read_SSSR(drv_data->ioaddr) & drv_data->mask_sr;
+        status = pxa2xx_spi_read(drv_data, SSSR) & drv_data->mask_sr;
        if (status & SSSR_ROR) {
                dev_err(&drv_data->pdev->dev, "FIFO overrun\n");
diff --git a/drivers/spi/spi-pxa2xx-pxadma.c b/drivers/spi/spi-pxa2xx-pxadma.c
index e8a26f25d5c0..2e0796a0003f 100644
--- a/drivers/spi/spi-pxa2xx-pxadma.c
+++ b/drivers/spi/spi-pxa2xx-pxadma.c
@@ -12,10 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #include <linux/delay.h>
@@ -25,6 +21,7 @@
 #include <linux/spi/spi.h>
 #include <linux/spi/pxa2xx_spi.h>
+#include <mach/dma.h>
 #include "spi-pxa2xx.h"
 #define DMA_INT_MASK            (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR)
@@ -118,11 +115,11 @@ static void pxa2xx_spi_unmap_dma_buffers(struct driver_data *drv_data)
        drv_data->dma_mapped = 0;
 }
-static int wait_ssp_rx_stall(void const __iomem *ioaddr)
+static int wait_ssp_rx_stall(struct driver_data *drv_data)
 {
        unsigned long limit = loops_per_jiffy << 1;
-        while ((read_SSSR(ioaddr) & SSSR_BSY) && --limit)
+        while ((pxa2xx_spi_read(drv_data, SSSR) & SSSR_BSY) && --limit)
                cpu_relax();
        return limit;
@@ -141,17 +138,18 @@ static int wait_dma_channel_stop(int channel)
 static void pxa2xx_spi_dma_error_stop(struct driver_data *drv_data,
                                      const char *msg)
 {
-        void __iomem *reg = drv_data->ioaddr;
        /* Stop and reset */
        DCSR(drv_data->rx_channel) = RESET_DMA_CHANNEL;
        DCSR(drv_data->tx_channel) = RESET_DMA_CHANNEL;
        write_SSSR_CS(drv_data, drv_data->clear_sr);
-        write_SSCR1(read_SSCR1(reg) & ~drv_data->dma_cr1, reg);
+        pxa2xx_spi_write(drv_data, SSCR1,
+                         pxa2xx_spi_read(drv_data, SSCR1)
+                         & ~drv_data->dma_cr1);
        if (!pxa25x_ssp_comp(drv_data))
-                write_SSTO(0, reg);
+                pxa2xx_spi_write(drv_data, SSTO, 0);
        pxa2xx_spi_flush(drv_data);
-        write_SSCR0(read_SSCR0(reg) & ~SSCR0_SSE, reg);
+        pxa2xx_spi_write(drv_data, SSCR0,
+                         pxa2xx_spi_read(drv_data, SSCR0) & ~SSCR0_SSE);
        pxa2xx_spi_unmap_dma_buffers(drv_data);
@@ -163,11 +161,12 @@ static void pxa2xx_spi_dma_error_stop(struct driver_data *drv_data,
 static void pxa2xx_spi_dma_transfer_complete(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
        struct spi_message *msg = drv_data->cur_msg;
        /* Clear and disable interrupts on SSP and DMA channels*/
-        write_SSCR1(read_SSCR1(reg) & ~drv_data->dma_cr1, reg);
+        pxa2xx_spi_write(drv_data, SSCR1,
+                         pxa2xx_spi_read(drv_data, SSCR1)
+                         & ~drv_data->dma_cr1);
        write_SSSR_CS(drv_data, drv_data->clear_sr);
        DCSR(drv_data->tx_channel) = RESET_DMA_CHANNEL;
        DCSR(drv_data->rx_channel) = RESET_DMA_CHANNEL;
@@ -228,7 +227,7 @@ void pxa2xx_spi_dma_handler(int channel, void *data)
                && (drv_data->ssp_type == PXA25x_SSP)) {
                /* Wait for rx to stall */
-                if (wait_ssp_rx_stall(drv_data->ioaddr) == 0)
+                if (wait_ssp_rx_stall(drv_data) == 0)
                        dev_err(&drv_data->pdev->dev,
                                "dma_handler: ssp rx stall failed\n");
@@ -240,9 +239,8 @@ void pxa2xx_spi_dma_handler(int channel, void *data)
 irqreturn_t pxa2xx_spi_dma_transfer(struct driver_data *drv_data)
 {
        u32 irq_status;
-        void __iomem *reg = drv_data->ioaddr;
-        irq_status = read_SSSR(reg) & drv_data->mask_sr;
+        irq_status = pxa2xx_spi_read(drv_data, SSSR) & drv_data->mask_sr;
        if (irq_status & SSSR_ROR) {
                pxa2xx_spi_dma_error_stop(drv_data,
                                          "dma_transfer: fifo overrun");
@@ -252,7 +250,7 @@ irqreturn_t pxa2xx_spi_dma_transfer(struct driver_data *drv_data)
        /* Check for false positive timeout */
        if ((irq_status & SSSR_TINT)
                && (DCSR(drv_data->tx_channel) & DCSR_RUN)) {
-                write_SSSR(SSSR_TINT, reg);
+                pxa2xx_spi_write(drv_data, SSSR, SSSR_TINT);
                return IRQ_HANDLED;
        }
@@ -261,7 +259,7 @@ irqreturn_t pxa2xx_spi_dma_transfer(struct driver_data *drv_data)
                /* Clear and disable timeout interrupt, do the rest in
                 * dma_transfer_complete */
                if (!pxa25x_ssp_comp(drv_data))
-                        write_SSTO(0, reg);
+                        pxa2xx_spi_write(drv_data, SSTO, 0);
                /* finish this transfer, start the next */
                pxa2xx_spi_dma_transfer_complete(drv_data);
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index 05c623cfb078..6f72ad01e041 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #include <linux/init.h>
@@ -45,8 +41,6 @@ MODULE_DESCRIPTION("PXA2xx SSP SPI Controller");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:pxa2xx-spi");
-#define MAX_BUSES 3
 #define TIMOUT_DFLT             1000
 /*
@@ -162,7 +156,6 @@ pxa2xx_spi_get_rx_default_thre(const struct driver_data *drv_data)
 static bool pxa2xx_spi_txfifo_full(const struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
        u32 mask;
        switch (drv_data->ssp_type) {
@@ -174,7 +167,7 @@ static bool pxa2xx_spi_txfifo_full(const struct driver_data *drv_data)
                break;
        }
-        return (read_SSSR(reg) & mask) == mask;
+        return (pxa2xx_spi_read(drv_data, SSSR) & mask) == mask;
 }
 static void pxa2xx_spi_clear_rx_thre(const struct driver_data *drv_data,
@@ -253,9 +246,6 @@ static void lpss_ssp_setup(struct driver_data *drv_data)
        unsigned offset = 0x400;
        u32 value, orig;
-        if (!is_lpss_ssp(drv_data))
-                return;
        /*
         * Perform auto-detection of the LPSS SSP private registers. They
         * can be either at 1k or 2k offset from the base address.
@@ -304,9 +294,6 @@ static void lpss_ssp_cs_control(struct driver_data *drv_data, bool enable)
 {
        u32 value;
-        if (!is_lpss_ssp(drv_data))
-                return;
        value = __lpss_ssp_read_priv(drv_data, SPI_CS_CONTROL);
        if (enable)
                value &= ~SPI_CS_CONTROL_CS_HIGH;
@@ -320,7 +307,7 @@ static void cs_assert(struct driver_data *drv_data)
        struct chip_data *chip = drv_data->cur_chip;
        if (drv_data->ssp_type == CE4100_SSP) {
-                write_SSSR(drv_data->cur_chip->frm, drv_data->ioaddr);
+                pxa2xx_spi_write(drv_data, SSSR, drv_data->cur_chip->frm);
                return;
        }
@@ -334,7 +321,8 @@ static void cs_assert(struct driver_data *drv_data)
                return;
        }
-        lpss_ssp_cs_control(drv_data, true);
+        if (is_lpss_ssp(drv_data))
+                lpss_ssp_cs_control(drv_data, true);
 }
 static void cs_deassert(struct driver_data *drv_data)
@@ -354,20 +342,18 @@ static void cs_deassert(struct driver_data *drv_data)
                return;
        }
-        lpss_ssp_cs_control(drv_data, false);
+        if (is_lpss_ssp(drv_data))
+                lpss_ssp_cs_control(drv_data, false);
 }
 int pxa2xx_spi_flush(struct driver_data *drv_data)
 {
        unsigned long limit = loops_per_jiffy << 1;
-        void __iomem *reg = drv_data->ioaddr;
        do {
-                while (read_SSSR(reg) & SSSR_RNE) {
+                while (pxa2xx_spi_read(drv_data, SSSR) & SSSR_RNE)
-                        read_SSDR(reg);
+                        pxa2xx_spi_read(drv_data, SSDR);
-                }
+        } while ((pxa2xx_spi_read(drv_data, SSSR) & SSSR_BSY) && --limit);
-        } while ((read_SSSR(reg) & SSSR_BSY) && --limit);
        write_SSSR_CS(drv_data, SSSR_ROR);
        return limit;
@@ -375,14 +361,13 @@ int pxa2xx_spi_flush(struct driver_data *drv_data)
 static int null_writer(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
        u8 n_bytes = drv_data->n_bytes;
        if (pxa2xx_spi_txfifo_full(drv_data)
                || (drv_data->tx == drv_data->tx_end))
                return 0;
-        write_SSDR(0, reg);
+        pxa2xx_spi_write(drv_data, SSDR, 0);
        drv_data->tx += n_bytes;
        return 1;
@@ -390,12 +375,11 @@ static int null_writer(struct driver_data *drv_data)
 static int null_reader(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
        u8 n_bytes = drv_data->n_bytes;
-        while ((read_SSSR(reg) & SSSR_RNE)
+        while ((pxa2xx_spi_read(drv_data, SSSR) & SSSR_RNE)
-                && (drv_data->rx < drv_data->rx_end)) {
+               && (drv_data->rx < drv_data->rx_end)) {
-                read_SSDR(reg);
+                pxa2xx_spi_read(drv_data, SSDR);
                drv_data->rx += n_bytes;
        }
@@ -404,13 +388,11 @@ static int null_reader(struct driver_data *drv_data)
 static int u8_writer(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
        if (pxa2xx_spi_txfifo_full(drv_data)
                || (drv_data->tx == drv_data->tx_end))
                return 0;
-        write_SSDR(*(u8 *)(drv_data->tx), reg);
+        pxa2xx_spi_write(drv_data, SSDR, *(u8 *)(drv_data->tx));
        ++drv_data->tx;
        return 1;
@@ -418,11 +400,9 @@ static int u8_writer(struct driver_data *drv_data)
 static int u8_reader(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
+        while ((pxa2xx_spi_read(drv_data, SSSR) & SSSR_RNE)
+               && (drv_data->rx < drv_data->rx_end)) {
-        while ((read_SSSR(reg) & SSSR_RNE)
+                *(u8 *)(drv_data->rx) = pxa2xx_spi_read(drv_data, SSDR);
-                && (drv_data->rx < drv_data->rx_end)) {
-                *(u8 *)(drv_data->rx) = read_SSDR(reg);
                ++drv_data->rx;
        }
@@ -431,13 +411,11 @@ static int u8_reader(struct driver_data *drv_data)
 static int u16_writer(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
        if (pxa2xx_spi_txfifo_full(drv_data)
                || (drv_data->tx == drv_data->tx_end))
                return 0;
-        write_SSDR(*(u16 *)(drv_data->tx), reg);
+        pxa2xx_spi_write(drv_data, SSDR, *(u16 *)(drv_data->tx));
        drv_data->tx += 2;
        return 1;
@@ -445,11 +423,9 @@ static int u16_writer(struct driver_data *drv_data)
 static int u16_reader(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
+        while ((pxa2xx_spi_read(drv_data, SSSR) & SSSR_RNE)
+               && (drv_data->rx < drv_data->rx_end)) {
-        while ((read_SSSR(reg) & SSSR_RNE)
+                *(u16 *)(drv_data->rx) = pxa2xx_spi_read(drv_data, SSDR);
-                && (drv_data->rx < drv_data->rx_end)) {
-                *(u16 *)(drv_data->rx) = read_SSDR(reg);
                drv_data->rx += 2;
        }
@@ -458,13 +434,11 @@ static int u16_reader(struct driver_data *drv_data)
 static int u32_writer(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
        if (pxa2xx_spi_txfifo_full(drv_data)
                || (drv_data->tx == drv_data->tx_end))
                return 0;
-        write_SSDR(*(u32 *)(drv_data->tx), reg);
+        pxa2xx_spi_write(drv_data, SSDR, *(u32 *)(drv_data->tx));
        drv_data->tx += 4;
        return 1;
@@ -472,11 +446,9 @@ static int u32_writer(struct driver_data *drv_data)
 static int u32_reader(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
+        while ((pxa2xx_spi_read(drv_data, SSSR) & SSSR_RNE)
+               && (drv_data->rx < drv_data->rx_end)) {
-        while ((read_SSSR(reg) & SSSR_RNE)
+                *(u32 *)(drv_data->rx) = pxa2xx_spi_read(drv_data, SSDR);
-                && (drv_data->rx < drv_data->rx_end)) {
-                *(u32 *)(drv_data->rx) = read_SSDR(reg);
                drv_data->rx += 4;
        }
@@ -546,33 +518,31 @@ static void giveback(struct driver_data *drv_data)
                        cs_deassert(drv_data);
        }
-        spi_finalize_current_message(drv_data->master);
        drv_data->cur_chip = NULL;
+        spi_finalize_current_message(drv_data->master);
 }
 static void reset_sccr1(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
        struct chip_data *chip = drv_data->cur_chip;
        u32 sccr1_reg;
-        sccr1_reg = read_SSCR1(reg) & ~drv_data->int_cr1;
+        sccr1_reg = pxa2xx_spi_read(drv_data, SSCR1) & ~drv_data->int_cr1;
        sccr1_reg &= ~SSCR1_RFT;
        sccr1_reg |= chip->threshold;
-        write_SSCR1(sccr1_reg, reg);
+        pxa2xx_spi_write(drv_data, SSCR1, sccr1_reg);
 }
 static void int_error_stop(struct driver_data *drv_data, const char* msg)
 {
-        void __iomem *reg = drv_data->ioaddr;
        /* Stop and reset SSP */
        write_SSSR_CS(drv_data, drv_data->clear_sr);
        reset_sccr1(drv_data);
        if (!pxa25x_ssp_comp(drv_data))
-                write_SSTO(0, reg);
+                pxa2xx_spi_write(drv_data, SSTO, 0);
        pxa2xx_spi_flush(drv_data);
-        write_SSCR0(read_SSCR0(reg) & ~SSCR0_SSE, reg);
+        pxa2xx_spi_write(drv_data, SSCR0,
+                         pxa2xx_spi_read(drv_data, SSCR0) & ~SSCR0_SSE);
        dev_err(&drv_data->pdev->dev, "%s\n", msg);
@@ -582,13 +552,11 @@ static void int_error_stop(struct driver_data *drv_data, const char* msg)
 static void int_transfer_complete(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
        /* Stop SSP */
        write_SSSR_CS(drv_data, drv_data->clear_sr);
        reset_sccr1(drv_data);
        if (!pxa25x_ssp_comp(drv_data))
-                write_SSTO(0, reg);
+                pxa2xx_spi_write(drv_data, SSTO, 0);
        /* Update total byte transferred return count actual bytes read */
        drv_data->cur_msg->actual_length += drv_data->len -
@@ -607,12 +575,10 @@ static void int_transfer_complete(struct driver_data *drv_data)
 static irqreturn_t interrupt_transfer(struct driver_data *drv_data)
 {
-        void __iomem *reg = drv_data->ioaddr;
+        u32 irq_mask = (pxa2xx_spi_read(drv_data, SSCR1) & SSCR1_TIE) ?
+                       drv_data->mask_sr : drv_data->mask_sr & ~SSSR_TFS;
-        u32 irq_mask = (read_SSCR1(reg) & SSCR1_TIE) ?
+        u32 irq_status = pxa2xx_spi_read(drv_data, SSSR) & irq_mask;
-                        drv_data->mask_sr : drv_data->mask_sr & ~SSSR_TFS;
-        u32 irq_status = read_SSSR(reg) & irq_mask;
        if (irq_status & SSSR_ROR) {
                int_error_stop(drv_data, "interrupt_transfer: fifo overrun");
@@ -620,7 +586,7 @@ static irqreturn_t interrupt_transfer(struct driver_data *drv_data)
        }
        if (irq_status & SSSR_TINT) {
-                write_SSSR(SSSR_TINT, reg);
+                pxa2xx_spi_write(drv_data, SSSR, SSSR_TINT);
                if (drv_data->read(drv_data)) {
                        int_transfer_complete(drv_data);
                        return IRQ_HANDLED;
@@ -644,7 +610,7 @@ static irqreturn_t interrupt_transfer(struct driver_data *drv_data)
                u32 bytes_left;
                u32 sccr1_reg;
-                sccr1_reg = read_SSCR1(reg);
+                sccr1_reg = pxa2xx_spi_read(drv_data, SSCR1);
                sccr1_reg &= ~SSCR1_TIE;
                /*
@@ -670,7 +636,7 @@ static irqreturn_t interrupt_transfer(struct driver_data *drv_data)
                        pxa2xx_spi_set_rx_thre(drv_data, &sccr1_reg, rx_thre);
                }
-                write_SSCR1(sccr1_reg, reg);
+                pxa2xx_spi_write(drv_data, SSCR1, sccr1_reg);
        }
        /* We did something */
@@ -680,7 +646,6 @@ static irqreturn_t interrupt_transfer(struct driver_data *drv_data)
 static irqreturn_t ssp_int(int irq, void *dev_id)
 {
        struct driver_data *drv_data = dev_id;
-        void __iomem *reg = drv_data->ioaddr;
        u32 sccr1_reg;
        u32 mask = drv_data->mask_sr;
        u32 status;
@@ -700,11 +665,11 @@ static irqreturn_t ssp_int(int irq, void *dev_id)
         * are all set to one. That means that the device is already
         * powered off.
         */
-        status = read_SSSR(reg);
+        status = pxa2xx_spi_read(drv_data, SSSR);
        if (status == ~0)
                return IRQ_NONE;
-        sccr1_reg = read_SSCR1(reg);
+        sccr1_reg = pxa2xx_spi_read(drv_data, SSCR1);
        /* Ignore possible writes if we don't need to write */
        if (!(sccr1_reg & SSCR1_TIE))
@@ -715,10 +680,14 @@ static irqreturn_t ssp_int(int irq, void *dev_id)
        if (!drv_data->cur_msg) {
-                write_SSCR0(read_SSCR0(reg) & ~SSCR0_SSE, reg);
+                pxa2xx_spi_write(drv_data, SSCR0,
-                write_SSCR1(read_SSCR1(reg) & ~drv_data->int_cr1, reg);
+                                 pxa2xx_spi_read(drv_data, SSCR0)
+                                 & ~SSCR0_SSE);
+                pxa2xx_spi_write(drv_data, SSCR1,
+                                 pxa2xx_spi_read(drv_data, SSCR1)
+                                 & ~drv_data->int_cr1);
                if (!pxa25x_ssp_comp(drv_data))
-                        write_SSTO(0, reg);
+                        pxa2xx_spi_write(drv_data, SSTO, 0);
                write_SSSR_CS(drv_data, drv_data->clear_sr);
                dev_err(&drv_data->pdev->dev,
@@ -787,7 +756,6 @@ static void pump_transfers(unsigned long data)
        struct spi_transfer *transfer = NULL;
        struct spi_transfer *previous = NULL;
        struct chip_data *chip = NULL;
-        void __iomem *reg = drv_data->ioaddr;
        u32 clk_div = 0;
        u8 bits = 0;
        u32 speed = 0;
@@ -931,7 +899,7 @@ static void pump_transfers(unsigned long data)
                /* Clear status and start DMA engine */
                cr1 = chip->cr1 | dma_thresh | drv_data->dma_cr1;
-                write_SSSR(drv_data->clear_sr, reg);
+                pxa2xx_spi_write(drv_data, SSSR, drv_data->clear_sr);
                pxa2xx_spi_dma_start(drv_data);
        } else {
@@ -944,39 +912,43 @@ static void pump_transfers(unsigned long data)
        }
        if (is_lpss_ssp(drv_data)) {
-                if ((read_SSIRF(reg) & 0xff) != chip->lpss_rx_threshold)
+                if ((pxa2xx_spi_read(drv_data, SSIRF) & 0xff)
-                        write_SSIRF(chip->lpss_rx_threshold, reg);
+                    != chip->lpss_rx_threshold)
-                if ((read_SSITF(reg) & 0xffff) != chip->lpss_tx_threshold)
+                        pxa2xx_spi_write(drv_data, SSIRF,
-                        write_SSITF(chip->lpss_tx_threshold, reg);
+                                         chip->lpss_rx_threshold);
+                if ((pxa2xx_spi_read(drv_data, SSITF) & 0xffff)
+                    != chip->lpss_tx_threshold)
+                        pxa2xx_spi_write(drv_data, SSITF,
+                                         chip->lpss_tx_threshold);
        }
        if (is_quark_x1000_ssp(drv_data) &&
-            (read_DDS_RATE(reg) != chip->dds_rate))
+            (pxa2xx_spi_read(drv_data, DDS_RATE) != chip->dds_rate))
-                write_DDS_RATE(chip->dds_rate, reg);
+                pxa2xx_spi_write(drv_data, DDS_RATE, chip->dds_rate);
        /* see if we need to reload the config registers */
-        if ((read_SSCR0(reg) != cr0) ||
+        if ((pxa2xx_spi_read(drv_data, SSCR0) != cr0)
-            (read_SSCR1(reg) & change_mask) != (cr1 & change_mask)) {
+            || (pxa2xx_spi_read(drv_data, SSCR1) & change_mask)
+            != (cr1 & change_mask)) {
                /* stop the SSP, and update the other bits */
-                write_SSCR0(cr0 & ~SSCR0_SSE, reg);
+                pxa2xx_spi_write(drv_data, SSCR0, cr0 & ~SSCR0_SSE);
                if (!pxa25x_ssp_comp(drv_data))
-                        write_SSTO(chip->timeout, reg);
+                        pxa2xx_spi_write(drv_data, SSTO, chip->timeout);
                /* first set CR1 without interrupt and service enables */
-                write_SSCR1(cr1 & change_mask, reg);
+                pxa2xx_spi_write(drv_data, SSCR1, cr1 & change_mask);
                /* restart the SSP */
-                write_SSCR0(cr0, reg);
+                pxa2xx_spi_write(drv_data, SSCR0, cr0);
        } else {
                if (!pxa25x_ssp_comp(drv_data))
-                        write_SSTO(chip->timeout, reg);
+                        pxa2xx_spi_write(drv_data, SSTO, chip->timeout);
        }
        cs_assert(drv_data);
        /* after chip select, release the data by enabling service
         * requests and interrupts, without changing any mode bits */
-        write_SSCR1(cr1, reg);
+        pxa2xx_spi_write(drv_data, SSCR1, cr1);
 }
 static int pxa2xx_spi_transfer_one_message(struct spi_master *master,
@@ -1005,8 +977,8 @@ static int pxa2xx_spi_unprepare_transfer(struct spi_master *master)
        struct driver_data *drv_data = spi_master_get_devdata(master);
        /* Disable the SSP now */
-        write_SSCR0(read_SSCR0(drv_data->ioaddr) & ~SSCR0_SSE,
+        pxa2xx_spi_write(drv_data, SSCR0,
-                    drv_data->ioaddr);
+                         pxa2xx_spi_read(drv_data, SSCR0) & ~SSCR0_SSE);
        return 0;
 }
@@ -1289,6 +1261,7 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
        struct driver_data *drv_data;
        struct ssp_device *ssp;
        int status;
+        u32 tmp;
        platform_info = dev_get_platdata(dev);
        if (!platform_info) {
@@ -1386,38 +1359,35 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
        drv_data->max_clk_rate = clk_get_rate(ssp->clk);
        /* Load default SSP configuration */
-        write_SSCR0(0, drv_data->ioaddr);
+        pxa2xx_spi_write(drv_data, SSCR0, 0);
        switch (drv_data->ssp_type) {
        case QUARK_X1000_SSP:
-                write_SSCR1(QUARK_X1000_SSCR1_RxTresh(
+                tmp = QUARK_X1000_SSCR1_RxTresh(RX_THRESH_QUARK_X1000_DFLT)
-                                        RX_THRESH_QUARK_X1000_DFLT) |
+                      | QUARK_X1000_SSCR1_TxTresh(TX_THRESH_QUARK_X1000_DFLT);
-                            QUARK_X1000_SSCR1_TxTresh(
+                pxa2xx_spi_write(drv_data, SSCR1, tmp);
-                                        TX_THRESH_QUARK_X1000_DFLT),
-                            drv_data->ioaddr);
                /* using the Motorola SPI protocol and use 8 bit frame */
-                write_SSCR0(QUARK_X1000_SSCR0_Motorola
+                pxa2xx_spi_write(drv_data, SSCR0,
-                            | QUARK_X1000_SSCR0_DataSize(8),
+                                 QUARK_X1000_SSCR0_Motorola
-                            drv_data->ioaddr);
+                                 | QUARK_X1000_SSCR0_DataSize(8));
                break;
        default:
-                write_SSCR1(SSCR1_RxTresh(RX_THRESH_DFLT) |
+                tmp = SSCR1_RxTresh(RX_THRESH_DFLT) |
-                            SSCR1_TxTresh(TX_THRESH_DFLT),
+                      SSCR1_TxTresh(TX_THRESH_DFLT);
-                            drv_data->ioaddr);
+                pxa2xx_spi_write(drv_data, SSCR1, tmp);
-                write_SSCR0(SSCR0_SCR(2)
+                tmp = SSCR0_SCR(2) | SSCR0_Motorola | SSCR0_DataSize(8);
-                            | SSCR0_Motorola
+                pxa2xx_spi_write(drv_data, SSCR0, tmp);
-                            | SSCR0_DataSize(8),
-                            drv_data->ioaddr);
                break;
        }
        if (!pxa25x_ssp_comp(drv_data))
-                write_SSTO(0, drv_data->ioaddr);
+                pxa2xx_spi_write(drv_data, SSTO, 0);
        if (!is_quark_x1000_ssp(drv_data))
-                write_SSPSP(0, drv_data->ioaddr);
+                pxa2xx_spi_write(drv_data, SSPSP, 0);
-        lpss_ssp_setup(drv_data);
+        if (is_lpss_ssp(drv_data))
+                lpss_ssp_setup(drv_data);
        tasklet_init(&drv_data->pump_transfers, pump_transfers,
                     (unsigned long)drv_data);
@@ -1460,7 +1430,7 @@ static int pxa2xx_spi_remove(struct platform_device *pdev)
        pm_runtime_get_sync(&pdev->dev);
        /* Disable the SSP at the peripheral and SOC level */
-        write_SSCR0(0, drv_data->ioaddr);
+        pxa2xx_spi_write(drv_data, SSCR0, 0);
        clk_disable_unprepare(ssp->clk);
        /* Release DMA */
@@ -1497,7 +1467,7 @@ static int pxa2xx_spi_suspend(struct device *dev)
        status = spi_master_suspend(drv_data->master);
        if (status != 0)
                return status;
-        write_SSCR0(0, drv_data->ioaddr);
+        pxa2xx_spi_write(drv_data, SSCR0, 0);
        if (!pm_runtime_suspended(dev))
                clk_disable_unprepare(ssp->clk);
@@ -1518,7 +1488,8 @@ static int pxa2xx_spi_resume(struct device *dev)
                clk_prepare_enable(ssp->clk);
        /* Restore LPSS private register bits */
-        lpss_ssp_setup(drv_data);
+        if (is_lpss_ssp(drv_data))
+                lpss_ssp_setup(drv_data);
        /* Start the queue running */
        status = spi_master_resume(drv_data->master);
diff --git a/drivers/spi/spi-pxa2xx.h b/drivers/spi/spi-pxa2xx.h
index 6bec59c90cd4..85a58c906869 100644
--- a/drivers/spi/spi-pxa2xx.h
+++ b/drivers/spi/spi-pxa2xx.h
@@ -115,23 +115,17 @@ struct chip_data {
        void (*cs_control)(u32 command);
 };
-#define DEFINE_SSP_REG(reg, off) \
+static inline u32 pxa2xx_spi_read(const struct driver_data *drv_data,
-static inline u32 read_##reg(void const __iomem *p) \
+                                  unsigned reg)
-{ return __raw_readl(p + (off)); } \
+{
-\
+        return __raw_readl(drv_data->ioaddr + reg);
-static inline void write_##reg(u32 v, void __iomem *p) \
+}
-{ __raw_writel(v, p + (off)); }
+static  inline void pxa2xx_spi_write(const struct driver_data *drv_data,
-DEFINE_SSP_REG(SSCR0, 0x00)
+                                     unsigned reg, u32 val)
-DEFINE_SSP_REG(SSCR1, 0x04)
+{
-DEFINE_SSP_REG(SSSR, 0x08)
+        __raw_writel(val, drv_data->ioaddr + reg);
-DEFINE_SSP_REG(SSITR, 0x0c)
+}
-DEFINE_SSP_REG(SSDR, 0x10)
-DEFINE_SSP_REG(DDS_RATE, 0x28)  /* DDS Clock Rate */
-DEFINE_SSP_REG(SSTO, 0x28)
-DEFINE_SSP_REG(SSPSP, 0x2c)
-DEFINE_SSP_REG(SSITF, SSITF)
-DEFINE_SSP_REG(SSIRF, SSIRF)
 #define START_STATE ((void *)0)
 #define RUNNING_STATE ((void *)1)
@@ -155,13 +149,11 @@ static inline int pxa25x_ssp_comp(struct driver_data *drv_data)
 static inline void write_SSSR_CS(struct driver_data *drv_data, u32 val)
 {
-        void __iomem *reg = drv_data->ioaddr;
        if (drv_data->ssp_type == CE4100_SSP ||
            drv_data->ssp_type == QUARK_X1000_SSP)
-                val |= read_SSSR(reg) & SSSR_ALT_FRM_MASK;
+                val |= pxa2xx_spi_read(drv_data, SSSR) & SSSR_ALT_FRM_MASK;
-        write_SSSR(val, reg);
+        pxa2xx_spi_write(drv_data, SSSR, val);
 }
 extern int pxa2xx_spi_flush(struct driver_data *drv_data);
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index e7fb5a0d2e8d..ff9cdbdb6672 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -337,7 +337,7 @@ static irqreturn_t spi_qup_qup_irq(int irq, void *dev_id)
 static int spi_qup_io_config(struct spi_device *spi, struct spi_transfer *xfer)
 {
        struct spi_qup *controller = spi_master_get_devdata(spi->master);
-        u32 config, iomode, mode;
+        u32 config, iomode, mode, control;
        int ret, n_words, w_size;
        if (spi->mode & SPI_LOOP && xfer->len > controller->in_fifo_sz) {
@@ -392,6 +392,15 @@ static int spi_qup_io_config(struct spi_device *spi, struct spi_transfer *xfer)
        writel_relaxed(iomode, controller->base + QUP_IO_M_MODES);
+        control = readl_relaxed(controller->base + SPI_IO_CONTROL);
+        if (spi->mode & SPI_CPOL)
+                control |= SPI_IO_C_CLK_IDLE_HIGH;
+        else
+                control &= ~SPI_IO_C_CLK_IDLE_HIGH;
+        writel_relaxed(control, controller->base + SPI_IO_CONTROL);
        config = readl_relaxed(controller->base + SPI_CONFIG);
        if (spi->mode & SPI_LOOP)
diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index daabbabd26b0..1a777dc261d6 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -437,6 +437,7 @@ static void rockchip_spi_prepare_dma(struct rockchip_spi *rs)
        rs->state &= ~TXBUSY;
        spin_unlock_irqrestore(&rs->lock, flags);
+        rxdesc = NULL;
        if (rs->rx) {
                rxconf.direction = rs->dma_rx.direction;
                rxconf.src_addr = rs->dma_rx.addr;
@@ -453,6 +454,7 @@ static void rockchip_spi_prepare_dma(struct rockchip_spi *rs)
                rxdesc->callback_param = rs;
        }
+        txdesc = NULL;
        if (rs->tx) {
                txconf.direction = rs->dma_tx.direction;
                txconf.dst_addr = rs->dma_tx.addr;
@@ -470,7 +472,7 @@ static void rockchip_spi_prepare_dma(struct rockchip_spi *rs)
        }
        /* rx must be started before tx due to spi instinct */
-        if (rs->rx) {
+        if (rxdesc) {
                spin_lock_irqsave(&rs->lock, flags);
                rs->state |= RXBUSY;
                spin_unlock_irqrestore(&rs->lock, flags);
@@ -478,7 +480,7 @@ static void rockchip_spi_prepare_dma(struct rockchip_spi *rs)
                dma_async_issue_pending(rs->dma_rx.ch);
        }
-        if (rs->tx) {
+        if (txdesc) {
                spin_lock_irqsave(&rs->lock, flags);
                rs->state |= TXBUSY;
                spin_unlock_irqrestore(&rs->lock, flags);
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 2071f788c6fb..46ce47076e63 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -15,11 +15,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- *
 */
 #include <linux/module.h>
diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index 37b19836f5cb..9231c34b5a5c 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #include <linux/init.h>
diff --git a/drivers/spi/spi-sc18is602.c b/drivers/spi/spi-sc18is602.c
index 237f2e7a7179..5a56acf8a43e 100644
--- a/drivers/spi/spi-sc18is602.c
+++ b/drivers/spi/spi-sc18is602.c
@@ -12,10 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 #include <linux/kernel.h>
diff --git a/drivers/spi/spi-sh-hspi.c b/drivers/spi/spi-sh-hspi.c
index fc29233d0650..20e800e70442 100644
--- a/drivers/spi/spi-sh-hspi.c
+++ b/drivers/spi/spi-sh-hspi.c
@@ -16,11 +16,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- *
 */
 #include <linux/clk.h>
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 239be7cbe5a8..e57eec0b2f46 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -82,7 +82,9 @@ struct sh_msiof_spi_priv {
 #define MDR1_SYNCMD_LR   0x30000000 /*   L/R mode */
 #define MDR1_SYNCAC_SHIFT        25 /* Sync Polarity (1 = Active-low) */
 #define MDR1_BITLSB_SHIFT        24 /* MSB/LSB First (1 = LSB first) */
-#define MDR1_FLD_MASK    0x000000c0 /* Frame Sync Signal Interval (0-3) */
+#define MDR1_DTDL_SHIFT          20 /* Data Pin Bit Delay for MSIOF_SYNC */
+#define MDR1_SYNCDL_SHIFT        16 /* Frame Sync Signal Timing Delay */
+#define MDR1_FLD_MASK    0x0000000c /* Frame Sync Signal Interval (0-3) */
 #define MDR1_FLD_SHIFT            2
 #define MDR1_XXSTP       0x00000001 /* Transmission/Reception Stop on FIFO */
 /* TMDR1 */
@@ -241,42 +243,80 @@ static irqreturn_t sh_msiof_spi_irq(int irq, void *data)
 static struct {
        unsigned short div;
-        unsigned short scr;
+        unsigned short brdv;
-} const sh_msiof_spi_clk_table[] = {
+} const sh_msiof_spi_div_table[] = {
-        { 1,    SCR_BRPS( 1) | SCR_BRDV_DIV_1 },
+        { 1,    SCR_BRDV_DIV_1 },
-        { 2,    SCR_BRPS( 1) | SCR_BRDV_DIV_2 },
+        { 2,    SCR_BRDV_DIV_2 },
-        { 4,    SCR_BRPS( 1) | SCR_BRDV_DIV_4 },
+        { 4,    SCR_BRDV_DIV_4 },
-        { 8,    SCR_BRPS( 1) | SCR_BRDV_DIV_8 },
+        { 8,    SCR_BRDV_DIV_8 },
-        { 16,   SCR_BRPS( 1) | SCR_BRDV_DIV_16 },
+        { 16,   SCR_BRDV_DIV_16 },
-        { 32,   SCR_BRPS( 1) | SCR_BRDV_DIV_32 },
+        { 32,   SCR_BRDV_DIV_32 },
-        { 64,   SCR_BRPS(32) | SCR_BRDV_DIV_2 },
-        { 128,  SCR_BRPS(32) | SCR_BRDV_DIV_4 },
-        { 256,  SCR_BRPS(32) | SCR_BRDV_DIV_8 },
-        { 512,  SCR_BRPS(32) | SCR_BRDV_DIV_16 },
-        { 1024, SCR_BRPS(32) | SCR_BRDV_DIV_32 },
 };
 static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p,
                                      unsigned long parent_rate, u32 spi_hz)
 {
        unsigned long div = 1024;
+        u32 brps, scr;
        size_t k;
        if (!WARN_ON(!spi_hz || !parent_rate))
                div = DIV_ROUND_UP(parent_rate, spi_hz);
-        /* TODO: make more fine grained */
+        for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) {
+                brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div);
-        for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_clk_table); k++) {
+                if (brps <= 32) /* max of brdv is 32 */
-                if (sh_msiof_spi_clk_table[k].div >= div)
                        break;
        }
-        k = min_t(int, k, ARRAY_SIZE(sh_msiof_spi_clk_table) - 1);
+        k = min_t(int, k, ARRAY_SIZE(sh_msiof_spi_div_table) - 1);
-        sh_msiof_write(p, TSCR, sh_msiof_spi_clk_table[k].scr);
+        scr = sh_msiof_spi_div_table[k].brdv | SCR_BRPS(brps);
+        sh_msiof_write(p, TSCR, scr);
        if (!(p->chipdata->master_flags & SPI_MASTER_MUST_TX))
-                sh_msiof_write(p, RSCR, sh_msiof_spi_clk_table[k].scr);
+                sh_msiof_write(p, RSCR, scr);
+}
+static u32 sh_msiof_get_delay_bit(u32 dtdl_or_syncdl)
+{
+        /*
+         * DTDL/SYNCDL bit      : p->info->dtdl or p->info->syncdl
+         * b'000                : 0
+         * b'001                : 100
+         * b'010                : 200
+         * b'011 (SYNCDL only)  : 300
+         * b'101                : 50
+         * b'110                : 150
+         */
+        if (dtdl_or_syncdl % 100)
+                return dtdl_or_syncdl / 100 + 5;
+        else
+                return dtdl_or_syncdl / 100;
+}
+static u32 sh_msiof_spi_get_dtdl_and_syncdl(struct sh_msiof_spi_priv *p)
+{
+        u32 val;
+        if (!p->info)
+                return 0;
+        /* check if DTDL and SYNCDL is allowed value */
+        if (p->info->dtdl > 200 || p->info->syncdl > 300) {
+                dev_warn(&p->pdev->dev, "DTDL or SYNCDL is too large\n");
+                return 0;
+        }
+        /* check if the sum of DTDL and SYNCDL becomes an integer value  */
+        if ((p->info->dtdl + p->info->syncdl) % 100) {
+                dev_warn(&p->pdev->dev, "the sum of DTDL/SYNCDL is not good\n");
+                return 0;
+        }
+        val = sh_msiof_get_delay_bit(p->info->dtdl) << MDR1_DTDL_SHIFT;
+        val |= sh_msiof_get_delay_bit(p->info->syncdl) << MDR1_SYNCDL_SHIFT;
+        return val;
 }
 static void sh_msiof_spi_set_pin_regs(struct sh_msiof_spi_priv *p,
@@ -296,6 +336,7 @@ static void sh_msiof_spi_set_pin_regs(struct sh_msiof_spi_priv *p,
        tmp = MDR1_SYNCMD_SPI | 1 << MDR1_FLD_SHIFT | MDR1_XXSTP;
        tmp |= !cs_high << MDR1_SYNCAC_SHIFT;
        tmp |= lsb_first << MDR1_BITLSB_SHIFT;
+        tmp |= sh_msiof_spi_get_dtdl_and_syncdl(p);
        sh_msiof_write(p, TMDR1, tmp | MDR1_TRMD | TMDR1_PCON);
        if (p->chipdata->master_flags & SPI_MASTER_MUST_TX) {
                /* These bits are reserved if RX needs TX */
@@ -480,6 +521,8 @@ static int sh_msiof_spi_setup(struct spi_device *spi)
        struct device_node      *np = spi->master->dev.of_node;
        struct sh_msiof_spi_priv *p = spi_master_get_devdata(spi->master);
+        pm_runtime_get_sync(&p->pdev->dev);
        if (!np) {
                /*
                 * Use spi->controller_data for CS (same strategy as spi_gpio),
@@ -498,6 +541,9 @@ static int sh_msiof_spi_setup(struct spi_device *spi)
        if (spi->cs_gpio >= 0)
                gpio_set_value(spi->cs_gpio, !(spi->mode & SPI_CS_HIGH));
+        pm_runtime_put(&p->pdev->dev);
        return 0;
 }
@@ -590,8 +636,7 @@ static int sh_msiof_spi_txrx_once(struct sh_msiof_spi_priv *p,
        }
        /* wait for tx fifo to be emptied / rx fifo to be filled */
-        ret = wait_for_completion_timeout(&p->done, HZ);
+        if (!wait_for_completion_timeout(&p->done, HZ)) {
-        if (!ret) {
                dev_err(&p->pdev->dev, "PIO timeout\n");
                ret = -ETIMEDOUT;
                goto stop_reset;
@@ -701,8 +746,7 @@ static int sh_msiof_dma_once(struct sh_msiof_spi_priv *p, const void *tx,
        }
        /* wait for tx fifo to be emptied / rx fifo to be filled */
-        ret = wait_for_completion_timeout(&p->done, HZ);
+        if (!wait_for_completion_timeout(&p->done, HZ)) {
-        if (!ret) {
                dev_err(&p->pdev->dev, "DMA timeout\n");
                ret = -ETIMEDOUT;
                goto stop_reset;
@@ -952,6 +996,8 @@ static struct sh_msiof_spi_info *sh_msiof_spi_parse_dt(struct device *dev)
                                        &info->tx_fifo_override);
        of_property_read_u32(np, "renesas,rx-fifo-size",
                                        &info->rx_fifo_override);
+        of_property_read_u32(np, "renesas,dtdl", &info->dtdl);
+        of_property_read_u32(np, "renesas,syncdl", &info->syncdl);
        info->num_chipselect = num_cs;
diff --git a/drivers/spi/spi-sh.c b/drivers/spi/spi-sh.c
index 1cfc906dd174..502501187c9e 100644
--- a/drivers/spi/spi-sh.c
+++ b/drivers/spi/spi-sh.c
@@ -14,11 +14,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- *
 */
 #include <linux/module.h>
diff --git a/drivers/spi/spi-sirf.c b/drivers/spi/spi-sirf.c
index d075191476f0..f5715c9f68b0 100644
--- a/drivers/spi/spi-sirf.c
+++ b/drivers/spi/spi-sirf.c
@@ -818,7 +818,6 @@ static SIMPLE_DEV_PM_OPS(spi_sirfsoc_pm_ops, spi_sirfsoc_suspend,
 static const struct of_device_id spi_sirfsoc_of_match[] = {
        { .compatible = "sirf,prima2-spi", },
-        { .compatible = "sirf,marco-spi", },
        {}
 };
 MODULE_DEVICE_TABLE(of, spi_sirfsoc_of_match);
diff --git a/drivers/spi/spi-st-ssc4.c b/drivers/spi/spi-st-ssc4.c
new file mode 100644
index 000000000000..2faeaa7b57a8
--- /dev/null
+++ b/drivers/spi/spi-st-ssc4.c
@@ -0,0 +1,504 @@
+/*
+ *  Copyright (c) 2008-2014 STMicroelectronics Limited
+ *
+ *  Author: Angus Clark <Angus.Clark@st.com>
+ *          Patrice Chotard <patrice.chotard@st.com>
+ *          Lee Jones <lee.jones@linaro.org>
+ *
+ *  SPI master mode controller driver, used in STMicroelectronics devices.
+ *
+ *  May be copied or modified under the terms of the GNU General Public
+ *  License Version 2.0 only.  See linux/COPYING for more information.
+ */
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/of_irq.h>
+#include <linux/pm_runtime.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/spi_bitbang.h>
+/* SSC registers */
+#define SSC_BRG                         0x000
+#define SSC_TBUF                        0x004
+#define SSC_RBUF                        0x008
+#define SSC_CTL                         0x00C
+#define SSC_IEN                         0x010
+#define SSC_I2C                         0x018
+/* SSC Control */
+#define SSC_CTL_DATA_WIDTH_9            0x8
+#define SSC_CTL_DATA_WIDTH_MSK          0xf
+#define SSC_CTL_BM                      0xf
+#define SSC_CTL_HB                      BIT(4)
+#define SSC_CTL_PH                      BIT(5)
+#define SSC_CTL_PO                      BIT(6)
+#define SSC_CTL_SR                      BIT(7)
+#define SSC_CTL_MS                      BIT(8)
+#define SSC_CTL_EN                      BIT(9)
+#define SSC_CTL_LPB                     BIT(10)
+#define SSC_CTL_EN_TX_FIFO              BIT(11)
+#define SSC_CTL_EN_RX_FIFO              BIT(12)
+#define SSC_CTL_EN_CLST_RX              BIT(13)
+/* SSC Interrupt Enable */
+#define SSC_IEN_TEEN                    BIT(2)
+#define FIFO_SIZE                       8
+struct spi_st {
+        /* SSC SPI Controller */
+        void __iomem            *base;
+        struct clk              *clk;
+        struct device           *dev;
+        /* SSC SPI current transaction */
+        const u8                *tx_ptr;
+        u8                      *rx_ptr;
+        u16                     bytes_per_word;
+        unsigned int            words_remaining;
+        unsigned int            baud;
+        struct completion       done;
+};
+static int spi_st_clk_enable(struct spi_st *spi_st)
+{
+        /*
+         * Current platforms use one of the core clocks for SPI and I2C.
+         * If we attempt to disable the clock, the system will hang.
+         *
+         * TODO: Remove this when platform supports power domains.
+         */
+        return 0;
+        return clk_prepare_enable(spi_st->clk);
+}
+static void spi_st_clk_disable(struct spi_st *spi_st)
+{
+        /*
+         * Current platforms use one of the core clocks for SPI and I2C.
+         * If we attempt to disable the clock, the system will hang.
+         *
+         * TODO: Remove this when platform supports power domains.
+         */
+        return;
+        clk_disable_unprepare(spi_st->clk);
+}
+/* Load the TX FIFO */
+static void ssc_write_tx_fifo(struct spi_st *spi_st)
+{
+        unsigned int count, i;
+        uint32_t word = 0;
+        if (spi_st->words_remaining > FIFO_SIZE)
+                count = FIFO_SIZE;
+        else
+                count = spi_st->words_remaining;
+        for (i = 0; i < count; i++) {
+                if (spi_st->tx_ptr) {
+                        if (spi_st->bytes_per_word == 1) {
+                                word = *spi_st->tx_ptr++;
+                        } else {
+                                word = *spi_st->tx_ptr++;
+                                word = *spi_st->tx_ptr++ | (word << 8);
+                        }
+                }
+                writel_relaxed(word, spi_st->base + SSC_TBUF);
+        }
+}
+/* Read the RX FIFO */
+static void ssc_read_rx_fifo(struct spi_st *spi_st)
+{
+        unsigned int count, i;
+        uint32_t word = 0;
+        if (spi_st->words_remaining > FIFO_SIZE)
+                count = FIFO_SIZE;
+        else
+                count = spi_st->words_remaining;
+        for (i = 0; i < count; i++) {
+                word = readl_relaxed(spi_st->base + SSC_RBUF);
+                if (spi_st->rx_ptr) {
+                        if (spi_st->bytes_per_word == 1) {
+                                *spi_st->rx_ptr++ = (uint8_t)word;
+                        } else {
+                                *spi_st->rx_ptr++ = (word >> 8);
+                                *spi_st->rx_ptr++ = word & 0xff;
+                        }
+                }
+        }
+        spi_st->words_remaining -= count;
+}
+static int spi_st_transfer_one(struct spi_master *master,
+                               struct spi_device *spi, struct spi_transfer *t)
+{
+        struct spi_st *spi_st = spi_master_get_devdata(master);
+        uint32_t ctl = 0;
+        /* Setup transfer */
+        spi_st->tx_ptr = t->tx_buf;
+        spi_st->rx_ptr = t->rx_buf;
+        if (spi->bits_per_word > 8) {
+                /*
+                 * Anything greater than 8 bits-per-word requires 2
+                 * bytes-per-word in the RX/TX buffers
+                 */
+                spi_st->bytes_per_word = 2;
+                spi_st->words_remaining = t->len / 2;
+        } else if (spi->bits_per_word == 8 && !(t->len & 0x1)) {
+                /*
+                 * If transfer is even-length, and 8 bits-per-word, then
+                 * implement as half-length 16 bits-per-word transfer
+                 */
+                spi_st->bytes_per_word = 2;
+                spi_st->words_remaining = t->len / 2;
+                /* Set SSC_CTL to 16 bits-per-word */
+                ctl = readl_relaxed(spi_st->base + SSC_CTL);
+                writel_relaxed((ctl | 0xf), spi_st->base + SSC_CTL);
+                readl_relaxed(spi_st->base + SSC_RBUF);
+        } else {
+                spi_st->bytes_per_word = 1;
+                spi_st->words_remaining = t->len;
+        }
+        reinit_completion(&spi_st->done);
+        /* Start transfer by writing to the TX FIFO */
+        ssc_write_tx_fifo(spi_st);
+        writel_relaxed(SSC_IEN_TEEN, spi_st->base + SSC_IEN);
+        /* Wait for transfer to complete */
+        wait_for_completion(&spi_st->done);
+        /* Restore SSC_CTL if necessary */
+        if (ctl)
+                writel_relaxed(ctl, spi_st->base + SSC_CTL);
+        spi_finalize_current_transfer(spi->master);
+        return t->len;
+}
+static void spi_st_cleanup(struct spi_device *spi)
+{
+        int cs = spi->cs_gpio;
+        if (gpio_is_valid(cs))
+                devm_gpio_free(&spi->dev, cs);
+}
+/* the spi->mode bits understood by this driver: */
+#define MODEBITS  (SPI_CPOL | SPI_CPHA | SPI_LSB_FIRST | SPI_LOOP | SPI_CS_HIGH)
+static int spi_st_setup(struct spi_device *spi)
+{
+        struct spi_st *spi_st = spi_master_get_devdata(spi->master);
+        u32 spi_st_clk, sscbrg, var;
+        u32 hz = spi->max_speed_hz;
+        int cs = spi->cs_gpio;
+        int ret;
+        if (!hz)  {
+                dev_err(&spi->dev, "max_speed_hz unspecified\n");
+                return -EINVAL;
+        }
+        if (!gpio_is_valid(cs)) {
+                dev_err(&spi->dev, "%d is not a valid gpio\n", cs);
+                return -EINVAL;
+        }
+        if (devm_gpio_request(&spi->dev, cs, dev_name(&spi->dev))) {
+                dev_err(&spi->dev, "could not request gpio:%d\n", cs);
+                return -EINVAL;
+        }
+        ret = gpio_direction_output(cs, spi->mode & SPI_CS_HIGH);
+        if (ret)
+                return ret;
+        spi_st_clk = clk_get_rate(spi_st->clk);
+        /* Set SSC_BRF */
+        sscbrg = spi_st_clk / (2 * hz);
+        if (sscbrg < 0x07 || sscbrg > BIT(16)) {
+                dev_err(&spi->dev,
+                        "baudrate %d outside valid range %d\n", sscbrg, hz);
+                return -EINVAL;
+        }
+        spi_st->baud = spi_st_clk / (2 * sscbrg);
+        if (sscbrg == BIT(16)) /* 16-bit counter wraps */
+                sscbrg = 0x0;
+        writel_relaxed(sscbrg, spi_st->base + SSC_BRG);
+        dev_dbg(&spi->dev,
+                "setting baudrate:target= %u hz, actual= %u hz, sscbrg= %u\n",
+                hz, spi_st->baud, sscbrg);
+         /* Set SSC_CTL and enable SSC */
+         var = readl_relaxed(spi_st->base + SSC_CTL);
+         var |= SSC_CTL_MS;
+         if (spi->mode & SPI_CPOL)
+                var |= SSC_CTL_PO;
+         else
+                var &= ~SSC_CTL_PO;
+         if (spi->mode & SPI_CPHA)
+                var |= SSC_CTL_PH;
+         else
+                var &= ~SSC_CTL_PH;
+         if ((spi->mode & SPI_LSB_FIRST) == 0)
+                var |= SSC_CTL_HB;
+         else
+                var &= ~SSC_CTL_HB;
+         if (spi->mode & SPI_LOOP)
+                var |= SSC_CTL_LPB;
+         else
+                var &= ~SSC_CTL_LPB;
+         var &= ~SSC_CTL_DATA_WIDTH_MSK;
+         var |= (spi->bits_per_word - 1);
+         var |= SSC_CTL_EN_TX_FIFO | SSC_CTL_EN_RX_FIFO;
+         var |= SSC_CTL_EN;
+         writel_relaxed(var, spi_st->base + SSC_CTL);
+         /* Clear the status register */
+         readl_relaxed(spi_st->base + SSC_RBUF);
+         return 0;
+}
+/* Interrupt fired when TX shift register becomes empty */
+static irqreturn_t spi_st_irq(int irq, void *dev_id)
+{
+        struct spi_st *spi_st = (struct spi_st *)dev_id;
+        /* Read RX FIFO */
+        ssc_read_rx_fifo(spi_st);
+        /* Fill TX FIFO */
+        if (spi_st->words_remaining) {
+                ssc_write_tx_fifo(spi_st);
+        } else {
+                /* TX/RX complete */
+                writel_relaxed(0x0, spi_st->base + SSC_IEN);
+                /*
+                 * read SSC_IEN to ensure that this bit is set
+                 * before re-enabling interrupt
+                 */
+                readl(spi_st->base + SSC_IEN);
+                complete(&spi_st->done);
+        }
+        return IRQ_HANDLED;
+}
+static int spi_st_probe(struct platform_device *pdev)
+{
+        struct device_node *np = pdev->dev.of_node;
+        struct spi_master *master;
+        struct resource *res;
+        struct spi_st *spi_st;
+        int irq, ret = 0;
+        u32 var;
+        master = spi_alloc_master(&pdev->dev, sizeof(*spi_st));
+        if (!master)
+                return -ENOMEM;
+        master->dev.of_node             = np;
+        master->mode_bits               = MODEBITS;
+        master->setup                   = spi_st_setup;
+        master->cleanup                 = spi_st_cleanup;
+        master->transfer_one            = spi_st_transfer_one;
+        master->bits_per_word_mask      = SPI_BPW_MASK(8) | SPI_BPW_MASK(16);
+        master->auto_runtime_pm         = true;
+        master->bus_num                 = pdev->id;
+        spi_st                          = spi_master_get_devdata(master);
+        spi_st->clk = devm_clk_get(&pdev->dev, "ssc");
+        if (IS_ERR(spi_st->clk)) {
+                dev_err(&pdev->dev, "Unable to request clock\n");
+                return PTR_ERR(spi_st->clk);
+        }
+        ret = spi_st_clk_enable(spi_st);
+        if (ret)
+                return ret;
+        init_completion(&spi_st->done);
+        /* Get resources */
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        spi_st->base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(spi_st->base)) {
+                ret = PTR_ERR(spi_st->base);
+                goto clk_disable;
+        }
+        /* Disable I2C and Reset SSC */
+        writel_relaxed(0x0, spi_st->base + SSC_I2C);
+        var = readw_relaxed(spi_st->base + SSC_CTL);
+        var |= SSC_CTL_SR;
+        writel_relaxed(var, spi_st->base + SSC_CTL);
+        udelay(1);
+        var = readl_relaxed(spi_st->base + SSC_CTL);
+        var &= ~SSC_CTL_SR;
+        writel_relaxed(var, spi_st->base + SSC_CTL);
+        /* Set SSC into slave mode before reconfiguring PIO pins */
+        var = readl_relaxed(spi_st->base + SSC_CTL);
+        var &= ~SSC_CTL_MS;
+        writel_relaxed(var, spi_st->base + SSC_CTL);
+        irq = irq_of_parse_and_map(np, 0);
+        if (!irq) {
+                dev_err(&pdev->dev, "IRQ missing or invalid\n");
+                ret = -EINVAL;
+                goto clk_disable;
+        }
+        ret = devm_request_irq(&pdev->dev, irq, spi_st_irq, 0,
+                               pdev->name, spi_st);
+        if (ret) {
+                dev_err(&pdev->dev, "Failed to request irq %d\n", irq);
+                goto clk_disable;
+        }
+        /* by default the device is on */
+        pm_runtime_set_active(&pdev->dev);
+        pm_runtime_enable(&pdev->dev);
+        platform_set_drvdata(pdev, master);
+        ret = devm_spi_register_master(&pdev->dev, master);
+        if (ret) {
+                dev_err(&pdev->dev, "Failed to register master\n");
+                goto clk_disable;
+        }
+        return 0;
+clk_disable:
+        spi_st_clk_disable(spi_st);
+        return ret;
+}
+static int spi_st_remove(struct platform_device *pdev)
+{
+        struct spi_master *master = platform_get_drvdata(pdev);
+        struct spi_st *spi_st = spi_master_get_devdata(master);
+        spi_st_clk_disable(spi_st);
+        pinctrl_pm_select_sleep_state(&pdev->dev);
+        return 0;
+}
+#ifdef CONFIG_PM
+static int spi_st_runtime_suspend(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct spi_st *spi_st = spi_master_get_devdata(master);
+        writel_relaxed(0, spi_st->base + SSC_IEN);
+        pinctrl_pm_select_sleep_state(dev);
+        spi_st_clk_disable(spi_st);
+        return 0;
+}
+static int spi_st_runtime_resume(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct spi_st *spi_st = spi_master_get_devdata(master);
+        int ret;
+        ret = spi_st_clk_enable(spi_st);
+        pinctrl_pm_select_default_state(dev);
+        return ret;
+}
+#endif
+#ifdef CONFIG_PM_SLEEP
+static int spi_st_suspend(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        int ret;
+        ret = spi_master_suspend(master);
+        if (ret)
+                return ret;
+        return pm_runtime_force_suspend(dev);
+}
+static int spi_st_resume(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        int ret;
+        ret = spi_master_resume(master);
+        if (ret)
+                return ret;
+        return pm_runtime_force_resume(dev);
+}
+#endif
+static const struct dev_pm_ops spi_st_pm = {
+        SET_SYSTEM_SLEEP_PM_OPS(spi_st_suspend, spi_st_resume)
+        SET_RUNTIME_PM_OPS(spi_st_runtime_suspend, spi_st_runtime_resume, NULL)
+};
+static struct of_device_id stm_spi_match[] = {
+        { .compatible = "st,comms-ssc4-spi", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, stm_spi_match);
+static struct platform_driver spi_st_driver = {
+        .driver = {
+                .name = "spi-st",
+                .pm = &spi_st_pm,
+                .of_match_table = of_match_ptr(stm_spi_match),
+        },
+        .probe = spi_st_probe,
+        .remove = spi_st_remove,
+};
+module_platform_driver(spi_st_driver);
+MODULE_AUTHOR("Patrice Chotard <patrice.chotard@st.com>");
+MODULE_DESCRIPTION("STM SSC SPI driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 6146c4cd6583..884a716e50cb 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -201,7 +201,7 @@ static void ti_qspi_restore_ctx(struct ti_qspi *qspi)
 static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t)
 {
-        int wlen, count, ret;
+        int wlen, count;
        unsigned int cmd;
        const u8 *txbuf;
@@ -230,9 +230,8 @@ static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t)
                }
                ti_qspi_write(qspi, cmd, QSPI_SPI_CMD_REG);
-                ret = wait_for_completion_timeout(&qspi->transfer_complete,
+                if (!wait_for_completion_timeout(&qspi->transfer_complete,
-                                                  QSPI_COMPLETION_TIMEOUT);
+                                                 QSPI_COMPLETION_TIMEOUT)) {
-                if (ret == 0) {
                        dev_err(qspi->dev, "write timed out\n");
                        return -ETIMEDOUT;
                }
@@ -245,7 +244,7 @@ static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t)
 static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t)
 {
-        int wlen, count, ret;
+        int wlen, count;
        unsigned int cmd;
        u8 *rxbuf;
@@ -268,9 +267,8 @@ static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t)
        while (count) {
                dev_dbg(qspi->dev, "rx cmd %08x dc %08x\n", cmd, qspi->dc);
                ti_qspi_write(qspi, cmd, QSPI_SPI_CMD_REG);
-                ret = wait_for_completion_timeout(&qspi->transfer_complete,
+                if (!wait_for_completion_timeout(&qspi->transfer_complete,
-                                QSPI_COMPLETION_TIMEOUT);
+                                                 QSPI_COMPLETION_TIMEOUT)) {
-                if (ret == 0) {
                        dev_err(qspi->dev, "read timed out\n");
                        return -ETIMEDOUT;
                }
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index be692ad50442..93dfcee0f987 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
 */
 #include <linux/delay.h>
diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
index 79bd84f43430..133f53a9c1d4 100644
--- a/drivers/spi/spi-xilinx.c
+++ b/drivers/spi/spi-xilinx.c
@@ -22,6 +22,8 @@
 #include <linux/spi/xilinx_spi.h>
 #include <linux/io.h>
+#define XILINX_SPI_MAX_CS       32
 #define XILINX_SPI_NAME "xilinx_spi"
 /* Register definitions as per "OPB Serial Peripheral Interface (SPI) (v1.00e)
@@ -34,7 +36,8 @@
 #define XSPI_CR_MASTER_MODE     0x04
 #define XSPI_CR_CPOL            0x08
 #define XSPI_CR_CPHA            0x10
-#define XSPI_CR_MODE_MASK       (XSPI_CR_CPHA | XSPI_CR_CPOL)
+#define XSPI_CR_MODE_MASK       (XSPI_CR_CPHA | XSPI_CR_CPOL | \
+                                 XSPI_CR_LSB_FIRST | XSPI_CR_LOOP)
 #define XSPI_CR_TXFIFO_RESET    0x20
 #define XSPI_CR_RXFIFO_RESET    0x40
 #define XSPI_CR_MANUAL_SSELECT  0x80
@@ -85,12 +88,11 @@ struct xilinx_spi {
        u8 *rx_ptr;             /* pointer in the Tx buffer */
        const u8 *tx_ptr;       /* pointer in the Rx buffer */
-        int remaining_bytes;    /* the number of bytes left to transfer */
+        u8 bytes_per_word;
-        u8 bits_per_word;
+        int buffer_size;        /* buffer size in words */
+        u32 cs_inactive;        /* Level of the CS pins when inactive*/
        unsigned int (*read_fn)(void __iomem *);
        void (*write_fn)(u32, void __iomem *);
-        void (*tx_fn)(struct xilinx_spi *);
-        void (*rx_fn)(struct xilinx_spi *);
 };
 static void xspi_write32(u32 val, void __iomem *addr)
@@ -113,49 +115,51 @@ static unsigned int xspi_read32_be(void __iomem *addr)
        return ioread32be(addr);
 }
-static void xspi_tx8(struct xilinx_spi *xspi)
+static void xilinx_spi_tx(struct xilinx_spi *xspi)
 {
-        xspi->write_fn(*xspi->tx_ptr, xspi->regs + XSPI_TXD_OFFSET);
+        u32 data = 0;
-        xspi->tx_ptr++;
-}
-static void xspi_tx16(struct xilinx_spi *xspi)
-{
-        xspi->write_fn(*(u16 *)(xspi->tx_ptr), xspi->regs + XSPI_TXD_OFFSET);
-        xspi->tx_ptr += 2;
-}
-static void xspi_tx32(struct xilinx_spi *xspi)
+        if (!xspi->tx_ptr) {
-{
+                xspi->write_fn(0, xspi->regs + XSPI_TXD_OFFSET);
-        xspi->write_fn(*(u32 *)(xspi->tx_ptr), xspi->regs + XSPI_TXD_OFFSET);
+                return;
-        xspi->tx_ptr += 4;
-}
-static void xspi_rx8(struct xilinx_spi *xspi)
-{
-        u32 data = xspi->read_fn(xspi->regs + XSPI_RXD_OFFSET);
-        if (xspi->rx_ptr) {
-                *xspi->rx_ptr = data & 0xff;
-                xspi->rx_ptr++;
        }
-}
-static void xspi_rx16(struct xilinx_spi *xspi)
+        switch (xspi->bytes_per_word) {
-{
+        case 1:
-        u32 data = xspi->read_fn(xspi->regs + XSPI_RXD_OFFSET);
+                data = *(u8 *)(xspi->tx_ptr);
-        if (xspi->rx_ptr) {
+                break;
-                *(u16 *)(xspi->rx_ptr) = data & 0xffff;
+        case 2:
-                xspi->rx_ptr += 2;
+                data = *(u16 *)(xspi->tx_ptr);
+                break;
+        case 4:
+                data = *(u32 *)(xspi->tx_ptr);
+                break;
        }
+        xspi->write_fn(data, xspi->regs + XSPI_TXD_OFFSET);
+        xspi->tx_ptr += xspi->bytes_per_word;
 }
-static void xspi_rx32(struct xilinx_spi *xspi)
+static void xilinx_spi_rx(struct xilinx_spi *xspi)
 {
        u32 data = xspi->read_fn(xspi->regs + XSPI_RXD_OFFSET);
-        if (xspi->rx_ptr) {
+        if (!xspi->rx_ptr)
+                return;
+        switch (xspi->bytes_per_word) {
+        case 1:
+                *(u8 *)(xspi->rx_ptr) = data;
+                break;
+        case 2:
+                *(u16 *)(xspi->rx_ptr) = data;
+                break;
+        case 4:
                *(u32 *)(xspi->rx_ptr) = data;
-                xspi->rx_ptr += 4;
+                break;
        }
+        xspi->rx_ptr += xspi->bytes_per_word;
 }
 static void xspi_init_hw(struct xilinx_spi *xspi)
@@ -165,46 +169,56 @@ static void xspi_init_hw(struct xilinx_spi *xspi)
        /* Reset the SPI device */
        xspi->write_fn(XIPIF_V123B_RESET_MASK,
                regs_base + XIPIF_V123B_RESETR_OFFSET);
-        /* Disable all the interrupts just in case */
+        /* Enable the transmit empty interrupt, which we use to determine
-        xspi->write_fn(0, regs_base + XIPIF_V123B_IIER_OFFSET);
+         * progress on the transmission.
-        /* Enable the global IPIF interrupt */
+         */
-        xspi->write_fn(XIPIF_V123B_GINTR_ENABLE,
+        xspi->write_fn(XSPI_INTR_TX_EMPTY,
-                regs_base + XIPIF_V123B_DGIER_OFFSET);
+                        regs_base + XIPIF_V123B_IIER_OFFSET);
+        /* Disable the global IPIF interrupt */
+        xspi->write_fn(0, regs_base + XIPIF_V123B_DGIER_OFFSET);
        /* Deselect the slave on the SPI bus */
        xspi->write_fn(0xffff, regs_base + XSPI_SSR_OFFSET);
        /* Disable the transmitter, enable Manual Slave Select Assertion,
         * put SPI controller into master mode, and enable it */
-        xspi->write_fn(XSPI_CR_TRANS_INHIBIT | XSPI_CR_MANUAL_SSELECT |
+        xspi->write_fn(XSPI_CR_MANUAL_SSELECT | XSPI_CR_MASTER_MODE |
-                XSPI_CR_MASTER_MODE | XSPI_CR_ENABLE | XSPI_CR_TXFIFO_RESET |
+                XSPI_CR_ENABLE | XSPI_CR_TXFIFO_RESET | XSPI_CR_RXFIFO_RESET,
-                XSPI_CR_RXFIFO_RESET, regs_base + XSPI_CR_OFFSET);
+                regs_base + XSPI_CR_OFFSET);
 }
 static void xilinx_spi_chipselect(struct spi_device *spi, int is_on)
 {
        struct xilinx_spi *xspi = spi_master_get_devdata(spi->master);
+        u16 cr;
+        u32 cs;
        if (is_on == BITBANG_CS_INACTIVE) {
                /* Deselect the slave on the SPI bus */
-                xspi->write_fn(0xffff, xspi->regs + XSPI_SSR_OFFSET);
+                xspi->write_fn(xspi->cs_inactive, xspi->regs + XSPI_SSR_OFFSET);
-        } else if (is_on == BITBANG_CS_ACTIVE) {
+                return;
-                /* Set the SPI clock phase and polarity */
-                u16 cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET)
-                         & ~XSPI_CR_MODE_MASK;
-                if (spi->mode & SPI_CPHA)
-                        cr |= XSPI_CR_CPHA;
-                if (spi->mode & SPI_CPOL)
-                        cr |= XSPI_CR_CPOL;
-                xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
-                /* We do not check spi->max_speed_hz here as the SPI clock
-                 * frequency is not software programmable (the IP block design
-                 * parameter)
-                 */
-                /* Activate the chip select */
-                xspi->write_fn(~(0x0001 << spi->chip_select),
-                        xspi->regs + XSPI_SSR_OFFSET);
        }
+        /* Set the SPI clock phase and polarity */
+        cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET) & ~XSPI_CR_MODE_MASK;
+        if (spi->mode & SPI_CPHA)
+                cr |= XSPI_CR_CPHA;
+        if (spi->mode & SPI_CPOL)
+                cr |= XSPI_CR_CPOL;
+        if (spi->mode & SPI_LSB_FIRST)
+                cr |= XSPI_CR_LSB_FIRST;
+        if (spi->mode & SPI_LOOP)
+                cr |= XSPI_CR_LOOP;
+        xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
+        /* We do not check spi->max_speed_hz here as the SPI clock
+         * frequency is not software programmable (the IP block design
+         * parameter)
+         */
+        cs = xspi->cs_inactive;
+        cs ^= BIT(spi->chip_select);
+        /* Activate the chip select */
+        xspi->write_fn(cs, xspi->regs + XSPI_SSR_OFFSET);
 }
 /* spi_bitbang requires custom setup_transfer() to be defined if there is a
@@ -213,85 +227,85 @@ static void xilinx_spi_chipselect(struct spi_device *spi, int is_on)
 static int xilinx_spi_setup_transfer(struct spi_device *spi,
                struct spi_transfer *t)
 {
-        return 0;
+        struct xilinx_spi *xspi = spi_master_get_devdata(spi->master);
-}
-static void xilinx_spi_fill_tx_fifo(struct xilinx_spi *xspi)
+        if (spi->mode & SPI_CS_HIGH)
-{
+                xspi->cs_inactive &= ~BIT(spi->chip_select);
-        u8 sr;
+        else
+                xspi->cs_inactive |= BIT(spi->chip_select);
-        /* Fill the Tx FIFO with as many bytes as possible */
+        return 0;
-        sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
-        while ((sr & XSPI_SR_TX_FULL_MASK) == 0 && xspi->remaining_bytes > 0) {
-                if (xspi->tx_ptr)
-                        xspi->tx_fn(xspi);
-                else
-                        xspi->write_fn(0, xspi->regs + XSPI_TXD_OFFSET);
-                xspi->remaining_bytes -= xspi->bits_per_word / 8;
-                sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
-        }
 }
 static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
 {
        struct xilinx_spi *xspi = spi_master_get_devdata(spi->master);
-        u32 ipif_ier;
+        int remaining_words;    /* the number of words left to transfer */
+        bool use_irq = false;
+        u16 cr = 0;
        /* We get here with transmitter inhibited */
        xspi->tx_ptr = t->tx_buf;
        xspi->rx_ptr = t->rx_buf;
-        xspi->remaining_bytes = t->len;
+        remaining_words = t->len / xspi->bytes_per_word;
        reinit_completion(&xspi->done);
+        if (xspi->irq >= 0 &&  remaining_words > xspi->buffer_size) {
+                use_irq = true;
+                xspi->write_fn(XSPI_INTR_TX_EMPTY,
+                                xspi->regs + XIPIF_V123B_IISR_OFFSET);
+                /* Enable the global IPIF interrupt */
+                xspi->write_fn(XIPIF_V123B_GINTR_ENABLE,
+                                xspi->regs + XIPIF_V123B_DGIER_OFFSET);
+                /* Inhibit irq to avoid spurious irqs on tx_empty*/
+                cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET);
+                xspi->write_fn(cr | XSPI_CR_TRANS_INHIBIT,
+                               xspi->regs + XSPI_CR_OFFSET);
+        }
-        /* Enable the transmit empty interrupt, which we use to determine
+        while (remaining_words) {
-         * progress on the transmission.
+                int n_words, tx_words, rx_words;
-         */
-        ipif_ier = xspi->read_fn(xspi->regs + XIPIF_V123B_IIER_OFFSET);
-        xspi->write_fn(ipif_ier | XSPI_INTR_TX_EMPTY,
-                xspi->regs + XIPIF_V123B_IIER_OFFSET);
-        for (;;) {
+                n_words = min(remaining_words, xspi->buffer_size);
-                u16 cr;
-                u8 sr;
-                xilinx_spi_fill_tx_fifo(xspi);
+                tx_words = n_words;
+                while (tx_words--)
+                        xilinx_spi_tx(xspi);
                /* Start the transfer by not inhibiting the transmitter any
                 * longer
                 */
-                cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET) &
-                                                        ~XSPI_CR_TRANS_INHIBIT;
-                xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
-                wait_for_completion(&xspi->done);
+                if (use_irq) {
+                        xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
+                        wait_for_completion(&xspi->done);
+                } else
+                        while (!(xspi->read_fn(xspi->regs + XSPI_SR_OFFSET) &
+                                                XSPI_SR_TX_EMPTY_MASK))
+                                ;
                /* A transmit has just completed. Process received data and
                 * check for more data to transmit. Always inhibit the
                 * transmitter while the Isr refills the transmit register/FIFO,
                 * or make sure it is stopped if we're done.
                 */
-                cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET);
+                if (use_irq)
-                xspi->write_fn(cr | XSPI_CR_TRANS_INHIBIT,
+                        xspi->write_fn(cr | XSPI_CR_TRANS_INHIBIT,
                               xspi->regs + XSPI_CR_OFFSET);
                /* Read out all the data from the Rx FIFO */
-                sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
+                rx_words = n_words;
-                while ((sr & XSPI_SR_RX_EMPTY_MASK) == 0) {
+                while (rx_words--)
-                        xspi->rx_fn(xspi);
+                        xilinx_spi_rx(xspi);
-                        sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
-                }
+                remaining_words -= n_words;
-                /* See if there is more data to send */
-                if (xspi->remaining_bytes <= 0)
-                        break;
        }
-        /* Disable the transmit empty interrupt */
+        if (use_irq)
-        xspi->write_fn(ipif_ier, xspi->regs + XIPIF_V123B_IIER_OFFSET);
+                xspi->write_fn(0, xspi->regs + XIPIF_V123B_DGIER_OFFSET);
-        return t->len - xspi->remaining_bytes;
+        return t->len;
 }
@@ -316,6 +330,28 @@ static irqreturn_t xilinx_spi_irq(int irq, void *dev_id)
        return IRQ_HANDLED;
 }
+static int xilinx_spi_find_buffer_size(struct xilinx_spi *xspi)
+{
+        u8 sr;
+        int n_words = 0;
+        /*
+         * Before the buffer_size detection we reset the core
+         * to make sure we start with a clean state.
+         */
+        xspi->write_fn(XIPIF_V123B_RESET_MASK,
+                xspi->regs + XIPIF_V123B_RESETR_OFFSET);
+        /* Fill the Tx FIFO with as many words as possible */
+        do {
+                xspi->write_fn(0, xspi->regs + XSPI_TXD_OFFSET);
+                sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
+                n_words++;
+        } while (!(sr & XSPI_SR_TX_FULL_MASK));
+        return n_words;
+}
 static const struct of_device_id xilinx_spi_of_match[] = {
        { .compatible = "xlnx,xps-spi-2.00.a", },
        { .compatible = "xlnx,xps-spi-2.00.b", },
@@ -348,14 +384,21 @@ static int xilinx_spi_probe(struct platform_device *pdev)
                return -EINVAL;
        }
+        if (num_cs > XILINX_SPI_MAX_CS) {
+                dev_err(&pdev->dev, "Invalid number of spi slaves\n");
+                return -EINVAL;
+        }
        master = spi_alloc_master(&pdev->dev, sizeof(struct xilinx_spi));
        if (!master)
                return -ENODEV;
        /* the spi->mode bits understood by this driver: */
-        master->mode_bits = SPI_CPOL | SPI_CPHA;
+        master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_LSB_FIRST | SPI_LOOP |
+                            SPI_CS_HIGH;
        xspi = spi_master_get_devdata(master);
+        xspi->cs_inactive = 0xffffffff;
        xspi->bitbang.master = master;
        xspi->bitbang.chipselect = xilinx_spi_chipselect;
        xspi->bitbang.setup_transfer = xilinx_spi_setup_transfer;
@@ -392,35 +435,20 @@ static int xilinx_spi_probe(struct platform_device *pdev)
        }
        master->bits_per_word_mask = SPI_BPW_MASK(bits_per_word);
-        xspi->bits_per_word = bits_per_word;
+        xspi->bytes_per_word = bits_per_word / 8;
-        if (xspi->bits_per_word == 8) {
+        xspi->buffer_size = xilinx_spi_find_buffer_size(xspi);
-                xspi->tx_fn = xspi_tx8;
-                xspi->rx_fn = xspi_rx8;
-        } else if (xspi->bits_per_word == 16) {
-                xspi->tx_fn = xspi_tx16;
-                xspi->rx_fn = xspi_rx16;
-        } else if (xspi->bits_per_word == 32) {
-                xspi->tx_fn = xspi_tx32;
-                xspi->rx_fn = xspi_rx32;
-        } else {
-                ret = -EINVAL;
-                goto put_master;
-        }
-        /* SPI controller initializations */
-        xspi_init_hw(xspi);
        xspi->irq = platform_get_irq(pdev, 0);
-        if (xspi->irq < 0) {
+        if (xspi->irq >= 0) {
-                ret = xspi->irq;
+                /* Register for SPI Interrupt */
-                goto put_master;
+                ret = devm_request_irq(&pdev->dev, xspi->irq, xilinx_spi_irq, 0,
+                                dev_name(&pdev->dev), xspi);
+                if (ret)
+                        goto put_master;
        }
-        /* Register for SPI Interrupt */
+        /* SPI controller initializations */
-        ret = devm_request_irq(&pdev->dev, xspi->irq, xilinx_spi_irq, 0,
+        xspi_init_hw(xspi);
-                               dev_name(&pdev->dev), xspi);
-        if (ret)
-                goto put_master;
        ret = spi_bitbang_start(&xspi->bitbang);
        if (ret) {
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 66a70e9bc743..c64a3e59fce3 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #include <linux/kernel.h>
@@ -788,7 +784,7 @@ static int spi_transfer_one_message(struct spi_master *master,
        struct spi_transfer *xfer;
        bool keep_cs = false;
        int ret = 0;
-        int ms = 1;
+        unsigned long ms = 1;
        spi_set_cs(msg->spi, true);
@@ -875,31 +871,59 @@ void spi_finalize_current_transfer(struct spi_master *master)
 EXPORT_SYMBOL_GPL(spi_finalize_current_transfer);
 /**
- * spi_pump_messages - kthread work function which processes spi message queue
+ * __spi_pump_messages - function which processes spi message queue
- * @work: pointer to kthread work struct contained in the master struct
+ * @master: master to process queue for
+ * @in_kthread: true if we are in the context of the message pump thread
 *
 * This function checks if there is any spi message in the queue that
 * needs processing and if so call out to the driver to initialize hardware
 * and transfer each message.
 *
+ * Note that it is called both from the kthread itself and also from
+ * inside spi_sync(); the queue extraction handling at the top of the
+ * function should deal with this safely.
 */
-static void spi_pump_messages(struct kthread_work *work)
+static void __spi_pump_messages(struct spi_master *master, bool in_kthread)
 {
-        struct spi_master *master =
-                container_of(work, struct spi_master, pump_messages);
        unsigned long flags;
        bool was_busy = false;
        int ret;
-        /* Lock queue and check for queue work */
+        /* Lock queue */
        spin_lock_irqsave(&master->queue_lock, flags);
+        /* Make sure we are not already running a message */
+        if (master->cur_msg) {
+                spin_unlock_irqrestore(&master->queue_lock, flags);
+                return;
+        }
+        /* If another context is idling the device then defer */
+        if (master->idling) {
+                queue_kthread_work(&master->kworker, &master->pump_messages);
+                spin_unlock_irqrestore(&master->queue_lock, flags);
+                return;
+        }
+        /* Check if the queue is idle */
        if (list_empty(&master->queue) || !master->running) {
                if (!master->busy) {
                        spin_unlock_irqrestore(&master->queue_lock, flags);
                        return;
                }
+                /* Only do teardown in the thread */
+                if (!in_kthread) {
+                        queue_kthread_work(&master->kworker,
+                                           &master->pump_messages);
+                        spin_unlock_irqrestore(&master->queue_lock, flags);
+                        return;
+                }
                master->busy = false;
+                master->idling = true;
                spin_unlock_irqrestore(&master->queue_lock, flags);
                kfree(master->dummy_rx);
                master->dummy_rx = NULL;
                kfree(master->dummy_tx);
@@ -913,14 +937,13 @@ static void spi_pump_messages(struct kthread_work *work)
                        pm_runtime_put_autosuspend(master->dev.parent);
                }
                trace_spi_master_idle(master);
-                return;
-        }
-        /* Make sure we are not already running a message */
+                spin_lock_irqsave(&master->queue_lock, flags);
-        if (master->cur_msg) {
+                master->idling = false;
                spin_unlock_irqrestore(&master->queue_lock, flags);
                return;
        }
        /* Extract head of queue */
        master->cur_msg =
                list_first_entry(&master->queue, struct spi_message, queue);
@@ -985,13 +1008,22 @@ static void spi_pump_messages(struct kthread_work *work)
        }
 }
+/**
+ * spi_pump_messages - kthread work function which processes spi message queue
+ * @work: pointer to kthread work struct contained in the master struct
+ */
+static void spi_pump_messages(struct kthread_work *work)
+{
+        struct spi_master *master =
+                container_of(work, struct spi_master, pump_messages);
+        __spi_pump_messages(master, true);
+}
 static int spi_init_queue(struct spi_master *master)
 {
        struct sched_param param = { .sched_priority = MAX_RT_PRIO - 1 };
-        INIT_LIST_HEAD(&master->queue);
-        spin_lock_init(&master->queue_lock);
        master->running = false;
        master->busy = false;
@@ -1161,12 +1193,9 @@ static int spi_destroy_queue(struct spi_master *master)
        return 0;
 }
-/**
+static int __spi_queued_transfer(struct spi_device *spi,
- * spi_queued_transfer - transfer function for queued transfers
+                                 struct spi_message *msg,
- * @spi: spi device which is requesting transfer
+                                 bool need_pump)
- * @msg: spi message which is to handled is queued to driver queue
- */
-static int spi_queued_transfer(struct spi_device *spi, struct spi_message *msg)
 {
        struct spi_master *master = spi->master;
        unsigned long flags;
@@ -1181,13 +1210,23 @@ static int spi_queued_transfer(struct spi_device *spi, struct spi_message *msg)
        msg->status = -EINPROGRESS;
        list_add_tail(&msg->queue, &master->queue);
-        if (!master->busy)
+        if (!master->busy && need_pump)
                queue_kthread_work(&master->kworker, &master->pump_messages);
        spin_unlock_irqrestore(&master->queue_lock, flags);
        return 0;
 }
+/**
+ * spi_queued_transfer - transfer function for queued transfers
+ * @spi: spi device which is requesting transfer
+ * @msg: spi message which is to handled is queued to driver queue
+ */
+static int spi_queued_transfer(struct spi_device *spi, struct spi_message *msg)
+{
+        return __spi_queued_transfer(spi, msg, true);
+}
 static int spi_master_initialize_queue(struct spi_master *master)
 {
        int ret;
@@ -1609,6 +1648,8 @@ int spi_register_master(struct spi_master *master)
                dynamic = 1;
        }
+        INIT_LIST_HEAD(&master->queue);
+        spin_lock_init(&master->queue_lock);
        spin_lock_init(&master->bus_lock_spinlock);
        mutex_init(&master->bus_lock_mutex);
        master->bus_lock_flag = 0;
@@ -2114,19 +2155,46 @@ static int __spi_sync(struct spi_device *spi, struct spi_message *message,
        DECLARE_COMPLETION_ONSTACK(done);
        int status;
        struct spi_master *master = spi->master;
+        unsigned long flags;
+        status = __spi_validate(spi, message);
+        if (status != 0)
+                return status;
        message->complete = spi_complete;
        message->context = &done;
+        message->spi = spi;
        if (!bus_locked)
                mutex_lock(&master->bus_lock_mutex);
-        status = spi_async_locked(spi, message);
+        /* If we're not using the legacy transfer method then we will
+         * try to transfer in the calling context so special case.
+         * This code would be less tricky if we could remove the
+         * support for driver implemented message queues.
+         */
+        if (master->transfer == spi_queued_transfer) {
+                spin_lock_irqsave(&master->bus_lock_spinlock, flags);
+                trace_spi_message_submit(message);
+                status = __spi_queued_transfer(spi, message, false);
+                spin_unlock_irqrestore(&master->bus_lock_spinlock, flags);
+        } else {
+                status = spi_async_locked(spi, message);
+        }
        if (!bus_locked)
                mutex_unlock(&master->bus_lock_mutex);
        if (status == 0) {
+                /* Push out the messages in the calling context if we
+                 * can.
+                 */
+                if (master->transfer == spi_queued_transfer)
+                        __spi_pump_messages(master, false);
                wait_for_completion(&done);
                status = message->status;
        }
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index 6941e04afb8c..4eb7a980e670 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -14,10 +14,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #include <linux/init.h>
@@ -317,6 +313,37 @@ done:
        return status;
 }
+static struct spi_ioc_transfer *
+spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc,
+                unsigned *n_ioc)
+{
+        struct spi_ioc_transfer *ioc;
+        u32     tmp;
+        /* Check type, command number and direction */
+        if (_IOC_TYPE(cmd) != SPI_IOC_MAGIC
+                        || _IOC_NR(cmd) != _IOC_NR(SPI_IOC_MESSAGE(0))
+                        || _IOC_DIR(cmd) != _IOC_WRITE)
+                return ERR_PTR(-ENOTTY);
+        tmp = _IOC_SIZE(cmd);
+        if ((tmp % sizeof(struct spi_ioc_transfer)) != 0)
+                return ERR_PTR(-EINVAL);
+        *n_ioc = tmp / sizeof(struct spi_ioc_transfer);
+        if (*n_ioc == 0)
+                return NULL;
+        /* copy into scratch area */
+        ioc = kmalloc(tmp, GFP_KERNEL);
+        if (!ioc)
+                return ERR_PTR(-ENOMEM);
+        if (__copy_from_user(ioc, u_ioc, tmp)) {
+                kfree(ioc);
+                return ERR_PTR(-EFAULT);
+        }
+        return ioc;
+}
 static long
 spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
@@ -456,32 +483,15 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        default:
                /* segmented and/or full-duplex I/O request */
-                if (_IOC_NR(cmd) != _IOC_NR(SPI_IOC_MESSAGE(0))
+                /* Check message and copy into scratch area */
-                                || _IOC_DIR(cmd) != _IOC_WRITE) {
+                ioc = spidev_get_ioc_message(cmd,
-                        retval = -ENOTTY;
+                                (struct spi_ioc_transfer __user *)arg, &n_ioc);
-                        break;
+                if (IS_ERR(ioc)) {
-                }
+                        retval = PTR_ERR(ioc);
-                tmp = _IOC_SIZE(cmd);
-                if ((tmp % sizeof(struct spi_ioc_transfer)) != 0) {
-                        retval = -EINVAL;
-                        break;
-                }
-                n_ioc = tmp / sizeof(struct spi_ioc_transfer);
-                if (n_ioc == 0)
-                        break;
-                /* copy into scratch area */
-                ioc = kmalloc(tmp, GFP_KERNEL);
-                if (!ioc) {
-                        retval = -ENOMEM;
-                        break;
-                }
-                if (__copy_from_user(ioc, (void __user *)arg, tmp)) {
-                        kfree(ioc);
-                        retval = -EFAULT;
                        break;
                }
+                if (!ioc)
+                        break;  /* n_ioc is also 0 */
                /* translate to spi_message, execute */
                retval = spidev_message(spidev, ioc, n_ioc);
@@ -496,8 +506,67 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 #ifdef CONFIG_COMPAT
 static long
+spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
+                unsigned long arg)
+{
+        struct spi_ioc_transfer __user  *u_ioc;
+        int                             retval = 0;
+        struct spidev_data              *spidev;
+        struct spi_device               *spi;
+        unsigned                        n_ioc, n;
+        struct spi_ioc_transfer         *ioc;
+        u_ioc = (struct spi_ioc_transfer __user *) compat_ptr(arg);
+        if (!access_ok(VERIFY_READ, u_ioc, _IOC_SIZE(cmd)))
+                return -EFAULT;
+        /* guard against device removal before, or while,
+         * we issue this ioctl.
+         */
+        spidev = filp->private_data;
+        spin_lock_irq(&spidev->spi_lock);
+        spi = spi_dev_get(spidev->spi);
+        spin_unlock_irq(&spidev->spi_lock);
+        if (spi == NULL)
+                return -ESHUTDOWN;
+        /* SPI_IOC_MESSAGE needs the buffer locked "normally" */
+        mutex_lock(&spidev->buf_lock);
+        /* Check message and copy into scratch area */
+        ioc = spidev_get_ioc_message(cmd, u_ioc, &n_ioc);
+        if (IS_ERR(ioc)) {
+                retval = PTR_ERR(ioc);
+                goto done;
+        }
+        if (!ioc)
+                goto done;      /* n_ioc is also 0 */
+        /* Convert buffer pointers */
+        for (n = 0; n < n_ioc; n++) {
+                ioc[n].rx_buf = (uintptr_t) compat_ptr(ioc[n].rx_buf);
+                ioc[n].tx_buf = (uintptr_t) compat_ptr(ioc[n].tx_buf);
+        }
+        /* translate to spi_message, execute */
+        retval = spidev_message(spidev, ioc, n_ioc);
+        kfree(ioc);
+done:
+        mutex_unlock(&spidev->buf_lock);
+        spi_dev_put(spi);
+        return retval;
+}
+static long
 spidev_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
+        if (_IOC_TYPE(cmd) == SPI_IOC_MAGIC
+                        && _IOC_NR(cmd) == _IOC_NR(SPI_IOC_MESSAGE(0))
+                        && _IOC_DIR(cmd) == _IOC_WRITE)
+                return spidev_compat_ioc_message(filp, cmd, arg);
        return spidev_ioctl(filp, cmd, (unsigned long)compat_ptr(arg));
 }
 #else
diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c
index 1bf891bd321a..4f361b77c749 100644
--- a/drivers/staging/lustre/lustre/llite/namei.c
+++ b/drivers/staging/lustre/lustre/llite/namei.c
@@ -264,7 +264,7 @@ int ll_md_blocking_ast(struct ldlm_lock *lock, struct ldlm_lock_desc *desc,
                if ((bits & (MDS_INODELOCK_LOOKUP | MDS_INODELOCK_PERM)) &&
                    inode->i_sb->s_root != NULL &&
-                    is_root_inode(inode))
+                    !is_root_inode(inode))
                        ll_invalidate_aliases(inode);
                iput(inode);
diff --git a/drivers/staging/lustre/lustre/llite/vvp_io.c b/drivers/staging/lustre/lustre/llite/vvp_io.c
index 930f6010203e..65d610abe06e 100644
--- a/drivers/staging/lustre/lustre/llite/vvp_io.c
+++ b/drivers/staging/lustre/lustre/llite/vvp_io.c
@@ -632,7 +632,7 @@ static int vvp_io_kernel_fault(struct vvp_fault_io *cfio)
                return 0;
        }
-        if (cfio->fault.ft_flags & VM_FAULT_SIGBUS) {
+        if (cfio->fault.ft_flags & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
                CDEBUG(D_PAGE, "got addr %p - SIGBUS\n", vmf->virtual_address);
                return -EFAULT;
        }
diff --git a/drivers/staging/media/tlg2300/Kconfig b/drivers/staging/media/tlg2300/Kconfig
index 81784c6f7b88..77d8753f6ba4 100644
--- a/drivers/staging/media/tlg2300/Kconfig
+++ b/drivers/staging/media/tlg2300/Kconfig
@@ -1,6 +1,7 @@
 config VIDEO_TLG2300
        tristate "Telegent TLG2300 USB video capture support (Deprecated)"
        depends on VIDEO_DEV && I2C && SND && DVB_CORE
+        depends on MEDIA_USB_SUPPORT
        select VIDEO_TUNER
        select VIDEO_TVEEPROM
        depends on RC_CORE
diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c
index 093535c6217b..120b70d72d79 100644
--- a/drivers/staging/nvec/nvec.c
+++ b/drivers/staging/nvec/nvec.c
@@ -85,23 +85,20 @@ static struct nvec_chip *nvec_power_handle;
 static const struct mfd_cell nvec_devices[] = {
        {
                .name = "nvec-kbd",
-                .id = 1,
        },
        {
                .name = "nvec-mouse",
-                .id = 1,
        },
        {
                .name = "nvec-power",
-                .id = 1,
+                .id = 0,
        },
        {
                .name = "nvec-power",
-                .id = 2,
+                .id = 1,
        },
        {
                .name = "nvec-paz00",
-                .id = 1,
        },
 };
@@ -891,7 +888,7 @@ static int tegra_nvec_probe(struct platform_device *pdev)
                nvec_msg_free(nvec, msg);
        }
-        ret = mfd_add_devices(nvec->dev, -1, nvec_devices,
+        ret = mfd_add_devices(nvec->dev, 0, nvec_devices,
                              ARRAY_SIZE(nvec_devices), NULL, 0, NULL);
        if (ret)
                dev_err(nvec->dev, "error adding subdevices\n");
diff --git a/drivers/staging/vt6655/baseband.c b/drivers/staging/vt6655/baseband.c
index 86c72ba0a0cd..f8c5fc371c4c 100644
--- a/drivers/staging/vt6655/baseband.c
+++ b/drivers/staging/vt6655/baseband.c
@@ -2177,7 +2177,7 @@ bool BBbVT3253Init(struct vnt_private *priv)
                /* Init ANT B select,RX Config CR10 = 0x28->0x2A, 0x2A->0x28(VC1/VC2 define, make the ANT_A, ANT_B inverted) */
                /*bResult &= BBbWriteEmbedded(dwIoBase,0x0a,0x28);*/
                /* Select VC1/VC2, CR215 = 0x02->0x06 */
-                bResult &= BBbWriteEmbedded(dwIoBase, 0xd7, 0x06);
+                bResult &= BBbWriteEmbedded(priv, 0xd7, 0x06);
                /* }} */
                for (ii = 0; ii < CB_VT3253B0_AGC; ii++)
diff --git a/drivers/staging/vt6655/channel.c b/drivers/staging/vt6655/channel.c
index c8f739dd346e..70f870541f92 100644
--- a/drivers/staging/vt6655/channel.c
+++ b/drivers/staging/vt6655/channel.c
@@ -182,6 +182,14 @@ bool set_channel(void *pDeviceHandler, unsigned int uConnectionChannel)
        if (pDevice->byCurrentCh == uConnectionChannel)
                return bResult;
+        /* Set VGA to max sensitivity */
+        if (pDevice->bUpdateBBVGA &&
+            pDevice->byBBVGACurrent != pDevice->abyBBVGA[0]) {
+                pDevice->byBBVGACurrent = pDevice->abyBBVGA[0];
+                BBvSetVGAGainOffset(pDevice, pDevice->byBBVGACurrent);
+        }
        /* clear NAV */
        MACvRegBitsOn(pDevice->PortOffset, MAC_REG_MACCR, MACCR_CLRNAV);
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index 83e4162c0094..cd1a277d853b 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -1232,7 +1232,7 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
        head_td = priv->apCurrTD[dma_idx];
-        head_td->m_td1TD1.byTCR = (TCR_EDP|TCR_STP);
+        head_td->m_td1TD1.byTCR = 0;
        head_td->pTDInfo->skb = skb;
@@ -1257,6 +1257,11 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
        priv->bPWBitOn = false;
+        /* Set TSR1 & ReqCount in TxDescHead */
+        head_td->m_td1TD1.byTCR |= (TCR_STP | TCR_EDP | EDMSDU);
+        head_td->m_td1TD1.wReqCount =
+                        cpu_to_le16((u16)head_td->pTDInfo->dwReqCount);
        head_td->pTDInfo->byFlags = TD_FLAGS_NETIF_SKB;
        if (dma_idx == TYPE_AC0DMA)
@@ -1500,9 +1505,11 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
                if (conf->enable_beacon) {
                        vnt_beacon_enable(priv, vif, conf);
-                        MACvRegBitsOn(priv, MAC_REG_TCR, TCR_AUTOBCNTX);
+                        MACvRegBitsOn(priv->PortOffset, MAC_REG_TCR,
+                                      TCR_AUTOBCNTX);
                } else {
-                        MACvRegBitsOff(priv, MAC_REG_TCR, TCR_AUTOBCNTX);
+                        MACvRegBitsOff(priv->PortOffset, MAC_REG_TCR,
+                                       TCR_AUTOBCNTX);
                }
        }
diff --git a/drivers/staging/vt6655/rxtx.c b/drivers/staging/vt6655/rxtx.c
index 61c39dd7ad01..b5b0155961f2 100644
--- a/drivers/staging/vt6655/rxtx.c
+++ b/drivers/staging/vt6655/rxtx.c
@@ -1204,13 +1204,10 @@ s_cbFillTxBufHead(struct vnt_private *pDevice, unsigned char byPktType,
        ptdCurr = (PSTxDesc)pHeadTD;
-        ptdCurr->pTDInfo->dwReqCount = cbReqCount - uPadding;
+        ptdCurr->pTDInfo->dwReqCount = cbReqCount;
        ptdCurr->pTDInfo->dwHeaderLength = cbHeaderLength;
        ptdCurr->pTDInfo->skb_dma = ptdCurr->pTDInfo->buf_dma;
        ptdCurr->buff_addr = cpu_to_le32(ptdCurr->pTDInfo->skb_dma);
-        /* Set TSR1 & ReqCount in TxDescHead */
-        ptdCurr->m_td1TD1.byTCR |= (TCR_STP | TCR_EDP | EDMSDU);
-        ptdCurr->m_td1TD1.wReqCount = cpu_to_le16((unsigned short)(cbReqCount));
        return cbHeaderLength;
 }
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 55f6774f706f..aebde3289c50 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -2027,10 +2027,10 @@ iscsit_process_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
                goto reject;
        }
        if (!strncmp("=All", text_ptr, 4)) {
-                cmd->cmd_flags |= IFC_SENDTARGETS_ALL;
+                cmd->cmd_flags |= ICF_SENDTARGETS_ALL;
        } else if (!strncmp("=iqn.", text_ptr, 5) ||
                   !strncmp("=eui.", text_ptr, 5)) {
-                cmd->cmd_flags |= IFC_SENDTARGETS_SINGLE;
+                cmd->cmd_flags |= ICF_SENDTARGETS_SINGLE;
        } else {
                pr_err("Unable to locate valid SendTargets=%s value\n", text_ptr);
                goto reject;
@@ -3415,10 +3415,10 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
                return -ENOMEM;
        }
        /*
-         * Locate pointer to iqn./eui. string for IFC_SENDTARGETS_SINGLE
+         * Locate pointer to iqn./eui. string for ICF_SENDTARGETS_SINGLE
         * explicit case..
         */
-        if (cmd->cmd_flags & IFC_SENDTARGETS_SINGLE) {
+        if (cmd->cmd_flags & ICF_SENDTARGETS_SINGLE) {
                text_ptr = strchr(text_in, '=');
                if (!text_ptr) {
                        pr_err("Unable to locate '=' string in text_in:"
@@ -3434,7 +3434,7 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
        spin_lock(&tiqn_lock);
        list_for_each_entry(tiqn, &g_tiqn_list, tiqn_list) {
-                if ((cmd->cmd_flags & IFC_SENDTARGETS_SINGLE) &&
+                if ((cmd->cmd_flags & ICF_SENDTARGETS_SINGLE) &&
                     strcmp(tiqn->tiqn, text_ptr)) {
                        continue;
                }
@@ -3512,7 +3512,7 @@ eob:
                if (end_of_buf)
                        break;
-                if (cmd->cmd_flags & IFC_SENDTARGETS_SINGLE)
+                if (cmd->cmd_flags & ICF_SENDTARGETS_SINGLE)
                        break;
        }
        spin_unlock(&tiqn_lock);
diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
index 09a522bae222..cbcff38ac9b7 100644
--- a/drivers/target/iscsi/iscsi_target_core.h
+++ b/drivers/target/iscsi/iscsi_target_core.h
@@ -135,8 +135,8 @@ enum cmd_flags_table {
        ICF_CONTIG_MEMORY                       = 0x00000020,
        ICF_ATTACHED_TO_RQUEUE                  = 0x00000040,
        ICF_OOO_CMDSN                           = 0x00000080,
-        IFC_SENDTARGETS_ALL                     = 0x00000100,
+        ICF_SENDTARGETS_ALL                     = 0x00000100,
-        IFC_SENDTARGETS_SINGLE                  = 0x00000200,
+        ICF_SENDTARGETS_SINGLE                  = 0x00000200,
 };
 /* struct iscsi_cmd->i_state */
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 7653cfb027a2..58f49ff69b14 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1103,51 +1103,6 @@ int se_dev_set_queue_depth(struct se_device *dev, u32 queue_depth)
 }
 EXPORT_SYMBOL(se_dev_set_queue_depth);
-int se_dev_set_fabric_max_sectors(struct se_device *dev, u32 fabric_max_sectors)
-{
-        int block_size = dev->dev_attrib.block_size;
-        if (dev->export_count) {
-                pr_err("dev[%p]: Unable to change SE Device"
-                        " fabric_max_sectors while export_count is %d\n",
-                        dev, dev->export_count);
-                return -EINVAL;
-        }
-        if (!fabric_max_sectors) {
-                pr_err("dev[%p]: Illegal ZERO value for"
-                        " fabric_max_sectors\n", dev);
-                return -EINVAL;
-        }
-        if (fabric_max_sectors < DA_STATUS_MAX_SECTORS_MIN) {
-                pr_err("dev[%p]: Passed fabric_max_sectors: %u less than"
-                        " DA_STATUS_MAX_SECTORS_MIN: %u\n", dev, fabric_max_sectors,
-                                DA_STATUS_MAX_SECTORS_MIN);
-                return -EINVAL;
-        }
-        if (fabric_max_sectors > DA_STATUS_MAX_SECTORS_MAX) {
-                pr_err("dev[%p]: Passed fabric_max_sectors: %u"
-                        " greater than DA_STATUS_MAX_SECTORS_MAX:"
-                        " %u\n", dev, fabric_max_sectors,
-                        DA_STATUS_MAX_SECTORS_MAX);
-                return -EINVAL;
-        }
-        /*
-         * Align max_sectors down to PAGE_SIZE to follow transport_allocate_data_tasks()
-         */
-        if (!block_size) {
-                block_size = 512;
-                pr_warn("Defaulting to 512 for zero block_size\n");
-        }
-        fabric_max_sectors = se_dev_align_max_sectors(fabric_max_sectors,
-                                                      block_size);
-        dev->dev_attrib.fabric_max_sectors = fabric_max_sectors;
-        pr_debug("dev[%p]: SE Device max_sectors changed to %u\n",
-                        dev, fabric_max_sectors);
-        return 0;
-}
-EXPORT_SYMBOL(se_dev_set_fabric_max_sectors);
 int se_dev_set_optimal_sectors(struct se_device *dev, u32 optimal_sectors)
 {
        if (dev->export_count) {
@@ -1156,10 +1111,10 @@ int se_dev_set_optimal_sectors(struct se_device *dev, u32 optimal_sectors)
                        dev, dev->export_count);
                return -EINVAL;
        }
-        if (optimal_sectors > dev->dev_attrib.fabric_max_sectors) {
+        if (optimal_sectors > dev->dev_attrib.hw_max_sectors) {
                pr_err("dev[%p]: Passed optimal_sectors %u cannot be"
-                        " greater than fabric_max_sectors: %u\n", dev,
+                        " greater than hw_max_sectors: %u\n", dev,
-                        optimal_sectors, dev->dev_attrib.fabric_max_sectors);
+                        optimal_sectors, dev->dev_attrib.hw_max_sectors);
                return -EINVAL;
        }
@@ -1553,8 +1508,6 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
        dev->dev_attrib.unmap_granularity_alignment =
                                DA_UNMAP_GRANULARITY_ALIGNMENT_DEFAULT;
        dev->dev_attrib.max_write_same_len = DA_MAX_WRITE_SAME_LEN;
-        dev->dev_attrib.fabric_max_sectors = DA_FABRIC_MAX_SECTORS;
-        dev->dev_attrib.optimal_sectors = DA_FABRIC_MAX_SECTORS;
        xcopy_lun = &dev->xcopy_lun;
        xcopy_lun->lun_se_dev = dev;
@@ -1595,6 +1548,7 @@ int target_configure_device(struct se_device *dev)
        dev->dev_attrib.hw_max_sectors =
                se_dev_align_max_sectors(dev->dev_attrib.hw_max_sectors,
                                         dev->dev_attrib.hw_block_size);
+        dev->dev_attrib.optimal_sectors = dev->dev_attrib.hw_max_sectors;
        dev->dev_index = scsi_get_new_index(SCSI_DEVICE_INDEX);
        dev->creation_time = get_jiffies_64();
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index c2aea099ea4a..d836de200a03 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -621,7 +621,16 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
        struct fd_prot fd_prot;
        sense_reason_t rc;
        int ret = 0;
+        /*
+         * We are currently limited by the number of iovecs (2048) per
+         * single vfs_[writev,readv] call.
+         */
+        if (cmd->data_length > FD_MAX_BYTES) {
+                pr_err("FILEIO: Not able to process I/O of %u bytes due to"
+                       "FD_MAX_BYTES: %u iovec count limitiation\n",
+                        cmd->data_length, FD_MAX_BYTES);
+                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+        }
        /*
         * Call vectorized fileio functions to map struct scatterlist
         * physical memory addresses to struct iovec virtual memory.
@@ -959,7 +968,6 @@ static struct configfs_attribute *fileio_backend_dev_attrs[] = {
        &fileio_dev_attrib_hw_block_size.attr,
        &fileio_dev_attrib_block_size.attr,
        &fileio_dev_attrib_hw_max_sectors.attr,
-        &fileio_dev_attrib_fabric_max_sectors.attr,
        &fileio_dev_attrib_optimal_sectors.attr,
        &fileio_dev_attrib_hw_queue_depth.attr,
        &fileio_dev_attrib_queue_depth.attr,
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 3efff94fbd97..78346b850968 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -124,7 +124,7 @@ static int iblock_configure_device(struct se_device *dev)
        q = bdev_get_queue(bd);
        dev->dev_attrib.hw_block_size = bdev_logical_block_size(bd);
-        dev->dev_attrib.hw_max_sectors = UINT_MAX;
+        dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
        dev->dev_attrib.hw_queue_depth = q->nr_requests;
        /*
@@ -883,7 +883,6 @@ static struct configfs_attribute *iblock_backend_dev_attrs[] = {
        &iblock_dev_attrib_hw_block_size.attr,
        &iblock_dev_attrib_block_size.attr,
        &iblock_dev_attrib_hw_max_sectors.attr,
-        &iblock_dev_attrib_fabric_max_sectors.attr,
        &iblock_dev_attrib_optimal_sectors.attr,
        &iblock_dev_attrib_hw_queue_depth.attr,
        &iblock_dev_attrib_queue_depth.attr,
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index d56f2aaba9af..283cf786ef98 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -528,6 +528,18 @@ static int core_scsi3_pr_seq_non_holder(
                        return 0;
                }
+       } else if (we && registered_nexus) {
+               /*
+                * Reads are allowed for Write Exclusive locks
+                * from all registrants.
+                */
+               if (cmd->data_direction == DMA_FROM_DEVICE) {
+                       pr_debug("Allowing READ CDB: 0x%02x for %s"
+                               " reservation\n", cdb[0],
+                               core_scsi3_pr_dump_type(pr_reg_type));
+                       return 0;
+               }
        }
        pr_debug("%s Conflict for %sregistered nexus %s CDB: 0x%2x"
                " for %s reservation\n", transport_dump_cmd_direction(cmd),
diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c
index 60ebd170a561..98e83ac5661b 100644
--- a/drivers/target/target_core_rd.c
+++ b/drivers/target/target_core_rd.c
@@ -657,7 +657,6 @@ static struct configfs_attribute *rd_mcp_backend_dev_attrs[] = {
        &rd_mcp_dev_attrib_hw_block_size.attr,
        &rd_mcp_dev_attrib_block_size.attr,
        &rd_mcp_dev_attrib_hw_max_sectors.attr,
-        &rd_mcp_dev_attrib_fabric_max_sectors.attr,
        &rd_mcp_dev_attrib_optimal_sectors.attr,
        &rd_mcp_dev_attrib_hw_queue_depth.attr,
        &rd_mcp_dev_attrib_queue_depth.attr,
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 11bea1952435..cd4bed7b2757 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -953,21 +953,6 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
        if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
                unsigned long long end_lba;
-                if (sectors > dev->dev_attrib.fabric_max_sectors) {
-                        printk_ratelimited(KERN_ERR "SCSI OP %02xh with too"
-                                " big sectors %u exceeds fabric_max_sectors:"
-                                " %u\n", cdb[0], sectors,
-                                dev->dev_attrib.fabric_max_sectors);
-                        return TCM_INVALID_CDB_FIELD;
-                }
-                if (sectors > dev->dev_attrib.hw_max_sectors) {
-                        printk_ratelimited(KERN_ERR "SCSI OP %02xh with too"
-                                " big sectors %u exceeds backend hw_max_sectors:"
-                                " %u\n", cdb[0], sectors,
-                                dev->dev_attrib.hw_max_sectors);
-                        return TCM_INVALID_CDB_FIELD;
-                }
 check_lba:
                end_lba = dev->transport->get_blocks(dev) + 1;
                if (cmd->t_task_lba + sectors > end_lba) {
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 1307600fe726..4c71657da56a 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -505,7 +505,6 @@ static sense_reason_t
 spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
 {
        struct se_device *dev = cmd->se_dev;
-        u32 max_sectors;
        int have_tp = 0;
        int opt, min;
@@ -539,9 +538,7 @@ spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
        /*
         * Set MAXIMUM TRANSFER LENGTH
         */
-        max_sectors = min(dev->dev_attrib.fabric_max_sectors,
+        put_unaligned_be32(dev->dev_attrib.hw_max_sectors, &buf[8]);
-                          dev->dev_attrib.hw_max_sectors);
-        put_unaligned_be32(max_sectors, &buf[8]);
        /*
         * Set OPTIMAL TRANSFER LENGTH
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 8bfa61c9693d..1157b559683b 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1118,7 +1118,6 @@ static struct configfs_attribute *tcmu_backend_dev_attrs[] = {
        &tcmu_dev_attrib_hw_block_size.attr,
        &tcmu_dev_attrib_block_size.attr,
        &tcmu_dev_attrib_hw_max_sectors.attr,
-        &tcmu_dev_attrib_fabric_max_sectors.attr,
        &tcmu_dev_attrib_optimal_sectors.attr,
        &tcmu_dev_attrib_hw_queue_depth.attr,
        &tcmu_dev_attrib_queue_depth.attr,
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index ad09e51ffae4..f65f0d109fc8 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -4,6 +4,8 @@
 *  Copyright (C) 2012  Samsung Electronics Co., Ltd(http://www.samsung.com)
 *  Copyright (C) 2012  Amit Daniel <amit.kachhap@linaro.org>
 *
+ *  Copyright (C) 2014  Viresh Kumar <viresh.kumar@linaro.org>
+ *
 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
@@ -28,6 +30,20 @@
 #include <linux/cpu.h>
 #include <linux/cpu_cooling.h>
+/*
+ * Cooling state <-> CPUFreq frequency
+ *
+ * Cooling states are translated to frequencies throughout this driver and this
+ * is the relation between them.
+ *
+ * Highest cooling state corresponds to lowest possible frequency.
+ *
+ * i.e.
+ *      level 0 --> 1st Max Freq
+ *      level 1 --> 2nd Max Freq
+ *      ...
+ */
 /**
 * struct cpufreq_cooling_device - data for cooling device with cpufreq
 * @id: unique integer value corresponding to each cpufreq_cooling_device
@@ -38,25 +54,27 @@
 *      cooling devices.
 * @cpufreq_val: integer value representing the absolute value of the clipped
 *      frequency.
+ * @max_level: maximum cooling level. One less than total number of valid
+ *      cpufreq frequencies.
 * @allowed_cpus: all the cpus involved for this cpufreq_cooling_device.
+ * @node: list_head to link all cpufreq_cooling_device together.
 *
- * This structure is required for keeping information of each
+ * This structure is required for keeping information of each registered
- * cpufreq_cooling_device registered. In order to prevent corruption of this a
+ * cpufreq_cooling_device.
- * mutex lock cooling_cpufreq_lock is used.
 */
 struct cpufreq_cooling_device {
        int id;
        struct thermal_cooling_device *cool_dev;
        unsigned int cpufreq_state;
        unsigned int cpufreq_val;
+        unsigned int max_level;
+        unsigned int *freq_table;       /* In descending order */
        struct cpumask allowed_cpus;
        struct list_head node;
 };
 static DEFINE_IDR(cpufreq_idr);
 static DEFINE_MUTEX(cooling_cpufreq_lock);
-static unsigned int cpufreq_dev_count;
 static LIST_HEAD(cpufreq_dev_list);
 /**
@@ -98,120 +116,30 @@ static void release_idr(struct idr *idr, int id)
 /* Below code defines functions to be used for cpufreq as cooling device */
 /**
- * is_cpufreq_valid - function to check frequency transitioning capability.
+ * get_level: Find the level for a particular frequency
- * @cpu: cpu for which check is needed.
+ * @cpufreq_dev: cpufreq_dev for which the property is required
+ * @freq: Frequency
 *
- * This function will check the current state of the system if
+ * Return: level on success, THERMAL_CSTATE_INVALID on error.
- * it is capable of changing the frequency for a given @cpu.
- *
- * Return: 0 if the system is not currently capable of changing
- * the frequency of given cpu. !0 in case the frequency is changeable.
 */
-static int is_cpufreq_valid(int cpu)
+static unsigned long get_level(struct cpufreq_cooling_device *cpufreq_dev,
+                               unsigned int freq)
 {
-        struct cpufreq_policy policy;
+        unsigned long level;
-        return !cpufreq_get_policy(&policy, cpu);
-}
-enum cpufreq_cooling_property {
-        GET_LEVEL,
-        GET_FREQ,
-        GET_MAXL,
-};
-/**
- * get_property - fetch a property of interest for a give cpu.
- * @cpu: cpu for which the property is required
- * @input: query parameter
- * @output: query return
- * @property: type of query (frequency, level, max level)
- *
- * This is the common function to
- * 1. get maximum cpu cooling states
- * 2. translate frequency to cooling state
- * 3. translate cooling state to frequency
- * Note that the code may be not in good shape
- * but it is written in this way in order to:
- * a) reduce duplicate code as most of the code can be shared.
- * b) make sure the logic is consistent when translating between
- *    cooling states and frequencies.
- *
- * Return: 0 on success, -EINVAL when invalid parameters are passed.
- */
-static int get_property(unsigned int cpu, unsigned long input,
-                        unsigned int *output,
-                        enum cpufreq_cooling_property property)
-{
-        int i;
-        unsigned long max_level = 0, level = 0;
-        unsigned int freq = CPUFREQ_ENTRY_INVALID;
-        int descend = -1;
-        struct cpufreq_frequency_table *pos, *table =
-                                        cpufreq_frequency_get_table(cpu);
-        if (!output)
-                return -EINVAL;
-        if (!table)
-                return -EINVAL;
-        cpufreq_for_each_valid_entry(pos, table) {
-                /* ignore duplicate entry */
-                if (freq == pos->frequency)
-                        continue;
-                /* get the frequency order */
-                if (freq != CPUFREQ_ENTRY_INVALID && descend == -1)
-                        descend = freq > pos->frequency;
-                freq = pos->frequency;
-                max_level++;
-        }
-        /* No valid cpu frequency entry */
-        if (max_level == 0)
-                return -EINVAL;
-        /* max_level is an index, not a counter */
+        for (level = 0; level <= cpufreq_dev->max_level; level++) {
-        max_level--;
+                if (freq == cpufreq_dev->freq_table[level])
+                        return level;
-        /* get max level */
+                if (freq > cpufreq_dev->freq_table[level])
-        if (property == GET_MAXL) {
+                        break;
-                *output = (unsigned int)max_level;
-                return 0;
        }
-        if (property == GET_FREQ)
+        return THERMAL_CSTATE_INVALID;
-                level = descend ? input : (max_level - input);
-        i = 0;
-        cpufreq_for_each_valid_entry(pos, table) {
-                /* ignore duplicate entry */
-                if (freq == pos->frequency)
-                        continue;
-                /* now we have a valid frequency entry */
-                freq = pos->frequency;
-                if (property == GET_LEVEL && (unsigned int)input == freq) {
-                        /* get level by frequency */
-                        *output = descend ? i : (max_level - i);
-                        return 0;
-                }
-                if (property == GET_FREQ && level == i) {
-                        /* get frequency by level */
-                        *output = freq;
-                        return 0;
-                }
-                i++;
-        }
-        return -EINVAL;
 }
 /**
- * cpufreq_cooling_get_level - for a give cpu, return the cooling level.
+ * cpufreq_cooling_get_level - for a given cpu, return the cooling level.
 * @cpu: cpu for which the level is required
 * @freq: the frequency of interest
 *
@@ -223,77 +151,21 @@ static int get_property(unsigned int cpu, unsigned long input,
 */
 unsigned long cpufreq_cooling_get_level(unsigned int cpu, unsigned int freq)
 {
-        unsigned int val;
+        struct cpufreq_cooling_device *cpufreq_dev;
-        if (get_property(cpu, (unsigned long)freq, &val, GET_LEVEL))
-                return THERMAL_CSTATE_INVALID;
-        return (unsigned long)val;
-}
-EXPORT_SYMBOL_GPL(cpufreq_cooling_get_level);
-/**
- * get_cpu_frequency - get the absolute value of frequency from level.
- * @cpu: cpu for which frequency is fetched.
- * @level: cooling level
- *
- * This function matches cooling level with frequency. Based on a cooling level
- * of frequency, equals cooling state of cpu cooling device, it will return
- * the corresponding frequency.
- *      e.g level=0 --> 1st MAX FREQ, level=1 ---> 2nd MAX FREQ, .... etc
- *
- * Return: 0 on error, the corresponding frequency otherwise.
- */
-static unsigned int get_cpu_frequency(unsigned int cpu, unsigned long level)
-{
-        int ret = 0;
-        unsigned int freq;
-        ret = get_property(cpu, level, &freq, GET_FREQ);
-        if (ret)
-                return 0;
-        return freq;
-}
-/**
- * cpufreq_apply_cooling - function to apply frequency clipping.
- * @cpufreq_device: cpufreq_cooling_device pointer containing frequency
- *      clipping data.
- * @cooling_state: value of the cooling state.
- *
- * Function used to make sure the cpufreq layer is aware of current thermal
- * limits. The limits are applied by updating the cpufreq policy.
- *
- * Return: 0 on success, an error code otherwise (-EINVAL in case wrong
- * cooling state).
- */
-static int cpufreq_apply_cooling(struct cpufreq_cooling_device *cpufreq_device,
-                                 unsigned long cooling_state)
-{
-        unsigned int cpuid, clip_freq;
-        struct cpumask *mask = &cpufreq_device->allowed_cpus;
-        unsigned int cpu = cpumask_any(mask);
-        /* Check if the old cooling action is same as new cooling action */
-        if (cpufreq_device->cpufreq_state == cooling_state)
-                return 0;
-        clip_freq = get_cpu_frequency(cpu, cooling_state);
-        if (!clip_freq)
-                return -EINVAL;
-        cpufreq_device->cpufreq_state = cooling_state;
-        cpufreq_device->cpufreq_val = clip_freq;
-        for_each_cpu(cpuid, mask) {
+        mutex_lock(&cooling_cpufreq_lock);
-                if (is_cpufreq_valid(cpuid))
+        list_for_each_entry(cpufreq_dev, &cpufreq_dev_list, node) {
-                        cpufreq_update_policy(cpuid);
+                if (cpumask_test_cpu(cpu, &cpufreq_dev->allowed_cpus)) {
+                        mutex_unlock(&cooling_cpufreq_lock);
+                        return get_level(cpufreq_dev, freq);
+                }
        }
+        mutex_unlock(&cooling_cpufreq_lock);
-        return 0;
+        pr_err("%s: cpu:%d not part of any cooling device\n", __func__, cpu);
+        return THERMAL_CSTATE_INVALID;
 }
+EXPORT_SYMBOL_GPL(cpufreq_cooling_get_level);
 /**
 * cpufreq_thermal_notifier - notifier callback for cpufreq policy change.
@@ -323,11 +195,6 @@ static int cpufreq_thermal_notifier(struct notifier_block *nb,
                                        &cpufreq_dev->allowed_cpus))
                        continue;
-                if (!cpufreq_dev->cpufreq_val)
-                        cpufreq_dev->cpufreq_val = get_cpu_frequency(
-                                        cpumask_any(&cpufreq_dev->allowed_cpus),
-                                        cpufreq_dev->cpufreq_state);
                max_freq = cpufreq_dev->cpufreq_val;
                if (policy->max != max_freq)
@@ -354,19 +221,9 @@ static int cpufreq_get_max_state(struct thermal_cooling_device *cdev,
                                 unsigned long *state)
 {
        struct cpufreq_cooling_device *cpufreq_device = cdev->devdata;
-        struct cpumask *mask = &cpufreq_device->allowed_cpus;
-        unsigned int cpu;
-        unsigned int count = 0;
-        int ret;
-        cpu = cpumask_any(mask);
-        ret = get_property(cpu, 0, &count, GET_MAXL);
-        if (count > 0)
+        *state = cpufreq_device->max_level;
-                *state = count;
+        return 0;
-        return ret;
 }
 /**
@@ -403,8 +260,24 @@ static int cpufreq_set_cur_state(struct thermal_cooling_device *cdev,
                                 unsigned long state)
 {
        struct cpufreq_cooling_device *cpufreq_device = cdev->devdata;
+        unsigned int cpu = cpumask_any(&cpufreq_device->allowed_cpus);
+        unsigned int clip_freq;
+        /* Request state should be less than max_level */
+        if (WARN_ON(state > cpufreq_device->max_level))
+                return -EINVAL;
+        /* Check if the old cooling action is same as new cooling action */
+        if (cpufreq_device->cpufreq_state == state)
+                return 0;
-        return cpufreq_apply_cooling(cpufreq_device, state);
+        clip_freq = cpufreq_device->freq_table[state];
+        cpufreq_device->cpufreq_state = state;
+        cpufreq_device->cpufreq_val = clip_freq;
+        cpufreq_update_policy(cpu);
+        return 0;
 }
 /* Bind cpufreq callbacks to thermal cooling device ops */
@@ -419,10 +292,25 @@ static struct notifier_block thermal_cpufreq_notifier_block = {
        .notifier_call = cpufreq_thermal_notifier,
 };
+static unsigned int find_next_max(struct cpufreq_frequency_table *table,
+                                  unsigned int prev_max)
+{
+        struct cpufreq_frequency_table *pos;
+        unsigned int max = 0;
+        cpufreq_for_each_valid_entry(pos, table) {
+                if (pos->frequency > max && pos->frequency < prev_max)
+                        max = pos->frequency;
+        }
+        return max;
+}
 /**
 * __cpufreq_cooling_register - helper function to create cpufreq cooling device
 * @np: a valid struct device_node to the cooling device device tree node
 * @clip_cpus: cpumask of cpus where the frequency constraints will happen.
+ * Normally this should be same as cpufreq policy->related_cpus.
 *
 * This interface function registers the cpufreq cooling device with the name
 * "thermal-cpufreq-%x". This api can support multiple instances of cpufreq
@@ -437,37 +325,42 @@ __cpufreq_cooling_register(struct device_node *np,
                           const struct cpumask *clip_cpus)
 {
        struct thermal_cooling_device *cool_dev;
-        struct cpufreq_cooling_device *cpufreq_dev = NULL;
+        struct cpufreq_cooling_device *cpufreq_dev;
-        unsigned int min = 0, max = 0;
        char dev_name[THERMAL_NAME_LENGTH];
-        int ret = 0, i;
+        struct cpufreq_frequency_table *pos, *table;
-        struct cpufreq_policy policy;
+        unsigned int freq, i;
+        int ret;
-        /* Verify that all the clip cpus have same freq_min, freq_max limit */
+        table = cpufreq_frequency_get_table(cpumask_first(clip_cpus));
-        for_each_cpu(i, clip_cpus) {
+        if (!table) {
-                /* continue if cpufreq policy not found and not return error */
+                pr_debug("%s: CPUFreq table not found\n", __func__);
-                if (!cpufreq_get_policy(&policy, i))
+                return ERR_PTR(-EPROBE_DEFER);
-                        continue;
-                if (min == 0 && max == 0) {
-                        min = policy.cpuinfo.min_freq;
-                        max = policy.cpuinfo.max_freq;
-                } else {
-                        if (min != policy.cpuinfo.min_freq ||
-                            max != policy.cpuinfo.max_freq)
-                                return ERR_PTR(-EINVAL);
-                }
        }
-        cpufreq_dev = kzalloc(sizeof(struct cpufreq_cooling_device),
-                              GFP_KERNEL);
+        cpufreq_dev = kzalloc(sizeof(*cpufreq_dev), GFP_KERNEL);
        if (!cpufreq_dev)
                return ERR_PTR(-ENOMEM);
+        /* Find max levels */
+        cpufreq_for_each_valid_entry(pos, table)
+                cpufreq_dev->max_level++;
+        cpufreq_dev->freq_table = kmalloc(sizeof(*cpufreq_dev->freq_table) *
+                                          cpufreq_dev->max_level, GFP_KERNEL);
+        if (!cpufreq_dev->freq_table) {
+                cool_dev = ERR_PTR(-ENOMEM);
+                goto free_cdev;
+        }
+        /* max_level is an index, not a counter */
+        cpufreq_dev->max_level--;
        cpumask_copy(&cpufreq_dev->allowed_cpus, clip_cpus);
        ret = get_idr(&cpufreq_idr, &cpufreq_dev->id);
        if (ret) {
-                kfree(cpufreq_dev);
+                cool_dev = ERR_PTR(ret);
-                return ERR_PTR(-EINVAL);
+                goto free_table;
        }
        snprintf(dev_name, sizeof(dev_name), "thermal-cpufreq-%d",
@@ -475,25 +368,44 @@ __cpufreq_cooling_register(struct device_node *np,
        cool_dev = thermal_of_cooling_device_register(np, dev_name, cpufreq_dev,
                                                      &cpufreq_cooling_ops);
-        if (IS_ERR(cool_dev)) {
+        if (IS_ERR(cool_dev))
-                release_idr(&cpufreq_idr, cpufreq_dev->id);
+                goto remove_idr;
-                kfree(cpufreq_dev);
-                return cool_dev;
+        /* Fill freq-table in descending order of frequencies */
+        for (i = 0, freq = -1; i <= cpufreq_dev->max_level; i++) {
+                freq = find_next_max(table, freq);
+                cpufreq_dev->freq_table[i] = freq;
+                /* Warn for duplicate entries */
+                if (!freq)
+                        pr_warn("%s: table has duplicate entries\n", __func__);
+                else
+                        pr_debug("%s: freq:%u KHz\n", __func__, freq);
        }
+        cpufreq_dev->cpufreq_val = cpufreq_dev->freq_table[0];
        cpufreq_dev->cool_dev = cool_dev;
-        cpufreq_dev->cpufreq_state = 0;
        mutex_lock(&cooling_cpufreq_lock);
        /* Register the notifier for first cpufreq cooling device */
-        if (cpufreq_dev_count == 0)
+        if (list_empty(&cpufreq_dev_list))
                cpufreq_register_notifier(&thermal_cpufreq_notifier_block,
                                          CPUFREQ_POLICY_NOTIFIER);
-        cpufreq_dev_count++;
        list_add(&cpufreq_dev->node, &cpufreq_dev_list);
        mutex_unlock(&cooling_cpufreq_lock);
        return cool_dev;
+remove_idr:
+        release_idr(&cpufreq_idr, cpufreq_dev->id);
+free_table:
+        kfree(cpufreq_dev->freq_table);
+free_cdev:
+        kfree(cpufreq_dev);
+        return cool_dev;
 }
 /**
@@ -554,16 +466,16 @@ void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
        cpufreq_dev = cdev->devdata;
        mutex_lock(&cooling_cpufreq_lock);
        list_del(&cpufreq_dev->node);
-        cpufreq_dev_count--;
        /* Unregister the notifier for the last cpufreq cooling device */
-        if (cpufreq_dev_count == 0)
+        if (list_empty(&cpufreq_dev_list))
                cpufreq_unregister_notifier(&thermal_cpufreq_notifier_block,
                                            CPUFREQ_POLICY_NOTIFIER);
        mutex_unlock(&cooling_cpufreq_lock);
        thermal_cooling_device_unregister(cpufreq_dev->cool_dev);
        release_idr(&cpufreq_idr, cpufreq_dev->id);
+        kfree(cpufreq_dev->freq_table);
        kfree(cpufreq_dev);
 }
 EXPORT_SYMBOL_GPL(cpufreq_cooling_unregister);
diff --git a/drivers/thermal/db8500_cpufreq_cooling.c b/drivers/thermal/db8500_cpufreq_cooling.c
index 000d53e934a0..607b62c7e611 100644
--- a/drivers/thermal/db8500_cpufreq_cooling.c
+++ b/drivers/thermal/db8500_cpufreq_cooling.c
@@ -18,7 +18,6 @@
 */
 #include <linux/cpu_cooling.h>
-#include <linux/cpufreq.h>
 #include <linux/err.h>
 #include <linux/module.h>
 #include <linux/of.h>
@@ -28,18 +27,17 @@
 static int db8500_cpufreq_cooling_probe(struct platform_device *pdev)
 {
        struct thermal_cooling_device *cdev;
-        struct cpumask mask_val;
-        /* make sure cpufreq driver has been initialized */
-        if (!cpufreq_frequency_get_table(0))
-                return -EPROBE_DEFER;
-        cpumask_set_cpu(0, &mask_val);
-        cdev = cpufreq_cooling_register(&mask_val);
+        cdev = cpufreq_cooling_register(cpu_present_mask);
        if (IS_ERR(cdev)) {
-                dev_err(&pdev->dev, "Failed to register cooling device\n");
+                int ret = PTR_ERR(cdev);
-                return PTR_ERR(cdev);
+                if (ret != -EPROBE_DEFER)
+                        dev_err(&pdev->dev,
+                                "Failed to register cooling device %d\n",
+                                ret);
+                                
+                return ret;
        }
        platform_set_drvdata(pdev, cdev);
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index 88b32f942dcf..2ccbc0788353 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -9,7 +9,6 @@
 #include <linux/clk.h>
 #include <linux/cpu_cooling.h>
-#include <linux/cpufreq.h>
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/init.h>
@@ -454,15 +453,10 @@ static int imx_thermal_probe(struct platform_device *pdev)
        const struct of_device_id *of_id =
                of_match_device(of_imx_thermal_match, &pdev->dev);
        struct imx_thermal_data *data;
-        struct cpumask clip_cpus;
        struct regmap *map;
        int measure_freq;
        int ret;
-        if (!cpufreq_get_current_driver()) {
-                dev_dbg(&pdev->dev, "no cpufreq driver!");
-                return -EPROBE_DEFER;
-        }
        data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
        if (!data)
                return -ENOMEM;
@@ -516,12 +510,13 @@ static int imx_thermal_probe(struct platform_device *pdev)
        regmap_write(map, MISC0 + REG_SET, MISC0_REFTOP_SELBIASOFF);
        regmap_write(map, TEMPSENSE0 + REG_SET, TEMPSENSE0_POWER_DOWN);
-        cpumask_set_cpu(0, &clip_cpus);
+        data->cdev = cpufreq_cooling_register(cpu_present_mask);
-        data->cdev = cpufreq_cooling_register(&clip_cpus);
        if (IS_ERR(data->cdev)) {
                ret = PTR_ERR(data->cdev);
-                dev_err(&pdev->dev,
+                if (ret != -EPROBE_DEFER)
-                        "failed to register cpufreq cooling device: %d\n", ret);
+                        dev_err(&pdev->dev,
+                                "failed to register cpufreq cooling device: %d\n",
+                                ret);
                return ret;
        }
@@ -613,6 +608,7 @@ static int imx_thermal_suspend(struct device *dev)
        regmap_write(map, TEMPSENSE0 + REG_CLR, TEMPSENSE0_MEASURE_TEMP);
        regmap_write(map, TEMPSENSE0 + REG_SET, TEMPSENSE0_POWER_DOWN);
        data->mode = THERMAL_DEVICE_DISABLED;
+        clk_disable_unprepare(data->thermal_clk);
        return 0;
 }
@@ -622,6 +618,7 @@ static int imx_thermal_resume(struct device *dev)
        struct imx_thermal_data *data = dev_get_drvdata(dev);
        struct regmap *map = data->tempmon;
+        clk_prepare_enable(data->thermal_clk);
        /* Enabled thermal sensor after resume */
        regmap_write(map, TEMPSENSE0 + REG_CLR, TEMPSENSE0_POWER_DOWN);
        regmap_write(map, TEMPSENSE0 + REG_SET, TEMPSENSE0_MEASURE_TEMP);
diff --git a/drivers/thermal/int340x_thermal/Makefile b/drivers/thermal/int340x_thermal/Makefile
index ffe40bffaf1a..d4413698a85f 100644
--- a/drivers/thermal/int340x_thermal/Makefile
+++ b/drivers/thermal/int340x_thermal/Makefile
@@ -1,4 +1,5 @@
 obj-$(CONFIG_INT340X_THERMAL)   += int3400_thermal.o
 obj-$(CONFIG_INT340X_THERMAL)   += int3402_thermal.o
 obj-$(CONFIG_INT340X_THERMAL)   += int3403_thermal.o
+obj-$(CONFIG_INT340X_THERMAL)   += processor_thermal_device.o
 obj-$(CONFIG_ACPI_THERMAL_REL)  += acpi_thermal_rel.o
diff --git a/drivers/thermal/int340x_thermal/acpi_thermal_rel.c b/drivers/thermal/int340x_thermal/acpi_thermal_rel.c
index e4e61b3fb11e..2c2ec7666eb1 100644
--- a/drivers/thermal/int340x_thermal/acpi_thermal_rel.c
+++ b/drivers/thermal/int340x_thermal/acpi_thermal_rel.c
@@ -82,7 +82,7 @@ int acpi_parse_trt(acpi_handle handle, int *trt_count, struct trt **trtp,
        struct acpi_buffer trt_format = { sizeof("RRNNNNNN"), "RRNNNNNN" };
        if (!acpi_has_method(handle, "_TRT"))
-                return 0;
+                return -ENODEV;
        status = acpi_evaluate_object(handle, "_TRT", NULL, &buffer);
        if (ACPI_FAILURE(status))
@@ -119,15 +119,11 @@ int acpi_parse_trt(acpi_handle handle, int *trt_count, struct trt **trtp,
                        continue;
                result = acpi_bus_get_device(trt->source, &adev);
-                if (!result)
+                if (result)
-                        acpi_create_platform_device(adev);
-                else
                        pr_warn("Failed to get source ACPI device\n");
                result = acpi_bus_get_device(trt->target, &adev);
-                if (!result)
+                if (result)
-                        acpi_create_platform_device(adev);
-                else
                        pr_warn("Failed to get target ACPI device\n");
        }
@@ -167,7 +163,7 @@ int acpi_parse_art(acpi_handle handle, int *art_count, struct art **artp,
                sizeof("RRNNNNNNNNNNN"), "RRNNNNNNNNNNN" };
        if (!acpi_has_method(handle, "_ART"))
-                return 0;
+                return -ENODEV;
        status = acpi_evaluate_object(handle, "_ART", NULL, &buffer);
        if (ACPI_FAILURE(status))
@@ -206,16 +202,12 @@ int acpi_parse_art(acpi_handle handle, int *art_count, struct art **artp,
                if (art->source) {
                        result = acpi_bus_get_device(art->source, &adev);
-                        if (!result)
+                        if (result)
-                                acpi_create_platform_device(adev);
-                        else
                                pr_warn("Failed to get source ACPI device\n");
                }
                if (art->target) {
                        result = acpi_bus_get_device(art->target, &adev);
-                        if (!result)
+                        if (result)
-                                acpi_create_platform_device(adev);
-                        else
                                pr_warn("Failed to get source ACPI device\n");
                }
        }
@@ -321,8 +313,8 @@ static long acpi_thermal_rel_ioctl(struct file *f, unsigned int cmd,
        unsigned long length = 0;
        int count = 0;
        char __user *arg = (void __user *)__arg;
-        struct trt *trts;
+        struct trt *trts = NULL;
-        struct art *arts;
+        struct art *arts = NULL;
        switch (cmd) {
        case ACPI_THERMAL_GET_TRT_COUNT:
diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c
index dcb306ea14a4..65a98a97df07 100644
--- a/drivers/thermal/int340x_thermal/int3400_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3400_thermal.c
@@ -335,7 +335,6 @@ static struct platform_driver int3400_thermal_driver = {
        .remove = int3400_thermal_remove,
        .driver = {
                   .name = "int3400 thermal",
-                   .owner = THIS_MODULE,
                   .acpi_match_table = ACPI_PTR(int3400_thermal_match),
                   },
 };
diff --git a/drivers/thermal/int340x_thermal/int3402_thermal.c b/drivers/thermal/int340x_thermal/int3402_thermal.c
index a5d08c14ba24..c5cbc3af3a05 100644
--- a/drivers/thermal/int340x_thermal/int3402_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3402_thermal.c
@@ -231,7 +231,6 @@ static struct platform_driver int3402_thermal_driver = {
        .remove = int3402_thermal_remove,
        .driver = {
                   .name = "int3402 thermal",
-                   .owner = THIS_MODULE,
                   .acpi_match_table = int3402_thermal_match,
                   },
 };
diff --git a/drivers/thermal/int340x_thermal/int3403_thermal.c b/drivers/thermal/int340x_thermal/int3403_thermal.c
index 1bfa6a69e77a..0faf500d8a77 100644
--- a/drivers/thermal/int340x_thermal/int3403_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3403_thermal.c
@@ -301,6 +301,8 @@ static int int3403_sensor_remove(struct int3403_priv *priv)
 {
        struct int3403_sensor *obj = priv->priv;
+        acpi_remove_notify_handler(priv->adev->handle,
+                                   ACPI_DEVICE_NOTIFY, int3403_notify);
        thermal_zone_device_unregister(obj->tzone);
        return 0;
 }
@@ -369,6 +371,7 @@ static int int3403_cdev_add(struct int3403_priv *priv)
        p = buf.pointer;
        if (!p || (p->type != ACPI_TYPE_PACKAGE)) {
                printk(KERN_WARNING "Invalid PPSS data\n");
+                kfree(buf.pointer);
                return -EFAULT;
        }
@@ -381,6 +384,7 @@ static int int3403_cdev_add(struct int3403_priv *priv)
        priv->priv = obj;
+        kfree(buf.pointer);
        /* TODO: add ACPI notification support */
        return result;
diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c
new file mode 100644
index 000000000000..0fe5dbbea968
--- /dev/null
+++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c
@@ -0,0 +1,311 @@
+/*
+ * processor_thermal_device.c
+ * Copyright (c) 2014, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/platform_device.h>
+#include <linux/acpi.h>
+/* Broadwell-U/HSB thermal reporting device */
+#define PCI_DEVICE_ID_PROC_BDW_THERMAL  0x1603
+#define PCI_DEVICE_ID_PROC_HSB_THERMAL  0x0A03
+/* Braswell thermal reporting device */
+#define PCI_DEVICE_ID_PROC_BSW_THERMAL  0x22DC
+struct power_config {
+        u32     index;
+        u32     min_uw;
+        u32     max_uw;
+        u32     tmin_us;
+        u32     tmax_us;
+        u32     step_uw;
+};
+struct proc_thermal_device {
+        struct device *dev;
+        struct acpi_device *adev;
+        struct power_config power_limits[2];
+};
+enum proc_thermal_emum_mode_type {
+        PROC_THERMAL_NONE,
+        PROC_THERMAL_PCI,
+        PROC_THERMAL_PLATFORM_DEV
+};
+/*
+ * We can have only one type of enumeration, PCI or Platform,
+ * not both. So we don't need instance specific data.
+ */
+static enum proc_thermal_emum_mode_type proc_thermal_emum_mode =
+                                                        PROC_THERMAL_NONE;
+#define POWER_LIMIT_SHOW(index, suffix) \
+static ssize_t power_limit_##index##_##suffix##_show(struct device *dev, \
+                                        struct device_attribute *attr, \
+                                        char *buf) \
+{ \
+        struct pci_dev *pci_dev; \
+        struct platform_device *pdev; \
+        struct proc_thermal_device *proc_dev; \
+\
+        if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) { \
+                pdev = to_platform_device(dev); \
+                proc_dev = platform_get_drvdata(pdev); \
+        } else { \
+                pci_dev = to_pci_dev(dev); \
+                proc_dev = pci_get_drvdata(pci_dev); \
+        } \
+        return sprintf(buf, "%lu\n",\
+        (unsigned long)proc_dev->power_limits[index].suffix * 1000); \
+}
+POWER_LIMIT_SHOW(0, min_uw)
+POWER_LIMIT_SHOW(0, max_uw)
+POWER_LIMIT_SHOW(0, step_uw)
+POWER_LIMIT_SHOW(0, tmin_us)
+POWER_LIMIT_SHOW(0, tmax_us)
+POWER_LIMIT_SHOW(1, min_uw)
+POWER_LIMIT_SHOW(1, max_uw)
+POWER_LIMIT_SHOW(1, step_uw)
+POWER_LIMIT_SHOW(1, tmin_us)
+POWER_LIMIT_SHOW(1, tmax_us)
+static DEVICE_ATTR_RO(power_limit_0_min_uw);
+static DEVICE_ATTR_RO(power_limit_0_max_uw);
+static DEVICE_ATTR_RO(power_limit_0_step_uw);
+static DEVICE_ATTR_RO(power_limit_0_tmin_us);
+static DEVICE_ATTR_RO(power_limit_0_tmax_us);
+static DEVICE_ATTR_RO(power_limit_1_min_uw);
+static DEVICE_ATTR_RO(power_limit_1_max_uw);
+static DEVICE_ATTR_RO(power_limit_1_step_uw);
+static DEVICE_ATTR_RO(power_limit_1_tmin_us);
+static DEVICE_ATTR_RO(power_limit_1_tmax_us);
+static struct attribute *power_limit_attrs[] = {
+        &dev_attr_power_limit_0_min_uw.attr,
+        &dev_attr_power_limit_1_min_uw.attr,
+        &dev_attr_power_limit_0_max_uw.attr,
+        &dev_attr_power_limit_1_max_uw.attr,
+        &dev_attr_power_limit_0_step_uw.attr,
+        &dev_attr_power_limit_1_step_uw.attr,
+        &dev_attr_power_limit_0_tmin_us.attr,
+        &dev_attr_power_limit_1_tmin_us.attr,
+        &dev_attr_power_limit_0_tmax_us.attr,
+        &dev_attr_power_limit_1_tmax_us.attr,
+        NULL
+};
+static struct attribute_group power_limit_attribute_group = {
+        .attrs = power_limit_attrs,
+        .name = "power_limits"
+};
+static int proc_thermal_add(struct device *dev,
+                            struct proc_thermal_device **priv)
+{
+        struct proc_thermal_device *proc_priv;
+        struct acpi_device *adev;
+        acpi_status status;
+        struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER, NULL };
+        union acpi_object *elements, *ppcc;
+        union acpi_object *p;
+        int i;
+        int ret;
+        adev = ACPI_COMPANION(dev);
+        if (!adev)
+                return -ENODEV;
+        status = acpi_evaluate_object(adev->handle, "PPCC", NULL, &buf);
+        if (ACPI_FAILURE(status))
+                return -ENODEV;
+        p = buf.pointer;
+        if (!p || (p->type != ACPI_TYPE_PACKAGE)) {
+                dev_err(dev, "Invalid PPCC data\n");
+                ret = -EFAULT;
+                goto free_buffer;
+        }
+        if (!p->package.count) {
+                dev_err(dev, "Invalid PPCC package size\n");
+                ret = -EFAULT;
+                goto free_buffer;
+        }
+        proc_priv = devm_kzalloc(dev, sizeof(*proc_priv), GFP_KERNEL);
+        if (!proc_priv) {
+                ret = -ENOMEM;
+                goto free_buffer;
+        }
+        proc_priv->dev = dev;
+        proc_priv->adev = adev;
+        for (i = 0; i < min((int)p->package.count - 1, 2); ++i) {
+                elements = &(p->package.elements[i+1]);
+                if (elements->type != ACPI_TYPE_PACKAGE ||
+                    elements->package.count != 6) {
+                        ret = -EFAULT;
+                        goto free_buffer;
+                }
+                ppcc = elements->package.elements;
+                proc_priv->power_limits[i].index = ppcc[0].integer.value;
+                proc_priv->power_limits[i].min_uw = ppcc[1].integer.value;
+                proc_priv->power_limits[i].max_uw = ppcc[2].integer.value;
+                proc_priv->power_limits[i].tmin_us = ppcc[3].integer.value;
+                proc_priv->power_limits[i].tmax_us = ppcc[4].integer.value;
+                proc_priv->power_limits[i].step_uw = ppcc[5].integer.value;
+        }
+        *priv = proc_priv;
+        ret = sysfs_create_group(&dev->kobj,
+                                 &power_limit_attribute_group);
+free_buffer:
+        kfree(buf.pointer);
+        return ret;
+}
+void proc_thermal_remove(struct proc_thermal_device *proc_priv)
+{
+        sysfs_remove_group(&proc_priv->dev->kobj,
+                           &power_limit_attribute_group);
+}
+static int int3401_add(struct platform_device *pdev)
+{
+        struct proc_thermal_device *proc_priv;
+        int ret;
+        if (proc_thermal_emum_mode == PROC_THERMAL_PCI) {
+                dev_err(&pdev->dev, "error: enumerated as PCI dev\n");
+                return -ENODEV;
+        }
+        ret = proc_thermal_add(&pdev->dev, &proc_priv);
+        if (ret)
+                return ret;
+        platform_set_drvdata(pdev, proc_priv);
+        proc_thermal_emum_mode = PROC_THERMAL_PLATFORM_DEV;
+        return 0;
+}
+static int int3401_remove(struct platform_device *pdev)
+{
+        proc_thermal_remove(platform_get_drvdata(pdev));
+        return 0;
+}
+static int  proc_thermal_pci_probe(struct pci_dev *pdev,
+                                   const struct pci_device_id *unused)
+{
+        struct proc_thermal_device *proc_priv;
+        int ret;
+        if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) {
+                dev_err(&pdev->dev, "error: enumerated as platform dev\n");
+                return -ENODEV;
+        }
+        ret = pci_enable_device(pdev);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "error: could not enable device\n");
+                return ret;
+        }
+        ret = proc_thermal_add(&pdev->dev, &proc_priv);
+        if (ret) {
+                pci_disable_device(pdev);
+                return ret;
+        }
+        pci_set_drvdata(pdev, proc_priv);
+        proc_thermal_emum_mode = PROC_THERMAL_PCI;
+        return 0;
+}
+static void  proc_thermal_pci_remove(struct pci_dev *pdev)
+{
+        proc_thermal_remove(pci_get_drvdata(pdev));
+        pci_disable_device(pdev);
+}
+static const struct pci_device_id proc_thermal_pci_ids[] = {
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_PROC_BDW_THERMAL)},
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_PROC_HSB_THERMAL)},
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_PROC_BSW_THERMAL)},
+        { 0, },
+};
+MODULE_DEVICE_TABLE(pci, proc_thermal_pci_ids);
+static struct pci_driver proc_thermal_pci_driver = {
+        .name           = "proc_thermal",
+        .probe          = proc_thermal_pci_probe,
+        .remove         = proc_thermal_pci_remove,
+        .id_table       = proc_thermal_pci_ids,
+};
+static const struct acpi_device_id int3401_device_ids[] = {
+        {"INT3401", 0},
+        {"", 0},
+};
+MODULE_DEVICE_TABLE(acpi, int3401_device_ids);
+static struct platform_driver int3401_driver = {
+        .probe = int3401_add,
+        .remove = int3401_remove,
+        .driver = {
+                .name = "int3401 thermal",
+                .acpi_match_table = int3401_device_ids,
+        },
+};
+static int __init proc_thermal_init(void)
+{
+        int ret;
+        ret = platform_driver_register(&int3401_driver);
+        if (ret)
+                return ret;
+        ret = pci_register_driver(&proc_thermal_pci_driver);
+        return ret;
+}
+static void __exit proc_thermal_exit(void)
+{
+        platform_driver_unregister(&int3401_driver);
+        pci_unregister_driver(&proc_thermal_pci_driver);
+}
+module_init(proc_thermal_init);
+module_exit(proc_thermal_exit);
+MODULE_AUTHOR("Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>");
+MODULE_DESCRIPTION("Processor Thermal Reporting Device Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
index e98b4249187c..6ceebd659dd4 100644
--- a/drivers/thermal/intel_powerclamp.c
+++ b/drivers/thermal/intel_powerclamp.c
@@ -688,6 +688,7 @@ static const struct x86_cpu_id intel_powerclamp_ids[] = {
        { X86_VENDOR_INTEL, 6, 0x45},
        { X86_VENDOR_INTEL, 6, 0x46},
        { X86_VENDOR_INTEL, 6, 0x4c},
+        { X86_VENDOR_INTEL, 6, 0x56},
        {}
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_powerclamp_ids);
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index e145b66df444..d717f3dab6f1 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -149,7 +149,7 @@ EXPORT_SYMBOL_GPL(of_thermal_is_trip_valid);
 *
 * Return: pointer to trip points table, NULL otherwise
 */
-const struct thermal_trip * const
+const struct thermal_trip *
 of_thermal_get_trip_points(struct thermal_zone_device *tz)
 {
        struct __thermal_zone *data = tz->devdata;
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 8803e693fe68..2580a4872f90 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -63,7 +63,7 @@ struct rcar_thermal_priv {
        struct mutex lock;
        struct list_head list;
        int id;
-        int ctemp;
+        u32 ctemp;
 };
 #define rcar_thermal_for_each_priv(pos, common) \
@@ -145,7 +145,7 @@ static int rcar_thermal_update_temp(struct rcar_thermal_priv *priv)
 {
        struct device *dev = rcar_priv_to_dev(priv);
        int i;
-        int ctemp, old, new;
+        u32 ctemp, old, new;
        int ret = -EINVAL;
        mutex_lock(&priv->lock);
@@ -372,6 +372,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
        int i;
        int ret = -ENODEV;
        int idle = IDLE_INTERVAL;
+        u32 enr_bits = 0;
        common = devm_kzalloc(dev, sizeof(*common), GFP_KERNEL);
        if (!common)
@@ -390,7 +391,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                /*
                 * platform has IRQ support.
-                 * Then, drier use common register
+                 * Then, driver uses common registers
                 */
                ret = devm_request_irq(dev, irq->start, rcar_thermal_irq, 0,
@@ -408,9 +409,6 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                if (IS_ERR(common->base))
                        return PTR_ERR(common->base);
-                /* enable temperature comparation */
-                rcar_thermal_common_write(common, ENR, 0x00030303);
                idle = 0; /* polling delay is not needed */
        }
@@ -452,8 +450,15 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                        rcar_thermal_irq_enable(priv);
                list_move_tail(&priv->list, &common->head);
+                /* update ENR bits */
+                enr_bits |= 3 << (i * 8);
        }
+        /* enable temperature comparation */
+        if (irq)
+                rcar_thermal_common_write(common, ENR, enr_bits);
        platform_set_drvdata(pdev, common);
        dev_info(dev, "%d sensor probed\n", i);
diff --git a/drivers/thermal/rockchip_thermal.c b/drivers/thermal/rockchip_thermal.c
index 1bcddfc60e91..9c6ce548e363 100644
--- a/drivers/thermal/rockchip_thermal.c
+++ b/drivers/thermal/rockchip_thermal.c
@@ -677,7 +677,6 @@ static SIMPLE_DEV_PM_OPS(rockchip_thermal_pm_ops,
 static struct platform_driver rockchip_thermal_driver = {
        .driver = {
                .name = "rockchip-thermal",
-                .owner = THIS_MODULE,
                .pm = &rockchip_thermal_pm_ops,
                .of_match_table = of_rockchip_thermal_match,
        },
diff --git a/drivers/thermal/samsung/Kconfig b/drivers/thermal/samsung/Kconfig
index f760389a204c..c43306ecc0ab 100644
--- a/drivers/thermal/samsung/Kconfig
+++ b/drivers/thermal/samsung/Kconfig
@@ -1,6 +1,6 @@
 config EXYNOS_THERMAL
        tristate "Exynos thermal management unit driver"
-        depends on ARCH_HAS_BANDGAP && OF
+        depends on OF
        help
          If you say yes here you get support for the TMU (Thermal Management
          Unit) driver for SAMSUNG EXYNOS series of SoCs. This driver initialises
diff --git a/drivers/thermal/samsung/exynos_thermal_common.c b/drivers/thermal/samsung/exynos_thermal_common.c
index b6be572704a4..6dc3815cc73f 100644
--- a/drivers/thermal/samsung/exynos_thermal_common.c
+++ b/drivers/thermal/samsung/exynos_thermal_common.c
@@ -347,7 +347,6 @@ void exynos_report_trigger(struct thermal_sensor_conf *conf)
 int exynos_register_thermal(struct thermal_sensor_conf *sensor_conf)
 {
        int ret;
-        struct cpumask mask_val;
        struct exynos_thermal_zone *th_zone;
        if (!sensor_conf || !sensor_conf->read_temperature) {
@@ -367,13 +366,14 @@ int exynos_register_thermal(struct thermal_sensor_conf *sensor_conf)
         *       sensor
         */
        if (sensor_conf->cooling_data.freq_clip_count > 0) {
-                cpumask_set_cpu(0, &mask_val);
                th_zone->cool_dev[th_zone->cool_dev_size] =
-                                        cpufreq_cooling_register(&mask_val);
+                                cpufreq_cooling_register(cpu_present_mask);
                if (IS_ERR(th_zone->cool_dev[th_zone->cool_dev_size])) {
-                        dev_err(sensor_conf->dev,
+                        ret = PTR_ERR(th_zone->cool_dev[th_zone->cool_dev_size]);
-                                "Failed to register cpufreq cooling device\n");
+                        if (ret != -EPROBE_DEFER)
-                        ret = -EINVAL;
+                                dev_err(sensor_conf->dev,
+                                        "Failed to register cpufreq cooling device: %d\n",
+                                        ret);
                        goto err_unregister;
                }
                th_zone->cool_dev_size++;
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index d44d91d681d4..d2f1e62a4232 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -927,7 +927,10 @@ static int exynos_tmu_probe(struct platform_device *pdev)
        /* Register the sensor with thermal management interface */
        ret = exynos_register_thermal(sensor_conf);
        if (ret) {
-                dev_err(&pdev->dev, "Failed to register thermal interface\n");
+                if (ret != -EPROBE_DEFER)
+                        dev_err(&pdev->dev,
+                                "Failed to register thermal interface: %d\n",
+                                ret);
                goto err_clk;
        }
        data->reg_conf = sensor_conf;
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 84fdf0792e27..87e0b0782023 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -930,7 +930,7 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
        struct thermal_zone_device *pos1;
        struct thermal_cooling_device *pos2;
        unsigned long max_state;
-        int result;
+        int result, ret;
        if (trip >= tz->trips || (trip < 0 && trip != THERMAL_TRIPS_NONE))
                return -EINVAL;
@@ -947,7 +947,9 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
        if (tz != pos1 || cdev != pos2)
                return -EINVAL;
-        cdev->ops->get_max_state(cdev, &max_state);
+        ret = cdev->ops->get_max_state(cdev, &max_state);
+        if (ret)
+                return ret;
        /* lower default 0, upper default max_state */
        lower = lower == THERMAL_NO_LIMIT ? 0 : lower;
diff --git a/drivers/thermal/thermal_core.h b/drivers/thermal/thermal_core.h
index 9083e7520623..0531c752fbbb 100644
--- a/drivers/thermal/thermal_core.h
+++ b/drivers/thermal/thermal_core.h
@@ -91,7 +91,7 @@ int of_parse_thermal_zones(void);
 void of_thermal_destroy_zones(void);
 int of_thermal_get_ntrips(struct thermal_zone_device *);
 bool of_thermal_is_trip_valid(struct thermal_zone_device *, int);
-const struct thermal_trip * const
+const struct thermal_trip *
 of_thermal_get_trip_points(struct thermal_zone_device *);
 #else
 static inline int of_parse_thermal_zones(void) { return 0; }
@@ -105,7 +105,7 @@ static inline bool of_thermal_is_trip_valid(struct thermal_zone_device *tz,
 {
        return 0;
 }
-static inline const struct thermal_trip * const
+static inline const struct thermal_trip *
 of_thermal_get_trip_points(struct thermal_zone_device *tz)
 {
        return NULL;
diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
index 5fd03865e396..3fb054a10f6a 100644
--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
@@ -28,7 +28,6 @@
 #include <linux/kernel.h>
 #include <linux/workqueue.h>
 #include <linux/thermal.h>
-#include <linux/cpufreq.h>
 #include <linux/cpumask.h>
 #include <linux/cpu_cooling.h>
 #include <linux/of.h>
@@ -407,17 +406,17 @@ int ti_thermal_register_cpu_cooling(struct ti_bandgap *bgp, int id)
        if (!data)
                return -EINVAL;
-        if (!cpufreq_get_current_driver()) {
-                dev_dbg(bgp->dev, "no cpufreq driver yet\n");
-                return -EPROBE_DEFER;
-        }
        /* Register cooling device */
        data->cool_dev = cpufreq_cooling_register(cpu_present_mask);
        if (IS_ERR(data->cool_dev)) {
-                dev_err(bgp->dev,
+                int ret = PTR_ERR(data->cool_dev);
-                        "Failed to register cpufreq cooling device\n");
-                return PTR_ERR(data->cool_dev);
+                if (ret != -EPROBE_DEFER)
+                        dev_err(bgp->dev,
+                                "Failed to register cpu cooling device %d\n",
+                                ret);
+                return ret;
        }
        ti_bandgap_set_sensor_data(bgp, id, data);
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index d2b496750d59..4ddfa60c9222 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2399,17 +2399,12 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
        poll_wait(file, &tty->read_wait, wait);
        poll_wait(file, &tty->write_wait, wait);
-        if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
-                mask |= POLLHUP;
        if (input_available_p(tty, 1))
                mask |= POLLIN | POLLRDNORM;
-        else if (mask & POLLHUP) {
-                tty_flush_to_ldisc(tty);
-                if (input_available_p(tty, 1))
-                        mask |= POLLIN | POLLRDNORM;
-        }
        if (tty->packet && tty->link->ctrl_status)
                mask |= POLLPRI | POLLIN | POLLRDNORM;
+        if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
+                mask |= POLLHUP;
        if (tty_hung_up_p(file))
                mask |= POLLHUP;
        if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 31feeb2d0a66..d1f8dc6aabcb 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1815,7 +1815,7 @@ pci_wch_ch353_setup(struct serial_private *priv,
 }
 static int
-pci_wch_ch382_setup(struct serial_private *priv,
+pci_wch_ch38x_setup(struct serial_private *priv,
                    const struct pciserial_board *board,
                    struct uart_8250_port *port, int idx)
 {
@@ -1880,6 +1880,7 @@ pci_wch_ch382_setup(struct serial_private *priv,
 #define PCIE_VENDOR_ID_WCH              0x1c00
 #define PCIE_DEVICE_ID_WCH_CH382_2S1P   0x3250
+#define PCIE_DEVICE_ID_WCH_CH384_4S     0x3470
 /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584
@@ -2571,13 +2572,21 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
                .subdevice      = PCI_ANY_ID,
                .setup          = pci_wch_ch353_setup,
        },
-        /* WCH CH382 2S1P card (16750 clone) */
+        /* WCH CH382 2S1P card (16850 clone) */
        {
                .vendor         = PCIE_VENDOR_ID_WCH,
                .device         = PCIE_DEVICE_ID_WCH_CH382_2S1P,
                .subvendor      = PCI_ANY_ID,
                .subdevice      = PCI_ANY_ID,
-                .setup          = pci_wch_ch382_setup,
+                .setup          = pci_wch_ch38x_setup,
+        },
+        /* WCH CH384 4S card (16850 clone) */
+        {
+                .vendor         = PCIE_VENDOR_ID_WCH,
+                .device         = PCIE_DEVICE_ID_WCH_CH384_4S,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .setup          = pci_wch_ch38x_setup,
        },
        /*
         * ASIX devices with FIFO bug
@@ -2876,6 +2885,7 @@ enum pci_board_num_t {
        pbn_fintek_4,
        pbn_fintek_8,
        pbn_fintek_12,
+        pbn_wch384_4,
 };
 /*
@@ -3675,6 +3685,14 @@ static struct pciserial_board pci_boards[] = {
                .base_baud      = 115200,
                .first_offset   = 0x40,
        },
+        [pbn_wch384_4] = {
+                .flags          = FL_BASE0,
+                .num_ports      = 4,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+                .first_offset   = 0xC0,
+        },
 };
 static const struct pci_device_id blacklist[] = {
@@ -3687,6 +3705,7 @@ static const struct pci_device_id blacklist[] = {
        { PCI_DEVICE(0x4348, 0x7053), }, /* WCH CH353 2S1P */
        { PCI_DEVICE(0x4348, 0x5053), }, /* WCH CH353 1S1P */
        { PCI_DEVICE(0x1c00, 0x3250), }, /* WCH CH382 2S1P */
+        { PCI_DEVICE(0x1c00, 0x3470), }, /* WCH CH384 4S */
 };
 /*
@@ -5400,6 +5419,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                PCI_ANY_ID, PCI_ANY_ID,
                0, 0, pbn_b0_bt_2_115200 },
+        {       PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH384_4S,
+                PCI_ANY_ID, PCI_ANY_ID,
+                0, 0, pbn_wch384_4 },
        /*
         * Commtech, Inc. Fastcom adapters
         */
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index 19273e31d224..107e80722575 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1757,32 +1757,43 @@ static struct s3c24xx_serial_drv_data s5pv210_serial_drv_data = {
 #endif
 #if defined(CONFIG_ARCH_EXYNOS)
+#define EXYNOS_COMMON_SERIAL_DRV_DATA                           \
+        .info = &(struct s3c24xx_uart_info) {                   \
+                .name           = "Samsung Exynos UART",        \
+                .type           = PORT_S3C6400,                 \
+                .has_divslot    = 1,                            \
+                .rx_fifomask    = S5PV210_UFSTAT_RXMASK,        \
+                .rx_fifoshift   = S5PV210_UFSTAT_RXSHIFT,       \
+                .rx_fifofull    = S5PV210_UFSTAT_RXFULL,        \
+                .tx_fifofull    = S5PV210_UFSTAT_TXFULL,        \
+                .tx_fifomask    = S5PV210_UFSTAT_TXMASK,        \
+                .tx_fifoshift   = S5PV210_UFSTAT_TXSHIFT,       \
+                .def_clk_sel    = S3C2410_UCON_CLKSEL0,         \
+                .num_clks       = 1,                            \
+                .clksel_mask    = 0,                            \
+                .clksel_shift   = 0,                            \
+        },                                                      \
+        .def_cfg = &(struct s3c2410_uartcfg) {                  \
+                .ucon           = S5PV210_UCON_DEFAULT,         \
+                .ufcon          = S5PV210_UFCON_DEFAULT,        \
+                .has_fracval    = 1,                            \
+        }                                                       \
 static struct s3c24xx_serial_drv_data exynos4210_serial_drv_data = {
-        .info = &(struct s3c24xx_uart_info) {
+        EXYNOS_COMMON_SERIAL_DRV_DATA,
-                .name           = "Samsung Exynos4 UART",
-                .type           = PORT_S3C6400,
-                .has_divslot    = 1,
-                .rx_fifomask    = S5PV210_UFSTAT_RXMASK,
-                .rx_fifoshift   = S5PV210_UFSTAT_RXSHIFT,
-                .rx_fifofull    = S5PV210_UFSTAT_RXFULL,
-                .tx_fifofull    = S5PV210_UFSTAT_TXFULL,
-                .tx_fifomask    = S5PV210_UFSTAT_TXMASK,
-                .tx_fifoshift   = S5PV210_UFSTAT_TXSHIFT,
-                .def_clk_sel    = S3C2410_UCON_CLKSEL0,
-                .num_clks       = 1,
-                .clksel_mask    = 0,
-                .clksel_shift   = 0,
-        },
-        .def_cfg = &(struct s3c2410_uartcfg) {
-                .ucon           = S5PV210_UCON_DEFAULT,
-                .ufcon          = S5PV210_UFCON_DEFAULT,
-                .has_fracval    = 1,
-        },
        .fifosize = { 256, 64, 16, 16 },
 };
+static struct s3c24xx_serial_drv_data exynos5433_serial_drv_data = {
+        EXYNOS_COMMON_SERIAL_DRV_DATA,
+        .fifosize = { 64, 256, 16, 256 },
+};
 #define EXYNOS4210_SERIAL_DRV_DATA ((kernel_ulong_t)&exynos4210_serial_drv_data)
+#define EXYNOS5433_SERIAL_DRV_DATA ((kernel_ulong_t)&exynos5433_serial_drv_data)
 #else
 #define EXYNOS4210_SERIAL_DRV_DATA (kernel_ulong_t)NULL
+#define EXYNOS5433_SERIAL_DRV_DATA (kernel_ulong_t)NULL
 #endif
 static struct platform_device_id s3c24xx_serial_driver_ids[] = {
@@ -1804,6 +1815,9 @@ static struct platform_device_id s3c24xx_serial_driver_ids[] = {
        }, {
                .name           = "exynos4210-uart",
                .driver_data    = EXYNOS4210_SERIAL_DRV_DATA,
+        }, {
+                .name           = "exynos5433-uart",
+                .driver_data    = EXYNOS5433_SERIAL_DRV_DATA,
        },
        { },
 };
@@ -1823,6 +1837,8 @@ static const struct of_device_id s3c24xx_uart_dt_match[] = {
                .data = (void *)S5PV210_SERIAL_DRV_DATA },
        { .compatible = "samsung,exynos4210-uart",
                .data = (void *)EXYNOS4210_SERIAL_DRV_DATA },
+        { .compatible = "samsung,exynos5433-uart",
+                .data = (void *)EXYNOS5433_SERIAL_DRV_DATA },
        {},
 };
 MODULE_DEVICE_TABLE(of, s3c24xx_uart_dt_match);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 57ca61b14670..984605bb5bf1 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2164,7 +2164,9 @@ uart_report_port(struct uart_driver *drv, struct uart_port *port)
                break;
        }
-        dev_info(port->dev, "%s%d at %s (irq = %d, base_baud = %d) is a %s\n",
+        printk(KERN_INFO "%s%s%s%d at %s (irq = %d, base_baud = %d) is a %s\n",
+               port->dev ? dev_name(port->dev) : "",
+               port->dev ? ": " : "",
               drv->dev_name,
               drv->tty_driver->name_base + port->line,
               address, port->irq, port->uartclk / 16, uart_type(port));
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 4f35b43e2475..51f066aa375e 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1464,6 +1464,9 @@ static int tty_reopen(struct tty_struct *tty)
            driver->subtype == PTY_TYPE_MASTER)
                return -EIO;
+        if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
+                return -EBUSY;
        tty->count++;
        WARN_ON(!tty->ldisc);
@@ -2106,10 +2109,6 @@ retry_open:
                retval = -ENODEV;
        filp->f_flags = saved_flags;
-        if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) &&
-                                                !capable(CAP_SYS_ADMIN))
-                retval = -EBUSY;
        if (retval) {
 #ifdef TTY_DEBUG_HANGUP
                printk(KERN_DEBUG "%s: error %d in opening %s...\n", __func__,
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 5b9825a4538a..a57dc8866fc5 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -669,7 +669,6 @@ static int ci_hdrc_probe(struct platform_device *pdev)
        if (!ci)
                return -ENOMEM;
-        platform_set_drvdata(pdev, ci);
        ci->dev = dev;
        ci->platdata = dev_get_platdata(dev);
        ci->imx28_write_fix = !!(ci->platdata->flags &
@@ -783,6 +782,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
                }
        }
+        platform_set_drvdata(pdev, ci);
        ret = devm_request_irq(dev, ci->irq, ci_irq, IRQF_SHARED,
                        ci->platdata->name, ci);
        if (ret)
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index c1694cff1eaf..48731d0bab35 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -91,6 +91,7 @@ static int host_start(struct ci_hdrc *ci)
        if (!hcd)
                return -ENOMEM;
+        dev_set_drvdata(ci->dev, ci);
        hcd->rsrc_start = ci->hw_bank.phys;
        hcd->rsrc_len = ci->hw_bank.size;
        hcd->regs = ci->hw_bank.abs;
diff --git a/drivers/usb/core/otg_whitelist.h b/drivers/usb/core/otg_whitelist.h
index de0c9c9d7091..a6315abe7b7c 100644
--- a/drivers/usb/core/otg_whitelist.h
+++ b/drivers/usb/core/otg_whitelist.h
@@ -55,6 +55,11 @@ static int is_targeted(struct usb_device *dev)
             le16_to_cpu(dev->descriptor.idProduct) == 0xbadd))
                return 0;
+        /* OTG PET device is always targeted (see OTG 2.0 ECN 6.4.2) */
+        if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1a0a &&
+             le16_to_cpu(dev->descriptor.idProduct) == 0x0200))
+                return 1;
        /* NOTE: can't use usb_match_id() since interface caches
         * aren't set up yet. this is cut/paste from that code.
         */
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 0ffb4ed0a945..41e510ae8c83 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -179,6 +179,10 @@ static const struct usb_device_id usb_quirk_list[] = {
        { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
                        USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+        /* Protocol and OTG Electrical Test Device */
+        { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
+                        USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
        { }  /* terminating entry must be last */
 };
diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
index ad43c5bc1ef1..02e3e2d4ea56 100644
--- a/drivers/usb/dwc2/core_intr.c
+++ b/drivers/usb/dwc2/core_intr.c
@@ -476,13 +476,13 @@ irqreturn_t dwc2_handle_common_intr(int irq, void *dev)
        u32 gintsts;
        irqreturn_t retval = IRQ_NONE;
+        spin_lock(&hsotg->lock);
        if (!dwc2_is_controller_alive(hsotg)) {
                dev_warn(hsotg->dev, "Controller is dead\n");
                goto out;
        }
-        spin_lock(&hsotg->lock);
        gintsts = dwc2_read_common_intr(hsotg);
        if (gintsts & ~GINTSTS_PRTINT)
                retval = IRQ_HANDLED;
@@ -515,8 +515,8 @@ irqreturn_t dwc2_handle_common_intr(int irq, void *dev)
                }
        }
-        spin_unlock(&hsotg->lock);
 out:
+        spin_unlock(&hsotg->lock);
        return retval;
 }
 EXPORT_SYMBOL_GPL(dwc2_handle_common_intr);
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 200168ec2d75..79242008085b 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -2567,7 +2567,7 @@ error:
 * s3c_hsotg_ep_disable - disable given endpoint
 * @ep: The endpoint to disable.
 */
-static int s3c_hsotg_ep_disable(struct usb_ep *ep)
+static int s3c_hsotg_ep_disable_force(struct usb_ep *ep, bool force)
 {
        struct s3c_hsotg_ep *hs_ep = our_ep(ep);
        struct dwc2_hsotg *hsotg = hs_ep->parent;
@@ -2588,7 +2588,7 @@ static int s3c_hsotg_ep_disable(struct usb_ep *ep)
        spin_lock_irqsave(&hsotg->lock, flags);
        /* terminate all requests with shutdown */
-        kill_all_requests(hsotg, hs_ep, -ESHUTDOWN, false);
+        kill_all_requests(hsotg, hs_ep, -ESHUTDOWN, force);
        hsotg->fifo_map &= ~(1<<hs_ep->fifo_index);
        hs_ep->fifo_index = 0;
@@ -2609,6 +2609,10 @@ static int s3c_hsotg_ep_disable(struct usb_ep *ep)
        return 0;
 }
+static int s3c_hsotg_ep_disable(struct usb_ep *ep)
+{
+        return s3c_hsotg_ep_disable_force(ep, false);
+}
 /**
 * on_list - check request is on the given endpoint
 * @ep: The endpoint to check.
@@ -2924,7 +2928,7 @@ static int s3c_hsotg_udc_stop(struct usb_gadget *gadget)
        /* all endpoints should be shutdown */
        for (ep = 1; ep < hsotg->num_of_eps; ep++)
-                s3c_hsotg_ep_disable(&hsotg->eps[ep].ep);
+                s3c_hsotg_ep_disable_force(&hsotg->eps[ep].ep, true);
        spin_lock_irqsave(&hsotg->lock, flags);
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 7c4faf738747..b642a2f998f9 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -33,6 +33,8 @@
 #define PCI_DEVICE_ID_INTEL_BYT         0x0f37
 #define PCI_DEVICE_ID_INTEL_MRFLD       0x119e
 #define PCI_DEVICE_ID_INTEL_BSW         0x22B7
+#define PCI_DEVICE_ID_INTEL_SPTLP       0x9d30
+#define PCI_DEVICE_ID_INTEL_SPTH        0xa130
 struct dwc3_pci {
        struct device           *dev;
@@ -219,6 +221,8 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BSW), },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BYT), },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SPTLP), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SPTH), },
        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
        {  }    /* Terminating Entry */
 };
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index f03b136ecfce..8f65ab3a3b92 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -882,8 +882,7 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting)
                                if (i == (request->num_mapped_sgs - 1) ||
                                                sg_is_last(s)) {
-                                        if (list_is_last(&req->list,
+                                        if (list_empty(&dep->request_list))
-                                                        &dep->request_list))
                                                last_one = true;
                                        chain = false;
                                }
@@ -901,6 +900,9 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting)
                                if (last_one)
                                        break;
                        }
+                        if (last_one)
+                                break;
                } else {
                        dma = req->request.dma;
                        length = req->request.length;
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 6e04e302dc3a..a1bc3e3a0b09 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -399,8 +399,9 @@ static int hidg_setup(struct usb_function *f,
        value   = __le16_to_cpu(ctrl->wValue);
        length  = __le16_to_cpu(ctrl->wLength);
-        VDBG(cdev, "hid_setup crtl_request : bRequestType:0x%x bRequest:0x%x "
+        VDBG(cdev,
-                "Value:0x%x\n", ctrl->bRequestType, ctrl->bRequest, value);
+             "%s crtl_request : bRequestType:0x%x bRequest:0x%x Value:0x%x\n",
+             __func__, ctrl->bRequestType, ctrl->bRequest, value);
        switch ((ctrl->bRequestType << 8) | ctrl->bRequest) {
        case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index a90440300735..259b656c0b3e 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -520,7 +520,7 @@ static void f_midi_transmit(struct f_midi *midi, struct usb_request *req)
                req = midi_alloc_ep_req(ep, midi->buflen);
        if (!req) {
-                ERROR(midi, "gmidi_transmit: alloc_ep_request failed\n");
+                ERROR(midi, "%s: alloc_ep_request failed\n", __func__);
                return;
        }
        req->length = 0;
diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
index f7b203293205..e9715845f82e 100644
--- a/drivers/usb/gadget/function/f_uac1.c
+++ b/drivers/usb/gadget/function/f_uac1.c
@@ -897,7 +897,6 @@ static void f_audio_free_inst(struct usb_function_instance *f)
        struct f_uac1_opts *opts;
        opts = container_of(f, struct f_uac1_opts, func_inst);
-        gaudio_cleanup(opts->card);
        if (opts->fn_play_alloc)
                kfree(opts->fn_play);
        if (opts->fn_cap_alloc)
@@ -935,6 +934,7 @@ static void f_audio_free(struct usb_function *f)
        struct f_audio *audio = func_to_audio(f);
        struct f_uac1_opts *opts;
+        gaudio_cleanup(&audio->card);
        opts = container_of(f->fi, struct f_uac1_opts, func_inst);
        kfree(audio);
        mutex_lock(&opts->lock);
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index c744e4975d74..db49ec4c748e 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -441,6 +441,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        kbuf = memdup_user(buf, len);
        if (IS_ERR(kbuf)) {
                value = PTR_ERR(kbuf);
+                kbuf = NULL;
                goto free1;
        }
@@ -449,6 +450,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                data->name, len, (int) value);
 free1:
        mutex_unlock(&data->lock);
+        kfree (kbuf);
        return value;
 }
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index ce882371786b..9f93bed42052 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -716,10 +716,10 @@ static int queue_dma(struct usba_udc *udc, struct usba_ep *ep,
        req->using_dma = 1;
        req->ctrl = USBA_BF(DMA_BUF_LEN, req->req.length)
                        | USBA_DMA_CH_EN | USBA_DMA_END_BUF_IE
-                        | USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;
+                        | USBA_DMA_END_BUF_EN;
-        if (ep->is_in)
+        if (!ep->is_in)
-                req->ctrl |= USBA_DMA_END_BUF_EN;
+                req->ctrl |= USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;
        /*
         * Add this request to the queue and submit for DMA if
@@ -828,7 +828,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 {
        struct usba_ep *ep = to_usba_ep(_ep);
        struct usba_udc *udc = ep->udc;
-        struct usba_request *req = to_usba_req(_req);
+        struct usba_request *req;
        unsigned long flags;
        u32 status;
@@ -837,6 +837,16 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
        spin_lock_irqsave(&udc->lock, flags);
+        list_for_each_entry(req, &ep->queue, queue) {
+                if (&req->req == _req)
+                        break;
+        }
+        if (&req->req != _req) {
+                spin_unlock_irqrestore(&udc->lock, flags);
+                return -EINVAL;
+        }
        if (req->using_dma) {
                /*
                 * If this request is currently being transferred,
@@ -1563,7 +1573,6 @@ static void usba_ep_irq(struct usba_udc *udc, struct usba_ep *ep)
        if ((epstatus & epctrl) & USBA_RX_BK_RDY) {
                DBG(DBG_BUS, "%s: RX data ready\n", ep->ep.name);
                receive_data(ep);
-                usba_ep_writel(ep, CLR_STA, USBA_RX_BK_RDY);
        }
 }
diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
index ff67ceac77c4..d4fe8d769bd6 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
@@ -718,10 +718,11 @@ static int ep_queue(struct bdc_ep *ep, struct bdc_req *req)
        struct bdc *bdc;
        int ret = 0;
-        bdc = ep->bdc;
        if (!req || !ep || !ep->usb_ep.desc)
                return -EINVAL;
+        bdc = ep->bdc;
        req->usb_req.actual = 0;
        req->usb_req.status = -EINPROGRESS;
        req->epnum = ep->ep_num;
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index e113fd73aeae..f9a332775c47 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1581,6 +1581,10 @@ iso_stream_schedule (
        else
                next = (now + 2 + 7) & ~0x07;   /* full frame cache */
+        /* If needed, initialize last_iso_frame so that this URB will be seen */
+        if (ehci->isoc_count == 0)
+                ehci->last_iso_frame = now >> 3;
        /*
         * Use ehci->last_iso_frame as the base.  There can't be any
         * TDs scheduled for earlier than that.
@@ -1600,11 +1604,11 @@ iso_stream_schedule (
         */
        now2 = (now - base) & (mod - 1);
-        /* Is the schedule already full? */
+        /* Is the schedule about to wrap around? */
        if (unlikely(!empty && start < period)) {
-                ehci_dbg(ehci, "iso sched full %p (%u-%u < %u mod %u)\n",
+                ehci_dbg(ehci, "request %p would overflow (%u-%u < %u mod %u)\n",
                                urb, stream->next_uframe, base, period, mod);
-                status = -ENOSPC;
+                status = -EFBIG;
                goto fail;
        }
@@ -1671,10 +1675,6 @@ iso_stream_schedule (
        urb->start_frame = start & (mod - 1);
        if (!stream->highspeed)
                urb->start_frame >>= 3;
-        /* Make sure scan_isoc() sees these */
-        if (ehci->isoc_count == 0)
-                ehci->last_iso_frame = now >> 3;
        return status;
 fail:
diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
index 19a9af1b4d74..ff9af29b4e9f 100644
--- a/drivers/usb/host/ehci-tegra.c
+++ b/drivers/usb/host/ehci-tegra.c
@@ -451,7 +451,7 @@ static int tegra_ehci_probe(struct platform_device *pdev)
        u_phy = devm_usb_get_phy_by_phandle(&pdev->dev, "nvidia,phy", 0);
        if (IS_ERR(u_phy)) {
-                err = PTR_ERR(u_phy);
+                err = -EPROBE_DEFER;
                goto cleanup_clk_en;
        }
        hcd->usb_phy = u_phy;
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index dd483c13565b..ce636466edb7 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -567,7 +567,8 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
 {
        void __iomem *base;
        u32 control;
-        u32 fminterval;
+        u32 fminterval = 0;
+        bool no_fminterval = false;
        int cnt;
        if (!mmio_resource_enabled(pdev, 0))
@@ -577,6 +578,13 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
        if (base == NULL)
                return;
+        /*
+         * ULi M5237 OHCI controller locks the whole system when accessing
+         * the OHCI_FMINTERVAL offset.
+         */
+        if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237)
+                no_fminterval = true;
        control = readl(base + OHCI_CONTROL);
 /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
@@ -615,7 +623,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
        }
        /* software reset of the controller, preserving HcFmInterval */
-        fminterval = readl(base + OHCI_FMINTERVAL);
+        if (!no_fminterval)
+                fminterval = readl(base + OHCI_FMINTERVAL);
        writel(OHCI_HCR, base + OHCI_CMDSTATUS);
        /* reset requires max 10 us delay */
@@ -624,7 +634,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
                        break;
                udelay(1);
        }
-        writel(fminterval, base + OHCI_FMINTERVAL);
+        if (!no_fminterval)
+                writel(fminterval, base + OHCI_FMINTERVAL);
        /* Now the controller is safely in SUSPEND and nothing can wake it up */
        iounmap(base);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 142b601f9563..7f76c8a12f89 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -82,6 +82,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                                "must be suspended extra slowly",
                                pdev->revision);
                }
+                if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK)
+                        xhci->quirks |= XHCI_BROKEN_STREAMS;
                /* Fresco Logic confirms: all revisions of this chip do not
                 * support MSI, even though some of them claim to in their PCI
                 * capabilities.
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 01fcbb5eb06e..c50d8d202618 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3803,6 +3803,15 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
                return -EINVAL;
        }
+        if (setup == SETUP_CONTEXT_ONLY) {
+                slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx);
+                if (GET_SLOT_STATE(le32_to_cpu(slot_ctx->dev_state)) ==
+                    SLOT_STATE_DEFAULT) {
+                        xhci_dbg(xhci, "Slot already in default state\n");
+                        return 0;
+                }
+        }
        command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
        if (!command)
                return -ENOMEM;
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 9d68372dd9aa..b005010240e5 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -72,6 +72,8 @@ config USB_MUSB_DA8XX
 config USB_MUSB_TUSB6010
        tristate "TUSB6010"
+        depends on ARCH_OMAP2PLUS || COMPILE_TEST
+        depends on NOP_USB_XCEIV = USB_MUSB_HDRC # both built-in or both modules
 config USB_MUSB_OMAP2PLUS
        tristate "OMAP2430 and onwards"
@@ -85,6 +87,7 @@ config USB_MUSB_AM35X
 config USB_MUSB_DSPS
        tristate "TI DSPS platforms"
        select USB_MUSB_AM335X_CHILD
+        depends on ARCH_OMAP2PLUS || COMPILE_TEST
        depends on OF_IRQ
 config USB_MUSB_BLACKFIN
@@ -93,6 +96,7 @@ config USB_MUSB_BLACKFIN
 config USB_MUSB_UX500
        tristate "Ux500 platforms"
+        depends on ARCH_U8500 || COMPILE_TEST
 config USB_MUSB_JZ4740
        tristate "JZ4740"
diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index a441a2de8619..178250145613 100644
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -63,7 +63,7 @@ static void bfin_writew(void __iomem *addr, unsigned offset, u16 data)
        bfin_write16(addr + offset, data);
 }
-static void binf_writel(void __iomem *addr, unsigned offset, u32 data)
+static void bfin_writel(void __iomem *addr, unsigned offset, u32 data)
 {
        bfin_write16(addr + offset, (u16)data);
 }
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index f64fd964dc6d..c39a16ad7832 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -628,9 +628,9 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller)
                ret = of_property_read_string_index(np, "dma-names", i, &str);
                if (ret)
                        goto err;
-                if (!strncmp(str, "tx", 2))
+                if (strstarts(str, "tx"))
                        is_tx = 1;
-                else if (!strncmp(str, "rx", 2))
+                else if (strstarts(str, "rx"))
                        is_tx = 0;
                else {
                        dev_err(dev, "Wrong dmatype %s\n", str);
diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c
index ad3701a97389..48131aa8472c 100644
--- a/drivers/usb/musb/musb_debugfs.c
+++ b/drivers/usb/musb/musb_debugfs.c
@@ -59,20 +59,12 @@ static const struct musb_register_map musb_regmap[] = {
        { "RxMaxPp",    MUSB_RXMAXP,    16 },
        { "RxCSR",      MUSB_RXCSR,     16 },
        { "RxCount",    MUSB_RXCOUNT,   16 },
-        { "ConfigData", MUSB_CONFIGDATA,8 },
        { "IntrRxE",    MUSB_INTRRXE,   16 },
        { "IntrTxE",    MUSB_INTRTXE,   16 },
        { "IntrUsbE",   MUSB_INTRUSBE,  8 },
        { "DevCtl",     MUSB_DEVCTL,    8 },
-        { "BabbleCtl",  MUSB_BABBLE_CTL,8 },
-        { "TxFIFOsz",   MUSB_TXFIFOSZ,  8 },
-        { "RxFIFOsz",   MUSB_RXFIFOSZ,  8 },
-        { "TxFIFOadd",  MUSB_TXFIFOADD, 16 },
-        { "RxFIFOadd",  MUSB_RXFIFOADD, 16 },
        { "VControl",   0x68,           32 },
        { "HWVers",     0x69,           16 },
-        { "EPInfo",     MUSB_EPINFO,    8 },
-        { "RAMInfo",    MUSB_RAMINFO,   8 },
        { "LinkInfo",   MUSB_LINKINFO,  8 },
        { "VPLen",      MUSB_VPLEN,     8 },
        { "HS_EOF1",    MUSB_HS_EOF1,   8 },
@@ -103,6 +95,16 @@ static const struct musb_register_map musb_regmap[] = {
        { "DMA_CNTLch7",        0x274,  16 },
        { "DMA_ADDRch7",        0x278,  32 },
        { "DMA_COUNTch7",       0x27C,  32 },
+#ifndef CONFIG_BLACKFIN
+        { "ConfigData", MUSB_CONFIGDATA,8 },
+        { "BabbleCtl",  MUSB_BABBLE_CTL,8 },
+        { "TxFIFOsz",   MUSB_TXFIFOSZ,  8 },
+        { "RxFIFOsz",   MUSB_RXFIFOSZ,  8 },
+        { "TxFIFOadd",  MUSB_TXFIFOADD, 16 },
+        { "RxFIFOadd",  MUSB_RXFIFOADD, 16 },
+        { "EPInfo",     MUSB_EPINFO,    8 },
+        { "RAMInfo",    MUSB_RAMINFO,   8 },
+#endif
        {  }    /* Terminating Entry */
 };
@@ -197,30 +199,30 @@ static ssize_t musb_test_mode_write(struct file *file,
        if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
                return -EFAULT;
-        if (!strncmp(buf, "force host", 9))
+        if (strstarts(buf, "force host"))
                test = MUSB_TEST_FORCE_HOST;
-        if (!strncmp(buf, "fifo access", 11))
+        if (strstarts(buf, "fifo access"))
                test = MUSB_TEST_FIFO_ACCESS;
-        if (!strncmp(buf, "force full-speed", 15))
+        if (strstarts(buf, "force full-speed"))
                test = MUSB_TEST_FORCE_FS;
-        if (!strncmp(buf, "force high-speed", 15))
+        if (strstarts(buf, "force high-speed"))
                test = MUSB_TEST_FORCE_HS;
-        if (!strncmp(buf, "test packet", 10)) {
+        if (strstarts(buf, "test packet")) {
                test = MUSB_TEST_PACKET;
                musb_load_testpacket(musb);
        }
-        if (!strncmp(buf, "test K", 6))
+        if (strstarts(buf, "test K"))
                test = MUSB_TEST_K;
-        if (!strncmp(buf, "test J", 6))
+        if (strstarts(buf, "test J"))
                test = MUSB_TEST_J;
-        if (!strncmp(buf, "test SE0 NAK", 12))
+        if (strstarts(buf, "test SE0 NAK"))
                test = MUSB_TEST_SE0_NAK;
        musb_writeb(musb->mregs, MUSB_TESTMODE, test);
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 23d474d3d7f4..883a9adfdfff 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2663,7 +2663,6 @@ void musb_host_cleanup(struct musb *musb)
        if (musb->port_mode == MUSB_PORT_MODE_GADGET)
                return;
        usb_remove_hcd(musb->hcd);
-        musb->hcd = NULL;
 }
 void musb_host_free(struct musb *musb)
diff --git a/drivers/usb/phy/phy-mv-usb.c b/drivers/usb/phy/phy-mv-usb.c
index 699e38c73d82..697a741a0cb1 100644
--- a/drivers/usb/phy/phy-mv-usb.c
+++ b/drivers/usb/phy/phy-mv-usb.c
@@ -338,7 +338,6 @@ static void mv_otg_update_inputs(struct mv_otg *mvotg)
 static void mv_otg_update_state(struct mv_otg *mvotg)
 {
        struct mv_otg_ctrl *otg_ctrl = &mvotg->otg_ctrl;
-        struct usb_phy *phy = &mvotg->phy;
        int old_state = mvotg->phy.otg->state;
        switch (old_state) {
@@ -858,10 +857,10 @@ static int mv_otg_suspend(struct platform_device *pdev, pm_message_t state)
 {
        struct mv_otg *mvotg = platform_get_drvdata(pdev);
-        if (mvotg->phy.state != OTG_STATE_B_IDLE) {
+        if (mvotg->phy.otg->state != OTG_STATE_B_IDLE) {
                dev_info(&pdev->dev,
                         "OTG state is not B_IDLE, it is %d!\n",
-                         mvotg->phy.state);
+                         mvotg->phy.otg->state);
                return -EAGAIN;
        }
diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
index b4066a001ba0..2f9735b35338 100644
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -59,6 +59,9 @@ static struct usb_phy *__of_usb_find_phy(struct device_node *node)
 {
        struct usb_phy  *phy;
+        if (!of_device_is_available(node))
+                return ERR_PTR(-ENODEV);
        list_for_each_entry(phy, &phy_list, head) {
                if (node != phy->dev->of_node)
                        continue;
@@ -66,7 +69,7 @@ static struct usb_phy *__of_usb_find_phy(struct device_node *node)
                return phy;
        }
-        return ERR_PTR(-ENODEV);
+        return ERR_PTR(-EPROBE_DEFER);
 }
 static void devm_usb_phy_release(struct device *dev, void *res)
@@ -190,10 +193,13 @@ struct usb_phy *devm_usb_get_phy_by_phandle(struct device *dev,
        spin_lock_irqsave(&phy_lock, flags);
        phy = __of_usb_find_phy(node);
-        if (IS_ERR(phy) || !try_module_get(phy->dev->driver->owner)) {
+        if (IS_ERR(phy)) {
-                if (!IS_ERR(phy))
+                devres_free(ptr);
-                        phy = ERR_PTR(-EPROBE_DEFER);
+                goto err1;
+        }
+        if (!try_module_get(phy->dev->driver->owner)) {
+                phy = ERR_PTR(-ENODEV);
                devres_free(ptr);
                goto err1;
        }
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index 8d7fc48b1f30..29fa1c3d0089 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -46,6 +46,8 @@ static struct console usbcons;
 * ------------------------------------------------------------
 */
+static const struct tty_operations usb_console_fake_tty_ops = {
+};
 /*
 * The parsing of the command line works exactly like the
@@ -137,13 +139,17 @@ static int usb_console_setup(struct console *co, char *options)
                                goto reset_open_count;
                        }
                        kref_init(&tty->kref);
-                        tty_port_tty_set(&port->port, tty);
                        tty->driver = usb_serial_tty_driver;
                        tty->index = co->index;
+                        init_ldsem(&tty->ldisc_sem);
+                        INIT_LIST_HEAD(&tty->tty_files);
+                        kref_get(&tty->driver->kref);
+                        tty->ops = &usb_console_fake_tty_ops;
                        if (tty_init_termios(tty)) {
                                retval = -ENOMEM;
-                                goto free_tty;
+                                goto put_tty;
                        }
+                        tty_port_tty_set(&port->port, tty);
                }
                /* only call the device specific open if this
@@ -161,7 +167,7 @@ static int usb_console_setup(struct console *co, char *options)
                        serial->type->set_termios(tty, port, &dummy);
                        tty_port_tty_set(&port->port, NULL);
-                        kfree(tty);
+                        tty_kref_put(tty);
                }
                set_bit(ASYNCB_INITIALIZED, &port->port.flags);
        }
@@ -177,8 +183,8 @@ static int usb_console_setup(struct console *co, char *options)
 fail:
        tty_port_tty_set(&port->port, NULL);
- free_tty:
+ put_tty:
-        kfree(tty);
+        tty_kref_put(tty);
 reset_open_count:
        port->port.count = 0;
        usb_autopm_put_interface(serial->interface);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 6c4eb3cf5efd..f4c56fc1a9f6 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -120,10 +120,12 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
        { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
        { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
-        { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */
+        { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */
+        { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */
        { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
        { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
        { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+        { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
        { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 1bd192290b08..ccf1df7c4b80 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -286,7 +286,7 @@ static int usb_serial_generic_submit_read_urb(struct usb_serial_port *port,
        res = usb_submit_urb(port->read_urbs[index], mem_flags);
        if (res) {
-                if (res != -EPERM) {
+                if (res != -EPERM && res != -ENODEV) {
                        dev_err(&port->dev,
                                        "%s - usb_submit_urb failed: %d\n",
                                        __func__, res);
@@ -373,7 +373,7 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
                                                        __func__, urb->status);
                return;
        default:
-                dev_err(&port->dev, "%s - nonzero urb status: %d\n",
+                dev_dbg(&port->dev, "%s - nonzero urb status: %d\n",
                                                        __func__, urb->status);
                goto resubmit;
        }
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 077c714f1285..e07b15ed5814 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -410,6 +410,8 @@ static void	usa26_instat_callback(struct urb *urb)
        }
        port = serial->port[msg->port];
        p_priv = usb_get_serial_port_data(port);
+        if (!p_priv)
+                goto resubmit;
        /* Update handshaking pin state information */
        old_dcd_state = p_priv->dcd_state;
@@ -420,7 +422,7 @@ static void	usa26_instat_callback(struct urb *urb)
        if (old_dcd_state != p_priv->dcd_state)
                tty_port_tty_hangup(&port->port, true);
+resubmit:
        /* Resubmit urb so we continue receiving */
        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (err != 0)
@@ -527,6 +529,8 @@ static void	usa28_instat_callback(struct urb *urb)
        }
        port = serial->port[msg->port];
        p_priv = usb_get_serial_port_data(port);
+        if (!p_priv)
+                goto resubmit;
        /* Update handshaking pin state information */
        old_dcd_state = p_priv->dcd_state;
@@ -537,7 +541,7 @@ static void	usa28_instat_callback(struct urb *urb)
        if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
                tty_port_tty_hangup(&port->port, true);
+resubmit:
                /* Resubmit urb so we continue receiving */
        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (err != 0)
@@ -607,6 +611,8 @@ static void	usa49_instat_callback(struct urb *urb)
        }
        port = serial->port[msg->portNumber];
        p_priv = usb_get_serial_port_data(port);
+        if (!p_priv)
+                goto resubmit;
        /* Update handshaking pin state information */
        old_dcd_state = p_priv->dcd_state;
@@ -617,7 +623,7 @@ static void	usa49_instat_callback(struct urb *urb)
        if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
                tty_port_tty_hangup(&port->port, true);
+resubmit:
        /* Resubmit urb so we continue receiving */
        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (err != 0)
@@ -855,6 +861,8 @@ static void	usa90_instat_callback(struct urb *urb)
        port = serial->port[0];
        p_priv = usb_get_serial_port_data(port);
+        if (!p_priv)
+                goto resubmit;
        /* Update handshaking pin state information */
        old_dcd_state = p_priv->dcd_state;
@@ -865,7 +873,7 @@ static void	usa90_instat_callback(struct urb *urb)
        if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
                tty_port_tty_hangup(&port->port, true);
+resubmit:
        /* Resubmit urb so we continue receiving */
        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (err != 0)
@@ -926,6 +934,8 @@ static void	usa67_instat_callback(struct urb *urb)
        port = serial->port[msg->port];
        p_priv = usb_get_serial_port_data(port);
+        if (!p_priv)
+                goto resubmit;
        /* Update handshaking pin state information */
        old_dcd_state = p_priv->dcd_state;
@@ -934,7 +944,7 @@ static void	usa67_instat_callback(struct urb *urb)
        if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
                tty_port_tty_hangup(&port->port, true);
+resubmit:
        /* Resubmit urb so we continue receiving */
        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (err != 0)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 7a4c21b4f676..efdcee15b520 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -234,6 +234,8 @@ static void option_instat_callback(struct urb *urb);
 #define QUALCOMM_VENDOR_ID                      0x05C6
+#define SIERRA_VENDOR_ID                        0x1199
 #define CMOTECH_VENDOR_ID                       0x16d8
 #define CMOTECH_PRODUCT_6001                    0x6001
 #define CMOTECH_PRODUCT_CMU_300                 0x6002
@@ -512,7 +514,7 @@ enum option_blacklist_reason {
                OPTION_BLACKLIST_RESERVED_IF = 2
 };
-#define MAX_BL_NUM  8
+#define MAX_BL_NUM  11
 struct option_blacklist_info {
        /* bitfield of interface numbers for OPTION_BLACKLIST_SENDSETUP */
        const unsigned long sendsetup;
@@ -601,6 +603,11 @@ static const struct option_blacklist_info telit_le920_blacklist = {
        .reserved = BIT(1) | BIT(5),
 };
+static const struct option_blacklist_info sierra_mc73xx_blacklist = {
+        .sendsetup = BIT(0) | BIT(2),
+        .reserved = BIT(8) | BIT(10) | BIT(11),
+};
 static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -1098,6 +1105,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+        { USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x68c0, 0xff),
+          .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC73xx */
        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index cb3e14780a7e..9c63897b3a56 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -142,7 +142,6 @@ static const struct usb_device_id id_table[] = {
        {DEVICE_SWI(0x0f3d, 0x68a2)},   /* Sierra Wireless MC7700 */
        {DEVICE_SWI(0x114f, 0x68a2)},   /* Sierra Wireless MC7750 */
        {DEVICE_SWI(0x1199, 0x68a2)},   /* Sierra Wireless MC7710 */
-        {DEVICE_SWI(0x1199, 0x68c0)},   /* Sierra Wireless MC73xx */
        {DEVICE_SWI(0x1199, 0x901c)},   /* Sierra Wireless EM7700 */
        {DEVICE_SWI(0x1199, 0x901f)},   /* Sierra Wireless EM7355 */
        {DEVICE_SWI(0x1199, 0x9040)},   /* Sierra Wireless Modem */
diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h
index 8a6f371ed6e7..9893d696fc97 100644
--- a/drivers/usb/storage/uas-detect.h
+++ b/drivers/usb/storage/uas-detect.h
@@ -69,16 +69,39 @@ static int uas_use_uas_driver(struct usb_interface *intf,
                return 0;
        /*
-         * ASM1051 and older ASM1053 devices have the same usb-id, and UAS is
+         * ASMedia has a number of usb3 to sata bridge chips, at the time of
-         * broken on the ASM1051, use the number of streams to differentiate.
+         * this writing the following versions exist:
-         * New ASM1053-s also support 32 streams, but have a different prod-id.
+         * ASM1051 - no uas support version
+         * ASM1051 - with broken (*) uas support
+         * ASM1053 - with working uas support
+         * ASM1153 - with working uas support
+         *
+         * Devices with these chips re-use a number of device-ids over the
+         * entire line, so the device-id is useless to determine if we're
+         * dealing with an ASM1051 (which we want to avoid).
+         *
+         * The ASM1153 can be identified by config.MaxPower == 0,
+         * where as the ASM105x models have config.MaxPower == 36.
+         *
+         * Differentiating between the ASM1053 and ASM1051 is trickier, when
+         * connected over USB-3 we can look at the number of streams supported,
+         * ASM1051 supports 32 streams, where as early ASM1053 versions support
+         * 16 streams, newer ASM1053-s also support 32 streams, but have a
+         * different prod-id.
+         *
+         * (*) ASM1051 chips do work with UAS with some disks (with the
+         *     US_FL_NO_REPORT_OPCODES quirk), but are broken with other disks
         */
        if (le16_to_cpu(udev->descriptor.idVendor) == 0x174c &&
-                        le16_to_cpu(udev->descriptor.idProduct) == 0x55aa) {
+                        (le16_to_cpu(udev->descriptor.idProduct) == 0x5106 ||
-                if (udev->speed < USB_SPEED_SUPER) {
+                         le16_to_cpu(udev->descriptor.idProduct) == 0x55aa)) {
+                if (udev->actconfig->desc.bMaxPower == 0) {
+                        /* ASM1153, do nothing */
+                } else if (udev->speed < USB_SPEED_SUPER) {
                        /* No streams info, assume ASM1051 */
                        flags |= US_FL_IGNORE_UAS;
                } else if (usb_ss_max_streams(&eps[1]->ss_ep_comp) == 32) {
+                        /* Possibly an ASM1051, disable uas */
                        flags |= US_FL_IGNORE_UAS;
                }
        }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 11c7a9676441..d684b4b8108f 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -507,7 +507,7 @@ UNUSUAL_DEV(  0x04e6, 0x000c, 0x0100, 0x0100,
 UNUSUAL_DEV(  0x04e6, 0x000f, 0x0000, 0x9999,
                "SCM Microsystems",
                "eUSB SCSI Adapter (Bus Powered)",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
+                USB_SC_SCSI, USB_PR_BULK, usb_stor_euscsi_init,
                US_FL_SCM_MULT_TARG ),
 UNUSUAL_DEV(  0x04e6, 0x0101, 0x0200, 0x0200,
@@ -1995,6 +1995,13 @@ UNUSUAL_DEV(  0x152d, 0x2329, 0x0100, 0x0100,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+/* Reported by Dmitry Nezhevenko <dion@dion.org.ua> */
+UNUSUAL_DEV(  0x152d, 0x2566, 0x0114, 0x0114,
+                "JMicron",
+                "USB to ATA/ATAPI Bridge",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA ),
 /* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
 * and Mac USB Dock USB-SCSI */
 UNUSUAL_DEV(  0x1645, 0x0007, 0x0100, 0x0133,
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 18a283d6de1c..dbc00e56c7f5 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -40,6 +40,16 @@
 * and don't forget to CC: the USB development list <linux-usb@vger.kernel.org>
 */
+/*
+ * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI
+ * commands in UAS mode.  Observed with the 1.28 firmware; are there others?
+ */
+UNUSUAL_DEV(0x0984, 0x0301, 0x0128, 0x0128,
+                "Apricorn",
+                "",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_UAS),
 /* https://bugzilla.kernel.org/show_bug.cgi?id=79511 */
 UNUSUAL_DEV(0x0bc2, 0x2312, 0x0000, 0x9999,
                "Seagate",
@@ -68,6 +78,20 @@ UNUSUAL_DEV(0x0bc2, 0xa003, 0x0000, 0x9999,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_NO_ATA_1X),
+/* Reported-by: Marcin Zajączkowski <mszpak@wp.pl> */
+UNUSUAL_DEV(0x0bc2, 0xa013, 0x0000, 0x9999,
+                "Seagate",
+                "Backup Plus",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV(0x0bc2, 0xa0a4, 0x0000, 0x9999,
+                "Seagate",
+                "Backup Plus Desk",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
 /* https://bbs.archlinux.org/viewtopic.php?id=183190 */
 UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999,
                "Seagate",
@@ -82,6 +106,13 @@ UNUSUAL_DEV(0x0bc2, 0xab21, 0x0000, 0x9999,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_NO_ATA_1X),
+/* Reported-by: G. Richard Bellamy <rbellamy@pteradigm.com> */
+UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
+                "Seagate",
+                "BUP Fast HDD",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
 /* Reported-by: Claudio Bizzarri <claudio.bizzarri@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                "JMicron",
@@ -89,14 +120,6 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_NO_REPORT_OPCODES),
-/* Most ASM1051 based devices have issues with uas, blacklist them all */
-/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
-UNUSUAL_DEV(0x174c, 0x5106, 0x0000, 0x9999,
-                "ASMedia",
-                "ASM1051",
-                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-                US_FL_IGNORE_UAS),
 /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
 UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
                "VIA",
@@ -104,9 +127,23 @@ UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_NO_ATA_1X),
+/* Reported-by: Takeo Nakayama <javhera@gmx.com> */
+UNUSUAL_DEV(0x357d, 0x7788, 0x0000, 0x9999,
+                "JMicron",
+                "JMS566",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_REPORT_OPCODES),
 /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
 UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x9999,
                "Hitachi",
                "External HDD",
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_IGNORE_UAS),
+/* Reported-by: Richard Henderson <rth@redhat.com> */
+UNUSUAL_DEV(0x4971, 0x8017, 0x0000, 0x9999,
+                "SimpleTech",
+                "External HDD",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_REPORT_OPCODES),
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 255201f22126..7cc0122a18ce 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -840,13 +840,11 @@ static const struct vfio_device_ops vfio_pci_ops = {
 static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
-        u8 type;
        struct vfio_pci_device *vdev;
        struct iommu_group *group;
        int ret;
-        pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type);
+        if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
-        if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL)
                return -EINVAL;
        group = iommu_group_get(&pdev->dev);
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 14419a8ccbb6..9484d5652ca5 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -538,7 +538,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
                ++headcount;
                seg += in;
        }
-        heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen);
+        heads[headcount - 1].len = cpu_to_vhost32(vq, len + datalen);
        *iovcount = seg;
        if (unlikely(log))
                *log_num = nlogs;
@@ -650,8 +650,10 @@ static void handle_rx(struct vhost_net *net)
                        break;
                }
                /* TODO: Should check and handle checksum. */
+                hdr.num_buffers = cpu_to_vhost16(vq, headcount);
                if (likely(mergeable) &&
-                    memcpy_toiovecend(nvq->hdr, (unsigned char *)&headcount,
+                    memcpy_toiovecend(nvq->hdr, (void *)&hdr.num_buffers,
                                      offsetof(typeof(hdr), num_buffers),
                                      sizeof hdr.num_buffers)) {
                        vq_err(vq, "Failed num_buffers write");
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 01c01cb3933f..d695b1673ae5 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -911,6 +911,23 @@ vhost_scsi_map_iov_to_prot(struct tcm_vhost_cmd *cmd,
        return 0;
 }
+static int vhost_scsi_to_tcm_attr(int attr)
+{
+        switch (attr) {
+        case VIRTIO_SCSI_S_SIMPLE:
+                return TCM_SIMPLE_TAG;
+        case VIRTIO_SCSI_S_ORDERED:
+                return TCM_ORDERED_TAG;
+        case VIRTIO_SCSI_S_HEAD:
+                return TCM_HEAD_TAG;
+        case VIRTIO_SCSI_S_ACA:
+                return TCM_ACA_TAG;
+        default:
+                break;
+        }
+        return TCM_SIMPLE_TAG;
+}
 static void tcm_vhost_submission_work(struct work_struct *work)
 {
        struct tcm_vhost_cmd *cmd =
@@ -936,9 +953,10 @@ static void tcm_vhost_submission_work(struct work_struct *work)
        rc = target_submit_cmd_map_sgls(se_cmd, tv_nexus->tvn_se_sess,
                        cmd->tvc_cdb, &cmd->tvc_sense_buf[0],
                        cmd->tvc_lun, cmd->tvc_exp_data_len,
-                        cmd->tvc_task_attr, cmd->tvc_data_direction,
+                        vhost_scsi_to_tcm_attr(cmd->tvc_task_attr),
-                        TARGET_SCF_ACK_KREF, sg_ptr, cmd->tvc_sgl_count,
+                        cmd->tvc_data_direction, TARGET_SCF_ACK_KREF,
-                        NULL, 0, sg_prot_ptr, cmd->tvc_prot_sgl_count);
+                        sg_ptr, cmd->tvc_sgl_count, NULL, 0, sg_prot_ptr,
+                        cmd->tvc_prot_sgl_count);
        if (rc < 0) {
                transport_send_check_condition_and_sense(se_cmd,
                                TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE, 0);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index ed71b5347a76..cb807d0ea498 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -713,9 +713,13 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp)
                        r = -EFAULT;
                        break;
                }
-                if ((a.avail_user_addr & (sizeof *vq->avail->ring - 1)) ||
-                    (a.used_user_addr & (sizeof *vq->used->ring - 1)) ||
+                /* Make sure it's safe to cast pointers to vring types. */
-                    (a.log_guest_addr & (sizeof *vq->used->ring - 1))) {
+                BUILD_BUG_ON(__alignof__ *vq->avail > VRING_AVAIL_ALIGN_SIZE);
+                BUILD_BUG_ON(__alignof__ *vq->used > VRING_USED_ALIGN_SIZE);
+                if ((a.avail_user_addr & (VRING_AVAIL_ALIGN_SIZE - 1)) ||
+                    (a.used_user_addr & (VRING_USED_ALIGN_SIZE - 1)) ||
+                    (a.log_guest_addr & (sizeof(u64) - 1))) {
                        r = -EINVAL;
                        break;
                }
diff --git a/drivers/video/fbdev/broadsheetfb.c b/drivers/video/fbdev/broadsheetfb.c
index 1c29bd19e3d5..0e5fde1d3ffb 100644
--- a/drivers/video/fbdev/broadsheetfb.c
+++ b/drivers/video/fbdev/broadsheetfb.c
@@ -636,7 +636,7 @@ static int broadsheet_spiflash_rewrite_sector(struct broadsheetfb_par *par,
                err = broadsheet_spiflash_read_range(par, start_sector_addr,
                                                data_start_addr, sector_buffer);
                if (err)
-                        return err;
+                        goto out;
        }
        /* now we copy our data into the right place in the sector buffer */
@@ -657,7 +657,7 @@ static int broadsheet_spiflash_rewrite_sector(struct broadsheetfb_par *par,
                err = broadsheet_spiflash_read_range(par, tail_start_addr,
                        tail_len, sector_buffer + tail_start_addr);
                if (err)
-                        return err;
+                        goto out;
        }
        /* if we got here we have the full sector that we want to rewrite. */
@@ -665,11 +665,13 @@ static int broadsheet_spiflash_rewrite_sector(struct broadsheetfb_par *par,
        /* first erase the sector */
        err = broadsheet_spiflash_erase_sector(par, start_sector_addr);
        if (err)
-                return err;
+                goto out;
        /* now write it */
        err = broadsheet_spiflash_write_sector(par, start_sector_addr,
                                        sector_buffer, sector_size);
+out:
+        kfree(sector_buffer);
        return err;
 }
diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c
index 900aa4ecd617..d6cab1fd9a47 100644
--- a/drivers/video/fbdev/core/fb_defio.c
+++ b/drivers/video/fbdev/core/fb_defio.c
@@ -83,9 +83,10 @@ int fb_deferred_io_fsync(struct file *file, loff_t start, loff_t end, int datasy
        cancel_delayed_work_sync(&info->deferred_work);
        /* Run it immediately */
-        err = schedule_delayed_work(&info->deferred_work, 0);
+        schedule_delayed_work(&info->deferred_work, 0);
        mutex_unlock(&inode->i_mutex);
-        return err;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(fb_deferred_io_fsync);
diff --git a/drivers/video/fbdev/omap2/dss/hdmi_pll.c b/drivers/video/fbdev/omap2/dss/hdmi_pll.c
index 87accdb59c81..ac83ef5cfd7d 100644
--- a/drivers/video/fbdev/omap2/dss/hdmi_pll.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi_pll.c
@@ -132,7 +132,6 @@ static const struct dss_pll_hw dss_omap4_hdmi_pll_hw = {
        .mX_max = 127,
        .fint_min = 500000,
        .fint_max = 2500000,
-        .clkdco_max = 1800000000,
        .clkdco_min = 500000000,
        .clkdco_low = 1000000000,
@@ -156,7 +155,6 @@ static const struct dss_pll_hw dss_omap5_hdmi_pll_hw = {
        .mX_max = 127,
        .fint_min = 620000,
        .fint_max = 2500000,
-        .clkdco_max = 1800000000,
        .clkdco_min = 750000000,
        .clkdco_low = 1500000000,
diff --git a/drivers/video/fbdev/omap2/dss/pll.c b/drivers/video/fbdev/omap2/dss/pll.c
index 50bc62c5d367..335ffac224b9 100644
--- a/drivers/video/fbdev/omap2/dss/pll.c
+++ b/drivers/video/fbdev/omap2/dss/pll.c
@@ -97,7 +97,8 @@ int dss_pll_enable(struct dss_pll *pll)
        return 0;
 err_enable:
-        regulator_disable(pll->regulator);
+        if (pll->regulator)
+                regulator_disable(pll->regulator);
 err_reg:
        clk_disable_unprepare(pll->clkin);
        return r;
diff --git a/drivers/video/fbdev/omap2/dss/sdi.c b/drivers/video/fbdev/omap2/dss/sdi.c
index d51a983075bc..5c2ccab5a958 100644
--- a/drivers/video/fbdev/omap2/dss/sdi.c
+++ b/drivers/video/fbdev/omap2/dss/sdi.c
@@ -342,6 +342,8 @@ static void sdi_init_output(struct platform_device *pdev)
        out->output_type = OMAP_DISPLAY_TYPE_SDI;
        out->name = "sdi.0";
        out->dispc_channel = OMAP_DSS_CHANNEL_LCD;
+        /* We have SDI only on OMAP3, where it's on port 1 */
+        out->port_num = 1;
        out->ops.sdi = &sdi_ops;
        out->owner = THIS_MODULE;
diff --git a/drivers/video/fbdev/simplefb.c b/drivers/video/fbdev/simplefb.c
index 92cac803dee3..1085c0432158 100644
--- a/drivers/video/fbdev/simplefb.c
+++ b/drivers/video/fbdev/simplefb.c
@@ -402,7 +402,7 @@ static int __init simplefb_init(void)
        if (ret)
                return ret;
-        if (IS_ENABLED(CONFIG_OF) && of_chosen) {
+        if (IS_ENABLED(CONFIG_OF_ADDRESS) && of_chosen) {
                for_each_child_of_node(of_chosen, np) {
                        if (of_device_is_compatible(np, "simple-framebuffer"))
                                of_platform_device_create(np, NULL, NULL);
diff --git a/drivers/video/logo/logo.c b/drivers/video/logo/logo.c
index 940cd196eef5..10fbfd8ab963 100644
--- a/drivers/video/logo/logo.c
+++ b/drivers/video/logo/logo.c
@@ -21,6 +21,21 @@ static bool nologo;
 module_param(nologo, bool, 0);
 MODULE_PARM_DESC(nologo, "Disables startup logo");
+/*
+ * Logos are located in the initdata, and will be freed in kernel_init.
+ * Use late_init to mark the logos as freed to prevent any further use.
+ */
+static bool logos_freed;
+static int __init fb_logo_late_init(void)
+{
+        logos_freed = true;
+        return 0;
+}
+late_initcall(fb_logo_late_init);
 /* logo's are marked __initdata. Use __init_refok to tell
 * modpost that it is intended that this function uses data
 * marked __initdata.
@@ -29,7 +44,7 @@ const struct linux_logo * __init_refok fb_find_logo(int depth)
 {
        const struct linux_logo *logo = NULL;
-        if (nologo)
+        if (nologo || logos_freed)
                return NULL;
        if (depth >= 1) {
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 2ef9529809d8..9756f21b809e 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -282,6 +282,7 @@ void vp_del_vqs(struct virtio_device *vdev)
        vp_free_vectors(vdev);
        kfree(vp_dev->vqs);
+        vp_dev->vqs = NULL;
 }
 static int vp_try_to_find_vqs(struct virtio_device *vdev, unsigned nvqs,
@@ -421,15 +422,6 @@ int vp_set_vq_affinity(struct virtqueue *vq, int cpu)
        return 0;
 }
-void virtio_pci_release_dev(struct device *_d)
-{
-        /*
-         * No need for a release method as we allocate/free
-         * all devices together with the pci devices.
-         * Provide an empty one to avoid getting a warning from core.
-         */
-}
 #ifdef CONFIG_PM_SLEEP
 static int virtio_pci_freeze(struct device *dev)
 {
diff --git a/drivers/virtio/virtio_pci_common.h b/drivers/virtio/virtio_pci_common.h
index adddb647b21d..5a497289b7e9 100644
--- a/drivers/virtio/virtio_pci_common.h
+++ b/drivers/virtio/virtio_pci_common.h
@@ -126,7 +126,6 @@ const char *vp_bus_name(struct virtio_device *vdev);
 * - ignore the affinity request if we're using INTX
 */
 int vp_set_vq_affinity(struct virtqueue *vq, int cpu);
-void virtio_pci_release_dev(struct device *);
 int virtio_pci_legacy_probe(struct pci_dev *pci_dev,
                            const struct pci_device_id *id);
diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
index 6c76f0f5658c..a5486e65e04b 100644
--- a/drivers/virtio/virtio_pci_legacy.c
+++ b/drivers/virtio/virtio_pci_legacy.c
@@ -211,6 +211,17 @@ static const struct virtio_config_ops virtio_pci_config_ops = {
        .set_vq_affinity = vp_set_vq_affinity,
 };
+static void virtio_pci_release_dev(struct device *_d)
+{
+        struct virtio_device *vdev = dev_to_virtio(_d);
+        struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+        /* As struct device is a kobject, it's not safe to
+         * free the memory (including the reference counter itself)
+         * until it's release callback. */
+        kfree(vp_dev);
+}
 /* the PCI probing function */
 int virtio_pci_legacy_probe(struct pci_dev *pci_dev,
                            const struct pci_device_id *id)
@@ -302,5 +313,4 @@ void virtio_pci_legacy_remove(struct pci_dev *pci_dev)
        pci_iounmap(pci_dev, vp_dev->ioaddr);
        pci_release_regions(pci_dev);
        pci_disable_device(pci_dev);
-        kfree(vp_dev);
 }
diff --git a/drivers/watchdog/cadence_wdt.c b/drivers/watchdog/cadence_wdt.c
index 5927c0a98a74..bcfd2a22208f 100644
--- a/drivers/watchdog/cadence_wdt.c
+++ b/drivers/watchdog/cadence_wdt.c
@@ -503,7 +503,6 @@ static struct platform_driver cdns_wdt_driver = {
        .shutdown       = cdns_wdt_shutdown,
        .driver         = {
                .name   = "cdns-wdt",
-                .owner  = THIS_MODULE,
                .of_match_table = cdns_wdt_of_match,
                .pm     = &cdns_wdt_pm_ops,
        },
diff --git a/drivers/watchdog/imx2_wdt.c b/drivers/watchdog/imx2_wdt.c
index d6add516a7a7..5142bbabe027 100644
--- a/drivers/watchdog/imx2_wdt.c
+++ b/drivers/watchdog/imx2_wdt.c
@@ -52,6 +52,8 @@
 #define IMX2_WDT_WRSR           0x04            /* Reset Status Register */
 #define IMX2_WDT_WRSR_TOUT      (1 << 1)        /* -> Reset due to Timeout */
+#define IMX2_WDT_WMCR           0x08            /* Misc Register */
 #define IMX2_WDT_MAX_TIME       128
 #define IMX2_WDT_DEFAULT_TIME   60              /* in seconds */
@@ -274,6 +276,13 @@ static int __init imx2_wdt_probe(struct platform_device *pdev)
        imx2_wdt_ping_if_active(wdog);
+        /*
+         * Disable the watchdog power down counter at boot. Otherwise the power
+         * down counter will pull down the #WDOG interrupt line for one clock
+         * cycle.
+         */
+        regmap_write(wdev->regmap, IMX2_WDT_WMCR, 0);
        ret = watchdog_register_device(wdog);
        if (ret) {
                dev_err(&pdev->dev, "cannot register watchdog device\n");
@@ -327,18 +336,21 @@ static void imx2_wdt_shutdown(struct platform_device *pdev)
 }
 #ifdef CONFIG_PM_SLEEP
-/* Disable watchdog if it is active during suspend */
+/* Disable watchdog if it is active or non-active but still running */
 static int imx2_wdt_suspend(struct device *dev)
 {
        struct watchdog_device *wdog = dev_get_drvdata(dev);
        struct imx2_wdt_device *wdev = watchdog_get_drvdata(wdog);
-        imx2_wdt_set_timeout(wdog, IMX2_WDT_MAX_TIME);
+        /* The watchdog IP block is running */
-        imx2_wdt_ping(wdog);
+        if (imx2_wdt_is_running(wdev)) {
+                imx2_wdt_set_timeout(wdog, IMX2_WDT_MAX_TIME);
+                imx2_wdt_ping(wdog);
-        /* Watchdog has been stopped but IP block is still running */
+                /* The watchdog is not active */
-        if (!watchdog_active(wdog) && imx2_wdt_is_running(wdev))
+                if (!watchdog_active(wdog))
-                del_timer_sync(&wdev->timer);
+                        del_timer_sync(&wdev->timer);
+        }
        clk_disable_unprepare(wdev->clk);
@@ -354,15 +366,25 @@ static int imx2_wdt_resume(struct device *dev)
        clk_prepare_enable(wdev->clk);
        if (watchdog_active(wdog) && !imx2_wdt_is_running(wdev)) {
-                /* Resumes from deep sleep we need restart
+                /*
-                 * the watchdog again.
+                 * If the watchdog is still active and resumes
+                 * from deep sleep state, need to restart the
+                 * watchdog again.
                 */
                imx2_wdt_setup(wdog);
                imx2_wdt_set_timeout(wdog, wdog->timeout);
                imx2_wdt_ping(wdog);
        } else if (imx2_wdt_is_running(wdev)) {
+                /* Resuming from non-deep sleep state. */
+                imx2_wdt_set_timeout(wdog, wdog->timeout);
                imx2_wdt_ping(wdog);
-                mod_timer(&wdev->timer, jiffies + wdog->timeout * HZ / 2);
+                /*
+                 * But the watchdog is not active, then start
+                 * the timer again.
+                 */
+                if (!watchdog_active(wdog))
+                        mod_timer(&wdev->timer,
+                                  jiffies + wdog->timeout * HZ / 2);
        }
        return 0;
diff --git a/drivers/watchdog/meson_wdt.c b/drivers/watchdog/meson_wdt.c
index ef6a298e8c45..1f4155ee3404 100644
--- a/drivers/watchdog/meson_wdt.c
+++ b/drivers/watchdog/meson_wdt.c
@@ -215,7 +215,6 @@ static struct platform_driver meson_wdt_driver = {
        .remove         = meson_wdt_remove,
        .shutdown       = meson_wdt_shutdown,
        .driver         = {
-                .owner          = THIS_MODULE,
                .name           = DRV_NAME,
                .of_match_table = meson_wdt_dt_ids,
        },
diff --git a/fs/Kconfig b/fs/Kconfig
index 664991afe0c0..a6bb530b1ec5 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -165,6 +165,7 @@ config HUGETLB_PAGE
        def_bool HUGETLBFS
 source "fs/configfs/Kconfig"
+source "fs/efivarfs/Kconfig"
 endmenu
@@ -209,7 +210,6 @@ source "fs/sysv/Kconfig"
 source "fs/ufs/Kconfig"
 source "fs/exofs/Kconfig"
 source "fs/f2fs/Kconfig"
-source "fs/efivarfs/Kconfig"
 endif # MISC_FILESYSTEMS
diff --git a/fs/aio.c b/fs/aio.c
index 1b7893ecc296..c428871f1093 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1140,6 +1140,13 @@ static long aio_read_events_ring(struct kioctx *ctx,
        long ret = 0;
        int copy_ret;
+        /*
+         * The mutex can block and wake us up and that will cause
+         * wait_event_interruptible_hrtimeout() to schedule without sleeping
+         * and repeat. This should be rare enough that it doesn't cause
+         * peformance issues. See the comment in read_events() for more detail.
+         */
+        sched_annotate_sleep();
        mutex_lock(&ctx->ring_lock);
        /* Access to ->ring_pages here is protected by ctx->ring_lock. */
diff --git a/fs/btrfs/Kconfig b/fs/btrfs/Kconfig
index a66768ebc8d1..80e9c18ea64f 100644
--- a/fs/btrfs/Kconfig
+++ b/fs/btrfs/Kconfig
@@ -8,6 +8,7 @@ config BTRFS_FS
        select LZO_DECOMPRESS
        select RAID6_PQ
        select XOR_BLOCKS
+        select SRCU
        help
          Btrfs is a general purpose copy-on-write filesystem with extents,
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 2d3e32ebfd15..8729cf68d2fe 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1552,7 +1552,6 @@ int tree_backref_for_extent(unsigned long *ptr, struct extent_buffer *eb,
 {
        int ret;
        int type;
-        struct btrfs_tree_block_info *info;
        struct btrfs_extent_inline_ref *eiref;
        if (*ptr == (unsigned long)-1)
@@ -1573,9 +1572,17 @@ int tree_backref_for_extent(unsigned long *ptr, struct extent_buffer *eb,
        }
        /* we can treat both ref types equally here */
-        info = (struct btrfs_tree_block_info *)(ei + 1);
        *out_root = btrfs_extent_inline_ref_offset(eb, eiref);
-        *out_level = btrfs_tree_block_level(eb, info);
+        if (key->type == BTRFS_EXTENT_ITEM_KEY) {
+                struct btrfs_tree_block_info *info;
+                info = (struct btrfs_tree_block_info *)(ei + 1);
+                *out_level = btrfs_tree_block_level(eb, info);
+        } else {
+                ASSERT(key->type == BTRFS_METADATA_ITEM_KEY);
+                *out_level = (u8)key->offset;
+        }
        if (ret == 1)
                *ptr = (unsigned long)-1;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 7e607416755a..0b180708bf79 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1171,6 +1171,7 @@ struct btrfs_space_info {
        struct percpu_counter total_bytes_pinned;
        struct list_head list;
+        /* Protected by the spinlock 'lock'. */
        struct list_head ro_bgs;
        struct rw_semaphore groups_sem;
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 054577bddaf2..de4e70fb3cbb 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -1857,6 +1857,14 @@ int btrfs_delayed_delete_inode_ref(struct inode *inode)
 {
        struct btrfs_delayed_node *delayed_node;
+        /*
+         * we don't do delayed inode updates during log recovery because it
+         * leads to enospc problems.  This means we also can't do
+         * delayed inode refs
+         */
+        if (BTRFS_I(inode)->root->fs_info->log_root_recovering)
+                return -EAGAIN;
        delayed_node = btrfs_get_or_create_delayed_node(inode);
        if (IS_ERR(delayed_node))
                return PTR_ERR(delayed_node);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index a80b97100d90..a684086c3c81 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3139,9 +3139,11 @@ static int write_one_cache_group(struct btrfs_trans_handle *trans,
        struct extent_buffer *leaf;
        ret = btrfs_search_slot(trans, extent_root, &cache->key, path, 0, 1);
-        if (ret < 0)
+        if (ret) {
+                if (ret > 0)
+                        ret = -ENOENT;
                goto fail;
-        BUG_ON(ret); /* Corruption */
+        }
        leaf = path->nodes[0];
        bi = btrfs_item_ptr_offset(leaf, path->slots[0]);
@@ -3149,11 +3151,9 @@ static int write_one_cache_group(struct btrfs_trans_handle *trans,
        btrfs_mark_buffer_dirty(leaf);
        btrfs_release_path(path);
 fail:
-        if (ret) {
+        if (ret)
                btrfs_abort_transaction(trans, root, ret);
-                return ret;
+        return ret;
-        }
-        return 0;
 }
@@ -9422,7 +9422,6 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
         * are still on the list after taking the semaphore
         */
        list_del_init(&block_group->list);
-        list_del_init(&block_group->ro_list);
        if (list_empty(&block_group->space_info->block_groups[index])) {
                kobj = block_group->space_info->block_group_kobjs[index];
                block_group->space_info->block_group_kobjs[index] = NULL;
@@ -9464,6 +9463,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
        btrfs_remove_free_space_cache(block_group);
        spin_lock(&block_group->space_info->lock);
+        list_del_init(&block_group->ro_list);
        block_group->space_info->total_bytes -= block_group->key.offset;
        block_group->space_info->bytes_readonly -= block_group->key.offset;
        block_group->space_info->disk_total -= block_group->key.offset * factor;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 4ebabd237153..790dbae3343c 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2190,7 +2190,7 @@ void btrfs_free_io_failure_record(struct inode *inode, u64 start, u64 end)
                next = next_state(state);
-                failrec = (struct io_failure_record *)state->private;
+                failrec = (struct io_failure_record *)(unsigned long)state->private;
                free_extent_state(state);
                kfree(failrec);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index e687bb0dc73a..8bf326affb94 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6255,8 +6255,10 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
 out_fail:
        btrfs_end_transaction(trans, root);
-        if (drop_on_err)
+        if (drop_on_err) {
+                inode_dec_link_count(inode);
                iput(inode);
+        }
        btrfs_balance_delayed_items(root);
        btrfs_btree_balance_dirty(root);
        return err;
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index f2bb13a23f86..e427cb7ee12c 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -2607,9 +2607,9 @@ static int scrub_extent_for_parity(struct scrub_parity *sparity,
                ret = scrub_pages_for_parity(sparity, logical, l, physical, dev,
                                             flags, gen, mirror_num,
                                             have_csum ? csum : NULL);
-skip:
                if (ret)
                        return ret;
+skip:
                len -= l;
                logical += l;
                physical += l;
@@ -3053,7 +3053,7 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
        ppath = btrfs_alloc_path();
        if (!ppath) {
-                btrfs_free_path(ppath);
+                btrfs_free_path(path);
                return -ENOMEM;
        }
@@ -3065,6 +3065,8 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
        path->search_commit_root = 1;
        path->skip_locking = 1;
+        ppath->search_commit_root = 1;
+        ppath->skip_locking = 1;
        /*
         * trigger the readahead for extent tree csum tree and wait for
         * completion. During readahead, the scrub is officially paused
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 60f7cbe815e9..6f49b2872a64 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1000,10 +1000,20 @@ int btrfs_sync_fs(struct super_block *sb, int wait)
                         */
                        if (fs_info->pending_changes == 0)
                                return 0;
+                        /*
+                         * A non-blocking test if the fs is frozen. We must not
+                         * start a new transaction here otherwise a deadlock
+                         * happens. The pending operations are delayed to the
+                         * next commit after thawing.
+                         */
+                        if (__sb_start_write(sb, SB_FREEZE_WRITE, false))
+                                __sb_end_write(sb, SB_FREEZE_WRITE);
+                        else
+                                return 0;
                        trans = btrfs_start_transaction(root, 0);
-                } else {
-                        return PTR_ERR(trans);
                }
+                if (IS_ERR(trans))
+                        return PTR_ERR(trans);
        }
        return btrfs_commit_transaction(trans, root);
 }
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index a605d4e2f2bc..e88b59d13439 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -2118,7 +2118,7 @@ void btrfs_apply_pending_changes(struct btrfs_fs_info *fs_info)
        unsigned long prev;
        unsigned long bit;
-        prev = cmpxchg(&fs_info->pending_changes, 0, 0);
+        prev = xchg(&fs_info->pending_changes, 0);
        if (!prev)
                return;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 9a02da16f2be..1a9585d4380a 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2591,6 +2591,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
        }
        if (log_root_tree->log_transid_committed >= root_log_ctx.log_transid) {
+                blk_finish_plug(&plug);
                mutex_unlock(&log_root_tree->log_mutex);
                ret = root_log_ctx.log_ret;
                goto out;
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index f5013d92a7e6..c81c0e004588 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -1416,7 +1416,7 @@ void ceph_fill_inline_data(struct inode *inode, struct page *locked_page,
                }
        }
-        dout("fill_inline_data %p %llx.%llx len %lu locked_page %p\n",
+        dout("fill_inline_data %p %llx.%llx len %zu locked_page %p\n",
             inode, ceph_vinop(inode), len, locked_page);
        if (len > 0) {
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 9c56ef776407..7febcf2475c5 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -606,9 +606,11 @@ cifs_security_flags_handle_must_flags(unsigned int *flags)
                *flags = CIFSSEC_MUST_NTLMV2;
        else if ((*flags & CIFSSEC_MUST_NTLM) == CIFSSEC_MUST_NTLM)
                *flags = CIFSSEC_MUST_NTLM;
-        else if ((*flags & CIFSSEC_MUST_LANMAN) == CIFSSEC_MUST_LANMAN)
+        else if (CIFSSEC_MUST_LANMAN &&
+                 (*flags & CIFSSEC_MUST_LANMAN) == CIFSSEC_MUST_LANMAN)
                *flags = CIFSSEC_MUST_LANMAN;
-        else if ((*flags & CIFSSEC_MUST_PLNTXT) == CIFSSEC_MUST_PLNTXT)
+        else if (CIFSSEC_MUST_PLNTXT &&
+                 (*flags & CIFSSEC_MUST_PLNTXT) == CIFSSEC_MUST_PLNTXT)
                *flags = CIFSSEC_MUST_PLNTXT;
        *flags |= signflags;
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 6e139111fdb2..22b289a3b1c4 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -661,16 +661,16 @@ set_credits(struct TCP_Server_Info *server, const int val)
        server->ops->set_credits(server, val);
 }
-static inline __u64
+static inline __le64
 get_next_mid64(struct TCP_Server_Info *server)
 {
-        return server->ops->get_next_mid(server);
+        return cpu_to_le64(server->ops->get_next_mid(server));
 }
 static inline __le16
 get_next_mid(struct TCP_Server_Info *server)
 {
-        __u16 mid = get_next_mid64(server);
+        __u16 mid = server->ops->get_next_mid(server);
        /*
         * The value in the SMB header should be little endian for easy
         * on-the-wire decoding.
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 96b7e9b7706d..74f12877493a 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -366,6 +366,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
        struct cifsLockInfo *li, *tmp;
        struct cifs_fid fid;
        struct cifs_pending_open open;
+        bool oplock_break_cancelled;
        spin_lock(&cifs_file_list_lock);
        if (--cifs_file->count > 0) {
@@ -397,7 +398,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
        }
        spin_unlock(&cifs_file_list_lock);
-        cancel_work_sync(&cifs_file->oplock_break);
+        oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
        if (!tcon->need_reconnect && !cifs_file->invalidHandle) {
                struct TCP_Server_Info *server = tcon->ses->server;
@@ -409,6 +410,9 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
                _free_xid(xid);
        }
+        if (oplock_break_cancelled)
+                cifs_done_oplock_break(cifsi);
        cifs_del_pending_open(&open);
        /*
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index 45cb59bcc791..8b7898b7670f 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -86,21 +86,16 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
        }
        src_inode = file_inode(src_file.file);
+        rc = -EINVAL;
+        if (S_ISDIR(src_inode->i_mode))
+                goto out_fput;
        /*
         * Note: cifs case is easier than btrfs since server responsible for
         * checks for proper open modes and file type and if it wants
         * server could even support copy of range where source = target
         */
+        lock_two_nondirectories(target_inode, src_inode);
-        /* so we do not deadlock racing two ioctls on same files */
-        if (target_inode < src_inode) {
-                mutex_lock_nested(&target_inode->i_mutex, I_MUTEX_PARENT);
-                mutex_lock_nested(&src_inode->i_mutex, I_MUTEX_CHILD);
-        } else {
-                mutex_lock_nested(&src_inode->i_mutex, I_MUTEX_PARENT);
-                mutex_lock_nested(&target_inode->i_mutex, I_MUTEX_CHILD);
-        }
        /* determine range to clone */
        rc = -EINVAL;
@@ -124,13 +119,7 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
 out_unlock:
        /* although unlocking in the reverse order from locking is not
           strictly necessary here it is a little cleaner to be consistent */
-        if (target_inode < src_inode) {
+        unlock_two_nondirectories(src_inode, target_inode);
-                mutex_unlock(&src_inode->i_mutex);
-                mutex_unlock(&target_inode->i_mutex);
-        } else {
-                mutex_unlock(&target_inode->i_mutex);
-                mutex_unlock(&src_inode->i_mutex);
-        }
 out_fput:
        fdput(src_file);
 out_drop_write:
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index b333ff60781d..abae6dd2c6b9 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -926,6 +926,7 @@ cifs_NTtimeToUnix(__le64 ntutc)
        /* Subtract the NTFS time offset, then convert to 1s intervals. */
        s64 t = le64_to_cpu(ntutc) - NTFS_TIME_OFFSET;
+        u64 abs_t;
        /*
         * Unfortunately can not use normal 64 bit division on 32 bit arch, but
@@ -933,13 +934,14 @@ cifs_NTtimeToUnix(__le64 ntutc)
         * to special case them
         */
        if (t < 0) {
-                t = -t;
+                abs_t = -t;
-                ts.tv_nsec = (long)(do_div(t, 10000000) * 100);
+                ts.tv_nsec = (long)(do_div(abs_t, 10000000) * 100);
                ts.tv_nsec = -ts.tv_nsec;
-                ts.tv_sec = -t;
+                ts.tv_sec = -abs_t;
        } else {
-                ts.tv_nsec = (long)do_div(t, 10000000) * 100;
+                abs_t = t;
-                ts.tv_sec = t;
+                ts.tv_nsec = (long)do_div(abs_t, 10000000) * 100;
+                ts.tv_sec = abs_t;
        }
        return ts;
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 8eaf20a80649..c295338e0a98 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -69,7 +69,8 @@ static inline void dump_cifs_file_struct(struct file *file, char *label)
 * Attempt to preload the dcache with the results from the FIND_FIRST/NEXT
 *
 * Find the dentry that matches "name". If there isn't one, create one. If it's
- * a negative dentry or the uniqueid changed, then drop it and recreate it.
+ * a negative dentry or the uniqueid or filetype(mode) changed,
+ * then drop it and recreate it.
 */
 static void
 cifs_prime_dcache(struct dentry *parent, struct qstr *name,
@@ -97,8 +98,11 @@ cifs_prime_dcache(struct dentry *parent, struct qstr *name,
                        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM))
                                fattr->cf_uniqueid = CIFS_I(inode)->uniqueid;
-                        /* update inode in place if i_ino didn't change */
+                        /* update inode in place
-                        if (CIFS_I(inode)->uniqueid == fattr->cf_uniqueid) {
+                         * if both i_ino and i_mode didn't change */
+                        if (CIFS_I(inode)->uniqueid == fattr->cf_uniqueid &&
+                            (inode->i_mode & S_IFMT) ==
+                            (fattr->cf_mode & S_IFMT)) {
                                cifs_fattr_to_inode(inode, fattr);
                                goto out;
                        }
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index f1cefc9763ed..689f035915cf 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -32,12 +32,14 @@
 static int
 check_smb2_hdr(struct smb2_hdr *hdr, __u64 mid)
 {
+        __u64 wire_mid = le64_to_cpu(hdr->MessageId);
        /*
         * Make sure that this really is an SMB, that it is a response,
         * and that the message ids match.
         */
        if ((*(__le32 *)hdr->ProtocolId == SMB2_PROTO_NUMBER) &&
-            (mid == hdr->MessageId)) {
+            (mid == wire_mid)) {
                if (hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR)
                        return 0;
                else {
@@ -51,11 +53,11 @@ check_smb2_hdr(struct smb2_hdr *hdr, __u64 mid)
                if (*(__le32 *)hdr->ProtocolId != SMB2_PROTO_NUMBER)
                        cifs_dbg(VFS, "Bad protocol string signature header %x\n",
                                 *(unsigned int *) hdr->ProtocolId);
-                if (mid != hdr->MessageId)
+                if (mid != wire_mid)
                        cifs_dbg(VFS, "Mids do not match: %llu and %llu\n",
-                                 mid, hdr->MessageId);
+                                 mid, wire_mid);
        }
-        cifs_dbg(VFS, "Bad SMB detected. The Mid=%llu\n", hdr->MessageId);
+        cifs_dbg(VFS, "Bad SMB detected. The Mid=%llu\n", wire_mid);
        return 1;
 }
@@ -95,7 +97,7 @@ smb2_check_message(char *buf, unsigned int length)
 {
        struct smb2_hdr *hdr = (struct smb2_hdr *)buf;
        struct smb2_pdu *pdu = (struct smb2_pdu *)hdr;
-        __u64 mid = hdr->MessageId;
+        __u64 mid = le64_to_cpu(hdr->MessageId);
        __u32 len = get_rfc1002_length(buf);
        __u32 clc_len;  /* calculated length */
        int command;
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 93fd0586f9ec..96b5d40a2ece 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -176,10 +176,11 @@ smb2_find_mid(struct TCP_Server_Info *server, char *buf)
 {
        struct mid_q_entry *mid;
        struct smb2_hdr *hdr = (struct smb2_hdr *)buf;
+        __u64 wire_mid = le64_to_cpu(hdr->MessageId);
        spin_lock(&GlobalMid_Lock);
        list_for_each_entry(mid, &server->pending_mid_q, qhead) {
-                if ((mid->mid == hdr->MessageId) &&
+                if ((mid->mid == wire_mid) &&
                    (mid->mid_state == MID_REQUEST_SUBMITTED) &&
                    (mid->command == hdr->Command)) {
                        spin_unlock(&GlobalMid_Lock);
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index ce858477002a..70867d54fb8b 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -110,7 +110,7 @@ struct smb2_hdr {
        __le16 CreditRequest;  /* CreditResponse */
        __le32 Flags;
        __le32 NextCommand;
-        __u64  MessageId;       /* opaque - so can stay little endian */
+        __le64 MessageId;
        __le32 ProcessId;
        __u32  TreeId;          /* opaque - so do not make little endian */
        __u64  SessionId;       /* opaque - so do not make little endian */
diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
index 5111e7272db6..d4c5b6f109a7 100644
--- a/fs/cifs/smb2transport.c
+++ b/fs/cifs/smb2transport.c
@@ -490,7 +490,7 @@ smb2_mid_entry_alloc(const struct smb2_hdr *smb_buffer,
                return temp;
        else {
                memset(temp, 0, sizeof(struct mid_q_entry));
-                temp->mid = smb_buffer->MessageId;      /* always LE */
+                temp->mid = le64_to_cpu(smb_buffer->MessageId);
                temp->pid = current->pid;
                temp->command = smb_buffer->Command;    /* Always LE */
                temp->when_alloc = jiffies;
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index 6c1566366a66..a4232ec4f2ba 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -221,7 +221,7 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16,
        }
        rc = mdfour(p16, (unsigned char *) wpwd, len * sizeof(__le16));
-        memset(wpwd, 0, 129 * sizeof(__le16));
+        memzero_explicit(wpwd, sizeof(wpwd));
        return rc;
 }
diff --git a/fs/efivarfs/Kconfig b/fs/efivarfs/Kconfig
index 367bbb10c543..c2499ef174a2 100644
--- a/fs/efivarfs/Kconfig
+++ b/fs/efivarfs/Kconfig
@@ -1,6 +1,7 @@
 config EFIVAR_FS
        tristate "EFI Variable filesystem"
        depends on EFI
+        default m
        help
          efivarfs is a replacement filesystem for the old EFI
          variable support via sysfs, as it doesn't suffer from the
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index 6dad1176ec52..ddbce42548c9 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -140,7 +140,7 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
        name[len] = '-';
-        efi_guid_unparse(&entry->var.VendorGuid, name + len + 1);
+        efi_guid_to_str(&entry->var.VendorGuid, name + len + 1);
        name[len + EFI_VARIABLE_GUID_LEN+1] = '\0';
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index e5d3eadf47b1..bed43081720f 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -5166,8 +5166,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
        /* fallback to generic here if not in extents fmt */
        if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
-                return __generic_block_fiemap(inode, fieinfo, start, len,
+                return generic_block_fiemap(inode, fieinfo, start, len,
-                                              ext4_get_block);
+                        ext4_get_block);
        if (fiemap_check_flags(fieinfo, EXT4_FIEMAP_FLAGS))
                return -EBADR;
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 513c12cf444c..8131be8c0af3 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -273,19 +273,24 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
 * we determine this extent as a data or a hole according to whether the
 * page cache has data or not.
 */
-static int ext4_find_unwritten_pgoff(struct inode *inode, int whence,
+static int ext4_find_unwritten_pgoff(struct inode *inode,
-                                     loff_t endoff, loff_t *offset)
+                                     int whence,
+                                     struct ext4_map_blocks *map,
+                                     loff_t *offset)
 {
        struct pagevec pvec;
+        unsigned int blkbits;
        pgoff_t index;
        pgoff_t end;
+        loff_t endoff;
        loff_t startoff;
        loff_t lastoff;
        int found = 0;
+        blkbits = inode->i_sb->s_blocksize_bits;
        startoff = *offset;
        lastoff = startoff;
+        endoff = (loff_t)(map->m_lblk + map->m_len) << blkbits;
        index = startoff >> PAGE_CACHE_SHIFT;
        end = endoff >> PAGE_CACHE_SHIFT;
@@ -403,144 +408,147 @@ out:
 static loff_t ext4_seek_data(struct file *file, loff_t offset, loff_t maxsize)
 {
        struct inode *inode = file->f_mapping->host;
-        struct fiemap_extent_info fie;
+        struct ext4_map_blocks map;
-        struct fiemap_extent ext[2];
+        struct extent_status es;
-        loff_t next;
+        ext4_lblk_t start, last, end;
-        int i, ret = 0;
+        loff_t dataoff, isize;
+        int blkbits;
+        int ret = 0;
        mutex_lock(&inode->i_mutex);
-        if (offset >= inode->i_size) {
+        isize = i_size_read(inode);
+        if (offset >= isize) {
                mutex_unlock(&inode->i_mutex);
                return -ENXIO;
        }
-        fie.fi_flags = 0;
-        fie.fi_extents_max = 2;
+        blkbits = inode->i_sb->s_blocksize_bits;
-        fie.fi_extents_start = (struct fiemap_extent __user *) &ext;
+        start = offset >> blkbits;
-        while (1) {
+        last = start;
-                mm_segment_t old_fs = get_fs();
+        end = isize >> blkbits;
+        dataoff = offset;
-                fie.fi_extents_mapped = 0;
-                memset(ext, 0, sizeof(*ext) * fie.fi_extents_max);
+        do {
+                map.m_lblk = last;
-                set_fs(get_ds());
+                map.m_len = end - last + 1;
-                ret = ext4_fiemap(inode, &fie, offset, maxsize - offset);
+                ret = ext4_map_blocks(NULL, inode, &map, 0);
-                set_fs(old_fs);
+                if (ret > 0 && !(map.m_flags & EXT4_MAP_UNWRITTEN)) {
-                if (ret)
+                        if (last != start)
+                                dataoff = (loff_t)last << blkbits;
                        break;
+                }
-                /* No extents found, EOF */
+                /*
-                if (!fie.fi_extents_mapped) {
+                 * If there is a delay extent at this offset,
-                        ret = -ENXIO;
+                 * it will be as a data.
+                 */
+                ext4_es_find_delayed_extent_range(inode, last, last, &es);
+                if (es.es_len != 0 && in_range(last, es.es_lblk, es.es_len)) {
+                        if (last != start)
+                                dataoff = (loff_t)last << blkbits;
                        break;
                }
-                for (i = 0; i < fie.fi_extents_mapped; i++) {
-                        next = (loff_t)(ext[i].fe_length + ext[i].fe_logical);
-                        if (offset < (loff_t)ext[i].fe_logical)
+                /*
-                                offset = (loff_t)ext[i].fe_logical;
+                 * If there is a unwritten extent at this offset,
-                        /*
+                 * it will be as a data or a hole according to page
-                         * If extent is not unwritten, then it contains valid
+                 * cache that has data or not.
-                         * data, mapped or delayed.
+                 */
-                         */
+                if (map.m_flags & EXT4_MAP_UNWRITTEN) {
-                        if (!(ext[i].fe_flags & FIEMAP_EXTENT_UNWRITTEN))
+                        int unwritten;
-                                goto out;
+                        unwritten = ext4_find_unwritten_pgoff(inode, SEEK_DATA,
+                                                              &map, &dataoff);
+                        if (unwritten)
+                                break;
+                }
-                        /*
+                last++;
-                         * If there is a unwritten extent at this offset,
+                dataoff = (loff_t)last << blkbits;
-                         * it will be as a data or a hole according to page
+        } while (last <= end);
-                         * cache that has data or not.
-                         */
-                        if (ext4_find_unwritten_pgoff(inode, SEEK_DATA,
-                                                      next, &offset))
-                                goto out;
-                        if (ext[i].fe_flags & FIEMAP_EXTENT_LAST) {
-                                ret = -ENXIO;
-                                goto out;
-                        }
-                        offset = next;
-                }
-        }
-        if (offset > inode->i_size)
-                offset = inode->i_size;
-out:
        mutex_unlock(&inode->i_mutex);
-        if (ret)
-                return ret;
-        return vfs_setpos(file, offset, maxsize);
+        if (dataoff > isize)
+                return -ENXIO;
+        return vfs_setpos(file, dataoff, maxsize);
 }
 /*
- * ext4_seek_hole() retrieves the offset for SEEK_HOLE
+ * ext4_seek_hole() retrieves the offset for SEEK_HOLE.
 */
 static loff_t ext4_seek_hole(struct file *file, loff_t offset, loff_t maxsize)
 {
        struct inode *inode = file->f_mapping->host;
-        struct fiemap_extent_info fie;
+        struct ext4_map_blocks map;
-        struct fiemap_extent ext[2];
+        struct extent_status es;
-        loff_t next;
+        ext4_lblk_t start, last, end;
-        int i, ret = 0;
+        loff_t holeoff, isize;
+        int blkbits;
+        int ret = 0;
        mutex_lock(&inode->i_mutex);
-        if (offset >= inode->i_size) {
+        isize = i_size_read(inode);
+        if (offset >= isize) {
                mutex_unlock(&inode->i_mutex);
                return -ENXIO;
        }
-        fie.fi_flags = 0;
+        blkbits = inode->i_sb->s_blocksize_bits;
-        fie.fi_extents_max = 2;
+        start = offset >> blkbits;
-        fie.fi_extents_start = (struct fiemap_extent __user *)&ext;
+        last = start;
-        while (1) {
+        end = isize >> blkbits;
-                mm_segment_t old_fs = get_fs();
+        holeoff = offset;
-                fie.fi_extents_mapped = 0;
-                memset(ext, 0, sizeof(*ext));
-                set_fs(get_ds());
+        do {
-                ret = ext4_fiemap(inode, &fie, offset, maxsize - offset);
+                map.m_lblk = last;
-                set_fs(old_fs);
+                map.m_len = end - last + 1;
-                if (ret)
+                ret = ext4_map_blocks(NULL, inode, &map, 0);
-                        break;
+                if (ret > 0 && !(map.m_flags & EXT4_MAP_UNWRITTEN)) {
+                        last += ret;
+                        holeoff = (loff_t)last << blkbits;
+                        continue;
+                }
-                /* No extents found */
+                /*
-                if (!fie.fi_extents_mapped)
+                 * If there is a delay extent at this offset,
-                        break;
+                 * we will skip this extent.
+                 */
+                ext4_es_find_delayed_extent_range(inode, last, last, &es);
+                if (es.es_len != 0 && in_range(last, es.es_lblk, es.es_len)) {
+                        last = es.es_lblk + es.es_len;
+                        holeoff = (loff_t)last << blkbits;
+                        continue;
+                }
-                for (i = 0; i < fie.fi_extents_mapped; i++) {
+                /*
-                        next = (loff_t)(ext[i].fe_logical + ext[i].fe_length);
+                 * If there is a unwritten extent at this offset,
-                        /*
+                 * it will be as a data or a hole according to page
-                         * If extent is not unwritten, then it contains valid
+                 * cache that has data or not.
-                         * data, mapped or delayed.
+                 */
-                         */
+                if (map.m_flags & EXT4_MAP_UNWRITTEN) {
-                        if (!(ext[i].fe_flags & FIEMAP_EXTENT_UNWRITTEN)) {
+                        int unwritten;
-                                if (offset < (loff_t)ext[i].fe_logical)
+                        unwritten = ext4_find_unwritten_pgoff(inode, SEEK_HOLE,
-                                        goto out;
+                                                              &map, &holeoff);
-                                offset = next;
+                        if (!unwritten) {
+                                last += ret;
+                                holeoff = (loff_t)last << blkbits;
                                continue;
                        }
-                        /*
-                         * If there is a unwritten extent at this offset,
-                         * it will be as a data or a hole according to page
-                         * cache that has data or not.
-                         */
-                        if (ext4_find_unwritten_pgoff(inode, SEEK_HOLE,
-                                                      next, &offset))
-                                goto out;
-                        offset = next;
-                        if (ext[i].fe_flags & FIEMAP_EXTENT_LAST)
-                                goto out;
                }
-        }
-        if (offset > inode->i_size)
+                /* find a hole */
-                offset = inode->i_size;
+                break;
-out:
+        } while (last <= end);
        mutex_unlock(&inode->i_mutex);
-        if (ret)
-                return ret;
-        return vfs_setpos(file, offset, maxsize);
+        if (holeoff > isize)
+                holeoff = isize;
+        return vfs_setpos(file, holeoff, maxsize);
 }
 /*
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index bf76f405a5f9..8a8ec6293b19 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -24,6 +24,18 @@ int ext4_resize_begin(struct super_block *sb)
                return -EPERM;
        /*
+         * If we are not using the primary superblock/GDT copy don't resize,
+         * because the user tools have no way of handling this.  Probably a
+         * bad time to do it anyways.
+         */
+        if (EXT4_SB(sb)->s_sbh->b_blocknr !=
+            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
+                ext4_warning(sb, "won't resize using backup superblock at %llu",
+                        (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
+                return -EPERM;
+        }
+        /*
         * We are not allowed to do online-resizing on a filesystem mounted
         * with error, because it can destroy the filesystem easily.
         */
@@ -758,18 +770,6 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
                       "EXT4-fs: ext4_add_new_gdb: adding group block %lu\n",
                       gdb_num);
-        /*
-         * If we are not using the primary superblock/GDT copy don't resize,
-         * because the user tools have no way of handling this.  Probably a
-         * bad time to do it anyways.
-         */
-        if (EXT4_SB(sb)->s_sbh->b_blocknr !=
-            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
-                ext4_warning(sb, "won't resize using backup superblock at %llu",
-                        (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
-                return -EPERM;
-        }
        gdb_bh = sb_bread(sb, gdblock);
        if (!gdb_bh)
                return -EIO;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 43c92b1685cb..74c5f53595fb 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3482,7 +3482,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
        if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
                                       EXT4_FEATURE_RO_COMPAT_METADATA_CSUM) &&
            EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_GDT_CSUM))
-                ext4_warning(sb, KERN_INFO "metadata_csum and uninit_bg are "
+                ext4_warning(sb, "metadata_csum and uninit_bg are "
                             "redundant flags; please run fsck.");
        /* Check for a known checksum algorithm */
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 99d440a4a6ba..ee85cd4e136a 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -740,14 +740,15 @@ static int __init fcntl_init(void)
         * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
         * is defined as O_NONBLOCK on some platforms and not on others.
         */
-        BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
+        BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
                O_RDONLY        | O_WRONLY      | O_RDWR        |
                O_CREAT         | O_EXCL        | O_NOCTTY      |
                O_TRUNC         | O_APPEND      | /* O_NONBLOCK | */
                __O_SYNC        | O_DSYNC       | FASYNC        |
                O_DIRECT        | O_LARGEFILE   | O_DIRECTORY   |
                O_NOFOLLOW      | O_NOATIME     | O_CLOEXEC     |
-                __FMODE_EXEC    | O_PATH        | __O_TMPFILE
+                __FMODE_EXEC    | O_PATH        | __O_TMPFILE   |
+                __FMODE_NONOTIFY
                ));
        fasync_cache = kmem_cache_create("fasync_cache",
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index ba1107977f2e..ed19a7d622fa 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -131,6 +131,13 @@ static void fuse_req_init_context(struct fuse_req *req)
        req->in.h.pid = current->pid;
 }
+void fuse_set_initialized(struct fuse_conn *fc)
+{
+        /* Make sure stores before this are seen on another CPU */
+        smp_wmb();
+        fc->initialized = 1;
+}
 static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
 {
        return !fc->initialized || (for_background && fc->blocked);
@@ -155,6 +162,8 @@ static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages,
                if (intr)
                        goto out;
        }
+        /* Matches smp_wmb() in fuse_set_initialized() */
+        smp_rmb();
        err = -ENOTCONN;
        if (!fc->connected)
@@ -253,6 +262,8 @@ struct fuse_req *fuse_get_req_nofail_nopages(struct fuse_conn *fc,
        atomic_inc(&fc->num_waiting);
        wait_event(fc->blocked_waitq, fc->initialized);
+        /* Matches smp_wmb() in fuse_set_initialized() */
+        smp_rmb();
        req = fuse_request_alloc(0);
        if (!req)
                req = get_reserved_req(fc, file);
@@ -511,6 +522,39 @@ void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
 }
 EXPORT_SYMBOL_GPL(fuse_request_send);
+static void fuse_adjust_compat(struct fuse_conn *fc, struct fuse_args *args)
+{
+        if (fc->minor < 4 && args->in.h.opcode == FUSE_STATFS)
+                args->out.args[0].size = FUSE_COMPAT_STATFS_SIZE;
+        if (fc->minor < 9) {
+                switch (args->in.h.opcode) {
+                case FUSE_LOOKUP:
+                case FUSE_CREATE:
+                case FUSE_MKNOD:
+                case FUSE_MKDIR:
+                case FUSE_SYMLINK:
+                case FUSE_LINK:
+                        args->out.args[0].size = FUSE_COMPAT_ENTRY_OUT_SIZE;
+                        break;
+                case FUSE_GETATTR:
+                case FUSE_SETATTR:
+                        args->out.args[0].size = FUSE_COMPAT_ATTR_OUT_SIZE;
+                        break;
+                }
+        }
+        if (fc->minor < 12) {
+                switch (args->in.h.opcode) {
+                case FUSE_CREATE:
+                        args->in.args[0].size = sizeof(struct fuse_open_in);
+                        break;
+                case FUSE_MKNOD:
+                        args->in.args[0].size = FUSE_COMPAT_MKNOD_IN_SIZE;
+                        break;
+                }
+        }
+}
 ssize_t fuse_simple_request(struct fuse_conn *fc, struct fuse_args *args)
 {
        struct fuse_req *req;
@@ -520,6 +564,9 @@ ssize_t fuse_simple_request(struct fuse_conn *fc, struct fuse_args *args)
        if (IS_ERR(req))
                return PTR_ERR(req);
+        /* Needs to be done after fuse_get_req() so that fc->minor is valid */
+        fuse_adjust_compat(fc, args);
        req->in.h.opcode = args->in.h.opcode;
        req->in.h.nodeid = args->in.h.nodeid;
        req->in.numargs = args->in.numargs;
@@ -2127,7 +2174,7 @@ void fuse_abort_conn(struct fuse_conn *fc)
        if (fc->connected) {
                fc->connected = 0;
                fc->blocked = 0;
-                fc->initialized = 1;
+                fuse_set_initialized(fc);
                end_io_requests(fc);
                end_queued_requests(fc);
                end_polls(fc);
@@ -2146,7 +2193,7 @@ int fuse_dev_release(struct inode *inode, struct file *file)
                spin_lock(&fc->lock);
                fc->connected = 0;
                fc->blocked = 0;
-                fc->initialized = 1;
+                fuse_set_initialized(fc);
                end_queued_requests(fc);
                end_polls(fc);
                wake_up_all(&fc->blocked_waitq);
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 252b8a5de8b5..08e7b1a9d5d0 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -156,10 +156,7 @@ static void fuse_lookup_init(struct fuse_conn *fc, struct fuse_args *args,
        args->in.args[0].size = name->len + 1;
        args->in.args[0].value = name->name;
        args->out.numargs = 1;
-        if (fc->minor < 9)
+        args->out.args[0].size = sizeof(struct fuse_entry_out);
-                args->out.args[0].size = FUSE_COMPAT_ENTRY_OUT_SIZE;
-        else
-                args->out.args[0].size = sizeof(struct fuse_entry_out);
        args->out.args[0].value = outarg;
 }
@@ -422,16 +419,12 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry,
        args.in.h.opcode = FUSE_CREATE;
        args.in.h.nodeid = get_node_id(dir);
        args.in.numargs = 2;
-        args.in.args[0].size = fc->minor < 12 ? sizeof(struct fuse_open_in) :
+        args.in.args[0].size = sizeof(inarg);
-                                                sizeof(inarg);
        args.in.args[0].value = &inarg;
        args.in.args[1].size = entry->d_name.len + 1;
        args.in.args[1].value = entry->d_name.name;
        args.out.numargs = 2;
-        if (fc->minor < 9)
+        args.out.args[0].size = sizeof(outentry);
-                args.out.args[0].size = FUSE_COMPAT_ENTRY_OUT_SIZE;
-        else
-                args.out.args[0].size = sizeof(outentry);
        args.out.args[0].value = &outentry;
        args.out.args[1].size = sizeof(outopen);
        args.out.args[1].value = &outopen;
@@ -539,10 +532,7 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_args *args,
        memset(&outarg, 0, sizeof(outarg));
        args->in.h.nodeid = get_node_id(dir);
        args->out.numargs = 1;
-        if (fc->minor < 9)
+        args->out.args[0].size = sizeof(outarg);
-                args->out.args[0].size = FUSE_COMPAT_ENTRY_OUT_SIZE;
-        else
-                args->out.args[0].size = sizeof(outarg);
        args->out.args[0].value = &outarg;
        err = fuse_simple_request(fc, args);
        if (err)
@@ -592,8 +582,7 @@ static int fuse_mknod(struct inode *dir, struct dentry *entry, umode_t mode,
        inarg.umask = current_umask();
        args.in.h.opcode = FUSE_MKNOD;
        args.in.numargs = 2;
-        args.in.args[0].size = fc->minor < 12 ? FUSE_COMPAT_MKNOD_IN_SIZE :
+        args.in.args[0].size = sizeof(inarg);
-                                                sizeof(inarg);
        args.in.args[0].value = &inarg;
        args.in.args[1].size = entry->d_name.len + 1;
        args.in.args[1].value = entry->d_name.name;
@@ -899,10 +888,7 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat,
        args.in.args[0].size = sizeof(inarg);
        args.in.args[0].value = &inarg;
        args.out.numargs = 1;
-        if (fc->minor < 9)
+        args.out.args[0].size = sizeof(outarg);
-                args.out.args[0].size = FUSE_COMPAT_ATTR_OUT_SIZE;
-        else
-                args.out.args[0].size = sizeof(outarg);
        args.out.args[0].value = &outarg;
        err = fuse_simple_request(fc, &args);
        if (!err) {
@@ -1574,10 +1560,7 @@ static void fuse_setattr_fill(struct fuse_conn *fc, struct fuse_args *args,
        args->in.args[0].size = sizeof(*inarg_p);
        args->in.args[0].value = inarg_p;
        args->out.numargs = 1;
-        if (fc->minor < 9)
+        args->out.args[0].size = sizeof(*outarg_p);
-                args->out.args[0].size = FUSE_COMPAT_ATTR_OUT_SIZE;
-        else
-                args->out.args[0].size = sizeof(*outarg_p);
        args->out.args[0].value = outarg_p;
 }
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index e0fc6725d1d0..1cdfb07c1376 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -906,4 +906,6 @@ int fuse_write_inode(struct inode *inode, struct writeback_control *wbc);
 int fuse_do_setattr(struct inode *inode, struct iattr *attr,
                    struct file *file);
+void fuse_set_initialized(struct fuse_conn *fc);
 #endif /* _FS_FUSE_I_H */
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 6749109f255d..f38256e4476e 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -424,8 +424,7 @@ static int fuse_statfs(struct dentry *dentry, struct kstatfs *buf)
        args.in.h.opcode = FUSE_STATFS;
        args.in.h.nodeid = get_node_id(dentry->d_inode);
        args.out.numargs = 1;
-        args.out.args[0].size =
+        args.out.args[0].size = sizeof(outarg);
-                fc->minor < 4 ? FUSE_COMPAT_STATFS_SIZE : sizeof(outarg);
        args.out.args[0].value = &outarg;
        err = fuse_simple_request(fc, &args);
        if (!err)
@@ -898,7 +897,7 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                fc->max_write = max_t(unsigned, 4096, fc->max_write);
                fc->conn_init = 1;
        }
-        fc->initialized = 1;
+        fuse_set_initialized(fc);
        wake_up_all(&fc->blocked_waitq);
 }
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index c8b148bbdc8b..3e193cb36996 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -667,7 +667,7 @@ static void do_qc(struct gfs2_quota_data *qd, s64 change)
 static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
                             s64 change, struct gfs2_quota_data *qd,
-                             struct fs_disk_quota *fdq)
+                             struct qc_dqblk *fdq)
 {
        struct inode *inode = &ip->i_inode;
        struct gfs2_sbd *sdp = GFS2_SB(inode);
@@ -697,16 +697,16 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
        be64_add_cpu(&q.qu_value, change);
        qd->qd_qb.qb_value = q.qu_value;
        if (fdq) {
-                if (fdq->d_fieldmask & FS_DQ_BSOFT) {
+                if (fdq->d_fieldmask & QC_SPC_SOFT) {
-                        q.qu_warn = cpu_to_be64(fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift);
+                        q.qu_warn = cpu_to_be64(fdq->d_spc_softlimit >> sdp->sd_sb.sb_bsize_shift);
                        qd->qd_qb.qb_warn = q.qu_warn;
                }
-                if (fdq->d_fieldmask & FS_DQ_BHARD) {
+                if (fdq->d_fieldmask & QC_SPC_HARD) {
-                        q.qu_limit = cpu_to_be64(fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift);
+                        q.qu_limit = cpu_to_be64(fdq->d_spc_hardlimit >> sdp->sd_sb.sb_bsize_shift);
                        qd->qd_qb.qb_limit = q.qu_limit;
                }
-                if (fdq->d_fieldmask & FS_DQ_BCOUNT) {
+                if (fdq->d_fieldmask & QC_SPACE) {
-                        q.qu_value = cpu_to_be64(fdq->d_bcount >> sdp->sd_fsb2bb_shift);
+                        q.qu_value = cpu_to_be64(fdq->d_space >> sdp->sd_sb.sb_bsize_shift);
                        qd->qd_qb.qb_value = q.qu_value;
                }
        }
@@ -1497,7 +1497,7 @@ static int gfs2_quota_get_xstate(struct super_block *sb,
 }
 static int gfs2_get_dqblk(struct super_block *sb, struct kqid qid,
-                          struct fs_disk_quota *fdq)
+                          struct qc_dqblk *fdq)
 {
        struct gfs2_sbd *sdp = sb->s_fs_info;
        struct gfs2_quota_lvb *qlvb;
@@ -1505,7 +1505,7 @@ static int gfs2_get_dqblk(struct super_block *sb, struct kqid qid,
        struct gfs2_holder q_gh;
        int error;
-        memset(fdq, 0, sizeof(struct fs_disk_quota));
+        memset(fdq, 0, sizeof(*fdq));
        if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
                return -ESRCH; /* Crazy XFS error code */
@@ -1522,12 +1522,9 @@ static int gfs2_get_dqblk(struct super_block *sb, struct kqid qid,
                goto out;
        qlvb = (struct gfs2_quota_lvb *)qd->qd_gl->gl_lksb.sb_lvbptr;
-        fdq->d_version = FS_DQUOT_VERSION;
+        fdq->d_spc_hardlimit = be64_to_cpu(qlvb->qb_limit) << sdp->sd_sb.sb_bsize_shift;
-        fdq->d_flags = (qid.type == USRQUOTA) ? FS_USER_QUOTA : FS_GROUP_QUOTA;
+        fdq->d_spc_softlimit = be64_to_cpu(qlvb->qb_warn) << sdp->sd_sb.sb_bsize_shift;
-        fdq->d_id = from_kqid_munged(current_user_ns(), qid);
+        fdq->d_space = be64_to_cpu(qlvb->qb_value) << sdp->sd_sb.sb_bsize_shift;
-        fdq->d_blk_hardlimit = be64_to_cpu(qlvb->qb_limit) << sdp->sd_fsb2bb_shift;
-        fdq->d_blk_softlimit = be64_to_cpu(qlvb->qb_warn) << sdp->sd_fsb2bb_shift;
-        fdq->d_bcount = be64_to_cpu(qlvb->qb_value) << sdp->sd_fsb2bb_shift;
        gfs2_glock_dq_uninit(&q_gh);
 out:
@@ -1536,10 +1533,10 @@ out:
 }
 /* GFS2 only supports a subset of the XFS fields */
-#define GFS2_FIELDMASK (FS_DQ_BSOFT|FS_DQ_BHARD|FS_DQ_BCOUNT)
+#define GFS2_FIELDMASK (QC_SPC_SOFT|QC_SPC_HARD|QC_SPACE)
 static int gfs2_set_dqblk(struct super_block *sb, struct kqid qid,
-                          struct fs_disk_quota *fdq)
+                          struct qc_dqblk *fdq)
 {
        struct gfs2_sbd *sdp = sb->s_fs_info;
        struct gfs2_inode *ip = GFS2_I(sdp->sd_quota_inode);
@@ -1583,17 +1580,17 @@ static int gfs2_set_dqblk(struct super_block *sb, struct kqid qid,
                goto out_i;
        /* If nothing has changed, this is a no-op */
-        if ((fdq->d_fieldmask & FS_DQ_BSOFT) &&
+        if ((fdq->d_fieldmask & QC_SPC_SOFT) &&
-            ((fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_warn)))
+            ((fdq->d_spc_softlimit >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_warn)))
-                fdq->d_fieldmask ^= FS_DQ_BSOFT;
+                fdq->d_fieldmask ^= QC_SPC_SOFT;
-        if ((fdq->d_fieldmask & FS_DQ_BHARD) &&
+        if ((fdq->d_fieldmask & QC_SPC_HARD) &&
-            ((fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_limit)))
+            ((fdq->d_spc_hardlimit >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_limit)))
-                fdq->d_fieldmask ^= FS_DQ_BHARD;
+                fdq->d_fieldmask ^= QC_SPC_HARD;
-        if ((fdq->d_fieldmask & FS_DQ_BCOUNT) &&
+        if ((fdq->d_fieldmask & QC_SPACE) &&
-            ((fdq->d_bcount >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_value)))
+            ((fdq->d_space >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_value)))
-                fdq->d_fieldmask ^= FS_DQ_BCOUNT;
+                fdq->d_fieldmask ^= QC_SPACE;
        if (fdq->d_fieldmask == 0)
                goto out_i;
diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
index bb63254ed848..735d7522a3a9 100644
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -362,6 +362,9 @@ repeat:
                        rs.cont_size = isonum_733(rr->u.CE.size);
                        break;
                case SIG('E', 'R'):
+                        /* Invalid length of ER tag id? */
+                        if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len)
+                                goto out;
                        ISOFS_SB(inode->i_sb)->s_rock = 1;
                        printk(KERN_DEBUG "ISO 9660 Extensions: ");
                        {
diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
index 37989f02a226..2d881b381d2b 100644
--- a/fs/kernfs/dir.c
+++ b/fs/kernfs/dir.c
@@ -201,10 +201,14 @@ static unsigned int kernfs_name_hash(const char *name, const void *ns)
 static int kernfs_name_compare(unsigned int hash, const char *name,
                               const void *ns, const struct kernfs_node *kn)
 {
-        if (hash != kn->hash)
+        if (hash < kn->hash)
-                return hash - kn->hash;
+                return -1;
-        if (ns != kn->ns)
+        if (hash > kn->hash)
-                return ns - kn->ns;
+                return 1;
+        if (ns < kn->ns)
+                return -1;
+        if (ns > kn->ns)
+                return 1;
        return strcmp(name, kn->name);
 }
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index e94c887da2d7..55505cbe11af 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -138,10 +138,6 @@ lockd(void *vrqstp)
        dprintk("NFS locking service started (ver " LOCKD_VERSION ").\n");
-        if (!nlm_timeout)
-                nlm_timeout = LOCKD_DFLT_TIMEO;
-        nlmsvc_timeout = nlm_timeout * HZ;
        /*
         * The main request loop. We don't terminate until the last
         * NFS mount or NFS daemon has gone away.
@@ -350,6 +346,10 @@ static struct svc_serv *lockd_create_svc(void)
                printk(KERN_WARNING
                        "lockd_up: no pid, %d users??\n", nlmsvc_users);
+        if (!nlm_timeout)
+                nlm_timeout = LOCKD_DFLT_TIMEO;
+        nlmsvc_timeout = nlm_timeout * HZ;
        serv = svc_create(&nlmsvc_program, LOCKD_BUFSIZE, svc_rpcb_cleanup);
        if (!serv) {
                printk(KERN_WARNING "lockd_up: create service failed\n");
diff --git a/fs/locks.c b/fs/locks.c
index 735b8d3fa78c..59e2f905e4ff 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1702,7 +1702,7 @@ static int generic_delete_lease(struct file *filp)
                        break;
        }
        trace_generic_delete_lease(inode, fl);
-        if (fl)
+        if (fl && IS_LEASE(fl))
                error = fl->fl_lmops->lm_change(before, F_UNLCK, &dispose);
        spin_unlock(&inode->i_lock);
        locks_dispose_list(&dispose);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 10bf07280f4a..294692ff83b1 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -212,6 +212,12 @@ static int nfs_direct_cmp_commit_data_verf(struct nfs_direct_req *dreq,
 */
 ssize_t nfs_direct_IO(int rw, struct kiocb *iocb, struct iov_iter *iter, loff_t pos)
 {
+        struct inode *inode = iocb->ki_filp->f_mapping->host;
+        /* we only support swap file calling nfs_direct_IO */
+        if (!IS_SWAPFILE(inode))
+                return 0;
 #ifndef CONFIG_NFS_SWAP
        dprintk("NFS: nfs_direct_IO (%pD) off/no(%Ld/%lu) EINVAL\n",
                        iocb->ki_filp, (long long) pos, iter->nr_segs);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 4bffe637ea32..2211f6ba8736 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -352,8 +352,9 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr, st
        nfs_attr_check_mountpoint(sb, fattr);
-        if (((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0) &&
+        if (nfs_attr_use_mounted_on_fileid(fattr))
-            !nfs_attr_use_mounted_on_fileid(fattr))
+                fattr->fileid = fattr->mounted_on_fileid;
+        else if ((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0)
                goto out_no_inode;
        if ((fattr->valid & NFS_ATTR_FATTR_TYPE) == 0)
                goto out_no_inode;
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index efaa31c70fbe..b6f34bfa6fe8 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -31,8 +31,6 @@ static inline int nfs_attr_use_mounted_on_fileid(struct nfs_fattr *fattr)
            (((fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0) &&
             ((fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL) == 0)))
                return 0;
-        fattr->fileid = fattr->mounted_on_fileid;
        return 1;
 }
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 03311259b0c4..706ad10b8186 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -228,6 +228,7 @@ static void nfs4_shutdown_client(struct nfs_client *clp)
        kfree(clp->cl_serverowner);
        kfree(clp->cl_serverscope);
        kfree(clp->cl_implid);
+        kfree(clp->cl_owner_id);
 }
 void nfs4_free_client(struct nfs_client *clp)
@@ -452,6 +453,14 @@ static void nfs4_swap_callback_idents(struct nfs_client *keep,
        spin_unlock(&nn->nfs_client_lock);
 }
+static bool nfs4_match_client_owner_id(const struct nfs_client *clp1,
+                const struct nfs_client *clp2)
+{
+        if (clp1->cl_owner_id == NULL || clp2->cl_owner_id == NULL)
+                return true;
+        return strcmp(clp1->cl_owner_id, clp2->cl_owner_id) == 0;
+}
 /**
 * nfs40_walk_client_list - Find server that recognizes a client ID
 *
@@ -483,9 +492,6 @@ int nfs40_walk_client_list(struct nfs_client *new,
                if (pos->rpc_ops != new->rpc_ops)
                        continue;
-                if (pos->cl_proto != new->cl_proto)
-                        continue;
                if (pos->cl_minorversion != new->cl_minorversion)
                        continue;
@@ -510,6 +516,9 @@ int nfs40_walk_client_list(struct nfs_client *new,
                if (pos->cl_clientid != new->cl_clientid)
                        continue;
+                if (!nfs4_match_client_owner_id(pos, new))
+                        continue;
                atomic_inc(&pos->cl_count);
                spin_unlock(&nn->nfs_client_lock);
@@ -566,20 +575,14 @@ static bool nfs4_match_clientids(struct nfs_client *a, struct nfs_client *b)
 }
 /*
- * Returns true if the server owners match
+ * Returns true if the server major ids match
 */
 static bool
-nfs4_match_serverowners(struct nfs_client *a, struct nfs_client *b)
+nfs4_check_clientid_trunking(struct nfs_client *a, struct nfs_client *b)
 {
        struct nfs41_server_owner *o1 = a->cl_serverowner;
        struct nfs41_server_owner *o2 = b->cl_serverowner;
-        if (o1->minor_id != o2->minor_id) {
-                dprintk("NFS: --> %s server owner minor IDs do not match\n",
-                        __func__);
-                return false;
-        }
        if (o1->major_id_sz != o2->major_id_sz)
                goto out_major_mismatch;
        if (memcmp(o1->major_id, o2->major_id, o1->major_id_sz) != 0)
@@ -621,9 +624,6 @@ int nfs41_walk_client_list(struct nfs_client *new,
                if (pos->rpc_ops != new->rpc_ops)
                        continue;
-                if (pos->cl_proto != new->cl_proto)
-                        continue;
                if (pos->cl_minorversion != new->cl_minorversion)
                        continue;
@@ -639,7 +639,7 @@ int nfs41_walk_client_list(struct nfs_client *new,
                        prev = pos;
                        status = nfs_wait_client_init_complete(pos);
-                        if (status == 0) {
+                        if (pos->cl_cons_state == NFS_CS_SESSION_INITING) {
                                nfs4_schedule_lease_recovery(pos);
                                status = nfs4_wait_clnt_recover(pos);
                        }
@@ -654,7 +654,19 @@ int nfs41_walk_client_list(struct nfs_client *new,
                if (!nfs4_match_clientids(pos, new))
                        continue;
-                if (!nfs4_match_serverowners(pos, new))
+                /*
+                 * Note that session trunking is just a special subcase of
+                 * client id trunking. In either case, we want to fall back
+                 * to using the existing nfs_client.
+                 */
+                if (!nfs4_check_clientid_trunking(pos, new))
+                        continue;
+                /* Unlike NFSv4.0, we know that NFSv4.1 always uses the
+                 * uniform string, however someone might switch the
+                 * uniquifier string on us.
+                 */
+                if (!nfs4_match_client_owner_id(pos, new))
                        continue;
                atomic_inc(&pos->cl_count);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index e7f8d5ff2581..c347705b0161 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1117,8 +1117,6 @@ static int can_open_delegated(struct nfs_delegation *delegation, fmode_t fmode)
                return 0;
        if ((delegation->type & fmode) != fmode)
                return 0;
-        if (test_bit(NFS_DELEGATION_NEED_RECLAIM, &delegation->flags))
-                return 0;
        if (test_bit(NFS_DELEGATION_RETURNING, &delegation->flags))
                return 0;
        nfs_mark_delegation_referenced(delegation);
@@ -4917,11 +4915,14 @@ static void nfs4_init_boot_verifier(const struct nfs_client *clp,
 }
 static unsigned int
-nfs4_init_nonuniform_client_string(const struct nfs_client *clp,
+nfs4_init_nonuniform_client_string(struct nfs_client *clp,
                                   char *buf, size_t len)
 {
        unsigned int result;
+        if (clp->cl_owner_id != NULL)
+                return strlcpy(buf, clp->cl_owner_id, len);
        rcu_read_lock();
        result = scnprintf(buf, len, "Linux NFSv4.0 %s/%s %s",
                                clp->cl_ipaddr,
@@ -4930,24 +4931,32 @@ nfs4_init_nonuniform_client_string(const struct nfs_client *clp,
                                rpc_peeraddr2str(clp->cl_rpcclient,
                                                        RPC_DISPLAY_PROTO));
        rcu_read_unlock();
+        clp->cl_owner_id = kstrdup(buf, GFP_KERNEL);
        return result;
 }
 static unsigned int
-nfs4_init_uniform_client_string(const struct nfs_client *clp,
+nfs4_init_uniform_client_string(struct nfs_client *clp,
                                char *buf, size_t len)
 {
        const char *nodename = clp->cl_rpcclient->cl_nodename;
+        unsigned int result;
+        if (clp->cl_owner_id != NULL)
+                return strlcpy(buf, clp->cl_owner_id, len);
        if (nfs4_client_id_uniquifier[0] != '\0')
-                return scnprintf(buf, len, "Linux NFSv%u.%u %s/%s",
+                result = scnprintf(buf, len, "Linux NFSv%u.%u %s/%s",
                                clp->rpc_ops->version,
                                clp->cl_minorversion,
                                nfs4_client_id_uniquifier,
                                nodename);
-        return scnprintf(buf, len, "Linux NFSv%u.%u %s",
+        else
+                result = scnprintf(buf, len, "Linux NFSv%u.%u %s",
                                clp->rpc_ops->version, clp->cl_minorversion,
                                nodename);
+        clp->cl_owner_id = kstrdup(buf, GFP_KERNEL);
+        return result;
 }
 /*
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 3550a9c87616..c06a1ba80d73 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3897,11 +3897,11 @@ nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
                status = nfs4_setlease(dp);
                goto out;
        }
-        atomic_inc(&fp->fi_delegees);
        if (fp->fi_had_conflict) {
                status = -EAGAIN;
                goto out_unlock;
        }
+        atomic_inc(&fp->fi_delegees);
        hash_delegation_locked(dp, fp);
        status = 0;
 out_unlock:
diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
index 91093cd74f0d..385704027575 100644
--- a/fs/nilfs2/nilfs.h
+++ b/fs/nilfs2/nilfs.h
@@ -141,7 +141,6 @@ enum {
 * @ti_save: Backup of journal_info field of task_struct
 * @ti_flags: Flags
 * @ti_count: Nest level
- * @ti_garbage: List of inode to be put when releasing semaphore
 */
 struct nilfs_transaction_info {
        u32                     ti_magic;
@@ -150,7 +149,6 @@ struct nilfs_transaction_info {
                                   one of other filesystems has a bug. */
        unsigned short          ti_flags;
        unsigned short          ti_count;
-        struct list_head        ti_garbage;
 };
 /* ti_magic */
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 7ef18fc656c2..469086b9f99b 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -305,7 +305,6 @@ static void nilfs_transaction_lock(struct super_block *sb,
        ti->ti_count = 0;
        ti->ti_save = cur_ti;
        ti->ti_magic = NILFS_TI_MAGIC;
-        INIT_LIST_HEAD(&ti->ti_garbage);
        current->journal_info = ti;
        for (;;) {
@@ -332,8 +331,6 @@ static void nilfs_transaction_unlock(struct super_block *sb)
        up_write(&nilfs->ns_segctor_sem);
        current->journal_info = ti->ti_save;
-        if (!list_empty(&ti->ti_garbage))
-                nilfs_dispose_list(nilfs, &ti->ti_garbage, 0);
 }
 static void *nilfs_segctor_map_segsum_entry(struct nilfs_sc_info *sci,
@@ -746,6 +743,15 @@ static void nilfs_dispose_list(struct the_nilfs *nilfs,
        }
 }
+static void nilfs_iput_work_func(struct work_struct *work)
+{
+        struct nilfs_sc_info *sci = container_of(work, struct nilfs_sc_info,
+                                                 sc_iput_work);
+        struct the_nilfs *nilfs = sci->sc_super->s_fs_info;
+        nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 0);
+}
 static int nilfs_test_metadata_dirty(struct the_nilfs *nilfs,
                                     struct nilfs_root *root)
 {
@@ -1900,8 +1906,8 @@ static int nilfs_segctor_collect_dirty_files(struct nilfs_sc_info *sci,
 static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
                                             struct the_nilfs *nilfs)
 {
-        struct nilfs_transaction_info *ti = current->journal_info;
        struct nilfs_inode_info *ii, *n;
+        int defer_iput = false;
        spin_lock(&nilfs->ns_inode_lock);
        list_for_each_entry_safe(ii, n, &sci->sc_dirty_files, i_dirty) {
@@ -1912,9 +1918,24 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
                clear_bit(NILFS_I_BUSY, &ii->i_state);
                brelse(ii->i_bh);
                ii->i_bh = NULL;
-                list_move_tail(&ii->i_dirty, &ti->ti_garbage);
+                list_del_init(&ii->i_dirty);
+                if (!ii->vfs_inode.i_nlink) {
+                        /*
+                         * Defer calling iput() to avoid a deadlock
+                         * over I_SYNC flag for inodes with i_nlink == 0
+                         */
+                        list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
+                        defer_iput = true;
+                } else {
+                        spin_unlock(&nilfs->ns_inode_lock);
+                        iput(&ii->vfs_inode);
+                        spin_lock(&nilfs->ns_inode_lock);
+                }
        }
        spin_unlock(&nilfs->ns_inode_lock);
+        if (defer_iput)
+                schedule_work(&sci->sc_iput_work);
 }
 /*
@@ -2583,6 +2604,8 @@ static struct nilfs_sc_info *nilfs_segctor_new(struct super_block *sb,
        INIT_LIST_HEAD(&sci->sc_segbufs);
        INIT_LIST_HEAD(&sci->sc_write_logs);
        INIT_LIST_HEAD(&sci->sc_gc_inodes);
+        INIT_LIST_HEAD(&sci->sc_iput_queue);
+        INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func);
        init_timer(&sci->sc_timer);
        sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT;
@@ -2609,6 +2632,8 @@ static void nilfs_segctor_write_out(struct nilfs_sc_info *sci)
                ret = nilfs_segctor_construct(sci, SC_LSEG_SR);
                nilfs_transaction_unlock(sci->sc_super);
+                flush_work(&sci->sc_iput_work);
        } while (ret && retrycount-- > 0);
 }
@@ -2633,6 +2658,9 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
                || sci->sc_seq_request != sci->sc_seq_done);
        spin_unlock(&sci->sc_state_lock);
+        if (flush_work(&sci->sc_iput_work))
+                flag = true;
        if (flag || !nilfs_segctor_confirm(sci))
                nilfs_segctor_write_out(sci);
@@ -2642,6 +2670,12 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
                nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1);
        }
+        if (!list_empty(&sci->sc_iput_queue)) {
+                nilfs_warning(sci->sc_super, __func__,
+                              "iput queue is not empty\n");
+                nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1);
+        }
        WARN_ON(!list_empty(&sci->sc_segbufs));
        WARN_ON(!list_empty(&sci->sc_write_logs));
diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h
index 38a1d0013314..a48d6de1e02c 100644
--- a/fs/nilfs2/segment.h
+++ b/fs/nilfs2/segment.h
@@ -26,6 +26,7 @@
 #include <linux/types.h>
 #include <linux/fs.h>
 #include <linux/buffer_head.h>
+#include <linux/workqueue.h>
 #include <linux/nilfs2_fs.h>
 #include "nilfs.h"
@@ -92,6 +93,8 @@ struct nilfs_segsum_pointer {
 * @sc_nblk_inc: Block count of current generation
 * @sc_dirty_files: List of files to be written
 * @sc_gc_inodes: List of GC inodes having blocks to be written
+ * @sc_iput_queue: list of inodes for which iput should be done
+ * @sc_iput_work: work struct to defer iput call
 * @sc_freesegs: array of segment numbers to be freed
 * @sc_nfreesegs: number of segments on @sc_freesegs
 * @sc_dsync_inode: inode whose data pages are written for a sync operation
@@ -135,6 +138,8 @@ struct nilfs_sc_info {
        struct list_head        sc_dirty_files;
        struct list_head        sc_gc_inodes;
+        struct list_head        sc_iput_queue;
+        struct work_struct      sc_iput_work;
        __u64                  *sc_freesegs;
        size_t                  sc_nfreesegs;
diff --git a/fs/notify/Kconfig b/fs/notify/Kconfig
index 22c629eedd82..2a24249b30af 100644
--- a/fs/notify/Kconfig
+++ b/fs/notify/Kconfig
@@ -1,5 +1,6 @@
 config FSNOTIFY
        def_bool n
+        select SRCU
 source "fs/notify/dnotify/Kconfig"
 source "fs/notify/inotify/Kconfig"
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index c991616acca9..bff8567aa42d 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -259,16 +259,15 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,
        struct fsnotify_event *kevent;
        char __user *start;
        int ret;
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        start = buf;
        group = file->private_data;
        pr_debug("%s: group=%p\n", __func__, group);
+        add_wait_queue(&group->notification_waitq, &wait);
        while (1) {
-                prepare_to_wait(&group->notification_waitq, &wait, TASK_INTERRUPTIBLE);
                mutex_lock(&group->notification_mutex);
                kevent = get_one_event(group, count);
                mutex_unlock(&group->notification_mutex);
@@ -289,7 +288,8 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,
                        if (start != buf)
                                break;
-                        schedule();
+                        wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
                        continue;
                }
@@ -318,8 +318,8 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,
                buf += ret;
                count -= ret;
        }
+        remove_wait_queue(&group->notification_waitq, &wait);
-        finish_wait(&group->notification_waitq, &wait);
        if (start != buf && ret != -EFAULT)
                ret = buf - start;
        return ret;
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 79b5af5e6a7b..cecd875653e4 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -2023,11 +2023,8 @@ leave:
        dlm_lockres_drop_inflight_ref(dlm, res);
        spin_unlock(&res->spinlock);
-        if (ret < 0) {
+        if (ret < 0)
                mlog_errno(ret);
-                if (newlock)
-                        dlm_lock_put(newlock);
-        }
        return ret;
 }
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index b931e04e3388..914c121ec890 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -94,6 +94,14 @@ static int ocfs2_create_symlink_data(struct ocfs2_super *osb,
                                     struct inode *inode,
                                     const char *symname);
+static int ocfs2_double_lock(struct ocfs2_super *osb,
+                             struct buffer_head **bh1,
+                             struct inode *inode1,
+                             struct buffer_head **bh2,
+                             struct inode *inode2,
+                             int rename);
+static void ocfs2_double_unlock(struct inode *inode1, struct inode *inode2);
 /* An orphan dir name is an 8 byte value, printed as a hex string */
 #define OCFS2_ORPHAN_NAMELEN ((int)(2 * sizeof(u64)))
@@ -678,8 +686,10 @@ static int ocfs2_link(struct dentry *old_dentry,
 {
        handle_t *handle;
        struct inode *inode = old_dentry->d_inode;
+        struct inode *old_dir = old_dentry->d_parent->d_inode;
        int err;
        struct buffer_head *fe_bh = NULL;
+        struct buffer_head *old_dir_bh = NULL;
        struct buffer_head *parent_fe_bh = NULL;
        struct ocfs2_dinode *fe = NULL;
        struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
@@ -696,19 +706,33 @@ static int ocfs2_link(struct dentry *old_dentry,
        dquot_initialize(dir);
-        err = ocfs2_inode_lock_nested(dir, &parent_fe_bh, 1, OI_LS_PARENT);
+        err = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
+                        &parent_fe_bh, dir, 0);
        if (err < 0) {
                if (err != -ENOENT)
                        mlog_errno(err);
                return err;
        }
+        /* make sure both dirs have bhs
+         * get an extra ref on old_dir_bh if old==new */
+        if (!parent_fe_bh) {
+                if (old_dir_bh) {
+                        parent_fe_bh = old_dir_bh;
+                        get_bh(parent_fe_bh);
+                } else {
+                        mlog(ML_ERROR, "%s: no old_dir_bh!\n", osb->uuid_str);
+                        err = -EIO;
+                        goto out;
+                }
+        }
        if (!dir->i_nlink) {
                err = -ENOENT;
                goto out;
        }
-        err = ocfs2_lookup_ino_from_name(dir, old_dentry->d_name.name,
+        err = ocfs2_lookup_ino_from_name(old_dir, old_dentry->d_name.name,
                        old_dentry->d_name.len, &old_de_ino);
        if (err) {
                err = -ENOENT;
@@ -801,10 +825,11 @@ out_unlock_inode:
        ocfs2_inode_unlock(inode, 1);
 out:
-        ocfs2_inode_unlock(dir, 1);
+        ocfs2_double_unlock(old_dir, dir);
        brelse(fe_bh);
        brelse(parent_fe_bh);
+        brelse(old_dir_bh);
        ocfs2_free_dir_lookup_result(&lookup);
@@ -1072,14 +1097,15 @@ static int ocfs2_check_if_ancestor(struct ocfs2_super *osb,
 }
 /*
- * The only place this should be used is rename!
+ * The only place this should be used is rename and link!
 * if they have the same id, then the 1st one is the only one locked.
 */
 static int ocfs2_double_lock(struct ocfs2_super *osb,
                             struct buffer_head **bh1,
                             struct inode *inode1,
                             struct buffer_head **bh2,
-                             struct inode *inode2)
+                             struct inode *inode2,
+                             int rename)
 {
        int status;
        int inode1_is_ancestor, inode2_is_ancestor;
@@ -1127,7 +1153,7 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
                }
                /* lock id2 */
                status = ocfs2_inode_lock_nested(inode2, bh2, 1,
-                                                 OI_LS_RENAME1);
+                                rename == 1 ? OI_LS_RENAME1 : OI_LS_PARENT);
                if (status < 0) {
                        if (status != -ENOENT)
                                mlog_errno(status);
@@ -1136,7 +1162,8 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
        }
        /* lock id1 */
-        status = ocfs2_inode_lock_nested(inode1, bh1, 1, OI_LS_RENAME2);
+        status = ocfs2_inode_lock_nested(inode1, bh1, 1,
+                        rename == 1 ?  OI_LS_RENAME2 : OI_LS_PARENT);
        if (status < 0) {
                /*
                 * An error return must mean that no cluster locks
@@ -1252,7 +1279,7 @@ static int ocfs2_rename(struct inode *old_dir,
        /* if old and new are the same, this'll just do one lock. */
        status = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
-                                   &new_dir_bh, new_dir);
+                                   &new_dir_bh, new_dir, 1);
        if (status < 0) {
                mlog_errno(status);
                goto bail;
diff --git a/fs/quota/Kconfig b/fs/quota/Kconfig
index c51df1dd237e..4a09975aac90 100644
--- a/fs/quota/Kconfig
+++ b/fs/quota/Kconfig
@@ -5,6 +5,7 @@
 config QUOTA
        bool "Quota support"
        select QUOTACTL
+        select SRCU
        help
          If you say Y here, you will be able to set per user limits for disk
          usage (also called disk quotas). Currently, it works for the
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 8f0acef3d184..69df5b239844 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -2396,30 +2396,25 @@ static inline qsize_t stoqb(qsize_t space)
 }
 /* Generic routine for getting common part of quota structure */
-static void do_get_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
+static void do_get_dqblk(struct dquot *dquot, struct qc_dqblk *di)
 {
        struct mem_dqblk *dm = &dquot->dq_dqb;
        memset(di, 0, sizeof(*di));
-        di->d_version = FS_DQUOT_VERSION;
-        di->d_flags = dquot->dq_id.type == USRQUOTA ?
-                        FS_USER_QUOTA : FS_GROUP_QUOTA;
-        di->d_id = from_kqid_munged(current_user_ns(), dquot->dq_id);
        spin_lock(&dq_data_lock);
-        di->d_blk_hardlimit = stoqb(dm->dqb_bhardlimit);
+        di->d_spc_hardlimit = dm->dqb_bhardlimit;
-        di->d_blk_softlimit = stoqb(dm->dqb_bsoftlimit);
+        di->d_spc_softlimit = dm->dqb_bsoftlimit;
        di->d_ino_hardlimit = dm->dqb_ihardlimit;
        di->d_ino_softlimit = dm->dqb_isoftlimit;
-        di->d_bcount = dm->dqb_curspace + dm->dqb_rsvspace;
+        di->d_space = dm->dqb_curspace + dm->dqb_rsvspace;
-        di->d_icount = dm->dqb_curinodes;
+        di->d_ino_count = dm->dqb_curinodes;
-        di->d_btimer = dm->dqb_btime;
+        di->d_spc_timer = dm->dqb_btime;
-        di->d_itimer = dm->dqb_itime;
+        di->d_ino_timer = dm->dqb_itime;
        spin_unlock(&dq_data_lock);
 }
 int dquot_get_dqblk(struct super_block *sb, struct kqid qid,
-                    struct fs_disk_quota *di)
+                    struct qc_dqblk *di)
 {
        struct dquot *dquot;
@@ -2433,70 +2428,70 @@ int dquot_get_dqblk(struct super_block *sb, struct kqid qid,
 }
 EXPORT_SYMBOL(dquot_get_dqblk);
-#define VFS_FS_DQ_MASK \
+#define VFS_QC_MASK \
-        (FS_DQ_BCOUNT | FS_DQ_BSOFT | FS_DQ_BHARD | \
+        (QC_SPACE | QC_SPC_SOFT | QC_SPC_HARD | \
-         FS_DQ_ICOUNT | FS_DQ_ISOFT | FS_DQ_IHARD | \
+         QC_INO_COUNT | QC_INO_SOFT | QC_INO_HARD | \
-         FS_DQ_BTIMER | FS_DQ_ITIMER)
+         QC_SPC_TIMER | QC_INO_TIMER)
 /* Generic routine for setting common part of quota structure */
-static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
+static int do_set_dqblk(struct dquot *dquot, struct qc_dqblk *di)
 {
        struct mem_dqblk *dm = &dquot->dq_dqb;
        int check_blim = 0, check_ilim = 0;
        struct mem_dqinfo *dqi = &sb_dqopt(dquot->dq_sb)->info[dquot->dq_id.type];
-        if (di->d_fieldmask & ~VFS_FS_DQ_MASK)
+        if (di->d_fieldmask & ~VFS_QC_MASK)
                return -EINVAL;
-        if (((di->d_fieldmask & FS_DQ_BSOFT) &&
+        if (((di->d_fieldmask & QC_SPC_SOFT) &&
-             (di->d_blk_softlimit > dqi->dqi_maxblimit)) ||
+             stoqb(di->d_spc_softlimit) > dqi->dqi_maxblimit) ||
-            ((di->d_fieldmask & FS_DQ_BHARD) &&
+            ((di->d_fieldmask & QC_SPC_HARD) &&
-             (di->d_blk_hardlimit > dqi->dqi_maxblimit)) ||
+             stoqb(di->d_spc_hardlimit) > dqi->dqi_maxblimit) ||
-            ((di->d_fieldmask & FS_DQ_ISOFT) &&
+            ((di->d_fieldmask & QC_INO_SOFT) &&
             (di->d_ino_softlimit > dqi->dqi_maxilimit)) ||
-            ((di->d_fieldmask & FS_DQ_IHARD) &&
+            ((di->d_fieldmask & QC_INO_HARD) &&
             (di->d_ino_hardlimit > dqi->dqi_maxilimit)))
                return -ERANGE;
        spin_lock(&dq_data_lock);
-        if (di->d_fieldmask & FS_DQ_BCOUNT) {
+        if (di->d_fieldmask & QC_SPACE) {
-                dm->dqb_curspace = di->d_bcount - dm->dqb_rsvspace;
+                dm->dqb_curspace = di->d_space - dm->dqb_rsvspace;
                check_blim = 1;
                set_bit(DQ_LASTSET_B + QIF_SPACE_B, &dquot->dq_flags);
        }
-        if (di->d_fieldmask & FS_DQ_BSOFT)
+        if (di->d_fieldmask & QC_SPC_SOFT)
-                dm->dqb_bsoftlimit = qbtos(di->d_blk_softlimit);
+                dm->dqb_bsoftlimit = di->d_spc_softlimit;
-        if (di->d_fieldmask & FS_DQ_BHARD)
+        if (di->d_fieldmask & QC_SPC_HARD)
-                dm->dqb_bhardlimit = qbtos(di->d_blk_hardlimit);
+                dm->dqb_bhardlimit = di->d_spc_hardlimit;
-        if (di->d_fieldmask & (FS_DQ_BSOFT | FS_DQ_BHARD)) {
+        if (di->d_fieldmask & (QC_SPC_SOFT | QC_SPC_HARD)) {
                check_blim = 1;
                set_bit(DQ_LASTSET_B + QIF_BLIMITS_B, &dquot->dq_flags);
        }
-        if (di->d_fieldmask & FS_DQ_ICOUNT) {
+        if (di->d_fieldmask & QC_INO_COUNT) {
-                dm->dqb_curinodes = di->d_icount;
+                dm->dqb_curinodes = di->d_ino_count;
                check_ilim = 1;
                set_bit(DQ_LASTSET_B + QIF_INODES_B, &dquot->dq_flags);
        }
-        if (di->d_fieldmask & FS_DQ_ISOFT)
+        if (di->d_fieldmask & QC_INO_SOFT)
                dm->dqb_isoftlimit = di->d_ino_softlimit;
-        if (di->d_fieldmask & FS_DQ_IHARD)
+        if (di->d_fieldmask & QC_INO_HARD)
                dm->dqb_ihardlimit = di->d_ino_hardlimit;
-        if (di->d_fieldmask & (FS_DQ_ISOFT | FS_DQ_IHARD)) {
+        if (di->d_fieldmask & (QC_INO_SOFT | QC_INO_HARD)) {
                check_ilim = 1;
                set_bit(DQ_LASTSET_B + QIF_ILIMITS_B, &dquot->dq_flags);
        }
-        if (di->d_fieldmask & FS_DQ_BTIMER) {
+        if (di->d_fieldmask & QC_SPC_TIMER) {
-                dm->dqb_btime = di->d_btimer;
+                dm->dqb_btime = di->d_spc_timer;
                check_blim = 1;
                set_bit(DQ_LASTSET_B + QIF_BTIME_B, &dquot->dq_flags);
        }
-        if (di->d_fieldmask & FS_DQ_ITIMER) {
+        if (di->d_fieldmask & QC_INO_TIMER) {
-                dm->dqb_itime = di->d_itimer;
+                dm->dqb_itime = di->d_ino_timer;
                check_ilim = 1;
                set_bit(DQ_LASTSET_B + QIF_ITIME_B, &dquot->dq_flags);
        }
@@ -2506,7 +2501,7 @@ static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
                    dm->dqb_curspace < dm->dqb_bsoftlimit) {
                        dm->dqb_btime = 0;
                        clear_bit(DQ_BLKS_B, &dquot->dq_flags);
-                } else if (!(di->d_fieldmask & FS_DQ_BTIMER))
+                } else if (!(di->d_fieldmask & QC_SPC_TIMER))
                        /* Set grace only if user hasn't provided his own... */
                        dm->dqb_btime = get_seconds() + dqi->dqi_bgrace;
        }
@@ -2515,7 +2510,7 @@ static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
                    dm->dqb_curinodes < dm->dqb_isoftlimit) {
                        dm->dqb_itime = 0;
                        clear_bit(DQ_INODES_B, &dquot->dq_flags);
-                } else if (!(di->d_fieldmask & FS_DQ_ITIMER))
+                } else if (!(di->d_fieldmask & QC_INO_TIMER))
                        /* Set grace only if user hasn't provided his own... */
                        dm->dqb_itime = get_seconds() + dqi->dqi_igrace;
        }
@@ -2531,7 +2526,7 @@ static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
 }
 int dquot_set_dqblk(struct super_block *sb, struct kqid qid,
-                  struct fs_disk_quota *di)
+                  struct qc_dqblk *di)
 {
        struct dquot *dquot;
        int rc;
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index 2aa4151f99d2..6f3856328eea 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -118,17 +118,27 @@ static int quota_setinfo(struct super_block *sb, int type, void __user *addr)
        return sb->s_qcop->set_info(sb, type, &info);
 }
-static void copy_to_if_dqblk(struct if_dqblk *dst, struct fs_disk_quota *src)
+static inline qsize_t qbtos(qsize_t blocks)
+{
+        return blocks << QIF_DQBLKSIZE_BITS;
+}
+static inline qsize_t stoqb(qsize_t space)
+{
+        return (space + QIF_DQBLKSIZE - 1) >> QIF_DQBLKSIZE_BITS;
+}
+static void copy_to_if_dqblk(struct if_dqblk *dst, struct qc_dqblk *src)
 {
        memset(dst, 0, sizeof(*dst));
-        dst->dqb_bhardlimit = src->d_blk_hardlimit;
+        dst->dqb_bhardlimit = stoqb(src->d_spc_hardlimit);
-        dst->dqb_bsoftlimit = src->d_blk_softlimit;
+        dst->dqb_bsoftlimit = stoqb(src->d_spc_softlimit);
-        dst->dqb_curspace = src->d_bcount;
+        dst->dqb_curspace = src->d_space;
        dst->dqb_ihardlimit = src->d_ino_hardlimit;
        dst->dqb_isoftlimit = src->d_ino_softlimit;
-        dst->dqb_curinodes = src->d_icount;
+        dst->dqb_curinodes = src->d_ino_count;
-        dst->dqb_btime = src->d_btimer;
+        dst->dqb_btime = src->d_spc_timer;
-        dst->dqb_itime = src->d_itimer;
+        dst->dqb_itime = src->d_ino_timer;
        dst->dqb_valid = QIF_ALL;
 }
@@ -136,7 +146,7 @@ static int quota_getquota(struct super_block *sb, int type, qid_t id,
                          void __user *addr)
 {
        struct kqid qid;
-        struct fs_disk_quota fdq;
+        struct qc_dqblk fdq;
        struct if_dqblk idq;
        int ret;
@@ -154,36 +164,36 @@ static int quota_getquota(struct super_block *sb, int type, qid_t id,
        return 0;
 }
-static void copy_from_if_dqblk(struct fs_disk_quota *dst, struct if_dqblk *src)
+static void copy_from_if_dqblk(struct qc_dqblk *dst, struct if_dqblk *src)
 {
-        dst->d_blk_hardlimit = src->dqb_bhardlimit;
+        dst->d_spc_hardlimit = qbtos(src->dqb_bhardlimit);
-        dst->d_blk_softlimit  = src->dqb_bsoftlimit;
+        dst->d_spc_softlimit = qbtos(src->dqb_bsoftlimit);
-        dst->d_bcount = src->dqb_curspace;
+        dst->d_space = src->dqb_curspace;
        dst->d_ino_hardlimit = src->dqb_ihardlimit;
        dst->d_ino_softlimit = src->dqb_isoftlimit;
-        dst->d_icount = src->dqb_curinodes;
+        dst->d_ino_count = src->dqb_curinodes;
-        dst->d_btimer = src->dqb_btime;
+        dst->d_spc_timer = src->dqb_btime;
-        dst->d_itimer = src->dqb_itime;
+        dst->d_ino_timer = src->dqb_itime;
        dst->d_fieldmask = 0;
        if (src->dqb_valid & QIF_BLIMITS)
-                dst->d_fieldmask |= FS_DQ_BSOFT | FS_DQ_BHARD;
+                dst->d_fieldmask |= QC_SPC_SOFT | QC_SPC_HARD;
        if (src->dqb_valid & QIF_SPACE)
-                dst->d_fieldmask |= FS_DQ_BCOUNT;
+                dst->d_fieldmask |= QC_SPACE;
        if (src->dqb_valid & QIF_ILIMITS)
-                dst->d_fieldmask |= FS_DQ_ISOFT | FS_DQ_IHARD;
+                dst->d_fieldmask |= QC_INO_SOFT | QC_INO_HARD;
        if (src->dqb_valid & QIF_INODES)
-                dst->d_fieldmask |= FS_DQ_ICOUNT;
+                dst->d_fieldmask |= QC_INO_COUNT;
        if (src->dqb_valid & QIF_BTIME)
-                dst->d_fieldmask |= FS_DQ_BTIMER;
+                dst->d_fieldmask |= QC_SPC_TIMER;
        if (src->dqb_valid & QIF_ITIME)
-                dst->d_fieldmask |= FS_DQ_ITIMER;
+                dst->d_fieldmask |= QC_INO_TIMER;
 }
 static int quota_setquota(struct super_block *sb, int type, qid_t id,
                          void __user *addr)
 {
-        struct fs_disk_quota fdq;
+        struct qc_dqblk fdq;
        struct if_dqblk idq;
        struct kqid qid;
@@ -247,10 +257,78 @@ static int quota_getxstatev(struct super_block *sb, void __user *addr)
        return ret;
 }
+/*
+ * XFS defines BBTOB and BTOBB macros inside fs/xfs/ and we cannot move them
+ * out of there as xfsprogs rely on definitions being in that header file. So
+ * just define same functions here for quota purposes.
+ */
+#define XFS_BB_SHIFT 9
+static inline u64 quota_bbtob(u64 blocks)
+{
+        return blocks << XFS_BB_SHIFT;
+}
+static inline u64 quota_btobb(u64 bytes)
+{
+        return (bytes + (1 << XFS_BB_SHIFT) - 1) >> XFS_BB_SHIFT;
+}
+static void copy_from_xfs_dqblk(struct qc_dqblk *dst, struct fs_disk_quota *src)
+{
+        dst->d_spc_hardlimit = quota_bbtob(src->d_blk_hardlimit);
+        dst->d_spc_softlimit = quota_bbtob(src->d_blk_softlimit);
+        dst->d_ino_hardlimit = src->d_ino_hardlimit;
+        dst->d_ino_softlimit = src->d_ino_softlimit;
+        dst->d_space = quota_bbtob(src->d_bcount);
+        dst->d_ino_count = src->d_icount;
+        dst->d_ino_timer = src->d_itimer;
+        dst->d_spc_timer = src->d_btimer;
+        dst->d_ino_warns = src->d_iwarns;
+        dst->d_spc_warns = src->d_bwarns;
+        dst->d_rt_spc_hardlimit = quota_bbtob(src->d_rtb_hardlimit);
+        dst->d_rt_spc_softlimit = quota_bbtob(src->d_rtb_softlimit);
+        dst->d_rt_space = quota_bbtob(src->d_rtbcount);
+        dst->d_rt_spc_timer = src->d_rtbtimer;
+        dst->d_rt_spc_warns = src->d_rtbwarns;
+        dst->d_fieldmask = 0;
+        if (src->d_fieldmask & FS_DQ_ISOFT)
+                dst->d_fieldmask |= QC_INO_SOFT;
+        if (src->d_fieldmask & FS_DQ_IHARD)
+                dst->d_fieldmask |= QC_INO_HARD;
+        if (src->d_fieldmask & FS_DQ_BSOFT)
+                dst->d_fieldmask |= QC_SPC_SOFT;
+        if (src->d_fieldmask & FS_DQ_BHARD)
+                dst->d_fieldmask |= QC_SPC_HARD;
+        if (src->d_fieldmask & FS_DQ_RTBSOFT)
+                dst->d_fieldmask |= QC_RT_SPC_SOFT;
+        if (src->d_fieldmask & FS_DQ_RTBHARD)
+                dst->d_fieldmask |= QC_RT_SPC_HARD;
+        if (src->d_fieldmask & FS_DQ_BTIMER)
+                dst->d_fieldmask |= QC_SPC_TIMER;
+        if (src->d_fieldmask & FS_DQ_ITIMER)
+                dst->d_fieldmask |= QC_INO_TIMER;
+        if (src->d_fieldmask & FS_DQ_RTBTIMER)
+                dst->d_fieldmask |= QC_RT_SPC_TIMER;
+        if (src->d_fieldmask & FS_DQ_BWARNS)
+                dst->d_fieldmask |= QC_SPC_WARNS;
+        if (src->d_fieldmask & FS_DQ_IWARNS)
+                dst->d_fieldmask |= QC_INO_WARNS;
+        if (src->d_fieldmask & FS_DQ_RTBWARNS)
+                dst->d_fieldmask |= QC_RT_SPC_WARNS;
+        if (src->d_fieldmask & FS_DQ_BCOUNT)
+                dst->d_fieldmask |= QC_SPACE;
+        if (src->d_fieldmask & FS_DQ_ICOUNT)
+                dst->d_fieldmask |= QC_INO_COUNT;
+        if (src->d_fieldmask & FS_DQ_RTBCOUNT)
+                dst->d_fieldmask |= QC_RT_SPACE;
+}
 static int quota_setxquota(struct super_block *sb, int type, qid_t id,
                           void __user *addr)
 {
        struct fs_disk_quota fdq;
+        struct qc_dqblk qdq;
        struct kqid qid;
        if (copy_from_user(&fdq, addr, sizeof(fdq)))
@@ -260,13 +338,44 @@ static int quota_setxquota(struct super_block *sb, int type, qid_t id,
        qid = make_kqid(current_user_ns(), type, id);
        if (!qid_valid(qid))
                return -EINVAL;
-        return sb->s_qcop->set_dqblk(sb, qid, &fdq);
+        copy_from_xfs_dqblk(&qdq, &fdq);
+        return sb->s_qcop->set_dqblk(sb, qid, &qdq);
+}
+static void copy_to_xfs_dqblk(struct fs_disk_quota *dst, struct qc_dqblk *src,
+                              int type, qid_t id)
+{
+        memset(dst, 0, sizeof(*dst));
+        dst->d_version = FS_DQUOT_VERSION;
+        dst->d_id = id;
+        if (type == USRQUOTA)
+                dst->d_flags = FS_USER_QUOTA;
+        else if (type == PRJQUOTA)
+                dst->d_flags = FS_PROJ_QUOTA;
+        else
+                dst->d_flags = FS_GROUP_QUOTA;
+        dst->d_blk_hardlimit = quota_btobb(src->d_spc_hardlimit);
+        dst->d_blk_softlimit = quota_btobb(src->d_spc_softlimit);
+        dst->d_ino_hardlimit = src->d_ino_hardlimit;
+        dst->d_ino_softlimit = src->d_ino_softlimit;
+        dst->d_bcount = quota_btobb(src->d_space);
+        dst->d_icount = src->d_ino_count;
+        dst->d_itimer = src->d_ino_timer;
+        dst->d_btimer = src->d_spc_timer;
+        dst->d_iwarns = src->d_ino_warns;
+        dst->d_bwarns = src->d_spc_warns;
+        dst->d_rtb_hardlimit = quota_btobb(src->d_rt_spc_hardlimit);
+        dst->d_rtb_softlimit = quota_btobb(src->d_rt_spc_softlimit);
+        dst->d_rtbcount = quota_btobb(src->d_rt_space);
+        dst->d_rtbtimer = src->d_rt_spc_timer;
+        dst->d_rtbwarns = src->d_rt_spc_warns;
 }
 static int quota_getxquota(struct super_block *sb, int type, qid_t id,
                           void __user *addr)
 {
        struct fs_disk_quota fdq;
+        struct qc_dqblk qdq;
        struct kqid qid;
        int ret;
@@ -275,8 +384,11 @@ static int quota_getxquota(struct super_block *sb, int type, qid_t id,
        qid = make_kqid(current_user_ns(), type, id);
        if (!qid_valid(qid))
                return -EINVAL;
-        ret = sb->s_qcop->get_dqblk(sb, qid, &fdq);
+        ret = sb->s_qcop->get_dqblk(sb, qid, &qdq);
-        if (!ret && copy_to_user(addr, &fdq, sizeof(fdq)))
+        if (ret)
+                return ret;
+        copy_to_xfs_dqblk(&fdq, &qdq, type, id);
+        if (copy_to_user(addr, &fdq, sizeof(fdq)))
                return -EFAULT;
        return ret;
 }
diff --git a/fs/udf/dir.c b/fs/udf/dir.c
index a012c51caffd..05e90edd1992 100644
--- a/fs/udf/dir.c
+++ b/fs/udf/dir.c
@@ -57,6 +57,7 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
        sector_t offset;
        int i, num, ret = 0;
        struct extent_position epos = { NULL, 0, {0, 0} };
+        struct super_block *sb = dir->i_sb;
        if (ctx->pos == 0) {
                if (!dir_emit_dot(file, ctx))
@@ -76,16 +77,16 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
        if (nf_pos == 0)
                nf_pos = udf_ext0_offset(dir);
-        fibh.soffset = fibh.eoffset = nf_pos & (dir->i_sb->s_blocksize - 1);
+        fibh.soffset = fibh.eoffset = nf_pos & (sb->s_blocksize - 1);
        if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
-                if (inode_bmap(dir, nf_pos >> dir->i_sb->s_blocksize_bits,
+                if (inode_bmap(dir, nf_pos >> sb->s_blocksize_bits,
                    &epos, &eloc, &elen, &offset)
                    != (EXT_RECORDED_ALLOCATED >> 30)) {
                        ret = -ENOENT;
                        goto out;
                }
-                block = udf_get_lb_pblock(dir->i_sb, &eloc, offset);
+                block = udf_get_lb_pblock(sb, &eloc, offset);
-                if ((++offset << dir->i_sb->s_blocksize_bits) < elen) {
+                if ((++offset << sb->s_blocksize_bits) < elen) {
                        if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
                                epos.offset -= sizeof(struct short_ad);
                        else if (iinfo->i_alloc_type ==
@@ -95,18 +96,18 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
                        offset = 0;
                }
-                if (!(fibh.sbh = fibh.ebh = udf_tread(dir->i_sb, block))) {
+                if (!(fibh.sbh = fibh.ebh = udf_tread(sb, block))) {
                        ret = -EIO;
                        goto out;
                }
-                if (!(offset & ((16 >> (dir->i_sb->s_blocksize_bits - 9)) - 1))) {
+                if (!(offset & ((16 >> (sb->s_blocksize_bits - 9)) - 1))) {
-                        i = 16 >> (dir->i_sb->s_blocksize_bits - 9);
+                        i = 16 >> (sb->s_blocksize_bits - 9);
-                        if (i + offset > (elen >> dir->i_sb->s_blocksize_bits))
+                        if (i + offset > (elen >> sb->s_blocksize_bits))
-                                i = (elen >> dir->i_sb->s_blocksize_bits) - offset;
+                                i = (elen >> sb->s_blocksize_bits) - offset;
                        for (num = 0; i > 0; i--) {
-                                block = udf_get_lb_pblock(dir->i_sb, &eloc, offset + i);
+                                block = udf_get_lb_pblock(sb, &eloc, offset + i);
-                                tmp = udf_tgetblk(dir->i_sb, block);
+                                tmp = udf_tgetblk(sb, block);
                                if (tmp && !buffer_uptodate(tmp) && !buffer_locked(tmp))
                                        bha[num++] = tmp;
                                else
@@ -152,12 +153,12 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
                }
                if ((cfi.fileCharacteristics & FID_FILE_CHAR_DELETED) != 0) {
-                        if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNDELETE))
+                        if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNDELETE))
                                continue;
                }
                if ((cfi.fileCharacteristics & FID_FILE_CHAR_HIDDEN) != 0) {
-                        if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNHIDE))
+                        if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNHIDE))
                                continue;
                }
@@ -167,12 +168,12 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
                        continue;
                }
-                flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
+                flen = udf_get_filename(sb, nameptr, lfi, fname, UDF_NAME_LEN);
                if (!flen)
                        continue;
                tloc = lelb_to_cpu(cfi.icb.extLocation);
-                iblock = udf_get_lb_pblock(dir->i_sb, &tloc, 0);
+                iblock = udf_get_lb_pblock(sb, &tloc, 0);
                if (!dir_emit(ctx, fname, flen, iblock, DT_UNKNOWN))
                        goto out;
        } /* end while */
diff --git a/fs/udf/file.c b/fs/udf/file.c
index bb15771b92ae..08f3555fbeac 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -224,7 +224,7 @@ out:
 static int udf_release_file(struct inode *inode, struct file *filp)
 {
        if (filp->f_mode & FMODE_WRITE &&
-            atomic_read(&inode->i_writecount) > 1) {
+            atomic_read(&inode->i_writecount) == 1) {
                /*
                 * Grab i_mutex to avoid races with writes changing i_size
                 * while we are running.
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index c9b4df5810d5..5bc71d9a674a 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1489,6 +1489,20 @@ reread:
        }
        inode->i_generation = iinfo->i_unique;
+        /* Sanity checks for files in ICB so that we don't get confused later */
+        if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
+                /*
+                 * For file in ICB data is stored in allocation descriptor
+                 * so sizes should match
+                 */
+                if (iinfo->i_lenAlloc != inode->i_size)
+                        goto out;
+                /* File in ICB has to fit in there... */
+                if (inode->i_size > inode->i_sb->s_blocksize -
+                                        udf_file_entry_alloc_offset(inode))
+                        goto out;
+        }
        switch (fe->icbTag.fileType) {
        case ICBTAG_FILE_TYPE_DIRECTORY:
                inode->i_op = &udf_dir_inode_operations;
diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index c12e260fd6c4..33b246b82c98 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -159,18 +159,19 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
        struct udf_inode_info *dinfo = UDF_I(dir);
        int isdotdot = child->len == 2 &&
                child->name[0] == '.' && child->name[1] == '.';
+        struct super_block *sb = dir->i_sb;
        size = udf_ext0_offset(dir) + dir->i_size;
        f_pos = udf_ext0_offset(dir);
        fibh->sbh = fibh->ebh = NULL;
-        fibh->soffset = fibh->eoffset = f_pos & (dir->i_sb->s_blocksize - 1);
+        fibh->soffset = fibh->eoffset = f_pos & (sb->s_blocksize - 1);
        if (dinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
-                if (inode_bmap(dir, f_pos >> dir->i_sb->s_blocksize_bits, &epos,
+                if (inode_bmap(dir, f_pos >> sb->s_blocksize_bits, &epos,
                    &eloc, &elen, &offset) != (EXT_RECORDED_ALLOCATED >> 30))
                        goto out_err;
-                block = udf_get_lb_pblock(dir->i_sb, &eloc, offset);
+                block = udf_get_lb_pblock(sb, &eloc, offset);
-                if ((++offset << dir->i_sb->s_blocksize_bits) < elen) {
+                if ((++offset << sb->s_blocksize_bits) < elen) {
                        if (dinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
                                epos.offset -= sizeof(struct short_ad);
                        else if (dinfo->i_alloc_type == ICBTAG_FLAG_AD_LONG)
@@ -178,7 +179,7 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
                } else
                        offset = 0;
-                fibh->sbh = fibh->ebh = udf_tread(dir->i_sb, block);
+                fibh->sbh = fibh->ebh = udf_tread(sb, block);
                if (!fibh->sbh)
                        goto out_err;
        }
@@ -217,12 +218,12 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
                }
                if ((cfi->fileCharacteristics & FID_FILE_CHAR_DELETED) != 0) {
-                        if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNDELETE))
+                        if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNDELETE))
                                continue;
                }
                if ((cfi->fileCharacteristics & FID_FILE_CHAR_HIDDEN) != 0) {
-                        if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNHIDE))
+                        if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNHIDE))
                                continue;
                }
@@ -233,7 +234,7 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
                if (!lfi)
                        continue;
-                flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
+                flen = udf_get_filename(sb, nameptr, lfi, fname, UDF_NAME_LEN);
                if (flen && udf_match(flen, fname, child->len, child->name))
                        goto out_ok;
        }
diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
index 6fb7945c1e6e..ac10ca939f26 100644
--- a/fs/udf/symlink.c
+++ b/fs/udf/symlink.c
@@ -30,49 +30,73 @@
 #include <linux/buffer_head.h>
 #include "udf_i.h"
-static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
+static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
-                           int fromlen, unsigned char *to)
+                          int fromlen, unsigned char *to, int tolen)
 {
        struct pathComponent *pc;
        int elen = 0;
+        int comp_len;
        unsigned char *p = to;
+        /* Reserve one byte for terminating \0 */
+        tolen--;
        while (elen < fromlen) {
                pc = (struct pathComponent *)(from + elen);
+                elen += sizeof(struct pathComponent);
                switch (pc->componentType) {
                case 1:
                        /*
                         * Symlink points to some place which should be agreed
                         * upon between originator and receiver of the media. Ignore.
                         */
-                        if (pc->lengthComponentIdent > 0)
+                        if (pc->lengthComponentIdent > 0) {
+                                elen += pc->lengthComponentIdent;
                                break;
+                        }
                        /* Fall through */
                case 2:
+                        if (tolen == 0)
+                                return -ENAMETOOLONG;
                        p = to;
                        *p++ = '/';
+                        tolen--;
                        break;
                case 3:
+                        if (tolen < 3)
+                                return -ENAMETOOLONG;
                        memcpy(p, "../", 3);
                        p += 3;
+                        tolen -= 3;
                        break;
                case 4:
+                        if (tolen < 2)
+                                return -ENAMETOOLONG;
                        memcpy(p, "./", 2);
                        p += 2;
+                        tolen -= 2;
                        /* that would be . - just ignore */
                        break;
                case 5:
-                        p += udf_get_filename(sb, pc->componentIdent, p,
+                        elen += pc->lengthComponentIdent;
-                                              pc->lengthComponentIdent);
+                        if (elen > fromlen)
+                                return -EIO;
+                        comp_len = udf_get_filename(sb, pc->componentIdent,
+                                                    pc->lengthComponentIdent,
+                                                    p, tolen);
+                        p += comp_len;
+                        tolen -= comp_len;
+                        if (tolen == 0)
+                                return -ENAMETOOLONG;
                        *p++ = '/';
+                        tolen--;
                        break;
                }
-                elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
        }
        if (p > to + 1)
                p[-1] = '\0';
        else
                p[0] = '\0';
+        return 0;
 }
 static int udf_symlink_filler(struct file *file, struct page *page)
@@ -80,11 +104,17 @@ static int udf_symlink_filler(struct file *file, struct page *page)
        struct inode *inode = page->mapping->host;
        struct buffer_head *bh = NULL;
        unsigned char *symlink;
-        int err = -EIO;
+        int err;
        unsigned char *p = kmap(page);
        struct udf_inode_info *iinfo;
        uint32_t pos;
+        /* We don't support symlinks longer than one block */
+        if (inode->i_size > inode->i_sb->s_blocksize) {
+                err = -ENAMETOOLONG;
+                goto out_unmap;
+        }
        iinfo = UDF_I(inode);
        pos = udf_block_map(inode, 0);
@@ -94,14 +124,18 @@ static int udf_symlink_filler(struct file *file, struct page *page)
        } else {
                bh = sb_bread(inode->i_sb, pos);
-                if (!bh)
+                if (!bh) {
-                        goto out;
+                        err = -EIO;
+                        goto out_unlock_inode;
+                }
                symlink = bh->b_data;
        }
-        udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p);
+        err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE);
        brelse(bh);
+        if (err)
+                goto out_unlock_inode;
        up_read(&iinfo->i_data_sem);
        SetPageUptodate(page);
@@ -109,9 +143,10 @@ static int udf_symlink_filler(struct file *file, struct page *page)
        unlock_page(page);
        return 0;
-out:
+out_unlock_inode:
        up_read(&iinfo->i_data_sem);
        SetPageError(page);
+out_unmap:
        kunmap(page);
        unlock_page(page);
        return err;
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index 1cc3c993ebd0..47bb3f5ca360 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -211,7 +211,8 @@ udf_get_lb_pblock(struct super_block *sb, struct kernel_lb_addr *loc,
 }
 /* unicode.c */
-extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int);
+extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *,
+                            int);
 extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *,
                            int);
 extern int udf_build_ustr(struct ustr *, dstring *, int);
diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
index afd470e588ff..b84fee372734 100644
--- a/fs/udf/unicode.c
+++ b/fs/udf/unicode.c
@@ -28,7 +28,8 @@
 #include "udf_sb.h"
-static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int);
+static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *,
+                                  int);
 static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen)
 {
@@ -333,8 +334,8 @@ try_again:
        return u_len + 1;
 }
-int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen,
-                     int flen)
+                     uint8_t *dname, int dlen)
 {
        struct ustr *filename, *unifilename;
        int len = 0;
@@ -347,7 +348,7 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
        if (!unifilename)
                goto out1;
-        if (udf_build_ustr_exact(unifilename, sname, flen))
+        if (udf_build_ustr_exact(unifilename, sname, slen))
                goto out2;
        if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) {
@@ -366,7 +367,8 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
        } else
                goto out2;
-        len = udf_translate_to_linux(dname, filename->u_name, filename->u_len,
+        len = udf_translate_to_linux(dname, dlen,
+                                     filename->u_name, filename->u_len,
                                     unifilename->u_name, unifilename->u_len);
 out2:
        kfree(unifilename);
@@ -403,10 +405,12 @@ int udf_put_filename(struct super_block *sb, const uint8_t *sname,
 #define EXT_MARK                '.'
 #define CRC_MARK                '#'
 #define EXT_SIZE                5
+/* Number of chars we need to store generated CRC to make filename unique */
+#define CRC_LEN                 5
-static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+static int udf_translate_to_linux(uint8_t *newName, int newLen,
-                                  int udfLen, uint8_t *fidName,
+                                  uint8_t *udfName, int udfLen,
-                                  int fidNameLen)
+                                  uint8_t *fidName, int fidNameLen)
 {
        int index, newIndex = 0, needsCRC = 0;
        int extIndex = 0, newExtIndex = 0, hasExt = 0;
@@ -439,7 +443,7 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
                                        newExtIndex = newIndex;
                                }
                        }
-                        if (newIndex < 256)
+                        if (newIndex < newLen)
                                newName[newIndex++] = curr;
                        else
                                needsCRC = 1;
@@ -467,13 +471,13 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
                                }
                                ext[localExtIndex++] = curr;
                        }
-                        maxFilenameLen = 250 - localExtIndex;
+                        maxFilenameLen = newLen - CRC_LEN - localExtIndex;
                        if (newIndex > maxFilenameLen)
                                newIndex = maxFilenameLen;
                        else
                                newIndex = newExtIndex;
-                } else if (newIndex > 250)
+                } else if (newIndex > newLen - CRC_LEN)
-                        newIndex = 250;
+                        newIndex = newLen - CRC_LEN;
                newName[newIndex++] = CRC_MARK;
                valueCRC = crc_itu_t(0, fidName, fidNameLen);
                newName[newIndex++] = hex_asc_upper_hi(valueCRC >> 8);
diff --git a/fs/xfs/xfs_qm.h b/fs/xfs/xfs_qm.h
index 3a07a937e232..41f6c0b9d51c 100644
--- a/fs/xfs/xfs_qm.h
+++ b/fs/xfs/xfs_qm.h
@@ -166,9 +166,9 @@ extern void		xfs_qm_dqrele_all_inodes(struct xfs_mount *, uint);
 /* quota ops */
 extern int              xfs_qm_scall_trunc_qfiles(struct xfs_mount *, uint);
 extern int              xfs_qm_scall_getquota(struct xfs_mount *, xfs_dqid_t,
-                                        uint, struct fs_disk_quota *);
+                                        uint, struct qc_dqblk *);
 extern int              xfs_qm_scall_setqlim(struct xfs_mount *, xfs_dqid_t, uint,
-                                        struct fs_disk_quota *);
+                                        struct qc_dqblk *);
 extern int              xfs_qm_scall_getqstat(struct xfs_mount *,
                                        struct fs_quota_stat *);
 extern int              xfs_qm_scall_getqstatv(struct xfs_mount *,
diff --git a/fs/xfs/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c
index 74fca68e43b6..cb6168ec92c9 100644
--- a/fs/xfs/xfs_qm_syscalls.c
+++ b/fs/xfs/xfs_qm_syscalls.c
@@ -39,7 +39,6 @@ STATIC int	xfs_qm_log_quotaoff(xfs_mount_t *, xfs_qoff_logitem_t **, uint);
 STATIC int      xfs_qm_log_quotaoff_end(xfs_mount_t *, xfs_qoff_logitem_t *,
                                        uint);
 STATIC uint     xfs_qm_export_flags(uint);
-STATIC uint     xfs_qm_export_qtype_flags(uint);
 /*
 * Turn off quota accounting and/or enforcement for all udquots and/or
@@ -573,8 +572,8 @@ xfs_qm_scall_getqstatv(
        return 0;
 }
-#define XFS_DQ_MASK \
+#define XFS_QC_MASK \
-        (FS_DQ_LIMIT_MASK | FS_DQ_TIMER_MASK | FS_DQ_WARNS_MASK)
+        (QC_LIMIT_MASK | QC_TIMER_MASK | QC_WARNS_MASK)
 /*
 * Adjust quota limits, and start/stop timers accordingly.
@@ -584,7 +583,7 @@ xfs_qm_scall_setqlim(
        struct xfs_mount        *mp,
        xfs_dqid_t              id,
        uint                    type,
-        fs_disk_quota_t         *newlim)
+        struct qc_dqblk         *newlim)
 {
        struct xfs_quotainfo    *q = mp->m_quotainfo;
        struct xfs_disk_dquot   *ddq;
@@ -593,9 +592,9 @@ xfs_qm_scall_setqlim(
        int                     error;
        xfs_qcnt_t              hard, soft;
-        if (newlim->d_fieldmask & ~XFS_DQ_MASK)
+        if (newlim->d_fieldmask & ~XFS_QC_MASK)
                return -EINVAL;
-        if ((newlim->d_fieldmask & XFS_DQ_MASK) == 0)
+        if ((newlim->d_fieldmask & XFS_QC_MASK) == 0)
                return 0;
        /*
@@ -633,11 +632,11 @@ xfs_qm_scall_setqlim(
        /*
         * Make sure that hardlimits are >= soft limits before changing.
         */
-        hard = (newlim->d_fieldmask & FS_DQ_BHARD) ?
+        hard = (newlim->d_fieldmask & QC_SPC_HARD) ?
-                (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_blk_hardlimit) :
+                (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_spc_hardlimit) :
                        be64_to_cpu(ddq->d_blk_hardlimit);
-        soft = (newlim->d_fieldmask & FS_DQ_BSOFT) ?
+        soft = (newlim->d_fieldmask & QC_SPC_SOFT) ?
-                (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_blk_softlimit) :
+                (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_spc_softlimit) :
                        be64_to_cpu(ddq->d_blk_softlimit);
        if (hard == 0 || hard >= soft) {
                ddq->d_blk_hardlimit = cpu_to_be64(hard);
@@ -650,11 +649,11 @@ xfs_qm_scall_setqlim(
        } else {
                xfs_debug(mp, "blkhard %Ld < blksoft %Ld", hard, soft);
        }
-        hard = (newlim->d_fieldmask & FS_DQ_RTBHARD) ?
+        hard = (newlim->d_fieldmask & QC_RT_SPC_HARD) ?
-                (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_rtb_hardlimit) :
+                (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_rt_spc_hardlimit) :
                        be64_to_cpu(ddq->d_rtb_hardlimit);
-        soft = (newlim->d_fieldmask & FS_DQ_RTBSOFT) ?
+        soft = (newlim->d_fieldmask & QC_RT_SPC_SOFT) ?
-                (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_rtb_softlimit) :
+                (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_rt_spc_softlimit) :
                        be64_to_cpu(ddq->d_rtb_softlimit);
        if (hard == 0 || hard >= soft) {
                ddq->d_rtb_hardlimit = cpu_to_be64(hard);
@@ -667,10 +666,10 @@ xfs_qm_scall_setqlim(
                xfs_debug(mp, "rtbhard %Ld < rtbsoft %Ld", hard, soft);
        }
-        hard = (newlim->d_fieldmask & FS_DQ_IHARD) ?
+        hard = (newlim->d_fieldmask & QC_INO_HARD) ?
                (xfs_qcnt_t) newlim->d_ino_hardlimit :
                        be64_to_cpu(ddq->d_ino_hardlimit);
-        soft = (newlim->d_fieldmask & FS_DQ_ISOFT) ?
+        soft = (newlim->d_fieldmask & QC_INO_SOFT) ?
                (xfs_qcnt_t) newlim->d_ino_softlimit :
                        be64_to_cpu(ddq->d_ino_softlimit);
        if (hard == 0 || hard >= soft) {
@@ -687,12 +686,12 @@ xfs_qm_scall_setqlim(
        /*
         * Update warnings counter(s) if requested
         */
-        if (newlim->d_fieldmask & FS_DQ_BWARNS)
+        if (newlim->d_fieldmask & QC_SPC_WARNS)
-                ddq->d_bwarns = cpu_to_be16(newlim->d_bwarns);
+                ddq->d_bwarns = cpu_to_be16(newlim->d_spc_warns);
-        if (newlim->d_fieldmask & FS_DQ_IWARNS)
+        if (newlim->d_fieldmask & QC_INO_WARNS)
-                ddq->d_iwarns = cpu_to_be16(newlim->d_iwarns);
+                ddq->d_iwarns = cpu_to_be16(newlim->d_ino_warns);
-        if (newlim->d_fieldmask & FS_DQ_RTBWARNS)
+        if (newlim->d_fieldmask & QC_RT_SPC_WARNS)
-                ddq->d_rtbwarns = cpu_to_be16(newlim->d_rtbwarns);
+                ddq->d_rtbwarns = cpu_to_be16(newlim->d_rt_spc_warns);
        if (id == 0) {
                /*
@@ -702,24 +701,24 @@ xfs_qm_scall_setqlim(
                 * soft and hard limit values (already done, above), and
                 * for warnings.
                 */
-                if (newlim->d_fieldmask & FS_DQ_BTIMER) {
+                if (newlim->d_fieldmask & QC_SPC_TIMER) {
-                        q->qi_btimelimit = newlim->d_btimer;
+                        q->qi_btimelimit = newlim->d_spc_timer;
-                        ddq->d_btimer = cpu_to_be32(newlim->d_btimer);
+                        ddq->d_btimer = cpu_to_be32(newlim->d_spc_timer);
                }
-                if (newlim->d_fieldmask & FS_DQ_ITIMER) {
+                if (newlim->d_fieldmask & QC_INO_TIMER) {
-                        q->qi_itimelimit = newlim->d_itimer;
+                        q->qi_itimelimit = newlim->d_ino_timer;
-                        ddq->d_itimer = cpu_to_be32(newlim->d_itimer);
+                        ddq->d_itimer = cpu_to_be32(newlim->d_ino_timer);
                }
-                if (newlim->d_fieldmask & FS_DQ_RTBTIMER) {
+                if (newlim->d_fieldmask & QC_RT_SPC_TIMER) {
-                        q->qi_rtbtimelimit = newlim->d_rtbtimer;
+                        q->qi_rtbtimelimit = newlim->d_rt_spc_timer;
-                        ddq->d_rtbtimer = cpu_to_be32(newlim->d_rtbtimer);
+                        ddq->d_rtbtimer = cpu_to_be32(newlim->d_rt_spc_timer);
                }
-                if (newlim->d_fieldmask & FS_DQ_BWARNS)
+                if (newlim->d_fieldmask & QC_SPC_WARNS)
-                        q->qi_bwarnlimit = newlim->d_bwarns;
+                        q->qi_bwarnlimit = newlim->d_spc_warns;
-                if (newlim->d_fieldmask & FS_DQ_IWARNS)
+                if (newlim->d_fieldmask & QC_INO_WARNS)
-                        q->qi_iwarnlimit = newlim->d_iwarns;
+                        q->qi_iwarnlimit = newlim->d_ino_warns;
-                if (newlim->d_fieldmask & FS_DQ_RTBWARNS)
+                if (newlim->d_fieldmask & QC_RT_SPC_WARNS)
-                        q->qi_rtbwarnlimit = newlim->d_rtbwarns;
+                        q->qi_rtbwarnlimit = newlim->d_rt_spc_warns;
        } else {
                /*
                 * If the user is now over quota, start the timelimit.
@@ -824,7 +823,7 @@ xfs_qm_scall_getquota(
        struct xfs_mount        *mp,
        xfs_dqid_t              id,
        uint                    type,
-        struct fs_disk_quota    *dst)
+        struct qc_dqblk         *dst)
 {
        struct xfs_dquot        *dqp;
        int                     error;
@@ -848,28 +847,25 @@ xfs_qm_scall_getquota(
        }
        memset(dst, 0, sizeof(*dst));
-        dst->d_version = FS_DQUOT_VERSION;
+        dst->d_spc_hardlimit =
-        dst->d_flags = xfs_qm_export_qtype_flags(dqp->q_core.d_flags);
+                XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_blk_hardlimit));
-        dst->d_id = be32_to_cpu(dqp->q_core.d_id);
+        dst->d_spc_softlimit =
-        dst->d_blk_hardlimit =
+                XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_blk_softlimit));
-                XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_blk_hardlimit));
-        dst->d_blk_softlimit =
-                XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_blk_softlimit));
        dst->d_ino_hardlimit = be64_to_cpu(dqp->q_core.d_ino_hardlimit);
        dst->d_ino_softlimit = be64_to_cpu(dqp->q_core.d_ino_softlimit);
-        dst->d_bcount = XFS_FSB_TO_BB(mp, dqp->q_res_bcount);
+        dst->d_space = XFS_FSB_TO_B(mp, dqp->q_res_bcount);
-        dst->d_icount = dqp->q_res_icount;
+        dst->d_ino_count = dqp->q_res_icount;
-        dst->d_btimer = be32_to_cpu(dqp->q_core.d_btimer);
+        dst->d_spc_timer = be32_to_cpu(dqp->q_core.d_btimer);
-        dst->d_itimer = be32_to_cpu(dqp->q_core.d_itimer);
+        dst->d_ino_timer = be32_to_cpu(dqp->q_core.d_itimer);
-        dst->d_iwarns = be16_to_cpu(dqp->q_core.d_iwarns);
+        dst->d_ino_warns = be16_to_cpu(dqp->q_core.d_iwarns);
-        dst->d_bwarns = be16_to_cpu(dqp->q_core.d_bwarns);
+        dst->d_spc_warns = be16_to_cpu(dqp->q_core.d_bwarns);
-        dst->d_rtb_hardlimit =
+        dst->d_rt_spc_hardlimit =
-                XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_rtb_hardlimit));
+                XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_rtb_hardlimit));
-        dst->d_rtb_softlimit =
+        dst->d_rt_spc_softlimit =
-                XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_rtb_softlimit));
+                XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_rtb_softlimit));
-        dst->d_rtbcount = XFS_FSB_TO_BB(mp, dqp->q_res_rtbcount);
+        dst->d_rt_space = XFS_FSB_TO_B(mp, dqp->q_res_rtbcount);
-        dst->d_rtbtimer = be32_to_cpu(dqp->q_core.d_rtbtimer);
+        dst->d_rt_spc_timer = be32_to_cpu(dqp->q_core.d_rtbtimer);
-        dst->d_rtbwarns = be16_to_cpu(dqp->q_core.d_rtbwarns);
+        dst->d_rt_spc_warns = be16_to_cpu(dqp->q_core.d_rtbwarns);
        /*
         * Internally, we don't reset all the timers when quota enforcement
@@ -882,23 +878,23 @@ xfs_qm_scall_getquota(
             dqp->q_core.d_flags == XFS_DQ_GROUP) ||
            (!XFS_IS_PQUOTA_ENFORCED(mp) &&
             dqp->q_core.d_flags == XFS_DQ_PROJ)) {
-                dst->d_btimer = 0;
+                dst->d_spc_timer = 0;
-                dst->d_itimer = 0;
+                dst->d_ino_timer = 0;
-                dst->d_rtbtimer = 0;
+                dst->d_rt_spc_timer = 0;
        }
 #ifdef DEBUG
-        if (((XFS_IS_UQUOTA_ENFORCED(mp) && dst->d_flags == FS_USER_QUOTA) ||
+        if (((XFS_IS_UQUOTA_ENFORCED(mp) && type == XFS_DQ_USER) ||
-             (XFS_IS_GQUOTA_ENFORCED(mp) && dst->d_flags == FS_GROUP_QUOTA) ||
+             (XFS_IS_GQUOTA_ENFORCED(mp) && type == XFS_DQ_GROUP) ||
-             (XFS_IS_PQUOTA_ENFORCED(mp) && dst->d_flags == FS_PROJ_QUOTA)) &&
+             (XFS_IS_PQUOTA_ENFORCED(mp) && type == XFS_DQ_PROJ)) &&
-            dst->d_id != 0) {
+            id != 0) {
-                if ((dst->d_bcount > dst->d_blk_softlimit) &&
+                if ((dst->d_space > dst->d_spc_softlimit) &&
-                    (dst->d_blk_softlimit > 0)) {
+                    (dst->d_spc_softlimit > 0)) {
-                        ASSERT(dst->d_btimer != 0);
+                        ASSERT(dst->d_spc_timer != 0);
                }
-                if ((dst->d_icount > dst->d_ino_softlimit) &&
+                if ((dst->d_ino_count > dst->d_ino_softlimit) &&
                    (dst->d_ino_softlimit > 0)) {
-                        ASSERT(dst->d_itimer != 0);
+                        ASSERT(dst->d_ino_timer != 0);
                }
        }
 #endif
@@ -908,26 +904,6 @@ out_put:
 }
 STATIC uint
-xfs_qm_export_qtype_flags(
-        uint flags)
-{
-        /*
-         * Can't be more than one, or none.
-         */
-        ASSERT((flags & (FS_PROJ_QUOTA | FS_USER_QUOTA)) !=
-                (FS_PROJ_QUOTA | FS_USER_QUOTA));
-        ASSERT((flags & (FS_PROJ_QUOTA | FS_GROUP_QUOTA)) !=
-                (FS_PROJ_QUOTA | FS_GROUP_QUOTA));
-        ASSERT((flags & (FS_USER_QUOTA | FS_GROUP_QUOTA)) !=
-                (FS_USER_QUOTA | FS_GROUP_QUOTA));
-        ASSERT((flags & (FS_PROJ_QUOTA|FS_USER_QUOTA|FS_GROUP_QUOTA)) != 0);
-        return (flags & XFS_DQ_USER) ?
-                FS_USER_QUOTA : (flags & XFS_DQ_PROJ) ?
-                        FS_PROJ_QUOTA : FS_GROUP_QUOTA;
-}
-STATIC uint
 xfs_qm_export_flags(
        uint flags)
 {
diff --git a/fs/xfs/xfs_quotaops.c b/fs/xfs/xfs_quotaops.c
index 7542bbeca6a1..801a84c1cdc3 100644
--- a/fs/xfs/xfs_quotaops.c
+++ b/fs/xfs/xfs_quotaops.c
@@ -131,7 +131,7 @@ STATIC int
 xfs_fs_get_dqblk(
        struct super_block      *sb,
        struct kqid             qid,
-        struct fs_disk_quota    *fdq)
+        struct qc_dqblk         *qdq)
 {
        struct xfs_mount        *mp = XFS_M(sb);
@@ -141,14 +141,14 @@ xfs_fs_get_dqblk(
                return -ESRCH;
        return xfs_qm_scall_getquota(mp, from_kqid(&init_user_ns, qid),
-                                      xfs_quota_type(qid.type), fdq);
+                                      xfs_quota_type(qid.type), qdq);
 }
 STATIC int
 xfs_fs_set_dqblk(
        struct super_block      *sb,
        struct kqid             qid,
-        struct fs_disk_quota    *fdq)
+        struct qc_dqblk         *qdq)
 {
        struct xfs_mount        *mp = XFS_M(sb);
@@ -160,7 +160,7 @@ xfs_fs_set_dqblk(
                return -ESRCH;
        return xfs_qm_scall_setqlim(mp, from_kqid(&init_user_ns, qid),
-                                     xfs_quota_type(qid.type), fdq);
+                                     xfs_quota_type(qid.type), qdq);
 }
 const struct quotactl_ops xfs_quotactl_operations = {
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index 3ca9b751f122..b95dc32a6e6b 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -196,8 +196,8 @@ struct acpi_processor_flags {
 struct acpi_processor {
        acpi_handle handle;
        u32 acpi_id;
-        u32 apic_id;
+        u32 phys_id;    /* CPU hardware ID such as APIC ID for x86 */
-        u32 id;
+        u32 id;         /* CPU logical ID allocated by OS */
        u32 pblk;
        int performance_platform_limit;
        int throttling_platform_limit;
@@ -310,8 +310,8 @@ static inline int acpi_processor_get_bios_limit(int cpu, unsigned int *limit)
 #endif                          /* CONFIG_CPU_FREQ */
 /* in processor_core.c */
-int acpi_get_apicid(acpi_handle, int type, u32 acpi_id);
+int acpi_get_phys_id(acpi_handle, int type, u32 acpi_id);
-int acpi_map_cpuid(int apic_id, u32 acpi_id);
+int acpi_map_cpuid(int phys_id, u32 acpi_id);
 int acpi_get_cpuid(acpi_handle, int type, u32 acpi_id);
 /* in processor_pdc.c */
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index 08848050922e..db284bff29dc 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -136,8 +136,12 @@ static inline void __tlb_adjust_range(struct mmu_gather *tlb,
 static inline void __tlb_reset_range(struct mmu_gather *tlb)
 {
-        tlb->start = TASK_SIZE;
+        if (tlb->fullmm) {
-        tlb->end = 0;
+                tlb->start = tlb->end = ~0;
+        } else {
+                tlb->start = TASK_SIZE;
+                tlb->end = 0;
+        }
 }
 /*
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 8ba35c622e22..e1b2e8b98af7 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -901,11 +901,15 @@ extern int drm_vblank_init(struct drm_device *dev, int num_crtcs);
 extern int drm_wait_vblank(struct drm_device *dev, void *data,
                           struct drm_file *filp);
 extern u32 drm_vblank_count(struct drm_device *dev, int crtc);
+extern u32 drm_crtc_vblank_count(struct drm_crtc *crtc);
 extern u32 drm_vblank_count_and_time(struct drm_device *dev, int crtc,
                                     struct timeval *vblanktime);
 extern void drm_send_vblank_event(struct drm_device *dev, int crtc,
                                     struct drm_pending_vblank_event *e);
+extern void drm_crtc_send_vblank_event(struct drm_crtc *crtc,
+                                       struct drm_pending_vblank_event *e);
 extern bool drm_handle_vblank(struct drm_device *dev, int crtc);
+extern bool drm_crtc_handle_vblank(struct drm_crtc *crtc);
 extern int drm_vblank_get(struct drm_device *dev, int crtc);
 extern void drm_vblank_put(struct drm_device *dev, int crtc);
 extern int drm_crtc_vblank_get(struct drm_crtc *crtc);
diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h
index 780511a459c0..1e6ae1458f7a 100644
--- a/include/drm/drm_gem.h
+++ b/include/drm/drm_gem.h
@@ -119,13 +119,6 @@ struct drm_gem_object {
         * simply leave it as NULL.
         */
        struct dma_buf_attachment *import_attach;
-        /**
-         * dumb - created as dumb buffer
-         * Whether the gem object was created using the dumb buffer interface
-         * as such it may not be used for GPU rendering.
-         */
-        bool dumb;
 };
 void drm_gem_object_release(struct drm_gem_object *obj);
diff --git a/include/dt-bindings/interrupt-controller/arm-gic.h b/include/dt-bindings/interrupt-controller/arm-gic.h
index 1ea1b702fec2..d4110d5caa3e 100644
--- a/include/dt-bindings/interrupt-controller/arm-gic.h
+++ b/include/dt-bindings/interrupt-controller/arm-gic.h
@@ -7,14 +7,14 @@
 #include <dt-bindings/interrupt-controller/irq.h>
-/* interrupt specific cell 0 */
+/* interrupt specifier cell 0 */
 #define GIC_SPI 0
 #define GIC_PPI 1
 /*
 * Interrupt specifier cell 2.
- * The flaggs in irq.h are valid, plus those below.
+ * The flags in irq.h are valid, plus those below.
 */
 #define GIC_CPU_MASK_RAW(x) ((x) << 8)
 #define GIC_CPU_MASK_SIMPLE(num) GIC_CPU_MASK_RAW((1 << (num)) - 1)
diff --git a/include/dt-bindings/thermal/thermal.h b/include/dt-bindings/thermal/thermal.h
index 59822a995858..b5e6b0069ac7 100644
--- a/include/dt-bindings/thermal/thermal.h
+++ b/include/dt-bindings/thermal/thermal.h
@@ -11,7 +11,7 @@
 #define _DT_BINDINGS_THERMAL_THERMAL_H
 /* On cooling devices upper and lower limits */
-#define THERMAL_NO_LIMIT                (-1UL)
+#define THERMAL_NO_LIMIT                (~0)
 #endif
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 856d381b1d5b..d459cd17b477 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -147,8 +147,8 @@ void acpi_numa_arch_fixup(void);
 #ifdef CONFIG_ACPI_HOTPLUG_CPU
 /* Arch dependent functions for cpu hotplug support */
-int acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu);
+int acpi_map_cpu(acpi_handle handle, int physid, int *pcpu);
-int acpi_unmap_lsapic(int cpu);
+int acpi_unmap_cpu(int cpu);
 #endif /* CONFIG_ACPI_HOTPLUG_CPU */
 int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base);
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 0c04917c2f12..af84234e1f6e 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -47,6 +47,7 @@ struct sk_buff;
 struct audit_krule {
        int                     vers_ops;
+        u32                     pflags;
        u32                     flags;
        u32                     listnr;
        u32                     action;
@@ -64,6 +65,9 @@ struct audit_krule {
        u64                     prio;
 };
+/* Flag to indicate legacy AUDIT_LOGINUID unset usage */
+#define AUDIT_LOGINUID_LEGACY           0x1
 struct audit_field {
        u32                             type;
        union {
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index 8aded9ab2e4e..5735e7130d63 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -34,7 +34,6 @@ struct blk_mq_hw_ctx {
        unsigned long           flags;          /* BLK_MQ_F_* flags */
        struct request_queue    *queue;
-        unsigned int            queue_num;
        struct blk_flush_queue  *fq;
        void                    *driver_data;
@@ -54,7 +53,7 @@ struct blk_mq_hw_ctx {
        unsigned long           dispatched[BLK_MQ_MAX_DISPATCH_ORDER];
        unsigned int            numa_node;
-        unsigned int            cmd_size;       /* per-request extra data */
+        unsigned int            queue_num;
        atomic_t                nr_active;
@@ -195,13 +194,16 @@ static inline u16 blk_mq_unique_tag_to_tag(u32 unique_tag)
 struct blk_mq_hw_ctx *blk_mq_map_queue(struct request_queue *, const int ctx_index);
 struct blk_mq_hw_ctx *blk_mq_alloc_single_hw_queue(struct blk_mq_tag_set *, unsigned int, int);
+int blk_mq_request_started(struct request *rq);
 void blk_mq_start_request(struct request *rq);
 void blk_mq_end_request(struct request *rq, int error);
 void __blk_mq_end_request(struct request *rq, int error);
 void blk_mq_requeue_request(struct request *rq);
 void blk_mq_add_to_requeue_list(struct request *rq, bool at_head);
+void blk_mq_cancel_requeue_work(struct request_queue *q);
 void blk_mq_kick_requeue_list(struct request_queue *q);
+void blk_mq_abort_requeue_list(struct request_queue *q);
 void blk_mq_complete_request(struct request *rq);
 void blk_mq_stop_hw_queue(struct blk_mq_hw_ctx *hctx);
@@ -212,6 +214,8 @@ void blk_mq_start_stopped_hw_queues(struct request_queue *q, bool async);
 void blk_mq_delay_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs);
 void blk_mq_tag_busy_iter(struct blk_mq_hw_ctx *hctx, busy_iter_fn *fn,
                void *priv);
+void blk_mq_unfreeze_queue(struct request_queue *q);
+void blk_mq_freeze_queue_start(struct request_queue *q);
 /*
 * Driver command data is immediately after the request. So subtract request
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 445d59231bc4..c294e3e25e37 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -190,6 +190,7 @@ enum rq_flag_bits {
        __REQ_PM,               /* runtime pm request */
        __REQ_HASHED,           /* on IO scheduler merge hash */
        __REQ_MQ_INFLIGHT,      /* track inflight for MQ */
+        __REQ_NO_TIMEOUT,       /* requests may never expire */
        __REQ_NR_BITS,          /* stops here */
 };
@@ -243,5 +244,6 @@ enum rq_flag_bits {
 #define REQ_PM                  (1ULL << __REQ_PM)
 #define REQ_HASHED              (1ULL << __REQ_HASHED)
 #define REQ_MQ_INFLIGHT         (1ULL << __REQ_MQ_INFLIGHT)
+#define REQ_NO_TIMEOUT          (1ULL << __REQ_NO_TIMEOUT)
 #endif /* __LINUX_BLK_TYPES_H */
diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h
index 5d86416d35f2..61b19c46bdb3 100644
--- a/include/linux/ceph/osd_client.h
+++ b/include/linux/ceph/osd_client.h
@@ -87,8 +87,8 @@ struct ceph_osd_req_op {
                        struct ceph_osd_data osd_data;
                } extent;
                struct {
-                        __le32 name_len;
+                        u32 name_len;
-                        __le32 value_len;
+                        u32 value_len;
                        __u8 cmp_op;       /* CEPH_OSD_CMPXATTR_OP_* */
                        __u8 cmp_mode;     /* CEPH_OSD_CMPXATTR_MODE_* */
                        struct ceph_osd_data osd_data;
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index a1c81f80978e..176bf816875e 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -215,7 +215,7 @@ static __always_inline void __read_once_size(volatile void *p, void *res, int si
        }
 }
-static __always_inline void __assign_once_size(volatile void *p, void *res, int size)
+static __always_inline void __write_once_size(volatile void *p, void *res, int size)
 {
        switch (size) {
        case 1: *(volatile __u8 *)p = *(__u8 *)res; break;
@@ -235,15 +235,15 @@ static __always_inline void __assign_once_size(volatile void *p, void *res, int
 /*
 * Prevent the compiler from merging or refetching reads or writes. The
 * compiler is also forbidden from reordering successive instances of
- * READ_ONCE, ASSIGN_ONCE and ACCESS_ONCE (see below), but only when the
+ * READ_ONCE, WRITE_ONCE and ACCESS_ONCE (see below), but only when the
 * compiler is aware of some particular ordering.  One way to make the
 * compiler aware of ordering is to put the two invocations of READ_ONCE,
- * ASSIGN_ONCE or ACCESS_ONCE() in different C statements.
+ * WRITE_ONCE or ACCESS_ONCE() in different C statements.
 *
 * In contrast to ACCESS_ONCE these two macros will also work on aggregate
 * data types like structs or unions. If the size of the accessed data
 * type exceeds the word size of the machine (e.g., 32 bits or 64 bits)
- * READ_ONCE() and ASSIGN_ONCE()  will fall back to memcpy and print a
+ * READ_ONCE() and WRITE_ONCE()  will fall back to memcpy and print a
 * compile-time warning.
 *
 * Their two major use cases are: (1) Mediating communication between
@@ -257,8 +257,8 @@ static __always_inline void __assign_once_size(volatile void *p, void *res, int
 #define READ_ONCE(x) \
        ({ typeof(x) __val; __read_once_size(&x, &__val, sizeof(__val)); __val; })
-#define ASSIGN_ONCE(val, x) \
+#define WRITE_ONCE(x, val) \
-        ({ typeof(x) __val; __val = val; __assign_once_size(&x, &__val, sizeof(__val)); __val; })
+        ({ typeof(x) __val; __val = val; __write_once_size(&x, &__val, sizeof(__val)); __val; })
 #endif /* __KERNEL__ */
@@ -385,7 +385,7 @@ static __always_inline void __assign_once_size(volatile void *p, void *res, int
 /* Is this type a native word size -- useful for atomic operations */
 #ifndef __native_word
-# define __native_word(t) (sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
+# define __native_word(t) (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
 #endif
 /* Compile time object size, -1 for unknown */
diff --git a/include/linux/cpu_cooling.h b/include/linux/cpu_cooling.h
index c303d383def1..bd955270d5aa 100644
--- a/include/linux/cpu_cooling.h
+++ b/include/linux/cpu_cooling.h
@@ -50,7 +50,7 @@ static inline struct thermal_cooling_device *
 of_cpufreq_cooling_register(struct device_node *np,
                            const struct cpumask *clip_cpus)
 {
-        return NULL;
+        return ERR_PTR(-ENOSYS);
 }
 #endif
@@ -65,13 +65,13 @@ unsigned long cpufreq_cooling_get_level(unsigned int cpu, unsigned int freq);
 static inline struct thermal_cooling_device *
 cpufreq_cooling_register(const struct cpumask *clip_cpus)
 {
-        return NULL;
+        return ERR_PTR(-ENOSYS);
 }
 static inline struct thermal_cooling_device *
 of_cpufreq_cooling_register(struct device_node *np,
                            const struct cpumask *clip_cpus)
 {
-        return NULL;
+        return ERR_PTR(-ENOSYS);
 }
 static inline
 void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index a07e087f54b2..ab70f3bc44ad 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -53,7 +53,6 @@ struct cpuidle_state {
 };
 /* Idle State Flags */
-#define CPUIDLE_FLAG_TIME_INVALID       (0x01) /* is residency time measurable? */
 #define CPUIDLE_FLAG_COUPLED    (0x02) /* state applies to multiple cpus */
 #define CPUIDLE_FLAG_TIMER_STOP (0x04)  /* timer is stopped on this state */
@@ -89,8 +88,6 @@ DECLARE_PER_CPU(struct cpuidle_device, cpuidle_dev);
 /**
 * cpuidle_get_last_residency - retrieves the last state's residency time
 * @dev: the target CPU
- *
- * NOTE: this value is invalid if CPUIDLE_FLAG_TIME_INVALID is set
 */
 static inline int cpuidle_get_last_residency(struct cpuidle_device *dev)
 {
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 0238d612750e..b674837e2b98 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -848,7 +848,7 @@ efi_guidcmp (efi_guid_t left, efi_guid_t right)
 }
 static inline char *
-efi_guid_unparse(efi_guid_t *guid, char *out)
+efi_guid_to_str(efi_guid_t *guid, char *out)
 {
        sprintf(out, "%pUl", guid->b);
        return out;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index f90c0282c114..42efe13077b6 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -135,7 +135,7 @@ typedef void (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
 #define FMODE_CAN_WRITE         ((__force fmode_t)0x40000)
 /* File was opened by fanotify and shouldn't generate fanotify events */
-#define FMODE_NONOTIFY          ((__force fmode_t)0x1000000)
+#define FMODE_NONOTIFY          ((__force fmode_t)0x4000000)
 /*
 * Flag for rw_copy_check_uvector and compat_rw_copy_check_uvector
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 0bebb5c348b8..d36f68b08acc 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -595,7 +595,7 @@ extern int  ftrace_profile_set_filter(struct perf_event *event, int event_id,
                                     char *filter_str);
 extern void ftrace_profile_free_filter(struct perf_event *event);
 extern void *perf_trace_buf_prepare(int size, unsigned short type,
-                                    struct pt_regs *regs, int *rctxp);
+                                    struct pt_regs **regs, int *rctxp);
 static inline void
 perf_trace_buf_submit(void *raw_data, int size, int rctx, u64 addr,
diff --git a/include/linux/genetlink.h b/include/linux/genetlink.h
index 55b685719d52..09460d6d6682 100644
--- a/include/linux/genetlink.h
+++ b/include/linux/genetlink.h
@@ -11,6 +11,10 @@ extern void genl_unlock(void);
 extern int lockdep_genl_is_held(void);
 #endif
+/* for synchronisation between af_netlink and genetlink */
+extern atomic_t genl_sk_destructing_cnt;
+extern wait_queue_head_t genl_sk_destructing_waitq;
 /**
 * rcu_dereference_genl - rcu_dereference with debug checking
 * @p: The pointer to read, prior to dereferencing
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index a036d058a249..05f6df1fdf5b 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -170,6 +170,7 @@ enum  hrtimer_base_type {
 * @clock_was_set:      Indicates that clock was set from irq context.
 * @expires_next:       absolute time of the next event which was scheduled
 *                      via clock_set_next_event()
+ * @in_hrtirq:          hrtimer_interrupt() is currently executing
 * @hres_active:        State of high resolution mode
 * @hang_detected:      The last hrtimer interrupt detected a hang
 * @nr_events:          Total number of hrtimer interrupt events
@@ -185,6 +186,7 @@ struct hrtimer_cpu_base {
        unsigned int                    clock_was_set;
 #ifdef CONFIG_HIGH_RES_TIMERS
        ktime_t                         expires_next;
+        int                             in_hrtirq;
        int                             hres_active;
        int                             hang_detected;
        unsigned long                   nr_events;
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index e3a1721c8354..7c7695940ddd 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -228,7 +228,9 @@ struct i2c_client {
        struct device dev;              /* the device structure         */
        int irq;                        /* irq issued by device         */
        struct list_head detected;
+#if IS_ENABLED(CONFIG_I2C_SLAVE)
        i2c_slave_cb_t slave_cb;        /* callback for slave mode      */
+#endif
 };
 #define to_i2c_client(d) container_of(d, struct i2c_client, dev)
@@ -253,6 +255,7 @@ static inline void i2c_set_clientdata(struct i2c_client *dev, void *data)
 /* I2C slave support */
+#if IS_ENABLED(CONFIG_I2C_SLAVE)
 enum i2c_slave_event {
        I2C_SLAVE_REQ_READ_START,
        I2C_SLAVE_REQ_READ_END,
@@ -269,6 +272,7 @@ static inline int i2c_slave_event(struct i2c_client *client,
 {
        return client->slave_cb(client, event, val);
 }
+#endif
 /**
 * struct i2c_board_info - template for device creation
@@ -404,8 +408,10 @@ struct i2c_algorithm {
        /* To determine what the adapter supports */
        u32 (*functionality) (struct i2c_adapter *);
+#if IS_ENABLED(CONFIG_I2C_SLAVE)
        int (*reg_slave)(struct i2c_client *client);
        int (*unreg_slave)(struct i2c_client *client);
+#endif
 };
 /**
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 515a35e2a48a..960e666c51e4 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -472,27 +472,59 @@ static inline int vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)
 /**
 * vlan_get_protocol - get protocol EtherType.
 * @skb: skbuff to query
+ * @type: first vlan protocol
+ * @depth: buffer to store length of eth and vlan tags in bytes
 *
 * Returns the EtherType of the packet, regardless of whether it is
 * vlan encapsulated (normal or hardware accelerated) or not.
 */
-static inline __be16 vlan_get_protocol(const struct sk_buff *skb)
+static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
+                                         int *depth)
 {
-        __be16 protocol = 0;
+        unsigned int vlan_depth = skb->mac_len;
-        if (vlan_tx_tag_present(skb) ||
+        /* if type is 802.1Q/AD then the header should already be
-             skb->protocol != cpu_to_be16(ETH_P_8021Q))
+         * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
-                protocol = skb->protocol;
+         * ETH_HLEN otherwise
-        else {
+         */
-                __be16 proto, *protop;
+        if (type == htons(ETH_P_8021Q) || type == htons(ETH_P_8021AD)) {
-                protop = skb_header_pointer(skb, offsetof(struct vlan_ethhdr,
+                if (vlan_depth) {
-                                                h_vlan_encapsulated_proto),
+                        if (WARN_ON(vlan_depth < VLAN_HLEN))
-                                                sizeof(proto), &proto);
+                                return 0;
-                if (likely(protop))
+                        vlan_depth -= VLAN_HLEN;
-                        protocol = *protop;
+                } else {
+                        vlan_depth = ETH_HLEN;
+                }
+                do {
+                        struct vlan_hdr *vh;
+                        if (unlikely(!pskb_may_pull(skb,
+                                                    vlan_depth + VLAN_HLEN)))
+                                return 0;
+                        vh = (struct vlan_hdr *)(skb->data + vlan_depth);
+                        type = vh->h_vlan_encapsulated_proto;
+                        vlan_depth += VLAN_HLEN;
+                } while (type == htons(ETH_P_8021Q) ||
+                         type == htons(ETH_P_8021AD));
        }
-        return protocol;
+        if (depth)
+                *depth = vlan_depth;
+        return type;
+}
+/**
+ * vlan_get_protocol - get protocol EtherType.
+ * @skb: skbuff to query
+ *
+ * Returns the EtherType of the packet, regardless of whether it is
+ * vlan encapsulated (normal or hardware accelerated) or not.
+ */
+static inline __be16 vlan_get_protocol(struct sk_buff *skb)
+{
+        return __vlan_get_protocol(skb, skb->protocol, NULL);
 }
 static inline void vlan_set_encap_proto(struct sk_buff *skb,
diff --git a/include/linux/kdb.h b/include/linux/kdb.h
index 290db1269c4c..75ae2e2631fc 100644
--- a/include/linux/kdb.h
+++ b/include/linux/kdb.h
@@ -13,11 +13,54 @@
 * Copyright (C) 2009 Jason Wessel <jason.wessel@windriver.com>
 */
+/* Shifted versions of the command enable bits are be used if the command
+ * has no arguments (see kdb_check_flags). This allows commands, such as
+ * go, to have different permissions depending upon whether it is called
+ * with an argument.
+ */
+#define KDB_ENABLE_NO_ARGS_SHIFT 10
 typedef enum {
-        KDB_REPEAT_NONE = 0,    /* Do not repeat this command */
+        KDB_ENABLE_ALL = (1 << 0), /* Enable everything */
-        KDB_REPEAT_NO_ARGS,     /* Repeat the command without arguments */
+        KDB_ENABLE_MEM_READ = (1 << 1),
-        KDB_REPEAT_WITH_ARGS,   /* Repeat the command including its arguments */
+        KDB_ENABLE_MEM_WRITE = (1 << 2),
-} kdb_repeat_t;
+        KDB_ENABLE_REG_READ = (1 << 3),
+        KDB_ENABLE_REG_WRITE = (1 << 4),
+        KDB_ENABLE_INSPECT = (1 << 5),
+        KDB_ENABLE_FLOW_CTRL = (1 << 6),
+        KDB_ENABLE_SIGNAL = (1 << 7),
+        KDB_ENABLE_REBOOT = (1 << 8),
+        /* User exposed values stop here, all remaining flags are
+         * exclusively used to describe a commands behaviour.
+         */
+        KDB_ENABLE_ALWAYS_SAFE = (1 << 9),
+        KDB_ENABLE_MASK = (1 << KDB_ENABLE_NO_ARGS_SHIFT) - 1,
+        KDB_ENABLE_ALL_NO_ARGS = KDB_ENABLE_ALL << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_MEM_READ_NO_ARGS = KDB_ENABLE_MEM_READ
+                                      << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_MEM_WRITE_NO_ARGS = KDB_ENABLE_MEM_WRITE
+                                       << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_REG_READ_NO_ARGS = KDB_ENABLE_REG_READ
+                                      << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_REG_WRITE_NO_ARGS = KDB_ENABLE_REG_WRITE
+                                       << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_INSPECT_NO_ARGS = KDB_ENABLE_INSPECT
+                                     << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_FLOW_CTRL_NO_ARGS = KDB_ENABLE_FLOW_CTRL
+                                       << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_SIGNAL_NO_ARGS = KDB_ENABLE_SIGNAL
+                                    << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_REBOOT_NO_ARGS = KDB_ENABLE_REBOOT
+                                    << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_ALWAYS_SAFE_NO_ARGS = KDB_ENABLE_ALWAYS_SAFE
+                                         << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_MASK_NO_ARGS = KDB_ENABLE_MASK << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_REPEAT_NO_ARGS = 0x40000000, /* Repeat the command w/o arguments */
+        KDB_REPEAT_WITH_ARGS = 0x80000000, /* Repeat the command with args */
+} kdb_cmdflags_t;
 typedef int (*kdb_func_t)(int, const char **);
@@ -62,6 +105,7 @@ extern atomic_t kdb_event;
 #define KDB_BADLENGTH   (-19)
 #define KDB_NOBP        (-20)
 #define KDB_BADADDR     (-21)
+#define KDB_NOPERM      (-22)
 /*
 * kdb_diemsg
@@ -146,17 +190,17 @@ static inline const char *kdb_walk_kallsyms(loff_t *pos)
 /* Dynamic kdb shell command registration */
 extern int kdb_register(char *, kdb_func_t, char *, char *, short);
-extern int kdb_register_repeat(char *, kdb_func_t, char *, char *,
+extern int kdb_register_flags(char *, kdb_func_t, char *, char *,
-                               short, kdb_repeat_t);
+                              short, kdb_cmdflags_t);
 extern int kdb_unregister(char *);
 #else /* ! CONFIG_KGDB_KDB */
 static inline __printf(1, 2) int kdb_printf(const char *fmt, ...) { return 0; }
 static inline void kdb_init(int level) {}
 static inline int kdb_register(char *cmd, kdb_func_t func, char *usage,
                               char *help, short minlen) { return 0; }
-static inline int kdb_register_repeat(char *cmd, kdb_func_t func, char *usage,
+static inline int kdb_register_flags(char *cmd, kdb_func_t func, char *usage,
-                                      char *help, short minlen,
+                                     char *help, short minlen,
-                                      kdb_repeat_t repeat) { return 0; }
+                                     kdb_cmdflags_t flags) { return 0; }
 static inline int kdb_unregister(char *cmd) { return 0; }
 #endif  /* CONFIG_KGDB_KDB */
 enum {
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 5449d2f4a1ef..64ce58bee6f5 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -176,7 +176,7 @@ extern int _cond_resched(void);
 */
 # define might_sleep() \
        do { __might_sleep(__FILE__, __LINE__, 0); might_resched(); } while (0)
-# define sched_annotate_sleep() __set_current_state(TASK_RUNNING)
+# define sched_annotate_sleep() (current->task_state_change = 0)
 #else
  static inline void ___might_sleep(const char *file, int line,
                                   int preempt_offset) { }
diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index c9d645ad98ff..5fc3d1083071 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -166,7 +166,17 @@ static inline bool ktime_before(const ktime_t cmp1, const ktime_t cmp2)
 }
 #if BITS_PER_LONG < 64
-extern u64 ktime_divns(const ktime_t kt, s64 div);
+extern u64 __ktime_divns(const ktime_t kt, s64 div);
+static inline u64 ktime_divns(const ktime_t kt, s64 div)
+{
+        if (__builtin_constant_p(div) && !(div >> 32)) {
+                u64 ns = kt.tv64;
+                do_div(ns, div);
+                return ns;
+        } else {
+                return __ktime_divns(kt, div);
+        }
+}
 #else /* BITS_PER_LONG < 64 */
 # define ktime_divns(kt, div)           (u64)((kt).tv64 / (div))
 #endif
@@ -186,6 +196,11 @@ static inline s64 ktime_us_delta(const ktime_t later, const ktime_t earlier)
       return ktime_to_us(ktime_sub(later, earlier));
 }
+static inline s64 ktime_ms_delta(const ktime_t later, const ktime_t earlier)
+{
+        return ktime_to_ms(ktime_sub(later, earlier));
+}
 static inline ktime_t ktime_add_us(const ktime_t kt, const u64 usec)
 {
        return ktime_add_ns(kt, usec * NSEC_PER_USEC);
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 2d182413b1db..91f705de2c0b 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -231,6 +231,7 @@ enum {
        ATA_FLAG_SW_ACTIVITY    = (1 << 22), /* driver supports sw activity
                                              * led */
        ATA_FLAG_NO_DIPM        = (1 << 23), /* host not happy with DIPM */
+        ATA_FLAG_LOWTAG         = (1 << 24), /* host wants lowest available tag */
        /* bits 24:31 of ap->flags are reserved for LLD specific flags */
@@ -422,6 +423,7 @@ enum {
        ATA_HORKAGE_NO_NCQ_TRIM = (1 << 19),    /* don't use queued TRIM */
        ATA_HORKAGE_NOLPM       = (1 << 20),    /* don't use LPM */
        ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),  /* some WDs have broken LPM */
+        ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
         /* DMA mask for user DMA control: User visible values; DO NOT
            renumber */
diff --git a/include/linux/mfd/samsung/s2mps13.h b/include/linux/mfd/samsung/s2mps13.h
index ce5dda8958fe..b1fd675fa36f 100644
--- a/include/linux/mfd/samsung/s2mps13.h
+++ b/include/linux/mfd/samsung/s2mps13.h
@@ -59,6 +59,7 @@ enum s2mps13_reg {
        S2MPS13_REG_B6CTRL,
        S2MPS13_REG_B6OUT,
        S2MPS13_REG_B7CTRL,
+        S2MPS13_REG_B7SW,
        S2MPS13_REG_B7OUT,
        S2MPS13_REG_B8CTRL,
        S2MPS13_REG_B8OUT,
@@ -102,6 +103,7 @@ enum s2mps13_reg {
        S2MPS13_REG_L26CTRL,
        S2MPS13_REG_L27CTRL,
        S2MPS13_REG_L28CTRL,
+        S2MPS13_REG_L29CTRL,
        S2MPS13_REG_L30CTRL,
        S2MPS13_REG_L31CTRL,
        S2MPS13_REG_L32CTRL,
diff --git a/include/linux/mfd/stmpe.h b/include/linux/mfd/stmpe.h
index 575a86c7fcbd..f742b6717d52 100644
--- a/include/linux/mfd/stmpe.h
+++ b/include/linux/mfd/stmpe.h
@@ -50,6 +50,8 @@ enum {
        STMPE_IDX_GPEDR_MSB,
        STMPE_IDX_GPRER_LSB,
        STMPE_IDX_GPFER_LSB,
+        STMPE_IDX_GPPUR_LSB,
+        STMPE_IDX_GPPDR_LSB,
        STMPE_IDX_GPAFR_U_MSB,
        STMPE_IDX_IEGPIOR_LSB,
        STMPE_IDX_ISGPIOR_LSB,
@@ -113,24 +115,6 @@ extern int stmpe_set_altfunc(struct stmpe *stmpe, u32 pins,
 extern int stmpe_enable(struct stmpe *stmpe, unsigned int blocks);
 extern int stmpe_disable(struct stmpe *stmpe, unsigned int blocks);
-struct matrix_keymap_data;
-/**
- * struct stmpe_keypad_platform_data - STMPE keypad platform data
- * @keymap_data: key map table and size
- * @debounce_ms: debounce interval, in ms.  Maximum is
- *               %STMPE_KEYPAD_MAX_DEBOUNCE.
- * @scan_count: number of key scanning cycles to confirm key data.
- *              Maximum is %STMPE_KEYPAD_MAX_SCAN_COUNT.
- * @no_autorepeat: disable key autorepeat
- */
-struct stmpe_keypad_platform_data {
-        const struct matrix_keymap_data *keymap_data;
-        unsigned int debounce_ms;
-        unsigned int scan_count;
-        bool no_autorepeat;
-};
 #define STMPE_GPIO_NOREQ_811_TOUCH      (0xf0)
 /**
@@ -199,7 +183,6 @@ struct stmpe_ts_platform_data {
 * @irq_gpio: gpio number over which irq will be requested (significant only if
 *            irq_over_gpio is true)
 * @gpio: GPIO-specific platform data
- * @keypad: keypad-specific platform data
 * @ts: touchscreen-specific platform data
 */
 struct stmpe_platform_data {
@@ -212,7 +195,6 @@ struct stmpe_platform_data {
        int autosleep_timeout;
        struct stmpe_gpio_platform_data *gpio;
-        struct stmpe_keypad_platform_data *keypad;
        struct stmpe_ts_platform_data *ts;
 };
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 25c791e295fd..5f3a9aa7225d 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -97,7 +97,7 @@ enum {
        MLX4_MAX_NUM_PF         = 16,
        MLX4_MAX_NUM_VF         = 126,
        MLX4_MAX_NUM_VF_P_PORT  = 64,
-        MLX4_MFUNC_MAX          = 80,
+        MLX4_MFUNC_MAX          = 128,
        MLX4_MAX_EQ_NUM         = 1024,
        MLX4_MFUNC_EQ_NUM       = 4,
        MLX4_MFUNC_MAX_EQES     = 8,
diff --git a/include/linux/mm.h b/include/linux/mm.h
index f80d0194c9bc..dd5ea3016fc4 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1070,6 +1070,7 @@ static inline int page_mapped(struct page *page)
 #define VM_FAULT_WRITE  0x0008  /* Special case for get_user_pages */
 #define VM_FAULT_HWPOISON 0x0010        /* Hit poisoned small page */
 #define VM_FAULT_HWPOISON_LARGE 0x0020  /* Hit poisoned large page. Index encoded in upper bits */
+#define VM_FAULT_SIGSEGV 0x0040
 #define VM_FAULT_NOPAGE 0x0100  /* ->fault installed the pte, not return page */
 #define VM_FAULT_LOCKED 0x0200  /* ->fault locked the returned page */
@@ -1078,8 +1079,9 @@ static inline int page_mapped(struct page *page)
 #define VM_FAULT_HWPOISON_LARGE_MASK 0xf000 /* encodes hpage index for large hwpoison */
-#define VM_FAULT_ERROR  (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_HWPOISON | \
+#define VM_FAULT_ERROR  (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | \
-                         VM_FAULT_FALLBACK | VM_FAULT_HWPOISON_LARGE)
+                         VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE | \
+                         VM_FAULT_FALLBACK)
 /* Encode hstate index for a hwpoisoned large page */
 #define VM_FAULT_SET_HINDEX(x) ((x) << 12)
@@ -1952,7 +1954,7 @@ extern int expand_downwards(struct vm_area_struct *vma,
 #if VM_GROWSUP
 extern int expand_upwards(struct vm_area_struct *vma, unsigned long address);
 #else
-  #define expand_upwards(vma, address) do { } while (0)
+  #define expand_upwards(vma, address) (0)
 #endif
 /* Look up the first VMA which satisfies  addr < vm_end,  NULL if none. */
diff --git a/include/linux/mmc/sdhci.h b/include/linux/mmc/sdhci.h
index 375af80bde7d..f767a0de611f 100644
--- a/include/linux/mmc/sdhci.h
+++ b/include/linux/mmc/sdhci.h
@@ -137,6 +137,7 @@ struct sdhci_host {
 #define SDHCI_SDR104_NEEDS_TUNING (1<<10)       /* SDR104/HS200 needs tuning */
 #define SDHCI_USING_RETUNING_TIMER (1<<11)      /* Host is using a retuning timer for the card */
 #define SDHCI_USE_64_BIT_DMA    (1<<12) /* Use 64-bit DMA */
+#define SDHCI_HS400_TUNING      (1<<13) /* Tuning for HS400 */
        unsigned int version;   /* SDHCI spec. version */
diff --git a/include/linux/module.h b/include/linux/module.h
index ebfb0e153c6a..b653d7c0a05a 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -444,7 +444,7 @@ extern void __module_put_and_exit(struct module *mod, long code)
 #define module_put_and_exit(code) __module_put_and_exit(THIS_MODULE, code)
 #ifdef CONFIG_MODULE_UNLOAD
-unsigned long module_refcount(struct module *mod);
+int module_refcount(struct module *mod);
 void __symbol_put(const char *symbol);
 #define symbol_put(x) __symbol_put(VMLINUX_SYMBOL_STR(x))
 void symbol_put_addr(void *addr);
diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
index 7eeb9bbfb816..f7556261fe3c 100644
--- a/include/linux/moduleloader.h
+++ b/include/linux/moduleloader.h
@@ -26,7 +26,7 @@ unsigned int arch_mod_section_prepend(struct module *mod, unsigned int section);
 void *module_alloc(unsigned long size);
 /* Free memory returned from module_alloc. */
-void module_free(struct module *mod, void *module_region);
+void module_memfree(void *module_region);
 /*
 * Apply the given relocation to the (simplified) ELF.  Return -error
@@ -82,4 +82,6 @@ int module_finalize(const Elf_Ehdr *hdr,
 /* Any cleanup needed when module leaves. */
 void module_arch_cleanup(struct module *mod);
+/* Any cleanup before freeing mod->module_init */
+void module_arch_freeing_init(struct module *mod);
 #endif
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index c31f74d76ebd..52fd8e8694cf 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -852,11 +852,11 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
 *      3. Update dev->stats asynchronously and atomically, and define
 *         neither operation.
 *
- * int (*ndo_vlan_rx_add_vid)(struct net_device *dev, __be16 proto, u16t vid);
+ * int (*ndo_vlan_rx_add_vid)(struct net_device *dev, __be16 proto, u16 vid);
 *      If device support VLAN filtering this function is called when a
 *      VLAN id is registered.
 *
- * int (*ndo_vlan_rx_kill_vid)(struct net_device *dev, unsigned short vid);
+ * int (*ndo_vlan_rx_kill_vid)(struct net_device *dev, __be16 proto, u16 vid);
 *      If device support VLAN filtering this function is called when a
 *      VLAN id is unregistered.
 *
@@ -1012,12 +1012,15 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
 *      Callback to use for xmit over the accelerated station. This
 *      is used in place of ndo_start_xmit on accelerated net
 *      devices.
- * bool (*ndo_gso_check) (struct sk_buff *skb,
+ * netdev_features_t (*ndo_features_check) (struct sk_buff *skb,
- *                        struct net_device *dev);
+ *                                          struct net_device *dev
+ *                                          netdev_features_t features);
 *      Called by core transmit path to determine if device is capable of
- *      performing GSO on a packet. The device returns true if it is
+ *      performing offload operations on a given packet. This is to give
- *      able to GSO the packet, false otherwise. If the return value is
+ *      the device an opportunity to implement any restrictions that cannot
- *      false the stack will do software GSO.
+ *      be otherwise expressed by feature flags. The check is called with
+ *      the set of features that the stack has calculated and it returns
+ *      those the driver believes to be appropriate.
 *
 * int (*ndo_switch_parent_id_get)(struct net_device *dev,
 *                                 struct netdev_phys_item_id *psid);
@@ -1178,8 +1181,9 @@ struct net_device_ops {
                                                        struct net_device *dev,
                                                        void *priv);
        int                     (*ndo_get_lock_subclass)(struct net_device *dev);
-        bool                    (*ndo_gso_check) (struct sk_buff *skb,
+        netdev_features_t       (*ndo_features_check) (struct sk_buff *skb,
-                                                  struct net_device *dev);
+                                                       struct net_device *dev,
+                                                       netdev_features_t features);
 #ifdef CONFIG_NET_SWITCHDEV
        int                     (*ndo_switch_parent_id_get)(struct net_device *dev,
                                                            struct netdev_phys_item_id *psid);
@@ -2081,7 +2085,7 @@ extern rwlock_t				dev_base_lock;		/* Device list lock */
        list_for_each_entry_continue_rcu(d, &(net)->dev_base_head, dev_list)
 #define for_each_netdev_in_bond_rcu(bond, slave)        \
                for_each_netdev_rcu(&init_net, slave)   \
-                        if (netdev_master_upper_dev_get_rcu(slave) == bond)
+                        if (netdev_master_upper_dev_get_rcu(slave) == (bond))
 #define net_device_entry(lh)    list_entry(lh, struct net_device, dev_list)
 static inline struct net_device *next_net_device(struct net_device *dev)
@@ -3611,8 +3615,6 @@ static inline bool netif_needs_gso(struct net_device *dev, struct sk_buff *skb,
                                   netdev_features_t features)
 {
        return skb_is_gso(skb) && (!skb_gso_ok(skb, features) ||
-                (dev->netdev_ops->ndo_gso_check &&
-                 !dev->netdev_ops->ndo_gso_check(skb, dev)) ||
                unlikely((skb->ip_summed != CHECKSUM_PARTIAL) &&
                         (skb->ip_summed != CHECKSUM_UNNECESSARY)));
 }
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 9e572daa15d5..02fc86d2348e 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -46,8 +46,8 @@ struct netlink_kernel_cfg {
        unsigned int    flags;
        void            (*input)(struct sk_buff *skb);
        struct mutex    *cb_mutex;
-        int             (*bind)(int group);
+        int             (*bind)(struct net *net, int group);
-        void            (*unbind)(int group);
+        void            (*unbind)(struct net *net, int group);
        bool            (*compare)(struct net *net, struct sock *sk);
 };
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index 1e37fbb78f7a..ddea982355f3 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -74,6 +74,9 @@ struct nfs_client {
        /* idmapper */
        struct idmap *          cl_idmap;
+        /* Client owner identifier */
+        const char *            cl_owner_id;
        /* Our own IP address, as a null-terminated string.
         * This is used to generate the mv0 callback address.
         */
diff --git a/include/linux/oom.h b/include/linux/oom.h
index 853698c721f7..76200984d1e2 100644
--- a/include/linux/oom.h
+++ b/include/linux/oom.h
@@ -85,11 +85,6 @@ static inline void oom_killer_enable(void)
        oom_killer_disabled = false;
 }
-static inline bool oom_gfp_allowed(gfp_t gfp_mask)
-{
-        return (gfp_mask & __GFP_FS) && !(gfp_mask & __GFP_NORETRY);
-}
 extern struct task_struct *find_lock_task_mm(struct task_struct *p);
 static inline bool task_will_free_mem(struct task_struct *task)
diff --git a/include/linux/osq_lock.h b/include/linux/osq_lock.h
index 90230d5811c5..3a6490e81b28 100644
--- a/include/linux/osq_lock.h
+++ b/include/linux/osq_lock.h
@@ -5,8 +5,11 @@
 * An MCS like lock especially tailored for optimistic spinning for sleeping
 * lock implementations (mutex, rwsem, etc).
 */
+struct optimistic_spin_node {
-#define OSQ_UNLOCKED_VAL (0)
+        struct optimistic_spin_node *next, *prev;
+        int locked; /* 1 if lock acquired */
+        int cpu; /* encoded CPU # + 1 value */
+};
 struct optimistic_spin_queue {
        /*
@@ -16,6 +19,8 @@ struct optimistic_spin_queue {
        atomic_t tail;
 };
+#define OSQ_UNLOCKED_VAL (0)
 /* Init macro and function. */
 #define OSQ_LOCK_UNLOCKED { ATOMIC_INIT(OSQ_UNLOCKED_VAL) }
@@ -24,4 +29,7 @@ static inline void osq_lock_init(struct optimistic_spin_queue *lock)
        atomic_set(&lock->tail, OSQ_UNLOCKED_VAL);
 }
+extern bool osq_lock(struct optimistic_spin_queue *lock);
+extern void osq_unlock(struct optimistic_spin_queue *lock);
 #endif
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index 7ea069cd3257..4b3736f7065c 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -251,7 +251,7 @@ pgoff_t page_cache_prev_hole(struct address_space *mapping,
 #define FGP_NOWAIT              0x00000020
 struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
-                int fgp_flags, gfp_t cache_gfp_mask, gfp_t radix_gfp_mask);
+                int fgp_flags, gfp_t cache_gfp_mask);
 /**
 * find_get_page - find and get a page reference
@@ -266,13 +266,13 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
 static inline struct page *find_get_page(struct address_space *mapping,
                                        pgoff_t offset)
 {
-        return pagecache_get_page(mapping, offset, 0, 0, 0);
+        return pagecache_get_page(mapping, offset, 0, 0);
 }
 static inline struct page *find_get_page_flags(struct address_space *mapping,
                                        pgoff_t offset, int fgp_flags)
 {
-        return pagecache_get_page(mapping, offset, fgp_flags, 0, 0);
+        return pagecache_get_page(mapping, offset, fgp_flags, 0);
 }
 /**
@@ -292,7 +292,7 @@ static inline struct page *find_get_page_flags(struct address_space *mapping,
 static inline struct page *find_lock_page(struct address_space *mapping,
                                        pgoff_t offset)
 {
-        return pagecache_get_page(mapping, offset, FGP_LOCK, 0, 0);
+        return pagecache_get_page(mapping, offset, FGP_LOCK, 0);
 }
 /**
@@ -319,7 +319,7 @@ static inline struct page *find_or_create_page(struct address_space *mapping,
 {
        return pagecache_get_page(mapping, offset,
                                        FGP_LOCK|FGP_ACCESSED|FGP_CREAT,
-                                        gfp_mask, gfp_mask & GFP_RECLAIM_MASK);
+                                        gfp_mask);
 }
 /**
@@ -340,8 +340,7 @@ static inline struct page *grab_cache_page_nowait(struct address_space *mapping,
 {
        return pagecache_get_page(mapping, index,
                        FGP_LOCK|FGP_CREAT|FGP_NOFS|FGP_NOWAIT,
-                        mapping_gfp_mask(mapping),
+                        mapping_gfp_mask(mapping));
-                        GFP_NOFS);
 }
 struct page *find_get_entry(struct address_space *mapping, pgoff_t offset);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 360a966a97a5..9603094ed59b 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -175,6 +175,8 @@ enum pci_dev_flags {
        PCI_DEV_FLAGS_DMA_ALIAS_DEVFN = (__force pci_dev_flags_t) (1 << 4),
        /* Use a PCIe-to-PCI bridge alias even if !pci_is_pcie */
        PCI_DEV_FLAG_PCIE_BRIDGE_ALIAS = (__force pci_dev_flags_t) (1 << 5),
+        /* Do not use bus resets for device */
+        PCI_DEV_FLAGS_NO_BUS_RESET = (__force pci_dev_flags_t) (1 << 6),
 };
 enum pci_irq_reroute_variant {
@@ -1065,6 +1067,7 @@ resource_size_t pcibios_retrieve_fw_addr(struct pci_dev *dev, int idx);
 void pci_bus_assign_resources(const struct pci_bus *bus);
 void pci_bus_size_bridges(struct pci_bus *bus);
 int pci_claim_resource(struct pci_dev *, int);
+int pci_claim_bridge_resource(struct pci_dev *bridge, int i);
 void pci_assign_unassigned_resources(void);
 void pci_assign_unassigned_bridge_resources(struct pci_dev *bridge);
 void pci_assign_unassigned_bus_resources(struct pci_bus *bus);
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 486e84ccb1f9..5cad0e6f3552 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -79,11 +79,6 @@ struct perf_branch_stack {
        struct perf_branch_entry        entries[0];
 };
-struct perf_regs {
-        __u64           abi;
-        struct pt_regs  *regs;
-};
 struct task_struct;
 /*
@@ -455,11 +450,6 @@ struct perf_event {
 #endif /* CONFIG_PERF_EVENTS */
 };
-enum perf_event_context_type {
-        task_context,
-        cpu_context,
-};
 /**
 * struct perf_event_context - event context structure
 *
@@ -467,7 +457,6 @@ enum perf_event_context_type {
 */
 struct perf_event_context {
        struct pmu                      *pmu;
-        enum perf_event_context_type    type;
        /*
         * Protect the states of the events in the list,
         * nr_active, and the list:
@@ -480,6 +469,7 @@ struct perf_event_context {
         */
        struct mutex                    mutex;
+        struct list_head                active_ctx_list;
        struct list_head                pinned_groups;
        struct list_head                flexible_groups;
        struct list_head                event_list;
@@ -530,7 +520,6 @@ struct perf_cpu_context {
        int                             exclusive;
        struct hrtimer                  hrtimer;
        ktime_t                         hrtimer_interval;
-        struct list_head                rotation_list;
        struct pmu                      *unique_pmu;
        struct perf_cgroup              *cgrp;
 };
@@ -610,7 +599,14 @@ struct perf_sample_data {
                u32     reserved;
        }                               cpu_entry;
        struct perf_callchain_entry     *callchain;
+        /*
+         * regs_user may point to task_pt_regs or to regs_user_copy, depending
+         * on arch details.
+         */
        struct perf_regs                regs_user;
+        struct pt_regs                  regs_user_copy;
        struct perf_regs                regs_intr;
        u64                             stack_user_size;
 } ____cacheline_aligned;
@@ -663,6 +659,7 @@ static inline int is_software_event(struct perf_event *event)
 extern struct static_key perf_swevent_enabled[PERF_COUNT_SW_MAX];
+extern void ___perf_sw_event(u32, u64, struct pt_regs *, u64);
 extern void __perf_sw_event(u32, u64, struct pt_regs *, u64);
 #ifndef perf_arch_fetch_caller_regs
@@ -687,14 +684,25 @@ static inline void perf_fetch_caller_regs(struct pt_regs *regs)
 static __always_inline void
 perf_sw_event(u32 event_id, u64 nr, struct pt_regs *regs, u64 addr)
 {
-        struct pt_regs hot_regs;
+        if (static_key_false(&perf_swevent_enabled[event_id]))
+                __perf_sw_event(event_id, nr, regs, addr);
+}
+DECLARE_PER_CPU(struct pt_regs, __perf_regs[4]);
+/*
+ * 'Special' version for the scheduler, it hard assumes no recursion,
+ * which is guaranteed by us not actually scheduling inside other swevents
+ * because those disable preemption.
+ */
+static __always_inline void
+perf_sw_event_sched(u32 event_id, u64 nr, u64 addr)
+{
        if (static_key_false(&perf_swevent_enabled[event_id])) {
-                if (!regs) {
+                struct pt_regs *regs = this_cpu_ptr(&__perf_regs[0]);
-                        perf_fetch_caller_regs(&hot_regs);
-                        regs = &hot_regs;
+                perf_fetch_caller_regs(regs);
-                }
+                ___perf_sw_event(event_id, nr, regs, addr);
-                __perf_sw_event(event_id, nr, regs, addr);
        }
 }
@@ -710,7 +718,7 @@ static inline void perf_event_task_sched_in(struct task_struct *prev,
 static inline void perf_event_task_sched_out(struct task_struct *prev,
                                             struct task_struct *next)
 {
-        perf_sw_event(PERF_COUNT_SW_CONTEXT_SWITCHES, 1, NULL, 0);
+        perf_sw_event_sched(PERF_COUNT_SW_CONTEXT_SWITCHES, 1, 0);
        if (static_key_false(&perf_sched_events.key))
                __perf_event_task_sched_out(prev, next);
@@ -821,6 +829,8 @@ static inline int perf_event_refresh(struct perf_event *event, int refresh)
 static inline void
 perf_sw_event(u32 event_id, u64 nr, struct pt_regs *regs, u64 addr)     { }
 static inline void
+perf_sw_event_sched(u32 event_id, u64 nr, u64 addr)                     { }
+static inline void
 perf_bp_event(struct perf_event *event, void *data)                     { }
 static inline int perf_register_guest_info_callbacks
diff --git a/include/linux/perf_regs.h b/include/linux/perf_regs.h
index 3c73d5fe18be..a5f98d53d732 100644
--- a/include/linux/perf_regs.h
+++ b/include/linux/perf_regs.h
@@ -1,11 +1,19 @@
 #ifndef _LINUX_PERF_REGS_H
 #define _LINUX_PERF_REGS_H
+struct perf_regs {
+        __u64           abi;
+        struct pt_regs  *regs;
+};
 #ifdef CONFIG_HAVE_PERF_REGS
 #include <asm/perf_regs.h>
 u64 perf_reg_value(struct pt_regs *regs, int idx);
 int perf_reg_validate(u64 mask);
 u64 perf_reg_abi(struct task_struct *task);
+void perf_get_regs_user(struct perf_regs *regs_user,
+                        struct pt_regs *regs,
+                        struct pt_regs *regs_user_copy);
 #else
 static inline u64 perf_reg_value(struct pt_regs *regs, int idx)
 {
@@ -21,5 +29,13 @@ static inline u64 perf_reg_abi(struct task_struct *task)
 {
        return PERF_SAMPLE_REGS_ABI_NONE;
 }
+static inline void perf_get_regs_user(struct perf_regs *regs_user,
+                                      struct pt_regs *regs,
+                                      struct pt_regs *regs_user_copy)
+{
+        regs_user->regs = task_pt_regs(current);
+        regs_user->abi = perf_reg_abi(current);
+}
 #endif /* CONFIG_HAVE_PERF_REGS */
 #endif /* _LINUX_PERF_REGS_H */
diff --git a/include/linux/phy/omap_control_phy.h b/include/linux/phy/omap_control_phy.h
index e9e6cfbfbb58..eb7d4a135a9e 100644
--- a/include/linux/phy/omap_control_phy.h
+++ b/include/linux/phy/omap_control_phy.h
@@ -66,7 +66,7 @@ enum omap_control_usb_mode {
 #define OMAP_CTRL_PIPE3_PHY_TX_RX_POWEROFF      0x0
 #define OMAP_CTRL_PCIE_PCS_MASK                 0xff
-#define OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT    0x8
+#define OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT    16
 #define OMAP_CTRL_USB2_PHY_PD           BIT(28)
@@ -79,7 +79,7 @@ enum omap_control_usb_mode {
 void omap_control_phy_power(struct device *dev, int on);
 void omap_control_usb_set_mode(struct device *dev,
                               enum omap_control_usb_mode mode);
-void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay);
+void omap_control_pcie_pcs(struct device *dev, u8 delay);
 #else
 static inline void omap_control_phy_power(struct device *dev, int on)
@@ -91,7 +91,7 @@ static inline void omap_control_usb_set_mode(struct device *dev,
 {
 }
-static inline void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay)
+static inline void omap_control_pcie_pcs(struct device *dev, u8 delay)
 {
 }
 #endif
diff --git a/include/linux/pm_domain.h b/include/linux/pm_domain.h
index 6cd20d5e651b..a9edab2c787a 100644
--- a/include/linux/pm_domain.h
+++ b/include/linux/pm_domain.h
@@ -271,6 +271,8 @@ typedef struct generic_pm_domain *(*genpd_xlate_t)(struct of_phandle_args *args,
 int __of_genpd_add_provider(struct device_node *np, genpd_xlate_t xlate,
                        void *data);
 void of_genpd_del_provider(struct device_node *np);
+struct generic_pm_domain *of_genpd_get_from_provider(
+                        struct of_phandle_args *genpdspec);
 struct generic_pm_domain *__of_genpd_xlate_simple(
                                        struct of_phandle_args *genpdspec,
@@ -288,6 +290,12 @@ static inline int __of_genpd_add_provider(struct device_node *np,
 }
 static inline void of_genpd_del_provider(struct device_node *np) {}
+static inline struct generic_pm_domain *of_genpd_get_from_provider(
+                        struct of_phandle_args *genpdspec)
+{
+        return NULL;
+}
 #define __of_genpd_xlate_simple         NULL
 #define __of_genpd_xlate_onecell        NULL
diff --git a/include/linux/printk.h b/include/linux/printk.h
index c8f170324e64..4d5bf5726578 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -10,9 +10,6 @@
 extern const char linux_banner[];
 extern const char linux_proc_banner[];
-extern char *log_buf_addr_get(void);
-extern u32 log_buf_len_get(void);
 static inline int printk_get_level(const char *buffer)
 {
        if (buffer[0] == KERN_SOH_ASCII && buffer[1]) {
@@ -163,6 +160,8 @@ extern int kptr_restrict;
 extern void wake_up_klogd(void);
+char *log_buf_addr_get(void);
+u32 log_buf_len_get(void);
 void log_buf_kexec_setup(void);
 void __init setup_log_buf(int early);
 void dump_stack_set_arch_desc(const char *fmt, ...);
@@ -198,6 +197,16 @@ static inline void wake_up_klogd(void)
 {
 }
+static inline char *log_buf_addr_get(void)
+{
+        return NULL;
+}
+static inline u32 log_buf_len_get(void)
+{
+        return 0;
+}
 static inline void log_buf_kexec_setup(void)
 {
 }
diff --git a/include/linux/pxa2xx_ssp.h b/include/linux/pxa2xx_ssp.h
index 77aed9ea1d26..dab545bb66b3 100644
--- a/include/linux/pxa2xx_ssp.h
+++ b/include/linux/pxa2xx_ssp.h
@@ -37,6 +37,7 @@
 #define SSDR            (0x10)  /* SSP Data Write/Data Read Register */
 #define SSTO            (0x28)  /* SSP Time Out Register */
+#define DDS_RATE        (0x28)  /* SSP DDS Clock Rate Register (Intel Quark) */
 #define SSPSP           (0x2C)  /* SSP Programmable Serial Protocol */
 #define SSTSA           (0x30)  /* SSP Tx Timeslot Active */
 #define SSRSA           (0x34)  /* SSP Rx Timeslot Active */
diff --git a/include/linux/quota.h b/include/linux/quota.h
index 50978b781a19..097d7eb2441e 100644
--- a/include/linux/quota.h
+++ b/include/linux/quota.h
@@ -321,6 +321,49 @@ struct dquot_operations {
 struct path;
+/* Structure for communicating via ->get_dqblk() & ->set_dqblk() */
+struct qc_dqblk {
+        int d_fieldmask;        /* mask of fields to change in ->set_dqblk() */
+        u64 d_spc_hardlimit;    /* absolute limit on used space */
+        u64 d_spc_softlimit;    /* preferred limit on used space */
+        u64 d_ino_hardlimit;    /* maximum # allocated inodes */
+        u64 d_ino_softlimit;    /* preferred inode limit */
+        u64 d_space;            /* Space owned by the user */
+        u64 d_ino_count;        /* # inodes owned by the user */
+        s64 d_ino_timer;        /* zero if within inode limits */
+                                /* if not, we refuse service */
+        s64 d_spc_timer;        /* similar to above; for space */
+        int d_ino_warns;        /* # warnings issued wrt num inodes */
+        int d_spc_warns;        /* # warnings issued wrt used space */
+        u64 d_rt_spc_hardlimit; /* absolute limit on realtime space */
+        u64 d_rt_spc_softlimit; /* preferred limit on RT space */
+        u64 d_rt_space;         /* realtime space owned */
+        s64 d_rt_spc_timer;     /* similar to above; for RT space */
+        int d_rt_spc_warns;     /* # warnings issued wrt RT space */
+};
+/* Field specifiers for ->set_dqblk() in struct qc_dqblk */
+#define QC_INO_SOFT     (1<<0)
+#define QC_INO_HARD     (1<<1)
+#define QC_SPC_SOFT     (1<<2)
+#define QC_SPC_HARD     (1<<3)
+#define QC_RT_SPC_SOFT  (1<<4)
+#define QC_RT_SPC_HARD  (1<<5)
+#define QC_LIMIT_MASK (QC_INO_SOFT | QC_INO_HARD | QC_SPC_SOFT | QC_SPC_HARD | \
+                       QC_RT_SPC_SOFT | QC_RT_SPC_HARD)
+#define QC_SPC_TIMER    (1<<6)
+#define QC_INO_TIMER    (1<<7)
+#define QC_RT_SPC_TIMER (1<<8)
+#define QC_TIMER_MASK (QC_SPC_TIMER | QC_INO_TIMER | QC_RT_SPC_TIMER)
+#define QC_SPC_WARNS    (1<<9)
+#define QC_INO_WARNS    (1<<10)
+#define QC_RT_SPC_WARNS (1<<11)
+#define QC_WARNS_MASK (QC_SPC_WARNS | QC_INO_WARNS | QC_RT_SPC_WARNS)
+#define QC_SPACE        (1<<12)
+#define QC_INO_COUNT    (1<<13)
+#define QC_RT_SPACE     (1<<14)
+#define QC_ACCT_MASK (QC_SPACE | QC_INO_COUNT | QC_RT_SPACE)
 /* Operations handling requests from userspace */
 struct quotactl_ops {
        int (*quota_on)(struct super_block *, int, int, struct path *);
@@ -329,8 +372,8 @@ struct quotactl_ops {
        int (*quota_sync)(struct super_block *, int);
        int (*get_info)(struct super_block *, int, struct if_dqinfo *);
        int (*set_info)(struct super_block *, int, struct if_dqinfo *);
-        int (*get_dqblk)(struct super_block *, struct kqid, struct fs_disk_quota *);
+        int (*get_dqblk)(struct super_block *, struct kqid, struct qc_dqblk *);
-        int (*set_dqblk)(struct super_block *, struct kqid, struct fs_disk_quota *);
+        int (*set_dqblk)(struct super_block *, struct kqid, struct qc_dqblk *);
        int (*get_xstate)(struct super_block *, struct fs_quota_stat *);
        int (*set_xstate)(struct super_block *, unsigned int, int);
        int (*get_xstatev)(struct super_block *, struct fs_quota_statv *);
diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index f23538a6e411..29e3455f7d41 100644
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -98,9 +98,9 @@ int dquot_quota_sync(struct super_block *sb, int type);
 int dquot_get_dqinfo(struct super_block *sb, int type, struct if_dqinfo *ii);
 int dquot_set_dqinfo(struct super_block *sb, int type, struct if_dqinfo *ii);
 int dquot_get_dqblk(struct super_block *sb, struct kqid id,
-                struct fs_disk_quota *di);
+                struct qc_dqblk *di);
 int dquot_set_dqblk(struct super_block *sb, struct kqid id,
-                struct fs_disk_quota *di);
+                struct qc_dqblk *di);
 int __dquot_transfer(struct inode *inode, struct dquot **transfer_to);
 int dquot_transfer(struct inode *inode, struct iattr *iattr);
diff --git a/include/linux/rculist.h b/include/linux/rculist.h
index 529bc946f450..a18b16f1dc0e 100644
--- a/include/linux/rculist.h
+++ b/include/linux/rculist.h
@@ -524,11 +524,11 @@ static inline void hlist_add_behind_rcu(struct hlist_node *n,
 * @member:     the name of the hlist_node within the struct.
 */
 #define hlist_for_each_entry_continue_rcu(pos, member)                  \
-        for (pos = hlist_entry_safe(rcu_dereference((pos)->member.next),\
+        for (pos = hlist_entry_safe(rcu_dereference_raw(hlist_next_rcu( \
-                        typeof(*(pos)), member);                        \
+                        &(pos)->member)), typeof(*(pos)), member);      \
             pos;                                                       \
-             pos = hlist_entry_safe(rcu_dereference((pos)->member.next),\
+             pos = hlist_entry_safe(rcu_dereference_raw(hlist_next_rcu( \
-                        typeof(*(pos)), member))
+                        &(pos)->member)), typeof(*(pos)), member))
 /**
 * hlist_for_each_entry_continue_rcu_bh - iterate over a hlist continuing after current point
@@ -536,11 +536,11 @@ static inline void hlist_add_behind_rcu(struct hlist_node *n,
 * @member:     the name of the hlist_node within the struct.
 */
 #define hlist_for_each_entry_continue_rcu_bh(pos, member)               \
-        for (pos = hlist_entry_safe(rcu_dereference_bh((pos)->member.next),\
+        for (pos = hlist_entry_safe(rcu_dereference_bh(hlist_next_rcu(  \
-                        typeof(*(pos)), member);                        \
+                        &(pos)->member)), typeof(*(pos)), member);      \
             pos;                                                       \
-             pos = hlist_entry_safe(rcu_dereference_bh((pos)->member.next),\
+             pos = hlist_entry_safe(rcu_dereference_bh(hlist_next_rcu(  \
-                        typeof(*(pos)), member))
+                        &(pos)->member)), typeof(*(pos)), member))
 /**
 * hlist_for_each_entry_from_rcu - iterate over a hlist continuing from current point
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index ed4f5939a452..78097491cd99 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -331,12 +331,13 @@ static inline void rcu_init_nohz(void)
 extern struct srcu_struct tasks_rcu_exit_srcu;
 #define rcu_note_voluntary_context_switch(t) \
        do { \
+                rcu_all_qs(); \
                if (ACCESS_ONCE((t)->rcu_tasks_holdout)) \
                        ACCESS_ONCE((t)->rcu_tasks_holdout) = false; \
        } while (0)
 #else /* #ifdef CONFIG_TASKS_RCU */
 #define TASKS_RCU(x) do { } while (0)
-#define rcu_note_voluntary_context_switch(t)    do { } while (0)
+#define rcu_note_voluntary_context_switch(t)    rcu_all_qs()
 #endif /* #else #ifdef CONFIG_TASKS_RCU */
 /**
@@ -582,11 +583,11 @@ static inline void rcu_preempt_sleep_check(void)
 })
 #define __rcu_dereference_check(p, c, space) \
 ({ \
-        typeof(*p) *_________p1 = (typeof(*p) *__force)ACCESS_ONCE(p); \
+        /* Dependency order vs. p above. */ \
+        typeof(*p) *________p1 = (typeof(*p) *__force)lockless_dereference(p); \
        rcu_lockdep_assert(c, "suspicious rcu_dereference_check() usage"); \
        rcu_dereference_sparse(p, space); \
-        smp_read_barrier_depends(); /* Dependency order vs. p above. */ \
+        ((typeof(*p) __force __kernel *)(________p1)); \
-        ((typeof(*p) __force __kernel *)(_________p1)); \
 })
 #define __rcu_dereference_protected(p, c, space) \
 ({ \
@@ -603,10 +604,10 @@ static inline void rcu_preempt_sleep_check(void)
 })
 #define __rcu_dereference_index_check(p, c) \
 ({ \
-        typeof(p) _________p1 = ACCESS_ONCE(p); \
+        /* Dependency order vs. p above. */ \
+        typeof(p) _________p1 = lockless_dereference(p); \
        rcu_lockdep_assert(c, \
                           "suspicious rcu_dereference_index_check() usage"); \
-        smp_read_barrier_depends(); /* Dependency order vs. p above. */ \
        (_________p1); \
 })
diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
index 0e5366200154..937edaeb150d 100644
--- a/include/linux/rcutiny.h
+++ b/include/linux/rcutiny.h
@@ -92,17 +92,49 @@ static inline void rcu_virt_note_context_switch(int cpu)
 }
 /*
- * Return the number of grace periods.
+ * Return the number of grace periods started.
 */
-static inline long rcu_batches_completed(void)
+static inline unsigned long rcu_batches_started(void)
 {
        return 0;
 }
 /*
- * Return the number of bottom-half grace periods.
+ * Return the number of bottom-half grace periods started.
 */
-static inline long rcu_batches_completed_bh(void)
+static inline unsigned long rcu_batches_started_bh(void)
+{
+        return 0;
+}
+/*
+ * Return the number of sched grace periods started.
+ */
+static inline unsigned long rcu_batches_started_sched(void)
+{
+        return 0;
+}
+/*
+ * Return the number of grace periods completed.
+ */
+static inline unsigned long rcu_batches_completed(void)
+{
+        return 0;
+}
+/*
+ * Return the number of bottom-half grace periods completed.
+ */
+static inline unsigned long rcu_batches_completed_bh(void)
+{
+        return 0;
+}
+/*
+ * Return the number of sched grace periods completed.
+ */
+static inline unsigned long rcu_batches_completed_sched(void)
 {
        return 0;
 }
@@ -154,7 +186,10 @@ static inline bool rcu_is_watching(void)
        return true;
 }
 #endif /* #else defined(CONFIG_DEBUG_LOCK_ALLOC) || defined(CONFIG_RCU_TRACE) */
+static inline void rcu_all_qs(void)
+{
+}
 #endif /* __LINUX_RCUTINY_H */
diff --git a/include/linux/rcutree.h b/include/linux/rcutree.h
index 52953790dcca..d2e583a6aaca 100644
--- a/include/linux/rcutree.h
+++ b/include/linux/rcutree.h
@@ -81,9 +81,12 @@ void cond_synchronize_rcu(unsigned long oldstate);
 extern unsigned long rcutorture_testseq;
 extern unsigned long rcutorture_vernum;
-long rcu_batches_completed(void);
+unsigned long rcu_batches_started(void);
-long rcu_batches_completed_bh(void);
+unsigned long rcu_batches_started_bh(void);
-long rcu_batches_completed_sched(void);
+unsigned long rcu_batches_started_sched(void);
+unsigned long rcu_batches_completed(void);
+unsigned long rcu_batches_completed_bh(void);
+unsigned long rcu_batches_completed_sched(void);
 void show_rcu_gp_kthreads(void);
 void rcu_force_quiescent_state(void);
@@ -97,4 +100,6 @@ extern int rcu_scheduler_active __read_mostly;
 bool rcu_is_watching(void);
+void rcu_all_qs(void);
 #endif /* __LINUX_RCUTREE_H */
diff --git a/include/linux/regmap.h b/include/linux/regmap.h
index 4419b99d8d6e..116655d92269 100644
--- a/include/linux/regmap.h
+++ b/include/linux/regmap.h
@@ -468,7 +468,7 @@ bool regmap_reg_in_ranges(unsigned int reg,
 *
 * @reg: Offset of the register within the regmap bank
 * @lsb: lsb of the register field.
- * @reg: msb of the register field.
+ * @msb: msb of the register field.
 * @id_size: port size if it has some ports
 * @id_offset: address offset for each ports
 */
diff --git a/include/linux/regulator/da9211.h b/include/linux/regulator/da9211.h
index 5479394fefce..5dd65acc2a69 100644
--- a/include/linux/regulator/da9211.h
+++ b/include/linux/regulator/da9211.h
@@ -32,6 +32,8 @@ struct da9211_pdata {
         * 2 : 2 phase 2 buck
         */
        int num_buck;
+        int gpio_ren[DA9211_MAX_REGULATORS];
+        struct device_node *reg_node[DA9211_MAX_REGULATORS];
        struct regulator_init_data *init_data[DA9211_MAX_REGULATORS];
 };
 #endif
diff --git a/include/linux/regulator/driver.h b/include/linux/regulator/driver.h
index 5f1e9ca47417..d4ad5b5a02bb 100644
--- a/include/linux/regulator/driver.h
+++ b/include/linux/regulator/driver.h
@@ -21,6 +21,7 @@
 struct regmap;
 struct regulator_dev;
+struct regulator_config;
 struct regulator_init_data;
 struct regulator_enable_gpio;
@@ -205,6 +206,15 @@ enum regulator_type {
 * @supply_name: Identifying the regulator supply
 * @of_match: Name used to identify regulator in DT.
 * @regulators_node: Name of node containing regulator definitions in DT.
+ * @of_parse_cb: Optional callback called only if of_match is present.
+ *               Will be called for each regulator parsed from DT, during
+ *               init_data parsing.
+ *               The regulator_config passed as argument to the callback will
+ *               be a copy of config passed to regulator_register, valid only
+ *               for this particular call. Callback may freely change the
+ *               config but it cannot store it for later usage.
+ *               Callback should return 0 on success or negative ERRNO
+ *               indicating failure.
 * @id: Numerical identifier for the regulator.
 * @ops: Regulator operations table.
 * @irq: Interrupt number for the regulator.
@@ -251,6 +261,9 @@ struct regulator_desc {
        const char *supply_name;
        const char *of_match;
        const char *regulators_node;
+        int (*of_parse_cb)(struct device_node *,
+                            const struct regulator_desc *,
+                            struct regulator_config *);
        int id;
        bool continuous_voltage_range;
        unsigned n_voltages;
diff --git a/include/linux/regulator/machine.h b/include/linux/regulator/machine.h
index 0b08d05d470b..b07562e082c4 100644
--- a/include/linux/regulator/machine.h
+++ b/include/linux/regulator/machine.h
@@ -191,15 +191,22 @@ struct regulator_init_data {
        void *driver_data;      /* core does not touch this */
 };
-int regulator_suspend_prepare(suspend_state_t state);
-int regulator_suspend_finish(void);
 #ifdef CONFIG_REGULATOR
 void regulator_has_full_constraints(void);
+int regulator_suspend_prepare(suspend_state_t state);
+int regulator_suspend_finish(void);
 #else
 static inline void regulator_has_full_constraints(void)
 {
 }
+static inline int regulator_suspend_prepare(suspend_state_t state)
+{
+        return 0;
+}
+static inline int regulator_suspend_finish(void)
+{
+        return 0;
+}
 #endif
 #endif
diff --git a/include/linux/regulator/mt6397-regulator.h b/include/linux/regulator/mt6397-regulator.h
new file mode 100644
index 000000000000..30cc5963e265
--- /dev/null
+++ b/include/linux/regulator/mt6397-regulator.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2014 MediaTek Inc.
+ * Author: Flora Fu <flora.fu@mediatek.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#ifndef __LINUX_REGULATOR_MT6397_H
+#define __LINUX_REGULATOR_MT6397_H
+enum {
+        MT6397_ID_VPCA15 = 0,
+        MT6397_ID_VPCA7,
+        MT6397_ID_VSRAMCA15,
+        MT6397_ID_VSRAMCA7,
+        MT6397_ID_VCORE,
+        MT6397_ID_VGPU,
+        MT6397_ID_VDRM,
+        MT6397_ID_VIO18 = 7,
+        MT6397_ID_VTCXO,
+        MT6397_ID_VA28,
+        MT6397_ID_VCAMA,
+        MT6397_ID_VIO28,
+        MT6397_ID_VUSB,
+        MT6397_ID_VMC,
+        MT6397_ID_VMCH,
+        MT6397_ID_VEMC3V3,
+        MT6397_ID_VGP1,
+        MT6397_ID_VGP2,
+        MT6397_ID_VGP3,
+        MT6397_ID_VGP4,
+        MT6397_ID_VGP5,
+        MT6397_ID_VGP6,
+        MT6397_ID_VIBR,
+        MT6397_ID_RG_MAX,
+};
+#define MT6397_MAX_REGULATOR    MT6397_ID_RG_MAX
+#define MT6397_REGULATOR_ID97   0x97
+#define MT6397_REGULATOR_ID91   0x91
+#endif /* __LINUX_REGULATOR_MT6397_H */
diff --git a/include/linux/regulator/pfuze100.h b/include/linux/regulator/pfuze100.h
index 364f7a7c43db..70c6c66c5bcf 100644
--- a/include/linux/regulator/pfuze100.h
+++ b/include/linux/regulator/pfuze100.h
@@ -49,6 +49,20 @@
 #define PFUZE200_VGEN5          11
 #define PFUZE200_VGEN6          12
+#define PFUZE3000_SW1A          0
+#define PFUZE3000_SW1B          1
+#define PFUZE3000_SW2           2
+#define PFUZE3000_SW3           3
+#define PFUZE3000_SWBST         4
+#define PFUZE3000_VSNVS         5
+#define PFUZE3000_VREFDDR       6
+#define PFUZE3000_VLDO1         7
+#define PFUZE3000_VLDO2         8
+#define PFUZE3000_VCCSD         9
+#define PFUZE3000_V33           10
+#define PFUZE3000_VLDO3         11
+#define PFUZE3000_VLDO4         12
 struct regulator_init_data;
 struct pfuze_regulator_platform_data {
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index c0c2bce6b0b7..d9d7e7e56352 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -37,6 +37,16 @@ struct anon_vma {
        atomic_t refcount;
        /*
+         * Count of child anon_vmas and VMAs which points to this anon_vma.
+         *
+         * This counter is used for making decision about reusing anon_vma
+         * instead of forking new one. See comments in function anon_vma_clone.
+         */
+        unsigned degree;
+        struct anon_vma *parent;        /* Parent of this anon_vma */
+        /*
         * NOTE: the LSB of the rb_root.rb_node is set by
         * mm_take_all_locks() _after_ taking the above lock. So the
         * rb_root must only be read/written after taking the above lock
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index 6d6be09a2fe5..dcad7ee0d746 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -161,7 +161,7 @@ extern void devm_rtc_device_unregister(struct device *dev,
 extern int rtc_read_time(struct rtc_device *rtc, struct rtc_time *tm);
 extern int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm);
 extern int rtc_set_mmss(struct rtc_device *rtc, unsigned long secs);
-extern int rtc_set_ntp_time(struct timespec now);
+extern int rtc_set_ntp_time(struct timespec64 now);
 int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm);
 extern int rtc_read_alarm(struct rtc_device *rtc,
                        struct rtc_wkalrm *alrm);
diff --git a/include/linux/smp.h b/include/linux/smp.h
index 93dff5fff524..be91db2a7017 100644
--- a/include/linux/smp.h
+++ b/include/linux/smp.h
@@ -151,6 +151,13 @@ smp_call_function_any(const struct cpumask *mask, smp_call_func_t func,
 static inline void kick_all_cpus_sync(void) {  }
 static inline void wake_up_all_idle_cpus(void) {  }
+#ifdef CONFIG_UP_LATE_INIT
+extern void __init up_late_init(void);
+static inline void smp_init(void) { up_late_init(); }
+#else
+static inline void smp_init(void) { }
+#endif
 #endif /* !SMP */
 /*
diff --git a/include/linux/spi/at86rf230.h b/include/linux/spi/at86rf230.h
index b2b1afbb3202..cd519a11c2c6 100644
--- a/include/linux/spi/at86rf230.h
+++ b/include/linux/spi/at86rf230.h
@@ -12,10 +12,6 @@
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
 * Written by:
 * Dmitry Eremin-Solenikov <dmitry.baryshkov@siemens.com>
 */
diff --git a/include/linux/spi/l4f00242t03.h b/include/linux/spi/l4f00242t03.h
index bc8677c8eba9..e69e9b51b21a 100644
--- a/include/linux/spi/l4f00242t03.h
+++ b/include/linux/spi/l4f00242t03.h
@@ -12,10 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 #ifndef _INCLUDE_LINUX_SPI_L4F00242T03_H_
diff --git a/include/linux/spi/lms283gf05.h b/include/linux/spi/lms283gf05.h
index 555d254e6606..fdd1d1d51da5 100644
--- a/include/linux/spi/lms283gf05.h
+++ b/include/linux/spi/lms283gf05.h
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 #ifndef _INCLUDE_LINUX_SPI_LMS283GF05_H_
diff --git a/include/linux/spi/mxs-spi.h b/include/linux/spi/mxs-spi.h
index 4835486f58e5..381d368b91b4 100644
--- a/include/linux/spi/mxs-spi.h
+++ b/include/linux/spi/mxs-spi.h
@@ -15,10 +15,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #ifndef __LINUX_SPI_MXS_SPI_H__
diff --git a/include/linux/spi/pxa2xx_spi.h b/include/linux/spi/pxa2xx_spi.h
index d5a316550177..6d36dacec4ba 100644
--- a/include/linux/spi/pxa2xx_spi.h
+++ b/include/linux/spi/pxa2xx_spi.h
@@ -10,10 +10,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #ifndef __linux_pxa2xx_spi_h
 #define __linux_pxa2xx_spi_h
@@ -57,7 +53,6 @@ struct pxa2xx_spi_chip {
 #if defined(CONFIG_ARCH_PXA) || defined(CONFIG_ARCH_MMP)
 #include <linux/clk.h>
-#include <mach/dma.h>
 extern void pxa2xx_set_spi_info(unsigned id, struct pxa2xx_spi_master *info);
diff --git a/include/linux/spi/rspi.h b/include/linux/spi/rspi.h
index e546b2ceb623..a693188cc08b 100644
--- a/include/linux/spi/rspi.h
+++ b/include/linux/spi/rspi.h
@@ -11,11 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- *
 */
 #ifndef __LINUX_SPI_RENESAS_SPI_H__
diff --git a/include/linux/spi/sh_hspi.h b/include/linux/spi/sh_hspi.h
index a1121f872ac1..aa0d440ab4f0 100644
--- a/include/linux/spi/sh_hspi.h
+++ b/include/linux/spi/sh_hspi.h
@@ -9,10 +9,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 */
 #ifndef SH_HSPI_H
 #define SH_HSPI_H
diff --git a/include/linux/spi/sh_msiof.h b/include/linux/spi/sh_msiof.h
index 88a14d81c49e..b087a85f5f72 100644
--- a/include/linux/spi/sh_msiof.h
+++ b/include/linux/spi/sh_msiof.h
@@ -7,6 +7,8 @@ struct sh_msiof_spi_info {
        u16 num_chipselect;
        unsigned int dma_tx_id;
        unsigned int dma_rx_id;
+        u32 dtdl;
+        u32 syncdl;
 };
 #endif /* __SPI_SH_MSIOF_H__ */
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index a6ef2a8e6de4..ed9489d893a4 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -10,10 +10,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #ifndef __LINUX_SPI_H
@@ -260,6 +256,7 @@ static inline void spi_unregister_driver(struct spi_driver *sdrv)
 * @pump_messages: work struct for scheduling work to the message pump
 * @queue_lock: spinlock to syncronise access to message queue
 * @queue: message queue
+ * @idling: the device is entering idle state
 * @cur_msg: the currently in-flight message
 * @cur_msg_prepared: spi_prepare_message was called for the currently
 *                    in-flight message
@@ -425,6 +422,7 @@ struct spi_master {
        spinlock_t                      queue_lock;
        struct list_head                queue;
        struct spi_message              *cur_msg;
+        bool                            idling;
        bool                            busy;
        bool                            running;
        bool                            rt;
diff --git a/include/linux/spi/tle62x0.h b/include/linux/spi/tle62x0.h
index 60b59187e590..414c6fddfcf0 100644
--- a/include/linux/spi/tle62x0.h
+++ b/include/linux/spi/tle62x0.h
@@ -12,10 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 struct tle62x0_pdata {
diff --git a/include/linux/spi/tsc2005.h b/include/linux/spi/tsc2005.h
index 8f721e465e05..563b3b1799a8 100644
--- a/include/linux/spi/tsc2005.h
+++ b/include/linux/spi/tsc2005.h
@@ -12,11 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- *
 */
 #ifndef _LINUX_SPI_TSC2005_H
diff --git a/include/linux/srcu.h b/include/linux/srcu.h
index a2783cb5d275..9cfd9623fb03 100644
--- a/include/linux/srcu.h
+++ b/include/linux/srcu.h
@@ -45,7 +45,7 @@ struct rcu_batch {
 #define RCU_BATCH_INIT(name) { NULL, &(name.head) }
 struct srcu_struct {
-        unsigned completed;
+        unsigned long completed;
        struct srcu_struct_array __percpu *per_cpu_ref;
        spinlock_t queue_lock; /* protect ->batch_queue, ->running */
        bool running;
@@ -102,13 +102,11 @@ void process_srcu(struct work_struct *work);
 * define and init a srcu struct at build time.
 * dont't call init_srcu_struct() nor cleanup_srcu_struct() on it.
 */
-#define DEFINE_SRCU(name)                                               \
+#define __DEFINE_SRCU(name, is_static)                                  \
        static DEFINE_PER_CPU(struct srcu_struct_array, name##_srcu_array);\
-        struct srcu_struct name = __SRCU_STRUCT_INIT(name);
+        is_static struct srcu_struct name = __SRCU_STRUCT_INIT(name)
+#define DEFINE_SRCU(name)               __DEFINE_SRCU(name, /* not static */)
-#define DEFINE_STATIC_SRCU(name)                                        \
+#define DEFINE_STATIC_SRCU(name)        __DEFINE_SRCU(name, static)
-        static DEFINE_PER_CPU(struct srcu_struct_array, name##_srcu_array);\
-        static struct srcu_struct name = __SRCU_STRUCT_INIT(name);
 /**
 * call_srcu() - Queue a callback for invocation after an SRCU grace period
@@ -135,7 +133,7 @@ int __srcu_read_lock(struct srcu_struct *sp) __acquires(sp);
 void __srcu_read_unlock(struct srcu_struct *sp, int idx) __releases(sp);
 void synchronize_srcu(struct srcu_struct *sp);
 void synchronize_srcu_expedited(struct srcu_struct *sp);
-long srcu_batches_completed(struct srcu_struct *sp);
+unsigned long srcu_batches_completed(struct srcu_struct *sp);
 void srcu_barrier(struct srcu_struct *sp);
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
diff --git a/include/linux/thermal.h b/include/linux/thermal.h
index c611a02fbc51..fc52e307efab 100644
--- a/include/linux/thermal.h
+++ b/include/linux/thermal.h
@@ -38,7 +38,7 @@
 #define THERMAL_CSTATE_INVALID -1UL
 /* No upper/lower limit requirement */
-#define THERMAL_NO_LIMIT        THERMAL_CSTATE_INVALID
+#define THERMAL_NO_LIMIT        ((u32)~0)
 /* Unit conversion macros */
 #define KELVIN_TO_CELSIUS(t)    (long)(((long)t-2732 >= 0) ?    \
diff --git a/include/linux/time.h b/include/linux/time.h
index 203c2ad40d71..beebe3a02d43 100644
--- a/include/linux/time.h
+++ b/include/linux/time.h
@@ -110,6 +110,19 @@ static inline bool timespec_valid_strict(const struct timespec *ts)
        return true;
 }
+static inline bool timeval_valid(const struct timeval *tv)
+{
+        /* Dates before 1970 are bogus */
+        if (tv->tv_sec < 0)
+                return false;
+        /* Can't have more microseconds then a second */
+        if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC)
+                return false;
+        return true;
+}
 extern struct timespec timespec_trunc(struct timespec t, unsigned gran);
 #define CURRENT_TIME            (current_kernel_time())
diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h
index 9b63d13ba82b..3eaae4754275 100644
--- a/include/linux/timekeeping.h
+++ b/include/linux/timekeeping.h
@@ -33,6 +33,7 @@ extern time64_t ktime_get_real_seconds(void);
 extern int __getnstimeofday64(struct timespec64 *tv);
 extern void getnstimeofday64(struct timespec64 *tv);
+extern void getboottime64(struct timespec64 *ts);
 #if BITS_PER_LONG == 64
 /**
@@ -72,6 +73,11 @@ static inline struct timespec get_monotonic_coarse(void)
 {
        return get_monotonic_coarse64();
 }
+static inline void getboottime(struct timespec *ts)
+{
+        return getboottime64(ts);
+}
 #else
 /**
 * Deprecated. Use do_settimeofday64().
@@ -129,9 +135,15 @@ static inline struct timespec get_monotonic_coarse(void)
 {
        return timespec64_to_timespec(get_monotonic_coarse64());
 }
-#endif
-extern void getboottime(struct timespec *ts);
+static inline void getboottime(struct timespec *ts)
+{
+        struct timespec64 ts64;
+        getboottime64(&ts64);
+        *ts = timespec64_to_timespec(ts64);
+}
+#endif
 #define do_posix_clock_monotonic_gettime(ts) ktime_get_ts(ts)
 #define ktime_get_real_ts64(ts) getnstimeofday64(ts)
@@ -217,6 +229,11 @@ static inline void get_monotonic_boottime(struct timespec *ts)
        *ts = ktime_to_timespec(ktime_get_boottime());
 }
+static inline void get_monotonic_boottime64(struct timespec64 *ts)
+{
+        *ts = ktime_to_timespec64(ktime_get_boottime());
+}
 static inline void timekeeping_clocktai(struct timespec *ts)
 {
        *ts = ktime_to_timespec(ktime_get_clocktai());
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index e08e21e5f601..c72851328ca9 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -173,7 +173,7 @@ extern void syscall_unregfunc(void);
                                TP_PROTO(data_proto),                   \
                                TP_ARGS(data_args),                     \
                                TP_CONDITION(cond),,);                  \
-                if (IS_ENABLED(CONFIG_LOCKDEP)) {                       \
+                if (IS_ENABLED(CONFIG_LOCKDEP) && (cond)) {             \
                        rcu_read_lock_sched_notrace();                  \
                        rcu_dereference_sched(__tracepoint_##name.funcs);\
                        rcu_read_unlock_sched_notrace();                \
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 2232ed16635a..537d58eea8a0 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -363,7 +363,6 @@ do {									\
 */
 #define wait_event_cmd(wq, condition, cmd1, cmd2)                       \
 do {                                                                    \
-        might_sleep();                                                  \
        if (condition)                                                  \
                break;                                                  \
        __wait_event_cmd(wq, condition, cmd1, cmd2);                    \
@@ -991,6 +990,32 @@ wait_on_bit_io(void *word, int bit, unsigned mode)
 }
 /**
+ * wait_on_bit_timeout - wait for a bit to be cleared or a timeout elapses
+ * @word: the word being waited on, a kernel virtual address
+ * @bit: the bit of the word being waited on
+ * @mode: the task state to sleep in
+ * @timeout: timeout, in jiffies
+ *
+ * Use the standard hashed waitqueue table to wait for a bit
+ * to be cleared. This is similar to wait_on_bit(), except also takes a
+ * timeout parameter.
+ *
+ * Returned value will be zero if the bit was cleared before the
+ * @timeout elapsed, or non-zero if the @timeout elapsed or process
+ * received a signal and the mode permitted wakeup on that signal.
+ */
+static inline int
+wait_on_bit_timeout(void *word, int bit, unsigned mode, unsigned long timeout)
+{
+        might_sleep();
+        if (!test_bit(bit, word))
+                return 0;
+        return out_of_line_wait_on_bit_timeout(word, bit,
+                                               bit_wait_timeout,
+                                               mode, timeout);
+}
+/**
 * wait_on_bit_action - wait for a bit to be cleared
 * @word: the word being waited on, a kernel virtual address
 * @bit: the bit of the word being waited on
diff --git a/include/linux/writeback.h b/include/linux/writeback.h
index a219be961c0a..00048339c23e 100644
--- a/include/linux/writeback.h
+++ b/include/linux/writeback.h
@@ -177,7 +177,6 @@ int write_cache_pages(struct address_space *mapping,
                      struct writeback_control *wbc, writepage_t writepage,
                      void *data);
 int do_writepages(struct address_space *mapping, struct writeback_control *wbc);
-void set_page_dirty_balance(struct page *page);
 void writeback_set_ratelimit(void);
 void tag_pages_for_writeback(struct address_space *mapping,
                             pgoff_t start, pgoff_t end);
diff --git a/include/net/flow_keys.h b/include/net/flow_keys.h
index 7ee2df083542..dc8fd81412bf 100644
--- a/include/net/flow_keys.h
+++ b/include/net/flow_keys.h
@@ -22,9 +22,9 @@ struct flow_keys {
                __be32 ports;
                __be16 port16[2];
        };
-        u16 thoff;
+        u16     thoff;
-        u16 n_proto;
+        __be16  n_proto;
-        u8 ip_proto;
+        u8      ip_proto;
 };
 bool __skb_flow_dissect(const struct sk_buff *skb, struct flow_keys *flow,
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index af10c2cf8a1d..6c92415311ca 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -27,10 +27,18 @@ struct genl_info;
 * @maxattr: maximum number of attributes supported
 * @netnsok: set to true if the family can handle network
 *      namespaces and should be presented in all of them
+ * @parallel_ops: operations can be called in parallel and aren't
+ *      synchronized by the core genetlink code
 * @pre_doit: called before an operation's doit callback, it may
 *      do additional, common, filtering and return an error
 * @post_doit: called after an operation's doit callback, it may
 *      undo operations done by pre_doit, for example release locks
+ * @mcast_bind: a socket bound to the given multicast group (which
+ *      is given as the offset into the groups array)
+ * @mcast_unbind: a socket was unbound from the given multicast group.
+ *      Note that unbind() will not be called symmetrically if the
+ *      generic netlink family is removed while there are still open
+ *      sockets.
 * @attrbuf: buffer to store parsed attributes
 * @family_list: family list
 * @mcgrps: multicast groups used by this family (private)
@@ -53,6 +61,8 @@ struct genl_family {
        void                    (*post_doit)(const struct genl_ops *ops,
                                             struct sk_buff *skb,
                                             struct genl_info *info);
+        int                     (*mcast_bind)(struct net *net, int group);
+        void                    (*mcast_unbind)(struct net *net, int group);
        struct nlattr **        attrbuf;        /* private */
        const struct genl_ops * ops;            /* private */
        const struct genl_multicast_group *mcgrps; /* private */
@@ -395,11 +405,11 @@ static inline int genl_set_err(struct genl_family *family, struct net *net,
 }
 static inline int genl_has_listeners(struct genl_family *family,
-                                     struct sock *sk, unsigned int group)
+                                     struct net *net, unsigned int group)
 {
        if (WARN_ON_ONCE(group >= family->n_mcgrps))
                return -EINVAL;
        group = family->mcgrp_offset + group;
-        return netlink_has_listeners(sk, group);
+        return netlink_has_listeners(net->genl_sock, group);
 }
 #endif  /* __NET_GENERIC_NETLINK_H */
diff --git a/include/net/ip.h b/include/net/ip.h
index 0bb620702929..09cf5aebb283 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -39,11 +39,12 @@ struct inet_skb_parm {
        struct ip_options       opt;            /* Compiled IP options          */
        unsigned char           flags;
-#define IPSKB_FORWARDED         1
+#define IPSKB_FORWARDED         BIT(0)
-#define IPSKB_XFRM_TUNNEL_SIZE  2
+#define IPSKB_XFRM_TUNNEL_SIZE  BIT(1)
-#define IPSKB_XFRM_TRANSFORMED  4
+#define IPSKB_XFRM_TRANSFORMED  BIT(2)
-#define IPSKB_FRAG_COMPLETE     8
+#define IPSKB_FRAG_COMPLETE     BIT(3)
-#define IPSKB_REROUTED          16
+#define IPSKB_REROUTED          BIT(4)
+#define IPSKB_DOREDIRECT        BIT(5)
        u16                     frag_max_size;
 };
@@ -180,7 +181,7 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg)
        return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0;
 }
-void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
+void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
                           const struct ip_options *sopt,
                           __be32 daddr, __be32 saddr,
                           const struct ip_reply_arg *arg,
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 4292929392b0..6e416f6d3e3c 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -671,6 +671,9 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
        return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
 }
+u32 __ipv6_select_ident(u32 hashrnd, struct in6_addr *dst,
+                        struct in6_addr *src);
+void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
 void ipv6_proxy_select_ident(struct sk_buff *skb);
 int ip6_dst_hoplimit(struct dst_entry *dst);
@@ -708,7 +711,7 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb,
                                        __be32 flowlabel, bool autolabel)
 {
        if (!flowlabel && (autolabel || net->ipv6.sysctl.auto_flowlabels)) {
-                __be32 hash;
+                u32 hash;
                hash = skb_get_hash(skb);
@@ -718,7 +721,7 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb,
                 */
                hash ^= hash >> 12;
-                flowlabel = hash & IPV6_FLOWLABEL_MASK;
+                flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK;
        }
        return flowlabel;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 58d719ddaa60..29c7be8808d5 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1270,8 +1270,7 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
 *
 * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
 *      driver to indicate that it requires IV generation for this
- *      particular key. Setting this flag does not necessarily mean that SKBs
+ *      particular key.
- *      will have sufficient tailroom for ICV or MIC.
 * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by
 *      the driver for a TKIP key if it requires Michael MIC
 *      generation in software.
@@ -1283,9 +1282,7 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
 * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
 *      if space should be prepared for the IV, but the IV
 *      itself should not be generated. Do not set together with
- *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key. Setting this flag does
+ *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
- *      not necessarily mean that SKBs will have sufficient tailroom for ICV or
- *      MIC.
 * @IEEE80211_KEY_FLAG_RX_MGMT: This key will be used to decrypt received
 *      management frames. The flag can help drivers that have a hardware
 *      crypto implementation that doesn't deal with management frames
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index eb070b3674a1..76f708486aae 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -190,7 +190,6 @@ struct neigh_hash_table {
 struct neigh_table {
-        struct neigh_table      *next;
        int                     family;
        int                     entry_size;
        int                     key_len;
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 3ae969e3acf0..9eaaa7884586 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -530,6 +530,8 @@ enum nft_chain_type {
 int nft_chain_validate_dependency(const struct nft_chain *chain,
                                  enum nft_chain_type type);
+int nft_chain_validate_hooks(const struct nft_chain *chain,
+                             unsigned int hook_flags);
 struct nft_stats {
        u64                     bytes;
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 24945cefc4fd..0ffef1a38efc 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -52,6 +52,7 @@ struct netns_ipv4 {
        struct inet_peer_base   *peers;
        struct tcpm_hash_bucket *tcp_metrics_hash;
        unsigned int            tcp_metrics_hash_log;
+        struct sock  * __percpu *tcp_sk;
        struct netns_frags      frags;
 #ifdef CONFIG_NETFILTER
        struct xt_table         *iptable_filter;
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 3d282cbb66bf..c605d305c577 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -79,6 +79,9 @@ struct Qdisc {
        struct netdev_queue     *dev_queue;
        struct gnet_stats_rate_est64    rate_est;
+        struct gnet_stats_basic_cpu __percpu *cpu_bstats;
+        struct gnet_stats_queue __percpu *cpu_qstats;
        struct Qdisc            *next_sched;
        struct sk_buff          *gso_skb;
        /*
@@ -86,15 +89,9 @@ struct Qdisc {
         */
        unsigned long           state;
        struct sk_buff_head     q;
-        union {
+        struct gnet_stats_basic_packed bstats;
-                struct gnet_stats_basic_packed bstats;
-                struct gnet_stats_basic_cpu __percpu *cpu_bstats;
-        } __packed;
        unsigned int            __state;
-        union {
+        struct gnet_stats_queue qstats;
-                struct gnet_stats_queue qstats;
-                struct gnet_stats_queue __percpu *cpu_qstats;
-        } __packed;
        struct rcu_head         rcu_head;
        int                     padded;
        atomic_t                refcnt;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index f50f29faf76f..9d9111ef43ae 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -834,8 +834,8 @@ void tcp_get_available_congestion_control(char *buf, size_t len);
 void tcp_get_allowed_congestion_control(char *buf, size_t len);
 int tcp_set_allowed_congestion_control(char *allowed);
 int tcp_set_congestion_control(struct sock *sk, const char *name);
-void tcp_slow_start(struct tcp_sock *tp, u32 acked);
+u32 tcp_slow_start(struct tcp_sock *tp, u32 acked);
-void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w);
+void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked);
 u32 tcp_reno_ssthresh(struct sock *sk);
 void tcp_reno_cong_avoid(struct sock *sk, u32 ack, u32 acked);
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 57cccd0052e5..903461aa5644 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -1,6 +1,9 @@
 #ifndef __NET_VXLAN_H
 #define __NET_VXLAN_H 1
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/if_vlan.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/udp.h>
@@ -51,16 +54,33 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
                   __be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
                   __be16 src_port, __be16 dst_port, __be32 vni, bool xnet);
-static inline bool vxlan_gso_check(struct sk_buff *skb)
+static inline netdev_features_t vxlan_features_check(struct sk_buff *skb,
+                                                     netdev_features_t features)
 {
-        if ((skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL) &&
+        u8 l4_hdr = 0;
+        if (!skb->encapsulation)
+                return features;
+        switch (vlan_get_protocol(skb)) {
+        case htons(ETH_P_IP):
+                l4_hdr = ip_hdr(skb)->protocol;
+                break;
+        case htons(ETH_P_IPV6):
+                l4_hdr = ipv6_hdr(skb)->nexthdr;
+                break;
+        default:
+                return features;;
+        }
+        if ((l4_hdr == IPPROTO_UDP) &&
            (skb->inner_protocol_type != ENCAP_TYPE_ETHER ||
             skb->inner_protocol != htons(ETH_P_TEB) ||
             (skb_inner_mac_header(skb) - skb_transport_header(skb) !=
              sizeof(struct udphdr) + sizeof(struct vxlanhdr))))
-                return false;
+                return features & ~(NETIF_F_ALL_CSUM | NETIF_F_GSO_MASK);
-        return true;
+        return features;
 }
 /* IP header + UDP + VXLAN + Ethernet header */
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 0d74f1de99aa..65994a19e840 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1707,10 +1707,7 @@ static inline int ib_copy_from_udata(void *dest, struct ib_udata *udata, size_t
 static inline int ib_copy_to_udata(struct ib_udata *udata, void *src, size_t len)
 {
-        size_t copy_sz;
+        return copy_to_user(udata->outbuf, src, len) ? -EFAULT : 0;
-        copy_sz = min_t(size_t, len, udata->outlen);
-        return copy_to_user(udata->outbuf, src, copy_sz) ? -EFAULT : 0;
 }
 /**
diff --git a/include/sound/ak4113.h b/include/sound/ak4113.h
index 2609048c1d44..3a34f6edc2d1 100644
--- a/include/sound/ak4113.h
+++ b/include/sound/ak4113.h
@@ -286,7 +286,7 @@ struct ak4113 {
        ak4113_write_t *write;
        ak4113_read_t *read;
        void *private_data;
-        unsigned int init:1;
+        atomic_t wq_processing;
        spinlock_t lock;
        unsigned char regmap[AK4113_WRITABLE_REGS];
        struct snd_kcontrol *kctls[AK4113_CONTROLS];
diff --git a/include/sound/ak4114.h b/include/sound/ak4114.h
index 52f02a60dba7..069299a88915 100644
--- a/include/sound/ak4114.h
+++ b/include/sound/ak4114.h
@@ -168,7 +168,7 @@ struct ak4114 {
        ak4114_write_t * write;
        ak4114_read_t * read;
        void * private_data;
-        unsigned int init: 1;
+        atomic_t wq_processing;
        spinlock_t lock;
        unsigned char regmap[6];
        unsigned char txcsb[5];
diff --git a/include/sound/pcm.h b/include/sound/pcm.h
index 1e7f74acc2ec..b429b73e875e 100644
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -857,7 +857,7 @@ static inline unsigned int params_channels(const struct snd_pcm_hw_params *p)
 }
 /**
- * params_channels - Get the sample rate from the hw params
+ * params_rate - Get the sample rate from the hw params
 * @p: hw params
 */
 static inline unsigned int params_rate(const struct snd_pcm_hw_params *p)
@@ -866,7 +866,7 @@ static inline unsigned int params_rate(const struct snd_pcm_hw_params *p)
 }
 /**
- * params_channels - Get the period size (in frames) from the hw params
+ * params_period_size - Get the period size (in frames) from the hw params
 * @p: hw params
 */
 static inline unsigned int params_period_size(const struct snd_pcm_hw_params *p)
@@ -875,7 +875,7 @@ static inline unsigned int params_period_size(const struct snd_pcm_hw_params *p)
 }
 /**
- * params_channels - Get the number of periods from the hw params
+ * params_periods - Get the number of periods from the hw params
 * @p: hw params
 */
 static inline unsigned int params_periods(const struct snd_pcm_hw_params *p)
@@ -884,7 +884,7 @@ static inline unsigned int params_periods(const struct snd_pcm_hw_params *p)
 }
 /**
- * params_channels - Get the buffer size (in frames) from the hw params
+ * params_buffer_size - Get the buffer size (in frames) from the hw params
 * @p: hw params
 */
 static inline unsigned int params_buffer_size(const struct snd_pcm_hw_params *p)
@@ -893,7 +893,7 @@ static inline unsigned int params_buffer_size(const struct snd_pcm_hw_params *p)
 }
 /**
- * params_channels - Get the buffer size (in bytes) from the hw params
+ * params_buffer_bytes - Get the buffer size (in bytes) from the hw params
 * @p: hw params
 */
 static inline unsigned int params_buffer_bytes(const struct snd_pcm_hw_params *p)
diff --git a/include/sound/soc.h b/include/sound/soc.h
index b4fca9aed2a2..ac8b333acb4d 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -498,6 +498,7 @@ int snd_soc_test_bits(struct snd_soc_codec *codec, unsigned int reg,
                                unsigned int mask, unsigned int value);
 #ifdef CONFIG_SND_SOC_AC97_BUS
+struct snd_ac97 *snd_soc_alloc_ac97_codec(struct snd_soc_codec *codec);
 struct snd_ac97 *snd_soc_new_ac97_codec(struct snd_soc_codec *codec);
 void snd_soc_free_ac97_codec(struct snd_ac97 *ac97);
diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
index 430cfaf92285..db81c65b8f48 100644
--- a/include/target/target_core_backend.h
+++ b/include/target/target_core_backend.h
@@ -135,7 +135,6 @@ int	se_dev_set_is_nonrot(struct se_device *, int);
 int     se_dev_set_emulate_rest_reord(struct se_device *dev, int);
 int     se_dev_set_queue_depth(struct se_device *, u32);
 int     se_dev_set_max_sectors(struct se_device *, u32);
-int     se_dev_set_fabric_max_sectors(struct se_device *, u32);
 int     se_dev_set_optimal_sectors(struct se_device *, u32);
 int     se_dev_set_block_size(struct se_device *, u32);
diff --git a/include/target/target_core_backend_configfs.h b/include/target/target_core_backend_configfs.h
index 3247d7530107..186f7a923570 100644
--- a/include/target/target_core_backend_configfs.h
+++ b/include/target/target_core_backend_configfs.h
@@ -98,8 +98,6 @@ static struct target_backend_dev_attrib_attribute _backend##_dev_attrib_##_name
        TB_DEV_ATTR(_backend, block_size, S_IRUGO | S_IWUSR);           \
        DEF_TB_DEV_ATTRIB_RO(_backend, hw_max_sectors);                 \
        TB_DEV_ATTR_RO(_backend, hw_max_sectors);                       \
-        DEF_TB_DEV_ATTRIB(_backend, fabric_max_sectors);                \
-        TB_DEV_ATTR(_backend, fabric_max_sectors, S_IRUGO | S_IWUSR);   \
        DEF_TB_DEV_ATTRIB(_backend, optimal_sectors);                   \
        TB_DEV_ATTR(_backend, optimal_sectors, S_IRUGO | S_IWUSR);      \
        DEF_TB_DEV_ATTRIB_RO(_backend, hw_queue_depth);                 \
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 397fb635766a..4a8795a87b9e 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -77,8 +77,6 @@
 #define DA_UNMAP_GRANULARITY_ALIGNMENT_DEFAULT  0
 /* Default max_write_same_len, disabled by default */
 #define DA_MAX_WRITE_SAME_LEN                   0
-/* Default max transfer length */
-#define DA_FABRIC_MAX_SECTORS                   8192
 /* Use a model alias based on the configfs backend device name */
 #define DA_EMULATE_MODEL_ALIAS                  0
 /* Emulation for Direct Page Out */
@@ -694,7 +692,6 @@ struct se_dev_attrib {
        u32             hw_block_size;
        u32             block_size;
        u32             hw_max_sectors;
-        u32             fabric_max_sectors;
        u32             optimal_sectors;
        u32             hw_queue_depth;
        u32             queue_depth;
diff --git a/include/trace/events/kvm.h b/include/trace/events/kvm.h
index 6edf1f2028cd..86b399c66c3d 100644
--- a/include/trace/events/kvm.h
+++ b/include/trace/events/kvm.h
@@ -146,6 +146,14 @@ TRACE_EVENT(kvm_msi_set_irq,
 #if defined(CONFIG_HAVE_KVM_IRQFD)
+#ifdef kvm_irqchips
+#define kvm_ack_irq_string "irqchip %s pin %u"
+#define kvm_ack_irq_parm  __print_symbolic(__entry->irqchip, kvm_irqchips), __entry->pin
+#else
+#define kvm_ack_irq_string "irqchip %d pin %u"
+#define kvm_ack_irq_parm  __entry->irqchip, __entry->pin
+#endif
 TRACE_EVENT(kvm_ack_irq,
        TP_PROTO(unsigned int irqchip, unsigned int pin),
        TP_ARGS(irqchip, pin),
@@ -160,13 +168,7 @@ TRACE_EVENT(kvm_ack_irq,
                __entry->pin            = pin;
        ),
-#ifdef kvm_irqchips
+        TP_printk(kvm_ack_irq_string, kvm_ack_irq_parm)
-        TP_printk("irqchip %s pin %u",
-                  __print_symbolic(__entry->irqchip, kvm_irqchips),
-                 __entry->pin)
-#else
-        TP_printk("irqchip %d pin %u", __entry->irqchip, __entry->pin)
-#endif
 );
 #endif /* defined(CONFIG_HAVE_KVM_IRQFD) */
diff --git a/include/trace/events/tlb.h b/include/trace/events/tlb.h
index 13391d288107..0e7635765153 100644
--- a/include/trace/events/tlb.h
+++ b/include/trace/events/tlb.h
@@ -13,11 +13,13 @@
        { TLB_LOCAL_SHOOTDOWN,          "local shootdown" },            \
        { TLB_LOCAL_MM_SHOOTDOWN,       "local mm shootdown" }
-TRACE_EVENT(tlb_flush,
+TRACE_EVENT_CONDITION(tlb_flush,
        TP_PROTO(int reason, unsigned long pages),
        TP_ARGS(reason, pages),
+        TP_CONDITION(cpu_online(smp_processor_id())),
        TP_STRUCT__entry(
                __field(          int, reason)
                __field(unsigned long,  pages)
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index 139b5067345b..27609dfcce25 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -763,7 +763,7 @@ perf_trace_##call(void *__data, proto)					\
        struct ftrace_event_call *event_call = __data;                  \
        struct ftrace_data_offsets_##call __maybe_unused __data_offsets;\
        struct ftrace_raw_##call *entry;                                \
-        struct pt_regs __regs;                                          \
+        struct pt_regs *__regs;                                         \
        u64 __addr = 0, __count = 1;                                    \
        struct task_struct *__task = NULL;                              \
        struct hlist_head *head;                                        \
@@ -782,18 +782,19 @@ perf_trace_##call(void *__data, proto)					\
                             sizeof(u64));                              \
        __entry_size -= sizeof(u32);                                    \
                                                                        \
-        perf_fetch_caller_regs(&__regs);                                \
        entry = perf_trace_buf_prepare(__entry_size,                    \
                        event_call->event.type, &__regs, &rctx);        \
        if (!entry)                                                     \
                return;                                                 \
                                                                        \
+        perf_fetch_caller_regs(__regs);                                 \
+                                                                        \
        tstruct                                                         \
                                                                        \
        { assign; }                                                     \
                                                                        \
        perf_trace_buf_submit(entry, __entry_size, rctx, __addr,        \
-                __count, &__regs, head, __task);                        \
+                __count, __regs, head, __task);                         \
 }
 /*
diff --git a/include/uapi/asm-generic/fcntl.h b/include/uapi/asm-generic/fcntl.h
index 7543b3e51331..e063effe0cc1 100644
--- a/include/uapi/asm-generic/fcntl.h
+++ b/include/uapi/asm-generic/fcntl.h
@@ -5,7 +5,7 @@
 /*
 * FMODE_EXEC is 0x20
- * FMODE_NONOTIFY is 0x1000000
+ * FMODE_NONOTIFY is 0x4000000
 * These cannot be used by userspace O_* until internal and external open
 * flags are split.
 * -Eric Paris
diff --git a/include/uapi/linux/can/netlink.h b/include/uapi/linux/can/netlink.h
index 3e4323a3918d..94ffe0c83ce7 100644
--- a/include/uapi/linux/can/netlink.h
+++ b/include/uapi/linux/can/netlink.h
@@ -98,6 +98,7 @@ struct can_ctrlmode {
 #define CAN_CTRLMODE_BERR_REPORTING     0x10    /* Bus-error reporting */
 #define CAN_CTRLMODE_FD                 0x20    /* CAN FD mode */
 #define CAN_CTRLMODE_PRESUME_ACK        0x40    /* Ignore missing CAN ACKs */
+#define CAN_CTRLMODE_FD_NON_ISO         0x80    /* CAN FD in non-ISO mode */
 /*
 * CAN device statistics
diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h
index 74a2a1773494..79b12b004ade 100644
--- a/include/uapi/linux/in6.h
+++ b/include/uapi/linux/in6.h
@@ -149,7 +149,7 @@ struct in6_flowlabel_req {
 /*
 *      IPV6 socket options
 */
+#if __UAPI_DEF_IPV6_OPTIONS
 #define IPV6_ADDRFORM           1
 #define IPV6_2292PKTINFO        2
 #define IPV6_2292HOPOPTS        3
@@ -196,6 +196,7 @@ struct in6_flowlabel_req {
 #define IPV6_IPSEC_POLICY       34
 #define IPV6_XFRM_POLICY        35
+#endif
 /*
 * Multicast:
diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h
index 7acef41fc209..af94f31e33ac 100644
--- a/include/uapi/linux/kfd_ioctl.h
+++ b/include/uapi/linux/kfd_ioctl.h
@@ -128,27 +128,34 @@ struct kfd_ioctl_get_process_apertures_args {
        uint32_t pad;
 };
-#define KFD_IOC_MAGIC 'K'
+#define AMDKFD_IOCTL_BASE 'K'
+#define AMDKFD_IO(nr)                   _IO(AMDKFD_IOCTL_BASE, nr)
+#define AMDKFD_IOR(nr, type)            _IOR(AMDKFD_IOCTL_BASE, nr, type)
+#define AMDKFD_IOW(nr, type)            _IOW(AMDKFD_IOCTL_BASE, nr, type)
+#define AMDKFD_IOWR(nr, type)           _IOWR(AMDKFD_IOCTL_BASE, nr, type)
-#define KFD_IOC_GET_VERSION \
+#define AMDKFD_IOC_GET_VERSION                  \
-                _IOR(KFD_IOC_MAGIC, 1, struct kfd_ioctl_get_version_args)
+                AMDKFD_IOR(0x01, struct kfd_ioctl_get_version_args)
-#define KFD_IOC_CREATE_QUEUE \
+#define AMDKFD_IOC_CREATE_QUEUE                 \
-                _IOWR(KFD_IOC_MAGIC, 2, struct kfd_ioctl_create_queue_args)
+                AMDKFD_IOWR(0x02, struct kfd_ioctl_create_queue_args)
-#define KFD_IOC_DESTROY_QUEUE \
+#define AMDKFD_IOC_DESTROY_QUEUE                \
-        _IOWR(KFD_IOC_MAGIC, 3, struct kfd_ioctl_destroy_queue_args)
+                AMDKFD_IOWR(0x03, struct kfd_ioctl_destroy_queue_args)
-#define KFD_IOC_SET_MEMORY_POLICY \
+#define AMDKFD_IOC_SET_MEMORY_POLICY            \
-        _IOW(KFD_IOC_MAGIC, 4, struct kfd_ioctl_set_memory_policy_args)
+                AMDKFD_IOW(0x04, struct kfd_ioctl_set_memory_policy_args)
-#define KFD_IOC_GET_CLOCK_COUNTERS \
+#define AMDKFD_IOC_GET_CLOCK_COUNTERS           \
-        _IOWR(KFD_IOC_MAGIC, 5, struct kfd_ioctl_get_clock_counters_args)
+                AMDKFD_IOWR(0x05, struct kfd_ioctl_get_clock_counters_args)
-#define KFD_IOC_GET_PROCESS_APERTURES \
+#define AMDKFD_IOC_GET_PROCESS_APERTURES        \
-        _IOR(KFD_IOC_MAGIC, 6, struct kfd_ioctl_get_process_apertures_args)
+                AMDKFD_IOR(0x06, struct kfd_ioctl_get_process_apertures_args)
-#define KFD_IOC_UPDATE_QUEUE \
+#define AMDKFD_IOC_UPDATE_QUEUE                 \
-        _IOW(KFD_IOC_MAGIC, 7, struct kfd_ioctl_update_queue_args)
+                AMDKFD_IOW(0x07, struct kfd_ioctl_update_queue_args)
+#define AMDKFD_COMMAND_START            0x01
+#define AMDKFD_COMMAND_END              0x08
 #endif
diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
index c140620dad92..e28807ad17fa 100644
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -69,6 +69,7 @@
 #define __UAPI_DEF_SOCKADDR_IN6         0
 #define __UAPI_DEF_IPV6_MREQ            0
 #define __UAPI_DEF_IPPROTO_V6           0
+#define __UAPI_DEF_IPV6_OPTIONS         0
 #else
@@ -82,6 +83,7 @@
 #define __UAPI_DEF_SOCKADDR_IN6         1
 #define __UAPI_DEF_IPV6_MREQ            1
 #define __UAPI_DEF_IPPROTO_V6           1
+#define __UAPI_DEF_IPV6_OPTIONS         1
 #endif /* _NETINET_IN_H */
@@ -103,6 +105,7 @@
 #define __UAPI_DEF_SOCKADDR_IN6         1
 #define __UAPI_DEF_IPV6_MREQ            1
 #define __UAPI_DEF_IPPROTO_V6           1
+#define __UAPI_DEF_IPV6_OPTIONS         1
 /* Definitions for xattr.h */
 #define __UAPI_DEF_XATTR                1
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index 3a6dcaa359b7..f714e8633352 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -174,6 +174,10 @@ enum ovs_packet_attr {
        OVS_PACKET_ATTR_USERDATA,    /* OVS_ACTION_ATTR_USERSPACE arg. */
        OVS_PACKET_ATTR_EGRESS_TUN_KEY,  /* Nested OVS_TUNNEL_KEY_ATTR_*
                                            attributes. */
+        OVS_PACKET_ATTR_UNUSED1,
+        OVS_PACKET_ATTR_UNUSED2,
+        OVS_PACKET_ATTR_PROBE,      /* Packet operation is a feature probe,
+                                       error logging should be suppressed. */
        __OVS_PACKET_ATTR_MAX
 };
diff --git a/include/uapi/linux/uinput.h b/include/uapi/linux/uinput.h
index baeab83deb64..013c9d8db372 100644
--- a/include/uapi/linux/uinput.h
+++ b/include/uapi/linux/uinput.h
@@ -82,7 +82,7 @@ struct uinput_ff_erase {
 * The complete sysfs path is then /sys/devices/virtual/input/--NAME--
 * Usually, it is in the form "inputN"
 */
-#define UI_GET_SYSNAME(len)     _IOC(_IOC_READ, UINPUT_IOCTL_BASE, 300, len)
+#define UI_GET_SYSNAME(len)     _IOC(_IOC_READ, UINPUT_IOCTL_BASE, 44, len)
 /**
 * UI_GET_VERSION - Return version of uinput protocol
@@ -91,7 +91,7 @@ struct uinput_ff_erase {
 * the integer pointed to by the ioctl argument. The protocol version
 * is hard-coded in the kernel and is independent of the uinput device.
 */
-#define UI_GET_VERSION          _IOR(UINPUT_IOCTL_BASE, 301, unsigned int)
+#define UI_GET_VERSION          _IOR(UINPUT_IOCTL_BASE, 45, unsigned int)
 /*
 * To write a force-feedback-capable driver, the upload_effect
diff --git a/include/uapi/linux/virtio_ring.h b/include/uapi/linux/virtio_ring.h
index 61c818a7fe70..a3318f31e8e7 100644
--- a/include/uapi/linux/virtio_ring.h
+++ b/include/uapi/linux/virtio_ring.h
@@ -101,6 +101,13 @@ struct vring {
        struct vring_used *used;
 };
+/* Alignment requirements for vring elements.
+ * When using pre-virtio 1.0 layout, these fall out naturally.
+ */
+#define VRING_AVAIL_ALIGN_SIZE 2
+#define VRING_USED_ALIGN_SIZE 4
+#define VRING_DESC_ALIGN_SIZE 16
 /* The standard layout for the ring is a continuous chunk of memory which looks
 * like this.  We assume num is a power of 2.
 *
diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
index 4275b961bf60..867cc5084afb 100644
--- a/include/uapi/rdma/ib_user_verbs.h
+++ b/include/uapi/rdma/ib_user_verbs.h
@@ -90,7 +90,6 @@ enum {
 };
 enum {
-        IB_USER_VERBS_EX_CMD_QUERY_DEVICE = IB_USER_VERBS_CMD_QUERY_DEVICE,
        IB_USER_VERBS_EX_CMD_CREATE_FLOW = IB_USER_VERBS_CMD_THRESHOLD,
        IB_USER_VERBS_EX_CMD_DESTROY_FLOW,
 };
@@ -202,32 +201,6 @@ struct ib_uverbs_query_device_resp {
        __u8  reserved[4];
 };
-enum {
-        IB_USER_VERBS_EX_QUERY_DEVICE_ODP =             1ULL << 0,
-};
-struct ib_uverbs_ex_query_device {
-        __u32 comp_mask;
-        __u32 reserved;
-};
-struct ib_uverbs_odp_caps {
-        __u64 general_caps;
-        struct {
-                __u32 rc_odp_caps;
-                __u32 uc_odp_caps;
-                __u32 ud_odp_caps;
-        } per_transport_caps;
-        __u32 reserved;
-};
-struct ib_uverbs_ex_query_device_resp {
-        struct ib_uverbs_query_device_resp base;
-        __u32 comp_mask;
-        __u32 reserved;
-        struct ib_uverbs_odp_caps odp_caps;
-};
 struct ib_uverbs_query_port {
        __u64 response;
        __u8  port_num;
diff --git a/include/xen/interface/nmi.h b/include/xen/interface/nmi.h
new file mode 100644
index 000000000000..b47d9d06fade
--- /dev/null
+++ b/include/xen/interface/nmi.h
@@ -0,0 +1,51 @@
+/******************************************************************************
+ * nmi.h
+ *
+ * NMI callback registration and reason codes.
+ *
+ * Copyright (c) 2005, Keir Fraser <keir@xensource.com>
+ */
+#ifndef __XEN_PUBLIC_NMI_H__
+#define __XEN_PUBLIC_NMI_H__
+#include <xen/interface/xen.h>
+/*
+ * NMI reason codes:
+ * Currently these are x86-specific, stored in arch_shared_info.nmi_reason.
+ */
+ /* I/O-check error reported via ISA port 0x61, bit 6. */
+#define _XEN_NMIREASON_io_error     0
+#define XEN_NMIREASON_io_error      (1UL << _XEN_NMIREASON_io_error)
+ /* PCI SERR reported via ISA port 0x61, bit 7. */
+#define _XEN_NMIREASON_pci_serr     1
+#define XEN_NMIREASON_pci_serr      (1UL << _XEN_NMIREASON_pci_serr)
+ /* Unknown hardware-generated NMI. */
+#define _XEN_NMIREASON_unknown      2
+#define XEN_NMIREASON_unknown       (1UL << _XEN_NMIREASON_unknown)
+/*
+ * long nmi_op(unsigned int cmd, void *arg)
+ * NB. All ops return zero on success, else a negative error code.
+ */
+/*
+ * Register NMI callback for this (calling) VCPU. Currently this only makes
+ * sense for domain 0, vcpu 0. All other callers will be returned EINVAL.
+ * arg == pointer to xennmi_callback structure.
+ */
+#define XENNMI_register_callback   0
+struct xennmi_callback {
+    unsigned long handler_address;
+    unsigned long pad;
+};
+DEFINE_GUEST_HANDLE_STRUCT(xennmi_callback);
+/*
+ * Deregister NMI callback for this (calling) VCPU.
+ * arg == NULL.
+ */
+#define XENNMI_unregister_callback 1
+#endif /* __XEN_PUBLIC_NMI_H__ */
diff --git a/init/Kconfig b/init/Kconfig
index 9afb971497f4..1354ac09b516 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -470,7 +470,6 @@ choice
 config TREE_RCU
        bool "Tree-based hierarchical RCU"
        depends on !PREEMPT && SMP
-        select IRQ_WORK
        help
          This option selects the RCU implementation that is
          designed for very large SMP system with hundreds or
@@ -480,7 +479,6 @@ config TREE_RCU
 config PREEMPT_RCU
        bool "Preemptible tree-based hierarchical RCU"
        depends on PREEMPT
-        select IRQ_WORK
        help
          This option selects the RCU implementation that is
          designed for very large SMP systems with hundreds or
@@ -501,9 +499,17 @@ config TINY_RCU
 endchoice
+config SRCU
+        bool
+        help
+          This option selects the sleepable version of RCU. This version
+          permits arbitrary sleeping or blocking within RCU read-side critical
+          sections.
 config TASKS_RCU
        bool "Task_based RCU implementation using voluntary context switch"
        default n
+        select SRCU
        help
          This option enables a task-based RCU implementation that uses
          only voluntary context switch (not preemption!), idle, and
@@ -668,9 +674,10 @@ config RCU_BOOST
 config RCU_KTHREAD_PRIO
        int "Real-time priority to use for RCU worker threads"
-        range 1 99
+        range 1 99 if RCU_BOOST
-        depends on RCU_BOOST
+        range 0 99 if !RCU_BOOST
-        default 1
+        default 1 if RCU_BOOST
+        default 0 if !RCU_BOOST
        help
          This option specifies the SCHED_FIFO priority value that will be
          assigned to the rcuc/n and rcub/n threads and is also the value
@@ -1595,6 +1602,7 @@ config PERF_EVENTS
        depends on HAVE_PERF_EVENTS
        select ANON_INODES
        select IRQ_WORK
+        select SRCU
        help
          Enable kernel support for various performance events provided
          by software and hardware.
diff --git a/init/main.c b/init/main.c
index 61b993767db5..179ada15d08a 100644
--- a/init/main.c
+++ b/init/main.c
@@ -87,10 +87,6 @@
 #include <asm/sections.h>
 #include <asm/cacheflush.h>
-#ifdef CONFIG_X86_LOCAL_APIC
-#include <asm/smp.h>
-#endif
 static int kernel_init(void *);
 extern void init_IRQ(void);
@@ -351,15 +347,6 @@ __setup("rdinit=", rdinit_setup);
 #ifndef CONFIG_SMP
 static const unsigned int setup_max_cpus = NR_CPUS;
-#ifdef CONFIG_X86_LOCAL_APIC
-static void __init smp_init(void)
-{
-        APIC_init_uniprocessor();
-}
-#else
-#define smp_init()      do { } while (0)
-#endif
 static inline void setup_nr_cpu_ids(void) { }
 static inline void smp_prepare_cpus(unsigned int maxcpus) { }
 #endif
diff --git a/kernel/Kconfig.locks b/kernel/Kconfig.locks
index 76768ee812b2..08561f1acd13 100644
--- a/kernel/Kconfig.locks
+++ b/kernel/Kconfig.locks
@@ -231,6 +231,10 @@ config RWSEM_SPIN_ON_OWNER
       def_bool y
       depends on SMP && RWSEM_XCHGADD_ALGORITHM && ARCH_SUPPORTS_ATOMIC_RMW
+config LOCK_SPIN_ON_OWNER
+       def_bool y
+       depends on MUTEX_SPIN_ON_OWNER || RWSEM_SPIN_ON_OWNER
 config ARCH_USE_QUEUE_RWLOCK
        bool
diff --git a/kernel/audit.c b/kernel/audit.c
index f8f203e8018c..72ab759a0b43 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -429,7 +429,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
 * This function doesn't consume an skb as might be expected since it has to
 * copy it anyways.
 */
-static void kauditd_send_multicast_skb(struct sk_buff *skb)
+static void kauditd_send_multicast_skb(struct sk_buff *skb, gfp_t gfp_mask)
 {
        struct sk_buff          *copy;
        struct audit_net        *aunet = net_generic(&init_net, audit_net_id);
@@ -448,11 +448,11 @@ static void kauditd_send_multicast_skb(struct sk_buff *skb)
         * no reason for new multicast clients to continue with this
         * non-compliance.
         */
-        copy = skb_copy(skb, GFP_KERNEL);
+        copy = skb_copy(skb, gfp_mask);
        if (!copy)
                return;
-        nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, GFP_KERNEL);
+        nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, gfp_mask);
 }
 /*
@@ -1100,7 +1100,7 @@ static void audit_receive(struct sk_buff  *skb)
 }
 /* Run custom bind function on netlink socket group connect or bind requests. */
-static int audit_bind(int group)
+static int audit_bind(struct net *net, int group)
 {
        if (!capable(CAP_AUDIT_READ))
                return -EPERM;
@@ -1940,7 +1940,7 @@ void audit_log_end(struct audit_buffer *ab)
                struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
                nlh->nlmsg_len = ab->skb->len;
-                kauditd_send_multicast_skb(ab->skb);
+                kauditd_send_multicast_skb(ab->skb, ab->gfp_mask);
                /*
                 * The original kaudit unicast socket sends up messages with
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 3598e13f2a65..4f68a326d92e 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -442,19 +442,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
                if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {
                        f->type = AUDIT_LOGINUID_SET;
                        f->val = 0;
-                }
+                        entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
-                if ((f->type == AUDIT_PID) || (f->type == AUDIT_PPID)) {
-                        struct pid *pid;
-                        rcu_read_lock();
-                        pid = find_vpid(f->val);
-                        if (!pid) {
-                                rcu_read_unlock();
-                                err = -ESRCH;
-                                goto exit_free;
-                        }
-                        f->val = pid_nr(pid);
-                        rcu_read_unlock();
                }
                err = audit_field_valid(entry, f);
@@ -630,6 +618,13 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
                        data->buflen += data->values[i] =
                                audit_pack_string(&bufp, krule->filterkey);
                        break;
+                case AUDIT_LOGINUID_SET:
+                        if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
+                                data->fields[i] = AUDIT_LOGINUID;
+                                data->values[i] = AUDIT_UID_UNSET;
+                                break;
+                        }
+                        /* fallthrough if set */
                default:
                        data->values[i] = f->val;
                }
@@ -646,6 +641,7 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
        int i;
        if (a->flags != b->flags ||
+            a->pflags != b->pflags ||
            a->listnr != b->listnr ||
            a->action != b->action ||
            a->field_count != b->field_count)
@@ -764,6 +760,7 @@ struct audit_entry *audit_dupe_rule(struct audit_krule *old)
        new = &entry->rule;
        new->vers_ops = old->vers_ops;
        new->flags = old->flags;
+        new->pflags = old->pflags;
        new->listnr = old->listnr;
        new->action = old->action;
        for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index c75522a83678..072566dd0caf 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -72,6 +72,8 @@
 #include <linux/fs_struct.h>
 #include <linux/compat.h>
 #include <linux/ctype.h>
+#include <linux/string.h>
+#include <uapi/linux/limits.h>
 #include "audit.h"
@@ -1861,8 +1863,7 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
        }
        list_for_each_entry_reverse(n, &context->names_list, list) {
-                /* does the name pointer match? */
+                if (!n->name || strcmp(n->name->name, name->name))
-                if (!n->name || n->name->name != name->name)
                        continue;
                /* match the correct record type */
@@ -1877,12 +1878,48 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
        }
 out_alloc:
-        /* unable to find the name from a previous getname(). Allocate a new
+        /* unable to find an entry with both a matching name and type */
-         * anonymous entry.
+        n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
-         */
-        n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);
        if (!n)
                return;
+        /* unfortunately, while we may have a path name to record with the
+         * inode, we can't always rely on the string lasting until the end of
+         * the syscall so we need to create our own copy, it may fail due to
+         * memory allocation issues, but we do our best */
+        if (name) {
+                /* we can't use getname_kernel() due to size limits */
+                size_t len = strlen(name->name) + 1;
+                struct filename *new = __getname();
+                if (unlikely(!new))
+                        goto out;
+                if (len <= (PATH_MAX - sizeof(*new))) {
+                        new->name = (char *)(new) + sizeof(*new);
+                        new->separate = false;
+                } else if (len <= PATH_MAX) {
+                        /* this looks odd, but is due to final_putname() */
+                        struct filename *new2;
+                        new2 = kmalloc(sizeof(*new2), GFP_KERNEL);
+                        if (unlikely(!new2)) {
+                                __putname(new);
+                                goto out;
+                        }
+                        new2->name = (char *)new;
+                        new2->separate = true;
+                        new = new2;
+                } else {
+                        /* we should never get here, but let's be safe */
+                        __putname(new);
+                        goto out;
+                }
+                strlcpy((char *)new->name, name->name, len);
+                new->uptr = NULL;
+                new->aname = n;
+                n->name = new;
+                n->name_put = true;
+        }
 out:
        if (parent) {
                n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index d6594e457a25..a64e7a207d2b 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -163,7 +163,7 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
 void bpf_jit_binary_free(struct bpf_binary_header *hdr)
 {
-        module_free(NULL, hdr);
+        module_memfree(hdr);
 }
 #endif /* CONFIG_BPF_JIT */
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 088ac0b1b106..536edc2be307 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -150,7 +150,7 @@ static int map_lookup_elem(union bpf_attr *attr)
        int ufd = attr->map_fd;
        struct fd f = fdget(ufd);
        struct bpf_map *map;
-        void *key, *value;
+        void *key, *value, *ptr;
        int err;
        if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM))
@@ -169,20 +169,29 @@ static int map_lookup_elem(union bpf_attr *attr)
        if (copy_from_user(key, ukey, map->key_size) != 0)
                goto free_key;
-        err = -ENOENT;
+        err = -ENOMEM;
-        rcu_read_lock();
+        value = kmalloc(map->value_size, GFP_USER);
-        value = map->ops->map_lookup_elem(map, key);
        if (!value)
-                goto err_unlock;
+                goto free_key;
+        rcu_read_lock();
+        ptr = map->ops->map_lookup_elem(map, key);
+        if (ptr)
+                memcpy(value, ptr, map->value_size);
+        rcu_read_unlock();
+        err = -ENOENT;
+        if (!ptr)
+                goto free_value;
        err = -EFAULT;
        if (copy_to_user(uvalue, value, map->value_size) != 0)
-                goto err_unlock;
+                goto free_value;
        err = 0;
-err_unlock:
+free_value:
-        rcu_read_unlock();
+        kfree(value);
 free_key:
        kfree(key);
 err_put:
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index bb263d0caab3..04cfe8ace520 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1909,7 +1909,7 @@ static void cgroup_kill_sb(struct super_block *sb)
         *
         * And don't kill the default root.
         */
-        if (css_has_online_children(&root->cgrp.self) ||
+        if (!list_empty(&root->cgrp.self.children) ||
            root == &cgrp_dfl_root)
                cgroup_put(&root->cgrp);
        else
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 5d220234b3ca..1972b161c61e 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -58,22 +58,23 @@ static int cpu_hotplug_disabled;
 static struct {
        struct task_struct *active_writer;
-        struct mutex lock; /* Synchronizes accesses to refcount, */
+        /* wait queue to wake up the active_writer */
+        wait_queue_head_t wq;
+        /* verifies that no writer will get active while readers are active */
+        struct mutex lock;
        /*
         * Also blocks the new readers during
         * an ongoing cpu hotplug operation.
         */
-        int refcount;
+        atomic_t refcount;
-        /* And allows lockless put_online_cpus(). */
-        atomic_t puts_pending;
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
        struct lockdep_map dep_map;
 #endif
 } cpu_hotplug = {
        .active_writer = NULL,
+        .wq = __WAIT_QUEUE_HEAD_INITIALIZER(cpu_hotplug.wq),
        .lock = __MUTEX_INITIALIZER(cpu_hotplug.lock),
-        .refcount = 0,
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
        .dep_map = {.name = "cpu_hotplug.lock" },
 #endif
@@ -86,15 +87,6 @@ static struct {
 #define cpuhp_lock_acquire()      lock_map_acquire(&cpu_hotplug.dep_map)
 #define cpuhp_lock_release()      lock_map_release(&cpu_hotplug.dep_map)
-static void apply_puts_pending(int max)
-{
-        int delta;
-        if (atomic_read(&cpu_hotplug.puts_pending) >= max) {
-                delta = atomic_xchg(&cpu_hotplug.puts_pending, 0);
-                cpu_hotplug.refcount -= delta;
-        }
-}
 void get_online_cpus(void)
 {
@@ -103,8 +95,7 @@ void get_online_cpus(void)
                return;
        cpuhp_lock_acquire_read();
        mutex_lock(&cpu_hotplug.lock);
-        apply_puts_pending(65536);
+        atomic_inc(&cpu_hotplug.refcount);
-        cpu_hotplug.refcount++;
        mutex_unlock(&cpu_hotplug.lock);
 }
 EXPORT_SYMBOL_GPL(get_online_cpus);
@@ -116,8 +107,7 @@ bool try_get_online_cpus(void)
        if (!mutex_trylock(&cpu_hotplug.lock))
                return false;
        cpuhp_lock_acquire_tryread();
-        apply_puts_pending(65536);
+        atomic_inc(&cpu_hotplug.refcount);
-        cpu_hotplug.refcount++;
        mutex_unlock(&cpu_hotplug.lock);
        return true;
 }
@@ -125,20 +115,18 @@ EXPORT_SYMBOL_GPL(try_get_online_cpus);
 void put_online_cpus(void)
 {
+        int refcount;
        if (cpu_hotplug.active_writer == current)
                return;
-        if (!mutex_trylock(&cpu_hotplug.lock)) {
-                atomic_inc(&cpu_hotplug.puts_pending);
-                cpuhp_lock_release();
-                return;
-        }
-        if (WARN_ON(!cpu_hotplug.refcount))
+        refcount = atomic_dec_return(&cpu_hotplug.refcount);
-                cpu_hotplug.refcount++; /* try to fix things up */
+        if (WARN_ON(refcount < 0)) /* try to fix things up */
+                atomic_inc(&cpu_hotplug.refcount);
+        if (refcount <= 0 && waitqueue_active(&cpu_hotplug.wq))
+                wake_up(&cpu_hotplug.wq);
-        if (!--cpu_hotplug.refcount && unlikely(cpu_hotplug.active_writer))
-                wake_up_process(cpu_hotplug.active_writer);
-        mutex_unlock(&cpu_hotplug.lock);
        cpuhp_lock_release();
 }
@@ -168,18 +156,20 @@ EXPORT_SYMBOL_GPL(put_online_cpus);
 */
 void cpu_hotplug_begin(void)
 {
-        cpu_hotplug.active_writer = current;
+        DEFINE_WAIT(wait);
+        cpu_hotplug.active_writer = current;
        cpuhp_lock_acquire();
        for (;;) {
                mutex_lock(&cpu_hotplug.lock);
-                apply_puts_pending(1);
+                prepare_to_wait(&cpu_hotplug.wq, &wait, TASK_UNINTERRUPTIBLE);
-                if (likely(!cpu_hotplug.refcount))
+                if (likely(!atomic_read(&cpu_hotplug.refcount)))
-                        break;
+                                break;
-                __set_current_state(TASK_UNINTERRUPTIBLE);
                mutex_unlock(&cpu_hotplug.lock);
                schedule();
        }
+        finish_wait(&cpu_hotplug.wq, &wait);
 }
 void cpu_hotplug_done(void)
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 1adf62b39b96..07ce18ca71e0 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -27,6 +27,9 @@
 * version 2. This program is licensed "as is" without any warranty of any
 * kind, whether express or implied.
 */
+#define pr_fmt(fmt) "KGDB: " fmt
 #include <linux/pid_namespace.h>
 #include <linux/clocksource.h>
 #include <linux/serial_core.h>
@@ -196,8 +199,8 @@ int __weak kgdb_validate_break_address(unsigned long addr)
                return err;
        err = kgdb_arch_remove_breakpoint(&tmp);
        if (err)
-                printk(KERN_ERR "KGDB: Critical breakpoint error, kernel "
+                pr_err("Critical breakpoint error, kernel memory destroyed at: %lx\n",
-                   "memory destroyed at: %lx", addr);
+                       addr);
        return err;
 }
@@ -256,8 +259,8 @@ int dbg_activate_sw_breakpoints(void)
                error = kgdb_arch_set_breakpoint(&kgdb_break[i]);
                if (error) {
                        ret = error;
-                        printk(KERN_INFO "KGDB: BP install failed: %lx",
+                        pr_info("BP install failed: %lx\n",
-                               kgdb_break[i].bpt_addr);
+                                kgdb_break[i].bpt_addr);
                        continue;
                }
@@ -319,8 +322,8 @@ int dbg_deactivate_sw_breakpoints(void)
                        continue;
                error = kgdb_arch_remove_breakpoint(&kgdb_break[i]);
                if (error) {
-                        printk(KERN_INFO "KGDB: BP remove failed: %lx\n",
+                        pr_info("BP remove failed: %lx\n",
-                               kgdb_break[i].bpt_addr);
+                                kgdb_break[i].bpt_addr);
                        ret = error;
                }
@@ -367,7 +370,7 @@ int dbg_remove_all_break(void)
                        goto setundefined;
                error = kgdb_arch_remove_breakpoint(&kgdb_break[i]);
                if (error)
-                        printk(KERN_ERR "KGDB: breakpoint remove failed: %lx\n",
+                        pr_err("breakpoint remove failed: %lx\n",
                               kgdb_break[i].bpt_addr);
 setundefined:
                kgdb_break[i].state = BP_UNDEFINED;
@@ -400,9 +403,9 @@ static int kgdb_io_ready(int print_wait)
        if (print_wait) {
 #ifdef CONFIG_KGDB_KDB
                if (!dbg_kdb_mode)
-                        printk(KERN_CRIT "KGDB: waiting... or $3#33 for KDB\n");
+                        pr_crit("waiting... or $3#33 for KDB\n");
 #else
-                printk(KERN_CRIT "KGDB: Waiting for remote debugger\n");
+                pr_crit("Waiting for remote debugger\n");
 #endif
        }
        return 1;
@@ -430,8 +433,7 @@ static int kgdb_reenter_check(struct kgdb_state *ks)
                exception_level = 0;
                kgdb_skipexception(ks->ex_vector, ks->linux_regs);
                dbg_activate_sw_breakpoints();
-                printk(KERN_CRIT "KGDB: re-enter error: breakpoint removed %lx\n",
+                pr_crit("re-enter error: breakpoint removed %lx\n", addr);
-                        addr);
                WARN_ON_ONCE(1);
                return 1;
@@ -444,7 +446,7 @@ static int kgdb_reenter_check(struct kgdb_state *ks)
                panic("Recursive entry to debugger");
        }
-        printk(KERN_CRIT "KGDB: re-enter exception: ALL breakpoints killed\n");
+        pr_crit("re-enter exception: ALL breakpoints killed\n");
 #ifdef CONFIG_KGDB_KDB
        /* Allow kdb to debug itself one level */
        return 0;
@@ -471,6 +473,7 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs,
        int cpu;
        int trace_on = 0;
        int online_cpus = num_online_cpus();
+        u64 time_left;
        kgdb_info[ks->cpu].enter_kgdb++;
        kgdb_info[ks->cpu].exception_state |= exception_state;
@@ -595,9 +598,13 @@ return_normal:
        /*
         * Wait for the other CPUs to be notified and be waiting for us:
         */
-        while (kgdb_do_roundup && (atomic_read(&masters_in_kgdb) +
+        time_left = loops_per_jiffy * HZ;
-                                atomic_read(&slaves_in_kgdb)) != online_cpus)
+        while (kgdb_do_roundup && --time_left &&
+               (atomic_read(&masters_in_kgdb) + atomic_read(&slaves_in_kgdb)) !=
+                   online_cpus)
                cpu_relax();
+        if (!time_left)
+                pr_crit("KGDB: Timed out waiting for secondary CPUs.\n");
        /*
         * At this point the primary processor is completely
@@ -795,15 +802,15 @@ static struct console kgdbcons = {
 static void sysrq_handle_dbg(int key)
 {
        if (!dbg_io_ops) {
-                printk(KERN_CRIT "ERROR: No KGDB I/O module available\n");
+                pr_crit("ERROR: No KGDB I/O module available\n");
                return;
        }
        if (!kgdb_connected) {
 #ifdef CONFIG_KGDB_KDB
                if (!dbg_kdb_mode)
-                        printk(KERN_CRIT "KGDB or $3#33 for KDB\n");
+                        pr_crit("KGDB or $3#33 for KDB\n");
 #else
-                printk(KERN_CRIT "Entering KGDB\n");
+                pr_crit("Entering KGDB\n");
 #endif
        }
@@ -945,7 +952,7 @@ static void kgdb_initial_breakpoint(void)
 {
        kgdb_break_asap = 0;
-        printk(KERN_CRIT "kgdb: Waiting for connection from remote gdb...\n");
+        pr_crit("Waiting for connection from remote gdb...\n");
        kgdb_breakpoint();
 }
@@ -964,8 +971,7 @@ int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
        if (dbg_io_ops) {
                spin_unlock(&kgdb_registration_lock);
-                printk(KERN_ERR "kgdb: Another I/O driver is already "
+                pr_err("Another I/O driver is already registered with KGDB\n");
-                                "registered with KGDB.\n");
                return -EBUSY;
        }
@@ -981,8 +987,7 @@ int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
        spin_unlock(&kgdb_registration_lock);
-        printk(KERN_INFO "kgdb: Registered I/O driver %s.\n",
+        pr_info("Registered I/O driver %s\n", new_dbg_io_ops->name);
-               new_dbg_io_ops->name);
        /* Arm KGDB now. */
        kgdb_register_callbacks();
@@ -1017,8 +1022,7 @@ void kgdb_unregister_io_module(struct kgdb_io *old_dbg_io_ops)
        spin_unlock(&kgdb_registration_lock);
-        printk(KERN_INFO
+        pr_info("Unregistered I/O driver %s, debugger disabled\n",
-                "kgdb: Unregistered I/O driver %s, debugger disabled.\n",
                old_dbg_io_ops->name);
 }
 EXPORT_SYMBOL_GPL(kgdb_unregister_io_module);
diff --git a/kernel/debug/kdb/kdb_bp.c b/kernel/debug/kdb/kdb_bp.c
index b20d544f20c2..e1dbf4a2c69e 100644
--- a/kernel/debug/kdb/kdb_bp.c
+++ b/kernel/debug/kdb/kdb_bp.c
@@ -531,22 +531,29 @@ void __init kdb_initbptab(void)
        for (i = 0, bp = kdb_breakpoints; i < KDB_MAXBPT; i++, bp++)
                bp->bp_free = 1;
-        kdb_register_repeat("bp", kdb_bp, "[<vaddr>]",
+        kdb_register_flags("bp", kdb_bp, "[<vaddr>]",
-                "Set/Display breakpoints", 0, KDB_REPEAT_NO_ARGS);
+                "Set/Display breakpoints", 0,
-        kdb_register_repeat("bl", kdb_bp, "[<vaddr>]",
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
-                "Display breakpoints", 0, KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("bl", kdb_bp, "[<vaddr>]",
+                "Display breakpoints", 0,
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
        if (arch_kgdb_ops.flags & KGDB_HW_BREAKPOINT)
-                kdb_register_repeat("bph", kdb_bp, "[<vaddr>]",
+                kdb_register_flags("bph", kdb_bp, "[<vaddr>]",
-                "[datar [length]|dataw [length]]   Set hw brk", 0, KDB_REPEAT_NO_ARGS);
+                "[datar [length]|dataw [length]]   Set hw brk", 0,
-        kdb_register_repeat("bc", kdb_bc, "<bpnum>",
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
-                "Clear Breakpoint", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("bc", kdb_bc, "<bpnum>",
-        kdb_register_repeat("be", kdb_bc, "<bpnum>",
+                "Clear Breakpoint", 0,
-                "Enable Breakpoint", 0, KDB_REPEAT_NONE);
+                KDB_ENABLE_FLOW_CTRL);
-        kdb_register_repeat("bd", kdb_bc, "<bpnum>",
+        kdb_register_flags("be", kdb_bc, "<bpnum>",
-                "Disable Breakpoint", 0, KDB_REPEAT_NONE);
+                "Enable Breakpoint", 0,
+                KDB_ENABLE_FLOW_CTRL);
-        kdb_register_repeat("ss", kdb_ss, "",
+        kdb_register_flags("bd", kdb_bc, "<bpnum>",
-                "Single Step", 1, KDB_REPEAT_NO_ARGS);
+                "Disable Breakpoint", 0,
+                KDB_ENABLE_FLOW_CTRL);
+        kdb_register_flags("ss", kdb_ss, "",
+                "Single Step", 1,
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
        /*
         * Architecture dependent initialization.
         */
diff --git a/kernel/debug/kdb/kdb_debugger.c b/kernel/debug/kdb/kdb_debugger.c
index 8859ca34dcfe..15e1a7af5dd0 100644
--- a/kernel/debug/kdb/kdb_debugger.c
+++ b/kernel/debug/kdb/kdb_debugger.c
@@ -129,6 +129,10 @@ int kdb_stub(struct kgdb_state *ks)
                ks->pass_exception = 1;
                KDB_FLAG_SET(CATASTROPHIC);
        }
+        /* set CATASTROPHIC if the system contains unresponsive processors */
+        for_each_online_cpu(i)
+                if (!kgdb_info[i].enter_kgdb)
+                        KDB_FLAG_SET(CATASTROPHIC);
        if (KDB_STATE(SSBPT) && reason == KDB_REASON_SSTEP) {
                KDB_STATE_CLEAR(SSBPT);
                KDB_STATE_CLEAR(DOING_SS);
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 379650b984f8..7b40c5f07dce 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -12,6 +12,7 @@
 */
 #include <linux/ctype.h>
+#include <linux/types.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/kmsg_dump.h>
@@ -23,6 +24,7 @@
 #include <linux/vmalloc.h>
 #include <linux/atomic.h>
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/kallsyms.h>
@@ -42,6 +44,12 @@
 #include <linux/slab.h>
 #include "kdb_private.h"
+#undef  MODULE_PARAM_PREFIX
+#define MODULE_PARAM_PREFIX "kdb."
+static int kdb_cmd_enabled = CONFIG_KDB_DEFAULT_ENABLE;
+module_param_named(cmd_enable, kdb_cmd_enabled, int, 0600);
 #define GREP_LEN 256
 char kdb_grep_string[GREP_LEN];
 int kdb_grepping_flag;
@@ -121,6 +129,7 @@ static kdbmsg_t kdbmsgs[] = {
        KDBMSG(BADLENGTH, "Invalid length field"),
        KDBMSG(NOBP, "No Breakpoint exists"),
        KDBMSG(BADADDR, "Invalid address"),
+        KDBMSG(NOPERM, "Permission denied"),
 };
 #undef KDBMSG
@@ -188,6 +197,26 @@ struct task_struct *kdb_curr_task(int cpu)
 }
 /*
+ * Check whether the flags of the current command and the permissions
+ * of the kdb console has allow a command to be run.
+ */
+static inline bool kdb_check_flags(kdb_cmdflags_t flags, int permissions,
+                                   bool no_args)
+{
+        /* permissions comes from userspace so needs massaging slightly */
+        permissions &= KDB_ENABLE_MASK;
+        permissions |= KDB_ENABLE_ALWAYS_SAFE;
+        /* some commands change group when launched with no arguments */
+        if (no_args)
+                permissions |= permissions << KDB_ENABLE_NO_ARGS_SHIFT;
+        flags |= KDB_ENABLE_ALL;
+        return permissions & flags;
+}
+/*
 * kdbgetenv - This function will return the character string value of
 *      an environment variable.
 * Parameters:
@@ -476,6 +505,15 @@ int kdbgetaddrarg(int argc, const char **argv, int *nextarg,
        kdb_symtab_t symtab;
        /*
+         * If the enable flags prohibit both arbitrary memory access
+         * and flow control then there are no reasonable grounds to
+         * provide symbol lookup.
+         */
+        if (!kdb_check_flags(KDB_ENABLE_MEM_READ | KDB_ENABLE_FLOW_CTRL,
+                             kdb_cmd_enabled, false))
+                return KDB_NOPERM;
+        /*
         * Process arguments which follow the following syntax:
         *
         *  symbol | numeric-address [+/- numeric-offset]
@@ -641,8 +679,13 @@ static int kdb_defcmd2(const char *cmdstr, const char *argv0)
                if (!s->count)
                        s->usable = 0;
                if (s->usable)
-                        kdb_register(s->name, kdb_exec_defcmd,
+                        /* macros are always safe because when executed each
-                                     s->usage, s->help, 0);
+                         * internal command re-enters kdb_parse() and is
+                         * safety checked individually.
+                         */
+                        kdb_register_flags(s->name, kdb_exec_defcmd, s->usage,
+                                           s->help, 0,
+                                           KDB_ENABLE_ALWAYS_SAFE);
                return 0;
        }
        if (!s->usable)
@@ -1003,25 +1046,22 @@ int kdb_parse(const char *cmdstr)
        if (i < kdb_max_commands) {
                int result;
+                if (!kdb_check_flags(tp->cmd_flags, kdb_cmd_enabled, argc <= 1))
+                        return KDB_NOPERM;
                KDB_STATE_SET(CMD);
                result = (*tp->cmd_func)(argc-1, (const char **)argv);
                if (result && ignore_errors && result > KDB_CMD_GO)
                        result = 0;
                KDB_STATE_CLEAR(CMD);
-                switch (tp->cmd_repeat) {
-                case KDB_REPEAT_NONE:
+                if (tp->cmd_flags & KDB_REPEAT_WITH_ARGS)
-                        argc = 0;
+                        return result;
-                        if (argv[0])
-                                *(argv[0]) = '\0';
+                argc = tp->cmd_flags & KDB_REPEAT_NO_ARGS ? 1 : 0;
-                        break;
+                if (argv[argc])
-                case KDB_REPEAT_NO_ARGS:
+                        *(argv[argc]) = '\0';
-                        argc = 1;
-                        if (argv[1])
-                                *(argv[1]) = '\0';
-                        break;
-                case KDB_REPEAT_WITH_ARGS:
-                        break;
-                }
                return result;
        }
@@ -1921,10 +1961,14 @@ static int kdb_rm(int argc, const char **argv)
 */
 static int kdb_sr(int argc, const char **argv)
 {
+        bool check_mask =
+            !kdb_check_flags(KDB_ENABLE_ALL, kdb_cmd_enabled, false);
        if (argc != 1)
                return KDB_ARGCOUNT;
        kdb_trap_printk++;
-        __handle_sysrq(*argv[1], false);
+        __handle_sysrq(*argv[1], check_mask);
        kdb_trap_printk--;
        return 0;
@@ -1979,7 +2023,7 @@ static int kdb_lsmod(int argc, const char **argv)
                kdb_printf("%-20s%8u  0x%p ", mod->name,
                           mod->core_size, (void *)mod);
 #ifdef CONFIG_MODULE_UNLOAD
-                kdb_printf("%4ld ", module_refcount(mod));
+                kdb_printf("%4d ", module_refcount(mod));
 #endif
                if (mod->state == MODULE_STATE_GOING)
                        kdb_printf(" (Unloading)");
@@ -2157,6 +2201,8 @@ static void kdb_cpu_status(void)
        for (start_cpu = -1, i = 0; i < NR_CPUS; i++) {
                if (!cpu_online(i)) {
                        state = 'F';    /* cpu is offline */
+                } else if (!kgdb_info[i].enter_kgdb) {
+                        state = 'D';    /* cpu is online but unresponsive */
                } else {
                        state = ' ';    /* cpu is responding to kdb */
                        if (kdb_task_state_char(KDB_TSK(i)) == 'I')
@@ -2210,7 +2256,7 @@ static int kdb_cpu(int argc, const char **argv)
        /*
         * Validate cpunum
         */
-        if ((cpunum > NR_CPUS) || !cpu_online(cpunum))
+        if ((cpunum > NR_CPUS) || !kgdb_info[cpunum].enter_kgdb)
                return KDB_BADCPUNUM;
        dbg_switch_cpu = cpunum;
@@ -2375,6 +2421,8 @@ static int kdb_help(int argc, const char **argv)
                        return 0;
                if (!kt->cmd_name)
                        continue;
+                if (!kdb_check_flags(kt->cmd_flags, kdb_cmd_enabled, true))
+                        continue;
                if (strlen(kt->cmd_usage) > 20)
                        space = "\n                                    ";
                kdb_printf("%-15.15s %-20s%s%s\n", kt->cmd_name,
@@ -2629,7 +2677,7 @@ static int kdb_grep_help(int argc, const char **argv)
 }
 /*
- * kdb_register_repeat - This function is used to register a kernel
+ * kdb_register_flags - This function is used to register a kernel
 *      debugger command.
 * Inputs:
 *      cmd     Command name
@@ -2641,12 +2689,12 @@ static int kdb_grep_help(int argc, const char **argv)
 *      zero for success, one if a duplicate command.
 */
 #define kdb_command_extend 50   /* arbitrary */
-int kdb_register_repeat(char *cmd,
+int kdb_register_flags(char *cmd,
-                        kdb_func_t func,
+                       kdb_func_t func,
-                        char *usage,
+                       char *usage,
-                        char *help,
+                       char *help,
-                        short minlen,
+                       short minlen,
-                        kdb_repeat_t repeat)
+                       kdb_cmdflags_t flags)
 {
        int i;
        kdbtab_t *kp;
@@ -2694,19 +2742,18 @@ int kdb_register_repeat(char *cmd,
        kp->cmd_func   = func;
        kp->cmd_usage  = usage;
        kp->cmd_help   = help;
-        kp->cmd_flags  = 0;
        kp->cmd_minlen = minlen;
-        kp->cmd_repeat = repeat;
+        kp->cmd_flags  = flags;
        return 0;
 }
-EXPORT_SYMBOL_GPL(kdb_register_repeat);
+EXPORT_SYMBOL_GPL(kdb_register_flags);
 /*
 * kdb_register - Compatibility register function for commands that do
 *      not need to specify a repeat state.  Equivalent to
- *      kdb_register_repeat with KDB_REPEAT_NONE.
+ *      kdb_register_flags with flags set to 0.
 * Inputs:
 *      cmd     Command name
 *      func    Function to execute the command
@@ -2721,8 +2768,7 @@ int kdb_register(char *cmd,
             char *help,
             short minlen)
 {
-        return kdb_register_repeat(cmd, func, usage, help, minlen,
+        return kdb_register_flags(cmd, func, usage, help, minlen, 0);
-                                   KDB_REPEAT_NONE);
 }
 EXPORT_SYMBOL_GPL(kdb_register);
@@ -2764,80 +2810,109 @@ static void __init kdb_inittab(void)
        for_each_kdbcmd(kp, i)
                kp->cmd_name = NULL;
-        kdb_register_repeat("md", kdb_md, "<vaddr>",
+        kdb_register_flags("md", kdb_md, "<vaddr>",
          "Display Memory Contents, also mdWcN, e.g. md8c1", 1,
-                            KDB_REPEAT_NO_ARGS);
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("mdr", kdb_md, "<vaddr> <bytes>",
+        kdb_register_flags("mdr", kdb_md, "<vaddr> <bytes>",
-          "Display Raw Memory", 0, KDB_REPEAT_NO_ARGS);
+          "Display Raw Memory", 0,
-        kdb_register_repeat("mdp", kdb_md, "<paddr> <bytes>",
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
-          "Display Physical Memory", 0, KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("mdp", kdb_md, "<paddr> <bytes>",
-        kdb_register_repeat("mds", kdb_md, "<vaddr>",
+          "Display Physical Memory", 0,
-          "Display Memory Symbolically", 0, KDB_REPEAT_NO_ARGS);
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("mm", kdb_mm, "<vaddr> <contents>",
+        kdb_register_flags("mds", kdb_md, "<vaddr>",
-          "Modify Memory Contents", 0, KDB_REPEAT_NO_ARGS);
+          "Display Memory Symbolically", 0,
-        kdb_register_repeat("go", kdb_go, "[<vaddr>]",
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
-          "Continue Execution", 1, KDB_REPEAT_NONE);
+        kdb_register_flags("mm", kdb_mm, "<vaddr> <contents>",
-        kdb_register_repeat("rd", kdb_rd, "",
+          "Modify Memory Contents", 0,
-          "Display Registers", 0, KDB_REPEAT_NONE);
+          KDB_ENABLE_MEM_WRITE | KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("rm", kdb_rm, "<reg> <contents>",
+        kdb_register_flags("go", kdb_go, "[<vaddr>]",
-          "Modify Registers", 0, KDB_REPEAT_NONE);
+          "Continue Execution", 1,
-        kdb_register_repeat("ef", kdb_ef, "<vaddr>",
+          KDB_ENABLE_REG_WRITE | KDB_ENABLE_ALWAYS_SAFE_NO_ARGS);
-          "Display exception frame", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("rd", kdb_rd, "",
-        kdb_register_repeat("bt", kdb_bt, "[<vaddr>]",
+          "Display Registers", 0,
-          "Stack traceback", 1, KDB_REPEAT_NONE);
+          KDB_ENABLE_REG_READ);
-        kdb_register_repeat("btp", kdb_bt, "<pid>",
+        kdb_register_flags("rm", kdb_rm, "<reg> <contents>",
-          "Display stack for process <pid>", 0, KDB_REPEAT_NONE);
+          "Modify Registers", 0,
-        kdb_register_repeat("bta", kdb_bt, "[D|R|S|T|C|Z|E|U|I|M|A]",
+          KDB_ENABLE_REG_WRITE);
-          "Backtrace all processes matching state flag", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("ef", kdb_ef, "<vaddr>",
-        kdb_register_repeat("btc", kdb_bt, "",
+          "Display exception frame", 0,
-          "Backtrace current process on each cpu", 0, KDB_REPEAT_NONE);
+          KDB_ENABLE_MEM_READ);
-        kdb_register_repeat("btt", kdb_bt, "<vaddr>",
+        kdb_register_flags("bt", kdb_bt, "[<vaddr>]",
+          "Stack traceback", 1,
+          KDB_ENABLE_MEM_READ | KDB_ENABLE_INSPECT_NO_ARGS);
+        kdb_register_flags("btp", kdb_bt, "<pid>",
+          "Display stack for process <pid>", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("bta", kdb_bt, "[D|R|S|T|C|Z|E|U|I|M|A]",
+          "Backtrace all processes matching state flag", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("btc", kdb_bt, "",
+          "Backtrace current process on each cpu", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("btt", kdb_bt, "<vaddr>",
          "Backtrace process given its struct task address", 0,
-                            KDB_REPEAT_NONE);
+          KDB_ENABLE_MEM_READ | KDB_ENABLE_INSPECT_NO_ARGS);
-        kdb_register_repeat("env", kdb_env, "",
+        kdb_register_flags("env", kdb_env, "",
-          "Show environment variables", 0, KDB_REPEAT_NONE);
+          "Show environment variables", 0,
-        kdb_register_repeat("set", kdb_set, "",
+          KDB_ENABLE_ALWAYS_SAFE);
-          "Set environment variables", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("set", kdb_set, "",
-        kdb_register_repeat("help", kdb_help, "",
+          "Set environment variables", 0,
-          "Display Help Message", 1, KDB_REPEAT_NONE);
+          KDB_ENABLE_ALWAYS_SAFE);
-        kdb_register_repeat("?", kdb_help, "",
+        kdb_register_flags("help", kdb_help, "",
-          "Display Help Message", 0, KDB_REPEAT_NONE);
+          "Display Help Message", 1,
-        kdb_register_repeat("cpu", kdb_cpu, "<cpunum>",
+          KDB_ENABLE_ALWAYS_SAFE);
-          "Switch to new cpu", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("?", kdb_help, "",
-        kdb_register_repeat("kgdb", kdb_kgdb, "",
+          "Display Help Message", 0,
-          "Enter kgdb mode", 0, KDB_REPEAT_NONE);
+          KDB_ENABLE_ALWAYS_SAFE);
-        kdb_register_repeat("ps", kdb_ps, "[<flags>|A]",
+        kdb_register_flags("cpu", kdb_cpu, "<cpunum>",
-          "Display active task list", 0, KDB_REPEAT_NONE);
+          "Switch to new cpu", 0,
-        kdb_register_repeat("pid", kdb_pid, "<pidnum>",
+          KDB_ENABLE_ALWAYS_SAFE_NO_ARGS);
-          "Switch to another task", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("kgdb", kdb_kgdb, "",
-        kdb_register_repeat("reboot", kdb_reboot, "",
+          "Enter kgdb mode", 0, 0);
-          "Reboot the machine immediately", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("ps", kdb_ps, "[<flags>|A]",
+          "Display active task list", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("pid", kdb_pid, "<pidnum>",
+          "Switch to another task", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("reboot", kdb_reboot, "",
+          "Reboot the machine immediately", 0,
+          KDB_ENABLE_REBOOT);
 #if defined(CONFIG_MODULES)
-        kdb_register_repeat("lsmod", kdb_lsmod, "",
+        kdb_register_flags("lsmod", kdb_lsmod, "",
-          "List loaded kernel modules", 0, KDB_REPEAT_NONE);
+          "List loaded kernel modules", 0,
+          KDB_ENABLE_INSPECT);
 #endif
 #if defined(CONFIG_MAGIC_SYSRQ)
-        kdb_register_repeat("sr", kdb_sr, "<key>",
+        kdb_register_flags("sr", kdb_sr, "<key>",
-          "Magic SysRq key", 0, KDB_REPEAT_NONE);
+          "Magic SysRq key", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
 #endif
 #if defined(CONFIG_PRINTK)
-        kdb_register_repeat("dmesg", kdb_dmesg, "[lines]",
+        kdb_register_flags("dmesg", kdb_dmesg, "[lines]",
-          "Display syslog buffer", 0, KDB_REPEAT_NONE);
+          "Display syslog buffer", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
 #endif
        if (arch_kgdb_ops.enable_nmi) {
-                kdb_register_repeat("disable_nmi", kdb_disable_nmi, "",
+                kdb_register_flags("disable_nmi", kdb_disable_nmi, "",
-                  "Disable NMI entry to KDB", 0, KDB_REPEAT_NONE);
+                  "Disable NMI entry to KDB", 0,
-        }
+                  KDB_ENABLE_ALWAYS_SAFE);
-        kdb_register_repeat("defcmd", kdb_defcmd, "name \"usage\" \"help\"",
+        }
-          "Define a set of commands, down to endefcmd", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("defcmd", kdb_defcmd, "name \"usage\" \"help\"",
-        kdb_register_repeat("kill", kdb_kill, "<-signal> <pid>",
+          "Define a set of commands, down to endefcmd", 0,
-          "Send a signal to a process", 0, KDB_REPEAT_NONE);
+          KDB_ENABLE_ALWAYS_SAFE);
-        kdb_register_repeat("summary", kdb_summary, "",
+        kdb_register_flags("kill", kdb_kill, "<-signal> <pid>",
-          "Summarize the system", 4, KDB_REPEAT_NONE);
+          "Send a signal to a process", 0,
-        kdb_register_repeat("per_cpu", kdb_per_cpu, "<sym> [<bytes>] [<cpu>]",
+          KDB_ENABLE_SIGNAL);
-          "Display per_cpu variables", 3, KDB_REPEAT_NONE);
+        kdb_register_flags("summary", kdb_summary, "",
-        kdb_register_repeat("grephelp", kdb_grep_help, "",
+          "Summarize the system", 4,
-          "Display help on | grep", 0, KDB_REPEAT_NONE);
+          KDB_ENABLE_ALWAYS_SAFE);
+        kdb_register_flags("per_cpu", kdb_per_cpu, "<sym> [<bytes>] [<cpu>]",
+          "Display per_cpu variables", 3,
+          KDB_ENABLE_MEM_READ);
+        kdb_register_flags("grephelp", kdb_grep_help, "",
+          "Display help on | grep", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
 }
 /* Execute any commands defined in kdb_cmds.  */
diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
index 7afd3c8c41d5..eaacd1693954 100644
--- a/kernel/debug/kdb/kdb_private.h
+++ b/kernel/debug/kdb/kdb_private.h
@@ -172,10 +172,9 @@ typedef struct _kdbtab {
        kdb_func_t cmd_func;            /* Function to execute command */
        char    *cmd_usage;             /* Usage String for this command */
        char    *cmd_help;              /* Help message for this command */
-        short    cmd_flags;             /* Parsing flags */
        short    cmd_minlen;            /* Minimum legal # command
                                         * chars required */
-        kdb_repeat_t cmd_repeat;        /* Does command auto repeat on enter? */
+        kdb_cmdflags_t cmd_flags;       /* Command behaviour flags */
 } kdbtab_t;
 extern int kdb_bt(int, const char **);  /* KDB display back trace */
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 4c1ee7f2bebc..7f2fbb8b5069 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -872,22 +872,32 @@ void perf_pmu_enable(struct pmu *pmu)
                pmu->pmu_enable(pmu);
 }
-static DEFINE_PER_CPU(struct list_head, rotation_list);
+static DEFINE_PER_CPU(struct list_head, active_ctx_list);
 /*
- * perf_pmu_rotate_start() and perf_rotate_context() are fully serialized
+ * perf_event_ctx_activate(), perf_event_ctx_deactivate(), and
- * because they're strictly cpu affine and rotate_start is called with IRQs
+ * perf_event_task_tick() are fully serialized because they're strictly cpu
- * disabled, while rotate_context is called from IRQ context.
+ * affine and perf_event_ctx{activate,deactivate} are called with IRQs
+ * disabled, while perf_event_task_tick is called from IRQ context.
 */
-static void perf_pmu_rotate_start(struct pmu *pmu)
+static void perf_event_ctx_activate(struct perf_event_context *ctx)
 {
-        struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
+        struct list_head *head = this_cpu_ptr(&active_ctx_list);
-        struct list_head *head = this_cpu_ptr(&rotation_list);
        WARN_ON(!irqs_disabled());
-        if (list_empty(&cpuctx->rotation_list))
+        WARN_ON(!list_empty(&ctx->active_ctx_list));
-                list_add(&cpuctx->rotation_list, head);
+        list_add(&ctx->active_ctx_list, head);
+}
+static void perf_event_ctx_deactivate(struct perf_event_context *ctx)
+{
+        WARN_ON(!irqs_disabled());
+        WARN_ON(list_empty(&ctx->active_ctx_list));
+        list_del_init(&ctx->active_ctx_list);
 }
 static void get_ctx(struct perf_event_context *ctx)
@@ -907,6 +917,84 @@ static void put_ctx(struct perf_event_context *ctx)
 }
 /*
+ * Because of perf_event::ctx migration in sys_perf_event_open::move_group and
+ * perf_pmu_migrate_context() we need some magic.
+ *
+ * Those places that change perf_event::ctx will hold both
+ * perf_event_ctx::mutex of the 'old' and 'new' ctx value.
+ *
+ * Lock ordering is by mutex address. There is one other site where
+ * perf_event_context::mutex nests and that is put_event(). But remember that
+ * that is a parent<->child context relation, and migration does not affect
+ * children, therefore these two orderings should not interact.
+ *
+ * The change in perf_event::ctx does not affect children (as claimed above)
+ * because the sys_perf_event_open() case will install a new event and break
+ * the ctx parent<->child relation, and perf_pmu_migrate_context() is only
+ * concerned with cpuctx and that doesn't have children.
+ *
+ * The places that change perf_event::ctx will issue:
+ *
+ *   perf_remove_from_context();
+ *   synchronize_rcu();
+ *   perf_install_in_context();
+ *
+ * to affect the change. The remove_from_context() + synchronize_rcu() should
+ * quiesce the event, after which we can install it in the new location. This
+ * means that only external vectors (perf_fops, prctl) can perturb the event
+ * while in transit. Therefore all such accessors should also acquire
+ * perf_event_context::mutex to serialize against this.
+ *
+ * However; because event->ctx can change while we're waiting to acquire
+ * ctx->mutex we must be careful and use the below perf_event_ctx_lock()
+ * function.
+ *
+ * Lock order:
+ *      task_struct::perf_event_mutex
+ *        perf_event_context::mutex
+ *          perf_event_context::lock
+ *          perf_event::child_mutex;
+ *          perf_event::mmap_mutex
+ *          mmap_sem
+ */
+static struct perf_event_context *
+perf_event_ctx_lock_nested(struct perf_event *event, int nesting)
+{
+        struct perf_event_context *ctx;
+again:
+        rcu_read_lock();
+        ctx = ACCESS_ONCE(event->ctx);
+        if (!atomic_inc_not_zero(&ctx->refcount)) {
+                rcu_read_unlock();
+                goto again;
+        }
+        rcu_read_unlock();
+        mutex_lock_nested(&ctx->mutex, nesting);
+        if (event->ctx != ctx) {
+                mutex_unlock(&ctx->mutex);
+                put_ctx(ctx);
+                goto again;
+        }
+        return ctx;
+}
+static inline struct perf_event_context *
+perf_event_ctx_lock(struct perf_event *event)
+{
+        return perf_event_ctx_lock_nested(event, 0);
+}
+static void perf_event_ctx_unlock(struct perf_event *event,
+                                  struct perf_event_context *ctx)
+{
+        mutex_unlock(&ctx->mutex);
+        put_ctx(ctx);
+}
+/*
 * This must be done under the ctx->lock, such as to serialize against
 * context_equiv(), therefore we cannot call put_ctx() since that might end up
 * calling scheduler related locks and ctx->lock nests inside those.
@@ -1155,8 +1243,6 @@ list_add_event(struct perf_event *event, struct perf_event_context *ctx)
                ctx->nr_branch_stack++;
        list_add_rcu(&event->event_entry, &ctx->event_list);
-        if (!ctx->nr_events)
-                perf_pmu_rotate_start(ctx->pmu);
        ctx->nr_events++;
        if (event->attr.inherit_stat)
                ctx->nr_stat++;
@@ -1275,6 +1361,8 @@ static void perf_group_attach(struct perf_event *event)
        if (group_leader == event)
                return;
+        WARN_ON_ONCE(group_leader->ctx != event->ctx);
        if (group_leader->group_flags & PERF_GROUP_SOFTWARE &&
                        !is_software_event(event))
                group_leader->group_flags &= ~PERF_GROUP_SOFTWARE;
@@ -1296,6 +1384,10 @@ static void
 list_del_event(struct perf_event *event, struct perf_event_context *ctx)
 {
        struct perf_cpu_context *cpuctx;
+        WARN_ON_ONCE(event->ctx != ctx);
+        lockdep_assert_held(&ctx->lock);
        /*
         * We can have double detach due to exit/hot-unplug + close.
         */
@@ -1380,6 +1472,8 @@ static void perf_group_detach(struct perf_event *event)
                /* Inherit group flags from the previous leader */
                sibling->group_flags = event->group_flags;
+                WARN_ON_ONCE(sibling->ctx != event->ctx);
        }
 out:
@@ -1442,6 +1536,10 @@ event_sched_out(struct perf_event *event,
 {
        u64 tstamp = perf_event_time(event);
        u64 delta;
+        WARN_ON_ONCE(event->ctx != ctx);
+        lockdep_assert_held(&ctx->lock);
        /*
         * An event which could not be activated because of
         * filter mismatch still needs to have its timings
@@ -1471,7 +1569,8 @@ event_sched_out(struct perf_event *event,
        if (!is_software_event(event))
                cpuctx->active_oncpu--;
-        ctx->nr_active--;
+        if (!--ctx->nr_active)
+                perf_event_ctx_deactivate(ctx);
        if (event->attr.freq && event->attr.sample_freq)
                ctx->nr_freq--;
        if (event->attr.exclusive || !cpuctx->active_oncpu)
@@ -1654,7 +1753,7 @@ int __perf_event_disable(void *info)
 * is the current context on this CPU and preemption is disabled,
 * hence we can't get into perf_event_task_sched_out for this context.
 */
-void perf_event_disable(struct perf_event *event)
+static void _perf_event_disable(struct perf_event *event)
 {
        struct perf_event_context *ctx = event->ctx;
        struct task_struct *task = ctx->task;
@@ -1695,6 +1794,19 @@ retry:
        }
        raw_spin_unlock_irq(&ctx->lock);
 }
+/*
+ * Strictly speaking kernel users cannot create groups and therefore this
+ * interface does not need the perf_event_ctx_lock() magic.
+ */
+void perf_event_disable(struct perf_event *event)
+{
+        struct perf_event_context *ctx;
+        ctx = perf_event_ctx_lock(event);
+        _perf_event_disable(event);
+        perf_event_ctx_unlock(event, ctx);
+}
 EXPORT_SYMBOL_GPL(perf_event_disable);
 static void perf_set_shadow_time(struct perf_event *event,
@@ -1782,7 +1894,8 @@ event_sched_in(struct perf_event *event,
        if (!is_software_event(event))
                cpuctx->active_oncpu++;
-        ctx->nr_active++;
+        if (!ctx->nr_active++)
+                perf_event_ctx_activate(ctx);
        if (event->attr.freq && event->attr.sample_freq)
                ctx->nr_freq++;
@@ -2158,7 +2271,7 @@ unlock:
 * perf_event_for_each_child or perf_event_for_each as described
 * for perf_event_disable.
 */
-void perf_event_enable(struct perf_event *event)
+static void _perf_event_enable(struct perf_event *event)
 {
        struct perf_event_context *ctx = event->ctx;
        struct task_struct *task = ctx->task;
@@ -2214,9 +2327,21 @@ retry:
 out:
        raw_spin_unlock_irq(&ctx->lock);
 }
+/*
+ * See perf_event_disable();
+ */
+void perf_event_enable(struct perf_event *event)
+{
+        struct perf_event_context *ctx;
+        ctx = perf_event_ctx_lock(event);
+        _perf_event_enable(event);
+        perf_event_ctx_unlock(event, ctx);
+}
 EXPORT_SYMBOL_GPL(perf_event_enable);
-int perf_event_refresh(struct perf_event *event, int refresh)
+static int _perf_event_refresh(struct perf_event *event, int refresh)
 {
        /*
         * not supported on inherited events
@@ -2225,10 +2350,25 @@ int perf_event_refresh(struct perf_event *event, int refresh)
                return -EINVAL;
        atomic_add(refresh, &event->event_limit);
-        perf_event_enable(event);
+        _perf_event_enable(event);
        return 0;
 }
+/*
+ * See perf_event_disable()
+ */
+int perf_event_refresh(struct perf_event *event, int refresh)
+{
+        struct perf_event_context *ctx;
+        int ret;
+        ctx = perf_event_ctx_lock(event);
+        ret = _perf_event_refresh(event, refresh);
+        perf_event_ctx_unlock(event, ctx);
+        return ret;
+}
 EXPORT_SYMBOL_GPL(perf_event_refresh);
 static void ctx_sched_out(struct perf_event_context *ctx,
@@ -2612,12 +2752,6 @@ static void perf_event_context_sched_in(struct perf_event_context *ctx,
        perf_pmu_enable(ctx->pmu);
        perf_ctx_unlock(cpuctx, ctx);
-        /*
-         * Since these rotations are per-cpu, we need to ensure the
-         * cpu-context we got scheduled on is actually rotating.
-         */
-        perf_pmu_rotate_start(ctx->pmu);
 }
 /*
@@ -2905,25 +3039,18 @@ static void rotate_ctx(struct perf_event_context *ctx)
                list_rotate_left(&ctx->flexible_groups);
 }
-/*
- * perf_pmu_rotate_start() and perf_rotate_context() are fully serialized
- * because they're strictly cpu affine and rotate_start is called with IRQs
- * disabled, while rotate_context is called from IRQ context.
- */
 static int perf_rotate_context(struct perf_cpu_context *cpuctx)
 {
        struct perf_event_context *ctx = NULL;
-        int rotate = 0, remove = 1;
+        int rotate = 0;
        if (cpuctx->ctx.nr_events) {
-                remove = 0;
                if (cpuctx->ctx.nr_events != cpuctx->ctx.nr_active)
                        rotate = 1;
        }
        ctx = cpuctx->task_ctx;
        if (ctx && ctx->nr_events) {
-                remove = 0;
                if (ctx->nr_events != ctx->nr_active)
                        rotate = 1;
        }
@@ -2947,8 +3074,6 @@ static int perf_rotate_context(struct perf_cpu_context *cpuctx)
        perf_pmu_enable(cpuctx->ctx.pmu);
        perf_ctx_unlock(cpuctx, cpuctx->task_ctx);
 done:
-        if (remove)
-                list_del_init(&cpuctx->rotation_list);
        return rotate;
 }
@@ -2966,9 +3091,8 @@ bool perf_event_can_stop_tick(void)
 void perf_event_task_tick(void)
 {
-        struct list_head *head = this_cpu_ptr(&rotation_list);
+        struct list_head *head = this_cpu_ptr(&active_ctx_list);
-        struct perf_cpu_context *cpuctx, *tmp;
+        struct perf_event_context *ctx, *tmp;
-        struct perf_event_context *ctx;
        int throttled;
        WARN_ON(!irqs_disabled());
@@ -2976,14 +3100,8 @@ void perf_event_task_tick(void)
        __this_cpu_inc(perf_throttled_seq);
        throttled = __this_cpu_xchg(perf_throttled_count, 0);
-        list_for_each_entry_safe(cpuctx, tmp, head, rotation_list) {
+        list_for_each_entry_safe(ctx, tmp, head, active_ctx_list)
-                ctx = &cpuctx->ctx;
                perf_adjust_freq_unthr_context(ctx, throttled);
-                ctx = cpuctx->task_ctx;
-                if (ctx)
-                        perf_adjust_freq_unthr_context(ctx, throttled);
-        }
 }
 static int event_enable_on_exec(struct perf_event *event,
@@ -3142,6 +3260,7 @@ static void __perf_event_init_context(struct perf_event_context *ctx)
 {
        raw_spin_lock_init(&ctx->lock);
        mutex_init(&ctx->mutex);
+        INIT_LIST_HEAD(&ctx->active_ctx_list);
        INIT_LIST_HEAD(&ctx->pinned_groups);
        INIT_LIST_HEAD(&ctx->flexible_groups);
        INIT_LIST_HEAD(&ctx->event_list);
@@ -3421,7 +3540,16 @@ static void perf_remove_from_owner(struct perf_event *event)
        rcu_read_unlock();
        if (owner) {
-                mutex_lock(&owner->perf_event_mutex);
+                /*
+                 * If we're here through perf_event_exit_task() we're already
+                 * holding ctx->mutex which would be an inversion wrt. the
+                 * normal lock order.
+                 *
+                 * However we can safely take this lock because its the child
+                 * ctx->mutex.
+                 */
+                mutex_lock_nested(&owner->perf_event_mutex, SINGLE_DEPTH_NESTING);
                /*
                 * We have to re-check the event->owner field, if it is cleared
                 * we raced with perf_event_exit_task(), acquiring the mutex
@@ -3440,7 +3568,7 @@ static void perf_remove_from_owner(struct perf_event *event)
 */
 static void put_event(struct perf_event *event)
 {
-        struct perf_event_context *ctx = event->ctx;
+        struct perf_event_context *ctx;
        if (!atomic_long_dec_and_test(&event->refcount))
                return;
@@ -3448,7 +3576,6 @@ static void put_event(struct perf_event *event)
        if (!is_kernel_event(event))
                perf_remove_from_owner(event);
-        WARN_ON_ONCE(ctx->parent_ctx);
        /*
         * There are two ways this annotation is useful:
         *
@@ -3461,7 +3588,8 @@ static void put_event(struct perf_event *event)
         *     the last filedesc died, so there is no possibility
         *     to trigger the AB-BA case.
         */
-        mutex_lock_nested(&ctx->mutex, SINGLE_DEPTH_NESTING);
+        ctx = perf_event_ctx_lock_nested(event, SINGLE_DEPTH_NESTING);
+        WARN_ON_ONCE(ctx->parent_ctx);
        perf_remove_from_context(event, true);
        mutex_unlock(&ctx->mutex);
@@ -3547,12 +3675,13 @@ static int perf_event_read_group(struct perf_event *event,
                                   u64 read_format, char __user *buf)
 {
        struct perf_event *leader = event->group_leader, *sub;
-        int n = 0, size = 0, ret = -EFAULT;
        struct perf_event_context *ctx = leader->ctx;
-        u64 values[5];
+        int n = 0, size = 0, ret;
        u64 count, enabled, running;
+        u64 values[5];
+        lockdep_assert_held(&ctx->mutex);
-        mutex_lock(&ctx->mutex);
        count = perf_event_read_value(leader, &enabled, &running);
        values[n++] = 1 + leader->nr_siblings;
@@ -3567,7 +3696,7 @@ static int perf_event_read_group(struct perf_event *event,
        size = n * sizeof(u64);
        if (copy_to_user(buf, values, size))
-                goto unlock;
+                return -EFAULT;
        ret = size;
@@ -3581,14 +3710,11 @@ static int perf_event_read_group(struct perf_event *event,
                size = n * sizeof(u64);
                if (copy_to_user(buf + ret, values, size)) {
-                        ret = -EFAULT;
+                        return -EFAULT;
-                        goto unlock;
                }
                ret += size;
        }
-unlock:
-        mutex_unlock(&ctx->mutex);
        return ret;
 }
@@ -3660,8 +3786,14 @@ static ssize_t
 perf_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
        struct perf_event *event = file->private_data;
+        struct perf_event_context *ctx;
+        int ret;
-        return perf_read_hw(event, buf, count);
+        ctx = perf_event_ctx_lock(event);
+        ret = perf_read_hw(event, buf, count);
+        perf_event_ctx_unlock(event, ctx);
+        return ret;
 }
 static unsigned int perf_poll(struct file *file, poll_table *wait)
@@ -3687,7 +3819,7 @@ static unsigned int perf_poll(struct file *file, poll_table *wait)
        return events;
 }
-static void perf_event_reset(struct perf_event *event)
+static void _perf_event_reset(struct perf_event *event)
 {
        (void)perf_event_read(event);
        local64_set(&event->count, 0);
@@ -3706,6 +3838,7 @@ static void perf_event_for_each_child(struct perf_event *event,
        struct perf_event *child;
        WARN_ON_ONCE(event->ctx->parent_ctx);
        mutex_lock(&event->child_mutex);
        func(event);
        list_for_each_entry(child, &event->child_list, child_list)
@@ -3719,14 +3852,13 @@ static void perf_event_for_each(struct perf_event *event,
        struct perf_event_context *ctx = event->ctx;
        struct perf_event *sibling;
-        WARN_ON_ONCE(ctx->parent_ctx);
+        lockdep_assert_held(&ctx->mutex);
-        mutex_lock(&ctx->mutex);
        event = event->group_leader;
        perf_event_for_each_child(event, func);
        list_for_each_entry(sibling, &event->sibling_list, group_entry)
                perf_event_for_each_child(sibling, func);
-        mutex_unlock(&ctx->mutex);
 }
 static int perf_event_period(struct perf_event *event, u64 __user *arg)
@@ -3796,25 +3928,24 @@ static int perf_event_set_output(struct perf_event *event,
                                 struct perf_event *output_event);
 static int perf_event_set_filter(struct perf_event *event, void __user *arg);
-static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+static long _perf_ioctl(struct perf_event *event, unsigned int cmd, unsigned long arg)
 {
-        struct perf_event *event = file->private_data;
        void (*func)(struct perf_event *);
        u32 flags = arg;
        switch (cmd) {
        case PERF_EVENT_IOC_ENABLE:
-                func = perf_event_enable;
+                func = _perf_event_enable;
                break;
        case PERF_EVENT_IOC_DISABLE:
-                func = perf_event_disable;
+                func = _perf_event_disable;
                break;
        case PERF_EVENT_IOC_RESET:
-                func = perf_event_reset;
+                func = _perf_event_reset;
                break;
        case PERF_EVENT_IOC_REFRESH:
-                return perf_event_refresh(event, arg);
+                return _perf_event_refresh(event, arg);
        case PERF_EVENT_IOC_PERIOD:
                return perf_event_period(event, (u64 __user *)arg);
@@ -3861,6 +3992,19 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        return 0;
 }
+static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        struct perf_event *event = file->private_data;
+        struct perf_event_context *ctx;
+        long ret;
+        ctx = perf_event_ctx_lock(event);
+        ret = _perf_ioctl(event, cmd, arg);
+        perf_event_ctx_unlock(event, ctx);
+        return ret;
+}
 #ifdef CONFIG_COMPAT
 static long perf_compat_ioctl(struct file *file, unsigned int cmd,
                                unsigned long arg)
@@ -3883,11 +4027,15 @@ static long perf_compat_ioctl(struct file *file, unsigned int cmd,
 int perf_event_task_enable(void)
 {
+        struct perf_event_context *ctx;
        struct perf_event *event;
        mutex_lock(&current->perf_event_mutex);
-        list_for_each_entry(event, &current->perf_event_list, owner_entry)
+        list_for_each_entry(event, &current->perf_event_list, owner_entry) {
-                perf_event_for_each_child(event, perf_event_enable);
+                ctx = perf_event_ctx_lock(event);
+                perf_event_for_each_child(event, _perf_event_enable);
+                perf_event_ctx_unlock(event, ctx);
+        }
        mutex_unlock(&current->perf_event_mutex);
        return 0;
@@ -3895,11 +4043,15 @@ int perf_event_task_enable(void)
 int perf_event_task_disable(void)
 {
+        struct perf_event_context *ctx;
        struct perf_event *event;
        mutex_lock(&current->perf_event_mutex);
-        list_for_each_entry(event, &current->perf_event_list, owner_entry)
+        list_for_each_entry(event, &current->perf_event_list, owner_entry) {
-                perf_event_for_each_child(event, perf_event_disable);
+                ctx = perf_event_ctx_lock(event);
+                perf_event_for_each_child(event, _perf_event_disable);
+                perf_event_ctx_unlock(event, ctx);
+        }
        mutex_unlock(&current->perf_event_mutex);
        return 0;
@@ -4461,18 +4613,14 @@ perf_output_sample_regs(struct perf_output_handle *handle,
 }
 static void perf_sample_regs_user(struct perf_regs *regs_user,
-                                  struct pt_regs *regs)
+                                  struct pt_regs *regs,
+                                  struct pt_regs *regs_user_copy)
 {
-        if (!user_mode(regs)) {
+        if (user_mode(regs)) {
-                if (current->mm)
+                regs_user->abi = perf_reg_abi(current);
-                        regs = task_pt_regs(current);
-                else
-                        regs = NULL;
-        }
-        if (regs) {
-                regs_user->abi  = perf_reg_abi(current);
                regs_user->regs = regs;
+        } else if (current->mm) {
+                perf_get_regs_user(regs_user, regs, regs_user_copy);
        } else {
                regs_user->abi = PERF_SAMPLE_REGS_ABI_NONE;
                regs_user->regs = NULL;
@@ -4951,7 +5099,8 @@ void perf_prepare_sample(struct perf_event_header *header,
        }
        if (sample_type & (PERF_SAMPLE_REGS_USER | PERF_SAMPLE_STACK_USER))
-                perf_sample_regs_user(&data->regs_user, regs);
+                perf_sample_regs_user(&data->regs_user, regs,
+                                      &data->regs_user_copy);
        if (sample_type & PERF_SAMPLE_REGS_USER) {
                /* regs dump ABI info */
@@ -5892,6 +6041,8 @@ end:
        rcu_read_unlock();
 }
+DEFINE_PER_CPU(struct pt_regs, __perf_regs[4]);
 int perf_swevent_get_recursion_context(void)
 {
        struct swevent_htable *swhash = this_cpu_ptr(&swevent_htable);
@@ -5907,21 +6058,30 @@ inline void perf_swevent_put_recursion_context(int rctx)
        put_recursion_context(swhash->recursion, rctx);
 }
-void __perf_sw_event(u32 event_id, u64 nr, struct pt_regs *regs, u64 addr)
+void ___perf_sw_event(u32 event_id, u64 nr, struct pt_regs *regs, u64 addr)
 {
        struct perf_sample_data data;
-        int rctx;
-        preempt_disable_notrace();
+        if (WARN_ON_ONCE(!regs))
-        rctx = perf_swevent_get_recursion_context();
-        if (rctx < 0)
                return;
        perf_sample_data_init(&data, addr, 0);
        do_perf_sw_event(PERF_TYPE_SOFTWARE, event_id, nr, &data, regs);
+}
+void __perf_sw_event(u32 event_id, u64 nr, struct pt_regs *regs, u64 addr)
+{
+        int rctx;
+        preempt_disable_notrace();
+        rctx = perf_swevent_get_recursion_context();
+        if (unlikely(rctx < 0))
+                goto fail;
+        ___perf_sw_event(event_id, nr, regs, addr);
        perf_swevent_put_recursion_context(rctx);
+fail:
        preempt_enable_notrace();
 }
@@ -6779,12 +6939,10 @@ skip_type:
                __perf_event_init_context(&cpuctx->ctx);
                lockdep_set_class(&cpuctx->ctx.mutex, &cpuctx_mutex);
                lockdep_set_class(&cpuctx->ctx.lock, &cpuctx_lock);
-                cpuctx->ctx.type = cpu_context;
                cpuctx->ctx.pmu = pmu;
                __perf_cpu_hrtimer_init(cpuctx, cpu);
-                INIT_LIST_HEAD(&cpuctx->rotation_list);
                cpuctx->unique_pmu = pmu;
        }
@@ -6857,6 +7015,20 @@ void perf_pmu_unregister(struct pmu *pmu)
 }
 EXPORT_SYMBOL_GPL(perf_pmu_unregister);
+static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)
+{
+        int ret;
+        if (!try_module_get(pmu->module))
+                return -ENODEV;
+        event->pmu = pmu;
+        ret = pmu->event_init(event);
+        if (ret)
+                module_put(pmu->module);
+        return ret;
+}
 struct pmu *perf_init_event(struct perf_event *event)
 {
        struct pmu *pmu = NULL;
@@ -6869,24 +7041,14 @@ struct pmu *perf_init_event(struct perf_event *event)
        pmu = idr_find(&pmu_idr, event->attr.type);
        rcu_read_unlock();
        if (pmu) {
-                if (!try_module_get(pmu->module)) {
+                ret = perf_try_init_event(pmu, event);
-                        pmu = ERR_PTR(-ENODEV);
-                        goto unlock;
-                }
-                event->pmu = pmu;
-                ret = pmu->event_init(event);
                if (ret)
                        pmu = ERR_PTR(ret);
                goto unlock;
        }
        list_for_each_entry_rcu(pmu, &pmus, entry) {
-                if (!try_module_get(pmu->module)) {
+                ret = perf_try_init_event(pmu, event);
-                        pmu = ERR_PTR(-ENODEV);
-                        goto unlock;
-                }
-                event->pmu = pmu;
-                ret = pmu->event_init(event);
                if (!ret)
                        goto unlock;
@@ -7250,6 +7412,15 @@ out:
        return ret;
 }
+static void mutex_lock_double(struct mutex *a, struct mutex *b)
+{
+        if (b < a)
+                swap(a, b);
+        mutex_lock(a);
+        mutex_lock_nested(b, SINGLE_DEPTH_NESTING);
+}
 /**
 * sys_perf_event_open - open a performance event, associate it to a task/cpu
 *
@@ -7265,7 +7436,7 @@ SYSCALL_DEFINE5(perf_event_open,
        struct perf_event *group_leader = NULL, *output_event = NULL;
        struct perf_event *event, *sibling;
        struct perf_event_attr attr;
-        struct perf_event_context *ctx;
+        struct perf_event_context *ctx, *uninitialized_var(gctx);
        struct file *event_file = NULL;
        struct fd group = {NULL, 0};
        struct task_struct *task = NULL;
@@ -7423,7 +7594,19 @@ SYSCALL_DEFINE5(perf_event_open,
                 * task or CPU context:
                 */
                if (move_group) {
-                        if (group_leader->ctx->type != ctx->type)
+                        /*
+                         * Make sure we're both on the same task, or both
+                         * per-cpu events.
+                         */
+                        if (group_leader->ctx->task != ctx->task)
+                                goto err_context;
+                        /*
+                         * Make sure we're both events for the same CPU;
+                         * grouping events for different CPUs is broken; since
+                         * you can never concurrently schedule them anyhow.
+                         */
+                        if (group_leader->cpu != event->cpu)
                                goto err_context;
                } else {
                        if (group_leader->ctx != ctx)
@@ -7451,43 +7634,68 @@ SYSCALL_DEFINE5(perf_event_open,
        }
        if (move_group) {
-                struct perf_event_context *gctx = group_leader->ctx;
+                gctx = group_leader->ctx;
-                mutex_lock(&gctx->mutex);
-                perf_remove_from_context(group_leader, false);
                /*
-                 * Removing from the context ends up with disabled
+                 * See perf_event_ctx_lock() for comments on the details
-                 * event. What we want here is event in the initial
+                 * of swizzling perf_event::ctx.
-                 * startup state, ready to be add into new context.
                 */
-                perf_event__state_init(group_leader);
+                mutex_lock_double(&gctx->mutex, &ctx->mutex);
+                perf_remove_from_context(group_leader, false);
                list_for_each_entry(sibling, &group_leader->sibling_list,
                                    group_entry) {
                        perf_remove_from_context(sibling, false);
-                        perf_event__state_init(sibling);
                        put_ctx(gctx);
                }
-                mutex_unlock(&gctx->mutex);
+        } else {
-                put_ctx(gctx);
+                mutex_lock(&ctx->mutex);
        }
        WARN_ON_ONCE(ctx->parent_ctx);
-        mutex_lock(&ctx->mutex);
        if (move_group) {
+                /*
+                 * Wait for everybody to stop referencing the events through
+                 * the old lists, before installing it on new lists.
+                 */
                synchronize_rcu();
-                perf_install_in_context(ctx, group_leader, group_leader->cpu);
-                get_ctx(ctx);
+                /*
+                 * Install the group siblings before the group leader.
+                 *
+                 * Because a group leader will try and install the entire group
+                 * (through the sibling list, which is still in-tact), we can
+                 * end up with siblings installed in the wrong context.
+                 *
+                 * By installing siblings first we NO-OP because they're not
+                 * reachable through the group lists.
+                 */
                list_for_each_entry(sibling, &group_leader->sibling_list,
                                    group_entry) {
+                        perf_event__state_init(sibling);
                        perf_install_in_context(ctx, sibling, sibling->cpu);
                        get_ctx(ctx);
                }
+                /*
+                 * Removing from the context ends up with disabled
+                 * event. What we want here is event in the initial
+                 * startup state, ready to be add into new context.
+                 */
+                perf_event__state_init(group_leader);
+                perf_install_in_context(ctx, group_leader, group_leader->cpu);
+                get_ctx(ctx);
        }
        perf_install_in_context(ctx, event, event->cpu);
        perf_unpin_context(ctx);
+        if (move_group) {
+                mutex_unlock(&gctx->mutex);
+                put_ctx(gctx);
+        }
        mutex_unlock(&ctx->mutex);
        put_online_cpus();
@@ -7595,7 +7803,11 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu)
        src_ctx = &per_cpu_ptr(pmu->pmu_cpu_context, src_cpu)->ctx;
        dst_ctx = &per_cpu_ptr(pmu->pmu_cpu_context, dst_cpu)->ctx;
-        mutex_lock(&src_ctx->mutex);
+        /*
+         * See perf_event_ctx_lock() for comments on the details
+         * of swizzling perf_event::ctx.
+         */
+        mutex_lock_double(&src_ctx->mutex, &dst_ctx->mutex);
        list_for_each_entry_safe(event, tmp, &src_ctx->event_list,
                                 event_entry) {
                perf_remove_from_context(event, false);
@@ -7603,11 +7815,36 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu)
                put_ctx(src_ctx);
                list_add(&event->migrate_entry, &events);
        }
-        mutex_unlock(&src_ctx->mutex);
+        /*
+         * Wait for the events to quiesce before re-instating them.
+         */
        synchronize_rcu();
-        mutex_lock(&dst_ctx->mutex);
+        /*
+         * Re-instate events in 2 passes.
+         *
+         * Skip over group leaders and only install siblings on this first
+         * pass, siblings will not get enabled without a leader, however a
+         * leader will enable its siblings, even if those are still on the old
+         * context.
+         */
+        list_for_each_entry_safe(event, tmp, &events, migrate_entry) {
+                if (event->group_leader == event)
+                        continue;
+                list_del(&event->migrate_entry);
+                if (event->state >= PERF_EVENT_STATE_OFF)
+                        event->state = PERF_EVENT_STATE_INACTIVE;
+                account_event_cpu(event, dst_cpu);
+                perf_install_in_context(dst_ctx, event, dst_cpu);
+                get_ctx(dst_ctx);
+        }
+        /*
+         * Once all the siblings are setup properly, install the group leaders
+         * to make it go.
+         */
        list_for_each_entry_safe(event, tmp, &events, migrate_entry) {
                list_del(&event->migrate_entry);
                if (event->state >= PERF_EVENT_STATE_OFF)
@@ -7617,6 +7854,7 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu)
                get_ctx(dst_ctx);
        }
        mutex_unlock(&dst_ctx->mutex);
+        mutex_unlock(&src_ctx->mutex);
 }
 EXPORT_SYMBOL_GPL(perf_pmu_migrate_context);
@@ -7803,14 +8041,19 @@ static void perf_free_event(struct perf_event *event,
        put_event(parent);
+        raw_spin_lock_irq(&ctx->lock);
        perf_group_detach(event);
        list_del_event(event, ctx);
+        raw_spin_unlock_irq(&ctx->lock);
        free_event(event);
 }
 /*
- * free an unexposed, unused context as created by inheritance by
+ * Free an unexposed, unused context as created by inheritance by
 * perf_event_init_task below, used by fork() in case of fail.
+ *
+ * Not all locks are strictly required, but take them anyway to be nice and
+ * help out with the lockdep assertions.
 */
 void perf_event_free_task(struct task_struct *task)
 {
@@ -8129,7 +8372,7 @@ static void __init perf_event_init_all_cpus(void)
        for_each_possible_cpu(cpu) {
                swhash = &per_cpu(swevent_htable, cpu);
                mutex_init(&swhash->hlist_mutex);
-                INIT_LIST_HEAD(&per_cpu(rotation_list, cpu));
+                INIT_LIST_HEAD(&per_cpu(active_ctx_list, cpu));
        }
 }
@@ -8150,22 +8393,11 @@ static void perf_event_init_cpu(int cpu)
 }
 #if defined CONFIG_HOTPLUG_CPU || defined CONFIG_KEXEC
-static void perf_pmu_rotate_stop(struct pmu *pmu)
-{
-        struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
-        WARN_ON(!irqs_disabled());
-        list_del_init(&cpuctx->rotation_list);
-}
 static void __perf_event_exit_context(void *__info)
 {
        struct remove_event re = { .detach_group = true };
        struct perf_event_context *ctx = __info;
-        perf_pmu_rotate_stop(ctx->pmu);
        rcu_read_lock();
        list_for_each_entry_rcu(re.event, &ctx->event_list, event_entry)
                __perf_remove_from_context(&re);
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 146a5792b1d2..eadb95ce7aac 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -13,12 +13,13 @@
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
 #include <linux/circ_buf.h>
+#include <linux/poll.h>
 #include "internal.h"
 static void perf_output_wakeup(struct perf_output_handle *handle)
 {
-        atomic_set(&handle->rb->poll, POLL_IN);
+        atomic_set(&handle->rb->poll, POLLIN);
        handle->event->pending_wakeup = 1;
        irq_work_queue(&handle->event->pending);
diff --git a/kernel/exit.c b/kernel/exit.c
index 1ea4369890a3..6806c55475ee 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1287,9 +1287,15 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
 static int wait_consider_task(struct wait_opts *wo, int ptrace,
                                struct task_struct *p)
 {
+        /*
+         * We can race with wait_task_zombie() from another thread.
+         * Ensure that EXIT_ZOMBIE -> EXIT_DEAD/EXIT_TRACE transition
+         * can't confuse the checks below.
+         */
+        int exit_state = ACCESS_ONCE(p->exit_state);
        int ret;
-        if (unlikely(p->exit_state == EXIT_DEAD))
+        if (unlikely(exit_state == EXIT_DEAD))
                return 0;
        ret = eligible_child(wo, p);
@@ -1310,7 +1316,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
                return 0;
        }
-        if (unlikely(p->exit_state == EXIT_TRACE)) {
+        if (unlikely(exit_state == EXIT_TRACE)) {
                /*
                 * ptrace == 0 means we are the natural parent. In this case
                 * we should clear notask_error, debugger will notify us.
@@ -1337,7 +1343,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
        }
        /* slay zombie? */
-        if (p->exit_state == EXIT_ZOMBIE) {
+        if (exit_state == EXIT_ZOMBIE) {
                /* we don't reap group leaders with subthreads */
                if (!delay_group_leader(p)) {
                        /*
diff --git a/kernel/futex.c b/kernel/futex.c
index 63678b573d61..4eeb63de7e54 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2258,7 +2258,7 @@ static long futex_wait_restart(struct restart_block *restart)
 * if there are waiters then it will block, it does PI, etc. (Due to
 * races the kernel might see a 0 value of the futex too.)
 */
-static int futex_lock_pi(u32 __user *uaddr, unsigned int flags, int detect,
+static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
                         ktime_t *time, int trylock)
 {
        struct hrtimer_sleeper timeout, *to = NULL;
@@ -2953,11 +2953,11 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
        case FUTEX_WAKE_OP:
                return futex_wake_op(uaddr, flags, uaddr2, val, val2, val3);
        case FUTEX_LOCK_PI:
-                return futex_lock_pi(uaddr, flags, val, timeout, 0);
+                return futex_lock_pi(uaddr, flags, timeout, 0);
        case FUTEX_UNLOCK_PI:
                return futex_unlock_pi(uaddr, flags);
        case FUTEX_TRYLOCK_PI:
-                return futex_lock_pi(uaddr, flags, 0, timeout, 1);
+                return futex_lock_pi(uaddr, flags, NULL, 1);
        case FUTEX_WAIT_REQUEUE_PI:
                val3 = FUTEX_BITSET_MATCH_ANY;
                return futex_wait_requeue_pi(uaddr, flags, val, timeout, val3,
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 06f58309fed2..ee619929cf90 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -127,7 +127,7 @@ static void *alloc_insn_page(void)
 static void free_insn_page(void *page)
 {
-        module_free(NULL, page);
+        module_memfree(page);
 }
 struct kprobe_insn_cache kprobe_insn_slots = {
diff --git a/kernel/locking/Makefile b/kernel/locking/Makefile
index 8541bfdfd232..4ca8eb151975 100644
--- a/kernel/locking/Makefile
+++ b/kernel/locking/Makefile
@@ -1,5 +1,5 @@
-obj-y += mutex.o semaphore.o rwsem.o mcs_spinlock.o
+obj-y += mutex.o semaphore.o rwsem.o
 ifdef CONFIG_FUNCTION_TRACER
 CFLAGS_REMOVE_lockdep.o = -pg
@@ -14,6 +14,7 @@ ifeq ($(CONFIG_PROC_FS),y)
 obj-$(CONFIG_LOCKDEP) += lockdep_proc.o
 endif
 obj-$(CONFIG_SMP) += spinlock.o
+obj-$(CONFIG_LOCK_SPIN_ON_OWNER) += osq_lock.o
 obj-$(CONFIG_SMP) += lglock.o
 obj-$(CONFIG_PROVE_LOCKING) += spinlock.o
 obj-$(CONFIG_RT_MUTEXES) += rtmutex.o
diff --git a/kernel/locking/mcs_spinlock.h b/kernel/locking/mcs_spinlock.h
index 4d60986fcbee..d1fe2ba5bac9 100644
--- a/kernel/locking/mcs_spinlock.h
+++ b/kernel/locking/mcs_spinlock.h
@@ -108,20 +108,4 @@ void mcs_spin_unlock(struct mcs_spinlock **lock, struct mcs_spinlock *node)
        arch_mcs_spin_unlock_contended(&next->locked);
 }
-/*
- * Cancellable version of the MCS lock above.
- *
- * Intended for adaptive spinning of sleeping locks:
- * mutex_lock()/rwsem_down_{read,write}() etc.
- */
-struct optimistic_spin_node {
-        struct optimistic_spin_node *next, *prev;
-        int locked; /* 1 if lock acquired */
-        int cpu; /* encoded CPU # value */
-};
-extern bool osq_lock(struct optimistic_spin_queue *lock);
-extern void osq_unlock(struct optimistic_spin_queue *lock);
 #endif /* __LINUX_MCS_SPINLOCK_H */
diff --git a/kernel/locking/mutex-debug.c b/kernel/locking/mutex-debug.c
index 5cf6731b98e9..3ef3736002d8 100644
--- a/kernel/locking/mutex-debug.c
+++ b/kernel/locking/mutex-debug.c
@@ -80,13 +80,13 @@ void debug_mutex_unlock(struct mutex *lock)
                        DEBUG_LOCKS_WARN_ON(lock->owner != current);
                DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
-                mutex_clear_owner(lock);
        }
        /*
         * __mutex_slowpath_needs_to_unlock() is explicitly 0 for debug
         * mutexes so that we can do it here after we've verified state.
         */
+        mutex_clear_owner(lock);
        atomic_set(&lock->count, 1);
 }
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index 454195194d4a..94674e5919cb 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -81,7 +81,7 @@ __visible void __sched __mutex_lock_slowpath(atomic_t *lock_count);
 * The mutex must later on be released by the same task that
 * acquired it. Recursive locking is not allowed. The task
 * may not exit without first unlocking the mutex. Also, kernel
- * memory where the mutex resides mutex must not be freed with
+ * memory where the mutex resides must not be freed with
 * the mutex still locked. The mutex must first be initialized
 * (or statically defined) before it can be locked. memset()-ing
 * the mutex to 0 is not allowed.
@@ -147,7 +147,7 @@ static __always_inline void ww_mutex_lock_acquired(struct ww_mutex *ww,
 }
 /*
- * after acquiring lock with fastpath or when we lost out in contested
+ * After acquiring lock with fastpath or when we lost out in contested
 * slowpath, set ctx and wake up any waiters so they can recheck.
 *
 * This function is never called when CONFIG_DEBUG_LOCK_ALLOC is set,
@@ -191,19 +191,32 @@ ww_mutex_set_context_fastpath(struct ww_mutex *lock,
        spin_unlock_mutex(&lock->base.wait_lock, flags);
 }
-#ifdef CONFIG_MUTEX_SPIN_ON_OWNER
 /*
- * In order to avoid a stampede of mutex spinners from acquiring the mutex
+ * After acquiring lock in the slowpath set ctx and wake up any
- * more or less simultaneously, the spinners need to acquire a MCS lock
+ * waiters so they can recheck.
- * first before spinning on the owner field.
 *
+ * Callers must hold the mutex wait_lock.
 */
+static __always_inline void
+ww_mutex_set_context_slowpath(struct ww_mutex *lock,
+                              struct ww_acquire_ctx *ctx)
+{
+        struct mutex_waiter *cur;
-/*
+        ww_mutex_lock_acquired(lock, ctx);
- * Mutex spinning code migrated from kernel/sched/core.c
+        lock->ctx = ctx;
- */
+        /*
+         * Give any possible sleeping processes the chance to wake up,
+         * so they can recheck if they have to back off.
+         */
+        list_for_each_entry(cur, &lock->base.wait_list, list) {
+                debug_mutex_wake_waiter(&lock->base, cur);
+                wake_up_process(cur->task);
+        }
+}
+#ifdef CONFIG_MUTEX_SPIN_ON_OWNER
 static inline bool owner_running(struct mutex *lock, struct task_struct *owner)
 {
        if (lock->owner != owner)
@@ -307,6 +320,11 @@ static bool mutex_optimistic_spin(struct mutex *lock,
        if (!mutex_can_spin_on_owner(lock))
                goto done;
+        /*
+         * In order to avoid a stampede of mutex spinners trying to
+         * acquire the mutex all at once, the spinners need to take a
+         * MCS (queued) lock first before spinning on the owner field.
+         */
        if (!osq_lock(&lock->osq))
                goto done;
@@ -469,7 +487,7 @@ void __sched ww_mutex_unlock(struct ww_mutex *lock)
 EXPORT_SYMBOL(ww_mutex_unlock);
 static inline int __sched
-__mutex_lock_check_stamp(struct mutex *lock, struct ww_acquire_ctx *ctx)
+__ww_mutex_lock_check_stamp(struct mutex *lock, struct ww_acquire_ctx *ctx)
 {
        struct ww_mutex *ww = container_of(lock, struct ww_mutex, base);
        struct ww_acquire_ctx *hold_ctx = ACCESS_ONCE(ww->ctx);
@@ -557,7 +575,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                }
                if (use_ww_ctx && ww_ctx->acquired > 0) {
-                        ret = __mutex_lock_check_stamp(lock, ww_ctx);
+                        ret = __ww_mutex_lock_check_stamp(lock, ww_ctx);
                        if (ret)
                                goto err;
                }
@@ -569,6 +587,8 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                schedule_preempt_disabled();
                spin_lock_mutex(&lock->wait_lock, flags);
        }
+        __set_task_state(task, TASK_RUNNING);
        mutex_remove_waiter(lock, &waiter, current_thread_info());
        /* set it to 0 if there are no waiters left: */
        if (likely(list_empty(&lock->wait_list)))
@@ -582,23 +602,7 @@ skip_wait:
        if (use_ww_ctx) {
                struct ww_mutex *ww = container_of(lock, struct ww_mutex, base);
-                struct mutex_waiter *cur;
+                ww_mutex_set_context_slowpath(ww, ww_ctx);
-                /*
-                 * This branch gets optimized out for the common case,
-                 * and is only important for ww_mutex_lock.
-                 */
-                ww_mutex_lock_acquired(ww, ww_ctx);
-                ww->ctx = ww_ctx;
-                /*
-                 * Give any possible sleeping processes the chance to wake up,
-                 * so they can recheck if they have to back off.
-                 */
-                list_for_each_entry(cur, &lock->wait_list, list) {
-                        debug_mutex_wake_waiter(lock, cur);
-                        wake_up_process(cur->task);
-                }
        }
        spin_unlock_mutex(&lock->wait_lock, flags);
diff --git a/kernel/locking/mcs_spinlock.c b/kernel/locking/osq_lock.c
index 9887a905a762..c112d00341b0 100644
--- a/kernel/locking/mcs_spinlock.c
+++ b/kernel/locking/osq_lock.c
@@ -1,8 +1,6 @@
 #include <linux/percpu.h>
 #include <linux/sched.h>
-#include "mcs_spinlock.h"
+#include <linux/osq_lock.h>
-#ifdef CONFIG_SMP
 /*
 * An MCS like lock especially tailored for optimistic spinning for sleeping
@@ -111,7 +109,7 @@ bool osq_lock(struct optimistic_spin_queue *lock)
         * cmpxchg in an attempt to undo our queueing.
         */
-        while (!smp_load_acquire(&node->locked)) {
+        while (!ACCESS_ONCE(node->locked)) {
                /*
                 * If we need to reschedule bail... so we can block.
                 */
@@ -203,6 +201,3 @@ void osq_unlock(struct optimistic_spin_queue *lock)
        if (next)
                ACCESS_ONCE(next->locked) = 1;
 }
-#endif
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 7c98873a3077..3059bc2f022d 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1130,6 +1130,7 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state,
                set_current_state(state);
        }
+        __set_current_state(TASK_RUNNING);
        return ret;
 }
@@ -1188,10 +1189,9 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
        ret = task_blocks_on_rt_mutex(lock, &waiter, current, chwalk);
        if (likely(!ret))
+                /* sleep on the mutex */
                ret = __rt_mutex_slowlock(lock, state, timeout, &waiter);
-        set_current_state(TASK_RUNNING);
        if (unlikely(ret)) {
                remove_waiter(lock, &waiter);
                rt_mutex_handle_deadlock(ret, chwalk, &waiter);
@@ -1626,10 +1626,9 @@ int rt_mutex_finish_proxy_lock(struct rt_mutex *lock,
        set_current_state(TASK_INTERRUPTIBLE);
+        /* sleep on the mutex */
        ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter);
-        set_current_state(TASK_RUNNING);
        if (unlikely(ret))
                remove_waiter(lock, waiter);
diff --git a/kernel/locking/rwsem-spinlock.c b/kernel/locking/rwsem-spinlock.c
index 2c93571162cb..2555ae15ec14 100644
--- a/kernel/locking/rwsem-spinlock.c
+++ b/kernel/locking/rwsem-spinlock.c
@@ -154,7 +154,7 @@ void __sched __down_read(struct rw_semaphore *sem)
                set_task_state(tsk, TASK_UNINTERRUPTIBLE);
        }
-        tsk->state = TASK_RUNNING;
+        __set_task_state(tsk, TASK_RUNNING);
 out:
        ;
 }
diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
index 7628c3fc37ca..2f7cc4076f50 100644
--- a/kernel/locking/rwsem-xadd.c
+++ b/kernel/locking/rwsem-xadd.c
@@ -242,8 +242,7 @@ struct rw_semaphore __sched *rwsem_down_read_failed(struct rw_semaphore *sem)
                schedule();
        }
-        tsk->state = TASK_RUNNING;
+        __set_task_state(tsk, TASK_RUNNING);
        return sem;
 }
 EXPORT_SYMBOL(rwsem_down_read_failed);
diff --git a/kernel/module.c b/kernel/module.c
index 3965511ae133..d856e96a3cce 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -772,9 +772,18 @@ static int try_stop_module(struct module *mod, int flags, int *forced)
        return 0;
 }
-unsigned long module_refcount(struct module *mod)
+/**
+ * module_refcount - return the refcount or -1 if unloading
+ *
+ * @mod:        the module we're checking
+ *
+ * Returns:
+ *      -1 if the module is in the process of unloading
+ *      otherwise the number of references in the kernel to the module
+ */
+int module_refcount(struct module *mod)
 {
-        return (unsigned long)atomic_read(&mod->refcnt) - MODULE_REF_BASE;
+        return atomic_read(&mod->refcnt) - MODULE_REF_BASE;
 }
 EXPORT_SYMBOL(module_refcount);
@@ -856,7 +865,7 @@ static inline void print_unload_info(struct seq_file *m, struct module *mod)
        struct module_use *use;
        int printed_something = 0;
-        seq_printf(m, " %lu ", module_refcount(mod));
+        seq_printf(m, " %i ", module_refcount(mod));
        /*
         * Always include a trailing , so userspace can differentiate
@@ -908,7 +917,7 @@ EXPORT_SYMBOL_GPL(symbol_put_addr);
 static ssize_t show_refcnt(struct module_attribute *mattr,
                           struct module_kobject *mk, char *buffer)
 {
-        return sprintf(buffer, "%lu\n", module_refcount(mk->mod));
+        return sprintf(buffer, "%i\n", module_refcount(mk->mod));
 }
 static struct module_attribute modinfo_refcnt =
@@ -1795,7 +1804,7 @@ static void unset_module_core_ro_nx(struct module *mod) { }
 static void unset_module_init_ro_nx(struct module *mod) { }
 #endif
-void __weak module_free(struct module *mod, void *module_region)
+void __weak module_memfree(void *module_region)
 {
        vfree(module_region);
 }
@@ -1804,6 +1813,10 @@ void __weak module_arch_cleanup(struct module *mod)
 {
 }
+void __weak module_arch_freeing_init(struct module *mod)
+{
+}
 /* Free a module, remove from lists, etc. */
 static void free_module(struct module *mod)
 {
@@ -1841,7 +1854,8 @@ static void free_module(struct module *mod)
        /* This may be NULL, but that's OK */
        unset_module_init_ro_nx(mod);
-        module_free(mod, mod->module_init);
+        module_arch_freeing_init(mod);
+        module_memfree(mod->module_init);
        kfree(mod->args);
        percpu_modfree(mod);
@@ -1850,7 +1864,7 @@ static void free_module(struct module *mod)
        /* Finally, free the core (containing the module structure) */
        unset_module_core_ro_nx(mod);
-        module_free(mod, mod->module_core);
+        module_memfree(mod->module_core);
 #ifdef CONFIG_MPU
        update_protections(current->mm);
@@ -2785,7 +2799,7 @@ static int move_module(struct module *mod, struct load_info *info)
                 */
                kmemleak_ignore(ptr);
                if (!ptr) {
-                        module_free(mod, mod->module_core);
+                        module_memfree(mod->module_core);
                        return -ENOMEM;
                }
                memset(ptr, 0, mod->init_size);
@@ -2930,8 +2944,9 @@ static struct module *layout_and_allocate(struct load_info *info, int flags)
 static void module_deallocate(struct module *mod, struct load_info *info)
 {
        percpu_modfree(mod);
-        module_free(mod, mod->module_init);
+        module_arch_freeing_init(mod);
-        module_free(mod, mod->module_core);
+        module_memfree(mod->module_init);
+        module_memfree(mod->module_core);
 }
 int __weak module_finalize(const Elf_Ehdr *hdr,
@@ -2983,10 +2998,31 @@ static void do_mod_ctors(struct module *mod)
 #endif
 }
+/* For freeing module_init on success, in case kallsyms traversing */
+struct mod_initfree {
+        struct rcu_head rcu;
+        void *module_init;
+};
+static void do_free_init(struct rcu_head *head)
+{
+        struct mod_initfree *m = container_of(head, struct mod_initfree, rcu);
+        module_memfree(m->module_init);
+        kfree(m);
+}
 /* This is where the real work happens */
 static int do_init_module(struct module *mod)
 {
        int ret = 0;
+        struct mod_initfree *freeinit;
+        freeinit = kmalloc(sizeof(*freeinit), GFP_KERNEL);
+        if (!freeinit) {
+                ret = -ENOMEM;
+                goto fail;
+        }
+        freeinit->module_init = mod->module_init;
        /*
         * We want to find out whether @mod uses async during init.  Clear
@@ -2999,18 +3035,7 @@ static int do_init_module(struct module *mod)
        if (mod->init != NULL)
                ret = do_one_initcall(mod->init);
        if (ret < 0) {
-                /*
+                goto fail_free_freeinit;
-                 * Init routine failed: abort.  Try to protect us from
-                 * buggy refcounters.
-                 */
-                mod->state = MODULE_STATE_GOING;
-                synchronize_sched();
-                module_put(mod);
-                blocking_notifier_call_chain(&module_notify_list,
-                                             MODULE_STATE_GOING, mod);
-                free_module(mod);
-                wake_up_all(&module_wq);
-                return ret;
        }
        if (ret > 0) {
                pr_warn("%s: '%s'->init suspiciously returned %d, it should "
@@ -3055,15 +3080,35 @@ static int do_init_module(struct module *mod)
        mod->strtab = mod->core_strtab;
 #endif
        unset_module_init_ro_nx(mod);
-        module_free(mod, mod->module_init);
+        module_arch_freeing_init(mod);
        mod->module_init = NULL;
        mod->init_size = 0;
        mod->init_ro_size = 0;
        mod->init_text_size = 0;
+        /*
+         * We want to free module_init, but be aware that kallsyms may be
+         * walking this with preempt disabled.  In all the failure paths,
+         * we call synchronize_rcu/synchronize_sched, but we don't want
+         * to slow down the success path, so use actual RCU here.
+         */
+        call_rcu(&freeinit->rcu, do_free_init);
        mutex_unlock(&module_mutex);
        wake_up_all(&module_wq);
        return 0;
+fail_free_freeinit:
+        kfree(freeinit);
+fail:
+        /* Try to protect us from buggy refcounters. */
+        mod->state = MODULE_STATE_GOING;
+        synchronize_sched();
+        module_put(mod);
+        blocking_notifier_call_chain(&module_notify_list,
+                                     MODULE_STATE_GOING, mod);
+        free_module(mod);
+        wake_up_all(&module_wq);
+        return ret;
 }
 static int may_init_module(void)
diff --git a/kernel/notifier.c b/kernel/notifier.c
index 4803da6eab62..ae9fc7cc360e 100644
--- a/kernel/notifier.c
+++ b/kernel/notifier.c
@@ -402,6 +402,7 @@ int raw_notifier_call_chain(struct raw_notifier_head *nh,
 }
 EXPORT_SYMBOL_GPL(raw_notifier_call_chain);
+#ifdef CONFIG_SRCU
 /*
 *      SRCU notifier chain routines.    Registration and unregistration
 *      use a mutex, and call_chain is synchronized by SRCU (no locks).
@@ -528,6 +529,8 @@ void srcu_init_notifier_head(struct srcu_notifier_head *nh)
 }
 EXPORT_SYMBOL_GPL(srcu_init_notifier_head);
+#endif /* CONFIG_SRCU */
 static ATOMIC_NOTIFIER_HEAD(die_chain);
 int notrace notify_die(enum die_val val, const char *str,
diff --git a/kernel/params.c b/kernel/params.c
index 0af9b2c4e56c..728e05b167de 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -642,12 +642,15 @@ static __modinit int add_sysfs_param(struct module_kobject *mk,
        mk->mp->grp.attrs = new_attrs;
        /* Tack new one on the end. */
+        memset(&mk->mp->attrs[mk->mp->num], 0, sizeof(mk->mp->attrs[0]));
        sysfs_attr_init(&mk->mp->attrs[mk->mp->num].mattr.attr);
        mk->mp->attrs[mk->mp->num].param = kp;
        mk->mp->attrs[mk->mp->num].mattr.show = param_attr_show;
        /* Do not allow runtime DAC changes to make param writable. */
        if ((kp->perm & (S_IWUSR | S_IWGRP | S_IWOTH)) != 0)
                mk->mp->attrs[mk->mp->num].mattr.store = param_attr_store;
+        else
+                mk->mp->attrs[mk->mp->num].mattr.store = NULL;
        mk->mp->attrs[mk->mp->num].mattr.attr.name = (char *)name;
        mk->mp->attrs[mk->mp->num].mattr.attr.mode = kp->perm;
        mk->mp->num++;
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index 48b28d387c7f..7e01f78f0417 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -251,6 +251,7 @@ config APM_EMULATION
 config PM_OPP
        bool
+        select SRCU
        ---help---
          SOCs have a standard set of tuples consisting of frequency and
          voltage pairs that the device will support per voltage domain. This
diff --git a/kernel/range.c b/kernel/range.c
index 322ea8e93e4b..82cfc285b046 100644
--- a/kernel/range.c
+++ b/kernel/range.c
@@ -113,12 +113,12 @@ static int cmp_range(const void *x1, const void *x2)
 {
        const struct range *r1 = x1;
        const struct range *r2 = x2;
-        s64 start1, start2;
-        start1 = r1->start;
+        if (r1->start < r2->start)
-        start2 = r2->start;
+                return -1;
+        if (r1->start > r2->start)
-        return start1 - start2;
+                return 1;
+        return 0;
 }
 int clean_sort_range(struct range *range, int az)
diff --git a/kernel/rcu/Makefile b/kernel/rcu/Makefile
index e6fae503d1bc..50a808424b06 100644
--- a/kernel/rcu/Makefile
+++ b/kernel/rcu/Makefile
@@ -1,4 +1,5 @@
-obj-y += update.o srcu.o
+obj-y += update.o
+obj-$(CONFIG_SRCU) += srcu.o
 obj-$(CONFIG_RCU_TORTURE_TEST) += rcutorture.o
 obj-$(CONFIG_TREE_RCU) += tree.o
 obj-$(CONFIG_PREEMPT_RCU) += tree.o
diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h
index 07bb02eda844..80adef7d4c3d 100644
--- a/kernel/rcu/rcu.h
+++ b/kernel/rcu/rcu.h
@@ -137,4 +137,10 @@ int rcu_jiffies_till_stall_check(void);
 void rcu_early_boot_tests(void);
+/*
+ * This function really isn't for public consumption, but RCU is special in
+ * that context switches can allow the state machine to make progress.
+ */
+extern void resched_cpu(int cpu);
 #endif /* __LINUX_RCU_H */
diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 4d559baf06e0..30d42aa55d83 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -244,7 +244,8 @@ struct rcu_torture_ops {
        int (*readlock)(void);
        void (*read_delay)(struct torture_random_state *rrsp);
        void (*readunlock)(int idx);
-        int (*completed)(void);
+        unsigned long (*started)(void);
+        unsigned long (*completed)(void);
        void (*deferred_free)(struct rcu_torture *p);
        void (*sync)(void);
        void (*exp_sync)(void);
@@ -296,11 +297,6 @@ static void rcu_torture_read_unlock(int idx) __releases(RCU)
        rcu_read_unlock();
 }
-static int rcu_torture_completed(void)
-{
-        return rcu_batches_completed();
-}
 /*
 * Update callback in the pipe.  This should be invoked after a grace period.
 */
@@ -356,7 +352,7 @@ rcu_torture_cb(struct rcu_head *p)
                cur_ops->deferred_free(rp);
 }
-static int rcu_no_completed(void)
+static unsigned long rcu_no_completed(void)
 {
        return 0;
 }
@@ -377,7 +373,8 @@ static struct rcu_torture_ops rcu_ops = {
        .readlock       = rcu_torture_read_lock,
        .read_delay     = rcu_read_delay,
        .readunlock     = rcu_torture_read_unlock,
-        .completed      = rcu_torture_completed,
+        .started        = rcu_batches_started,
+        .completed      = rcu_batches_completed,
        .deferred_free  = rcu_torture_deferred_free,
        .sync           = synchronize_rcu,
        .exp_sync       = synchronize_rcu_expedited,
@@ -407,11 +404,6 @@ static void rcu_bh_torture_read_unlock(int idx) __releases(RCU_BH)
        rcu_read_unlock_bh();
 }
-static int rcu_bh_torture_completed(void)
-{
-        return rcu_batches_completed_bh();
-}
 static void rcu_bh_torture_deferred_free(struct rcu_torture *p)
 {
        call_rcu_bh(&p->rtort_rcu, rcu_torture_cb);
@@ -423,7 +415,8 @@ static struct rcu_torture_ops rcu_bh_ops = {
        .readlock       = rcu_bh_torture_read_lock,
        .read_delay     = rcu_read_delay,  /* just reuse rcu's version. */
        .readunlock     = rcu_bh_torture_read_unlock,
-        .completed      = rcu_bh_torture_completed,
+        .started        = rcu_batches_started_bh,
+        .completed      = rcu_batches_completed_bh,
        .deferred_free  = rcu_bh_torture_deferred_free,
        .sync           = synchronize_rcu_bh,
        .exp_sync       = synchronize_rcu_bh_expedited,
@@ -466,6 +459,7 @@ static struct rcu_torture_ops rcu_busted_ops = {
        .readlock       = rcu_torture_read_lock,
        .read_delay     = rcu_read_delay,  /* just reuse rcu's version. */
        .readunlock     = rcu_torture_read_unlock,
+        .started        = rcu_no_completed,
        .completed      = rcu_no_completed,
        .deferred_free  = rcu_busted_torture_deferred_free,
        .sync           = synchronize_rcu_busted,
@@ -510,7 +504,7 @@ static void srcu_torture_read_unlock(int idx) __releases(&srcu_ctl)
        srcu_read_unlock(&srcu_ctl, idx);
 }
-static int srcu_torture_completed(void)
+static unsigned long srcu_torture_completed(void)
 {
        return srcu_batches_completed(&srcu_ctl);
 }
@@ -564,6 +558,7 @@ static struct rcu_torture_ops srcu_ops = {
        .readlock       = srcu_torture_read_lock,
        .read_delay     = srcu_read_delay,
        .readunlock     = srcu_torture_read_unlock,
+        .started        = NULL,
        .completed      = srcu_torture_completed,
        .deferred_free  = srcu_torture_deferred_free,
        .sync           = srcu_torture_synchronize,
@@ -600,7 +595,8 @@ static struct rcu_torture_ops sched_ops = {
        .readlock       = sched_torture_read_lock,
        .read_delay     = rcu_read_delay,  /* just reuse rcu's version. */
        .readunlock     = sched_torture_read_unlock,
-        .completed      = rcu_no_completed,
+        .started        = rcu_batches_started_sched,
+        .completed      = rcu_batches_completed_sched,
        .deferred_free  = rcu_sched_torture_deferred_free,
        .sync           = synchronize_sched,
        .exp_sync       = synchronize_sched_expedited,
@@ -638,6 +634,7 @@ static struct rcu_torture_ops tasks_ops = {
        .readlock       = tasks_torture_read_lock,
        .read_delay     = rcu_read_delay,  /* just reuse rcu's version. */
        .readunlock     = tasks_torture_read_unlock,
+        .started        = rcu_no_completed,
        .completed      = rcu_no_completed,
        .deferred_free  = rcu_tasks_torture_deferred_free,
        .sync           = synchronize_rcu_tasks,
@@ -1015,8 +1012,8 @@ static void rcutorture_trace_dump(void)
 static void rcu_torture_timer(unsigned long unused)
 {
        int idx;
-        int completed;
+        unsigned long started;
-        int completed_end;
+        unsigned long completed;
        static DEFINE_TORTURE_RANDOM(rand);
        static DEFINE_SPINLOCK(rand_lock);
        struct rcu_torture *p;
@@ -1024,7 +1021,10 @@ static void rcu_torture_timer(unsigned long unused)
        unsigned long long ts;
        idx = cur_ops->readlock();
-        completed = cur_ops->completed();
+        if (cur_ops->started)
+                started = cur_ops->started();
+        else
+                started = cur_ops->completed();
        ts = rcu_trace_clock_local();
        p = rcu_dereference_check(rcu_torture_current,
                                  rcu_read_lock_bh_held() ||
@@ -1047,14 +1047,16 @@ static void rcu_torture_timer(unsigned long unused)
                /* Should not happen, but... */
                pipe_count = RCU_TORTURE_PIPE_LEN;
        }
-        completed_end = cur_ops->completed();
+        completed = cur_ops->completed();
        if (pipe_count > 1) {
                do_trace_rcu_torture_read(cur_ops->name, &p->rtort_rcu, ts,
-                                          completed, completed_end);
+                                          started, completed);
                rcutorture_trace_dump();
        }
        __this_cpu_inc(rcu_torture_count[pipe_count]);
-        completed = completed_end - completed;
+        completed = completed - started;
+        if (cur_ops->started)
+                completed++;
        if (completed > RCU_TORTURE_PIPE_LEN) {
                /* Should not happen, but... */
                completed = RCU_TORTURE_PIPE_LEN;
@@ -1073,8 +1075,8 @@ static void rcu_torture_timer(unsigned long unused)
 static int
 rcu_torture_reader(void *arg)
 {
-        int completed;
+        unsigned long started;
-        int completed_end;
+        unsigned long completed;
        int idx;
        DEFINE_TORTURE_RANDOM(rand);
        struct rcu_torture *p;
@@ -1093,7 +1095,10 @@ rcu_torture_reader(void *arg)
                                mod_timer(&t, jiffies + 1);
                }
                idx = cur_ops->readlock();
-                completed = cur_ops->completed();
+                if (cur_ops->started)
+                        started = cur_ops->started();
+                else
+                        started = cur_ops->completed();
                ts = rcu_trace_clock_local();
                p = rcu_dereference_check(rcu_torture_current,
                                          rcu_read_lock_bh_held() ||
@@ -1114,14 +1119,16 @@ rcu_torture_reader(void *arg)
                        /* Should not happen, but... */
                        pipe_count = RCU_TORTURE_PIPE_LEN;
                }
-                completed_end = cur_ops->completed();
+                completed = cur_ops->completed();
                if (pipe_count > 1) {
                        do_trace_rcu_torture_read(cur_ops->name, &p->rtort_rcu,
-                                                  ts, completed, completed_end);
+                                                  ts, started, completed);
                        rcutorture_trace_dump();
                }
                __this_cpu_inc(rcu_torture_count[pipe_count]);
-                completed = completed_end - completed;
+                completed = completed - started;
+                if (cur_ops->started)
+                        completed++;
                if (completed > RCU_TORTURE_PIPE_LEN) {
                        /* Should not happen, but... */
                        completed = RCU_TORTURE_PIPE_LEN;
@@ -1420,6 +1427,9 @@ static int rcu_torture_barrier(void *arg)
                cur_ops->cb_barrier(); /* Implies smp_mb() for wait_event(). */
                if (atomic_read(&barrier_cbs_invoked) != n_barrier_cbs) {
                        n_rcu_torture_barrier_error++;
+                        pr_err("barrier_cbs_invoked = %d, n_barrier_cbs = %d\n",
+                               atomic_read(&barrier_cbs_invoked),
+                               n_barrier_cbs);
                        WARN_ON_ONCE(1);
                }
                n_barrier_successes++;
diff --git a/kernel/rcu/srcu.c b/kernel/rcu/srcu.c
index e037f3eb2f7b..445bf8ffe3fb 100644
--- a/kernel/rcu/srcu.c
+++ b/kernel/rcu/srcu.c
@@ -546,7 +546,7 @@ EXPORT_SYMBOL_GPL(srcu_barrier);
 * Report the number of batches, correlated with, but not necessarily
 * precisely the same as, the number of grace periods that have elapsed.
 */
-long srcu_batches_completed(struct srcu_struct *sp)
+unsigned long srcu_batches_completed(struct srcu_struct *sp)
 {
        return sp->completed;
 }
diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
index 0db5649f8817..cc9ceca7bde1 100644
--- a/kernel/rcu/tiny.c
+++ b/kernel/rcu/tiny.c
@@ -47,54 +47,14 @@ static void __call_rcu(struct rcu_head *head,
                       void (*func)(struct rcu_head *rcu),
                       struct rcu_ctrlblk *rcp);
-static long long rcu_dynticks_nesting = DYNTICK_TASK_EXIT_IDLE;
 #include "tiny_plugin.h"
-/* Common code for rcu_idle_enter() and rcu_irq_exit(), see kernel/rcu/tree.c. */
-static void rcu_idle_enter_common(long long newval)
-{
-        if (newval) {
-                RCU_TRACE(trace_rcu_dyntick(TPS("--="),
-                                            rcu_dynticks_nesting, newval));
-                rcu_dynticks_nesting = newval;
-                return;
-        }
-        RCU_TRACE(trace_rcu_dyntick(TPS("Start"),
-                                    rcu_dynticks_nesting, newval));
-        if (IS_ENABLED(CONFIG_RCU_TRACE) && !is_idle_task(current)) {
-                struct task_struct *idle __maybe_unused = idle_task(smp_processor_id());
-                RCU_TRACE(trace_rcu_dyntick(TPS("Entry error: not idle task"),
-                                            rcu_dynticks_nesting, newval));
-                ftrace_dump(DUMP_ALL);
-                WARN_ONCE(1, "Current pid: %d comm: %s / Idle pid: %d comm: %s",
-                          current->pid, current->comm,
-                          idle->pid, idle->comm); /* must be idle task! */
-        }
-        rcu_sched_qs(); /* implies rcu_bh_inc() */
-        barrier();
-        rcu_dynticks_nesting = newval;
-}
 /*
 * Enter idle, which is an extended quiescent state if we have fully
- * entered that mode (i.e., if the new value of dynticks_nesting is zero).
+ * entered that mode.
 */
 void rcu_idle_enter(void)
 {
-        unsigned long flags;
-        long long newval;
-        local_irq_save(flags);
-        WARN_ON_ONCE((rcu_dynticks_nesting & DYNTICK_TASK_NEST_MASK) == 0);
-        if ((rcu_dynticks_nesting & DYNTICK_TASK_NEST_MASK) ==
-            DYNTICK_TASK_NEST_VALUE)
-                newval = 0;
-        else
-                newval = rcu_dynticks_nesting - DYNTICK_TASK_NEST_VALUE;
-        rcu_idle_enter_common(newval);
-        local_irq_restore(flags);
 }
 EXPORT_SYMBOL_GPL(rcu_idle_enter);
@@ -103,55 +63,14 @@ EXPORT_SYMBOL_GPL(rcu_idle_enter);
 */
 void rcu_irq_exit(void)
 {
-        unsigned long flags;
-        long long newval;
-        local_irq_save(flags);
-        newval = rcu_dynticks_nesting - 1;
-        WARN_ON_ONCE(newval < 0);
-        rcu_idle_enter_common(newval);
-        local_irq_restore(flags);
 }
 EXPORT_SYMBOL_GPL(rcu_irq_exit);
-/* Common code for rcu_idle_exit() and rcu_irq_enter(), see kernel/rcu/tree.c. */
-static void rcu_idle_exit_common(long long oldval)
-{
-        if (oldval) {
-                RCU_TRACE(trace_rcu_dyntick(TPS("++="),
-                                            oldval, rcu_dynticks_nesting));
-                return;
-        }
-        RCU_TRACE(trace_rcu_dyntick(TPS("End"), oldval, rcu_dynticks_nesting));
-        if (IS_ENABLED(CONFIG_RCU_TRACE) && !is_idle_task(current)) {
-                struct task_struct *idle __maybe_unused = idle_task(smp_processor_id());
-                RCU_TRACE(trace_rcu_dyntick(TPS("Exit error: not idle task"),
-                          oldval, rcu_dynticks_nesting));
-                ftrace_dump(DUMP_ALL);
-                WARN_ONCE(1, "Current pid: %d comm: %s / Idle pid: %d comm: %s",
-                          current->pid, current->comm,
-                          idle->pid, idle->comm); /* must be idle task! */
-        }
-}
 /*
 * Exit idle, so that we are no longer in an extended quiescent state.
 */
 void rcu_idle_exit(void)
 {
-        unsigned long flags;
-        long long oldval;
-        local_irq_save(flags);
-        oldval = rcu_dynticks_nesting;
-        WARN_ON_ONCE(rcu_dynticks_nesting < 0);
-        if (rcu_dynticks_nesting & DYNTICK_TASK_NEST_MASK)
-                rcu_dynticks_nesting += DYNTICK_TASK_NEST_VALUE;
-        else
-                rcu_dynticks_nesting = DYNTICK_TASK_EXIT_IDLE;
-        rcu_idle_exit_common(oldval);
-        local_irq_restore(flags);
 }
 EXPORT_SYMBOL_GPL(rcu_idle_exit);
@@ -160,15 +79,6 @@ EXPORT_SYMBOL_GPL(rcu_idle_exit);
 */
 void rcu_irq_enter(void)
 {
-        unsigned long flags;
-        long long oldval;
-        local_irq_save(flags);
-        oldval = rcu_dynticks_nesting;
-        rcu_dynticks_nesting++;
-        WARN_ON_ONCE(rcu_dynticks_nesting == 0);
-        rcu_idle_exit_common(oldval);
-        local_irq_restore(flags);
 }
 EXPORT_SYMBOL_GPL(rcu_irq_enter);
@@ -179,23 +89,13 @@ EXPORT_SYMBOL_GPL(rcu_irq_enter);
 */
 bool notrace __rcu_is_watching(void)
 {
-        return rcu_dynticks_nesting;
+        return true;
 }
 EXPORT_SYMBOL(__rcu_is_watching);
 #endif /* defined(CONFIG_DEBUG_LOCK_ALLOC) || defined(CONFIG_RCU_TRACE) */
 /*
- * Test whether the current CPU was interrupted from idle.  Nested
- * interrupts don't count, we must be running at the first interrupt
- * level.
- */
-static int rcu_is_cpu_rrupt_from_idle(void)
-{
-        return rcu_dynticks_nesting <= 1;
-}
-/*
 * Helper function for rcu_sched_qs() and rcu_bh_qs().
 * Also irqs are disabled to avoid confusion due to interrupt handlers
 * invoking call_rcu().
@@ -250,7 +150,7 @@ void rcu_bh_qs(void)
 void rcu_check_callbacks(int user)
 {
        RCU_TRACE(check_cpu_stalls());
-        if (user || rcu_is_cpu_rrupt_from_idle())
+        if (user)
                rcu_sched_qs();
        else if (!in_softirq())
                rcu_bh_qs();
@@ -357,6 +257,11 @@ static void __call_rcu(struct rcu_head *head,
        rcp->curtail = &head->next;
        RCU_TRACE(rcp->qlen++);
        local_irq_restore(flags);
+        if (unlikely(is_idle_task(current))) {
+                /* force scheduling for rcu_sched_qs() */
+                resched_cpu(0);
+        }
 }
 /*
@@ -383,6 +288,8 @@ EXPORT_SYMBOL_GPL(call_rcu_bh);
 void __init rcu_init(void)
 {
        open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
+        RCU_TRACE(reset_cpu_stall_ticks(&rcu_sched_ctrlblk));
+        RCU_TRACE(reset_cpu_stall_ticks(&rcu_bh_ctrlblk));
        rcu_early_boot_tests();
 }
diff --git a/kernel/rcu/tiny_plugin.h b/kernel/rcu/tiny_plugin.h
index 858c56569127..f94e209a10d6 100644
--- a/kernel/rcu/tiny_plugin.h
+++ b/kernel/rcu/tiny_plugin.h
@@ -145,17 +145,16 @@ static void check_cpu_stall(struct rcu_ctrlblk *rcp)
        rcp->ticks_this_gp++;
        j = jiffies;
        js = ACCESS_ONCE(rcp->jiffies_stall);
-        if (*rcp->curtail && ULONG_CMP_GE(j, js)) {
+        if (rcp->rcucblist && ULONG_CMP_GE(j, js)) {
                pr_err("INFO: %s stall on CPU (%lu ticks this GP) idle=%llx (t=%lu jiffies q=%ld)\n",
-                       rcp->name, rcp->ticks_this_gp, rcu_dynticks_nesting,
+                       rcp->name, rcp->ticks_this_gp, DYNTICK_TASK_EXIT_IDLE,
                       jiffies - rcp->gp_start, rcp->qlen);
                dump_stack();
-        }
-        if (*rcp->curtail && ULONG_CMP_GE(j, js))
                ACCESS_ONCE(rcp->jiffies_stall) = jiffies +
                        3 * rcu_jiffies_till_stall_check() + 3;
-        else if (ULONG_CMP_GE(j, js))
+        } else if (ULONG_CMP_GE(j, js)) {
                ACCESS_ONCE(rcp->jiffies_stall) = jiffies + rcu_jiffies_till_stall_check();
+        }
 }
 static void reset_cpu_stall_ticks(struct rcu_ctrlblk *rcp)
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 7680fc275036..48d640ca1a05 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -156,6 +156,10 @@ static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
 static void invoke_rcu_core(void);
 static void invoke_rcu_callbacks(struct rcu_state *rsp, struct rcu_data *rdp);
+/* rcuc/rcub kthread realtime priority */
+static int kthread_prio = CONFIG_RCU_KTHREAD_PRIO;
+module_param(kthread_prio, int, 0644);
 /*
 * Track the rcutorture test sequence number and the update version
 * number within a given test.  The rcutorture_testseq is incremented
@@ -215,6 +219,9 @@ static DEFINE_PER_CPU(struct rcu_dynticks, rcu_dynticks) = {
 #endif /* #ifdef CONFIG_NO_HZ_FULL_SYSIDLE */
 };
+DEFINE_PER_CPU_SHARED_ALIGNED(unsigned long, rcu_qs_ctr);
+EXPORT_PER_CPU_SYMBOL_GPL(rcu_qs_ctr);
 /*
 * Let the RCU core know that this CPU has gone through the scheduler,
 * which is a quiescent state.  This is called when the need for a
@@ -284,6 +291,22 @@ void rcu_note_context_switch(void)
 }
 EXPORT_SYMBOL_GPL(rcu_note_context_switch);
+/*
+ * Register a quiesecent state for all RCU flavors.  If there is an
+ * emergency, invoke rcu_momentary_dyntick_idle() to do a heavy-weight
+ * dyntick-idle quiescent state visible to other CPUs (but only for those
+ * RCU flavors in desparate need of a quiescent state, which will normally
+ * be none of them).  Either way, do a lightweight quiescent state for
+ * all RCU flavors.
+ */
+void rcu_all_qs(void)
+{
+        if (unlikely(raw_cpu_read(rcu_sched_qs_mask)))
+                rcu_momentary_dyntick_idle();
+        this_cpu_inc(rcu_qs_ctr);
+}
+EXPORT_SYMBOL_GPL(rcu_all_qs);
 static long blimit = 10;        /* Maximum callbacks per rcu_do_batch. */
 static long qhimark = 10000;    /* If this many pending, ignore blimit. */
 static long qlowmark = 100;     /* Once only this many pending, use blimit. */
@@ -315,18 +338,54 @@ static void force_quiescent_state(struct rcu_state *rsp);
 static int rcu_pending(void);
 /*
- * Return the number of RCU-sched batches processed thus far for debug & stats.
+ * Return the number of RCU batches started thus far for debug & stats.
+ */
+unsigned long rcu_batches_started(void)
+{
+        return rcu_state_p->gpnum;
+}
+EXPORT_SYMBOL_GPL(rcu_batches_started);
+/*
+ * Return the number of RCU-sched batches started thus far for debug & stats.
+ */
+unsigned long rcu_batches_started_sched(void)
+{
+        return rcu_sched_state.gpnum;
+}
+EXPORT_SYMBOL_GPL(rcu_batches_started_sched);
+/*
+ * Return the number of RCU BH batches started thus far for debug & stats.
 */
-long rcu_batches_completed_sched(void)
+unsigned long rcu_batches_started_bh(void)
+{
+        return rcu_bh_state.gpnum;
+}
+EXPORT_SYMBOL_GPL(rcu_batches_started_bh);
+/*
+ * Return the number of RCU batches completed thus far for debug & stats.
+ */
+unsigned long rcu_batches_completed(void)
+{
+        return rcu_state_p->completed;
+}
+EXPORT_SYMBOL_GPL(rcu_batches_completed);
+/*
+ * Return the number of RCU-sched batches completed thus far for debug & stats.
+ */
+unsigned long rcu_batches_completed_sched(void)
 {
        return rcu_sched_state.completed;
 }
 EXPORT_SYMBOL_GPL(rcu_batches_completed_sched);
 /*
- * Return the number of RCU BH batches processed thus far for debug & stats.
+ * Return the number of RCU BH batches completed thus far for debug & stats.
 */
-long rcu_batches_completed_bh(void)
+unsigned long rcu_batches_completed_bh(void)
 {
        return rcu_bh_state.completed;
 }
@@ -759,39 +818,71 @@ void rcu_irq_enter(void)
 /**
 * rcu_nmi_enter - inform RCU of entry to NMI context
 *
- * If the CPU was idle with dynamic ticks active, and there is no
+ * If the CPU was idle from RCU's viewpoint, update rdtp->dynticks and
- * irq handler running, this updates rdtp->dynticks_nmi to let the
+ * rdtp->dynticks_nmi_nesting to let the RCU grace-period handling know
- * RCU grace-period handling know that the CPU is active.
+ * that the CPU is active.  This implementation permits nested NMIs, as
+ * long as the nesting level does not overflow an int.  (You will probably
+ * run out of stack space first.)
 */
 void rcu_nmi_enter(void)
 {
        struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks);
+        int incby = 2;
-        if (rdtp->dynticks_nmi_nesting == 0 &&
+        /* Complain about underflow. */
-            (atomic_read(&rdtp->dynticks) & 0x1))
+        WARN_ON_ONCE(rdtp->dynticks_nmi_nesting < 0);
-                return;
-        rdtp->dynticks_nmi_nesting++;
+        /*
-        smp_mb__before_atomic();  /* Force delay from prior write. */
+         * If idle from RCU viewpoint, atomically increment ->dynticks
-        atomic_inc(&rdtp->dynticks);
+         * to mark non-idle and increment ->dynticks_nmi_nesting by one.
-        /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
+         * Otherwise, increment ->dynticks_nmi_nesting by two.  This means
-        smp_mb__after_atomic();  /* See above. */
+         * if ->dynticks_nmi_nesting is equal to one, we are guaranteed
-        WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
+         * to be in the outermost NMI handler that interrupted an RCU-idle
+         * period (observation due to Andy Lutomirski).
+         */
+        if (!(atomic_read(&rdtp->dynticks) & 0x1)) {
+                smp_mb__before_atomic();  /* Force delay from prior write. */
+                atomic_inc(&rdtp->dynticks);
+                /* atomic_inc() before later RCU read-side crit sects */
+                smp_mb__after_atomic();  /* See above. */
+                WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
+                incby = 1;
+        }
+        rdtp->dynticks_nmi_nesting += incby;
+        barrier();
 }
 /**
 * rcu_nmi_exit - inform RCU of exit from NMI context
 *
- * If the CPU was idle with dynamic ticks active, and there is no
+ * If we are returning from the outermost NMI handler that interrupted an
- * irq handler running, this updates rdtp->dynticks_nmi to let the
+ * RCU-idle period, update rdtp->dynticks and rdtp->dynticks_nmi_nesting
- * RCU grace-period handling know that the CPU is no longer active.
+ * to let the RCU grace-period handling know that the CPU is back to
+ * being RCU-idle.
 */
 void rcu_nmi_exit(void)
 {
        struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks);
-        if (rdtp->dynticks_nmi_nesting == 0 ||
+        /*
-            --rdtp->dynticks_nmi_nesting != 0)
+         * Check for ->dynticks_nmi_nesting underflow and bad ->dynticks.
+         * (We are exiting an NMI handler, so RCU better be paying attention
+         * to us!)
+         */
+        WARN_ON_ONCE(rdtp->dynticks_nmi_nesting <= 0);
+        WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
+        /*
+         * If the nesting level is not 1, the CPU wasn't RCU-idle, so
+         * leave it in non-RCU-idle state.
+         */
+        if (rdtp->dynticks_nmi_nesting != 1) {
+                rdtp->dynticks_nmi_nesting -= 2;
                return;
+        }
+        /* This NMI interrupted an RCU-idle CPU, restore RCU-idleness. */
+        rdtp->dynticks_nmi_nesting = 0;
        /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
        smp_mb__before_atomic();  /* See above. */
        atomic_inc(&rdtp->dynticks);
@@ -898,17 +989,14 @@ static int dyntick_save_progress_counter(struct rcu_data *rdp,
                trace_rcu_fqs(rdp->rsp->name, rdp->gpnum, rdp->cpu, TPS("dti"));
                return 1;
        } else {
+                if (ULONG_CMP_LT(ACCESS_ONCE(rdp->gpnum) + ULONG_MAX / 4,
+                                 rdp->mynode->gpnum))
+                        ACCESS_ONCE(rdp->gpwrap) = true;
                return 0;
        }
 }
 /*
- * This function really isn't for public consumption, but RCU is special in
- * that context switches can allow the state machine to make progress.
- */
-extern void resched_cpu(int cpu);
-/*
 * Return true if the specified CPU has passed through a quiescent
 * state by virtue of being in or having passed through an dynticks
 * idle state since the last call to dyntick_save_progress_counter()
@@ -1011,6 +1099,22 @@ static void record_gp_stall_check_time(struct rcu_state *rsp)
        j1 = rcu_jiffies_till_stall_check();
        ACCESS_ONCE(rsp->jiffies_stall) = j + j1;
        rsp->jiffies_resched = j + j1 / 2;
+        rsp->n_force_qs_gpstart = ACCESS_ONCE(rsp->n_force_qs);
+}
+/*
+ * Complain about starvation of grace-period kthread.
+ */
+static void rcu_check_gp_kthread_starvation(struct rcu_state *rsp)
+{
+        unsigned long gpa;
+        unsigned long j;
+        j = jiffies;
+        gpa = ACCESS_ONCE(rsp->gp_activity);
+        if (j - gpa > 2 * HZ)
+                pr_err("%s kthread starved for %ld jiffies!\n",
+                       rsp->name, j - gpa);
 }
 /*
@@ -1033,11 +1137,13 @@ static void rcu_dump_cpu_stacks(struct rcu_state *rsp)
        }
 }
-static void print_other_cpu_stall(struct rcu_state *rsp)
+static void print_other_cpu_stall(struct rcu_state *rsp, unsigned long gpnum)
 {
        int cpu;
        long delta;
        unsigned long flags;
+        unsigned long gpa;
+        unsigned long j;
        int ndetected = 0;
        struct rcu_node *rnp = rcu_get_root(rsp);
        long totqlen = 0;
@@ -1075,30 +1181,34 @@ static void print_other_cpu_stall(struct rcu_state *rsp)
                raw_spin_unlock_irqrestore(&rnp->lock, flags);
        }
-        /*
-         * Now rat on any tasks that got kicked up to the root rcu_node
-         * due to CPU offlining.
-         */
-        rnp = rcu_get_root(rsp);
-        raw_spin_lock_irqsave(&rnp->lock, flags);
-        ndetected += rcu_print_task_stall(rnp);
-        raw_spin_unlock_irqrestore(&rnp->lock, flags);
        print_cpu_stall_info_end();
        for_each_possible_cpu(cpu)
                totqlen += per_cpu_ptr(rsp->rda, cpu)->qlen;
        pr_cont("(detected by %d, t=%ld jiffies, g=%ld, c=%ld, q=%lu)\n",
               smp_processor_id(), (long)(jiffies - rsp->gp_start),
               (long)rsp->gpnum, (long)rsp->completed, totqlen);
-        if (ndetected == 0)
+        if (ndetected) {
-                pr_err("INFO: Stall ended before state dump start\n");
-        else
                rcu_dump_cpu_stacks(rsp);
+        } else {
+                if (ACCESS_ONCE(rsp->gpnum) != gpnum ||
+                    ACCESS_ONCE(rsp->completed) == gpnum) {
+                        pr_err("INFO: Stall ended before state dump start\n");
+                } else {
+                        j = jiffies;
+                        gpa = ACCESS_ONCE(rsp->gp_activity);
+                        pr_err("All QSes seen, last %s kthread activity %ld (%ld-%ld), jiffies_till_next_fqs=%ld\n",
+                               rsp->name, j - gpa, j, gpa,
+                               jiffies_till_next_fqs);
+                        /* In this case, the current CPU might be at fault. */
+                        sched_show_task(current);
+                }
+        }
        /* Complain about tasks blocking the grace period. */
        rcu_print_detail_task_stall(rsp);
+        rcu_check_gp_kthread_starvation(rsp);
        force_quiescent_state(rsp);  /* Kick them all. */
 }
@@ -1123,6 +1233,9 @@ static void print_cpu_stall(struct rcu_state *rsp)
        pr_cont(" (t=%lu jiffies g=%ld c=%ld q=%lu)\n",
                jiffies - rsp->gp_start,
                (long)rsp->gpnum, (long)rsp->completed, totqlen);
+        rcu_check_gp_kthread_starvation(rsp);
        rcu_dump_cpu_stacks(rsp);
        raw_spin_lock_irqsave(&rnp->lock, flags);
@@ -1193,7 +1306,7 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
                   ULONG_CMP_GE(j, js + RCU_STALL_RAT_DELAY)) {
                /* They had a few time units to dump stack, so complain. */
-                print_other_cpu_stall(rsp);
+                print_other_cpu_stall(rsp, gpnum);
        }
 }
@@ -1530,7 +1643,8 @@ static bool __note_gp_changes(struct rcu_state *rsp, struct rcu_node *rnp,
        bool ret;
        /* Handle the ends of any preceding grace periods first. */
-        if (rdp->completed == rnp->completed) {
+        if (rdp->completed == rnp->completed &&
+            !unlikely(ACCESS_ONCE(rdp->gpwrap))) {
                /* No grace period end, so just accelerate recent callbacks. */
                ret = rcu_accelerate_cbs(rsp, rnp, rdp);
@@ -1545,7 +1659,7 @@ static bool __note_gp_changes(struct rcu_state *rsp, struct rcu_node *rnp,
                trace_rcu_grace_period(rsp->name, rdp->gpnum, TPS("cpuend"));
        }
-        if (rdp->gpnum != rnp->gpnum) {
+        if (rdp->gpnum != rnp->gpnum || unlikely(ACCESS_ONCE(rdp->gpwrap))) {
                /*
                 * If the current grace period is waiting for this CPU,
                 * set up to detect a quiescent state, otherwise don't
@@ -1554,8 +1668,10 @@ static bool __note_gp_changes(struct rcu_state *rsp, struct rcu_node *rnp,
                rdp->gpnum = rnp->gpnum;
                trace_rcu_grace_period(rsp->name, rdp->gpnum, TPS("cpustart"));
                rdp->passed_quiesce = 0;
+                rdp->rcu_qs_ctr_snap = __this_cpu_read(rcu_qs_ctr);
                rdp->qs_pending = !!(rnp->qsmask & rdp->grpmask);
                zero_cpu_stall_ticks(rdp);
+                ACCESS_ONCE(rdp->gpwrap) = false;
        }
        return ret;
 }
@@ -1569,7 +1685,8 @@ static void note_gp_changes(struct rcu_state *rsp, struct rcu_data *rdp)
        local_irq_save(flags);
        rnp = rdp->mynode;
        if ((rdp->gpnum == ACCESS_ONCE(rnp->gpnum) &&
-             rdp->completed == ACCESS_ONCE(rnp->completed)) || /* w/out lock. */
+             rdp->completed == ACCESS_ONCE(rnp->completed) &&
+             !unlikely(ACCESS_ONCE(rdp->gpwrap))) || /* w/out lock. */
            !raw_spin_trylock(&rnp->lock)) { /* irqs already off, so later. */
                local_irq_restore(flags);
                return;
@@ -1589,6 +1706,7 @@ static int rcu_gp_init(struct rcu_state *rsp)
        struct rcu_data *rdp;
        struct rcu_node *rnp = rcu_get_root(rsp);
+        ACCESS_ONCE(rsp->gp_activity) = jiffies;
        rcu_bind_gp_kthread();
        raw_spin_lock_irq(&rnp->lock);
        smp_mb__after_unlock_lock();
@@ -1649,6 +1767,7 @@ static int rcu_gp_init(struct rcu_state *rsp)
                                            rnp->grphi, rnp->qsmask);
                raw_spin_unlock_irq(&rnp->lock);
                cond_resched_rcu_qs();
+                ACCESS_ONCE(rsp->gp_activity) = jiffies;
        }
        mutex_unlock(&rsp->onoff_mutex);
@@ -1665,6 +1784,7 @@ static int rcu_gp_fqs(struct rcu_state *rsp, int fqs_state_in)
        unsigned long maxj;
        struct rcu_node *rnp = rcu_get_root(rsp);
+        ACCESS_ONCE(rsp->gp_activity) = jiffies;
        rsp->n_force_qs++;
        if (fqs_state == RCU_SAVE_DYNTICK) {
                /* Collect dyntick-idle snapshots. */
@@ -1703,6 +1823,7 @@ static void rcu_gp_cleanup(struct rcu_state *rsp)
        struct rcu_data *rdp;
        struct rcu_node *rnp = rcu_get_root(rsp);
+        ACCESS_ONCE(rsp->gp_activity) = jiffies;
        raw_spin_lock_irq(&rnp->lock);
        smp_mb__after_unlock_lock();
        gp_duration = jiffies - rsp->gp_start;
@@ -1739,6 +1860,7 @@ static void rcu_gp_cleanup(struct rcu_state *rsp)
                nocb += rcu_future_gp_cleanup(rsp, rnp);
                raw_spin_unlock_irq(&rnp->lock);
                cond_resched_rcu_qs();
+                ACCESS_ONCE(rsp->gp_activity) = jiffies;
        }
        rnp = rcu_get_root(rsp);
        raw_spin_lock_irq(&rnp->lock);
@@ -1788,6 +1910,7 @@ static int __noreturn rcu_gp_kthread(void *arg)
                        if (rcu_gp_init(rsp))
                                break;
                        cond_resched_rcu_qs();
+                        ACCESS_ONCE(rsp->gp_activity) = jiffies;
                        WARN_ON(signal_pending(current));
                        trace_rcu_grace_period(rsp->name,
                                               ACCESS_ONCE(rsp->gpnum),
@@ -1831,9 +1954,11 @@ static int __noreturn rcu_gp_kthread(void *arg)
                                                       ACCESS_ONCE(rsp->gpnum),
                                                       TPS("fqsend"));
                                cond_resched_rcu_qs();
+                                ACCESS_ONCE(rsp->gp_activity) = jiffies;
                        } else {
                                /* Deal with stray signal. */
                                cond_resched_rcu_qs();
+                                ACCESS_ONCE(rsp->gp_activity) = jiffies;
                                WARN_ON(signal_pending(current));
                                trace_rcu_grace_period(rsp->name,
                                                       ACCESS_ONCE(rsp->gpnum),
@@ -2010,8 +2135,10 @@ rcu_report_qs_rdp(int cpu, struct rcu_state *rsp, struct rcu_data *rdp)
        rnp = rdp->mynode;
        raw_spin_lock_irqsave(&rnp->lock, flags);
        smp_mb__after_unlock_lock();
-        if (rdp->passed_quiesce == 0 || rdp->gpnum != rnp->gpnum ||
+        if ((rdp->passed_quiesce == 0 &&
-            rnp->completed == rnp->gpnum) {
+             rdp->rcu_qs_ctr_snap == __this_cpu_read(rcu_qs_ctr)) ||
+            rdp->gpnum != rnp->gpnum || rnp->completed == rnp->gpnum ||
+            rdp->gpwrap) {
                /*
                 * The grace period in which this quiescent state was
@@ -2020,6 +2147,7 @@ rcu_report_qs_rdp(int cpu, struct rcu_state *rsp, struct rcu_data *rdp)
                 * within the current grace period.
                 */
                rdp->passed_quiesce = 0;        /* need qs for new gp. */
+                rdp->rcu_qs_ctr_snap = __this_cpu_read(rcu_qs_ctr);
                raw_spin_unlock_irqrestore(&rnp->lock, flags);
                return;
        }
@@ -2064,7 +2192,8 @@ rcu_check_quiescent_state(struct rcu_state *rsp, struct rcu_data *rdp)
         * Was there a quiescent state since the beginning of the grace
         * period? If no, then exit and wait for the next call.
         */
-        if (!rdp->passed_quiesce)
+        if (!rdp->passed_quiesce &&
+            rdp->rcu_qs_ctr_snap == __this_cpu_read(rcu_qs_ctr))
                return;
        /*
@@ -2195,6 +2324,46 @@ static void rcu_cleanup_dying_cpu(struct rcu_state *rsp)
 }
 /*
+ * All CPUs for the specified rcu_node structure have gone offline,
+ * and all tasks that were preempted within an RCU read-side critical
+ * section while running on one of those CPUs have since exited their RCU
+ * read-side critical section.  Some other CPU is reporting this fact with
+ * the specified rcu_node structure's ->lock held and interrupts disabled.
+ * This function therefore goes up the tree of rcu_node structures,
+ * clearing the corresponding bits in the ->qsmaskinit fields.  Note that
+ * the leaf rcu_node structure's ->qsmaskinit field has already been
+ * updated
+ *
+ * This function does check that the specified rcu_node structure has
+ * all CPUs offline and no blocked tasks, so it is OK to invoke it
+ * prematurely.  That said, invoking it after the fact will cost you
+ * a needless lock acquisition.  So once it has done its work, don't
+ * invoke it again.
+ */
+static void rcu_cleanup_dead_rnp(struct rcu_node *rnp_leaf)
+{
+        long mask;
+        struct rcu_node *rnp = rnp_leaf;
+        if (rnp->qsmaskinit || rcu_preempt_has_tasks(rnp))
+                return;
+        for (;;) {
+                mask = rnp->grpmask;
+                rnp = rnp->parent;
+                if (!rnp)
+                        break;
+                raw_spin_lock(&rnp->lock); /* irqs already disabled. */
+                smp_mb__after_unlock_lock(); /* GP memory ordering. */
+                rnp->qsmaskinit &= ~mask;
+                if (rnp->qsmaskinit) {
+                        raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */
+                        return;
+                }
+                raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */
+        }
+}
+/*
 * The CPU has been completely removed, and some other CPU is reporting
 * this fact from process context.  Do the remainder of the cleanup,
 * including orphaning the outgoing CPU's RCU callbacks, and also
@@ -2204,8 +2373,6 @@ static void rcu_cleanup_dying_cpu(struct rcu_state *rsp)
 static void rcu_cleanup_dead_cpu(int cpu, struct rcu_state *rsp)
 {
        unsigned long flags;
-        unsigned long mask;
-        int need_report = 0;
        struct rcu_data *rdp = per_cpu_ptr(rsp->rda, cpu);
        struct rcu_node *rnp = rdp->mynode;  /* Outgoing CPU's rdp & rnp. */
@@ -2219,40 +2386,15 @@ static void rcu_cleanup_dead_cpu(int cpu, struct rcu_state *rsp)
        /* Orphan the dead CPU's callbacks, and adopt them if appropriate. */
        rcu_send_cbs_to_orphanage(cpu, rsp, rnp, rdp);
        rcu_adopt_orphan_cbs(rsp, flags);
+        raw_spin_unlock_irqrestore(&rsp->orphan_lock, flags);
-        /* Remove the outgoing CPU from the masks in the rcu_node hierarchy. */
+        /* Remove outgoing CPU from mask in the leaf rcu_node structure. */
-        mask = rdp->grpmask;    /* rnp->grplo is constant. */
+        raw_spin_lock_irqsave(&rnp->lock, flags);
-        do {
+        smp_mb__after_unlock_lock();    /* Enforce GP memory-order guarantee. */
-                raw_spin_lock(&rnp->lock);      /* irqs already disabled. */
+        rnp->qsmaskinit &= ~rdp->grpmask;
-                smp_mb__after_unlock_lock();
+        if (rnp->qsmaskinit == 0 && !rcu_preempt_has_tasks(rnp))
-                rnp->qsmaskinit &= ~mask;
+                rcu_cleanup_dead_rnp(rnp);
-                if (rnp->qsmaskinit != 0) {
+        rcu_report_qs_rnp(rdp->grpmask, rsp, rnp, flags); /* Rlses rnp->lock. */
-                        if (rnp != rdp->mynode)
-                                raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */
-                        break;
-                }
-                if (rnp == rdp->mynode)
-                        need_report = rcu_preempt_offline_tasks(rsp, rnp, rdp);
-                else
-                        raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */
-                mask = rnp->grpmask;
-                rnp = rnp->parent;
-        } while (rnp != NULL);
-        /*
-         * We still hold the leaf rcu_node structure lock here, and
-         * irqs are still disabled.  The reason for this subterfuge is
-         * because invoking rcu_report_unblock_qs_rnp() with ->orphan_lock
-         * held leads to deadlock.
-         */
-        raw_spin_unlock(&rsp->orphan_lock); /* irqs remain disabled. */
-        rnp = rdp->mynode;
-        if (need_report & RCU_OFL_TASKS_NORM_GP)
-                rcu_report_unblock_qs_rnp(rnp, flags);
-        else
-                raw_spin_unlock_irqrestore(&rnp->lock, flags);
-        if (need_report & RCU_OFL_TASKS_EXP_GP)
-                rcu_report_exp_rnp(rsp, rnp, true);
        WARN_ONCE(rdp->qlen != 0 || rdp->nxtlist != NULL,
                  "rcu_cleanup_dead_cpu: Callbacks on offline CPU %d: qlen=%lu, nxtlist=%p\n",
                  cpu, rdp->qlen, rdp->nxtlist);
@@ -2268,6 +2410,10 @@ static void rcu_cleanup_dying_cpu(struct rcu_state *rsp)
 {
 }
+static void __maybe_unused rcu_cleanup_dead_rnp(struct rcu_node *rnp_leaf)
+{
+}
 static void rcu_cleanup_dead_cpu(int cpu, struct rcu_state *rsp)
 {
 }
@@ -2464,12 +2610,6 @@ static void force_qs_rnp(struct rcu_state *rsp,
                }
                raw_spin_unlock_irqrestore(&rnp->lock, flags);
        }
-        rnp = rcu_get_root(rsp);
-        if (rnp->qsmask == 0) {
-                raw_spin_lock_irqsave(&rnp->lock, flags);
-                smp_mb__after_unlock_lock();
-                rcu_initiate_boost(rnp, flags); /* releases rnp->lock. */
-        }
 }
 /*
@@ -2569,7 +2709,7 @@ static void rcu_process_callbacks(struct softirq_action *unused)
 * Schedule RCU callback invocation.  If the specified type of RCU
 * does not support RCU priority boosting, just do a direct call,
 * otherwise wake up the per-CPU kernel kthread.  Note that because we
- * are running on the current CPU with interrupts disabled, the
+ * are running on the current CPU with softirqs disabled, the
 * rcu_cpu_kthread_task cannot disappear out from under us.
 */
 static void invoke_rcu_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
@@ -3109,9 +3249,12 @@ static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp)
        /* Is the RCU core waiting for a quiescent state from this CPU? */
        if (rcu_scheduler_fully_active &&
-            rdp->qs_pending && !rdp->passed_quiesce) {
+            rdp->qs_pending && !rdp->passed_quiesce &&
+            rdp->rcu_qs_ctr_snap == __this_cpu_read(rcu_qs_ctr)) {
                rdp->n_rp_qs_pending++;
-        } else if (rdp->qs_pending && rdp->passed_quiesce) {
+        } else if (rdp->qs_pending &&
+                   (rdp->passed_quiesce ||
+                    rdp->rcu_qs_ctr_snap != __this_cpu_read(rcu_qs_ctr))) {
                rdp->n_rp_report_qs++;
                return 1;
        }
@@ -3135,7 +3278,8 @@ static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp)
        }
        /* Has a new RCU grace period started? */
-        if (ACCESS_ONCE(rnp->gpnum) != rdp->gpnum) { /* outside lock */
+        if (ACCESS_ONCE(rnp->gpnum) != rdp->gpnum ||
+            unlikely(ACCESS_ONCE(rdp->gpwrap))) { /* outside lock */
                rdp->n_rp_gp_started++;
                return 1;
        }
@@ -3318,6 +3462,7 @@ static void _rcu_barrier(struct rcu_state *rsp)
                        } else {
                                _rcu_barrier_trace(rsp, "OnlineNoCB", cpu,
                                                   rsp->n_barrier_done);
+                                smp_mb__before_atomic();
                                atomic_inc(&rsp->barrier_cpu_count);
                                __call_rcu(&rdp->barrier_head,
                                           rcu_barrier_callback, rsp, cpu, 0);
@@ -3385,9 +3530,6 @@ rcu_boot_init_percpu_data(int cpu, struct rcu_state *rsp)
        /* Set up local state, ensuring consistent view of global state. */
        raw_spin_lock_irqsave(&rnp->lock, flags);
        rdp->grpmask = 1UL << (cpu - rdp->mynode->grplo);
-        init_callback_list(rdp);
-        rdp->qlen_lazy = 0;
-        ACCESS_ONCE(rdp->qlen) = 0;
        rdp->dynticks = &per_cpu(rcu_dynticks, cpu);
        WARN_ON_ONCE(rdp->dynticks->dynticks_nesting != DYNTICK_TASK_EXIT_IDLE);
        WARN_ON_ONCE(atomic_read(&rdp->dynticks->dynticks) != 1);
@@ -3444,6 +3586,7 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp)
                        rdp->gpnum = rnp->completed;
                        rdp->completed = rnp->completed;
                        rdp->passed_quiesce = 0;
+                        rdp->rcu_qs_ctr_snap = __this_cpu_read(rcu_qs_ctr);
                        rdp->qs_pending = 0;
                        trace_rcu_grace_period(rsp->name, rdp->gpnum, TPS("cpuonl"));
                }
@@ -3535,17 +3678,35 @@ static int rcu_pm_notify(struct notifier_block *self,
 static int __init rcu_spawn_gp_kthread(void)
 {
        unsigned long flags;
+        int kthread_prio_in = kthread_prio;
        struct rcu_node *rnp;
        struct rcu_state *rsp;
+        struct sched_param sp;
        struct task_struct *t;
+        /* Force priority into range. */
+        if (IS_ENABLED(CONFIG_RCU_BOOST) && kthread_prio < 1)
+                kthread_prio = 1;
+        else if (kthread_prio < 0)
+                kthread_prio = 0;
+        else if (kthread_prio > 99)
+                kthread_prio = 99;
+        if (kthread_prio != kthread_prio_in)
+                pr_alert("rcu_spawn_gp_kthread(): Limited prio to %d from %d\n",
+                         kthread_prio, kthread_prio_in);
        rcu_scheduler_fully_active = 1;
        for_each_rcu_flavor(rsp) {
-                t = kthread_run(rcu_gp_kthread, rsp, "%s", rsp->name);
+                t = kthread_create(rcu_gp_kthread, rsp, "%s", rsp->name);
                BUG_ON(IS_ERR(t));
                rnp = rcu_get_root(rsp);
                raw_spin_lock_irqsave(&rnp->lock, flags);
                rsp->gp_kthread = t;
+                if (kthread_prio) {
+                        sp.sched_priority = kthread_prio;
+                        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
+                }
+                wake_up_process(t);
                raw_spin_unlock_irqrestore(&rnp->lock, flags);
        }
        rcu_spawn_nocb_kthreads();
diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
index 8e7b1843896e..119de399eb2f 100644
--- a/kernel/rcu/tree.h
+++ b/kernel/rcu/tree.h
@@ -27,7 +27,6 @@
 #include <linux/threads.h>
 #include <linux/cpumask.h>
 #include <linux/seqlock.h>
-#include <linux/irq_work.h>
 /*
 * Define shape of hierarchy based on NR_CPUS, CONFIG_RCU_FANOUT, and
@@ -172,11 +171,6 @@ struct rcu_node {
                                /*  queued on this rcu_node structure that */
                                /*  are blocking the current grace period, */
                                /*  there can be no such task. */
-        struct completion boost_completion;
-                                /* Used to ensure that the rt_mutex used */
-                                /*  to carry out the boosting is fully */
-                                /*  released with no future boostee accesses */
-                                /*  before that rt_mutex is re-initialized. */
        struct rt_mutex boost_mtx;
                                /* Used only for the priority-boosting */
                                /*  side effect, not as a lock. */
@@ -257,9 +251,12 @@ struct rcu_data {
                                        /*  in order to detect GP end. */
        unsigned long   gpnum;          /* Highest gp number that this CPU */
                                        /*  is aware of having started. */
+        unsigned long   rcu_qs_ctr_snap;/* Snapshot of rcu_qs_ctr to check */
+                                        /*  for rcu_all_qs() invocations. */
        bool            passed_quiesce; /* User-mode/idle loop etc. */
        bool            qs_pending;     /* Core waits for quiesc state. */
        bool            beenonline;     /* CPU online at least once. */
+        bool            gpwrap;         /* Possible gpnum/completed wrap. */
        struct rcu_node *mynode;        /* This CPU's leaf of hierarchy */
        unsigned long grpmask;          /* Mask to apply to leaf qsmask. */
 #ifdef CONFIG_RCU_CPU_STALL_INFO
@@ -340,14 +337,10 @@ struct rcu_data {
 #ifdef CONFIG_RCU_NOCB_CPU
        struct rcu_head *nocb_head;     /* CBs waiting for kthread. */
        struct rcu_head **nocb_tail;
-        atomic_long_t nocb_q_count;     /* # CBs waiting for kthread */
+        atomic_long_t nocb_q_count;     /* # CBs waiting for nocb */
-        atomic_long_t nocb_q_count_lazy; /*  (approximate). */
+        atomic_long_t nocb_q_count_lazy; /*  invocation (all stages). */
        struct rcu_head *nocb_follower_head; /* CBs ready to invoke. */
        struct rcu_head **nocb_follower_tail;
-        atomic_long_t nocb_follower_count; /* # CBs ready to invoke. */
-        atomic_long_t nocb_follower_count_lazy; /*  (approximate). */
-        int nocb_p_count;               /* # CBs being invoked by kthread */
-        int nocb_p_count_lazy;          /*  (approximate). */
        wait_queue_head_t nocb_wq;      /* For nocb kthreads to sleep on. */
        struct task_struct *nocb_kthread;
        int nocb_defer_wakeup;          /* Defer wakeup of nocb_kthread. */
@@ -356,8 +349,6 @@ struct rcu_data {
        struct rcu_head *nocb_gp_head ____cacheline_internodealigned_in_smp;
                                        /* CBs waiting for GP. */
        struct rcu_head **nocb_gp_tail;
-        long nocb_gp_count;
-        long nocb_gp_count_lazy;
        bool nocb_leader_sleep;         /* Is the nocb leader thread asleep? */
        struct rcu_data *nocb_next_follower;
                                        /* Next follower in wakeup chain. */
@@ -488,10 +479,14 @@ struct rcu_state {
                                                /*  due to no GP active. */
        unsigned long gp_start;                 /* Time at which GP started, */
                                                /*  but in jiffies. */
+        unsigned long gp_activity;              /* Time of last GP kthread */
+                                                /*  activity in jiffies. */
        unsigned long jiffies_stall;            /* Time at which to check */
                                                /*  for CPU stalls. */
        unsigned long jiffies_resched;          /* Time at which to resched */
                                                /*  a reluctant CPU. */
+        unsigned long n_force_qs_gpstart;       /* Snapshot of n_force_qs at */
+                                                /*  GP start. */
        unsigned long gp_max;                   /* Maximum GP duration in */
                                                /*  jiffies. */
        const char *name;                       /* Name of structure. */
@@ -514,13 +509,6 @@ extern struct list_head rcu_struct_flavors;
 #define for_each_rcu_flavor(rsp) \
        list_for_each_entry((rsp), &rcu_struct_flavors, flavors)
-/* Return values for rcu_preempt_offline_tasks(). */
-#define RCU_OFL_TASKS_NORM_GP   0x1             /* Tasks blocking normal */
-                                                /*  GP were moved to root. */
-#define RCU_OFL_TASKS_EXP_GP    0x2             /* Tasks blocking expedited */
-                                                /*  GP were moved to root. */
 /*
 * RCU implementation internal declarations:
 */
@@ -546,27 +534,16 @@ DECLARE_PER_CPU(char, rcu_cpu_has_work);
 /* Forward declarations for rcutree_plugin.h */
 static void rcu_bootup_announce(void);
-long rcu_batches_completed(void);
 static void rcu_preempt_note_context_switch(void);
 static int rcu_preempt_blocked_readers_cgp(struct rcu_node *rnp);
 #ifdef CONFIG_HOTPLUG_CPU
-static void rcu_report_unblock_qs_rnp(struct rcu_node *rnp,
+static bool rcu_preempt_has_tasks(struct rcu_node *rnp);
-                                      unsigned long flags);
 #endif /* #ifdef CONFIG_HOTPLUG_CPU */
 static void rcu_print_detail_task_stall(struct rcu_state *rsp);
 static int rcu_print_task_stall(struct rcu_node *rnp);
 static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp);
-#ifdef CONFIG_HOTPLUG_CPU
-static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
-                                     struct rcu_node *rnp,
-                                     struct rcu_data *rdp);
-#endif /* #ifdef CONFIG_HOTPLUG_CPU */
 static void rcu_preempt_check_callbacks(void);
 void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu));
-#if defined(CONFIG_HOTPLUG_CPU) || defined(CONFIG_PREEMPT_RCU)
-static void rcu_report_exp_rnp(struct rcu_state *rsp, struct rcu_node *rnp,
-                               bool wake);
-#endif /* #if defined(CONFIG_HOTPLUG_CPU) || defined(CONFIG_PREEMPT_RCU) */
 static void __init __rcu_init_preempt(void);
 static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags);
 static void rcu_preempt_boost_start_gp(struct rcu_node *rnp);
@@ -622,24 +599,15 @@ static void rcu_dynticks_task_exit(void);
 #endif /* #ifndef RCU_TREE_NONCORE */
 #ifdef CONFIG_RCU_TRACE
-#ifdef CONFIG_RCU_NOCB_CPU
+/* Read out queue lengths for tracing. */
-/* Sum up queue lengths for tracing. */
 static inline void rcu_nocb_q_lengths(struct rcu_data *rdp, long *ql, long *qll)
 {
-        *ql = atomic_long_read(&rdp->nocb_q_count) +
+#ifdef CONFIG_RCU_NOCB_CPU
-              rdp->nocb_p_count +
+        *ql = atomic_long_read(&rdp->nocb_q_count);
-              atomic_long_read(&rdp->nocb_follower_count) +
+        *qll = atomic_long_read(&rdp->nocb_q_count_lazy);
-              rdp->nocb_p_count + rdp->nocb_gp_count;
-        *qll = atomic_long_read(&rdp->nocb_q_count_lazy) +
-               rdp->nocb_p_count_lazy +
-               atomic_long_read(&rdp->nocb_follower_count_lazy) +
-               rdp->nocb_p_count_lazy + rdp->nocb_gp_count_lazy;
-}
 #else /* #ifdef CONFIG_RCU_NOCB_CPU */
-static inline void rcu_nocb_q_lengths(struct rcu_data *rdp, long *ql, long *qll)
-{
        *ql = 0;
        *qll = 0;
-}
 #endif /* #else #ifdef CONFIG_RCU_NOCB_CPU */
+}
 #endif /* #ifdef CONFIG_RCU_TRACE */
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 3ec85cb5d544..2e850a51bb8f 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -34,10 +34,6 @@
 #include "../locking/rtmutex_common.h"
-/* rcuc/rcub kthread realtime priority */
-static int kthread_prio = CONFIG_RCU_KTHREAD_PRIO;
-module_param(kthread_prio, int, 0644);
 /*
 * Control variables for per-CPU and per-rcu_node kthreads.  These
 * handle all flavors of RCU.
@@ -103,6 +99,8 @@ RCU_STATE_INITIALIZER(rcu_preempt, 'p', call_rcu);
 static struct rcu_state *rcu_state_p = &rcu_preempt_state;
 static int rcu_preempted_readers_exp(struct rcu_node *rnp);
+static void rcu_report_exp_rnp(struct rcu_state *rsp, struct rcu_node *rnp,
+                               bool wake);
 /*
 * Tell them what RCU they are running.
@@ -114,25 +112,6 @@ static void __init rcu_bootup_announce(void)
 }
 /*
- * Return the number of RCU-preempt batches processed thus far
- * for debug and statistics.
- */
-static long rcu_batches_completed_preempt(void)
-{
-        return rcu_preempt_state.completed;
-}
-EXPORT_SYMBOL_GPL(rcu_batches_completed_preempt);
-/*
- * Return the number of RCU batches processed thus far for debug & stats.
- */
-long rcu_batches_completed(void)
-{
-        return rcu_batches_completed_preempt();
-}
-EXPORT_SYMBOL_GPL(rcu_batches_completed);
-/*
 * Record a preemptible-RCU quiescent state for the specified CPU.  Note
 * that this just means that the task currently running on the CPU is
 * not in a quiescent state.  There might be any number of tasks blocked
@@ -307,15 +286,25 @@ static struct list_head *rcu_next_node_entry(struct task_struct *t,
 }
 /*
+ * Return true if the specified rcu_node structure has tasks that were
+ * preempted within an RCU read-side critical section.
+ */
+static bool rcu_preempt_has_tasks(struct rcu_node *rnp)
+{
+        return !list_empty(&rnp->blkd_tasks);
+}
+/*
 * Handle special cases during rcu_read_unlock(), such as needing to
 * notify RCU core processing or task having blocked during the RCU
 * read-side critical section.
 */
 void rcu_read_unlock_special(struct task_struct *t)
 {
-        int empty;
+        bool empty;
-        int empty_exp;
+        bool empty_exp;
-        int empty_exp_now;
+        bool empty_norm;
+        bool empty_exp_now;
        unsigned long flags;
        struct list_head *np;
 #ifdef CONFIG_RCU_BOOST
@@ -367,7 +356,8 @@ void rcu_read_unlock_special(struct task_struct *t)
                                break;
                        raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */
                }
-                empty = !rcu_preempt_blocked_readers_cgp(rnp);
+                empty = !rcu_preempt_has_tasks(rnp);
+                empty_norm = !rcu_preempt_blocked_readers_cgp(rnp);
                empty_exp = !rcu_preempted_readers_exp(rnp);
                smp_mb(); /* ensure expedited fastpath sees end of RCU c-s. */
                np = rcu_next_node_entry(t, rnp);
@@ -387,13 +377,21 @@ void rcu_read_unlock_special(struct task_struct *t)
 #endif /* #ifdef CONFIG_RCU_BOOST */
                /*
+                 * If this was the last task on the list, go see if we
+                 * need to propagate ->qsmaskinit bit clearing up the
+                 * rcu_node tree.
+                 */
+                if (!empty && !rcu_preempt_has_tasks(rnp))
+                        rcu_cleanup_dead_rnp(rnp);
+                /*
                 * If this was the last task on the current list, and if
                 * we aren't waiting on any CPUs, report the quiescent state.
                 * Note that rcu_report_unblock_qs_rnp() releases rnp->lock,
                 * so we must take a snapshot of the expedited state.
                 */
                empty_exp_now = !rcu_preempted_readers_exp(rnp);
-                if (!empty && !rcu_preempt_blocked_readers_cgp(rnp)) {
+                if (!empty_norm && !rcu_preempt_blocked_readers_cgp(rnp)) {
                        trace_rcu_quiescent_state_report(TPS("preempt_rcu"),
                                                         rnp->gpnum,
                                                         0, rnp->qsmask,
@@ -408,10 +406,8 @@ void rcu_read_unlock_special(struct task_struct *t)
 #ifdef CONFIG_RCU_BOOST
                /* Unboost if we were boosted. */
-                if (drop_boost_mutex) {
+                if (drop_boost_mutex)
                        rt_mutex_unlock(&rnp->boost_mtx);
-                        complete(&rnp->boost_completion);
-                }
 #endif /* #ifdef CONFIG_RCU_BOOST */
                /*
@@ -519,99 +515,13 @@ static int rcu_print_task_stall(struct rcu_node *rnp)
 static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
 {
        WARN_ON_ONCE(rcu_preempt_blocked_readers_cgp(rnp));
-        if (!list_empty(&rnp->blkd_tasks))
+        if (rcu_preempt_has_tasks(rnp))
                rnp->gp_tasks = rnp->blkd_tasks.next;
        WARN_ON_ONCE(rnp->qsmask);
 }
 #ifdef CONFIG_HOTPLUG_CPU
-/*
- * Handle tasklist migration for case in which all CPUs covered by the
- * specified rcu_node have gone offline.  Move them up to the root
- * rcu_node.  The reason for not just moving them to the immediate
- * parent is to remove the need for rcu_read_unlock_special() to
- * make more than two attempts to acquire the target rcu_node's lock.
- * Returns true if there were tasks blocking the current RCU grace
- * period.
- *
- * Returns 1 if there was previously a task blocking the current grace
- * period on the specified rcu_node structure.
- *
- * The caller must hold rnp->lock with irqs disabled.
- */
-static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
-                                     struct rcu_node *rnp,
-                                     struct rcu_data *rdp)
-{
-        struct list_head *lp;
-        struct list_head *lp_root;
-        int retval = 0;
-        struct rcu_node *rnp_root = rcu_get_root(rsp);
-        struct task_struct *t;
-        if (rnp == rnp_root) {
-                WARN_ONCE(1, "Last CPU thought to be offlined?");
-                return 0;  /* Shouldn't happen: at least one CPU online. */
-        }
-        /* If we are on an internal node, complain bitterly. */
-        WARN_ON_ONCE(rnp != rdp->mynode);
-        /*
-         * Move tasks up to root rcu_node.  Don't try to get fancy for
-         * this corner-case operation -- just put this node's tasks
-         * at the head of the root node's list, and update the root node's
-         * ->gp_tasks and ->exp_tasks pointers to those of this node's,
-         * if non-NULL.  This might result in waiting for more tasks than
-         * absolutely necessary, but this is a good performance/complexity
-         * tradeoff.
-         */
-        if (rcu_preempt_blocked_readers_cgp(rnp) && rnp->qsmask == 0)
-                retval |= RCU_OFL_TASKS_NORM_GP;
-        if (rcu_preempted_readers_exp(rnp))
-                retval |= RCU_OFL_TASKS_EXP_GP;
-        lp = &rnp->blkd_tasks;
-        lp_root = &rnp_root->blkd_tasks;
-        while (!list_empty(lp)) {
-                t = list_entry(lp->next, typeof(*t), rcu_node_entry);
-                raw_spin_lock(&rnp_root->lock); /* irqs already disabled */
-                smp_mb__after_unlock_lock();
-                list_del(&t->rcu_node_entry);
-                t->rcu_blocked_node = rnp_root;
-                list_add(&t->rcu_node_entry, lp_root);
-                if (&t->rcu_node_entry == rnp->gp_tasks)
-                        rnp_root->gp_tasks = rnp->gp_tasks;
-                if (&t->rcu_node_entry == rnp->exp_tasks)
-                        rnp_root->exp_tasks = rnp->exp_tasks;
-#ifdef CONFIG_RCU_BOOST
-                if (&t->rcu_node_entry == rnp->boost_tasks)
-                        rnp_root->boost_tasks = rnp->boost_tasks;
-#endif /* #ifdef CONFIG_RCU_BOOST */
-                raw_spin_unlock(&rnp_root->lock); /* irqs still disabled */
-        }
-        rnp->gp_tasks = NULL;
-        rnp->exp_tasks = NULL;
-#ifdef CONFIG_RCU_BOOST
-        rnp->boost_tasks = NULL;
-        /*
-         * In case root is being boosted and leaf was not.  Make sure
-         * that we boost the tasks blocking the current grace period
-         * in this case.
-         */
-        raw_spin_lock(&rnp_root->lock); /* irqs already disabled */
-        smp_mb__after_unlock_lock();
-        if (rnp_root->boost_tasks != NULL &&
-            rnp_root->boost_tasks != rnp_root->gp_tasks &&
-            rnp_root->boost_tasks != rnp_root->exp_tasks)
-                rnp_root->boost_tasks = rnp_root->gp_tasks;
-        raw_spin_unlock(&rnp_root->lock); /* irqs still disabled */
-#endif /* #ifdef CONFIG_RCU_BOOST */
-        return retval;
-}
 #endif /* #ifdef CONFIG_HOTPLUG_CPU */
 /*
@@ -771,7 +681,7 @@ sync_rcu_preempt_exp_init(struct rcu_state *rsp, struct rcu_node *rnp)
        raw_spin_lock_irqsave(&rnp->lock, flags);
        smp_mb__after_unlock_lock();
-        if (list_empty(&rnp->blkd_tasks)) {
+        if (!rcu_preempt_has_tasks(rnp)) {
                raw_spin_unlock_irqrestore(&rnp->lock, flags);
        } else {
                rnp->exp_tasks = rnp->blkd_tasks.next;
@@ -933,15 +843,6 @@ static void __init rcu_bootup_announce(void)
 }
 /*
- * Return the number of RCU batches processed thus far for debug & stats.
- */
-long rcu_batches_completed(void)
-{
-        return rcu_batches_completed_sched();
-}
-EXPORT_SYMBOL_GPL(rcu_batches_completed);
-/*
 * Because preemptible RCU does not exist, we never have to check for
 * CPUs being in quiescent states.
 */
@@ -960,11 +861,12 @@ static int rcu_preempt_blocked_readers_cgp(struct rcu_node *rnp)
 #ifdef CONFIG_HOTPLUG_CPU
-/* Because preemptible RCU does not exist, no quieting of tasks. */
+/*
-static void rcu_report_unblock_qs_rnp(struct rcu_node *rnp, unsigned long flags)
+ * Because there is no preemptible RCU, there can be no readers blocked.
-        __releases(rnp->lock)
+ */
+static bool rcu_preempt_has_tasks(struct rcu_node *rnp)
 {
-        raw_spin_unlock_irqrestore(&rnp->lock, flags);
+        return false;
 }
 #endif /* #ifdef CONFIG_HOTPLUG_CPU */
@@ -996,23 +898,6 @@ static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
        WARN_ON_ONCE(rnp->qsmask);
 }
-#ifdef CONFIG_HOTPLUG_CPU
-/*
- * Because preemptible RCU does not exist, it never needs to migrate
- * tasks that were blocked within RCU read-side critical sections, and
- * such non-existent tasks cannot possibly have been blocking the current
- * grace period.
- */
-static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
-                                     struct rcu_node *rnp,
-                                     struct rcu_data *rdp)
-{
-        return 0;
-}
-#endif /* #ifdef CONFIG_HOTPLUG_CPU */
 /*
 * Because preemptible RCU does not exist, it never has any callbacks
 * to check.
@@ -1031,20 +916,6 @@ void synchronize_rcu_expedited(void)
 }
 EXPORT_SYMBOL_GPL(synchronize_rcu_expedited);
-#ifdef CONFIG_HOTPLUG_CPU
-/*
- * Because preemptible RCU does not exist, there is never any need to
- * report on tasks preempted in RCU read-side critical sections during
- * expedited RCU grace periods.
- */
-static void rcu_report_exp_rnp(struct rcu_state *rsp, struct rcu_node *rnp,
-                               bool wake)
-{
-}
-#endif /* #ifdef CONFIG_HOTPLUG_CPU */
 /*
 * Because preemptible RCU does not exist, rcu_barrier() is just
 * another name for rcu_barrier_sched().
@@ -1080,7 +951,7 @@ void exit_rcu(void)
 static void rcu_initiate_boost_trace(struct rcu_node *rnp)
 {
-        if (list_empty(&rnp->blkd_tasks))
+        if (!rcu_preempt_has_tasks(rnp))
                rnp->n_balk_blkd_tasks++;
        else if (rnp->exp_tasks == NULL && rnp->gp_tasks == NULL)
                rnp->n_balk_exp_gp_tasks++;
@@ -1127,7 +998,8 @@ static int rcu_boost(struct rcu_node *rnp)
        struct task_struct *t;
        struct list_head *tb;
-        if (rnp->exp_tasks == NULL && rnp->boost_tasks == NULL)
+        if (ACCESS_ONCE(rnp->exp_tasks) == NULL &&
+            ACCESS_ONCE(rnp->boost_tasks) == NULL)
                return 0;  /* Nothing left to boost. */
        raw_spin_lock_irqsave(&rnp->lock, flags);
@@ -1175,15 +1047,11 @@ static int rcu_boost(struct rcu_node *rnp)
         */
        t = container_of(tb, struct task_struct, rcu_node_entry);
        rt_mutex_init_proxy_locked(&rnp->boost_mtx, t);
-        init_completion(&rnp->boost_completion);
        raw_spin_unlock_irqrestore(&rnp->lock, flags);
        /* Lock only for side effect: boosts task t's priority. */
        rt_mutex_lock(&rnp->boost_mtx);
        rt_mutex_unlock(&rnp->boost_mtx);  /* Then keep lockdep happy. */
-        /* Wait for boostee to be done w/boost_mtx before reinitializing. */
-        wait_for_completion(&rnp->boost_completion);
        return ACCESS_ONCE(rnp->exp_tasks) != NULL ||
               ACCESS_ONCE(rnp->boost_tasks) != NULL;
 }
@@ -1416,12 +1284,8 @@ static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
        for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++, mask >>= 1)
                if ((mask & 0x1) && cpu != outgoingcpu)
                        cpumask_set_cpu(cpu, cm);
-        if (cpumask_weight(cm) == 0) {
+        if (cpumask_weight(cm) == 0)
                cpumask_setall(cm);
-                for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++)
-                        cpumask_clear_cpu(cpu, cm);
-                WARN_ON_ONCE(cpumask_weight(cm) == 0);
-        }
        set_cpus_allowed_ptr(t, cm);
        free_cpumask_var(cm);
 }
@@ -1446,12 +1310,8 @@ static void __init rcu_spawn_boost_kthreads(void)
        for_each_possible_cpu(cpu)
                per_cpu(rcu_cpu_has_work, cpu) = 0;
        BUG_ON(smpboot_register_percpu_thread(&rcu_cpu_thread_spec));
-        rnp = rcu_get_root(rcu_state_p);
+        rcu_for_each_leaf_node(rcu_state_p, rnp)
-        (void)rcu_spawn_one_boost_kthread(rcu_state_p, rnp);
+                (void)rcu_spawn_one_boost_kthread(rcu_state_p, rnp);
-        if (NUM_RCU_NODES > 1) {
-                rcu_for_each_leaf_node(rcu_state_p, rnp)
-                        (void)rcu_spawn_one_boost_kthread(rcu_state_p, rnp);
-        }
 }
 static void rcu_prepare_kthreads(int cpu)
@@ -1605,7 +1465,8 @@ static bool __maybe_unused rcu_try_advance_all_cbs(void)
                 * completed since we last checked and there are
                 * callbacks not yet ready to invoke.
                 */
-                if (rdp->completed != rnp->completed &&
+                if ((rdp->completed != rnp->completed ||
+                     unlikely(ACCESS_ONCE(rdp->gpwrap))) &&
                    rdp->nxttail[RCU_DONE_TAIL] != rdp->nxttail[RCU_NEXT_TAIL])
                        note_gp_changes(rsp, rdp);
@@ -1898,11 +1759,12 @@ static void print_cpu_stall_info(struct rcu_state *rsp, int cpu)
                ticks_value = rsp->gpnum - rdp->gpnum;
        }
        print_cpu_stall_fast_no_hz(fast_no_hz, cpu);
-        pr_err("\t%d: (%lu %s) idle=%03x/%llx/%d softirq=%u/%u %s\n",
+        pr_err("\t%d: (%lu %s) idle=%03x/%llx/%d softirq=%u/%u fqs=%ld %s\n",
               cpu, ticks_value, ticks_title,
               atomic_read(&rdtp->dynticks) & 0xfff,
               rdtp->dynticks_nesting, rdtp->dynticks_nmi_nesting,
               rdp->softirq_snap, kstat_softirqs_cpu(RCU_SOFTIRQ, cpu),
+               ACCESS_ONCE(rsp->n_force_qs) - rsp->n_force_qs_gpstart,
               fast_no_hz);
 }
@@ -2056,9 +1918,26 @@ static void wake_nocb_leader(struct rcu_data *rdp, bool force)
 static bool rcu_nocb_cpu_needs_barrier(struct rcu_state *rsp, int cpu)
 {
        struct rcu_data *rdp = per_cpu_ptr(rsp->rda, cpu);
+        unsigned long ret;
+#ifdef CONFIG_PROVE_RCU
        struct rcu_head *rhp;
+#endif /* #ifdef CONFIG_PROVE_RCU */
-        /* No-CBs CPUs might have callbacks on any of three lists. */
+        /*
+         * Check count of all no-CBs callbacks awaiting invocation.
+         * There needs to be a barrier before this function is called,
+         * but associated with a prior determination that no more
+         * callbacks would be posted.  In the worst case, the first
+         * barrier in _rcu_barrier() suffices (but the caller cannot
+         * necessarily rely on this, not a substitute for the caller
+         * getting the concurrency design right!).  There must also be
+         * a barrier between the following load an posting of a callback
+         * (if a callback is in fact needed).  This is associated with an
+         * atomic_inc() in the caller.
+         */
+        ret = atomic_long_read(&rdp->nocb_q_count);
+#ifdef CONFIG_PROVE_RCU
        rhp = ACCESS_ONCE(rdp->nocb_head);
        if (!rhp)
                rhp = ACCESS_ONCE(rdp->nocb_gp_head);
@@ -2072,8 +1951,9 @@ static bool rcu_nocb_cpu_needs_barrier(struct rcu_state *rsp, int cpu)
                       cpu, rhp->func);
                WARN_ON_ONCE(1);
        }
+#endif /* #ifdef CONFIG_PROVE_RCU */
-        return !!rhp;
+        return !!ret;
 }
 /*
@@ -2095,9 +1975,10 @@ static void __call_rcu_nocb_enqueue(struct rcu_data *rdp,
        struct task_struct *t;
        /* Enqueue the callback on the nocb list and update counts. */
+        atomic_long_add(rhcount, &rdp->nocb_q_count);
+        /* rcu_barrier() relies on ->nocb_q_count add before xchg. */
        old_rhpp = xchg(&rdp->nocb_tail, rhtp);
        ACCESS_ONCE(*old_rhpp) = rhp;
-        atomic_long_add(rhcount, &rdp->nocb_q_count);
        atomic_long_add(rhcount_lazy, &rdp->nocb_q_count_lazy);
        smp_mb__after_atomic(); /* Store *old_rhpp before _wake test. */
@@ -2288,9 +2169,6 @@ wait_again:
                /* Move callbacks to wait-for-GP list, which is empty. */
                ACCESS_ONCE(rdp->nocb_head) = NULL;
                rdp->nocb_gp_tail = xchg(&rdp->nocb_tail, &rdp->nocb_head);
-                rdp->nocb_gp_count = atomic_long_xchg(&rdp->nocb_q_count, 0);
-                rdp->nocb_gp_count_lazy =
-                        atomic_long_xchg(&rdp->nocb_q_count_lazy, 0);
                gotcbs = true;
        }
@@ -2338,9 +2216,6 @@ wait_again:
                /* Append callbacks to follower's "done" list. */
                tail = xchg(&rdp->nocb_follower_tail, rdp->nocb_gp_tail);
                *tail = rdp->nocb_gp_head;
-                atomic_long_add(rdp->nocb_gp_count, &rdp->nocb_follower_count);
-                atomic_long_add(rdp->nocb_gp_count_lazy,
-                                &rdp->nocb_follower_count_lazy);
                smp_mb__after_atomic(); /* Store *tail before wakeup. */
                if (rdp != my_rdp && tail == &rdp->nocb_follower_head) {
                        /*
@@ -2415,13 +2290,11 @@ static int rcu_nocb_kthread(void *arg)
                trace_rcu_nocb_wake(rdp->rsp->name, rdp->cpu, "WokeNonEmpty");
                ACCESS_ONCE(rdp->nocb_follower_head) = NULL;
                tail = xchg(&rdp->nocb_follower_tail, &rdp->nocb_follower_head);
-                c = atomic_long_xchg(&rdp->nocb_follower_count, 0);
-                cl = atomic_long_xchg(&rdp->nocb_follower_count_lazy, 0);
-                rdp->nocb_p_count += c;
-                rdp->nocb_p_count_lazy += cl;
                /* Each pass through the following loop invokes a callback. */
-                trace_rcu_batch_start(rdp->rsp->name, cl, c, -1);
+                trace_rcu_batch_start(rdp->rsp->name,
+                                      atomic_long_read(&rdp->nocb_q_count_lazy),
+                                      atomic_long_read(&rdp->nocb_q_count), -1);
                c = cl = 0;
                while (list) {
                        next = list->next;
@@ -2443,9 +2316,9 @@ static int rcu_nocb_kthread(void *arg)
                        list = next;
                }
                trace_rcu_batch_end(rdp->rsp->name, c, !!list, 0, 0, 1);
-                ACCESS_ONCE(rdp->nocb_p_count) = rdp->nocb_p_count - c;
+                smp_mb__before_atomic();  /* _add after CB invocation. */
-                ACCESS_ONCE(rdp->nocb_p_count_lazy) =
+                atomic_long_add(-c, &rdp->nocb_q_count);
-                                                rdp->nocb_p_count_lazy - cl;
+                atomic_long_add(-cl, &rdp->nocb_q_count_lazy);
                rdp->n_nocbs_invoked += c;
        }
        return 0;
diff --git a/kernel/rcu/tree_trace.c b/kernel/rcu/tree_trace.c
index 5cdc62e1beeb..fbb6240509ea 100644
--- a/kernel/rcu/tree_trace.c
+++ b/kernel/rcu/tree_trace.c
@@ -46,6 +46,8 @@
 #define RCU_TREE_NONCORE
 #include "tree.h"
+DECLARE_PER_CPU_SHARED_ALIGNED(unsigned long, rcu_qs_ctr);
 static int r_open(struct inode *inode, struct file *file,
                                        const struct seq_operations *op)
 {
@@ -115,11 +117,13 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
        if (!rdp->beenonline)
                return;
-        seq_printf(m, "%3d%cc=%ld g=%ld pq=%d qp=%d",
+        seq_printf(m, "%3d%cc=%ld g=%ld pq=%d/%d qp=%d",
                   rdp->cpu,
                   cpu_is_offline(rdp->cpu) ? '!' : ' ',
                   ulong2long(rdp->completed), ulong2long(rdp->gpnum),
-                   rdp->passed_quiesce, rdp->qs_pending);
+                   rdp->passed_quiesce,
+                   rdp->rcu_qs_ctr_snap == per_cpu(rcu_qs_ctr, rdp->cpu),
+                   rdp->qs_pending);
        seq_printf(m, " dt=%d/%llx/%d df=%lu",
                   atomic_read(&rdp->dynticks->dynticks),
                   rdp->dynticks->dynticks_nesting,
diff --git a/kernel/sched/completion.c b/kernel/sched/completion.c
index 607f852b4d04..7052d3fd4e7b 100644
--- a/kernel/sched/completion.c
+++ b/kernel/sched/completion.c
@@ -268,6 +268,15 @@ bool try_wait_for_completion(struct completion *x)
        unsigned long flags;
        int ret = 1;
+        /*
+         * Since x->done will need to be locked only
+         * in the non-blocking case, we check x->done
+         * first without taking the lock so we can
+         * return early in the blocking case.
+         */
+        if (!ACCESS_ONCE(x->done))
+                return 0;
        spin_lock_irqsave(&x->wait.lock, flags);
        if (!x->done)
                ret = 0;
@@ -288,13 +297,6 @@ EXPORT_SYMBOL(try_wait_for_completion);
 */
 bool completion_done(struct completion *x)
 {
-        unsigned long flags;
+        return !!ACCESS_ONCE(x->done);
-        int ret = 1;
-        spin_lock_irqsave(&x->wait.lock, flags);
-        if (!x->done)
-                ret = 0;
-        spin_unlock_irqrestore(&x->wait.lock, flags);
-        return ret;
 }
 EXPORT_SYMBOL(completion_done);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index b5797b78add6..1f37fe7f77a4 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -119,7 +119,9 @@ void update_rq_clock(struct rq *rq)
 {
        s64 delta;
-        if (rq->skip_clock_update > 0)
+        lockdep_assert_held(&rq->lock);
+        if (rq->clock_skip_update & RQCF_ACT_SKIP)
                return;
        delta = sched_clock_cpu(cpu_of(rq)) - rq->clock;
@@ -490,6 +492,11 @@ static __init void init_hrtick(void)
 */
 void hrtick_start(struct rq *rq, u64 delay)
 {
+        /*
+         * Don't schedule slices shorter than 10000ns, that just
+         * doesn't make sense. Rely on vruntime for fairness.
+         */
+        delay = max_t(u64, delay, 10000LL);
        __hrtimer_start_range_ns(&rq->hrtick_timer, ns_to_ktime(delay), 0,
                        HRTIMER_MODE_REL_PINNED, 0);
 }
@@ -1046,7 +1053,7 @@ void check_preempt_curr(struct rq *rq, struct task_struct *p, int flags)
         * this case, we can save a useless back to back clock update.
         */
        if (task_on_rq_queued(rq->curr) && test_tsk_need_resched(rq->curr))
-                rq->skip_clock_update = 1;
+                rq_clock_skip_update(rq, true);
 }
 #ifdef CONFIG_SMP
@@ -1082,7 +1089,7 @@ void set_task_cpu(struct task_struct *p, unsigned int new_cpu)
                if (p->sched_class->migrate_task_rq)
                        p->sched_class->migrate_task_rq(p, new_cpu);
                p->se.nr_migrations++;
-                perf_sw_event(PERF_COUNT_SW_CPU_MIGRATIONS, 1, NULL, 0);
+                perf_sw_event_sched(PERF_COUNT_SW_CPU_MIGRATIONS, 1, 0);
        }
        __set_task_cpu(p, new_cpu);
@@ -1814,6 +1821,10 @@ void __dl_clear_params(struct task_struct *p)
        dl_se->dl_period = 0;
        dl_se->flags = 0;
        dl_se->dl_bw = 0;
+        dl_se->dl_throttled = 0;
+        dl_se->dl_new = 1;
+        dl_se->dl_yielded = 0;
 }
 /*
@@ -1832,6 +1843,9 @@ static void __sched_fork(unsigned long clone_flags, struct task_struct *p)
        p->se.prev_sum_exec_runtime     = 0;
        p->se.nr_migrations             = 0;
        p->se.vruntime                  = 0;
+#ifdef CONFIG_SMP
+        p->se.avg.decay_count           = 0;
+#endif
        INIT_LIST_HEAD(&p->se.group_node);
 #ifdef CONFIG_SCHEDSTATS
@@ -1839,7 +1853,7 @@ static void __sched_fork(unsigned long clone_flags, struct task_struct *p)
 #endif
        RB_CLEAR_NODE(&p->dl.rb_node);
-        hrtimer_init(&p->dl.dl_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        init_dl_task_timer(&p->dl);
        __dl_clear_params(p);
        INIT_LIST_HEAD(&p->rt.run_list);
@@ -2049,6 +2063,9 @@ static inline int dl_bw_cpus(int i)
 * allocated bandwidth to reflect the new situation.
 *
 * This function is called while holding p's rq->lock.
+ *
+ * XXX we should delay bw change until the task's 0-lag point, see
+ * __setparam_dl().
 */
 static int dl_overflow(struct task_struct *p, int policy,
                       const struct sched_attr *attr)
@@ -2748,6 +2765,10 @@ again:
 *          - explicit schedule() call
 *          - return from syscall or exception to user-space
 *          - return from interrupt-handler to user-space
+ *
+ * WARNING: all callers must re-check need_resched() afterward and reschedule
+ * accordingly in case an event triggered the need for rescheduling (such as
+ * an interrupt waking up a task) while preemption was disabled in __schedule().
 */
 static void __sched __schedule(void)
 {
@@ -2756,7 +2777,6 @@ static void __sched __schedule(void)
        struct rq *rq;
        int cpu;
-need_resched:
        preempt_disable();
        cpu = smp_processor_id();
        rq = cpu_rq(cpu);
@@ -2776,6 +2796,8 @@ need_resched:
        smp_mb__before_spinlock();
        raw_spin_lock_irq(&rq->lock);
+        rq->clock_skip_update <<= 1; /* promote REQ to ACT */
        switch_count = &prev->nivcsw;
        if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {
                if (unlikely(signal_pending_state(prev->state, prev))) {
@@ -2800,13 +2822,13 @@ need_resched:
                switch_count = &prev->nvcsw;
        }
-        if (task_on_rq_queued(prev) || rq->skip_clock_update < 0)
+        if (task_on_rq_queued(prev))
                update_rq_clock(rq);
        next = pick_next_task(rq, prev);
        clear_tsk_need_resched(prev);
        clear_preempt_need_resched();
-        rq->skip_clock_update = 0;
+        rq->clock_skip_update = 0;
        if (likely(prev != next)) {
                rq->nr_switches++;
@@ -2821,8 +2843,6 @@ need_resched:
        post_schedule(rq);
        sched_preempt_enable_no_resched();
-        if (need_resched())
-                goto need_resched;
 }
 static inline void sched_submit_work(struct task_struct *tsk)
@@ -2842,7 +2862,9 @@ asmlinkage __visible void __sched schedule(void)
        struct task_struct *tsk = current;
        sched_submit_work(tsk);
-        __schedule();
+        do {
+                __schedule();
+        } while (need_resched());
 }
 EXPORT_SYMBOL(schedule);
@@ -2877,6 +2899,21 @@ void __sched schedule_preempt_disabled(void)
        preempt_disable();
 }
+static void preempt_schedule_common(void)
+{
+        do {
+                __preempt_count_add(PREEMPT_ACTIVE);
+                __schedule();
+                __preempt_count_sub(PREEMPT_ACTIVE);
+                /*
+                 * Check again in case we missed a preemption opportunity
+                 * between schedule and now.
+                 */
+                barrier();
+        } while (need_resched());
+}
 #ifdef CONFIG_PREEMPT
 /*
 * this is the entry point to schedule() from in-kernel preemption
@@ -2892,17 +2929,7 @@ asmlinkage __visible void __sched notrace preempt_schedule(void)
        if (likely(!preemptible()))
                return;
-        do {
+        preempt_schedule_common();
-                __preempt_count_add(PREEMPT_ACTIVE);
-                __schedule();
-                __preempt_count_sub(PREEMPT_ACTIVE);
-                /*
-                 * Check again in case we missed a preemption opportunity
-                 * between schedule and now.
-                 */
-                barrier();
-        } while (need_resched());
 }
 NOKPROBE_SYMBOL(preempt_schedule);
 EXPORT_SYMBOL(preempt_schedule);
@@ -3251,15 +3278,31 @@ __setparam_dl(struct task_struct *p, const struct sched_attr *attr)
 {
        struct sched_dl_entity *dl_se = &p->dl;
-        init_dl_task_timer(dl_se);
        dl_se->dl_runtime = attr->sched_runtime;
        dl_se->dl_deadline = attr->sched_deadline;
        dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline;
        dl_se->flags = attr->sched_flags;
        dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime);
-        dl_se->dl_throttled = 0;
-        dl_se->dl_new = 1;
+        /*
-        dl_se->dl_yielded = 0;
+         * Changing the parameters of a task is 'tricky' and we're not doing
+         * the correct thing -- also see task_dead_dl() and switched_from_dl().
+         *
+         * What we SHOULD do is delay the bandwidth release until the 0-lag
+         * point. This would include retaining the task_struct until that time
+         * and change dl_overflow() to not immediately decrement the current
+         * amount.
+         *
+         * Instead we retain the current runtime/deadline and let the new
+         * parameters take effect after the current reservation period lapses.
+         * This is safe (albeit pessimistic) because the 0-lag point is always
+         * before the current scheduling deadline.
+         *
+         * We can still have temporary overloads because we do not delay the
+         * change in bandwidth until that time; so admission control is
+         * not on the safe side. It does however guarantee tasks will never
+         * consume more than promised.
+         */
 }
 /*
@@ -3382,6 +3425,20 @@ static bool check_same_owner(struct task_struct *p)
        return match;
 }
+static bool dl_param_changed(struct task_struct *p,
+                const struct sched_attr *attr)
+{
+        struct sched_dl_entity *dl_se = &p->dl;
+        if (dl_se->dl_runtime != attr->sched_runtime ||
+                dl_se->dl_deadline != attr->sched_deadline ||
+                dl_se->dl_period != attr->sched_period ||
+                dl_se->flags != attr->sched_flags)
+                return true;
+        return false;
+}
 static int __sched_setscheduler(struct task_struct *p,
                                const struct sched_attr *attr,
                                bool user)
@@ -3510,7 +3567,7 @@ recheck:
                        goto change;
                if (rt_policy(policy) && attr->sched_priority != p->rt_priority)
                        goto change;
-                if (dl_policy(policy))
+                if (dl_policy(policy) && dl_param_changed(p, attr))
                        goto change;
                p->sched_reset_on_fork = reset_on_fork;
@@ -4202,17 +4259,10 @@ SYSCALL_DEFINE0(sched_yield)
        return 0;
 }
-static void __cond_resched(void)
-{
-        __preempt_count_add(PREEMPT_ACTIVE);
-        __schedule();
-        __preempt_count_sub(PREEMPT_ACTIVE);
-}
 int __sched _cond_resched(void)
 {
        if (should_resched()) {
-                __cond_resched();
+                preempt_schedule_common();
                return 1;
        }
        return 0;
@@ -4237,7 +4287,7 @@ int __cond_resched_lock(spinlock_t *lock)
        if (spin_needbreak(lock) || resched) {
                spin_unlock(lock);
                if (resched)
-                        __cond_resched();
+                        preempt_schedule_common();
                else
                        cpu_relax();
                ret = 1;
@@ -4253,7 +4303,7 @@ int __sched __cond_resched_softirq(void)
        if (should_resched()) {
                local_bh_enable();
-                __cond_resched();
+                preempt_schedule_common();
                local_bh_disable();
                return 1;
        }
@@ -4508,9 +4558,10 @@ void sched_show_task(struct task_struct *p)
 {
        unsigned long free = 0;
        int ppid;
-        unsigned state;
+        unsigned long state = p->state;
-        state = p->state ? __ffs(p->state) + 1 : 0;
+        if (state)
+                state = __ffs(state) + 1;
        printk(KERN_INFO "%-15.15s %c", p->comm,
                state < sizeof(stat_nam) - 1 ? stat_nam[state] : '?');
 #if BITS_PER_LONG == 32
@@ -4642,6 +4693,9 @@ int cpuset_cpumask_can_shrink(const struct cpumask *cur,
        struct dl_bw *cur_dl_b;
        unsigned long flags;
+        if (!cpumask_weight(cur))
+                return ret;
        rcu_read_lock_sched();
        cur_dl_b = dl_bw_of(cpumask_any(cur));
        trial_cpus = cpumask_weight(trial);
@@ -4740,7 +4794,7 @@ static struct rq *move_queued_task(struct task_struct *p, int new_cpu)
 void do_set_cpus_allowed(struct task_struct *p, const struct cpumask *new_mask)
 {
-        if (p->sched_class && p->sched_class->set_cpus_allowed)
+        if (p->sched_class->set_cpus_allowed)
                p->sched_class->set_cpus_allowed(p, new_mask);
        cpumask_copy(&p->cpus_allowed, new_mask);
@@ -7113,9 +7167,6 @@ void __init sched_init(void)
 #ifdef CONFIG_RT_GROUP_SCHED
        alloc_size += 2 * nr_cpu_ids * sizeof(void **);
 #endif
-#ifdef CONFIG_CPUMASK_OFFSTACK
-        alloc_size += num_possible_cpus() * cpumask_size();
-#endif
        if (alloc_size) {
                ptr = (unsigned long)kzalloc(alloc_size, GFP_NOWAIT);
@@ -7135,13 +7186,13 @@ void __init sched_init(void)
                ptr += nr_cpu_ids * sizeof(void **);
 #endif /* CONFIG_RT_GROUP_SCHED */
+        }
 #ifdef CONFIG_CPUMASK_OFFSTACK
-                for_each_possible_cpu(i) {
+        for_each_possible_cpu(i) {
-                        per_cpu(load_balance_mask, i) = (void *)ptr;
+                per_cpu(load_balance_mask, i) = (cpumask_var_t)kzalloc_node(
-                        ptr += cpumask_size();
+                        cpumask_size(), GFP_KERNEL, cpu_to_node(i));
-                }
-#endif /* CONFIG_CPUMASK_OFFSTACK */
        }
+#endif /* CONFIG_CPUMASK_OFFSTACK */
        init_rt_bandwidth(&def_rt_bandwidth,
                        global_rt_period(), global_rt_runtime());
@@ -7253,6 +7304,11 @@ void __init sched_init(void)
        enter_lazy_tlb(&init_mm, current);
        /*
+         * During early bootup we pretend to be a normal task:
+         */
+        current->sched_class = &fair_sched_class;
+        /*
         * Make us the idle thread. Technically, schedule() should not be
         * called from this thread, however somewhere below it might be,
         * but because we are the idle thread, we just pick up running again
@@ -7262,11 +7318,6 @@ void __init sched_init(void)
        calc_load_update = jiffies + LOAD_FREQ;
-        /*
-         * During early bootup we pretend to be a normal task:
-         */
-        current->sched_class = &fair_sched_class;
 #ifdef CONFIG_SMP
        zalloc_cpumask_var(&sched_domains_tmpmask, GFP_NOWAIT);
        /* May be allocated at isolcpus cmdline parse time */
@@ -7295,13 +7346,12 @@ void __might_sleep(const char *file, int line, int preempt_offset)
         * since we will exit with TASK_RUNNING make sure we enter with it,
         * otherwise we will destroy state.
         */
-        if (WARN_ONCE(current->state != TASK_RUNNING,
+        WARN_ONCE(current->state != TASK_RUNNING && current->task_state_change,
                        "do not call blocking ops when !TASK_RUNNING; "
                        "state=%lx set at [<%p>] %pS\n",
                        current->state,
                        (void *)current->task_state_change,
-                        (void *)current->task_state_change))
+                        (void *)current->task_state_change);
-                __set_current_state(TASK_RUNNING);
        ___might_sleep(file, line, preempt_offset);
 }
@@ -7328,6 +7378,9 @@ void ___might_sleep(const char *file, int line, int preempt_offset)
                        in_atomic(), irqs_disabled(),
                        current->pid, current->comm);
+        if (task_stack_end_corrupted(current))
+                printk(KERN_EMERG "Thread overran stack, or stack corrupted\n");
        debug_show_held_locks(current);
        if (irqs_disabled())
                print_irqtrace_events(current);
diff --git a/kernel/sched/cpudeadline.c b/kernel/sched/cpudeadline.c
index 539ca3ce071b..c6acb07466bb 100644
--- a/kernel/sched/cpudeadline.c
+++ b/kernel/sched/cpudeadline.c
@@ -107,7 +107,8 @@ int cpudl_find(struct cpudl *cp, struct task_struct *p,
        int best_cpu = -1;
        const struct sched_dl_entity *dl_se = &p->dl;
-        if (later_mask && cpumask_and(later_mask, later_mask, cp->free_cpus)) {
+        if (later_mask &&
+            cpumask_and(later_mask, cp->free_cpus, &p->cpus_allowed)) {
                best_cpu = cpumask_any(later_mask);
                goto out;
        } else if (cpumask_test_cpu(cpudl_maximum(cp), &p->cpus_allowed) &&
@@ -186,6 +187,26 @@ out:
 }
 /*
+ * cpudl_set_freecpu - Set the cpudl.free_cpus
+ * @cp: the cpudl max-heap context
+ * @cpu: rd attached cpu
+ */
+void cpudl_set_freecpu(struct cpudl *cp, int cpu)
+{
+        cpumask_set_cpu(cpu, cp->free_cpus);
+}
+/*
+ * cpudl_clear_freecpu - Clear the cpudl.free_cpus
+ * @cp: the cpudl max-heap context
+ * @cpu: rd attached cpu
+ */
+void cpudl_clear_freecpu(struct cpudl *cp, int cpu)
+{
+        cpumask_clear_cpu(cpu, cp->free_cpus);
+}
+/*
 * cpudl_init - initialize the cpudl structure
 * @cp: the cpudl max-heap context
 */
@@ -203,7 +224,7 @@ int cpudl_init(struct cpudl *cp)
        if (!cp->elements)
                return -ENOMEM;
-        if (!alloc_cpumask_var(&cp->free_cpus, GFP_KERNEL)) {
+        if (!zalloc_cpumask_var(&cp->free_cpus, GFP_KERNEL)) {
                kfree(cp->elements);
                return -ENOMEM;
        }
@@ -211,8 +232,6 @@ int cpudl_init(struct cpudl *cp)
        for_each_possible_cpu(i)
                cp->elements[i].idx = IDX_INVALID;
-        cpumask_setall(cp->free_cpus);
        return 0;
 }
diff --git a/kernel/sched/cpudeadline.h b/kernel/sched/cpudeadline.h
index 020039bd1326..1a0a6ef2fbe1 100644
--- a/kernel/sched/cpudeadline.h
+++ b/kernel/sched/cpudeadline.h
@@ -24,6 +24,8 @@ int cpudl_find(struct cpudl *cp, struct task_struct *p,
               struct cpumask *later_mask);
 void cpudl_set(struct cpudl *cp, int cpu, u64 dl, int is_valid);
 int cpudl_init(struct cpudl *cp);
+void cpudl_set_freecpu(struct cpudl *cp, int cpu);
+void cpudl_clear_freecpu(struct cpudl *cp, int cpu);
 void cpudl_cleanup(struct cpudl *cp);
 #endif /* CONFIG_SMP */
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index e5db8c6feebd..a027799ae130 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -350,6 +350,11 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se,
                dl_se->deadline = rq_clock(rq) + pi_se->dl_deadline;
                dl_se->runtime = pi_se->dl_runtime;
        }
+        if (dl_se->dl_yielded)
+                dl_se->dl_yielded = 0;
+        if (dl_se->dl_throttled)
+                dl_se->dl_throttled = 0;
 }
 /*
@@ -536,23 +541,19 @@ again:
        sched_clock_tick();
        update_rq_clock(rq);
-        dl_se->dl_throttled = 0;
+        enqueue_task_dl(rq, p, ENQUEUE_REPLENISH);
-        dl_se->dl_yielded = 0;
+        if (dl_task(rq->curr))
-        if (task_on_rq_queued(p)) {
+                check_preempt_curr_dl(rq, p, 0);
-                enqueue_task_dl(rq, p, ENQUEUE_REPLENISH);
+        else
-                if (dl_task(rq->curr))
+                resched_curr(rq);
-                        check_preempt_curr_dl(rq, p, 0);
-                else
-                        resched_curr(rq);
 #ifdef CONFIG_SMP
-                /*
+        /*
-                 * Queueing this task back might have overloaded rq,
+         * Queueing this task back might have overloaded rq,
-                 * check if we need to kick someone away.
+         * check if we need to kick someone away.
-                 */
+         */
-                if (has_pushable_dl_tasks(rq))
+        if (has_pushable_dl_tasks(rq))
-                        push_dl_task(rq);
+                push_dl_task(rq);
 #endif
-        }
 unlock:
        raw_spin_unlock(&rq->lock);
@@ -570,24 +571,7 @@ void init_dl_task_timer(struct sched_dl_entity *dl_se)
 static
 int dl_runtime_exceeded(struct rq *rq, struct sched_dl_entity *dl_se)
 {
-        int dmiss = dl_time_before(dl_se->deadline, rq_clock(rq));
+        return (dl_se->runtime <= 0);
-        int rorun = dl_se->runtime <= 0;
-        if (!rorun && !dmiss)
-                return 0;
-        /*
-         * If we are beyond our current deadline and we are still
-         * executing, then we have already used some of the runtime of
-         * the next instance. Thus, if we do not account that, we are
-         * stealing bandwidth from the system at each deadline miss!
-         */
-        if (dmiss) {
-                dl_se->runtime = rorun ? dl_se->runtime : 0;
-                dl_se->runtime -= rq_clock(rq) - dl_se->deadline;
-        }
-        return 1;
 }
 extern bool sched_rt_bandwidth_account(struct rt_rq *rt_rq);
@@ -630,10 +614,9 @@ static void update_curr_dl(struct rq *rq)
        dl_se->runtime -= dl_se->dl_yielded ? 0 : delta_exec;
        if (dl_runtime_exceeded(rq, dl_se)) {
+                dl_se->dl_throttled = 1;
                __dequeue_task_dl(rq, curr, 0);
-                if (likely(start_dl_timer(dl_se, curr->dl.dl_boosted)))
+                if (unlikely(!start_dl_timer(dl_se, curr->dl.dl_boosted)))
-                        dl_se->dl_throttled = 1;
-                else
                        enqueue_task_dl(rq, curr, ENQUEUE_REPLENISH);
                if (!is_leftmost(curr, &rq->dl))
@@ -826,10 +809,10 @@ enqueue_dl_entity(struct sched_dl_entity *dl_se,
         * parameters of the task might need updating. Otherwise,
         * we want a replenishment of its runtime.
         */
-        if (!dl_se->dl_new && flags & ENQUEUE_REPLENISH)
+        if (dl_se->dl_new || flags & ENQUEUE_WAKEUP)
-                replenish_dl_entity(dl_se, pi_se);
-        else
                update_dl_entity(dl_se, pi_se);
+        else if (flags & ENQUEUE_REPLENISH)
+                replenish_dl_entity(dl_se, pi_se);
        __enqueue_dl_entity(dl_se);
 }
@@ -870,7 +853,7 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
         * its rq, the bandwidth timer callback (which clearly has not
         * run yet) will take care of this.
         */
-        if (p->dl.dl_throttled)
+        if (p->dl.dl_throttled && !(flags & ENQUEUE_REPLENISH))
                return;
        enqueue_dl_entity(&p->dl, pi_se, flags);
@@ -1090,7 +1073,13 @@ static void task_tick_dl(struct rq *rq, struct task_struct *p, int queued)
 {
        update_curr_dl(rq);
-        if (hrtick_enabled(rq) && queued && p->dl.runtime > 0)
+        /*
+         * Even when we have runtime, update_curr_dl() might have resulted in us
+         * not being the leftmost task anymore. In that case NEED_RESCHED will
+         * be set and schedule() will start a new hrtick for the next task.
+         */
+        if (hrtick_enabled(rq) && queued && p->dl.runtime > 0 &&
+            is_leftmost(p, &rq->dl))
                start_hrtick_dl(rq, p);
 }
@@ -1111,6 +1100,7 @@ static void task_dead_dl(struct task_struct *p)
         * Since we are TASK_DEAD we won't slip out of the domain!
         */
        raw_spin_lock_irq(&dl_b->lock);
+        /* XXX we should retain the bw until 0-lag */
        dl_b->total_bw -= p->dl.dl_bw;
        raw_spin_unlock_irq(&dl_b->lock);
@@ -1182,9 +1172,6 @@ static int find_later_rq(struct task_struct *task)
         * We have to consider system topology and task affinity
         * first, then we can look for a suitable cpu.
         */
-        cpumask_copy(later_mask, task_rq(task)->rd->span);
-        cpumask_and(later_mask, later_mask, cpu_active_mask);
-        cpumask_and(later_mask, later_mask, &task->cpus_allowed);
        best_cpu = cpudl_find(&task_rq(task)->rd->cpudl,
                        task, later_mask);
        if (best_cpu == -1)
@@ -1579,6 +1566,7 @@ static void rq_online_dl(struct rq *rq)
        if (rq->dl.overloaded)
                dl_set_overload(rq);
+        cpudl_set_freecpu(&rq->rd->cpudl, rq->cpu);
        if (rq->dl.dl_nr_running > 0)
                cpudl_set(&rq->rd->cpudl, rq->cpu, rq->dl.earliest_dl.curr, 1);
 }
@@ -1590,6 +1578,7 @@ static void rq_offline_dl(struct rq *rq)
                dl_clear_overload(rq);
        cpudl_set(&rq->rd->cpudl, rq->cpu, 0, 0);
+        cpudl_clear_freecpu(&rq->rd->cpudl, rq->cpu);
 }
 void init_sched_dl_class(void)
@@ -1631,8 +1620,8 @@ static void cancel_dl_timer(struct rq *rq, struct task_struct *p)
 static void switched_from_dl(struct rq *rq, struct task_struct *p)
 {
+        /* XXX we should retain the bw until 0-lag */
        cancel_dl_timer(rq, p);
        __dl_clear_params(p);
        /*
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 92cc52001e74..8baaf858d25c 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -305,6 +305,7 @@ do {									\
        PN(next_balance);
        SEQ_printf(m, "  .%-30s: %ld\n", "curr->pid", (long)(task_pid_nr(rq->curr)));
        PN(clock);
+        PN(clock_task);
        P(cpu_load[0]);
        P(cpu_load[1]);
        P(cpu_load[2]);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index df2cdf77f899..7ce18f3c097a 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -676,7 +676,6 @@ void init_task_runnable_average(struct task_struct *p)
 {
        u32 slice;
-        p->se.avg.decay_count = 0;
        slice = sched_slice(task_cfs_rq(p), &p->se) >> 10;
        p->se.avg.runnable_avg_sum = slice;
        p->se.avg.runnable_avg_period = slice;
@@ -1730,7 +1729,7 @@ static int preferred_group_nid(struct task_struct *p, int nid)
        nodes = node_online_map;
        for (dist = sched_max_numa_distance; dist > LOCAL_DISTANCE; dist--) {
                unsigned long max_faults = 0;
-                nodemask_t max_group;
+                nodemask_t max_group = NODE_MASK_NONE;
                int a, b;
                /* Are there nodes at this distance from each other? */
@@ -2574,11 +2573,11 @@ static inline u64 __synchronize_entity_decay(struct sched_entity *se)
        u64 decays = atomic64_read(&cfs_rq->decay_counter);
        decays -= se->avg.decay_count;
+        se->avg.decay_count = 0;
        if (!decays)
                return 0;
        se->avg.load_avg_contrib = decay_load(se->avg.load_avg_contrib, decays);
-        se->avg.decay_count = 0;
        return decays;
 }
@@ -4005,6 +4004,10 @@ void __start_cfs_bandwidth(struct cfs_bandwidth *cfs_b, bool force)
 static void destroy_cfs_bandwidth(struct cfs_bandwidth *cfs_b)
 {
+        /* init_cfs_bandwidth() was not called */
+        if (!cfs_b->throttled_cfs_rq.next)
+                return;
        hrtimer_cancel(&cfs_b->period_timer);
        hrtimer_cancel(&cfs_b->slack_timer);
 }
@@ -4424,7 +4427,7 @@ static long effective_load(struct task_group *tg, int cpu, long wl, long wg)
                 * wl = S * s'_i; see (2)
                 */
                if (W > 0 && w < W)
-                        wl = (w * tg->shares) / W;
+                        wl = (w * (long)tg->shares) / W;
                else
                        wl = tg->shares;
@@ -5153,7 +5156,7 @@ static void yield_task_fair(struct rq *rq)
                 * so we don't do microscopic update in schedule()
                 * and double the fastpath cost.
                 */
-                 rq->skip_clock_update = 1;
+                rq_clock_skip_update(rq, true);
        }
        set_skip_buddy(se);
@@ -5945,8 +5948,8 @@ static unsigned long scale_rt_capacity(int cpu)
         */
        age_stamp = ACCESS_ONCE(rq->age_stamp);
        avg = ACCESS_ONCE(rq->rt_avg);
+        delta = __rq_clock_broken(rq) - age_stamp;
-        delta = rq_clock(rq) - age_stamp;
        if (unlikely(delta < 0))
                delta = 0;
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index c47fce75e666..aaf1c1d5cf5d 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -47,7 +47,8 @@ static inline int cpu_idle_poll(void)
        rcu_idle_enter();
        trace_cpu_idle_rcuidle(0, smp_processor_id());
        local_irq_enable();
-        while (!tif_need_resched())
+        while (!tif_need_resched() &&
+                (cpu_idle_force_poll || tick_check_broadcast_expired()))
                cpu_relax();
        trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id());
        rcu_idle_exit();
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index ee15f5a0d1c1..f4d4b077eba0 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -831,11 +831,14 @@ static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun)
                                enqueue = 1;
                                /*
-                                 * Force a clock update if the CPU was idle,
+                                 * When we're idle and a woken (rt) task is
-                                 * lest wakeup -> unthrottle time accumulate.
+                                 * throttled check_preempt_curr() will set
+                                 * skip_update and the time between the wakeup
+                                 * and this unthrottle will get accounted as
+                                 * 'runtime'.
                                 */
                                if (rt_rq->rt_nr_running && rq->curr == rq->idle)
-                                        rq->skip_clock_update = -1;
+                                        rq_clock_skip_update(rq, false);
                        }
                        if (rt_rq->rt_time || rt_rq->rt_nr_running)
                                idle = 0;
@@ -1337,7 +1340,12 @@ select_task_rq_rt(struct task_struct *p, int cpu, int sd_flag, int flags)
             curr->prio <= p->prio)) {
                int target = find_lowest_rq(p);
-                if (target != -1)
+                /*
+                 * Don't bother moving it if the destination CPU is
+                 * not running a lower priority task.
+                 */
+                if (target != -1 &&
+                    p->prio < cpu_rq(target)->rt.highest_prio.curr)
                        cpu = target;
        }
        rcu_read_unlock();
@@ -1614,6 +1622,16 @@ static struct rq *find_lock_lowest_rq(struct task_struct *task, struct rq *rq)
                lowest_rq = cpu_rq(cpu);
+                if (lowest_rq->rt.highest_prio.curr <= task->prio) {
+                        /*
+                         * Target rq has tasks of equal or higher priority,
+                         * retrying does not release any lock and is unlikely
+                         * to yield a different result.
+                         */
+                        lowest_rq = NULL;
+                        break;
+                }
                /* if the prio of this runqueue changed, try again */
                if (double_lock_balance(rq, lowest_rq)) {
                        /*
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 9a2a45c970e7..0870db23d79c 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -558,8 +558,6 @@ struct rq {
 #ifdef CONFIG_NO_HZ_FULL
        unsigned long last_sched_tick;
 #endif
-        int skip_clock_update;
        /* capture load from *all* tasks on this cpu: */
        struct load_weight load;
        unsigned long nr_load_updates;
@@ -588,6 +586,7 @@ struct rq {
        unsigned long next_balance;
        struct mm_struct *prev_mm;
+        unsigned int clock_skip_update;
        u64 clock;
        u64 clock_task;
@@ -687,16 +686,35 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues);
 #define cpu_curr(cpu)           (cpu_rq(cpu)->curr)
 #define raw_rq()                raw_cpu_ptr(&runqueues)
+static inline u64 __rq_clock_broken(struct rq *rq)
+{
+        return ACCESS_ONCE(rq->clock);
+}
 static inline u64 rq_clock(struct rq *rq)
 {
+        lockdep_assert_held(&rq->lock);
        return rq->clock;
 }
 static inline u64 rq_clock_task(struct rq *rq)
 {
+        lockdep_assert_held(&rq->lock);
        return rq->clock_task;
 }
+#define RQCF_REQ_SKIP   0x01
+#define RQCF_ACT_SKIP   0x02
+static inline void rq_clock_skip_update(struct rq *rq, bool skip)
+{
+        lockdep_assert_held(&rq->lock);
+        if (skip)
+                rq->clock_skip_update |= RQCF_REQ_SKIP;
+        else
+                rq->clock_skip_update &= ~RQCF_REQ_SKIP;
+}
 #ifdef CONFIG_NUMA
 enum numa_topology_type {
        NUMA_DIRECT,
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index f032fb5284e3..40190f28db35 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -280,6 +280,7 @@ int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread)
        unsigned int cpu;
        int ret = 0;
+        get_online_cpus();
        mutex_lock(&smpboot_threads_lock);
        for_each_online_cpu(cpu) {
                ret = __smpboot_create_thread(plug_thread, cpu);
@@ -292,6 +293,7 @@ int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread)
        list_add(&plug_thread->list, &hotplug_threads);
 out:
        mutex_unlock(&smpboot_threads_lock);
+        put_online_cpus();
        return ret;
 }
 EXPORT_SYMBOL_GPL(smpboot_register_percpu_thread);
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 501baa9ac1be..479e4436f787 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -114,8 +114,12 @@ void __local_bh_disable_ip(unsigned long ip, unsigned int cnt)
                trace_softirqs_off(ip);
        raw_local_irq_restore(flags);
-        if (preempt_count() == cnt)
+        if (preempt_count() == cnt) {
+#ifdef CONFIG_DEBUG_PREEMPT
+                current->preempt_disable_ip = get_parent_ip(CALLER_ADDR1);
+#endif
                trace_preempt_off(CALLER_ADDR0, get_parent_ip(CALLER_ADDR1));
+        }
 }
 EXPORT_SYMBOL(__local_bh_disable_ip);
 #endif /* CONFIG_TRACE_IRQFLAGS */
@@ -656,9 +660,8 @@ static void run_ksoftirqd(unsigned int cpu)
                 * in the task stack here.
                 */
                __do_softirq();
-                rcu_note_context_switch();
                local_irq_enable();
-                cond_resched();
+                cond_resched_rcu_qs();
                return;
        }
        local_irq_enable();
diff --git a/kernel/sys.c b/kernel/sys.c
index a8c9f5a7dda6..ea9c88109894 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -2210,9 +2210,13 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                up_write(&me->mm->mmap_sem);
                break;
        case PR_MPX_ENABLE_MANAGEMENT:
+                if (arg2 || arg3 || arg4 || arg5)
+                        return -EINVAL;
                error = MPX_ENABLE_MANAGEMENT(me);
                break;
        case PR_MPX_DISABLE_MANAGEMENT:
+                if (arg2 || arg3 || arg4 || arg5)
+                        return -EINVAL;
                error = MPX_DISABLE_MANAGEMENT(me);
                break;
        default:
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 37e50aadd471..3f5e183c3d97 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -122,7 +122,7 @@ static void hrtimer_get_softirq_time(struct hrtimer_cpu_base *base)
        mono = ktime_get_update_offsets_tick(&off_real, &off_boot, &off_tai);
        boot = ktime_add(mono, off_boot);
        xtim = ktime_add(mono, off_real);
-        tai = ktime_add(xtim, off_tai);
+        tai = ktime_add(mono, off_tai);
        base->clock_base[HRTIMER_BASE_REALTIME].softirq_time = xtim;
        base->clock_base[HRTIMER_BASE_MONOTONIC].softirq_time = mono;
@@ -266,7 +266,7 @@ lock_hrtimer_base(const struct hrtimer *timer, unsigned long *flags)
 /*
 * Divide a ktime value by a nanosecond value
 */
-u64 ktime_divns(const ktime_t kt, s64 div)
+u64 __ktime_divns(const ktime_t kt, s64 div)
 {
        u64 dclc;
        int sft = 0;
@@ -282,7 +282,7 @@ u64 ktime_divns(const ktime_t kt, s64 div)
        return dclc;
 }
-EXPORT_SYMBOL_GPL(ktime_divns);
+EXPORT_SYMBOL_GPL(__ktime_divns);
 #endif /* BITS_PER_LONG >= 64 */
 /*
@@ -440,6 +440,37 @@ static inline void debug_deactivate(struct hrtimer *timer)
        trace_hrtimer_cancel(timer);
 }
+#if defined(CONFIG_NO_HZ_COMMON) || defined(CONFIG_HIGH_RES_TIMERS)
+static ktime_t __hrtimer_get_next_event(struct hrtimer_cpu_base *cpu_base)
+{
+        struct hrtimer_clock_base *base = cpu_base->clock_base;
+        ktime_t expires, expires_next = { .tv64 = KTIME_MAX };
+        int i;
+        for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++, base++) {
+                struct timerqueue_node *next;
+                struct hrtimer *timer;
+                next = timerqueue_getnext(&base->active);
+                if (!next)
+                        continue;
+                timer = container_of(next, struct hrtimer, node);
+                expires = ktime_sub(hrtimer_get_expires(timer), base->offset);
+                if (expires.tv64 < expires_next.tv64)
+                        expires_next = expires;
+        }
+        /*
+         * clock_was_set() might have changed base->offset of any of
+         * the clock bases so the result might be negative. Fix it up
+         * to prevent a false positive in clockevents_program_event().
+         */
+        if (expires_next.tv64 < 0)
+                expires_next.tv64 = 0;
+        return expires_next;
+}
+#endif
 /* High resolution timer related functions */
 #ifdef CONFIG_HIGH_RES_TIMERS
@@ -488,32 +519,7 @@ static inline int hrtimer_hres_active(void)
 static void
 hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal)
 {
-        int i;
+        ktime_t expires_next = __hrtimer_get_next_event(cpu_base);
-        struct hrtimer_clock_base *base = cpu_base->clock_base;
-        ktime_t expires, expires_next;
-        expires_next.tv64 = KTIME_MAX;
-        for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++, base++) {
-                struct hrtimer *timer;
-                struct timerqueue_node *next;
-                next = timerqueue_getnext(&base->active);
-                if (!next)
-                        continue;
-                timer = container_of(next, struct hrtimer, node);
-                expires = ktime_sub(hrtimer_get_expires(timer), base->offset);
-                /*
-                 * clock_was_set() has changed base->offset so the
-                 * result might be negative. Fix it up to prevent a
-                 * false positive in clockevents_program_event()
-                 */
-                if (expires.tv64 < 0)
-                        expires.tv64 = 0;
-                if (expires.tv64 < expires_next.tv64)
-                        expires_next = expires;
-        }
        if (skip_equal && expires_next.tv64 == cpu_base->expires_next.tv64)
                return;
@@ -587,6 +593,15 @@ static int hrtimer_reprogram(struct hrtimer *timer,
                return 0;
        /*
+         * When the target cpu of the timer is currently executing
+         * hrtimer_interrupt(), then we do not touch the clock event
+         * device. hrtimer_interrupt() will reevaluate all clock bases
+         * before reprogramming the device.
+         */
+        if (cpu_base->in_hrtirq)
+                return 0;
+        /*
         * If a hang was detected in the last timer interrupt then we
         * do not schedule a timer which is earlier than the expiry
         * which we enforced in the hang detection. We want the system
@@ -1104,29 +1119,14 @@ EXPORT_SYMBOL_GPL(hrtimer_get_remaining);
 ktime_t hrtimer_get_next_event(void)
 {
        struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases);
-        struct hrtimer_clock_base *base = cpu_base->clock_base;
+        ktime_t mindelta = { .tv64 = KTIME_MAX };
-        ktime_t delta, mindelta = { .tv64 = KTIME_MAX };
        unsigned long flags;
-        int i;
        raw_spin_lock_irqsave(&cpu_base->lock, flags);
-        if (!hrtimer_hres_active()) {
+        if (!hrtimer_hres_active())
-                for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++, base++) {
+                mindelta = ktime_sub(__hrtimer_get_next_event(cpu_base),
-                        struct hrtimer *timer;
+                                     ktime_get());
-                        struct timerqueue_node *next;
-                        next = timerqueue_getnext(&base->active);
-                        if (!next)
-                                continue;
-                        timer = container_of(next, struct hrtimer, node);
-                        delta.tv64 = hrtimer_get_expires_tv64(timer);
-                        delta = ktime_sub(delta, base->get_time());
-                        if (delta.tv64 < mindelta.tv64)
-                                mindelta.tv64 = delta.tv64;
-                }
-        }
        raw_spin_unlock_irqrestore(&cpu_base->lock, flags);
@@ -1253,7 +1253,7 @@ void hrtimer_interrupt(struct clock_event_device *dev)
        raw_spin_lock(&cpu_base->lock);
        entry_time = now = hrtimer_update_base(cpu_base);
 retry:
-        expires_next.tv64 = KTIME_MAX;
+        cpu_base->in_hrtirq = 1;
        /*
         * We set expires_next to KTIME_MAX here with cpu_base->lock
         * held to prevent that a timer is enqueued in our queue via
@@ -1291,28 +1291,20 @@ retry:
                         * are right-of a not yet expired timer, because that
                         * timer will have to trigger a wakeup anyway.
                         */
+                        if (basenow.tv64 < hrtimer_get_softexpires_tv64(timer))
-                        if (basenow.tv64 < hrtimer_get_softexpires_tv64(timer)) {
-                                ktime_t expires;
-                                expires = ktime_sub(hrtimer_get_expires(timer),
-                                                    base->offset);
-                                if (expires.tv64 < 0)
-                                        expires.tv64 = KTIME_MAX;
-                                if (expires.tv64 < expires_next.tv64)
-                                        expires_next = expires;
                                break;
-                        }
                        __run_hrtimer(timer, &basenow);
                }
        }
+        /* Reevaluate the clock bases for the next expiry */
+        expires_next = __hrtimer_get_next_event(cpu_base);
        /*
         * Store the new expiry value so the migration code can verify
         * against it.
         */
        cpu_base->expires_next = expires_next;
+        cpu_base->in_hrtirq = 0;
        raw_spin_unlock(&cpu_base->lock);
        /* Reprogramming necessary ? */
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 87a346fd6d61..4b585e0fdd22 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -488,13 +488,13 @@ static void sync_cmos_clock(struct work_struct *work)
        getnstimeofday64(&now);
        if (abs(now.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec * 5) {
-                struct timespec adjust = timespec64_to_timespec(now);
+                struct timespec64 adjust = now;
                fail = -ENODEV;
                if (persistent_clock_is_local)
                        adjust.tv_sec -= (sys_tz.tz_minuteswest * 60);
 #ifdef CONFIG_GENERIC_CMOS_UPDATE
-                fail = update_persistent_clock(adjust);
+                fail = update_persistent_clock(timespec64_to_timespec(adjust));
 #endif
 #ifdef CONFIG_RTC_SYSTOHC
                if (fail == -ENODEV)
@@ -633,6 +633,13 @@ int ntp_validate_timex(struct timex *txc)
        if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME)))
                return -EPERM;
+        if (txc->modes & ADJ_FREQUENCY) {
+                if (LONG_MIN / PPM_SCALE > txc->freq)
+                        return -EINVAL;
+                if (LONG_MAX / PPM_SCALE < txc->freq)
+                        return -EINVAL;
+        }
        return 0;
 }
diff --git a/kernel/time/time.c b/kernel/time/time.c
index 6390517e77d4..2c85b7724af4 100644
--- a/kernel/time/time.c
+++ b/kernel/time/time.c
@@ -196,6 +196,10 @@ SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv,
        if (tv) {
                if (copy_from_user(&user_tv, tv, sizeof(*tv)))
                        return -EFAULT;
+                if (!timeval_valid(&user_tv))
+                        return -EINVAL;
                new_ts.tv_sec = user_tv.tv_sec;
                new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC;
        }
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 6a931852082f..b124af259800 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1659,24 +1659,24 @@ out:
 }
 /**
- * getboottime - Return the real time of system boot.
+ * getboottime64 - Return the real time of system boot.
- * @ts:         pointer to the timespec to be set
+ * @ts:         pointer to the timespec64 to be set
 *
- * Returns the wall-time of boot in a timespec.
+ * Returns the wall-time of boot in a timespec64.
 *
 * This is based on the wall_to_monotonic offset and the total suspend
 * time. Calls to settimeofday will affect the value returned (which
 * basically means that however wrong your real time clock is at boot time,
 * you get the right time here).
 */
-void getboottime(struct timespec *ts)
+void getboottime64(struct timespec64 *ts)
 {
        struct timekeeper *tk = &tk_core.timekeeper;
        ktime_t t = ktime_sub(tk->offs_real, tk->offs_boot);
-        *ts = ktime_to_timespec(t);
+        *ts = ktime_to_timespec64(t);
 }
-EXPORT_SYMBOL_GPL(getboottime);
+EXPORT_SYMBOL_GPL(getboottime64);
 unsigned long get_seconds(void)
 {
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 929a733d302e..224e768bdc73 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -2497,12 +2497,14 @@ static void ftrace_run_update_code(int command)
 }
 static void ftrace_run_modify_code(struct ftrace_ops *ops, int command,
-                                   struct ftrace_hash *old_hash)
+                                   struct ftrace_ops_hash *old_hash)
 {
        ops->flags |= FTRACE_OPS_FL_MODIFYING;
-        ops->old_hash.filter_hash = old_hash;
+        ops->old_hash.filter_hash = old_hash->filter_hash;
+        ops->old_hash.notrace_hash = old_hash->notrace_hash;
        ftrace_run_update_code(command);
        ops->old_hash.filter_hash = NULL;
+        ops->old_hash.notrace_hash = NULL;
        ops->flags &= ~FTRACE_OPS_FL_MODIFYING;
 }
@@ -3579,7 +3581,7 @@ static struct ftrace_ops trace_probe_ops __read_mostly =
 static int ftrace_probe_registered;
-static void __enable_ftrace_function_probe(struct ftrace_hash *old_hash)
+static void __enable_ftrace_function_probe(struct ftrace_ops_hash *old_hash)
 {
        int ret;
        int i;
@@ -3637,6 +3639,7 @@ int
 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
                              void *data)
 {
+        struct ftrace_ops_hash old_hash_ops;
        struct ftrace_func_probe *entry;
        struct ftrace_hash **orig_hash = &trace_probe_ops.func_hash->filter_hash;
        struct ftrace_hash *old_hash = *orig_hash;
@@ -3658,6 +3661,10 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
        mutex_lock(&trace_probe_ops.func_hash->regex_lock);
+        old_hash_ops.filter_hash = old_hash;
+        /* Probes only have filters */
+        old_hash_ops.notrace_hash = NULL;
        hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
        if (!hash) {
                count = -ENOMEM;
@@ -3718,7 +3725,7 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
        ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash);
-        __enable_ftrace_function_probe(old_hash);
+        __enable_ftrace_function_probe(&old_hash_ops);
        if (!ret)
                free_ftrace_hash_rcu(old_hash);
@@ -4006,10 +4013,34 @@ ftrace_match_addr(struct ftrace_hash *hash, unsigned long ip, int remove)
 }
 static void ftrace_ops_update_code(struct ftrace_ops *ops,
-                                   struct ftrace_hash *old_hash)
+                                   struct ftrace_ops_hash *old_hash)
 {
-        if (ops->flags & FTRACE_OPS_FL_ENABLED && ftrace_enabled)
+        struct ftrace_ops *op;
+        if (!ftrace_enabled)
+                return;
+        if (ops->flags & FTRACE_OPS_FL_ENABLED) {
                ftrace_run_modify_code(ops, FTRACE_UPDATE_CALLS, old_hash);
+                return;
+        }
+        /*
+         * If this is the shared global_ops filter, then we need to
+         * check if there is another ops that shares it, is enabled.
+         * If so, we still need to run the modify code.
+         */
+        if (ops->func_hash != &global_ops.local_hash)
+                return;
+        do_for_each_ftrace_op(op, ftrace_ops_list) {
+                if (op->func_hash == &global_ops.local_hash &&
+                    op->flags & FTRACE_OPS_FL_ENABLED) {
+                        ftrace_run_modify_code(op, FTRACE_UPDATE_CALLS, old_hash);
+                        /* Only need to do this once */
+                        return;
+                }
+        } while_for_each_ftrace_op(op);
 }
 static int
@@ -4017,6 +4048,7 @@ ftrace_set_hash(struct ftrace_ops *ops, unsigned char *buf, int len,
                unsigned long ip, int remove, int reset, int enable)
 {
        struct ftrace_hash **orig_hash;
+        struct ftrace_ops_hash old_hash_ops;
        struct ftrace_hash *old_hash;
        struct ftrace_hash *hash;
        int ret;
@@ -4053,9 +4085,11 @@ ftrace_set_hash(struct ftrace_ops *ops, unsigned char *buf, int len,
        mutex_lock(&ftrace_lock);
        old_hash = *orig_hash;
+        old_hash_ops.filter_hash = ops->func_hash->filter_hash;
+        old_hash_ops.notrace_hash = ops->func_hash->notrace_hash;
        ret = ftrace_hash_move(ops, enable, orig_hash, hash);
        if (!ret) {
-                ftrace_ops_update_code(ops, old_hash);
+                ftrace_ops_update_code(ops, &old_hash_ops);
                free_ftrace_hash_rcu(old_hash);
        }
        mutex_unlock(&ftrace_lock);
@@ -4267,6 +4301,7 @@ static void __init set_ftrace_early_filters(void)
 int ftrace_regex_release(struct inode *inode, struct file *file)
 {
        struct seq_file *m = (struct seq_file *)file->private_data;
+        struct ftrace_ops_hash old_hash_ops;
        struct ftrace_iterator *iter;
        struct ftrace_hash **orig_hash;
        struct ftrace_hash *old_hash;
@@ -4300,10 +4335,12 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
                mutex_lock(&ftrace_lock);
                old_hash = *orig_hash;
+                old_hash_ops.filter_hash = iter->ops->func_hash->filter_hash;
+                old_hash_ops.notrace_hash = iter->ops->func_hash->notrace_hash;
                ret = ftrace_hash_move(iter->ops, filter_hash,
                                       orig_hash, iter->hash);
                if (!ret) {
-                        ftrace_ops_update_code(iter->ops, old_hash);
+                        ftrace_ops_update_code(iter->ops, &old_hash_ops);
                        free_ftrace_hash_rcu(old_hash);
                }
                mutex_unlock(&ftrace_lock);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 2e767972e99c..4a9079b9f082 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6918,7 +6918,6 @@ void __init trace_init(void)
                        tracepoint_printk = 0;
        }
        tracer_alloc_buffers();
-        init_ftrace_syscalls();
        trace_event_init();     
 }
diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index 4b9c114ee9de..6fa484de2ba1 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -261,7 +261,7 @@ void perf_trace_del(struct perf_event *p_event, int flags)
 }
 void *perf_trace_buf_prepare(int size, unsigned short type,
-                             struct pt_regs *regs, int *rctxp)
+                             struct pt_regs **regs, int *rctxp)
 {
        struct trace_entry *entry;
        unsigned long flags;
@@ -280,6 +280,8 @@ void *perf_trace_buf_prepare(int size, unsigned short type,
        if (*rctxp < 0)
                return NULL;
+        if (regs)
+                *regs = this_cpu_ptr(&__perf_regs[*rctxp]);
        raw_data = this_cpu_ptr(perf_trace_buf[*rctxp]);
        /* zero the dead bytes from align to not leak stack to user */
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 366a78a3e61e..b03a0ea77b99 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -2429,12 +2429,39 @@ static __init int event_trace_memsetup(void)
        return 0;
 }
+static __init void
+early_enable_events(struct trace_array *tr, bool disable_first)
+{
+        char *buf = bootup_event_buf;
+        char *token;
+        int ret;
+        while (true) {
+                token = strsep(&buf, ",");
+                if (!token)
+                        break;
+                if (!*token)
+                        continue;
+                /* Restarting syscalls requires that we stop them first */
+                if (disable_first)
+                        ftrace_set_clr_event(tr, token, 0);
+                ret = ftrace_set_clr_event(tr, token, 1);
+                if (ret)
+                        pr_warn("Failed to enable trace event: %s\n", token);
+                /* Put back the comma to allow this to be called again */
+                if (buf)
+                        *(buf - 1) = ',';
+        }
+}
 static __init int event_trace_enable(void)
 {
        struct trace_array *tr = top_trace_array();
        struct ftrace_event_call **iter, *call;
-        char *buf = bootup_event_buf;
-        char *token;
        int ret;
        if (!tr)
@@ -2456,18 +2483,7 @@ static __init int event_trace_enable(void)
         */
        __trace_early_add_events(tr);
-        while (true) {
+        early_enable_events(tr, false);
-                token = strsep(&buf, ",");
-                if (!token)
-                        break;
-                if (!*token)
-                        continue;
-                ret = ftrace_set_clr_event(tr, token, 1);
-                if (ret)
-                        pr_warn("Failed to enable trace event: %s\n", token);
-        }
        trace_printk_start_comm();
@@ -2478,6 +2494,31 @@ static __init int event_trace_enable(void)
        return 0;
 }
+/*
+ * event_trace_enable() is called from trace_event_init() first to
+ * initialize events and perhaps start any events that are on the
+ * command line. Unfortunately, there are some events that will not
+ * start this early, like the system call tracepoints that need
+ * to set the TIF_SYSCALL_TRACEPOINT flag of pid 1. But event_trace_enable()
+ * is called before pid 1 starts, and this flag is never set, making
+ * the syscall tracepoint never get reached, but the event is enabled
+ * regardless (and not doing anything).
+ */
+static __init int event_trace_enable_again(void)
+{
+        struct trace_array *tr;
+        tr = top_trace_array();
+        if (!tr)
+                return -ENODEV;
+        early_enable_events(tr, true);
+        return 0;
+}
+early_initcall(event_trace_enable_again);
 static __init int event_trace_init(void)
 {
        struct trace_array *tr;
diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c
index b0b1c44e923a..3ccf5c2c1320 100644
--- a/kernel/trace/trace_kdb.c
+++ b/kernel/trace/trace_kdb.c
@@ -132,8 +132,8 @@ static int kdb_ftdump(int argc, const char **argv)
 static __init int kdb_ftrace_register(void)
 {
-        kdb_register_repeat("ftdump", kdb_ftdump, "[skip_#lines] [cpu]",
+        kdb_register_flags("ftdump", kdb_ftdump, "[skip_#lines] [cpu]",
-                            "Dump ftrace log", 0, KDB_REPEAT_NONE);
+                            "Dump ftrace log", 0, KDB_ENABLE_ALWAYS_SAFE);
        return 0;
 }
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 5edb518be345..296079ae6583 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -1148,7 +1148,7 @@ kprobe_perf_func(struct trace_kprobe *tk, struct pt_regs *regs)
        size = ALIGN(__size + sizeof(u32), sizeof(u64));
        size -= sizeof(u32);
-        entry = perf_trace_buf_prepare(size, call->event.type, regs, &rctx);
+        entry = perf_trace_buf_prepare(size, call->event.type, NULL, &rctx);
        if (!entry)
                return;
@@ -1179,7 +1179,7 @@ kretprobe_perf_func(struct trace_kprobe *tk, struct kretprobe_instance *ri,
        size = ALIGN(__size + sizeof(u32), sizeof(u64));
        size -= sizeof(u32);
-        entry = perf_trace_buf_prepare(size, call->event.type, regs, &rctx);
+        entry = perf_trace_buf_prepare(size, call->event.type, NULL, &rctx);
        if (!entry)
                return;
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index c6ee36fcbf90..f97f6e3a676c 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -574,7 +574,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
        size -= sizeof(u32);
        rec = (struct syscall_trace_enter *)perf_trace_buf_prepare(size,
-                                sys_data->enter_event->event.type, regs, &rctx);
+                                sys_data->enter_event->event.type, NULL, &rctx);
        if (!rec)
                return;
@@ -647,7 +647,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
        size -= sizeof(u32);
        rec = (struct syscall_trace_exit *)perf_trace_buf_prepare(size,
-                                sys_data->exit_event->event.type, regs, &rctx);
+                                sys_data->exit_event->event.type, NULL, &rctx);
        if (!rec)
                return;
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 8520acc34b18..b11441321e7a 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -1111,7 +1111,7 @@ static void __uprobe_perf_func(struct trace_uprobe *tu,
        if (hlist_empty(head))
                goto out;
-        entry = perf_trace_buf_prepare(size, call->event.type, regs, &rctx);
+        entry = perf_trace_buf_prepare(size, call->event.type, NULL, &rctx);
        if (!entry)
                goto out;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 6202b08f1933..beeeac9e0e3e 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1841,17 +1841,11 @@ static void pool_mayday_timeout(unsigned long __pool)
 * spin_lock_irq(pool->lock) which may be released and regrabbed
 * multiple times.  Does GFP_KERNEL allocations.  Called only from
 * manager.
- *
- * Return:
- * %false if no action was taken and pool->lock stayed locked, %true
- * otherwise.
 */
-static bool maybe_create_worker(struct worker_pool *pool)
+static void maybe_create_worker(struct worker_pool *pool)
 __releases(&pool->lock)
 __acquires(&pool->lock)
 {
-        if (!need_to_create_worker(pool))
-                return false;
 restart:
        spin_unlock_irq(&pool->lock);
@@ -1877,7 +1871,6 @@ restart:
         */
        if (need_to_create_worker(pool))
                goto restart;
-        return true;
 }
 /**
@@ -1897,16 +1890,14 @@ restart:
 * multiple times.  Does GFP_KERNEL allocations.
 *
 * Return:
- * %false if the pool don't need management and the caller can safely start
+ * %false if the pool doesn't need management and the caller can safely
- * processing works, %true indicates that the function released pool->lock
+ * start processing works, %true if management function was performed and
- * and reacquired it to perform some management function and that the
+ * the conditions that the caller verified before calling the function may
- * conditions that the caller verified while holding the lock before
+ * no longer be true.
- * calling the function might no longer be true.
 */
 static bool manage_workers(struct worker *worker)
 {
        struct worker_pool *pool = worker->pool;
-        bool ret = false;
        /*
         * Anyone who successfully grabs manager_arb wins the arbitration
@@ -1919,12 +1910,12 @@ static bool manage_workers(struct worker *worker)
         * actual management, the pool may stall indefinitely.
         */
        if (!mutex_trylock(&pool->manager_arb))
-                return ret;
+                return false;
-        ret |= maybe_create_worker(pool);
+        maybe_create_worker(pool);
        mutex_unlock(&pool->manager_arb);
-        return ret;
+        return true;
 }
 /**
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 5f2ce616c046..a2ca213c71ca 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1215,6 +1215,7 @@ config RCU_TORTURE_TEST
        tristate "torture tests for RCU"
        depends on DEBUG_KERNEL
        select TORTURE_TEST
+        select SRCU
        default n
        help
          This option provides a kernel module that runs torture tests
@@ -1257,7 +1258,7 @@ config RCU_CPU_STALL_TIMEOUT
 config RCU_CPU_STALL_INFO
        bool "Print additional diagnostics on RCU CPU stall"
        depends on (TREE_RCU || PREEMPT_RCU) && DEBUG_KERNEL
-        default n
+        default y
        help
          For each stalled CPU that is aware of the current RCU grace
          period, print out additional per-CPU diagnostic information
diff --git a/lib/Kconfig.kgdb b/lib/Kconfig.kgdb
index 358eb81fa28d..c635a107a7de 100644
--- a/lib/Kconfig.kgdb
+++ b/lib/Kconfig.kgdb
@@ -73,6 +73,31 @@ config KGDB_KDB
        help
          KDB frontend for kernel
+config KDB_DEFAULT_ENABLE
+        hex "KDB: Select kdb command functions to be enabled by default"
+        depends on KGDB_KDB
+        default 0x1
+        help
+          Specifiers which kdb commands are enabled by default. This may
+          be set to 1 or 0 to enable all commands or disable almost all
+          commands.
+          Alternatively the following bitmask applies:
+            0x0002 - allow arbitrary reads from memory and symbol lookup
+            0x0004 - allow arbitrary writes to memory
+            0x0008 - allow current register state to be inspected
+            0x0010 - allow current register state to be modified
+            0x0020 - allow passive inspection (backtrace, process list, lsmod)
+            0x0040 - allow flow control management (breakpoint, single step)
+            0x0080 - enable signalling of processes
+            0x0100 - allow machine to be rebooted
+          The config option merely sets the default at boot time. Both
+          issuing 'echo X > /sys/module/kdb/parameters/cmd_enable' or
+          setting with kdb.cmd_enable=X kernel command line option will
+          override the default settings.
 config KDB_KEYBOARD
        bool "KGDB_KDB: keyboard as input device"
        depends on VT && KGDB_KDB
diff --git a/lib/assoc_array.c b/lib/assoc_array.c
index 2404d03e251a..03dd576e6773 100644
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -11,6 +11,7 @@
 * 2 of the Licence, or (at your option) any later version.
 */
 //#define DEBUG
+#include <linux/rcupdate.h>
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/assoc_array_priv.h>
diff --git a/lib/checksum.c b/lib/checksum.c
index 129775eb6de6..8b39e86dbab5 100644
--- a/lib/checksum.c
+++ b/lib/checksum.c
@@ -181,6 +181,15 @@ csum_partial_copy(const void *src, void *dst, int len, __wsum sum)
 EXPORT_SYMBOL(csum_partial_copy);
 #ifndef csum_tcpudp_nofold
+static inline u32 from64to32(u64 x)
+{
+        /* add up 32-bit and 32-bit for 32+c bit */
+        x = (x & 0xffffffff) + (x >> 32);
+        /* add up carry.. */
+        x = (x & 0xffffffff) + (x >> 32);
+        return (u32)x;
+}
 __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
                        unsigned short len,
                        unsigned short proto,
@@ -195,8 +204,7 @@ __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
 #else
        s += (proto + len) << 8;
 #endif
-        s += (s >> 32);
+        return (__force __wsum)from64to32(s);
-        return (__force __wsum)s;
 }
 EXPORT_SYMBOL(csum_tcpudp_nofold);
 #endif
diff --git a/mm/Kconfig b/mm/Kconfig
index 1d1ae6b078fd..4395b12869c8 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -325,6 +325,7 @@ config VIRT_TO_BUS
 config MMU_NOTIFIER
        bool
+        select SRCU
 config KSM
        bool "Enable KSM for page merging"
diff --git a/mm/Kconfig.debug b/mm/Kconfig.debug
index 56badfc4810a..957d3da53ddd 100644
--- a/mm/Kconfig.debug
+++ b/mm/Kconfig.debug
@@ -14,7 +14,6 @@ config DEBUG_PAGEALLOC
        depends on !KMEMCHECK
        select PAGE_EXTENSION
        select PAGE_POISONING if !ARCH_SUPPORTS_DEBUG_PAGEALLOC
-        select PAGE_GUARD if ARCH_SUPPORTS_DEBUG_PAGEALLOC
        ---help---
          Unmap pages from the kernel linear mapping after free_pages().
          This results in a large slowdown, but helps to find certain types
@@ -27,13 +26,5 @@ config DEBUG_PAGEALLOC
          that would result in incorrect warnings of memory corruption after
          a resume because free pages are not saved to the suspend image.
-config WANT_PAGE_DEBUG_FLAGS
-        bool
 config PAGE_POISONING
        bool
-        select WANT_PAGE_DEBUG_FLAGS
-config PAGE_GUARD
-        bool
-        select WANT_PAGE_DEBUG_FLAGS
diff --git a/mm/filemap.c b/mm/filemap.c
index bd8543c6508f..673e4581a2e5 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1046,8 +1046,7 @@ EXPORT_SYMBOL(find_lock_entry);
 * @mapping: the address_space to search
 * @offset: the page index
 * @fgp_flags: PCG flags
- * @cache_gfp_mask: gfp mask to use for the page cache data page allocation
+ * @gfp_mask: gfp mask to use for the page cache data page allocation
- * @radix_gfp_mask: gfp mask to use for radix tree node allocation
 *
 * Looks up the page cache slot at @mapping & @offset.
 *
@@ -1056,11 +1055,9 @@ EXPORT_SYMBOL(find_lock_entry);
 * FGP_ACCESSED: the page will be marked accessed
 * FGP_LOCK: Page is return locked
 * FGP_CREAT: If page is not present then a new page is allocated using
- *              @cache_gfp_mask and added to the page cache and the VM's LRU
+ *              @gfp_mask and added to the page cache and the VM's LRU
- *              list. If radix tree nodes are allocated during page cache
+ *              list. The page is returned locked and with an increased
- *              insertion then @radix_gfp_mask is used. The page is returned
+ *              refcount. Otherwise, %NULL is returned.
- *              locked and with an increased refcount. Otherwise, %NULL is
- *              returned.
 *
 * If FGP_LOCK or FGP_CREAT are specified then the function may sleep even
 * if the GFP flags specified for FGP_CREAT are atomic.
@@ -1068,7 +1065,7 @@ EXPORT_SYMBOL(find_lock_entry);
 * If there is a page cache page, it is returned with an increased refcount.
 */
 struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
-        int fgp_flags, gfp_t cache_gfp_mask, gfp_t radix_gfp_mask)
+        int fgp_flags, gfp_t gfp_mask)
 {
        struct page *page;
@@ -1105,13 +1102,11 @@ no_page:
        if (!page && (fgp_flags & FGP_CREAT)) {
                int err;
                if ((fgp_flags & FGP_WRITE) && mapping_cap_account_dirty(mapping))
-                        cache_gfp_mask |= __GFP_WRITE;
+                        gfp_mask |= __GFP_WRITE;
-                if (fgp_flags & FGP_NOFS) {
+                if (fgp_flags & FGP_NOFS)
-                        cache_gfp_mask &= ~__GFP_FS;
+                        gfp_mask &= ~__GFP_FS;
-                        radix_gfp_mask &= ~__GFP_FS;
-                }
-                page = __page_cache_alloc(cache_gfp_mask);
+                page = __page_cache_alloc(gfp_mask);
                if (!page)
                        return NULL;
@@ -1122,7 +1117,8 @@ no_page:
                if (fgp_flags & FGP_ACCESSED)
                        __SetPageReferenced(page);
-                err = add_to_page_cache_lru(page, mapping, offset, radix_gfp_mask);
+                err = add_to_page_cache_lru(page, mapping, offset,
+                                gfp_mask & GFP_RECLAIM_MASK);
                if (unlikely(err)) {
                        page_cache_release(page);
                        page = NULL;
@@ -2443,8 +2439,7 @@ struct page *grab_cache_page_write_begin(struct address_space *mapping,
                fgp_flags |= FGP_NOFS;
        page = pagecache_get_page(mapping, index, fgp_flags,
-                        mapping_gfp_mask(mapping),
+                        mapping_gfp_mask(mapping));
-                        GFP_KERNEL);
        if (page)
                wait_for_stable_page(page);
diff --git a/mm/gup.c b/mm/gup.c
index a900759cc807..8dd50ce6326f 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -296,7 +296,7 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
                        return -ENOMEM;
                if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
                        return *flags & FOLL_HWPOISON ? -EHWPOISON : -EFAULT;
-                if (ret & VM_FAULT_SIGBUS)
+                if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
                        return -EFAULT;
                BUG();
        }
@@ -571,7 +571,7 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
                        return -ENOMEM;
                if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
                        return -EHWPOISON;
-                if (ret & VM_FAULT_SIGBUS)
+                if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
                        return -EFAULT;
                BUG();
        }
diff --git a/mm/ksm.c b/mm/ksm.c
index d247efab5073..15647fb0394f 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -376,7 +376,7 @@ static int break_ksm(struct vm_area_struct *vma, unsigned long addr)
                else
                        ret = VM_FAULT_WRITE;
                put_page(page);
-        } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_OOM)));
+        } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | VM_FAULT_OOM)));
        /*
         * We must loop because handle_mm_fault() may back out if there's
         * any difficulty e.g. if pte accessed bit gets updated concurrently.
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index ef91e856c7e4..2f6893c2f01b 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1477,9 +1477,9 @@ void mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
        pr_info("Task in ");
        pr_cont_cgroup_path(task_cgroup(p, memory_cgrp_id));
-        pr_info(" killed as a result of limit of ");
+        pr_cont(" killed as a result of limit of ");
        pr_cont_cgroup_path(memcg->css.cgroup);
-        pr_info("\n");
+        pr_cont("\n");
        rcu_read_unlock();
@@ -3043,18 +3043,6 @@ static int mem_cgroup_move_swap_account(swp_entry_t entry,
        if (swap_cgroup_cmpxchg(entry, old_id, new_id) == old_id) {
                mem_cgroup_swap_statistics(from, false);
                mem_cgroup_swap_statistics(to, true);
-                /*
-                 * This function is only called from task migration context now.
-                 * It postpones page_counter and refcount handling till the end
-                 * of task migration(mem_cgroup_clear_mc()) for performance
-                 * improvement. But we cannot postpone css_get(to)  because if
-                 * the process that has been moved to @to does swap-in, the
-                 * refcount of @to might be decreased to 0.
-                 *
-                 * We are in attach() phase, so the cgroup is guaranteed to be
-                 * alive, so we can just call css_get().
-                 */
-                css_get(&to->css);
                return 0;
        }
        return -EINVAL;
@@ -4679,6 +4667,7 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
        if (parent_css == NULL) {
                root_mem_cgroup = memcg;
                page_counter_init(&memcg->memory, NULL);
+                memcg->soft_limit = PAGE_COUNTER_MAX;
                page_counter_init(&memcg->memsw, NULL);
                page_counter_init(&memcg->kmem, NULL);
        }
@@ -4724,6 +4713,7 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css)
        if (parent->use_hierarchy) {
                page_counter_init(&memcg->memory, &parent->memory);
+                memcg->soft_limit = PAGE_COUNTER_MAX;
                page_counter_init(&memcg->memsw, &parent->memsw);
                page_counter_init(&memcg->kmem, &parent->kmem);
@@ -4733,6 +4723,7 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css)
                 */
        } else {
                page_counter_init(&memcg->memory, NULL);
+                memcg->soft_limit = PAGE_COUNTER_MAX;
                page_counter_init(&memcg->memsw, NULL);
                page_counter_init(&memcg->kmem, NULL);
                /*
@@ -4807,7 +4798,7 @@ static void mem_cgroup_css_reset(struct cgroup_subsys_state *css)
        mem_cgroup_resize_limit(memcg, PAGE_COUNTER_MAX);
        mem_cgroup_resize_memsw_limit(memcg, PAGE_COUNTER_MAX);
        memcg_update_kmem_limit(memcg, PAGE_COUNTER_MAX);
-        memcg->soft_limit = 0;
+        memcg->soft_limit = PAGE_COUNTER_MAX;
 }
 #ifdef CONFIG_MMU
@@ -5782,7 +5773,7 @@ void mem_cgroup_uncharge_list(struct list_head *page_list)
 * mem_cgroup_migrate - migrate a charge to another page
 * @oldpage: currently charged page
 * @newpage: page to transfer the charge to
- * @lrucare: both pages might be on the LRU already
+ * @lrucare: either or both pages might be on the LRU already
 *
 * Migrate the charge from @oldpage to @newpage.
 *
diff --git a/mm/memory.c b/mm/memory.c
index 649e7d440bd7..2c3536cc6c63 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -235,6 +235,9 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long
 static void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
 {
+        if (!tlb->end)
+                return;
        tlb_flush(tlb);
        mmu_notifier_invalidate_range(tlb->mm, tlb->start, tlb->end);
 #ifdef CONFIG_HAVE_RCU_TABLE_FREE
@@ -247,7 +250,7 @@ static void tlb_flush_mmu_free(struct mmu_gather *tlb)
 {
        struct mmu_gather_batch *batch;
-        for (batch = &tlb->local; batch; batch = batch->next) {
+        for (batch = &tlb->local; batch && batch->nr; batch = batch->next) {
                free_pages_and_swap_cache(batch->pages, batch->nr);
                batch->nr = 0;
        }
@@ -256,9 +259,6 @@ static void tlb_flush_mmu_free(struct mmu_gather *tlb)
 void tlb_flush_mmu(struct mmu_gather *tlb)
 {
-        if (!tlb->end)
-                return;
        tlb_flush_mmu_tlbonly(tlb);
        tlb_flush_mmu_free(tlb);
 }
@@ -2137,17 +2137,24 @@ reuse:
                if (!dirty_page)
                        return ret;
-                /*
-                 * Yes, Virginia, this is actually required to prevent a race
-                 * with clear_page_dirty_for_io() from clearing the page dirty
-                 * bit after it clear all dirty ptes, but before a racing
-                 * do_wp_page installs a dirty pte.
-                 *
-                 * do_shared_fault is protected similarly.
-                 */
                if (!page_mkwrite) {
-                        wait_on_page_locked(dirty_page);
+                        struct address_space *mapping;
-                        set_page_dirty_balance(dirty_page);
+                        int dirtied;
+                        lock_page(dirty_page);
+                        dirtied = set_page_dirty(dirty_page);
+                        VM_BUG_ON_PAGE(PageAnon(dirty_page), dirty_page);
+                        mapping = dirty_page->mapping;
+                        unlock_page(dirty_page);
+                        if (dirtied && mapping) {
+                                /*
+                                 * Some device drivers do not set page.mapping
+                                 * but still dirty their pages
+                                 */
+                                balance_dirty_pages_ratelimited(mapping);
+                        }
                        /* file_update_time outside page_lock */
                        if (vma->vm_file)
                                file_update_time(vma->vm_file);
@@ -2378,12 +2385,12 @@ void unmap_mapping_range(struct address_space *mapping,
                details.last_index = ULONG_MAX;
-        i_mmap_lock_read(mapping);
+        i_mmap_lock_write(mapping);
        if (unlikely(!RB_EMPTY_ROOT(&mapping->i_mmap)))
                unmap_mapping_range_tree(&mapping->i_mmap, &details);
        if (unlikely(!list_empty(&mapping->i_mmap_nonlinear)))
                unmap_mapping_range_list(&mapping->i_mmap_nonlinear, &details);
-        i_mmap_unlock_read(mapping);
+        i_mmap_unlock_write(mapping);
 }
 EXPORT_SYMBOL(unmap_mapping_range);
@@ -2593,7 +2600,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
                if (prev && prev->vm_end == address)
                        return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
-                expand_downwards(vma, address - PAGE_SIZE);
+                return expand_downwards(vma, address - PAGE_SIZE);
        }
        if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
                struct vm_area_struct *next = vma->vm_next;
@@ -2602,7 +2609,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
                if (next && next->vm_start == address + PAGE_SIZE)
                        return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
-                expand_upwards(vma, address + PAGE_SIZE);
+                return expand_upwards(vma, address + PAGE_SIZE);
        }
        return 0;
 }
@@ -2625,7 +2632,7 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
        /* Check if we need to add a guard page to the stack */
        if (check_stack_guard_page(vma, address) < 0)
-                return VM_FAULT_SIGBUS;
+                return VM_FAULT_SIGSEGV;
        /* Use the zero-page for reads */
        if (!(flags & FAULT_FLAG_WRITE) && !mm_forbids_zeropage(mm)) {
diff --git a/mm/mmap.c b/mm/mmap.c
index 7b36aa7cc89a..7f684d5a8087 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -778,10 +778,12 @@ again:			remove_next = 1 + (end > next->vm_end);
                if (exporter && exporter->anon_vma && !importer->anon_vma) {
                        int error;
+                        importer->anon_vma = exporter->anon_vma;
                        error = anon_vma_clone(importer, exporter);
-                        if (error)
+                        if (error) {
+                                importer->anon_vma = NULL;
                                return error;
-                        importer->anon_vma = exporter->anon_vma;
+                        }
                }
        }
@@ -2099,14 +2101,17 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
 {
        struct mm_struct *mm = vma->vm_mm;
        struct rlimit *rlim = current->signal->rlim;
-        unsigned long new_start;
+        unsigned long new_start, actual_size;
        /* address space limit tests */
        if (!may_expand_vm(mm, grow))
                return -ENOMEM;
        /* Stack limit test */
-        if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+        actual_size = size;
+        if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
+                actual_size -= PAGE_SIZE;
+        if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
                return -ENOMEM;
        /* mlock limit tests */
diff --git a/mm/nommu.c b/mm/nommu.c
index b51eadf6d952..28bd8c4dff6f 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -59,6 +59,7 @@
 #endif
 void *high_memory;
+EXPORT_SYMBOL(high_memory);
 struct page *mem_map;
 unsigned long max_mapnr;
 unsigned long highest_memmap_pfn;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index d5d81f5384d1..6f4335238e33 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1541,16 +1541,6 @@ pause:
                bdi_start_background_writeback(bdi);
 }
-void set_page_dirty_balance(struct page *page)
-{
-        if (set_page_dirty(page)) {
-                struct address_space *mapping = page_mapping(page);
-                if (mapping)
-                        balance_dirty_pages_ratelimited(mapping);
-        }
-}
 static DEFINE_PER_CPU(int, bdp_ratelimits);
 /*
@@ -2123,32 +2113,25 @@ EXPORT_SYMBOL(account_page_dirtied);
 * page dirty in that case, but not all the buffers.  This is a "bottom-up"
 * dirtying, whereas __set_page_dirty_buffers() is a "top-down" dirtying.
 *
- * Most callers have locked the page, which pins the address_space in memory.
+ * The caller must ensure this doesn't race with truncation.  Most will simply
- * But zap_pte_range() does not lock the page, however in that case the
+ * hold the page lock, but e.g. zap_pte_range() calls with the page mapped and
- * mapping is pinned by the vma's ->vm_file reference.
+ * the pte lock held, which also locks out truncation.
- *
- * We take care to handle the case where the page was truncated from the
- * mapping by re-checking page_mapping() inside tree_lock.
 */
 int __set_page_dirty_nobuffers(struct page *page)
 {
        if (!TestSetPageDirty(page)) {
                struct address_space *mapping = page_mapping(page);
-                struct address_space *mapping2;
                unsigned long flags;
                if (!mapping)
                        return 1;
                spin_lock_irqsave(&mapping->tree_lock, flags);
-                mapping2 = page_mapping(page);
+                BUG_ON(page_mapping(page) != mapping);
-                if (mapping2) { /* Race with truncate? */
+                WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
-                        BUG_ON(mapping2 != mapping);
+                account_page_dirtied(page, mapping);
-                        WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
+                radix_tree_tag_set(&mapping->page_tree, page_index(page),
-                        account_page_dirtied(page, mapping);
+                                   PAGECACHE_TAG_DIRTY);
-                        radix_tree_tag_set(&mapping->page_tree,
-                                page_index(page), PAGECACHE_TAG_DIRTY);
-                }
                spin_unlock_irqrestore(&mapping->tree_lock, flags);
                if (mapping->host) {
                        /* !PageAnon && !swapper_space */
@@ -2305,12 +2288,10 @@ int clear_page_dirty_for_io(struct page *page)
                /*
                 * We carefully synchronise fault handlers against
                 * installing a dirty pte and marking the page dirty
-                 * at this point. We do this by having them hold the
+                 * at this point.  We do this by having them hold the
-                 * page lock at some point after installing their
+                 * page lock while dirtying the page, and pages are
-                 * pte, but before marking the page dirty.
+                 * always locked coming in here, so we get the desired
-                 * Pages are always locked coming in here, so we get
+                 * exclusion.
-                 * the desired exclusion. See mm/memory.c:do_wp_page()
-                 * for more comments.
                 */
                if (TestClearPageDirty(page)) {
                        dec_zone_page_state(page, NR_FILE_DIRTY);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 7633c503a116..8e20f9c2fa5a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2332,12 +2332,21 @@ static inline struct page *
 __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
        struct zonelist *zonelist, enum zone_type high_zoneidx,
        nodemask_t *nodemask, struct zone *preferred_zone,
-        int classzone_idx, int migratetype)
+        int classzone_idx, int migratetype, unsigned long *did_some_progress)
 {
        struct page *page;
-        /* Acquire the per-zone oom lock for each zone */
+        *did_some_progress = 0;
+        if (oom_killer_disabled)
+                return NULL;
+        /*
+         * Acquire the per-zone oom lock for each zone.  If that
+         * fails, somebody else is making progress for us.
+         */
        if (!oom_zonelist_trylock(zonelist, gfp_mask)) {
+                *did_some_progress = 1;
                schedule_timeout_uninterruptible(1);
                return NULL;
        }
@@ -2363,12 +2372,18 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
                goto out;
        if (!(gfp_mask & __GFP_NOFAIL)) {
+                /* Coredumps can quickly deplete all memory reserves */
+                if (current->flags & PF_DUMPCORE)
+                        goto out;
                /* The OOM killer will not help higher order allocs */
                if (order > PAGE_ALLOC_COSTLY_ORDER)
                        goto out;
                /* The OOM killer does not needlessly kill tasks for lowmem */
                if (high_zoneidx < ZONE_NORMAL)
                        goto out;
+                /* The OOM killer does not compensate for light reclaim */
+                if (!(gfp_mask & __GFP_FS))
+                        goto out;
                /*
                 * GFP_THISNODE contains __GFP_NORETRY and we never hit this.
                 * Sanity check for bare calls of __GFP_THISNODE, not real OOM.
@@ -2381,7 +2396,7 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
        }
        /* Exhausted what can be done so it's blamo time */
        out_of_memory(zonelist, gfp_mask, order, nodemask, false);
+        *did_some_progress = 1;
 out:
        oom_zonelist_unlock(zonelist, gfp_mask);
        return page;
@@ -2658,7 +2673,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
            (gfp_mask & GFP_THISNODE) == GFP_THISNODE)
                goto nopage;
-restart:
+retry:
        if (!(gfp_mask & __GFP_NO_KSWAPD))
                wake_all_kswapds(order, zonelist, high_zoneidx,
                                preferred_zone, nodemask);
@@ -2681,7 +2696,6 @@ restart:
                classzone_idx = zonelist_zone_idx(preferred_zoneref);
        }
-rebalance:
        /* This is the last chance, in general, before the goto nopage. */
        page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist,
                        high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS,
@@ -2788,54 +2802,28 @@ rebalance:
        if (page)
                goto got_pg;
-        /*
-         * If we failed to make any progress reclaiming, then we are
-         * running out of options and have to consider going OOM
-         */
-        if (!did_some_progress) {
-                if (oom_gfp_allowed(gfp_mask)) {
-                        if (oom_killer_disabled)
-                                goto nopage;
-                        /* Coredumps can quickly deplete all memory reserves */
-                        if ((current->flags & PF_DUMPCORE) &&
-                            !(gfp_mask & __GFP_NOFAIL))
-                                goto nopage;
-                        page = __alloc_pages_may_oom(gfp_mask, order,
-                                        zonelist, high_zoneidx,
-                                        nodemask, preferred_zone,
-                                        classzone_idx, migratetype);
-                        if (page)
-                                goto got_pg;
-                        if (!(gfp_mask & __GFP_NOFAIL)) {
-                                /*
-                                 * The oom killer is not called for high-order
-                                 * allocations that may fail, so if no progress
-                                 * is being made, there are no other options and
-                                 * retrying is unlikely to help.
-                                 */
-                                if (order > PAGE_ALLOC_COSTLY_ORDER)
-                                        goto nopage;
-                                /*
-                                 * The oom killer is not called for lowmem
-                                 * allocations to prevent needlessly killing
-                                 * innocent tasks.
-                                 */
-                                if (high_zoneidx < ZONE_NORMAL)
-                                        goto nopage;
-                        }
-                        goto restart;
-                }
-        }
        /* Check if we should retry the allocation */
        pages_reclaimed += did_some_progress;
        if (should_alloc_retry(gfp_mask, order, did_some_progress,
                                                pages_reclaimed)) {
+                /*
+                 * If we fail to make progress by freeing individual
+                 * pages, but the allocation wants us to keep going,
+                 * start OOM killing tasks.
+                 */
+                if (!did_some_progress) {
+                        page = __alloc_pages_may_oom(gfp_mask, order, zonelist,
+                                                high_zoneidx, nodemask,
+                                                preferred_zone, classzone_idx,
+                                                migratetype,&did_some_progress);
+                        if (page)
+                                goto got_pg;
+                        if (!did_some_progress)
+                                goto nopage;
+                }
                /* Wait for some write requests to complete then retry */
                wait_iff_congested(preferred_zone, BLK_RW_ASYNC, HZ/50);
-                goto rebalance;
+                goto retry;
        } else {
                /*
                 * High-order allocations do not necessarily loop after
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index ad83195521f2..b264bda46e1b 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -199,7 +199,10 @@ int walk_page_range(unsigned long addr, unsigned long end,
                         */
                        if ((vma->vm_start <= addr) &&
                            (vma->vm_flags & VM_PFNMAP)) {
-                                next = vma->vm_end;
+                                if (walk->pte_hole)
+                                        err = walk->pte_hole(addr, next, walk);
+                                if (err)
+                                        break;
                                pgd = pgd_offset(walk->mm, next);
                                continue;
                        }
diff --git a/mm/rmap.c b/mm/rmap.c
index c5bc241127b2..71cd5bd0c17d 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -72,6 +72,8 @@ static inline struct anon_vma *anon_vma_alloc(void)
        anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
        if (anon_vma) {
                atomic_set(&anon_vma->refcount, 1);
+                anon_vma->degree = 1;   /* Reference for first vma */
+                anon_vma->parent = anon_vma;
                /*
                 * Initialise the anon_vma root to point to itself. If called
                 * from fork, the root will be reset to the parents anon_vma.
@@ -188,6 +190,8 @@ int anon_vma_prepare(struct vm_area_struct *vma)
                if (likely(!vma->anon_vma)) {
                        vma->anon_vma = anon_vma;
                        anon_vma_chain_link(vma, avc, anon_vma);
+                        /* vma reference or self-parent link for new root */
+                        anon_vma->degree++;
                        allocated = NULL;
                        avc = NULL;
                }
@@ -236,6 +240,14 @@ static inline void unlock_anon_vma_root(struct anon_vma *root)
 /*
 * Attach the anon_vmas from src to dst.
 * Returns 0 on success, -ENOMEM on failure.
+ *
+ * If dst->anon_vma is NULL this function tries to find and reuse existing
+ * anon_vma which has no vmas and only one child anon_vma. This prevents
+ * degradation of anon_vma hierarchy to endless linear chain in case of
+ * constantly forking task. On the other hand, an anon_vma with more than one
+ * child isn't reused even if there was no alive vma, thus rmap walker has a
+ * good chance of avoiding scanning the whole hierarchy when it searches where
+ * page is mapped.
 */
 int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
 {
@@ -256,7 +268,21 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
                anon_vma = pavc->anon_vma;
                root = lock_anon_vma_root(root, anon_vma);
                anon_vma_chain_link(dst, avc, anon_vma);
+                /*
+                 * Reuse existing anon_vma if its degree lower than two,
+                 * that means it has no vma and only one anon_vma child.
+                 *
+                 * Do not chose parent anon_vma, otherwise first child
+                 * will always reuse it. Root anon_vma is never reused:
+                 * it has self-parent reference and at least one child.
+                 */
+                if (!dst->anon_vma && anon_vma != src->anon_vma &&
+                                anon_vma->degree < 2)
+                        dst->anon_vma = anon_vma;
        }
+        if (dst->anon_vma)
+                dst->anon_vma->degree++;
        unlock_anon_vma_root(root);
        return 0;
@@ -280,6 +306,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
        if (!pvma->anon_vma)
                return 0;
+        /* Drop inherited anon_vma, we'll reuse existing or allocate new. */
+        vma->anon_vma = NULL;
        /*
         * First, attach the new VMA to the parent VMA's anon_vmas,
         * so rmap can find non-COWed pages in child processes.
@@ -288,6 +317,10 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
        if (error)
                return error;
+        /* An existing anon_vma has been reused, all done then. */
+        if (vma->anon_vma)
+                return 0;
        /* Then add our own anon_vma. */
        anon_vma = anon_vma_alloc();
        if (!anon_vma)
@@ -301,6 +334,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
         * lock any of the anon_vmas in this anon_vma tree.
         */
        anon_vma->root = pvma->anon_vma->root;
+        anon_vma->parent = pvma->anon_vma;
        /*
         * With refcounts, an anon_vma can stay around longer than the
         * process it belongs to. The root anon_vma needs to be pinned until
@@ -311,6 +345,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
        vma->anon_vma = anon_vma;
        anon_vma_lock_write(anon_vma);
        anon_vma_chain_link(vma, avc, anon_vma);
+        anon_vma->parent->degree++;
        anon_vma_unlock_write(anon_vma);
        return 0;
@@ -341,12 +376,16 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
                 * Leave empty anon_vmas on the list - we'll need
                 * to free them outside the lock.
                 */
-                if (RB_EMPTY_ROOT(&anon_vma->rb_root))
+                if (RB_EMPTY_ROOT(&anon_vma->rb_root)) {
+                        anon_vma->parent->degree--;
                        continue;
+                }
                list_del(&avc->same_vma);
                anon_vma_chain_free(avc);
        }
+        if (vma->anon_vma)
+                vma->anon_vma->degree--;
        unlock_anon_vma_root(root);
        /*
@@ -357,6 +396,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
        list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
                struct anon_vma *anon_vma = avc->anon_vma;
+                BUG_ON(anon_vma->degree);
                put_anon_vma(anon_vma);
                list_del(&avc->same_vma);
diff --git a/mm/shmem.c b/mm/shmem.c
index 73ba1df7c8ba..993e6ba689cc 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1013,7 +1013,7 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
                 */
                oldpage = newpage;
        } else {
-                mem_cgroup_migrate(oldpage, newpage, false);
+                mem_cgroup_migrate(oldpage, newpage, true);
                lru_cache_add_anon(newpage);
                *pagep = newpage;
        }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index bd9a72bc4a1b..dcd90c891d8e 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2656,7 +2656,7 @@ static bool throttle_direct_reclaim(gfp_t gfp_mask, struct zonelist *zonelist,
         * should make reasonable progress.
         */
        for_each_zone_zonelist_nodemask(zone, z, zonelist,
-                                        gfp_mask, nodemask) {
+                                        gfp_zone(gfp_mask), nodemask) {
                if (zone_idx(zone) > ZONE_NORMAL)
                        continue;
@@ -2921,18 +2921,20 @@ static bool prepare_kswapd_sleep(pg_data_t *pgdat, int order, long remaining,
                return false;
        /*
-         * There is a potential race between when kswapd checks its watermarks
+         * The throttled processes are normally woken up in balance_pgdat() as
-         * and a process gets throttled. There is also a potential race if
+         * soon as pfmemalloc_watermark_ok() is true. But there is a potential
-         * processes get throttled, kswapd wakes, a large process exits therby
+         * race between when kswapd checks the watermarks and a process gets
-         * balancing the zones that causes kswapd to miss a wakeup. If kswapd
+         * throttled. There is also a potential race if processes get
-         * is going to sleep, no process should be sleeping on pfmemalloc_wait
+         * throttled, kswapd wakes, a large process exits thereby balancing the
-         * so wake them now if necessary. If necessary, processes will wake
+         * zones, which causes kswapd to exit balance_pgdat() before reaching
-         * kswapd and get throttled again
+         * the wake up checks. If kswapd is going to sleep, no process should
+         * be sleeping on pfmemalloc_wait, so wake them now if necessary. If
+         * the wake up is premature, processes will wake kswapd and get
+         * throttled again. The difference from wake ups in balance_pgdat() is
+         * that here we are under prepare_to_wait().
         */
-        if (waitqueue_active(&pgdat->pfmemalloc_wait)) {
+        if (waitqueue_active(&pgdat->pfmemalloc_wait))
-                wake_up(&pgdat->pfmemalloc_wait);
+                wake_up_all(&pgdat->pfmemalloc_wait);
-                return false;
-        }
        return pgdat_balanced(pgdat, order, classzone_idx);
 }
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index fc1835c6bb40..00f9e144cc97 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -251,7 +251,7 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb)
        kfree(entry);
        /* Make room for the rest of the fragments. */
-        if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) {
+        if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
                kfree_skb(skb_out);
                skb_out = NULL;
                goto free;
@@ -434,7 +434,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
         * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE
         */
        mtu = min_t(unsigned, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
-        max_fragment_size = (mtu - header_size - ETH_HLEN);
+        max_fragment_size = mtu - header_size;
        max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS;
        /* Don't even try to fragment, if we need more than 16 fragments */
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index 90cff585b37d..e0bcf9e84273 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -810,7 +810,7 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
                goto out;
        gw_node = batadv_gw_node_get(bat_priv, orig_dst_node);
-        if (!gw_node->bandwidth_down == 0)
+        if (!gw_node)
                goto out;
        switch (atomic_read(&bat_priv->gw_mode)) {
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index ab6bb2af1d45..b24e4bb64fb5 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -685,11 +685,13 @@ static void batadv_mcast_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
                if (orig_initialized)
                        atomic_dec(&bat_priv->mcast.num_disabled);
                orig->capabilities |= BATADV_ORIG_CAPA_HAS_MCAST;
-        /* If mcast support is being switched off increase the disabled
+        /* If mcast support is being switched off or if this is an initial
-         * mcast node counter.
+         * OGM without mcast support then increase the disabled mcast
+         * node counter.
         */
        } else if (!orig_mcast_enabled &&
-                   orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) {
+                   (orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST ||
+                    !orig_initialized)) {
                atomic_inc(&bat_priv->mcast.num_disabled);
                orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_MCAST;
        }
@@ -738,7 +740,8 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig)
 {
        struct batadv_priv *bat_priv = orig->bat_priv;
-        if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST))
+        if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) &&
+            orig->capa_initialized & BATADV_ORIG_CAPA_HAS_MCAST)
                atomic_dec(&bat_priv->mcast.num_disabled);
        batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index 8d04d174669e..fab47f1f3ef9 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -133,7 +133,7 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
        if (!bat_priv->nc.decoding_hash)
                goto err;
-        batadv_hash_set_lock_class(bat_priv->nc.coding_hash,
+        batadv_hash_set_lock_class(bat_priv->nc.decoding_hash,
                                   &batadv_nc_decoding_hash_lock_class_key);
        INIT_DELAYED_WORK(&bat_priv->nc.work, batadv_nc_worker);
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 6a484514cd3e..bea8198d0198 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -570,9 +570,6 @@ static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
        batadv_frag_purge_orig(orig_node, NULL);
-        batadv_tt_global_del_orig(orig_node->bat_priv, orig_node, -1,
-                                  "originator timed out");
        if (orig_node->bat_priv->bat_algo_ops->bat_orig_free)
                orig_node->bat_priv->bat_algo_ops->bat_orig_free(orig_node);
@@ -678,6 +675,7 @@ struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
        atomic_set(&orig_node->last_ttvn, 0);
        orig_node->tt_buff = NULL;
        orig_node->tt_buff_len = 0;
+        orig_node->last_seen = jiffies;
        reset_time = jiffies - 1 - msecs_to_jiffies(BATADV_RESET_PROTECTION_MS);
        orig_node->bcast_seqno_reset = reset_time;
 #ifdef CONFIG_BATMAN_ADV_MCAST
@@ -977,6 +975,9 @@ static void _batadv_purge_orig(struct batadv_priv *bat_priv)
                        if (batadv_purge_orig_node(bat_priv, orig_node)) {
                                batadv_gw_node_delete(bat_priv, orig_node);
                                hlist_del_rcu(&orig_node->hash_entry);
+                                batadv_tt_global_del_orig(orig_node->bat_priv,
+                                                          orig_node, -1,
+                                                          "originator timed out");
                                batadv_orig_node_free_ref(orig_node);
                                continue;
                        }
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 35f76f2f7824..6648f321864d 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -443,11 +443,13 @@ batadv_find_router(struct batadv_priv *bat_priv,
        router = batadv_orig_router_get(orig_node, recv_if);
+        if (!router)
+                return router;
        /* only consider bonding for recv_if == BATADV_IF_DEFAULT (first hop)
         * and if activated.
         */
-        if (recv_if == BATADV_IF_DEFAULT || !atomic_read(&bat_priv->bonding) ||
+        if (!(recv_if == BATADV_IF_DEFAULT && atomic_read(&bat_priv->bonding)))
-            !router)
                return router;
        /* bonding: loop through the list of possible routers found
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 76617be1e797..c989253737f0 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -390,7 +390,6 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
 drop:
        dev->stats.rx_dropped++;
-        kfree_skb(skb);
        return NET_RX_DROP;
 }
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 85bcc21e84d2..ce82722d049b 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -533,6 +533,9 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
        BT_DBG("");
+        if (!l2cap_is_socket(sock))
+                return -EBADFD;
        baswap((void *) dst, &l2cap_pi(sock->sk)->chan->dst);
        baswap((void *) src, &l2cap_pi(sock->sk)->chan->src);
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 67fe5e84e68f..278a194e6af4 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -334,6 +334,9 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
        BT_DBG("");
+        if (!l2cap_is_socket(sock))
+                return -EBADFD;
        session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
        if (!session)
                return -ENOMEM;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 39a5c8a01726..3f2e8b830cbd 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -242,7 +242,8 @@ static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
        if (rp->status)
                return;
-        if (test_bit(HCI_SETUP, &hdev->dev_flags))
+        if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
+            test_bit(HCI_CONFIG, &hdev->dev_flags))
                memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 }
@@ -509,7 +510,8 @@ static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
        if (rp->status)
                return;
-        if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
+        if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
+            test_bit(HCI_CONFIG, &hdev->dev_flags)) {
                hdev->hci_ver = rp->hci_ver;
                hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
                hdev->lmp_ver = rp->lmp_ver;
@@ -528,7 +530,8 @@ static void hci_cc_read_local_commands(struct hci_dev *hdev,
        if (rp->status)
                return;
-        if (test_bit(HCI_SETUP, &hdev->dev_flags))
+        if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
+            test_bit(HCI_CONFIG, &hdev->dev_flags))
                memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 }
@@ -2194,7 +2197,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                return;
        }
-        if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
+        /* Require HCI_CONNECTABLE or a whitelist entry to accept the
+         * connection. These features are only touched through mgmt so
+         * only do the checks if HCI_MGMT is set.
+         */
+        if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
+            !test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
            !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
                                    BDADDR_BREDR)) {
                    hci_reject_conn(hdev, &ev->bdaddr);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index cc25d0b74b36..07348e142f16 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -1314,13 +1314,14 @@ int hidp_connection_add(struct hidp_connadd_req *req,
 {
        struct hidp_session *session;
        struct l2cap_conn *conn;
-        struct l2cap_chan *chan = l2cap_pi(ctrl_sock->sk)->chan;
+        struct l2cap_chan *chan;
        int ret;
        ret = hidp_verify_sockets(ctrl_sock, intr_sock);
        if (ret)
                return ret;
+        chan = l2cap_pi(ctrl_sock->sk)->chan;
        conn = NULL;
        l2cap_chan_lock(chan);
        if (chan->conn)
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 1f1de715197c..e2aa7be3a847 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -154,7 +154,8 @@ int br_handle_frame_finish(struct sk_buff *skb)
        dst = NULL;
        if (is_broadcast_ether_addr(dest)) {
-                if (p->flags & BR_PROXYARP &&
+                if (IS_ENABLED(CONFIG_INET) &&
+                    p->flags & BR_PROXYARP &&
                    skb->protocol == htons(ETH_P_ARP))
                        br_do_proxy_arp(skb, br, vid);
diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index b0330aecbf97..3244aead0926 100644
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -265,22 +265,12 @@ out:
        data[NFT_REG_VERDICT].verdict = NF_DROP;
 }
-static int nft_reject_bridge_validate_hooks(const struct nft_chain *chain)
+static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
+                                      const struct nft_expr *expr,
+                                      const struct nft_data **data)
 {
-        struct nft_base_chain *basechain;
+        return nft_chain_validate_hooks(ctx->chain, (1 << NF_BR_PRE_ROUTING) |
+                                                    (1 << NF_BR_LOCAL_IN));
-        if (chain->flags & NFT_BASE_CHAIN) {
-                basechain = nft_base_chain(chain);
-                switch (basechain->ops[0].hooknum) {
-                case NF_BR_PRE_ROUTING:
-                case NF_BR_LOCAL_IN:
-                        break;
-                default:
-                        return -EOPNOTSUPP;
-                }
-        }
-        return 0;
 }
 static int nft_reject_bridge_init(const struct nft_ctx *ctx,
@@ -290,7 +280,7 @@ static int nft_reject_bridge_init(const struct nft_ctx *ctx,
        struct nft_reject *priv = nft_expr_priv(expr);
        int icmp_code, err;
-        err = nft_reject_bridge_validate_hooks(ctx->chain);
+        err = nft_reject_bridge_validate(ctx, expr, NULL);
        if (err < 0)
                return err;
@@ -341,13 +331,6 @@ nla_put_failure:
        return -1;
 }
-static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
-                                      const struct nft_expr *expr,
-                                      const struct nft_data **data)
-{
-        return nft_reject_bridge_validate_hooks(ctx->chain);
-}
 static struct nft_expr_type nft_reject_bridge_type;
 static const struct nft_expr_ops nft_reject_bridge_ops = {
        .type           = &nft_reject_bridge_type,
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 4589ff67bfa9..67a4a36febd1 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -470,7 +470,6 @@ static int ipcaif_newlink(struct net *src_net, struct net_device *dev,
        ASSERT_RTNL();
        caifdev = netdev_priv(dev);
        caif_netlink_parms(data, &caifdev->conn_req);
-        dev_net_set(caifdev->netdev, src_net);
        ret = register_netdevice(dev);
        if (ret)
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 15845814a0f2..ba6eb17226da 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -676,7 +676,7 @@ static int calcu_signature(struct ceph_x_authorizer *au,
        int ret;
        char tmp_enc[40];
        __le32 tmp[5] = {
-                16u, msg->hdr.crc, msg->footer.front_crc,
+                cpu_to_le32(16), msg->hdr.crc, msg->footer.front_crc,
                msg->footer.middle_crc, msg->footer.data_crc,
        };
        ret = ceph_x_encrypt(&au->session_key, &tmp, sizeof(tmp),
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index a83062ceeec9..f2148e22b148 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -717,7 +717,7 @@ static int get_poolop_reply_buf(const char *src, size_t src_len,
        if (src_len != sizeof(u32) + dst_len)
                return -EINVAL;
-        buf_len = le32_to_cpu(*(u32 *)src);
+        buf_len = le32_to_cpu(*(__le32 *)src);
        if (buf_len != dst_len)
                return -EINVAL;
diff --git a/net/core/dev.c b/net/core/dev.c
index f411c28d0a66..7fe82929f509 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1694,6 +1694,7 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
        skb_scrub_packet(skb, true);
        skb->protocol = eth_type_trans(skb, dev);
+        skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
        return 0;
 }
@@ -2351,7 +2352,6 @@ EXPORT_SYMBOL(skb_checksum_help);
 __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
 {
-        unsigned int vlan_depth = skb->mac_len;
        __be16 type = skb->protocol;
        /* Tunnel gso handlers can set protocol to ethernet. */
@@ -2365,35 +2365,7 @@ __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
                type = eth->h_proto;
        }
-        /* if skb->protocol is 802.1Q/AD then the header should already be
+        return __vlan_get_protocol(skb, type, depth);
-         * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
-         * ETH_HLEN otherwise
-         */
-        if (type == htons(ETH_P_8021Q) || type == htons(ETH_P_8021AD)) {
-                if (vlan_depth) {
-                        if (WARN_ON(vlan_depth < VLAN_HLEN))
-                                return 0;
-                        vlan_depth -= VLAN_HLEN;
-                } else {
-                        vlan_depth = ETH_HLEN;
-                }
-                do {
-                        struct vlan_hdr *vh;
-                        if (unlikely(!pskb_may_pull(skb,
-                                                    vlan_depth + VLAN_HLEN)))
-                                return 0;
-                        vh = (struct vlan_hdr *)(skb->data + vlan_depth);
-                        type = vh->h_vlan_encapsulated_proto;
-                        vlan_depth += VLAN_HLEN;
-                } while (type == htons(ETH_P_8021Q) ||
-                         type == htons(ETH_P_8021AD));
-        }
-        *depth = vlan_depth;
-        return type;
 }
 /**
@@ -2522,7 +2494,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
 /* If MPLS offload request, verify we are testing hardware MPLS features
 * instead of standard features for the netdev.
 */
-#ifdef CONFIG_NET_MPLS_GSO
+#if IS_ENABLED(CONFIG_NET_MPLS_GSO)
 static netdev_features_t net_mpls_features(struct sk_buff *skb,
                                           netdev_features_t features,
                                           __be16 type)
@@ -2562,7 +2534,7 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,
 netdev_features_t netif_skb_features(struct sk_buff *skb)
 {
-        const struct net_device *dev = skb->dev;
+        struct net_device *dev = skb->dev;
        netdev_features_t features = dev->features;
        u16 gso_segs = skb_shinfo(skb)->gso_segs;
        __be16 protocol = skb->protocol;
@@ -2570,11 +2542,21 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
        if (gso_segs > dev->gso_max_segs || gso_segs < dev->gso_min_segs)
                features &= ~NETIF_F_GSO_MASK;
-        if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) {
+        /* If encapsulation offload request, verify we are testing
-                struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+         * hardware encapsulation features instead of standard
-                protocol = veh->h_vlan_encapsulated_proto;
+         * features for the netdev
-        } else if (!vlan_tx_tag_present(skb)) {
+         */
-                return harmonize_features(skb, features);
+        if (skb->encapsulation)
+                features &= dev->hw_enc_features;
+        if (!vlan_tx_tag_present(skb)) {
+                if (unlikely(protocol == htons(ETH_P_8021Q) ||
+                             protocol == htons(ETH_P_8021AD))) {
+                        struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+                        protocol = veh->h_vlan_encapsulated_proto;
+                } else {
+                        goto finalize;
+                }
        }
        features = netdev_intersect_features(features,
@@ -2591,6 +2573,11 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
                                                     NETIF_F_HW_VLAN_CTAG_TX |
                                                     NETIF_F_HW_VLAN_STAG_TX);
+finalize:
+        if (dev->netdev_ops->ndo_features_check)
+                features &= dev->netdev_ops->ndo_features_check(skb, dev,
+                                                                features);
        return harmonize_features(skb, features);
 }
 EXPORT_SYMBOL(netif_skb_features);
@@ -2661,19 +2648,12 @@ static struct sk_buff *validate_xmit_skb(struct sk_buff *skb, struct net_device
        if (unlikely(!skb))
                goto out_null;
-        /* If encapsulation offload request, verify we are testing
-         * hardware encapsulation features instead of standard
-         * features for the netdev
-         */
-        if (skb->encapsulation)
-                features &= dev->hw_enc_features;
        if (netif_needs_gso(dev, skb, features)) {
                struct sk_buff *segs;
                segs = skb_gso_segment(skb, features);
                if (IS_ERR(segs)) {
-                        segs = NULL;
+                        goto out_kfree_skb;
                } else if (segs) {
                        consume_skb(skb);
                        skb = segs;
@@ -4557,6 +4537,68 @@ void netif_napi_del(struct napi_struct *napi)
 }
 EXPORT_SYMBOL(netif_napi_del);
+static int napi_poll(struct napi_struct *n, struct list_head *repoll)
+{
+        void *have;
+        int work, weight;
+        list_del_init(&n->poll_list);
+        have = netpoll_poll_lock(n);
+        weight = n->weight;
+        /* This NAPI_STATE_SCHED test is for avoiding a race
+         * with netpoll's poll_napi().  Only the entity which
+         * obtains the lock and sees NAPI_STATE_SCHED set will
+         * actually make the ->poll() call.  Therefore we avoid
+         * accidentally calling ->poll() when NAPI is not scheduled.
+         */
+        work = 0;
+        if (test_bit(NAPI_STATE_SCHED, &n->state)) {
+                work = n->poll(n, weight);
+                trace_napi_poll(n);
+        }
+        WARN_ON_ONCE(work > weight);
+        if (likely(work < weight))
+                goto out_unlock;
+        /* Drivers must not modify the NAPI state if they
+         * consume the entire weight.  In such cases this code
+         * still "owns" the NAPI instance and therefore can
+         * move the instance around on the list at-will.
+         */
+        if (unlikely(napi_disable_pending(n))) {
+                napi_complete(n);
+                goto out_unlock;
+        }
+        if (n->gro_list) {
+                /* flush too old packets
+                 * If HZ < 1000, flush all packets.
+                 */
+                napi_gro_flush(n, HZ >= 1000);
+        }
+        /* Some drivers may have called napi_schedule
+         * prior to exhausting their budget.
+         */
+        if (unlikely(!list_empty(&n->poll_list))) {
+                pr_warn_once("%s: Budget exhausted after napi rescheduled\n",
+                             n->dev ? n->dev->name : "backlog");
+                goto out_unlock;
+        }
+        list_add_tail(&n->poll_list, repoll);
+out_unlock:
+        netpoll_poll_unlock(have);
+        return work;
+}
 static void net_rx_action(struct softirq_action *h)
 {
        struct softnet_data *sd = this_cpu_ptr(&softnet_data);
@@ -4564,74 +4606,34 @@ static void net_rx_action(struct softirq_action *h)
        int budget = netdev_budget;
        LIST_HEAD(list);
        LIST_HEAD(repoll);
-        void *have;
        local_irq_disable();
        list_splice_init(&sd->poll_list, &list);
        local_irq_enable();
-        while (!list_empty(&list)) {
+        for (;;) {
                struct napi_struct *n;
-                int work, weight;
-                /* If softirq window is exhausted then punt.
-                 * Allow this to run for 2 jiffies since which will allow
-                 * an average latency of 1.5/HZ.
-                 */
-                if (unlikely(budget <= 0 || time_after_eq(jiffies, time_limit)))
-                        goto softnet_break;
-                n = list_first_entry(&list, struct napi_struct, poll_list);
-                list_del_init(&n->poll_list);
-                have = netpoll_poll_lock(n);
-                weight = n->weight;
+                if (list_empty(&list)) {
+                        if (!sd_has_rps_ipi_waiting(sd) && list_empty(&repoll))
-                /* This NAPI_STATE_SCHED test is for avoiding a race
+                                return;
-                 * with netpoll's poll_napi().  Only the entity which
+                        break;
-                 * obtains the lock and sees NAPI_STATE_SCHED set will
-                 * actually make the ->poll() call.  Therefore we avoid
-                 * accidentally calling ->poll() when NAPI is not scheduled.
-                 */
-                work = 0;
-                if (test_bit(NAPI_STATE_SCHED, &n->state)) {
-                        work = n->poll(n, weight);
-                        trace_napi_poll(n);
                }
-                WARN_ON_ONCE(work > weight);
+                n = list_first_entry(&list, struct napi_struct, poll_list);
+                budget -= napi_poll(n, &repoll);
-                budget -= work;
-                /* Drivers must not modify the NAPI state if they
+                /* If softirq window is exhausted then punt.
-                 * consume the entire weight.  In such cases this code
+                 * Allow this to run for 2 jiffies since which will allow
-                 * still "owns" the NAPI instance and therefore can
+                 * an average latency of 1.5/HZ.
-                 * move the instance around on the list at-will.
                 */
-                if (unlikely(work == weight)) {
+                if (unlikely(budget <= 0 ||
-                        if (unlikely(napi_disable_pending(n))) {
+                             time_after_eq(jiffies, time_limit))) {
-                                napi_complete(n);
+                        sd->time_squeeze++;
-                        } else {
+                        break;
-                                if (n->gro_list) {
-                                        /* flush too old packets
-                                         * If HZ < 1000, flush all packets.
-                                         */
-                                        napi_gro_flush(n, HZ >= 1000);
-                                }
-                                list_add_tail(&n->poll_list, &repoll);
-                        }
                }
-                netpoll_poll_unlock(have);
        }
-        if (!sd_has_rps_ipi_waiting(sd) &&
-            list_empty(&list) &&
-            list_empty(&repoll))
-                return;
-out:
        local_irq_disable();
        list_splice_tail_init(&sd->poll_list, &list);
@@ -4641,12 +4643,6 @@ out:
                __raise_softirq_irqoff(NET_RX_SOFTIRQ);
        net_rps_action_and_irq_enable(sd);
-        return;
-softnet_break:
-        sd->time_squeeze++;
-        goto out;
 }
 struct netdev_adjacent {
@@ -5298,7 +5294,7 @@ void netdev_upper_dev_unlink(struct net_device *dev,
 }
 EXPORT_SYMBOL(netdev_upper_dev_unlink);
-void netdev_adjacent_add_links(struct net_device *dev)
+static void netdev_adjacent_add_links(struct net_device *dev)
 {
        struct netdev_adjacent *iter;
@@ -5323,7 +5319,7 @@ void netdev_adjacent_add_links(struct net_device *dev)
        }
 }
-void netdev_adjacent_del_links(struct net_device *dev)
+static void netdev_adjacent_del_links(struct net_device *dev)
 {
        struct netdev_adjacent *iter;
@@ -6631,7 +6627,7 @@ struct netdev_queue *dev_ingress_queue_create(struct net_device *dev)
        if (!queue)
                return NULL;
        netdev_init_one_queue(dev, queue, NULL);
-        queue->qdisc = &noop_qdisc;
+        RCU_INIT_POINTER(queue->qdisc, &noop_qdisc);
        queue->qdisc_sleeping = &noop_qdisc;
        rcu_assign_pointer(dev->ingress_queue, queue);
 #endif
@@ -7047,10 +7043,20 @@ static int dev_cpu_callback(struct notifier_block *nfb,
                oldsd->output_queue = NULL;
                oldsd->output_queue_tailp = &oldsd->output_queue;
        }
-        /* Append NAPI poll list from offline CPU. */
+        /* Append NAPI poll list from offline CPU, with one exception :
-        if (!list_empty(&oldsd->poll_list)) {
+         * process_backlog() must be called by cpu owning percpu backlog.
-                list_splice_init(&oldsd->poll_list, &sd->poll_list);
+         * We properly handle process_queue & input_pkt_queue later.
-                raise_softirq_irqoff(NET_RX_SOFTIRQ);
+         */
+        while (!list_empty(&oldsd->poll_list)) {
+                struct napi_struct *napi = list_first_entry(&oldsd->poll_list,
+                                                            struct napi_struct,
+                                                            poll_list);
+                list_del_init(&napi->poll_list);
+                if (napi->poll == process_backlog)
+                        napi->state = 0;
+                else
+                        ____napi_schedule(sd, napi);
        }
        raise_softirq_irqoff(NET_TX_SOFTIRQ);
@@ -7061,7 +7067,7 @@ static int dev_cpu_callback(struct notifier_block *nfb,
                netif_rx_internal(skb);
                input_queue_head_incr(oldsd);
        }
-        while ((skb = __skb_dequeue(&oldsd->input_pkt_queue))) {
+        while ((skb = skb_dequeue(&oldsd->input_pkt_queue))) {
                netif_rx_internal(skb);
                input_queue_head_incr(oldsd);
        }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 8e38f17288d3..8d614c93f86a 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2043,6 +2043,12 @@ static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh)
                        case NDTPA_BASE_REACHABLE_TIME:
                                NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
                                              nla_get_msecs(tbp[i]));
+                                /* update reachable_time as well, otherwise, the change will
+                                 * only be effective after the next time neigh_periodic_work
+                                 * decides to recompute it (can be multiple minutes)
+                                 */
+                                p->reachable_time =
+                                        neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
                                break;
                        case NDTPA_GC_STALETIME:
                                NEIGH_VAR_SET(p, GC_STALETIME,
@@ -2921,6 +2927,31 @@ static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
        return ret;
 }
+static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
+                                          void __user *buffer,
+                                          size_t *lenp, loff_t *ppos)
+{
+        struct neigh_parms *p = ctl->extra2;
+        int ret;
+        if (strcmp(ctl->procname, "base_reachable_time") == 0)
+                ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
+        else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
+                ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
+        else
+                ret = -1;
+        if (write && ret == 0) {
+                /* update reachable_time as well, otherwise, the change will
+                 * only be effective after the next time neigh_periodic_work
+                 * decides to recompute it
+                 */
+                p->reachable_time =
+                        neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
+        }
+        return ret;
+}
 #define NEIGH_PARMS_DATA_OFFSET(index)  \
        (&((struct neigh_parms *) 0)->data[index])
@@ -3047,6 +3078,19 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
                t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
                /* ReachableTime (in milliseconds) */
                t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
+        } else {
+                /* Those handlers will update p->reachable_time after
+                 * base_reachable_time(_ms) is set to ensure the new timer starts being
+                 * applied after the next neighbour update instead of waiting for
+                 * neigh_periodic_work to update its value (can be multiple minutes)
+                 * So any handler that replaces them should do this as well
+                 */
+                /* ReachableTime */
+                t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
+                        neigh_proc_base_reachable_time;
+                /* ReachableTime (in milliseconds) */
+                t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
+                        neigh_proc_base_reachable_time;
        }
        /* Don't export sysctls to unprivileged users */
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 9cf6fe9ddc0c..446cbaf81185 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2895,12 +2895,16 @@ static int rtnl_bridge_notify(struct net_device *dev, u16 flags)
                        goto errout;
        }
+        if (!skb->len)
+                goto errout;
        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
        return 0;
 errout:
        WARN_ON(err == -EMSGSIZE);
        kfree_skb(skb);
-        rtnl_set_sk_err(net, RTNLGRP_LINK, err);
+        if (err)
+                rtnl_set_sk_err(net, RTNLGRP_LINK, err);
        return err;
 }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ae13ef6b3ea7..395c15b82087 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4148,6 +4148,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
        skb->ignore_df = 0;
        skb_dst_drop(skb);
        skb->mark = 0;
+        skb_init_secmark(skb);
        secpath_reset(skb);
        nf_reset(skb);
        nf_reset_trace(skb);
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 515569ffde8a..589aafd01fc5 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -46,6 +46,7 @@ void dsa_slave_mii_bus_init(struct dsa_switch *ds)
        snprintf(ds->slave_mii_bus->id, MII_BUS_ID_SIZE, "dsa-%d:%.2x",
                        ds->index, ds->pd->sw_addr);
        ds->slave_mii_bus->parent = ds->master_dev;
+        ds->slave_mii_bus->phy_mask = ~ds->phys_mii_mask;
 }
diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c
index 95e47c97585e..394a200f93c1 100644
--- a/net/ipv4/geneve.c
+++ b/net/ipv4/geneve.c
@@ -122,14 +122,18 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
        int err;
        skb = udp_tunnel_handle_offloads(skb, !gs->sock->sk->sk_no_check_tx);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
        min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
                        + GENEVE_BASE_HLEN + opt_len + sizeof(struct iphdr)
                        + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
        err = skb_cow_head(skb, min_headroom);
-        if (unlikely(err))
+        if (unlikely(err)) {
+                kfree_skb(skb);
                return err;
+        }
        skb = vlan_hwaccel_push_inside(skb);
        if (unlikely(!skb))
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 3a83ce5efa80..787b3c294ce6 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -129,7 +129,8 @@ int ip_forward(struct sk_buff *skb)
         *      We now generate an ICMP HOST REDIRECT giving the route
         *      we calculated.
         */
-        if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb))
+        if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
+            !skb_sec_path(skb))
                ip_rt_send_redirect(skb);
        skb->priority = rt_tos2priority(iph->tos);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index b50861b22b6b..c373c0708d97 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1506,23 +1506,8 @@ static int ip_reply_glue_bits(void *dptr, char *to, int offset,
 /*
 *      Generic function to send a packet as reply to another packet.
 *      Used to send some TCP resets/acks so far.
- *
- *      Use a fake percpu inet socket to avoid false sharing and contention.
 */
-static DEFINE_PER_CPU(struct inet_sock, unicast_sock) = {
+void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
-        .sk = {
-                .__sk_common = {
-                        .skc_refcnt = ATOMIC_INIT(1),
-                },
-                .sk_wmem_alloc  = ATOMIC_INIT(1),
-                .sk_allocation  = GFP_ATOMIC,
-                .sk_flags       = (1UL << SOCK_USE_WRITE_QUEUE),
-        },
-        .pmtudisc       = IP_PMTUDISC_WANT,
-        .uc_ttl         = -1,
-};
-void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
                           const struct ip_options *sopt,
                           __be32 daddr, __be32 saddr,
                           const struct ip_reply_arg *arg,
@@ -1532,9 +1517,8 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
        struct ipcm_cookie ipc;
        struct flowi4 fl4;
        struct rtable *rt = skb_rtable(skb);
+        struct net *net = sock_net(sk);
        struct sk_buff *nskb;
-        struct sock *sk;
-        struct inet_sock *inet;
        int err;
        if (__ip_options_echo(&replyopts.opt.opt, skb, sopt))
@@ -1565,15 +1549,11 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
        if (IS_ERR(rt))
                return;
-        inet = &get_cpu_var(unicast_sock);
+        inet_sk(sk)->tos = arg->tos;
-        inet->tos = arg->tos;
-        sk = &inet->sk;
        sk->sk_priority = skb->priority;
        sk->sk_protocol = ip_hdr(skb)->protocol;
        sk->sk_bound_dev_if = arg->bound_dev_if;
-        sock_net_set(sk, net);
-        __skb_queue_head_init(&sk->sk_write_queue);
        sk->sk_sndbuf = sysctl_wmem_default;
        err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,
                             len, 0, &ipc, &rt, MSG_DONTWAIT);
@@ -1589,13 +1569,10 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
                          arg->csumoffset) = csum_fold(csum_add(nskb->csum,
                                                                arg->csum));
                nskb->ip_summed = CHECKSUM_NONE;
-                skb_orphan(nskb);
                skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb));
                ip_push_pending_frames(sk, &fl4);
        }
 out:
-        put_cpu_var(unicast_sock);
        ip_rt_put(rt);
 }
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 8a89c738b7a3..6b85adb05003 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -461,17 +461,13 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
        memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
        sin = &errhdr.offender;
-        sin->sin_family = AF_UNSPEC;
+        memset(sin, 0, sizeof(*sin));
        if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
            ipv4_pktinfo_prepare_errqueue(sk, skb, serr->ee.ee_origin)) {
-                struct inet_sock *inet = inet_sk(sk);
                sin->sin_family = AF_INET;
                sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
-                sin->sin_port = 0;
+                if (inet_sk(sk)->cmsg_flags)
-                memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
-                if (inet->cmsg_flags)
                        ip_cmsg_recv(msg, skb);
        }
diff --git a/net/ipv4/netfilter/nft_redir_ipv4.c b/net/ipv4/netfilter/nft_redir_ipv4.c
index ff2d23d8c87a..6ecfce63201a 100644
--- a/net/ipv4/netfilter/nft_redir_ipv4.c
+++ b/net/ipv4/netfilter/nft_redir_ipv4.c
@@ -27,10 +27,10 @@ static void nft_redir_ipv4_eval(const struct nft_expr *expr,
        memset(&mr, 0, sizeof(mr));
        if (priv->sreg_proto_min) {
-                mr.range[0].min.all = (__force __be16)
+                mr.range[0].min.all =
-                                        data[priv->sreg_proto_min].data[0];
+                        *(__be16 *)&data[priv->sreg_proto_min].data[0];
-                mr.range[0].max.all = (__force __be16)
+                mr.range[0].max.all =
-                                        data[priv->sreg_proto_max].data[0];
+                        *(__be16 *)&data[priv->sreg_proto_max].data[0];
                mr.range[0].flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
        }
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index c0d82f78d364..2a3720fb5a5f 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -966,8 +966,11 @@ bool ping_rcv(struct sk_buff *skb)
        sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id));
        if (sk != NULL) {
+                struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
                pr_debug("rcv on socket %p\n", sk);
-                ping_queue_rcv_skb(sk, skb_get(skb));
+                if (skb2)
+                        ping_queue_rcv_skb(sk, skb2);
                sock_put(sk);
                return true;
        }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6a2155b02602..52e1f2bf0ca2 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -966,6 +966,9 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
        if (dst->dev->mtu < mtu)
                return;
+        if (rt->rt_pmtu && rt->rt_pmtu < mtu)
+                return;
        if (mtu < ip_rt_min_pmtu)
                mtu = ip_rt_min_pmtu;
@@ -1554,11 +1557,10 @@ static int __mkroute_input(struct sk_buff *skb,
        do_cache = res->fi && !itag;
        if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
+            skb->protocol == htons(ETH_P_IP) &&
            (IN_DEV_SHARED_MEDIA(out_dev) ||
-             inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
+             inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
-                flags |= RTCF_DOREDIRECT;
+                IPCB(skb)->flags |= IPSKB_DOREDIRECT;
-                do_cache = false;
-        }
        if (skb->protocol != htons(ETH_P_IP)) {
                /* Not IP (i.e. ARP). Do not create route, if it is
@@ -2303,6 +2305,8 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src,
        r->rtm_flags    = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
        if (rt->rt_flags & RTCF_NOTIFY)
                r->rtm_flags |= RTM_F_NOTIFY;
+        if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
+                r->rtm_flags |= RTCF_DOREDIRECT;
        if (nla_put_be32(skb, RTA_DST, dst))
                goto nla_put_failure;
diff --git a/net/ipv4/tcp_bic.c b/net/ipv4/tcp_bic.c
index bb395d46a389..c037644eafb7 100644
--- a/net/ipv4/tcp_bic.c
+++ b/net/ipv4/tcp_bic.c
@@ -150,7 +150,7 @@ static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
                tcp_slow_start(tp, acked);
        else {
                bictcp_update(ca, tp->snd_cwnd);
-                tcp_cong_avoid_ai(tp, ca->cnt);
+                tcp_cong_avoid_ai(tp, ca->cnt, 1);
        }
 }
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 27ead0dd16bc..8670e68e2ce6 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -291,26 +291,32 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
 * ABC caps N to 2. Slow start exits when cwnd grows over ssthresh and
 * returns the leftover acks to adjust cwnd in congestion avoidance mode.
 */
-void tcp_slow_start(struct tcp_sock *tp, u32 acked)
+u32 tcp_slow_start(struct tcp_sock *tp, u32 acked)
 {
        u32 cwnd = tp->snd_cwnd + acked;
        if (cwnd > tp->snd_ssthresh)
                cwnd = tp->snd_ssthresh + 1;
+        acked -= cwnd - tp->snd_cwnd;
        tp->snd_cwnd = min(cwnd, tp->snd_cwnd_clamp);
+        return acked;
 }
 EXPORT_SYMBOL_GPL(tcp_slow_start);
-/* In theory this is tp->snd_cwnd += 1 / tp->snd_cwnd (or alternative w) */
+/* In theory this is tp->snd_cwnd += 1 / tp->snd_cwnd (or alternative w),
-void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w)
+ * for every packet that was ACKed.
+ */
+void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked)
 {
+        tp->snd_cwnd_cnt += acked;
        if (tp->snd_cwnd_cnt >= w) {
-                if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                u32 delta = tp->snd_cwnd_cnt / w;
-                        tp->snd_cwnd++;
-                tp->snd_cwnd_cnt = 0;
+                tp->snd_cwnd_cnt -= delta * w;
-        } else {
+                tp->snd_cwnd += delta;
-                tp->snd_cwnd_cnt++;
        }
+        tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_cwnd_clamp);
 }
 EXPORT_SYMBOL_GPL(tcp_cong_avoid_ai);
@@ -329,11 +335,13 @@ void tcp_reno_cong_avoid(struct sock *sk, u32 ack, u32 acked)
                return;
        /* In "safe" area, increase. */
-        if (tp->snd_cwnd <= tp->snd_ssthresh)
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
-                tcp_slow_start(tp, acked);
+                acked = tcp_slow_start(tp, acked);
+                if (!acked)
+                        return;
+        }
        /* In dangerous area, increase slowly. */
-        else
+        tcp_cong_avoid_ai(tp, tp->snd_cwnd, acked);
-                tcp_cong_avoid_ai(tp, tp->snd_cwnd);
 }
 EXPORT_SYMBOL_GPL(tcp_reno_cong_avoid);
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index 6b6002416a73..4b276d1ed980 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -93,9 +93,7 @@ struct bictcp {
        u32     epoch_start;    /* beginning of an epoch */
        u32     ack_cnt;        /* number of acks */
        u32     tcp_cwnd;       /* estimated tcp cwnd */
-#define ACK_RATIO_SHIFT 4
+        u16     unused;
-#define ACK_RATIO_LIMIT (32u << ACK_RATIO_SHIFT)
-        u16     delayed_ack;    /* estimate the ratio of Packets/ACKs << 4 */
        u8      sample_cnt;     /* number of samples to decide curr_rtt */
        u8      found;          /* the exit point is found? */
        u32     round_start;    /* beginning of each round */
@@ -114,7 +112,6 @@ static inline void bictcp_reset(struct bictcp *ca)
        ca->bic_K = 0;
        ca->delay_min = 0;
        ca->epoch_start = 0;
-        ca->delayed_ack = 2 << ACK_RATIO_SHIFT;
        ca->ack_cnt = 0;
        ca->tcp_cwnd = 0;
        ca->found = 0;
@@ -205,23 +202,30 @@ static u32 cubic_root(u64 a)
 /*
 * Compute congestion window to use.
 */
-static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
+static inline void bictcp_update(struct bictcp *ca, u32 cwnd, u32 acked)
 {
        u32 delta, bic_target, max_cnt;
        u64 offs, t;
-        ca->ack_cnt++;  /* count the number of ACKs */
+        ca->ack_cnt += acked;   /* count the number of ACKed packets */
        if (ca->last_cwnd == cwnd &&
            (s32)(tcp_time_stamp - ca->last_time) <= HZ / 32)
                return;
+        /* The CUBIC function can update ca->cnt at most once per jiffy.
+         * On all cwnd reduction events, ca->epoch_start is set to 0,
+         * which will force a recalculation of ca->cnt.
+         */
+        if (ca->epoch_start && tcp_time_stamp == ca->last_time)
+                goto tcp_friendliness;
        ca->last_cwnd = cwnd;
        ca->last_time = tcp_time_stamp;
        if (ca->epoch_start == 0) {
                ca->epoch_start = tcp_time_stamp;       /* record beginning */
-                ca->ack_cnt = 1;                        /* start counting */
+                ca->ack_cnt = acked;                    /* start counting */
                ca->tcp_cwnd = cwnd;                    /* syn with cubic */
                if (ca->last_max_cwnd <= cwnd) {
@@ -283,6 +287,7 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
        if (ca->last_max_cwnd == 0 && ca->cnt > 20)
                ca->cnt = 20;   /* increase cwnd 5% per RTT */
+tcp_friendliness:
        /* TCP Friendly */
        if (tcp_friendliness) {
                u32 scale = beta_scale;
@@ -301,7 +306,6 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
                }
        }
-        ca->cnt = (ca->cnt << ACK_RATIO_SHIFT) / ca->delayed_ack;
        if (ca->cnt == 0)                       /* cannot be zero */
                ca->cnt = 1;
 }
@@ -317,11 +321,12 @@ static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
        if (tp->snd_cwnd <= tp->snd_ssthresh) {
                if (hystart && after(ack, ca->end_seq))
                        bictcp_hystart_reset(sk);
-                tcp_slow_start(tp, acked);
+                acked = tcp_slow_start(tp, acked);
-        } else {
+                if (!acked)
-                bictcp_update(ca, tp->snd_cwnd);
+                        return;
-                tcp_cong_avoid_ai(tp, ca->cnt);
        }
+        bictcp_update(ca, tp->snd_cwnd, acked);
+        tcp_cong_avoid_ai(tp, ca->cnt, acked);
 }
 static u32 bictcp_recalc_ssthresh(struct sock *sk)
@@ -411,20 +416,10 @@ static void hystart_update(struct sock *sk, u32 delay)
 */
 static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us)
 {
-        const struct inet_connection_sock *icsk = inet_csk(sk);
        const struct tcp_sock *tp = tcp_sk(sk);
        struct bictcp *ca = inet_csk_ca(sk);
        u32 delay;
-        if (icsk->icsk_ca_state == TCP_CA_Open) {
-                u32 ratio = ca->delayed_ack;
-                ratio -= ca->delayed_ack >> ACK_RATIO_SHIFT;
-                ratio += cnt;
-                ca->delayed_ack = clamp(ratio, 1U, ACK_RATIO_LIMIT);
-        }
        /* Some calls are for duplicates without timetamps */
        if (rtt_us < 0)
                return;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a3f72d7fc06c..d22f54482bab 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -683,7 +683,8 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
                arg.bound_dev_if = sk->sk_bound_dev_if;
        arg.tos = ip_hdr(skb)->tos;
-        ip_send_unicast_reply(net, skb, &TCP_SKB_CB(skb)->header.h4.opt,
+        ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
+                              skb, &TCP_SKB_CB(skb)->header.h4.opt,
                              ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
                              &arg, arg.iov[0].iov_len);
@@ -767,7 +768,8 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
        if (oif)
                arg.bound_dev_if = oif;
        arg.tos = tos;
-        ip_send_unicast_reply(net, skb, &TCP_SKB_CB(skb)->header.h4.opt,
+        ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
+                              skb, &TCP_SKB_CB(skb)->header.h4.opt,
                              ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
                              &arg, arg.iov[0].iov_len);
@@ -2428,14 +2430,39 @@ struct proto tcp_prot = {
 };
 EXPORT_SYMBOL(tcp_prot);
+static void __net_exit tcp_sk_exit(struct net *net)
+{
+        int cpu;
+        for_each_possible_cpu(cpu)
+                inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu));
+        free_percpu(net->ipv4.tcp_sk);
+}
 static int __net_init tcp_sk_init(struct net *net)
 {
+        int res, cpu;
+        net->ipv4.tcp_sk = alloc_percpu(struct sock *);
+        if (!net->ipv4.tcp_sk)
+                return -ENOMEM;
+        for_each_possible_cpu(cpu) {
+                struct sock *sk;
+                res = inet_ctl_sock_create(&sk, PF_INET, SOCK_RAW,
+                                           IPPROTO_TCP, net);
+                if (res)
+                        goto fail;
+                *per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk;
+        }
        net->ipv4.sysctl_tcp_ecn = 2;
        return 0;
-}
-static void __net_exit tcp_sk_exit(struct net *net)
+fail:
-{
+        tcp_sk_exit(net);
+        return res;
 }
 static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7f18262e2326..65caf8b95e17 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2019,7 +2019,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
                        break;
-                if (tso_segs == 1) {
+                if (tso_segs == 1 || !max_segs) {
                        if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
                                                     (tcp_skb_is_last(sk, skb) ?
                                                      nonagle : TCP_NAGLE_PUSH))))
@@ -2032,7 +2032,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                }
                limit = mss_now;
-                if (tso_segs > 1 && !tcp_urg_mode(tp))
+                if (tso_segs > 1 && max_segs && !tcp_urg_mode(tp))
                        limit = tcp_mss_split_point(sk, skb, mss_now,
                                                    min_t(unsigned int,
                                                          cwnd_quota,
diff --git a/net/ipv4/tcp_scalable.c b/net/ipv4/tcp_scalable.c
index 6824afb65d93..333bcb2415ff 100644
--- a/net/ipv4/tcp_scalable.c
+++ b/net/ipv4/tcp_scalable.c
@@ -25,7 +25,8 @@ static void tcp_scalable_cong_avoid(struct sock *sk, u32 ack, u32 acked)
        if (tp->snd_cwnd <= tp->snd_ssthresh)
                tcp_slow_start(tp, acked);
        else
-                tcp_cong_avoid_ai(tp, min(tp->snd_cwnd, TCP_SCALABLE_AI_CNT));
+                tcp_cong_avoid_ai(tp, min(tp->snd_cwnd, TCP_SCALABLE_AI_CNT),
+                                  1);
 }
 static u32 tcp_scalable_ssthresh(struct sock *sk)
diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
index a4d2d2d88dca..112151eeee45 100644
--- a/net/ipv4/tcp_veno.c
+++ b/net/ipv4/tcp_veno.c
@@ -159,7 +159,7 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 acked)
                                /* In the "non-congestive state", increase cwnd
                                 *  every rtt.
                                 */
-                                tcp_cong_avoid_ai(tp, tp->snd_cwnd);
+                                tcp_cong_avoid_ai(tp, tp->snd_cwnd, 1);
                        } else {
                                /* In the "congestive state", increase cwnd
                                 * every other rtt.
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index cd7273218598..17d35662930d 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -92,7 +92,7 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)
        } else {
                /* Reno */
-                tcp_cong_avoid_ai(tp, tp->snd_cwnd);
+                tcp_cong_avoid_ai(tp, tp->snd_cwnd, 1);
        }
        /* The key players are v_vegas.beg_snd_una and v_beg_snd_nxt.
diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
index 7927db0a9279..4a000f1dd757 100644
--- a/net/ipv4/udp_diag.c
+++ b/net/ipv4/udp_diag.c
@@ -99,11 +99,13 @@ static void udp_dump(struct udp_table *table, struct sk_buff *skb, struct netlin
        s_slot = cb->args[0];
        num = s_num = cb->args[1];
-        for (slot = s_slot; slot <= table->mask; num = s_num = 0, slot++) {
+        for (slot = s_slot; slot <= table->mask; s_num = 0, slot++) {
                struct sock *sk;
                struct hlist_nulls_node *node;
                struct udp_hslot *hslot = &table->hash[slot];
+                num = 0;
                if (hlist_nulls_empty(&hslot->head))
                        continue;
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 100c589a2a6c..49f5e73db122 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -393,11 +393,10 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
        memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
        sin = &errhdr.offender;
-        sin->sin6_family = AF_UNSPEC;
+        memset(sin, 0, sizeof(*sin));
        if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
                sin->sin6_family = AF_INET6;
-                sin->sin6_flowinfo = 0;
-                sin->sin6_port = 0;
                if (np->rxopt.all) {
                        if (serr->ee.ee_origin != SO_EE_ORIGIN_ICMP &&
                            serr->ee.ee_origin != SO_EE_ORIGIN_ICMP6)
@@ -412,12 +411,9 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
                                ipv6_iface_scope_id(&sin->sin6_addr,
                                                    IP6CB(skb)->iif);
                } else {
-                        struct inet_sock *inet = inet_sk(sk);
                        ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
                                               &sin->sin6_addr);
-                        sin->sin6_scope_id = 0;
+                        if (inet_sk(sk)->cmsg_flags)
-                        if (inet->cmsg_flags)
                                ip_cmsg_recv(msg, skb);
                }
        }
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index b2d1838897c9..f1c6d5e98322 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -659,6 +659,29 @@ static int fib6_commit_metrics(struct dst_entry *dst,
        return 0;
 }
+static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
+                          struct net *net)
+{
+        if (atomic_read(&rt->rt6i_ref) != 1) {
+                /* This route is used as dummy address holder in some split
+                 * nodes. It is not leaked, but it still holds other resources,
+                 * which must be released in time. So, scan ascendant nodes
+                 * and replace dummy references to this route with references
+                 * to still alive ones.
+                 */
+                while (fn) {
+                        if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
+                                fn->leaf = fib6_find_prefix(net, fn);
+                                atomic_inc(&fn->leaf->rt6i_ref);
+                                rt6_release(rt);
+                        }
+                        fn = fn->parent;
+                }
+                /* No more references are possible at this point. */
+                BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
+        }
+}
 /*
 *      Insert routing information in a node.
 */
@@ -807,11 +830,12 @@ add:
                rt->dst.rt6_next = iter->dst.rt6_next;
                atomic_inc(&rt->rt6i_ref);
                inet6_rt_notify(RTM_NEWROUTE, rt, info);
-                rt6_release(iter);
                if (!(fn->fn_flags & RTN_RTINFO)) {
                        info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
                        fn->fn_flags |= RTN_RTINFO;
                }
+                fib6_purge_rt(iter, fn, info->nl_net);
+                rt6_release(iter);
        }
        return 0;
@@ -1322,24 +1346,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
                fn = fib6_repair_tree(net, fn);
        }
-        if (atomic_read(&rt->rt6i_ref) != 1) {
+        fib6_purge_rt(rt, fn, net);
-                /* This route is used as dummy address holder in some split
-                 * nodes. It is not leaked, but it still holds other resources,
-                 * which must be released in time. So, scan ascendant nodes
-                 * and replace dummy references to this route with references
-                 * to still alive ones.
-                 */
-                while (fn) {
-                        if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
-                                fn->leaf = fib6_find_prefix(net, fn);
-                                atomic_inc(&fn->leaf->rt6i_ref);
-                                rt6_release(rt);
-                        }
-                        fn = fn->parent;
-                }
-                /* No more references are possible at this point. */
-                BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
-        }
        inet6_rt_notify(RTM_DELROUTE, rt, info);
        rt6_release(rt);
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 13cda4c6313b..01ccc28a686f 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -417,7 +417,7 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                if (code == ICMPV6_HDR_FIELD)
                        teli = ip6_tnl_parse_tlv_enc_lim(skb, skb->data);
-                if (teli && teli == info - 2) {
+                if (teli && teli == be32_to_cpu(info) - 2) {
                        tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
                        if (tel->encap_limit == 0) {
                                net_warn_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
@@ -429,7 +429,7 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                }
                break;
        case ICMPV6_PKT_TOOBIG:
-                mtu = info - offset;
+                mtu = be32_to_cpu(info) - offset;
                if (mtu < IPV6_MIN_MTU)
                        mtu = IPV6_MIN_MTU;
                t->dev->mtu = mtu;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index ce69a12ae48c..d28f2a2efb32 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -537,20 +537,6 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
        skb_copy_secmark(to, from);
 }
-static void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
-{
-        static u32 ip6_idents_hashrnd __read_mostly;
-        u32 hash, id;
-        net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
-        hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
-        hash = __ipv6_addr_jhash(&rt->rt6i_src.addr, hash);
-        id = ip_idents_reserve(hash, 1);
-        fhdr->identification = htonl(id);
-}
 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
        struct sk_buff *frag;
diff --git a/net/ipv6/netfilter/nft_redir_ipv6.c b/net/ipv6/netfilter/nft_redir_ipv6.c
index 2433a6bfb191..11820b6b3613 100644
--- a/net/ipv6/netfilter/nft_redir_ipv6.c
+++ b/net/ipv6/netfilter/nft_redir_ipv6.c
@@ -27,10 +27,10 @@ static void nft_redir_ipv6_eval(const struct nft_expr *expr,
        memset(&range, 0, sizeof(range));
        if (priv->sreg_proto_min) {
-                range.min_proto.all = (__force __be16)
+                range.min_proto.all =
-                                        data[priv->sreg_proto_min].data[0];
+                        *(__be16 *)&data[priv->sreg_proto_min].data[0];
-                range.max_proto.all = (__force __be16)
+                range.max_proto.all =
-                                        data[priv->sreg_proto_max].data[0];
+                        *(__be16 *)&data[priv->sreg_proto_max].data[0];
                range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
        }
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 97f41a3e68d9..54520a0bd5e3 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -9,6 +9,24 @@
 #include <net/addrconf.h>
 #include <net/secure_seq.h>
+u32 __ipv6_select_ident(u32 hashrnd, struct in6_addr *dst, struct in6_addr *src)
+{
+        u32 hash, id;
+        hash = __ipv6_addr_jhash(dst, hashrnd);
+        hash = __ipv6_addr_jhash(src, hash);
+        /* Treat id of 0 as unset and if we get 0 back from ip_idents_reserve,
+         * set the hight order instead thus minimizing possible future
+         * collisions.
+         */
+        id = ip_idents_reserve(hash, 1);
+        if (unlikely(!id))
+                id = 1 << 31;
+        return id;
+}
 /* This function exists only for tap drivers that must support broken
 * clients requesting UFO without specifying an IPv6 fragment ID.
 *
@@ -22,7 +40,7 @@ void ipv6_proxy_select_ident(struct sk_buff *skb)
        static u32 ip6_proxy_idents_hashrnd __read_mostly;
        struct in6_addr buf[2];
        struct in6_addr *addrs;
-        u32 hash, id;
+        u32 id;
        addrs = skb_header_pointer(skb,
                                   skb_network_offset(skb) +
@@ -34,14 +52,25 @@ void ipv6_proxy_select_ident(struct sk_buff *skb)
        net_get_random_once(&ip6_proxy_idents_hashrnd,
                            sizeof(ip6_proxy_idents_hashrnd));
-        hash = __ipv6_addr_jhash(&addrs[1], ip6_proxy_idents_hashrnd);
+        id = __ipv6_select_ident(ip6_proxy_idents_hashrnd,
-        hash = __ipv6_addr_jhash(&addrs[0], hash);
+                                 &addrs[1], &addrs[0]);
+        skb_shinfo(skb)->ip6_frag_id = id;
-        id = ip_idents_reserve(hash, 1);
-        skb_shinfo(skb)->ip6_frag_id = htonl(id);
 }
 EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident);
+void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
+{
+        static u32 ip6_idents_hashrnd __read_mostly;
+        u32 id;
+        net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
+        id = __ipv6_select_ident(ip6_idents_hashrnd, &rt->rt6i_dst.addr,
+                                 &rt->rt6i_src.addr);
+        fhdr->identification = htonl(id);
+}
+EXPORT_SYMBOL(ipv6_select_ident);
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
        u16 offset = sizeof(struct ipv6hdr);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c91083156edb..495965358d22 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1160,12 +1160,9 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
                struct net *net = dev_net(dst->dev);
                rt6->rt6i_flags |= RTF_MODIFIED;
-                if (mtu < IPV6_MIN_MTU) {
+                if (mtu < IPV6_MIN_MTU)
-                        u32 features = dst_metric(dst, RTAX_FEATURES);
                        mtu = IPV6_MIN_MTU;
-                        features |= RTAX_FEATURE_ALLFRAG;
-                        dst_metric_set(dst, RTAX_FEATURES, features);
-                }
                dst_metric_set(dst, RTAX_MTU, mtu);
                rt6_update_expires(rt6, net->ipv6.sysctl.ip6_rt_mtu_expires);
        }
@@ -1245,12 +1242,16 @@ restart:
                rt = net->ipv6.ip6_null_entry;
        else if (rt->dst.error) {
                rt = net->ipv6.ip6_null_entry;
-        } else if (rt == net->ipv6.ip6_null_entry) {
+                goto out;
+        }
+        if (rt == net->ipv6.ip6_null_entry) {
                fn = fib6_backtrack(fn, &fl6->saddr);
                if (fn)
                        goto restart;
        }
+out:
        dst_hold(&rt->dst);
        read_unlock_bh(&table->tb6_lock);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 213546bd6d5d..cdbfe5af6187 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1506,12 +1506,12 @@ static bool ipip6_netlink_encap_parms(struct nlattr *data[],
        if (data[IFLA_IPTUN_ENCAP_SPORT]) {
                ret = true;
-                ipencap->sport = nla_get_u16(data[IFLA_IPTUN_ENCAP_SPORT]);
+                ipencap->sport = nla_get_be16(data[IFLA_IPTUN_ENCAP_SPORT]);
        }
        if (data[IFLA_IPTUN_ENCAP_DPORT]) {
                ret = true;
-                ipencap->dport = nla_get_u16(data[IFLA_IPTUN_ENCAP_DPORT]);
+                ipencap->dport = nla_get_be16(data[IFLA_IPTUN_ENCAP_DPORT]);
        }
        return ret;
@@ -1707,9 +1707,9 @@ static int ipip6_fill_info(struct sk_buff *skb, const struct net_device *dev)
        if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE,
                        tunnel->encap.type) ||
-            nla_put_u16(skb, IFLA_IPTUN_ENCAP_SPORT,
+            nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT,
                        tunnel->encap.sport) ||
-            nla_put_u16(skb, IFLA_IPTUN_ENCAP_DPORT,
+            nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT,
                        tunnel->encap.dport) ||
            nla_put_u16(skb, IFLA_IPTUN_ENCAP_FLAGS,
                        tunnel->encap.flags))
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 5ff87805258e..9c0b54e87b47 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1387,6 +1387,28 @@ ipv6_pktoptions:
        return 0;
 }
+static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
+                           const struct tcphdr *th)
+{
+        /* This is tricky: we move IP6CB at its correct location into
+         * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
+         * _decode_session6() uses IP6CB().
+         * barrier() makes sure compiler won't play aliasing games.
+         */
+        memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
+                sizeof(struct inet6_skb_parm));
+        barrier();
+        TCP_SKB_CB(skb)->seq = ntohl(th->seq);
+        TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
+                                    skb->len - th->doff*4);
+        TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
+        TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
+        TCP_SKB_CB(skb)->tcp_tw_isn = 0;
+        TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
+        TCP_SKB_CB(skb)->sacked = 0;
+}
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
        const struct tcphdr *th;
@@ -1418,24 +1440,9 @@ static int tcp_v6_rcv(struct sk_buff *skb)
        th = tcp_hdr(skb);
        hdr = ipv6_hdr(skb);
-        /* This is tricky : We move IPCB at its correct location into TCP_SKB_CB()
-         * barrier() makes sure compiler wont play fool^Waliasing games.
-         */
-        memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
-                sizeof(struct inet6_skb_parm));
-        barrier();
-        TCP_SKB_CB(skb)->seq = ntohl(th->seq);
-        TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
-                                    skb->len - th->doff*4);
-        TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
-        TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
-        TCP_SKB_CB(skb)->tcp_tw_isn = 0;
-        TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
-        TCP_SKB_CB(skb)->sacked = 0;
        sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
-                                tcp_v6_iif(skb));
+                                inet6_iif(skb));
        if (!sk)
                goto no_tcp_socket;
@@ -1451,6 +1458,8 @@ process:
        if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                goto discard_and_relse;
+        tcp_v6_fill_cb(skb, hdr, th);
 #ifdef CONFIG_TCP_MD5SIG
        if (tcp_v6_inbound_md5_hash(sk, skb))
                goto discard_and_relse;
@@ -1482,6 +1491,8 @@ no_tcp_socket:
        if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
                goto discard_it;
+        tcp_v6_fill_cb(skb, hdr, th);
        if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
 csum_error:
                TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
@@ -1505,6 +1516,8 @@ do_time_wait:
                goto discard_it;
        }
+        tcp_v6_fill_cb(skb, hdr, th);
        if (skb->len < (th->doff<<2)) {
                inet_twsk_put(inet_twsk(sk));
                goto bad_packet;
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index b6aa8ed18257..a56276996b72 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -52,6 +52,10 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
+                /* Set the IPv6 fragment id if not set yet */
+                if (!skb_shinfo(skb)->ip6_frag_id)
+                        ipv6_proxy_select_ident(skb);
                segs = NULL;
                goto out;
        }
@@ -108,7 +112,11 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
                fptr->nexthdr = nexthdr;
                fptr->reserved = 0;
-                fptr->identification = skb_shinfo(skb)->ip6_frag_id;
+                if (skb_shinfo(skb)->ip6_frag_id)
+                        fptr->identification = skb_shinfo(skb)->ip6_frag_id;
+                else
+                        ipv6_select_ident(fptr,
+                                          (struct rt6_info *)skb_dst(skb));
                /* Fragment the skb. ipv6 header and the remaining fields of the
                 * fragment header are updated in ipv6_gso_segment()
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 5f983644373a..48bf5a06847b 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -130,12 +130,18 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 {
        struct flowi6 *fl6 = &fl->u.ip6;
        int onlyproto = 0;
-        u16 offset = skb_network_header_len(skb);
        const struct ipv6hdr *hdr = ipv6_hdr(skb);
+        u16 offset = sizeof(*hdr);
        struct ipv6_opt_hdr *exthdr;
        const unsigned char *nh = skb_network_header(skb);
-        u8 nexthdr = nh[IP6CB(skb)->nhoff];
+        u16 nhoff = IP6CB(skb)->nhoff;
        int oif = 0;
+        u8 nexthdr;
+        if (!nhoff)
+                nhoff = offsetof(struct ipv6hdr, nexthdr);
+        nexthdr = nh[nhoff];
        if (skb_dst(skb))
                oif = skb_dst(skb)->dev->ifindex;
diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c
index 612a5ddaf93b..799bafc2af39 100644
--- a/net/llc/sysctl_net_llc.c
+++ b/net/llc/sysctl_net_llc.c
@@ -18,28 +18,28 @@ static struct ctl_table llc2_timeout_table[] = {
        {
                .procname       = "ack",
                .data           = &sysctl_llc2_ack_timeout,
-                .maxlen         = sizeof(long),
+                .maxlen         = sizeof(sysctl_llc2_ack_timeout),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_jiffies,
        },
        {
                .procname       = "busy",
                .data           = &sysctl_llc2_busy_timeout,
-                .maxlen         = sizeof(long),
+                .maxlen         = sizeof(sysctl_llc2_busy_timeout),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_jiffies,
        },
        {
                .procname       = "p",
                .data           = &sysctl_llc2_p_timeout,
-                .maxlen         = sizeof(long),
+                .maxlen         = sizeof(sysctl_llc2_p_timeout),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_jiffies,
        },
        {
                .procname       = "rej",
                .data           = &sysctl_llc2_rej_timeout,
-                .maxlen         = sizeof(long),
+                .maxlen         = sizeof(sysctl_llc2_rej_timeout),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_jiffies,
        },
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 0bb7038121ac..bd4e46ec32bd 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -140,7 +140,9 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
        if (!ret) {
                key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                        sdata->crypto_tx_tailroom_needed_cnt--;
                WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
@@ -188,7 +190,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
        sta = key->sta;
        sdata = key->sdata;
-        if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+        if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+              (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+              (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                increment_tailroom_need_count(sdata);
        ret = drv_set_key(key->local, DISABLE_KEY, sdata,
@@ -884,7 +888,9 @@ void ieee80211_remove_key(struct ieee80211_key_conf *keyconf)
        if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                        increment_tailroom_need_count(key->sdata);
        }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 2c36c4765f47..837a406a9dd6 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1643,7 +1643,7 @@ __ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
 {
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        bool ret;
+        bool ret = false;
        int ac;
        if (local->hw.queues < IEEE80211_NUM_ACS)
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 4c5192e0d66c..4a95fe3cffbc 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -86,20 +86,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                }
        }
-        /* tear down aggregation sessions and remove STAs */
-        mutex_lock(&local->sta_mtx);
-        list_for_each_entry(sta, &local->sta_list, list) {
-                if (sta->uploaded) {
-                        enum ieee80211_sta_state state;
-                        state = sta->sta_state;
-                        for (; state > IEEE80211_STA_NOTEXIST; state--)
-                                WARN_ON(drv_sta_state(local, sta->sdata, sta,
-                                                      state, state - 1));
-                }
-        }
-        mutex_unlock(&local->sta_mtx);
        /* remove all interfaces that were created in the driver */
        list_for_each_entry(sdata, &local->interfaces, list) {
                if (!ieee80211_sdata_running(sdata))
@@ -111,6 +97,21 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                case NL80211_IFTYPE_STATION:
                        ieee80211_mgd_quiesce(sdata);
                        break;
+                case NL80211_IFTYPE_WDS:
+                        /* tear down aggregation sessions and remove STAs */
+                        mutex_lock(&local->sta_mtx);
+                        sta = sdata->u.wds.sta;
+                        if (sta && sta->uploaded) {
+                                enum ieee80211_sta_state state;
+                                state = sta->sta_state;
+                                for (; state > IEEE80211_STA_NOTEXIST; state--)
+                                        WARN_ON(drv_sta_state(local, sta->sdata,
+                                                              sta, state,
+                                                              state - 1));
+                        }
+                        mutex_unlock(&local->sta_mtx);
+                        break;
                default:
                        break;
                }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 683b10f46505..d69ca513848e 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -272,7 +272,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
        else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
                channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
        else if (rate)
-                channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
+                channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
        else
                channel_flags |= IEEE80211_CHAN_2GHZ;
        put_unaligned_le16(channel_flags, pos);
diff --git a/net/mpls/mpls_gso.c b/net/mpls/mpls_gso.c
index ca27837974fe..349295d21946 100644
--- a/net/mpls/mpls_gso.c
+++ b/net/mpls/mpls_gso.c
@@ -31,10 +31,7 @@ static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
                                  SKB_GSO_TCPV6 |
                                  SKB_GSO_UDP |
                                  SKB_GSO_DODGY |
-                                  SKB_GSO_TCP_ECN |
+                                  SKB_GSO_TCP_ECN)))
-                                  SKB_GSO_GRE |
-                                  SKB_GSO_GRE_CSUM |
-                                  SKB_GSO_IPIP)))
                goto out;
        /* Setup inner SKB. */
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 990decba1fe4..b87ca32efa0b 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -659,16 +659,24 @@ static inline int ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)
        return err;
 }
-static int ip_vs_route_me_harder(int af, struct sk_buff *skb)
+static int ip_vs_route_me_harder(int af, struct sk_buff *skb,
+                                 unsigned int hooknum)
 {
+        if (!sysctl_snat_reroute(skb))
+                return 0;
+        /* Reroute replies only to remote clients (FORWARD and LOCAL_OUT) */
+        if (NF_INET_LOCAL_IN == hooknum)
+                return 0;
 #ifdef CONFIG_IP_VS_IPV6
        if (af == AF_INET6) {
-                if (sysctl_snat_reroute(skb) && ip6_route_me_harder(skb) != 0)
+                struct dst_entry *dst = skb_dst(skb);
+                if (dst->dev && !(dst->dev->flags & IFF_LOOPBACK) &&
+                    ip6_route_me_harder(skb) != 0)
                        return 1;
        } else
 #endif
-                if ((sysctl_snat_reroute(skb) ||
+                if (!(skb_rtable(skb)->rt_flags & RTCF_LOCAL) &&
-                     skb_rtable(skb)->rt_flags & RTCF_LOCAL) &&
                    ip_route_me_harder(skb, RTN_LOCAL) != 0)
                        return 1;
@@ -791,7 +799,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
                                union nf_inet_addr *snet,
                                __u8 protocol, struct ip_vs_conn *cp,
                                struct ip_vs_protocol *pp,
-                                unsigned int offset, unsigned int ihl)
+                                unsigned int offset, unsigned int ihl,
+                                unsigned int hooknum)
 {
        unsigned int verdict = NF_DROP;
@@ -821,7 +830,7 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
 #endif
                ip_vs_nat_icmp(skb, pp, cp, 1);
-        if (ip_vs_route_me_harder(af, skb))
+        if (ip_vs_route_me_harder(af, skb, hooknum))
                goto out;
        /* do the statistics and put it back */
@@ -916,7 +925,7 @@ static int ip_vs_out_icmp(struct sk_buff *skb, int *related,
        snet.ip = iph->saddr;
        return handle_response_icmp(AF_INET, skb, &snet, cih->protocol, cp,
-                                    pp, ciph.len, ihl);
+                                    pp, ciph.len, ihl, hooknum);
 }
 #ifdef CONFIG_IP_VS_IPV6
@@ -981,7 +990,8 @@ static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related,
        snet.in6 = ciph.saddr.in6;
        writable = ciph.len;
        return handle_response_icmp(AF_INET6, skb, &snet, ciph.protocol, cp,
-                                    pp, writable, sizeof(struct ipv6hdr));
+                                    pp, writable, sizeof(struct ipv6hdr),
+                                    hooknum);
 }
 #endif
@@ -1040,7 +1050,8 @@ static inline bool is_new_conn(const struct sk_buff *skb,
 */
 static unsigned int
 handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
-                struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
+                struct ip_vs_conn *cp, struct ip_vs_iphdr *iph,
+                unsigned int hooknum)
 {
        struct ip_vs_protocol *pp = pd->pp;
@@ -1078,7 +1089,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
         * if it came from this machine itself.  So re-compute
         * the routing information.
         */
-        if (ip_vs_route_me_harder(af, skb))
+        if (ip_vs_route_me_harder(af, skb, hooknum))
                goto drop;
        IP_VS_DBG_PKT(10, af, pp, skb, 0, "After SNAT");
@@ -1181,7 +1192,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af)
        cp = pp->conn_out_get(af, skb, &iph, 0);
        if (likely(cp))
-                return handle_response(af, skb, pd, cp, &iph);
+                return handle_response(af, skb, pd, cp, &iph, hooknum);
        if (sysctl_nat_icmp_send(net) &&
            (pp->protocol == IPPROTO_TCP ||
             pp->protocol == IPPROTO_UDP ||
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 1d5341f3761d..5d3daae98bf0 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -183,6 +183,8 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
        struct nf_conn *ct;
        struct net *net;
+        *diff = 0;
 #ifdef CONFIG_IP_VS_IPV6
        /* This application helper doesn't work with IPv6 yet,
         * so turn this into a no-op for IPv6 packets
@@ -191,8 +193,6 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                return 1;
 #endif
-        *diff = 0;
        /* Only useful for established sessions */
        if (cp->state != IP_VS_TCP_S_ESTABLISHED)
                return 1;
@@ -322,6 +322,9 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
        struct ip_vs_conn *n_cp;
        struct net *net;
+        /* no diff required for incoming packets */
+        *diff = 0;
 #ifdef CONFIG_IP_VS_IPV6
        /* This application helper doesn't work with IPv6 yet,
         * so turn this into a no-op for IPv6 packets
@@ -330,9 +333,6 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
                return 1;
 #endif
-        /* no diff required for incoming packets */
-        *diff = 0;
        /* Only useful for established sessions */
        if (cp->state != IP_VS_TCP_S_ESTABLISHED)
                return 1;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index a11674806707..46d1b26a468e 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -611,16 +611,15 @@ __nf_conntrack_confirm(struct sk_buff *skb)
         */
        NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
        pr_debug("Confirming conntrack %p\n", ct);
-        /* We have to check the DYING flag inside the lock to prevent
+        /* We have to check the DYING flag after unlink to prevent
-           a race against nf_ct_get_next_corpse() possibly called from
+         * a race against nf_ct_get_next_corpse() possibly called from
-           user context, else we insert an already 'dead' hash, blocking
+         * user context, else we insert an already 'dead' hash, blocking
-           further use of that particular connection -JM */
+         * further use of that particular connection -JM.
+         */
+        nf_ct_del_from_dying_or_unconfirmed_list(ct);
-        if (unlikely(nf_ct_is_dying(ct))) {
+        if (unlikely(nf_ct_is_dying(ct)))
-                nf_conntrack_double_unlock(hash, reply_hash);
+                goto out;
-                local_bh_enable();
-                return NF_ACCEPT;
-        }
        /* See if there's one in the list already, including reverse:
           NAT could have grabbed it without realizing, since we're
@@ -636,8 +635,6 @@ __nf_conntrack_confirm(struct sk_buff *skb)
                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
                        goto out;
-        nf_ct_del_from_dying_or_unconfirmed_list(ct);
        /* Timer relative to confirmation time, not original
           setting time, otherwise we'd get timer wrap in
           weird delay cases. */
@@ -673,6 +670,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
        return NF_ACCEPT;
 out:
+        nf_ct_add_to_dying_list(ct);
        nf_conntrack_double_unlock(hash, reply_hash);
        NF_CT_STAT_INC(net, insert_failed);
        local_bh_enable();
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 129a8daa4abf..1ff04bcd4871 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -713,16 +713,12 @@ static int nft_flush_table(struct nft_ctx *ctx)
        struct nft_chain *chain, *nc;
        struct nft_set *set, *ns;
-        list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
+        list_for_each_entry(chain, &ctx->table->chains, list) {
                ctx->chain = chain;
                err = nft_delrule_by_chain(ctx);
                if (err < 0)
                        goto out;
-                err = nft_delchain(ctx);
-                if (err < 0)
-                        goto out;
        }
        list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
@@ -735,6 +731,14 @@ static int nft_flush_table(struct nft_ctx *ctx)
                        goto out;
        }
+        list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
+                ctx->chain = chain;
+                err = nft_delchain(ctx);
+                if (err < 0)
+                        goto out;
+        }
        err = nft_deltable(ctx);
 out:
        return err;
@@ -1130,9 +1134,11 @@ static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
        /* Restore old counters on this cpu, no problem. Per-cpu statistics
         * are not exposed to userspace.
         */
+        preempt_disable();
        stats = this_cpu_ptr(newstats);
        stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
        stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
+        preempt_enable();
        return newstats;
 }
@@ -1258,8 +1264,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
                nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
                trans = nft_trans_alloc(&ctx, NFT_MSG_NEWCHAIN,
                                        sizeof(struct nft_trans_chain));
-                if (trans == NULL)
+                if (trans == NULL) {
+                        free_percpu(stats);
                        return -ENOMEM;
+                }
                nft_trans_chain_stats(trans) = stats;
                nft_trans_chain_update(trans) = true;
@@ -1315,8 +1323,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
                hookfn = type->hooks[hooknum];
                basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
-                if (basechain == NULL)
+                if (basechain == NULL) {
+                        module_put(type->owner);
                        return -ENOMEM;
+                }
                if (nla[NFTA_CHAIN_COUNTERS]) {
                        stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
@@ -3749,6 +3759,24 @@ int nft_chain_validate_dependency(const struct nft_chain *chain,
 }
 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
+int nft_chain_validate_hooks(const struct nft_chain *chain,
+                             unsigned int hook_flags)
+{
+        struct nft_base_chain *basechain;
+        if (chain->flags & NFT_BASE_CHAIN) {
+                basechain = nft_base_chain(chain);
+                if ((1 << basechain->ops[0].hooknum) & hook_flags)
+                        return 0;
+                return -EOPNOTSUPP;
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
 /*
 * Loop detection - walk through the ruleset beginning at the destination chain
 * of a new jump until either the source chain is reached (loop) or all
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 13c2e17bbe27..c421d94c4652 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -321,7 +321,8 @@ replay:
                nlh = nlmsg_hdr(skb);
                err = 0;
-                if (nlh->nlmsg_len < NLMSG_HDRLEN) {
+                if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) ||
+                    skb->len < nlh->nlmsg_len) {
                        err = -EINVAL;
                        goto ack;
                }
@@ -463,13 +464,13 @@ static void nfnetlink_rcv(struct sk_buff *skb)
 }
 #ifdef CONFIG_MODULES
-static int nfnetlink_bind(int group)
+static int nfnetlink_bind(struct net *net, int group)
 {
        const struct nfnetlink_subsystem *ss;
        int type;
        if (group <= NFNLGRP_NONE || group > NFNLGRP_MAX)
-                return -EINVAL;
+                return 0;
        type = nfnl_group2type[group];
diff --git a/net/netfilter/nft_masq.c b/net/netfilter/nft_masq.c
index d1ffd5eb3a9b..9aea747b43ea 100644
--- a/net/netfilter/nft_masq.c
+++ b/net/netfilter/nft_masq.c
@@ -21,6 +21,21 @@ const struct nla_policy nft_masq_policy[NFTA_MASQ_MAX + 1] = {
 };
 EXPORT_SYMBOL_GPL(nft_masq_policy);
+int nft_masq_validate(const struct nft_ctx *ctx,
+                      const struct nft_expr *expr,
+                      const struct nft_data **data)
+{
+        int err;
+        err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+        if (err < 0)
+                return err;
+        return nft_chain_validate_hooks(ctx->chain,
+                                        (1 << NF_INET_POST_ROUTING));
+}
+EXPORT_SYMBOL_GPL(nft_masq_validate);
 int nft_masq_init(const struct nft_ctx *ctx,
                  const struct nft_expr *expr,
                  const struct nlattr * const tb[])
@@ -28,8 +43,8 @@ int nft_masq_init(const struct nft_ctx *ctx,
        struct nft_masq *priv = nft_expr_priv(expr);
        int err;
-        err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+        err = nft_masq_validate(ctx, expr, NULL);
-        if (err < 0)
+        if (err)
                return err;
        if (tb[NFTA_MASQ_FLAGS] == NULL)
@@ -60,12 +75,5 @@ nla_put_failure:
 }
 EXPORT_SYMBOL_GPL(nft_masq_dump);
-int nft_masq_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
-                      const struct nft_data **data)
-{
-        return nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
-}
-EXPORT_SYMBOL_GPL(nft_masq_validate);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>");
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index afe2b0b45ec4..a0837c6c9283 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -65,10 +65,10 @@ static void nft_nat_eval(const struct nft_expr *expr,
        }
        if (priv->sreg_proto_min) {
-                range.min_proto.all = (__force __be16)
+                range.min_proto.all =
-                                        data[priv->sreg_proto_min].data[0];
+                        *(__be16 *)&data[priv->sreg_proto_min].data[0];
-                range.max_proto.all = (__force __be16)
+                range.max_proto.all =
-                                        data[priv->sreg_proto_max].data[0];
+                        *(__be16 *)&data[priv->sreg_proto_max].data[0];
                range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
        }
@@ -88,17 +88,40 @@ static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = {
        [NFTA_NAT_FLAGS]         = { .type = NLA_U32 },
 };
-static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+static int nft_nat_validate(const struct nft_ctx *ctx,
-                        const struct nlattr * const tb[])
+                            const struct nft_expr *expr,
+                            const struct nft_data **data)
 {
        struct nft_nat *priv = nft_expr_priv(expr);
-        u32 family;
        int err;
        err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
        if (err < 0)
                return err;
+        switch (priv->type) {
+        case NFT_NAT_SNAT:
+                err = nft_chain_validate_hooks(ctx->chain,
+                                               (1 << NF_INET_POST_ROUTING) |
+                                               (1 << NF_INET_LOCAL_IN));
+                break;
+        case NFT_NAT_DNAT:
+                err = nft_chain_validate_hooks(ctx->chain,
+                                               (1 << NF_INET_PRE_ROUTING) |
+                                               (1 << NF_INET_LOCAL_OUT));
+                break;
+        }
+        return err;
+}
+static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+                        const struct nlattr * const tb[])
+{
+        struct nft_nat *priv = nft_expr_priv(expr);
+        u32 family;
+        int err;
        if (tb[NFTA_NAT_TYPE] == NULL ||
            (tb[NFTA_NAT_REG_ADDR_MIN] == NULL &&
             tb[NFTA_NAT_REG_PROTO_MIN] == NULL))
@@ -115,6 +138,10 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                return -EINVAL;
        }
+        err = nft_nat_validate(ctx, expr, NULL);
+        if (err < 0)
+                return err;
        if (tb[NFTA_NAT_FAMILY] == NULL)
                return -EINVAL;
@@ -219,13 +246,6 @@ nla_put_failure:
        return -1;
 }
-static int nft_nat_validate(const struct nft_ctx *ctx,
-                            const struct nft_expr *expr,
-                            const struct nft_data **data)
-{
-        return nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
-}
 static struct nft_expr_type nft_nat_type;
 static const struct nft_expr_ops nft_nat_ops = {
        .type           = &nft_nat_type,
diff --git a/net/netfilter/nft_redir.c b/net/netfilter/nft_redir.c
index 9e8093f28311..d7e9e93a4e90 100644
--- a/net/netfilter/nft_redir.c
+++ b/net/netfilter/nft_redir.c
@@ -23,6 +23,22 @@ const struct nla_policy nft_redir_policy[NFTA_REDIR_MAX + 1] = {
 };
 EXPORT_SYMBOL_GPL(nft_redir_policy);
+int nft_redir_validate(const struct nft_ctx *ctx,
+                       const struct nft_expr *expr,
+                       const struct nft_data **data)
+{
+        int err;
+        err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+        if (err < 0)
+                return err;
+        return nft_chain_validate_hooks(ctx->chain,
+                                        (1 << NF_INET_PRE_ROUTING) |
+                                        (1 << NF_INET_LOCAL_OUT));
+}
+EXPORT_SYMBOL_GPL(nft_redir_validate);
 int nft_redir_init(const struct nft_ctx *ctx,
                   const struct nft_expr *expr,
                   const struct nlattr * const tb[])
@@ -30,7 +46,7 @@ int nft_redir_init(const struct nft_ctx *ctx,
        struct nft_redir *priv = nft_expr_priv(expr);
        int err;
-        err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+        err = nft_redir_validate(ctx, expr, NULL);
        if (err < 0)
                return err;
@@ -88,12 +104,5 @@ nla_put_failure:
 }
 EXPORT_SYMBOL_GPL(nft_redir_dump);
-int nft_redir_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
-                       const struct nft_data **data)
-{
-        return nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
-}
-EXPORT_SYMBOL_GPL(nft_redir_validate);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>");
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 074cf3e91c6f..75532efa51cd 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -61,6 +61,7 @@
 #include <linux/rhashtable.h>
 #include <asm/cacheflush.h>
 #include <linux/hash.h>
+#include <linux/genetlink.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -1091,8 +1092,12 @@ static void netlink_remove(struct sock *sk)
        mutex_unlock(&nl_sk_hash_lock);
        netlink_table_grab();
-        if (nlk_sk(sk)->subscriptions)
+        if (nlk_sk(sk)->subscriptions) {
                __sk_del_bind_node(sk);
+                netlink_update_listeners(sk);
+        }
+        if (sk->sk_protocol == NETLINK_GENERIC)
+                atomic_inc(&genl_sk_destructing_cnt);
        netlink_table_ungrab();
 }
@@ -1139,8 +1144,8 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol,
        struct module *module = NULL;
        struct mutex *cb_mutex;
        struct netlink_sock *nlk;
-        int (*bind)(int group);
+        int (*bind)(struct net *net, int group);
-        void (*unbind)(int group);
+        void (*unbind)(struct net *net, int group);
        int err = 0;
        sock->state = SS_UNCONNECTED;
@@ -1209,6 +1214,20 @@ static int netlink_release(struct socket *sock)
         * will be purged.
         */
+        /* must not acquire netlink_table_lock in any way again before unbind
+         * and notifying genetlink is done as otherwise it might deadlock
+         */
+        if (nlk->netlink_unbind) {
+                int i;
+                for (i = 0; i < nlk->ngroups; i++)
+                        if (test_bit(i, nlk->groups))
+                                nlk->netlink_unbind(sock_net(sk), i + 1);
+        }
+        if (sk->sk_protocol == NETLINK_GENERIC &&
+            atomic_dec_return(&genl_sk_destructing_cnt) == 0)
+                wake_up(&genl_sk_destructing_waitq);
        sock->sk = NULL;
        wake_up_interruptible_all(&nlk->wait);
@@ -1226,8 +1245,8 @@ static int netlink_release(struct socket *sock)
        module_put(nlk->module);
-        netlink_table_grab();
        if (netlink_is_kernel(sk)) {
+                netlink_table_grab();
                BUG_ON(nl_table[sk->sk_protocol].registered == 0);
                if (--nl_table[sk->sk_protocol].registered == 0) {
                        struct listeners *old;
@@ -1241,10 +1260,8 @@ static int netlink_release(struct socket *sock)
                        nl_table[sk->sk_protocol].flags = 0;
                        nl_table[sk->sk_protocol].registered = 0;
                }
-        } else if (nlk->subscriptions) {
+                netlink_table_ungrab();
-                netlink_update_listeners(sk);
        }
-        netlink_table_ungrab();
        kfree(nlk->groups);
        nlk->groups = NULL;
@@ -1410,9 +1427,10 @@ static int netlink_realloc_groups(struct sock *sk)
        return err;
 }
-static void netlink_unbind(int group, long unsigned int groups,
+static void netlink_undo_bind(int group, long unsigned int groups,
-                           struct netlink_sock *nlk)
+                              struct sock *sk)
 {
+        struct netlink_sock *nlk = nlk_sk(sk);
        int undo;
        if (!nlk->netlink_unbind)
@@ -1420,7 +1438,7 @@ static void netlink_unbind(int group, long unsigned int groups,
        for (undo = 0; undo < group; undo++)
                if (test_bit(undo, &groups))
-                        nlk->netlink_unbind(undo);
+                        nlk->netlink_unbind(sock_net(sk), undo + 1);
 }
 static int netlink_bind(struct socket *sock, struct sockaddr *addr,
@@ -1458,10 +1476,10 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                for (group = 0; group < nlk->ngroups; group++) {
                        if (!test_bit(group, &groups))
                                continue;
-                        err = nlk->netlink_bind(group);
+                        err = nlk->netlink_bind(net, group + 1);
                        if (!err)
                                continue;
-                        netlink_unbind(group, groups, nlk);
+                        netlink_undo_bind(group, groups, sk);
                        return err;
                }
        }
@@ -1471,7 +1489,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                        netlink_insert(sk, net, nladdr->nl_pid) :
                        netlink_autobind(sock);
                if (err) {
-                        netlink_unbind(nlk->ngroups, groups, nlk);
+                        netlink_undo_bind(nlk->ngroups, groups, sk);
                        return err;
                }
        }
@@ -2122,7 +2140,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
                if (!val || val - 1 >= nlk->ngroups)
                        return -EINVAL;
                if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) {
-                        err = nlk->netlink_bind(val);
+                        err = nlk->netlink_bind(sock_net(sk), val);
                        if (err)
                                return err;
                }
@@ -2131,7 +2149,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
                                         optname == NETLINK_ADD_MEMBERSHIP);
                netlink_table_ungrab();
                if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind)
-                        nlk->netlink_unbind(val);
+                        nlk->netlink_unbind(sock_net(sk), val);
                err = 0;
                break;
diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
index b20a1731759b..f1c31b39aa3e 100644
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -2,6 +2,7 @@
 #define _AF_NETLINK_H
 #include <linux/rhashtable.h>
+#include <linux/atomic.h>
 #include <net/sock.h>
 #define NLGRPSZ(x)      (ALIGN(x, sizeof(unsigned long) * 8) / 8)
@@ -39,8 +40,8 @@ struct netlink_sock {
        struct mutex            *cb_mutex;
        struct mutex            cb_def_mutex;
        void                    (*netlink_rcv)(struct sk_buff *skb);
-        int                     (*netlink_bind)(int group);
+        int                     (*netlink_bind)(struct net *net, int group);
-        void                    (*netlink_unbind)(int group);
+        void                    (*netlink_unbind)(struct net *net, int group);
        struct module           *module;
 #ifdef CONFIG_NETLINK_MMAP
        struct mutex            pg_vec_lock;
@@ -65,8 +66,8 @@ struct netlink_table {
        unsigned int            groups;
        struct mutex            *cb_mutex;
        struct module           *module;
-        int                     (*bind)(int group);
+        int                     (*bind)(struct net *net, int group);
-        void                    (*unbind)(int group);
+        void                    (*unbind)(struct net *net, int group);
        bool                    (*compare)(struct net *net, struct sock *sock);
        int                     registered;
 };
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 76393f2f4b22..ee57459fc258 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -23,6 +23,9 @@
 static DEFINE_MUTEX(genl_mutex); /* serialization of message processing */
 static DECLARE_RWSEM(cb_lock);
+atomic_t genl_sk_destructing_cnt = ATOMIC_INIT(0);
+DECLARE_WAIT_QUEUE_HEAD(genl_sk_destructing_waitq);
 void genl_lock(void)
 {
        mutex_lock(&genl_mutex);
@@ -435,15 +438,18 @@ int genl_unregister_family(struct genl_family *family)
        genl_lock_all();
-        genl_unregister_mc_groups(family);
        list_for_each_entry(rc, genl_family_chain(family->id), family_list) {
                if (family->id != rc->id || strcmp(rc->name, family->name))
                        continue;
+                genl_unregister_mc_groups(family);
                list_del(&rc->family_list);
                family->n_ops = 0;
-                genl_unlock_all();
+                up_write(&cb_lock);
+                wait_event(genl_sk_destructing_waitq,
+                           atomic_read(&genl_sk_destructing_cnt) == 0);
+                genl_unlock();
                kfree(family->attrbuf);
                genl_ctrl_event(CTRL_CMD_DELFAMILY, family, NULL, 0);
@@ -983,11 +989,63 @@ static struct genl_multicast_group genl_ctrl_groups[] = {
        { .name = "notify", },
 };
+static int genl_bind(struct net *net, int group)
+{
+        int i, err = -ENOENT;
+        down_read(&cb_lock);
+        for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
+                struct genl_family *f;
+                list_for_each_entry(f, genl_family_chain(i), family_list) {
+                        if (group >= f->mcgrp_offset &&
+                            group < f->mcgrp_offset + f->n_mcgrps) {
+                                int fam_grp = group - f->mcgrp_offset;
+                                if (!f->netnsok && net != &init_net)
+                                        err = -ENOENT;
+                                else if (f->mcast_bind)
+                                        err = f->mcast_bind(net, fam_grp);
+                                else
+                                        err = 0;
+                                break;
+                        }
+                }
+        }
+        up_read(&cb_lock);
+        return err;
+}
+static void genl_unbind(struct net *net, int group)
+{
+        int i;
+        down_read(&cb_lock);
+        for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
+                struct genl_family *f;
+                list_for_each_entry(f, genl_family_chain(i), family_list) {
+                        if (group >= f->mcgrp_offset &&
+                            group < f->mcgrp_offset + f->n_mcgrps) {
+                                int fam_grp = group - f->mcgrp_offset;
+                                if (f->mcast_unbind)
+                                        f->mcast_unbind(net, fam_grp);
+                                break;
+                        }
+                }
+        }
+        up_read(&cb_lock);
+}
 static int __net_init genl_pernet_init(struct net *net)
 {
        struct netlink_kernel_cfg cfg = {
                .input          = genl_rcv,
                .flags          = NL_CFG_F_NONROOT_RECV,
+                .bind           = genl_bind,
+                .unbind         = genl_unbind,
        };
        /* we'll bump the group number right afterwards */
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 764fdc39c63b..770064c83711 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -147,7 +147,8 @@ static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key,
        hdr = eth_hdr(skb);
        hdr->h_proto = mpls->mpls_ethertype;
-        skb_set_inner_protocol(skb, skb->protocol);
+        if (!skb->inner_protocol)
+                skb_set_inner_protocol(skb, skb->protocol);
        skb->protocol = mpls->mpls_ethertype;
        invalidate_flow_key(key);
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 332b5a031739..b07349e82d78 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -83,8 +83,7 @@ static bool ovs_must_notify(struct genl_family *family, struct genl_info *info,
                            unsigned int group)
 {
        return info->nlhdr->nlmsg_flags & NLM_F_ECHO ||
-               genl_has_listeners(family, genl_info_net(info)->genl_sock,
+               genl_has_listeners(family, genl_info_net(info), group);
-                                  group);
 }
 static void ovs_notify(struct genl_family *family,
@@ -525,7 +524,7 @@ static int ovs_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info)
        struct vport *input_vport;
        int len;
        int err;
-        bool log = !a[OVS_FLOW_ATTR_PROBE];
+        bool log = !a[OVS_PACKET_ATTR_PROBE];
        err = -EINVAL;
        if (!a[OVS_PACKET_ATTR_PACKET] || !a[OVS_PACKET_ATTR_KEY] ||
@@ -611,6 +610,7 @@ static const struct nla_policy packet_policy[OVS_PACKET_ATTR_MAX + 1] = {
        [OVS_PACKET_ATTR_PACKET] = { .len = ETH_HLEN },
        [OVS_PACKET_ATTR_KEY] = { .type = NLA_NESTED },
        [OVS_PACKET_ATTR_ACTIONS] = { .type = NLA_NESTED },
+        [OVS_PACKET_ATTR_PROBE] = { .type = NLA_FLAG },
 };
 static const struct genl_ops dp_packet_genl_ops[] = {
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 70bef2ab7f2b..da2fae0873a5 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -70,6 +70,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
 {
        struct flow_stats *stats;
        int node = numa_node_id();
+        int len = skb->len + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
        stats = rcu_dereference(flow->stats[node]);
@@ -105,7 +106,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
                                if (likely(new_stats)) {
                                        new_stats->used = jiffies;
                                        new_stats->packet_count = 1;
-                                        new_stats->byte_count = skb->len;
+                                        new_stats->byte_count = len;
                                        new_stats->tcp_flags = tcp_flags;
                                        spin_lock_init(&new_stats->lock);
@@ -120,7 +121,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
        stats->used = jiffies;
        stats->packet_count++;
-        stats->byte_count += skb->len;
+        stats->byte_count += len;
        stats->tcp_flags |= tcp_flags;
 unlock:
        spin_unlock(&stats->lock);
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 9645a21d9eaa..d1eecf707613 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -1753,7 +1753,6 @@ static int __ovs_nla_copy_actions(const struct nlattr *attr,
                                  __be16 eth_type, __be16 vlan_tci, bool log)
 {
        const struct nlattr *a;
-        bool out_tnl_port = false;
        int rem, err;
        if (depth >= SAMPLE_ACTION_DEPTH)
@@ -1796,8 +1795,6 @@ static int __ovs_nla_copy_actions(const struct nlattr *attr,
                case OVS_ACTION_ATTR_OUTPUT:
                        if (nla_get_u32(a) >= DP_MAX_PORTS)
                                return -EINVAL;
-                        out_tnl_port = false;
                        break;
                case OVS_ACTION_ATTR_HASH: {
@@ -1832,12 +1829,6 @@ static int __ovs_nla_copy_actions(const struct nlattr *attr,
                case OVS_ACTION_ATTR_PUSH_MPLS: {
                        const struct ovs_action_push_mpls *mpls = nla_data(a);
-                        /* Networking stack do not allow simultaneous Tunnel
-                         * and MPLS GSO.
-                         */
-                        if (out_tnl_port)
-                                return -EINVAL;
                        if (!eth_p_mpls(mpls->mpls_ethertype))
                                return -EINVAL;
                        /* Prohibit push MPLS other than to a white list
@@ -1873,11 +1864,9 @@ static int __ovs_nla_copy_actions(const struct nlattr *attr,
                case OVS_ACTION_ATTR_SET:
                        err = validate_set(a, key, sfa,
-                                           &out_tnl_port, eth_type, log);
+                                           &skip_copy, eth_type, log);
                        if (err)
                                return err;
-                        skip_copy = out_tnl_port;
                        break;
                case OVS_ACTION_ATTR_SAMPLE:
diff --git a/net/openvswitch/vport-geneve.c b/net/openvswitch/vport-geneve.c
index 347fa2325b22..484864dd0e68 100644
--- a/net/openvswitch/vport-geneve.c
+++ b/net/openvswitch/vport-geneve.c
@@ -219,7 +219,10 @@ static int geneve_tnl_send(struct vport *vport, struct sk_buff *skb)
                              false);
        if (err < 0)
                ip_rt_put(rt);
+        return err;
 error:
+        kfree_skb(skb);
        return err;
 }
diff --git a/net/openvswitch/vport-gre.c b/net/openvswitch/vport-gre.c
index 6b69df545b1d..d4168c442db5 100644
--- a/net/openvswitch/vport-gre.c
+++ b/net/openvswitch/vport-gre.c
@@ -73,7 +73,7 @@ static struct sk_buff *__build_header(struct sk_buff *skb,
        skb = gre_handle_offloads(skb, !!(tun_key->tun_flags & TUNNEL_CSUM));
        if (IS_ERR(skb))
-                return NULL;
+                return skb;
        tpi.flags = filter_tnl_flags(tun_key->tun_flags);
        tpi.proto = htons(ETH_P_TEB);
@@ -144,7 +144,7 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
        if (unlikely(!OVS_CB(skb)->egress_tun_info)) {
                err = -EINVAL;
-                goto error;
+                goto err_free_skb;
        }
        tun_key = &OVS_CB(skb)->egress_tun_info->tunnel;
@@ -157,8 +157,10 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
        fl.flowi4_proto = IPPROTO_GRE;
        rt = ip_route_output_key(net, &fl);
-        if (IS_ERR(rt))
+        if (IS_ERR(rt)) {
-                return PTR_ERR(rt);
+                err = PTR_ERR(rt);
+                goto err_free_skb;
+        }
        tunnel_hlen = ip_gre_calc_hlen(tun_key->tun_flags);
@@ -183,8 +185,9 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
        /* Push Tunnel header. */
        skb = __build_header(skb, tunnel_hlen);
-        if (unlikely(!skb)) {
+        if (IS_ERR(skb)) {
-                err = 0;
+                err = PTR_ERR(skb);
+                skb = NULL;
                goto err_free_rt;
        }
@@ -198,7 +201,8 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
                             tun_key->ipv4_tos, tun_key->ipv4_ttl, df, false);
 err_free_rt:
        ip_rt_put(rt);
-error:
+err_free_skb:
+        kfree_skb(skb);
        return err;
 }
diff --git a/net/openvswitch/vport-vxlan.c b/net/openvswitch/vport-vxlan.c
index 38f95a52241b..d7c46b301024 100644
--- a/net/openvswitch/vport-vxlan.c
+++ b/net/openvswitch/vport-vxlan.c
@@ -187,7 +187,9 @@ static int vxlan_tnl_send(struct vport *vport, struct sk_buff *skb)
                             false);
        if (err < 0)
                ip_rt_put(rt);
+        return err;
 error:
+        kfree_skb(skb);
        return err;
 }
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 9584526c0778..2034c6d9cb5a 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -480,7 +480,7 @@ void ovs_vport_receive(struct vport *vport, struct sk_buff *skb,
        stats = this_cpu_ptr(vport->percpu_stats);
        u64_stats_update_begin(&stats->syncp);
        stats->rx_packets++;
-        stats->rx_bytes += skb->len;
+        stats->rx_bytes += skb->len + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
        u64_stats_update_end(&stats->syncp);
        OVS_CB(skb)->input_vport = vport;
@@ -519,10 +519,9 @@ int ovs_vport_send(struct vport *vport, struct sk_buff *skb)
                u64_stats_update_end(&stats->syncp);
        } else if (sent < 0) {
                ovs_vport_record_error(vport, VPORT_E_TX_ERROR);
-                kfree_skb(skb);
+        } else {
-        } else
                ovs_vport_record_error(vport, VPORT_E_TX_DROPPED);
+        }
        return sent;
 }
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e52a44785681..9cfe2e1dd8b5 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -785,6 +785,7 @@ static void prb_close_block(struct tpacket_kbdq_core *pkc1,
        struct tpacket3_hdr *last_pkt;
        struct tpacket_hdr_v1 *h1 = &pbd1->hdr.bh1;
+        struct sock *sk = &po->sk;
        if (po->stats.stats3.tp_drops)
                status |= TP_STATUS_LOSING;
@@ -809,6 +810,8 @@ static void prb_close_block(struct tpacket_kbdq_core *pkc1,
        /* Flush the block */
        prb_flush_block(pkc1, pbd1, status);
+        sk->sk_data_ready(sk);
        pkc1->kactive_blk_num = GET_NEXT_PRB_BLK_NUM(pkc1);
 }
@@ -2052,12 +2055,12 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
        smp_wmb();
 #endif
-        if (po->tp_version <= TPACKET_V2)
+        if (po->tp_version <= TPACKET_V2) {
                __packet_set_status(po, h.raw, status);
-        else
+                sk->sk_data_ready(sk);
+        } else {
                prb_clear_blk_fill_status(&po->rx_ring);
+        }
-        sk->sk_data_ready(sk);
 drop_n_restore:
        if (skb_head != skb->data && skb_shared(skb)) {
@@ -2514,7 +2517,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
        err = -EINVAL;
        if (sock->type == SOCK_DGRAM) {
                offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len);
-                if (unlikely(offset) < 0)
+                if (unlikely(offset < 0))
                        goto out_free;
        } else {
                if (ll_header_truncated(dev, len))
diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
index c3b0cd43eb56..c173f69e1479 100644
--- a/net/rds/sysctl.c
+++ b/net/rds/sysctl.c
@@ -71,14 +71,14 @@ static struct ctl_table rds_sysctl_rds_table[] = {
        {
                .procname       = "max_unacked_packets",
                .data           = &rds_sysctl_max_unacked_packets,
-                .maxlen         = sizeof(unsigned long),
+                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec,
        },
        {
                .procname       = "max_unacked_bytes",
                .data           = &rds_sysctl_max_unacked_bytes,
-                .maxlen         = sizeof(unsigned long),
+                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec,
        },
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index aad6a679fb13..baef987fe2c0 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -556,8 +556,9 @@ void tcf_exts_change(struct tcf_proto *tp, struct tcf_exts *dst,
 }
 EXPORT_SYMBOL(tcf_exts_change);
-#define tcf_exts_first_act(ext) \
+#define tcf_exts_first_act(ext)                                 \
-                list_first_entry(&(exts)->actions, struct tc_action, list)
+        list_first_entry_or_null(&(exts)->actions,              \
+                                 struct tc_action, list)
 int tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts)
 {
@@ -603,7 +604,7 @@ int tcf_exts_dump_stats(struct sk_buff *skb, struct tcf_exts *exts)
 {
 #ifdef CONFIG_NET_CLS_ACT
        struct tc_action *a = tcf_exts_first_act(exts);
-        if (tcf_action_copy_stats(skb, a, 1) < 0)
+        if (a != NULL && tcf_action_copy_stats(skb, a, 1) < 0)
                return -1;
 #endif
        return 0;
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 84c8219c3e1c..f59adf8a4cd7 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -180,6 +180,11 @@ static int cls_bpf_modify_existing(struct net *net, struct tcf_proto *tp,
        }
        bpf_size = bpf_len * sizeof(*bpf_ops);
+        if (bpf_size != nla_len(tb[TCA_BPF_OPS])) {
+                ret = -EINVAL;
+                goto errout;
+        }
        bpf_ops = kzalloc(bpf_size, GFP_KERNEL);
        if (bpf_ops == NULL) {
                ret = -ENOMEM;
@@ -215,15 +220,21 @@ static u32 cls_bpf_grab_new_handle(struct tcf_proto *tp,
                                   struct cls_bpf_head *head)
 {
        unsigned int i = 0x80000000;
+        u32 handle;
        do {
                if (++head->hgen == 0x7FFFFFFF)
                        head->hgen = 1;
        } while (--i > 0 && cls_bpf_get(tp, head->hgen));
-        if (i == 0)
+        if (unlikely(i == 0)) {
                pr_err("Insufficient number of handles\n");
+                handle = 0;
+        } else {
+                handle = head->hgen;
+        }
-        return i;
+        return handle;
 }
 static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 9b05924cc386..333cd94ba381 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -670,8 +670,14 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
        if (tb[TCA_FQ_FLOW_PLIMIT])
                q->flow_plimit = nla_get_u32(tb[TCA_FQ_FLOW_PLIMIT]);
-        if (tb[TCA_FQ_QUANTUM])
+        if (tb[TCA_FQ_QUANTUM]) {
-                q->quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]);
+                u32 quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]);
+                if (quantum > 0)
+                        q->quantum = quantum;
+                else
+                        err = -EINVAL;
+        }
        if (tb[TCA_FQ_INITIAL_QUANTUM])
                q->initial_quantum = nla_get_u32(tb[TCA_FQ_INITIAL_QUANTUM]);
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index f791edd64d6c..26d06dbcc1c8 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1182,7 +1182,6 @@ void sctp_assoc_update(struct sctp_association *asoc,
        asoc->peer.peer_hmacs = new->peer.peer_hmacs;
        new->peer.peer_hmacs = NULL;
-        sctp_auth_key_put(asoc->asoc_shared_key);
        sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC);
 }
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index e49e231cef52..06320c8c1c86 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2608,7 +2608,7 @@ do_addr_param:
                addr_param = param.v + sizeof(sctp_addip_param_t);
-                af = sctp_get_af_specific(param_type2af(param.p->type));
+                af = sctp_get_af_specific(param_type2af(addr_param->p.type));
                if (af == NULL)
                        break;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 2625eccb77d5..aafe94bf292e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1603,7 +1603,7 @@ static int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
        sctp_assoc_t associd = 0;
        sctp_cmsgs_t cmsgs = { NULL };
        sctp_scope_t scope;
-        bool fill_sinfo_ttl = false;
+        bool fill_sinfo_ttl = false, wait_connect = false;
        struct sctp_datamsg *datamsg;
        int msg_flags = msg->msg_flags;
        __u16 sinfo_flags = 0;
@@ -1943,6 +1943,7 @@ static int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                if (err < 0)
                        goto out_free;
+                wait_connect = true;
                pr_debug("%s: we associated primitively\n", __func__);
        }
@@ -1980,6 +1981,11 @@ static int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
        sctp_datamsg_put(datamsg);
        err = msg_len;
+        if (unlikely(wait_connect)) {
+                timeo = sock_sndtimeo(sk, msg_flags & MSG_DONTWAIT);
+                sctp_wait_for_connect(asoc, &timeo);
+        }
        /* If we are already past ASSOCIATE, the lower
         * layers are responsible for association cleanup.
         */
diff --git a/net/socket.c b/net/socket.c
index a2c33a4dc7ba..418795caa897 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -869,9 +869,6 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
 static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
                                         struct sock_iocb *siocb)
 {
-        if (!is_sync_kiocb(iocb))
-                BUG();
        siocb->kiocb = iocb;
        iocb->private = siocb;
        return siocb;
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 1cb61242e55e..4439ac4c1b53 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -606,7 +606,7 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
        struct kvec *head = buf->head;
        struct kvec *tail = buf->tail;
        int fraglen;
-        int new, old;
+        int new;
        if (len > buf->len) {
                WARN_ON_ONCE(1);
@@ -629,8 +629,8 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
        buf->len -= fraglen;
        new = buf->page_base + buf->page_len;
-        old = new + fraglen;
-        xdr->page_ptr -= (old >> PAGE_SHIFT) - (new >> PAGE_SHIFT);
+        xdr->page_ptr = buf->pages + (new >> PAGE_SHIFT);
        if (buf->page_len) {
                xdr->p = page_address(*xdr->page_ptr);
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 96ceefeb9daf..a9e174fc0f91 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -220,10 +220,11 @@ static void bclink_retransmit_pkt(u32 after, u32 to)
        struct sk_buff *skb;
        skb_queue_walk(&bcl->outqueue, skb) {
-                if (more(buf_seqno(skb), after))
+                if (more(buf_seqno(skb), after)) {
+                        tipc_link_retransmit(bcl, skb, mod(to - after));
                        break;
+                }
        }
-        tipc_link_retransmit(bcl, skb, mod(to - after));
 }
 /**
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 22ba971741e5..29c8675f9a11 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -175,7 +175,7 @@ config CFG80211_INTERNAL_REGDB
          Most distributions have a CRDA package.  So if unsure, say N.
 config CFG80211_WEXT
-        bool
+        bool "cfg80211 wireless extensions compatibility"
        depends on CFG80211
        select WEXT_CORE
        help
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 7ca4b5133123..8887c6e5fca8 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2854,6 +2854,9 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
        if (!rdev->ops->get_key)
                return -EOPNOTSUPP;
+        if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
+                return -ENOENT;
        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg)
                return -ENOMEM;
@@ -2873,10 +2876,6 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
                goto nla_put_failure;
-        if (pairwise && mac_addr &&
-            !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
-                return -ENOENT;
        err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
                           get_key_callback);
@@ -3047,7 +3046,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
        wdev_lock(dev->ieee80211_ptr);
        err = nl80211_key_allowed(dev->ieee80211_ptr);
-        if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
+        if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
            !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
                err = -ENOENT;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 7b8309840d4e..d39d1cbc86b1 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1530,45 +1530,40 @@ static void reg_call_notifier(struct wiphy *wiphy,
 static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
 {
-        struct ieee80211_channel *ch;
        struct cfg80211_chan_def chandef;
        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
-        bool ret = true;
+        enum nl80211_iftype iftype;
        wdev_lock(wdev);
+        iftype = wdev->iftype;
+        /* make sure the interface is active */
        if (!wdev->netdev || !netif_running(wdev->netdev))
-                goto out;
+                goto wdev_inactive_unlock;
-        switch (wdev->iftype) {
+        switch (iftype) {
        case NL80211_IFTYPE_AP:
        case NL80211_IFTYPE_P2P_GO:
                if (!wdev->beacon_interval)
-                        goto out;
+                        goto wdev_inactive_unlock;
+                chandef = wdev->chandef;
-                ret = cfg80211_reg_can_beacon(wiphy,
-                                              &wdev->chandef, wdev->iftype);
                break;
        case NL80211_IFTYPE_ADHOC:
                if (!wdev->ssid_len)
-                        goto out;
+                        goto wdev_inactive_unlock;
+                chandef = wdev->chandef;
-                ret = cfg80211_reg_can_beacon(wiphy,
-                                              &wdev->chandef, wdev->iftype);
                break;
        case NL80211_IFTYPE_STATION:
        case NL80211_IFTYPE_P2P_CLIENT:
                if (!wdev->current_bss ||
                    !wdev->current_bss->pub.channel)
-                        goto out;
+                        goto wdev_inactive_unlock;
-                ch = wdev->current_bss->pub.channel;
+                if (!rdev->ops->get_channel ||
-                if (rdev->ops->get_channel &&
+                    rdev_get_channel(rdev, wdev, &chandef))
-                    !rdev_get_channel(rdev, wdev, &chandef))
+                        cfg80211_chandef_create(&chandef,
-                        ret = cfg80211_chandef_usable(wiphy, &chandef,
+                                                wdev->current_bss->pub.channel,
-                                                      IEEE80211_CHAN_DISABLED);
+                                                NL80211_CHAN_NO_HT);
-                else
-                        ret = !(ch->flags & IEEE80211_CHAN_DISABLED);
                break;
        case NL80211_IFTYPE_MONITOR:
        case NL80211_IFTYPE_AP_VLAN:
@@ -1581,9 +1576,26 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
                break;
        }
-out:
        wdev_unlock(wdev);
-        return ret;
+        switch (iftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_ADHOC:
+                return cfg80211_reg_can_beacon(wiphy, &chandef, iftype);
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
+                return cfg80211_chandef_usable(wiphy, &chandef,
+                                               IEEE80211_CHAN_DISABLED);
+        default:
+                break;
+        }
+        return true;
+wdev_inactive_unlock:
+        wdev_unlock(wdev);
+        return true;
 }
 static void reg_leave_invalid_chans(struct wiphy *wiphy)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index d0ac795445b7..5488c3662f7d 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -308,6 +308,12 @@ unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc)
                goto out;
        }
+        if (ieee80211_is_mgmt(fc)) {
+                if (ieee80211_has_order(fc))
+                        hdrlen += IEEE80211_HT_CTL_LEN;
+                goto out;
+        }
        if (ieee80211_is_ctl(fc)) {
                /*
                 * ACK and CTS are 10 bytes, all others 16. To see how
diff --git a/samples/bpf/test_maps.c b/samples/bpf/test_maps.c
index e286b42307f3..6299ee95cd11 100644
--- a/samples/bpf/test_maps.c
+++ b/samples/bpf/test_maps.c
@@ -69,9 +69,9 @@ static void test_hashmap_sanity(int i, void *data)
        /* iterate over two elements */
        assert(bpf_get_next_key(map_fd, &key, &next_key) == 0 &&
-               next_key == 2);
+               (next_key == 1 || next_key == 2));
        assert(bpf_get_next_key(map_fd, &next_key, &next_key) == 0 &&
-               next_key == 1);
+               (next_key == 1 || next_key == 2));
        assert(bpf_get_next_key(map_fd, &next_key, &next_key) == -1 &&
               errno == ENOENT);
diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
index 1bca180db8ad..627f8cbbedb8 100644
--- a/scripts/Makefile.clean
+++ b/scripts/Makefile.clean
@@ -42,19 +42,19 @@ __clean-files	:= $(extra-y) $(extra-m) $(extra-)       \
 __clean-files   := $(filter-out $(no-clean-files), $(__clean-files))
-# as clean-files is given relative to the current directory, this adds
+# clean-files is given relative to the current directory, unless it
-# a $(obj) prefix, except for absolute paths
+# starts with $(objtree)/ (which means "./", so do not add "./" unless
+# you want to delete a file from the toplevel object directory).
 __clean-files   := $(wildcard                                               \
-                   $(addprefix $(obj)/, $(filter-out /%, $(__clean-files))) \
+                   $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(__clean-files))) \
-                   $(filter /%, $(__clean-files)))
+                   $(filter $(objtree)/%, $(__clean-files)))
-# as clean-dirs is given relative to the current directory, this adds
+# same as clean-files
-# a $(obj) prefix, except for absolute paths
 __clean-dirs    := $(wildcard                                               \
-                   $(addprefix $(obj)/, $(filter-out /%, $(clean-dirs)))    \
+                   $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(clean-dirs)))    \
-                   $(filter /%, $(clean-dirs)))
+                   $(filter $(objtree)/%, $(clean-dirs)))
 # ==========================================================================
diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index 56ea99a12ab7..537c38ca2e1c 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -255,7 +255,6 @@ if ($arch eq "x86_64") {
    # force flags for this arch
    $ld .= " -m shlelf_linux";
    $objcopy .= " -O elf32-sh-linux";
-    $cc .= " -m32";
 } elsif ($arch eq "powerpc") {
    $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)";
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 9609a7f0faea..c7952375ac53 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -148,12 +148,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
                if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
                        atomic_dec(&key->user->nikeys);
-                key_user_put(key->user);
                /* now throw away the key memory */
                if (key->type->destroy)
                        key->type->destroy(key);
+                key_user_put(key->user);
                kfree(key->description);
 #ifdef KEY_DEBUGGING
diff --git a/security/tomoyo/Kconfig b/security/tomoyo/Kconfig
index 8eb779b9d77f..604e718d68d3 100644
--- a/security/tomoyo/Kconfig
+++ b/security/tomoyo/Kconfig
@@ -5,6 +5,7 @@ config SECURITY_TOMOYO
        select SECURITYFS
        select SECURITY_PATH
        select SECURITY_NETWORK
+        select SRCU
        default n
        help
          This selects TOMOYO Linux, pathname-based access control.
diff --git a/sound/core/seq/seq_dummy.c b/sound/core/seq/seq_dummy.c
index ec667f158f19..5d905d90d504 100644
--- a/sound/core/seq/seq_dummy.c
+++ b/sound/core/seq/seq_dummy.c
@@ -82,36 +82,6 @@ struct snd_seq_dummy_port {
 static int my_client = -1;
 /*
- * unuse callback - send ALL_SOUNDS_OFF and RESET_CONTROLLERS events
- * to subscribers.
- * Note: this callback is called only after all subscribers are removed.
- */
-static int
-dummy_unuse(void *private_data, struct snd_seq_port_subscribe *info)
-{
-        struct snd_seq_dummy_port *p;
-        int i;
-        struct snd_seq_event ev;
-        p = private_data;
-        memset(&ev, 0, sizeof(ev));
-        if (p->duplex)
-                ev.source.port = p->connect;
-        else
-                ev.source.port = p->port;
-        ev.dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS;
-        ev.type = SNDRV_SEQ_EVENT_CONTROLLER;
-        for (i = 0; i < 16; i++) {
-                ev.data.control.channel = i;
-                ev.data.control.param = MIDI_CTL_ALL_SOUNDS_OFF;
-                snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
-                ev.data.control.param = MIDI_CTL_RESET_CONTROLLERS;
-                snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
-        }
-        return 0;
-}
-/*
 * event input callback - just redirect events to subscribers
 */
 static int
@@ -175,7 +145,6 @@ create_port(int idx, int type)
                | SNDRV_SEQ_PORT_TYPE_PORT;
        memset(&pcb, 0, sizeof(pcb));
        pcb.owner = THIS_MODULE;
-        pcb.unuse = dummy_unuse;
        pcb.event_input = dummy_input;
        pcb.private_free = dummy_free;
        pcb.private_data = rec;
diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c
index 3badc70124ab..0d580186ef1a 100644
--- a/sound/firewire/amdtp.c
+++ b/sound/firewire/amdtp.c
@@ -21,7 +21,19 @@
 #define CYCLES_PER_SECOND       8000
 #define TICKS_PER_SECOND        (TICKS_PER_CYCLE * CYCLES_PER_SECOND)
-#define TRANSFER_DELAY_TICKS    0x2e00 /* 479.17 µs */
+/*
+ * Nominally 3125 bytes/second, but the MIDI port's clock might be
+ * 1% too slow, and the bus clock 100 ppm too fast.
+ */
+#define MIDI_BYTES_PER_SECOND   3093
+/*
+ * Several devices look only at the first eight data blocks.
+ * In any case, this is more than enough for the MIDI data rate.
+ */
+#define MAX_MIDI_RX_BLOCKS      8
+#define TRANSFER_DELAY_TICKS    0x2e00 /* 479.17 Âµs */
 /* isochronous header parameters */
 #define ISO_DATA_LENGTH_SHIFT   16
@@ -78,8 +90,6 @@ int amdtp_stream_init(struct amdtp_stream *s, struct fw_unit *unit,
        s->callbacked = false;
        s->sync_slave = NULL;
-        s->rx_blocks_for_midi = UINT_MAX;
        return 0;
 }
 EXPORT_SYMBOL(amdtp_stream_init);
@@ -222,6 +232,14 @@ sfc_found:
        for (i = 0; i < pcm_channels; i++)
                s->pcm_positions[i] = i;
        s->midi_position = s->pcm_channels;
+        /*
+         * We do not know the actual MIDI FIFO size of most devices.  Just
+         * assume two bytes, i.e., one byte can be received over the bus while
+         * the previous one is transmitted over MIDI.
+         * (The value here is adjusted for midi_ratelimit_per_packet().)
+         */
+        s->midi_fifo_limit = rate - MIDI_BYTES_PER_SECOND * s->syt_interval + 1;
 }
 EXPORT_SYMBOL(amdtp_stream_set_parameters);
@@ -463,6 +481,36 @@ static void amdtp_fill_pcm_silence(struct amdtp_stream *s,
        }
 }
+/*
+ * To avoid sending MIDI bytes at too high a rate, assume that the receiving
+ * device has a FIFO, and track how much it is filled.  This values increases
+ * by one whenever we send one byte in a packet, but the FIFO empties at
+ * a constant rate independent of our packet rate.  One packet has syt_interval
+ * samples, so the number of bytes that empty out of the FIFO, per packet(!),
+ * is MIDI_BYTES_PER_SECOND * syt_interval / sample_rate.  To avoid storing
+ * fractional values, the values in midi_fifo_used[] are measured in bytes
+ * multiplied by the sample rate.
+ */
+static bool midi_ratelimit_per_packet(struct amdtp_stream *s, unsigned int port)
+{
+        int used;
+        used = s->midi_fifo_used[port];
+        if (used == 0) /* common shortcut */
+                return true;
+        used -= MIDI_BYTES_PER_SECOND * s->syt_interval;
+        used = max(used, 0);
+        s->midi_fifo_used[port] = used;
+        return used < s->midi_fifo_limit;
+}
+static void midi_rate_use_one_byte(struct amdtp_stream *s, unsigned int port)
+{
+        s->midi_fifo_used[port] += amdtp_rate_table[s->sfc];
+}
 static void amdtp_fill_midi(struct amdtp_stream *s,
                            __be32 *buffer, unsigned int frames)
 {
@@ -470,16 +518,21 @@ static void amdtp_fill_midi(struct amdtp_stream *s,
        u8 *b;
        for (f = 0; f < frames; f++) {
-                buffer[s->midi_position] = 0;
                b = (u8 *)&buffer[s->midi_position];
                port = (s->data_block_counter + f) % 8;
-                if ((f >= s->rx_blocks_for_midi) ||
+                if (f < MAX_MIDI_RX_BLOCKS &&
-                    (s->midi[port] == NULL) ||
+                    midi_ratelimit_per_packet(s, port) &&
-                    (snd_rawmidi_transmit(s->midi[port], b + 1, 1) <= 0))
+                    s->midi[port] != NULL &&
-                        b[0] = 0x80;
+                    snd_rawmidi_transmit(s->midi[port], &b[1], 1) == 1) {
-                else
+                        midi_rate_use_one_byte(s, port);
                        b[0] = 0x81;
+                } else {
+                        b[0] = 0x80;
+                        b[1] = 0;
+                }
+                b[2] = 0;
+                b[3] = 0;
                buffer += s->data_block_quadlets;
        }
diff --git a/sound/firewire/amdtp.h b/sound/firewire/amdtp.h
index e6e8926275b0..8a03a91e728b 100644
--- a/sound/firewire/amdtp.h
+++ b/sound/firewire/amdtp.h
@@ -148,13 +148,12 @@ struct amdtp_stream {
        bool double_pcm_frames;
        struct snd_rawmidi_substream *midi[AMDTP_MAX_CHANNELS_FOR_MIDI * 8];
+        int midi_fifo_limit;
+        int midi_fifo_used[AMDTP_MAX_CHANNELS_FOR_MIDI * 8];
        /* quirk: fixed interval of dbc between previos/current packets. */
        unsigned int tx_dbc_interval;
-        /* quirk: the first count of data blocks in an rx packet for MIDI */
-        unsigned int rx_blocks_for_midi;
        bool callbacked;
        wait_queue_head_t callback_wait;
        struct amdtp_stream *sync_slave;
diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c
index 1aab0a32870c..0ebcabfdc7ce 100644
--- a/sound/firewire/bebob/bebob_stream.c
+++ b/sound/firewire/bebob/bebob_stream.c
@@ -484,13 +484,6 @@ int snd_bebob_stream_init_duplex(struct snd_bebob *bebob)
                amdtp_stream_destroy(&bebob->rx_stream);
                destroy_both_connections(bebob);
        }
-        /*
-         * The firmware for these devices ignore MIDI messages in more than
-         * first 8 data blocks of an received AMDTP packet.
-         */
-        if (bebob->spec == &maudio_fw410_spec ||
-            bebob->spec == &maudio_special_spec)
-                bebob->rx_stream.rx_blocks_for_midi = 8;
 end:
        return err;
 }
diff --git a/sound/firewire/fireworks/fireworks_stream.c b/sound/firewire/fireworks/fireworks_stream.c
index b985fc5ebdc6..4f440e163667 100644
--- a/sound/firewire/fireworks/fireworks_stream.c
+++ b/sound/firewire/fireworks/fireworks_stream.c
@@ -179,11 +179,6 @@ int snd_efw_stream_init_duplex(struct snd_efw *efw)
                destroy_stream(efw, &efw->tx_stream);
                goto end;
        }
-        /*
-         * Fireworks ignores MIDI messages in more than first 8 data
-         * blocks of an received AMDTP packet.
-         */
-        efw->rx_stream.rx_blocks_for_midi = 8;
        /* set IEC61883 compliant mode (actually not fully compliant...) */
        err = snd_efw_command_set_tx_mode(efw, SND_EFW_TRANSPORT_MODE_IEC61883);
diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c
index 255dabc6fc33..2a85e4209f0b 100644
--- a/sound/firewire/fireworks/fireworks_transaction.c
+++ b/sound/firewire/fireworks/fireworks_transaction.c
@@ -124,7 +124,7 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
        spin_lock_irq(&efw->lock);
        t = (struct snd_efw_transaction *)data;
-        length = min_t(size_t, t->length * sizeof(t->length), length);
+        length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
        if (efw->push_ptr < efw->pull_ptr)
                capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
diff --git a/sound/i2c/other/ak4113.c b/sound/i2c/other/ak4113.c
index 1a3a6fa27158..c6bba99a90b2 100644
--- a/sound/i2c/other/ak4113.c
+++ b/sound/i2c/other/ak4113.c
@@ -56,8 +56,7 @@ static inline unsigned char reg_read(struct ak4113 *ak4113, unsigned char reg)
 static void snd_ak4113_free(struct ak4113 *chip)
 {
-        chip->init = 1; /* don't schedule new work */
+        atomic_inc(&chip->wq_processing);       /* don't schedule new work */
-        mb();
        cancel_delayed_work_sync(&chip->work);
        kfree(chip);
 }
@@ -89,6 +88,7 @@ int snd_ak4113_create(struct snd_card *card, ak4113_read_t *read,
        chip->write = write;
        chip->private_data = private_data;
        INIT_DELAYED_WORK(&chip->work, ak4113_stats);
+        atomic_set(&chip->wq_processing, 0);
        for (reg = 0; reg < AK4113_WRITABLE_REGS ; reg++)
                chip->regmap[reg] = pgm[reg];
@@ -139,13 +139,11 @@ static void ak4113_init_regs(struct ak4113 *chip)
 void snd_ak4113_reinit(struct ak4113 *chip)
 {
-        chip->init = 1;
+        if (atomic_inc_return(&chip->wq_processing) == 1)
-        mb();
+                cancel_delayed_work_sync(&chip->work);
-        flush_delayed_work(&chip->work);
        ak4113_init_regs(chip);
        /* bring up statistics / event queing */
-        chip->init = 0;
+        if (atomic_dec_and_test(&chip->wq_processing))
-        if (chip->kctls[0])
                schedule_delayed_work(&chip->work, HZ / 10);
 }
 EXPORT_SYMBOL_GPL(snd_ak4113_reinit);
@@ -632,8 +630,9 @@ static void ak4113_stats(struct work_struct *work)
 {
        struct ak4113 *chip = container_of(work, struct ak4113, work.work);
-        if (!chip->init)
+        if (atomic_inc_return(&chip->wq_processing) == 1)
                snd_ak4113_check_rate_and_errors(chip, chip->check_flags);
-        schedule_delayed_work(&chip->work, HZ / 10);
+        if (atomic_dec_and_test(&chip->wq_processing))
+                schedule_delayed_work(&chip->work, HZ / 10);
 }
diff --git a/sound/i2c/other/ak4114.c b/sound/i2c/other/ak4114.c
index c7f56339415d..b70e6eccbd03 100644
--- a/sound/i2c/other/ak4114.c
+++ b/sound/i2c/other/ak4114.c
@@ -66,8 +66,7 @@ static void reg_dump(struct ak4114 *ak4114)
 static void snd_ak4114_free(struct ak4114 *chip)
 {
-        chip->init = 1; /* don't schedule new work */
+        atomic_inc(&chip->wq_processing);       /* don't schedule new work */
-        mb();
        cancel_delayed_work_sync(&chip->work);
        kfree(chip);
 }
@@ -100,6 +99,7 @@ int snd_ak4114_create(struct snd_card *card,
        chip->write = write;
        chip->private_data = private_data;
        INIT_DELAYED_WORK(&chip->work, ak4114_stats);
+        atomic_set(&chip->wq_processing, 0);
        for (reg = 0; reg < 6; reg++)
                chip->regmap[reg] = pgm[reg];
@@ -152,13 +152,11 @@ static void ak4114_init_regs(struct ak4114 *chip)
 void snd_ak4114_reinit(struct ak4114 *chip)
 {
-        chip->init = 1;
+        if (atomic_inc_return(&chip->wq_processing) == 1)
-        mb();
+                cancel_delayed_work_sync(&chip->work);
-        flush_delayed_work(&chip->work);
        ak4114_init_regs(chip);
        /* bring up statistics / event queing */
-        chip->init = 0;
+        if (atomic_dec_and_test(&chip->wq_processing))
-        if (chip->kctls[0])
                schedule_delayed_work(&chip->work, HZ / 10);
 }
@@ -612,10 +610,10 @@ static void ak4114_stats(struct work_struct *work)
 {
        struct ak4114 *chip = container_of(work, struct ak4114, work.work);
-        if (!chip->init)
+        if (atomic_inc_return(&chip->wq_processing) == 1)
                snd_ak4114_check_rate_and_errors(chip, chip->check_flags);
+        if (atomic_dec_and_test(&chip->wq_processing))
-        schedule_delayed_work(&chip->work, HZ / 10);
+                schedule_delayed_work(&chip->work, HZ / 10);
 }
 EXPORT_SYMBOL(snd_ak4114_create);
diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index 8276a743e22e..0cfc9c8c4b4e 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -1922,10 +1922,18 @@ int azx_mixer_create(struct azx *chip)
 EXPORT_SYMBOL_GPL(azx_mixer_create);
+static bool is_input_stream(struct azx *chip, unsigned char index)
+{
+        return (index >= chip->capture_index_offset &&
+                index < chip->capture_index_offset + chip->capture_streams);
+}
 /* initialize SD streams */
 int azx_init_stream(struct azx *chip)
 {
        int i;
+        int in_stream_tag = 0;
+        int out_stream_tag = 0;
        /* initialize each stream (aka device)
         * assign the starting bdl address to each stream (device)
@@ -1938,9 +1946,21 @@ int azx_init_stream(struct azx *chip)
                azx_dev->sd_addr = chip->remap_addr + (0x20 * i + 0x80);
                /* int mask: SDI0=0x01, SDI1=0x02, ... SDO3=0x80 */
                azx_dev->sd_int_sta_mask = 1 << i;
-                /* stream tag: must be non-zero and unique */
                azx_dev->index = i;
-                azx_dev->stream_tag = i + 1;
+                /* stream tag must be unique throughout
+                 * the stream direction group,
+                 * valid values 1...15
+                 * use separate stream tag if the flag
+                 * AZX_DCAPS_SEPARATE_STREAM_TAG is used
+                 */
+                if (chip->driver_caps & AZX_DCAPS_SEPARATE_STREAM_TAG)
+                        azx_dev->stream_tag =
+                                is_input_stream(chip, i) ?
+                                ++in_stream_tag :
+                                ++out_stream_tag;
+                else
+                        azx_dev->stream_tag = i + 1;
        }
        return 0;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 2bf0b568e3de..d426a0bd6a5f 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -299,6 +299,9 @@ enum {
         AZX_DCAPS_PM_RUNTIME | AZX_DCAPS_I915_POWERWELL |\
         AZX_DCAPS_SNOOP_TYPE(SCH))
+#define AZX_DCAPS_INTEL_SKYLAKE \
+        (AZX_DCAPS_INTEL_PCH | AZX_DCAPS_SEPARATE_STREAM_TAG)
 /* quirks for ATI SB / AMD Hudson */
 #define AZX_DCAPS_PRESET_ATI_SB \
        (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB |\
@@ -2027,7 +2030,7 @@ static const struct pci_device_id azx_ids[] = {
          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
        /* Sunrise Point-LP */
        { PCI_DEVICE(0x8086, 0x9d70),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
        /* Haswell */
        { PCI_DEVICE(0x8086, 0x0a0c),
          .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL },
diff --git a/sound/pci/hda/hda_priv.h b/sound/pci/hda/hda_priv.h
index aa484fdf4338..166e3e84b963 100644
--- a/sound/pci/hda/hda_priv.h
+++ b/sound/pci/hda/hda_priv.h
@@ -171,6 +171,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
 #define AZX_DCAPS_I915_POWERWELL (1 << 27)      /* HSW i915 powerwell support */
 #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28)   /* CORBRP clears itself after reset */
 #define AZX_DCAPS_NO_MSI64      (1 << 29)       /* Stick to 32-bit MSIs */
+#define AZX_DCAPS_SEPARATE_STREAM_TAG   (1 << 30) /* capture and playback use separate stream tag */
 enum {
        AZX_SNOOP_TYPE_NONE ,
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 5f13d2d18079..b422e406a9cb 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -3353,6 +3353,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
 { .id = 0x10de0067, .name = "MCP67 HDMI",       .patch = patch_nvhdmi_2ch },
 { .id = 0x10de0070, .name = "GPU 70 HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de0071, .name = "GPU 71 HDMI/DP",   .patch = patch_nvhdmi },
+{ .id = 0x10de0072, .name = "GPU 72 HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de8001, .name = "MCP73 HDMI",       .patch = patch_nvhdmi_2ch },
 { .id = 0x11069f80, .name = "VX900 HDMI/DP",    .patch = patch_via_hdmi },
 { .id = 0x11069f81, .name = "VX900 HDMI/DP",    .patch = patch_via_hdmi },
@@ -3413,6 +3414,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0060");
 MODULE_ALIAS("snd-hda-codec-id:10de0067");
 MODULE_ALIAS("snd-hda-codec-id:10de0070");
 MODULE_ALIAS("snd-hda-codec-id:10de0071");
+MODULE_ALIAS("snd-hda-codec-id:10de0072");
 MODULE_ALIAS("snd-hda-codec-id:10de8001");
 MODULE_ALIAS("snd-hda-codec-id:11069f80");
 MODULE_ALIAS("snd-hda-codec-id:11069f81");
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 4f6413e01c13..605d14003d25 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -568,9 +568,9 @@ static void stac_store_hints(struct hda_codec *codec)
                        spec->gpio_mask;
        }
        if (get_int_hint(codec, "gpio_dir", &spec->gpio_dir))
-                spec->gpio_mask &= spec->gpio_mask;
-        if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
                spec->gpio_dir &= spec->gpio_mask;
+        if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
+                spec->gpio_data &= spec->gpio_mask;
        if (get_int_hint(codec, "eapd_mask", &spec->eapd_mask))
                spec->eapd_mask &= spec->gpio_mask;
        if (get_int_hint(codec, "gpio_mute", &spec->gpio_mute))
diff --git a/sound/soc/adi/axi-i2s.c b/sound/soc/adi/axi-i2s.c
index 7752860f7230..4c23381727a1 100644
--- a/sound/soc/adi/axi-i2s.c
+++ b/sound/soc/adi/axi-i2s.c
@@ -240,6 +240,8 @@ static int axi_i2s_probe(struct platform_device *pdev)
        if (ret)
                goto err_clk_disable;
+        return 0;
 err_clk_disable:
        clk_disable_unprepare(i2s->clk);
        return ret;
diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
index 99ff35e2a25d..35e44e463cfe 100644
--- a/sound/soc/atmel/atmel_ssc_dai.c
+++ b/sound/soc/atmel/atmel_ssc_dai.c
@@ -348,7 +348,6 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
        struct atmel_pcm_dma_params *dma_params;
        int dir, channels, bits;
        u32 tfmr, rfmr, tcmr, rcmr;
-        int start_event;
        int ret;
        int fslen, fslen_ext;
@@ -457,19 +456,10 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                 * The SSC transmit clock is obtained from the BCLK signal on
                 * on the TK line, and the SSC receive clock is
                 * generated from the transmit clock.
-                 *
-                 *  For single channel data, one sample is transferred
-                 * on the falling edge of the LRC clock.
-                 * For two channel data, one sample is
-                 * transferred on both edges of the LRC clock.
                 */
-                start_event = ((channels == 1)
-                                ? SSC_START_FALLING_RF
-                                : SSC_START_EDGE_RF);
                rcmr =    SSC_BF(RCMR_PERIOD, 0)
                        | SSC_BF(RCMR_STTDLY, START_DELAY)
-                        | SSC_BF(RCMR_START, start_event)
+                        | SSC_BF(RCMR_START, SSC_START_FALLING_RF)
                        | SSC_BF(RCMR_CKI, SSC_CKI_RISING)
                        | SSC_BF(RCMR_CKO, SSC_CKO_NONE)
                        | SSC_BF(RCMR_CKS, ssc->clk_from_rk_pin ?
@@ -478,14 +468,14 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                rfmr =    SSC_BF(RFMR_FSEDGE, SSC_FSEDGE_POSITIVE)
                        | SSC_BF(RFMR_FSOS, SSC_FSOS_NONE)
                        | SSC_BF(RFMR_FSLEN, 0)
-                        | SSC_BF(RFMR_DATNB, 0)
+                        | SSC_BF(RFMR_DATNB, (channels - 1))
                        | SSC_BIT(RFMR_MSBF)
                        | SSC_BF(RFMR_LOOP, 0)
                        | SSC_BF(RFMR_DATLEN, (bits - 1));
                tcmr =    SSC_BF(TCMR_PERIOD, 0)
                        | SSC_BF(TCMR_STTDLY, START_DELAY)
-                        | SSC_BF(TCMR_START, start_event)
+                        | SSC_BF(TCMR_START, SSC_START_FALLING_RF)
                        | SSC_BF(TCMR_CKI, SSC_CKI_FALLING)
                        | SSC_BF(TCMR_CKO, SSC_CKO_NONE)
                        | SSC_BF(TCMR_CKS, ssc->clk_from_rk_pin ?
@@ -495,7 +485,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                        | SSC_BF(TFMR_FSDEN, 0)
                        | SSC_BF(TFMR_FSOS, SSC_FSOS_NONE)
                        | SSC_BF(TFMR_FSLEN, 0)
-                        | SSC_BF(TFMR_DATNB, 0)
+                        | SSC_BF(TFMR_DATNB, (channels - 1))
                        | SSC_BIT(TFMR_MSBF)
                        | SSC_BF(TFMR_DATDEF, 0)
                        | SSC_BF(TFMR_DATLEN, (bits - 1));
@@ -512,7 +502,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                rcmr =    SSC_BF(RCMR_PERIOD, ssc_p->rcmr_period)
                        | SSC_BF(RCMR_STTDLY, 1)
                        | SSC_BF(RCMR_START, SSC_START_RISING_RF)
-                        | SSC_BF(RCMR_CKI, SSC_CKI_RISING)
+                        | SSC_BF(RCMR_CKI, SSC_CKI_FALLING)
                        | SSC_BF(RCMR_CKO, SSC_CKO_NONE)
                        | SSC_BF(RCMR_CKS, SSC_CKS_DIV);
@@ -527,7 +517,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                tcmr =    SSC_BF(TCMR_PERIOD, ssc_p->tcmr_period)
                        | SSC_BF(TCMR_STTDLY, 1)
                        | SSC_BF(TCMR_START, SSC_START_RISING_RF)
-                        | SSC_BF(TCMR_CKI, SSC_CKI_RISING)
+                        | SSC_BF(TCMR_CKI, SSC_CKI_FALLING)
                        | SSC_BF(TCMR_CKO, SSC_CKO_CONTINUOUS)
                        | SSC_BF(TCMR_CKS, SSC_CKS_DIV);
@@ -556,7 +546,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                rcmr =    SSC_BF(RCMR_PERIOD, 0)
                        | SSC_BF(RCMR_STTDLY, START_DELAY)
                        | SSC_BF(RCMR_START, SSC_START_RISING_RF)
-                        | SSC_BF(RCMR_CKI, SSC_CKI_RISING)
+                        | SSC_BF(RCMR_CKI, SSC_CKI_FALLING)
                        | SSC_BF(RCMR_CKO, SSC_CKO_NONE)
                        | SSC_BF(RCMR_CKS, ssc->clk_from_rk_pin ?
                                           SSC_CKS_PIN : SSC_CKS_CLOCK);
diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
index e5f2fb884bf3..30c673cdc12e 100644
--- a/sound/soc/codecs/pcm512x.c
+++ b/sound/soc/codecs/pcm512x.c
@@ -188,8 +188,8 @@ static const DECLARE_TLV_DB_SCALE(boost_tlv, 0, 80, 0);
 static const char * const pcm512x_dsp_program_texts[] = {
        "FIR interpolation with de-emphasis",
        "Low latency IIR with de-emphasis",
-        "Fixed process flow",
        "High attenuation with de-emphasis",
+        "Fixed process flow",
        "Ringing-less low latency FIR",
 };
diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
index 2cd4fe463102..1d1c7f8a9af2 100644
--- a/sound/soc/codecs/rt286.c
+++ b/sound/soc/codecs/rt286.c
@@ -861,10 +861,8 @@ static int rt286_hw_params(struct snd_pcm_substream *substream,
                RT286_I2S_CTRL1, 0x0018, d_len_code << 3);
        dev_dbg(codec->dev, "format val = 0x%x\n", val);
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+        snd_soc_update_bits(codec, RT286_DAC_FORMAT, 0x407f, val);
-                snd_soc_update_bits(codec, RT286_DAC_FORMAT, 0x407f, val);
+        snd_soc_update_bits(codec, RT286_ADC_FORMAT, 0x407f, val);
-        else
-                snd_soc_update_bits(codec, RT286_ADC_FORMAT, 0x407f, val);
        return 0;
 }
diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
index c3f2decd643c..1ff726c29249 100644
--- a/sound/soc/codecs/rt5640.c
+++ b/sound/soc/codecs/rt5640.c
@@ -2124,6 +2124,7 @@ MODULE_DEVICE_TABLE(of, rt5640_of_match);
 static struct acpi_device_id rt5640_acpi_match[] = {
        { "INT33CA", 0 },
        { "10EC5640", 0 },
+        { "10EC5642", 0 },
        { },
 };
 MODULE_DEVICE_TABLE(acpi, rt5640_acpi_match);
diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
index 81fe1464d268..918ada9738b0 100644
--- a/sound/soc/codecs/rt5677.c
+++ b/sound/soc/codecs/rt5677.c
@@ -784,8 +784,8 @@ static unsigned int bst_tlv[] = {
 static int rt5677_dsp_vad_get(struct snd_kcontrol *kcontrol,
                struct snd_ctl_elem_value *ucontrol)
 {
-        struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+        struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
-        struct rt5677_priv *rt5677 = snd_soc_codec_get_drvdata(codec);
+        struct rt5677_priv *rt5677 = snd_soc_component_get_drvdata(component);
        ucontrol->value.integer.value[0] = rt5677->dsp_vad_en;
@@ -795,8 +795,9 @@ static int rt5677_dsp_vad_get(struct snd_kcontrol *kcontrol,
 static int rt5677_dsp_vad_put(struct snd_kcontrol *kcontrol,
                struct snd_ctl_elem_value *ucontrol)
 {
-        struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+        struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
-        struct rt5677_priv *rt5677 = snd_soc_codec_get_drvdata(codec);
+        struct rt5677_priv *rt5677 = snd_soc_component_get_drvdata(component);
+        struct snd_soc_codec *codec = snd_soc_component_to_codec(component);
        rt5677->dsp_vad_en = !!ucontrol->value.integer.value[0];
@@ -2082,10 +2083,14 @@ static int rt5677_set_pll1_event(struct snd_soc_dapm_widget *w,
        struct rt5677_priv *rt5677 = snd_soc_codec_get_drvdata(codec);
        switch (event) {
-        case SND_SOC_DAPM_POST_PMU:
+        case SND_SOC_DAPM_PRE_PMU:
                regmap_update_bits(rt5677->regmap, RT5677_PLL1_CTRL2, 0x2, 0x2);
+                break;
+        case SND_SOC_DAPM_POST_PMU:
                regmap_update_bits(rt5677->regmap, RT5677_PLL1_CTRL2, 0x2, 0x0);
                break;
        default:
                return 0;
        }
@@ -2100,10 +2105,14 @@ static int rt5677_set_pll2_event(struct snd_soc_dapm_widget *w,
        struct rt5677_priv *rt5677 = snd_soc_codec_get_drvdata(codec);
        switch (event) {
-        case SND_SOC_DAPM_POST_PMU:
+        case SND_SOC_DAPM_PRE_PMU:
                regmap_update_bits(rt5677->regmap, RT5677_PLL2_CTRL2, 0x2, 0x2);
+                break;
+        case SND_SOC_DAPM_POST_PMU:
                regmap_update_bits(rt5677->regmap, RT5677_PLL2_CTRL2, 0x2, 0x0);
                break;
        default:
                return 0;
        }
@@ -2211,9 +2220,11 @@ static int rt5677_vref_event(struct snd_soc_dapm_widget *w,
 static const struct snd_soc_dapm_widget rt5677_dapm_widgets[] = {
        SND_SOC_DAPM_SUPPLY("PLL1", RT5677_PWR_ANLG2, RT5677_PWR_PLL1_BIT,
-                0, rt5677_set_pll1_event, SND_SOC_DAPM_POST_PMU),
+                0, rt5677_set_pll1_event, SND_SOC_DAPM_PRE_PMU |
+                SND_SOC_DAPM_POST_PMU),
        SND_SOC_DAPM_SUPPLY("PLL2", RT5677_PWR_ANLG2, RT5677_PWR_PLL2_BIT,
-                0, rt5677_set_pll2_event, SND_SOC_DAPM_POST_PMU),
+                0, rt5677_set_pll2_event, SND_SOC_DAPM_PRE_PMU |
+                SND_SOC_DAPM_POST_PMU),
        /* Input Side */
        /* micbias */
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index 29cf7ce610f4..aa98be32bb60 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -483,21 +483,21 @@ static int sgtl5000_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
        /* setting i2s data format */
        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
        case SND_SOC_DAIFMT_DSP_A:
-                i2sctl |= SGTL5000_I2S_MODE_PCM;
+                i2sctl |= SGTL5000_I2S_MODE_PCM << SGTL5000_I2S_MODE_SHIFT;
                break;
        case SND_SOC_DAIFMT_DSP_B:
-                i2sctl |= SGTL5000_I2S_MODE_PCM;
+                i2sctl |= SGTL5000_I2S_MODE_PCM << SGTL5000_I2S_MODE_SHIFT;
                i2sctl |= SGTL5000_I2S_LRALIGN;
                break;
        case SND_SOC_DAIFMT_I2S:
-                i2sctl |= SGTL5000_I2S_MODE_I2S_LJ;
+                i2sctl |= SGTL5000_I2S_MODE_I2S_LJ << SGTL5000_I2S_MODE_SHIFT;
                break;
        case SND_SOC_DAIFMT_RIGHT_J:
-                i2sctl |= SGTL5000_I2S_MODE_RJ;
+                i2sctl |= SGTL5000_I2S_MODE_RJ << SGTL5000_I2S_MODE_SHIFT;
                i2sctl |= SGTL5000_I2S_LRPOL;
                break;
        case SND_SOC_DAIFMT_LEFT_J:
-                i2sctl |= SGTL5000_I2S_MODE_I2S_LJ;
+                i2sctl |= SGTL5000_I2S_MODE_I2S_LJ << SGTL5000_I2S_MODE_SHIFT;
                i2sctl |= SGTL5000_I2S_LRALIGN;
                break;
        default:
@@ -1462,6 +1462,9 @@ static int sgtl5000_i2c_probe(struct i2c_client *client,
        if (ret)
                return ret;
+        /* Need 8 clocks before I2C accesses */
+        udelay(1);
        /* read chip information */
        ret = regmap_read(sgtl5000->regmap, SGTL5000_CHIP_ID, &reg);
        if (ret)
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index b7ebce054b4e..dd222b10ce13 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -1046,7 +1046,7 @@ static int aic3x_prepare(struct snd_pcm_substream *substream,
                delay += aic3x->tdm_delay;
        /* Configure data delay */
-        snd_soc_write(codec, AIC3X_ASD_INTF_CTRLC, aic3x->tdm_delay);
+        snd_soc_write(codec, AIC3X_ASD_INTF_CTRLC, delay);
        return 0;
 }
diff --git a/sound/soc/codecs/ts3a227e.c b/sound/soc/codecs/ts3a227e.c
index 1d1205702d23..9f2dced046de 100644
--- a/sound/soc/codecs/ts3a227e.c
+++ b/sound/soc/codecs/ts3a227e.c
@@ -254,6 +254,7 @@ static int ts3a227e_i2c_probe(struct i2c_client *i2c,
        struct ts3a227e *ts3a227e;
        struct device *dev = &i2c->dev;
        int ret;
+        unsigned int acc_reg;
        ts3a227e = devm_kzalloc(&i2c->dev, sizeof(*ts3a227e), GFP_KERNEL);
        if (ts3a227e == NULL)
@@ -283,6 +284,11 @@ static int ts3a227e_i2c_probe(struct i2c_client *i2c,
                           INTB_DISABLE | ADC_COMPLETE_INT_DISABLE,
                           ADC_COMPLETE_INT_DISABLE);
+        /* Read jack status because chip might not trigger interrupt at boot. */
+        regmap_read(ts3a227e->regmap, TS3A227E_REG_ACCESSORY_STATUS, &acc_reg);
+        ts3a227e_new_jack_state(ts3a227e, acc_reg);
+        ts3a227e_jack_report(ts3a227e);
        return 0;
 }
diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
index b9211b42f6e9..b115ed815db9 100644
--- a/sound/soc/codecs/wm8731.c
+++ b/sound/soc/codecs/wm8731.c
@@ -717,6 +717,8 @@ static int wm8731_i2c_probe(struct i2c_client *i2c,
        if (wm8731 == NULL)
                return -ENOMEM;
+        mutex_init(&wm8731->lock);
        wm8731->regmap = devm_regmap_init_i2c(i2c, &wm8731_regmap);
        if (IS_ERR(wm8731->regmap)) {
                ret = PTR_ERR(wm8731->regmap);
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index 4d2d2b1380d5..75b87c5c0f04 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -1076,10 +1076,13 @@ static const struct snd_soc_dapm_route adc_intercon[] = {
        { "Right Capture PGA", NULL, "Right Capture Mux" },
        { "Right Capture PGA", NULL, "Right Capture Inverting Mux" },
-        { "AIFOUTL", "Left",  "ADCL" },
+        { "AIFOUTL Mux", "Left", "ADCL" },
-        { "AIFOUTL", "Right", "ADCR" },
+        { "AIFOUTL Mux", "Right", "ADCR" },
-        { "AIFOUTR", "Left",  "ADCL" },
+        { "AIFOUTR Mux", "Left", "ADCL" },
-        { "AIFOUTR", "Right", "ADCR" },
+        { "AIFOUTR Mux", "Right", "ADCR" },
+        { "AIFOUTL", NULL, "AIFOUTL Mux" },
+        { "AIFOUTR", NULL, "AIFOUTR Mux" },
        { "ADCL", NULL, "CLK_DSP" },
        { "ADCL", NULL, "Left Capture PGA" },
@@ -1089,12 +1092,16 @@ static const struct snd_soc_dapm_route adc_intercon[] = {
 };
 static const struct snd_soc_dapm_route dac_intercon[] = {
-        { "DACL", "Right", "AIFINR" },
+        { "DACL Mux", "Left", "AIFINL" },
-        { "DACL", "Left",  "AIFINL" },
+        { "DACL Mux", "Right", "AIFINR" },
+        { "DACR Mux", "Left", "AIFINL" },
+        { "DACR Mux", "Right", "AIFINR" },
+        { "DACL", NULL, "DACL Mux" },
        { "DACL", NULL, "CLK_DSP" },
-        { "DACR", "Right", "AIFINR" },
+        { "DACR", NULL, "DACR Mux" },
-        { "DACR", "Left",  "AIFINL" },
        { "DACR", NULL, "CLK_DSP" },
        { "Charge pump", NULL, "SYSCLK" },
diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index 031a1ae71d94..a96eb497a379 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -556,7 +556,7 @@ static struct {
        { 22050, 2 },
        { 24000, 2 },
        { 16000, 3 },
-        { 11250, 4 },
+        { 11025, 4 },
        { 12000, 4 },
        {  8000, 5 },
 };
diff --git a/sound/soc/codecs/wm9705.c b/sound/soc/codecs/wm9705.c
index 3eddb18fefd1..5cc457ef8894 100644
--- a/sound/soc/codecs/wm9705.c
+++ b/sound/soc/codecs/wm9705.c
@@ -344,23 +344,27 @@ static int wm9705_soc_probe(struct snd_soc_codec *codec)
        struct snd_ac97 *ac97;
        int ret = 0;
-        ac97 = snd_soc_new_ac97_codec(codec);
+        ac97 = snd_soc_alloc_ac97_codec(codec);
        if (IS_ERR(ac97)) {
                ret = PTR_ERR(ac97);
                dev_err(codec->dev, "Failed to register AC97 codec\n");
                return ret;
        }
-        snd_soc_codec_set_drvdata(codec, ac97);
        ret = wm9705_reset(codec);
        if (ret)
-                goto reset_err;
+                goto err_put_device;
+        ret = device_add(&ac97->dev);
+        if (ret)
+                goto err_put_device;
+        snd_soc_codec_set_drvdata(codec, ac97);
        return 0;
-reset_err:
+err_put_device:
-        snd_soc_free_ac97_codec(ac97);
+        put_device(&ac97->dev);
        return ret;
 }
diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
index e04643d2bb24..9517571e820d 100644
--- a/sound/soc/codecs/wm9712.c
+++ b/sound/soc/codecs/wm9712.c
@@ -666,7 +666,7 @@ static int wm9712_soc_probe(struct snd_soc_codec *codec)
        struct wm9712_priv *wm9712 = snd_soc_codec_get_drvdata(codec);
        int ret = 0;
-        wm9712->ac97 = snd_soc_new_ac97_codec(codec);
+        wm9712->ac97 = snd_soc_alloc_ac97_codec(codec);
        if (IS_ERR(wm9712->ac97)) {
                ret = PTR_ERR(wm9712->ac97);
                dev_err(codec->dev, "Failed to register AC97 codec: %d\n", ret);
@@ -675,15 +675,19 @@ static int wm9712_soc_probe(struct snd_soc_codec *codec)
        ret = wm9712_reset(codec, 0);
        if (ret < 0)
-                goto reset_err;
+                goto err_put_device;
+        ret = device_add(&wm9712->ac97->dev);
+        if (ret)
+                goto err_put_device;
        /* set alc mux to none */
        ac97_write(codec, AC97_VIDEO, ac97_read(codec, AC97_VIDEO) | 0x3000);
        return 0;
-reset_err:
+err_put_device:
-        snd_soc_free_ac97_codec(wm9712->ac97);
+        put_device(&wm9712->ac97->dev);
        return ret;
 }
diff --git a/sound/soc/codecs/wm9713.c b/sound/soc/codecs/wm9713.c
index 71b9d5b0734d..6ab1122a3872 100644
--- a/sound/soc/codecs/wm9713.c
+++ b/sound/soc/codecs/wm9713.c
@@ -1225,7 +1225,7 @@ static int wm9713_soc_probe(struct snd_soc_codec *codec)
        struct wm9713_priv *wm9713 = snd_soc_codec_get_drvdata(codec);
        int ret = 0, reg;
-        wm9713->ac97 = snd_soc_new_ac97_codec(codec);
+        wm9713->ac97 = snd_soc_alloc_ac97_codec(codec);
        if (IS_ERR(wm9713->ac97))
                return PTR_ERR(wm9713->ac97);
@@ -1234,7 +1234,11 @@ static int wm9713_soc_probe(struct snd_soc_codec *codec)
        wm9713_reset(codec, 0);
        ret = wm9713_reset(codec, 1);
        if (ret < 0)
-                goto reset_err;
+                goto err_put_device;
+        ret = device_add(&wm9713->ac97->dev);
+        if (ret)
+                goto err_put_device;
        /* unmute the adc - move to kcontrol */
        reg = ac97_read(codec, AC97_CD) & 0x7fff;
@@ -1242,8 +1246,8 @@ static int wm9713_soc_probe(struct snd_soc_codec *codec)
        return 0;
-reset_err:
+err_put_device:
-        snd_soc_free_ac97_codec(wm9713->ac97);
+        put_device(&wm9713->ac97->dev);
        return ret;
 }
diff --git a/sound/soc/dwc/designware_i2s.c b/sound/soc/dwc/designware_i2s.c
index b93168d4f648..8d18bbda661b 100644
--- a/sound/soc/dwc/designware_i2s.c
+++ b/sound/soc/dwc/designware_i2s.c
@@ -209,16 +209,9 @@ static int dw_i2s_hw_params(struct snd_pcm_substream *substream,
        switch (config->chan_nr) {
        case EIGHT_CHANNEL_SUPPORT:
-                ch_reg = 3;
-                break;
        case SIX_CHANNEL_SUPPORT:
-                ch_reg = 2;
-                break;
        case FOUR_CHANNEL_SUPPORT:
-                ch_reg = 1;
-                break;
        case TWO_CHANNEL_SUPPORT:
-                ch_reg = 0;
                break;
        default:
                dev_err(dev->dev, "channel not supported\n");
@@ -227,18 +220,22 @@ static int dw_i2s_hw_params(struct snd_pcm_substream *substream,
        i2s_disable_channels(dev, substream->stream);
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+        for (ch_reg = 0; ch_reg < (config->chan_nr / 2); ch_reg++) {
-                i2s_write_reg(dev->i2s_base, TCR(ch_reg), xfer_resolution);
+                if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                i2s_write_reg(dev->i2s_base, TFCR(ch_reg), 0x02);
+                        i2s_write_reg(dev->i2s_base, TCR(ch_reg),
-                irq = i2s_read_reg(dev->i2s_base, IMR(ch_reg));
+                                      xfer_resolution);
-                i2s_write_reg(dev->i2s_base, IMR(ch_reg), irq & ~0x30);
+                        i2s_write_reg(dev->i2s_base, TFCR(ch_reg), 0x02);
-                i2s_write_reg(dev->i2s_base, TER(ch_reg), 1);
+                        irq = i2s_read_reg(dev->i2s_base, IMR(ch_reg));
-        } else {
+                        i2s_write_reg(dev->i2s_base, IMR(ch_reg), irq & ~0x30);
-                i2s_write_reg(dev->i2s_base, RCR(ch_reg), xfer_resolution);
+                        i2s_write_reg(dev->i2s_base, TER(ch_reg), 1);
-                i2s_write_reg(dev->i2s_base, RFCR(ch_reg), 0x07);
+                } else {
-                irq = i2s_read_reg(dev->i2s_base, IMR(ch_reg));
+                        i2s_write_reg(dev->i2s_base, RCR(ch_reg),
-                i2s_write_reg(dev->i2s_base, IMR(ch_reg), irq & ~0x03);
+                                      xfer_resolution);
-                i2s_write_reg(dev->i2s_base, RER(ch_reg), 1);
+                        i2s_write_reg(dev->i2s_base, RFCR(ch_reg), 0x07);
+                        irq = i2s_read_reg(dev->i2s_base, IMR(ch_reg));
+                        i2s_write_reg(dev->i2s_base, IMR(ch_reg), irq & ~0x03);
+                        i2s_write_reg(dev->i2s_base, RER(ch_reg), 1);
+                }
        }
        i2s_write_reg(dev->i2s_base, CCR, ccr);
@@ -263,6 +260,19 @@ static void dw_i2s_shutdown(struct snd_pcm_substream *substream,
        snd_soc_dai_set_dma_data(dai, substream, NULL);
 }
+static int dw_i2s_prepare(struct snd_pcm_substream *substream,
+                          struct snd_soc_dai *dai)
+{
+        struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                i2s_write_reg(dev->i2s_base, TXFFR, 1);
+        else
+                i2s_write_reg(dev->i2s_base, RXFFR, 1);
+        return 0;
+}
 static int dw_i2s_trigger(struct snd_pcm_substream *substream,
                int cmd, struct snd_soc_dai *dai)
 {
@@ -294,6 +304,7 @@ static struct snd_soc_dai_ops dw_i2s_dai_ops = {
        .startup        = dw_i2s_startup,
        .shutdown       = dw_i2s_shutdown,
        .hw_params      = dw_i2s_hw_params,
+        .prepare        = dw_i2s_prepare,
        .trigger        = dw_i2s_trigger,
 };
diff --git a/sound/soc/fsl/fsl_esai.h b/sound/soc/fsl/fsl_esai.h
index 91a550f4a10d..5e793bbb6b02 100644
--- a/sound/soc/fsl/fsl_esai.h
+++ b/sound/soc/fsl/fsl_esai.h
@@ -302,7 +302,7 @@
 #define ESAI_xCCR_xFP_MASK      (((1 << ESAI_xCCR_xFP_WIDTH) - 1) << ESAI_xCCR_xFP_SHIFT)
 #define ESAI_xCCR_xFP(v)        ((((v) - 1) << ESAI_xCCR_xFP_SHIFT) & ESAI_xCCR_xFP_MASK)
 #define ESAI_xCCR_xDC_SHIFT     9
-#define ESAI_xCCR_xDC_WIDTH     4
+#define ESAI_xCCR_xDC_WIDTH     5
 #define ESAI_xCCR_xDC_MASK      (((1 << ESAI_xCCR_xDC_WIDTH) - 1) << ESAI_xCCR_xDC_SHIFT)
 #define ESAI_xCCR_xDC(v)        ((((v) - 1) << ESAI_xCCR_xDC_SHIFT) & ESAI_xCCR_xDC_MASK)
 #define ESAI_xCCR_xPSR_SHIFT    8
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index a65f17d57ffb..059496ed9ad7 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -1362,9 +1362,9 @@ static int fsl_ssi_probe(struct platform_device *pdev)
        }
        ssi_private->irq = platform_get_irq(pdev, 0);
-        if (!ssi_private->irq) {
+        if (ssi_private->irq < 0) {
                dev_err(&pdev->dev, "no irq for node %s\n", np->full_name);
-                return -ENXIO;
+                return ssi_private->irq;
        }
        /* Are the RX and the TX clocks locked? */
diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
index 4caacb05a623..cd146d4fa805 100644
--- a/sound/soc/fsl/imx-wm8962.c
+++ b/sound/soc/fsl/imx-wm8962.c
@@ -257,6 +257,7 @@ static int imx_wm8962_probe(struct platform_device *pdev)
        if (ret)
                goto clk_fail;
        data->card.num_links = 1;
+        data->card.owner = THIS_MODULE;
        data->card.dai_link = &data->dai;
        data->card.dapm_widgets = imx_wm8962_dapm_widgets;
        data->card.num_dapm_widgets = ARRAY_SIZE(imx_wm8962_dapm_widgets);
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index fb9240fdc9b7..7fe3009b1c43 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -452,9 +452,8 @@ static int asoc_simple_card_parse_of(struct device_node *node,
 }
 /* Decrease the reference count of the device nodes */
-static int asoc_simple_card_unref(struct platform_device *pdev)
+static int asoc_simple_card_unref(struct snd_soc_card *card)
 {
-        struct snd_soc_card *card = platform_get_drvdata(pdev);
        struct snd_soc_dai_link *dai_link;
        int num_links;
@@ -556,7 +555,7 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
                return ret;
 err:
-        asoc_simple_card_unref(pdev);
+        asoc_simple_card_unref(&priv->snd_card);
        return ret;
 }
@@ -572,7 +571,7 @@ static int asoc_simple_card_remove(struct platform_device *pdev)
                snd_soc_jack_free_gpios(&simple_card_mic_jack, 1,
                                        &simple_card_mic_jack_gpio);
-        return asoc_simple_card_unref(pdev);
+        return asoc_simple_card_unref(card);
 }
 static const struct of_device_id asoc_simple_of_match[] = {
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index e989ecf046c9..f86de1211b96 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -89,7 +89,7 @@ config SND_SOC_INTEL_BROADWELL_MACH
 config SND_SOC_INTEL_BYTCR_RT5640_MACH
        tristate "ASoC Audio DSP Support for MID BYT Platform"
-        depends on X86
+        depends on X86 && I2C
        select SND_SOC_RT5640
        select SND_SST_MFLD_PLATFORM
        select SND_SST_IPC_ACPI
@@ -101,7 +101,7 @@ config SND_SOC_INTEL_BYTCR_RT5640_MACH
 config SND_SOC_INTEL_CHT_BSW_RT5672_MACH
        tristate "ASoC Audio driver for Intel Cherrytrail & Braswell with RT5672 codec"
-        depends on X86_INTEL_LPSS
+        depends on X86_INTEL_LPSS && I2C
        select SND_SOC_RT5670
        select SND_SST_MFLD_PLATFORM
        select SND_SST_IPC_ACPI
diff --git a/sound/soc/intel/bytcr_dpcm_rt5640.c b/sound/soc/intel/bytcr_dpcm_rt5640.c
index f5d0fc1ab10c..eef0c56ec32e 100644
--- a/sound/soc/intel/bytcr_dpcm_rt5640.c
+++ b/sound/soc/intel/bytcr_dpcm_rt5640.c
@@ -227,4 +227,4 @@ module_platform_driver(snd_byt_mc_driver);
 MODULE_DESCRIPTION("ASoC Intel(R) Baytrail CR Machine driver");
 MODULE_AUTHOR("Subhransu S. Prusty <subhransu.s.prusty@intel.com>");
 MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:bytrt5640-audio");
+MODULE_ALIAS("platform:bytt100_rt5640");
diff --git a/sound/soc/intel/sst-firmware.c b/sound/soc/intel/sst-firmware.c
index 4a5bde9c686b..b3f9489794a6 100644
--- a/sound/soc/intel/sst-firmware.c
+++ b/sound/soc/intel/sst-firmware.c
@@ -706,6 +706,7 @@ static int block_alloc_fixed(struct sst_dsp *dsp, struct sst_block_allocator *ba
        struct list_head *block_list)
 {
        struct sst_mem_block *block, *tmp;
+        struct sst_block_allocator ba_tmp = *ba;
        u32 end = ba->offset + ba->size, block_end;
        int err;
@@ -730,9 +731,9 @@ static int block_alloc_fixed(struct sst_dsp *dsp, struct sst_block_allocator *ba
                if (ba->offset >= block->offset && ba->offset < block_end) {
                        /* align ba to block boundary */
-                        ba->size -= block_end - ba->offset;
+                        ba_tmp.size -= block_end - ba->offset;
-                        ba->offset = block_end;
+                        ba_tmp.offset = block_end;
-                        err = block_alloc_contiguous(dsp, ba, block_list);
+                        err = block_alloc_contiguous(dsp, &ba_tmp, block_list);
                        if (err < 0)
                                return -ENOMEM;
@@ -763,10 +764,14 @@ static int block_alloc_fixed(struct sst_dsp *dsp, struct sst_block_allocator *ba
                /* does block span more than 1 section */
                if (ba->offset >= block->offset && ba->offset < block_end) {
+                        /* add block */
+                        list_move(&block->list, &dsp->used_block_list);
+                        list_add(&block->module_list, block_list);
                        /* align ba to block boundary */
-                        ba->offset = block->offset;
+                        ba_tmp.size -= block_end - ba->offset;
+                        ba_tmp.offset = block_end;
-                        err = block_alloc_contiguous(dsp, ba, block_list);
+                        err = block_alloc_contiguous(dsp, &ba_tmp, block_list);
                        if (err < 0)
                                return -ENOMEM;
diff --git a/sound/soc/intel/sst-haswell-ipc.c b/sound/soc/intel/sst-haswell-ipc.c
index 3f8c48231364..8156cc1accb7 100644
--- a/sound/soc/intel/sst-haswell-ipc.c
+++ b/sound/soc/intel/sst-haswell-ipc.c
@@ -651,11 +651,11 @@ static void hsw_notification_work(struct work_struct *work)
        }
        /* tell DSP that notification has been handled */
-        sst_dsp_shim_update_bits_unlocked(hsw->dsp, SST_IPCD,
+        sst_dsp_shim_update_bits(hsw->dsp, SST_IPCD,
                SST_IPCD_BUSY | SST_IPCD_DONE, SST_IPCD_DONE);
        /* unmask busy interrupt */
-        sst_dsp_shim_update_bits_unlocked(hsw->dsp, SST_IMRX, SST_IMRX_BUSY, 0);
+        sst_dsp_shim_update_bits(hsw->dsp, SST_IMRX, SST_IMRX_BUSY, 0);
 }
 static struct ipc_message *reply_find_msg(struct sst_hsw *hsw, u32 header)
@@ -1228,6 +1228,11 @@ int sst_hsw_stream_free(struct sst_hsw *hsw, struct sst_hsw_stream *stream)
        struct sst_dsp *sst = hsw->dsp;
        unsigned long flags;
+        if (!stream) {
+                dev_warn(hsw->dev, "warning: stream is NULL, no stream to free, ignore it.\n");
+                return 0;
+        }
        /* dont free DSP streams that are not commited */
        if (!stream->commited)
                goto out;
@@ -1415,6 +1420,16 @@ int sst_hsw_stream_commit(struct sst_hsw *hsw, struct sst_hsw_stream *stream)
        u32 header;
        int ret;
+        if (!stream) {
+                dev_warn(hsw->dev, "warning: stream is NULL, no stream to commit, ignore it.\n");
+                return 0;
+        }
+        if (stream->commited) {
+                dev_warn(hsw->dev, "warning: stream is already committed, ignore it.\n");
+                return 0;
+        }
        trace_ipc_request("stream alloc", stream->host_id);
        header = IPC_GLB_TYPE(IPC_GLB_ALLOCATE_STREAM);
@@ -1519,6 +1534,11 @@ int sst_hsw_stream_pause(struct sst_hsw *hsw, struct sst_hsw_stream *stream,
 {
        int ret;
+        if (!stream) {
+                dev_warn(hsw->dev, "warning: stream is NULL, no stream to pause, ignore it.\n");
+                return 0;
+        }
        trace_ipc_request("stream pause", stream->reply.stream_hw_id);
        ret = sst_hsw_stream_operations(hsw, IPC_STR_PAUSE,
@@ -1535,6 +1555,11 @@ int sst_hsw_stream_resume(struct sst_hsw *hsw, struct sst_hsw_stream *stream,
 {
        int ret;
+        if (!stream) {
+                dev_warn(hsw->dev, "warning: stream is NULL, no stream to resume, ignore it.\n");
+                return 0;
+        }
        trace_ipc_request("stream resume", stream->reply.stream_hw_id);
        ret = sst_hsw_stream_operations(hsw, IPC_STR_RESUME,
@@ -1550,6 +1575,11 @@ int sst_hsw_stream_reset(struct sst_hsw *hsw, struct sst_hsw_stream *stream)
 {
        int ret, tries = 10;
+        if (!stream) {
+                dev_warn(hsw->dev, "warning: stream is NULL, no stream to reset, ignore it.\n");
+                return 0;
+        }
        /* dont reset streams that are not commited */
        if (!stream->commited)
                return 0;
diff --git a/sound/soc/intel/sst/sst_acpi.c b/sound/soc/intel/sst/sst_acpi.c
index 3abc29e8a928..b3360139c41a 100644
--- a/sound/soc/intel/sst/sst_acpi.c
+++ b/sound/soc/intel/sst/sst_acpi.c
@@ -343,14 +343,14 @@ int sst_acpi_remove(struct platform_device *pdev)
 }
 static struct sst_machines sst_acpi_bytcr[] = {
-        {"10EC5640", "T100", "bytt100_rt5640", NULL, "fw_sst_0f28.bin",
+        {"10EC5640", "T100", "bytt100_rt5640", NULL, "intel/fw_sst_0f28.bin",
                                                &byt_rvp_platform_data },
        {},
 };
 /* Cherryview-based platforms: CherryTrail and Braswell */
 static struct sst_machines sst_acpi_chv[] = {
-        {"10EC5670", "cht-bsw", "cht-bsw-rt5672", NULL, "fw_sst_22a8.bin",
+        {"10EC5670", "cht-bsw", "cht-bsw-rt5672", NULL, "intel/fw_sst_22a8.bin",
                                                &chv_platform_data },
        {},
 };
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index 8b79cafab1e2..c7eb9dd67f60 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -434,7 +434,7 @@ static int omap_mcbsp_dai_set_dai_fmt(struct snd_soc_dai *cpu_dai,
        case SND_SOC_DAIFMT_CBM_CFS:
                /* McBSP slave. FS clock as output */
                regs->srgr2     |= FSGM;
-                regs->pcr0      |= FSXM;
+                regs->pcr0      |= FSXM | FSRM;
                break;
        case SND_SOC_DAIFMT_CBM_CFM:
                /* McBSP slave */
diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
index 26ec5117b35c..dcc26eda0539 100644
--- a/sound/soc/rockchip/rockchip_i2s.c
+++ b/sound/soc/rockchip/rockchip_i2s.c
@@ -335,6 +335,7 @@ static struct snd_soc_dai_driver rockchip_i2s_dai = {
                            SNDRV_PCM_FMTBIT_S24_LE),
        },
        .ops = &rockchip_i2s_dai_ops,
+        .symmetric_rates = 1,
 };
 static const struct snd_soc_component_driver rockchip_i2s_component = {
@@ -454,11 +455,11 @@ static int rockchip_i2s_probe(struct platform_device *pdev)
        i2s->playback_dma_data.addr = res->start + I2S_TXDR;
        i2s->playback_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        i2s->playback_dma_data.maxburst = 16;
+        i2s->playback_dma_data.maxburst = 4;
        i2s->capture_dma_data.addr = res->start + I2S_RXDR;
        i2s->capture_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        i2s->capture_dma_data.maxburst = 16;
+        i2s->capture_dma_data.maxburst = 4;
        i2s->dev = &pdev->dev;
        dev_set_drvdata(&pdev->dev, i2s);
diff --git a/sound/soc/rockchip/rockchip_i2s.h b/sound/soc/rockchip/rockchip_i2s.h
index 89a5d8bc6ee7..93f456f518a9 100644
--- a/sound/soc/rockchip/rockchip_i2s.h
+++ b/sound/soc/rockchip/rockchip_i2s.h
@@ -127,7 +127,7 @@
 #define I2S_DMACR_TDE_DISABLE   (0 << I2S_DMACR_TDE_SHIFT)
 #define I2S_DMACR_TDE_ENABLE    (1 << I2S_DMACR_TDE_SHIFT)
 #define I2S_DMACR_TDL_SHIFT     0
-#define I2S_DMACR_TDL(x)        ((x - 1) << I2S_DMACR_TDL_SHIFT)
+#define I2S_DMACR_TDL(x)        ((x) << I2S_DMACR_TDL_SHIFT)
 #define I2S_DMACR_TDL_MASK      (0x1f << I2S_DMACR_TDL_SHIFT)
 /*
diff --git a/sound/soc/soc-ac97.c b/sound/soc/soc-ac97.c
index 2e10e9a38376..08d7259bbaab 100644
--- a/sound/soc/soc-ac97.c
+++ b/sound/soc/soc-ac97.c
@@ -48,15 +48,18 @@ static void soc_ac97_device_release(struct device *dev)
 }
 /**
- * snd_soc_new_ac97_codec - initailise AC97 device
+ * snd_soc_alloc_ac97_codec() - Allocate new a AC'97 device
- * @codec: audio codec
+ * @codec: The CODEC for which to create the AC'97 device
 *
- * Initialises AC97 codec resources for use by ad-hoc devices only.
+ * Allocated a new snd_ac97 device and intializes it, but does not yet register
+ * it. The caller is responsible to either call device_add(&ac97->dev) to
+ * register the device, or to call put_device(&ac97->dev) to free the device.
+ *
+ * Returns: A snd_ac97 device or a PTR_ERR in case of an error.
 */
-struct snd_ac97 *snd_soc_new_ac97_codec(struct snd_soc_codec *codec)
+struct snd_ac97 *snd_soc_alloc_ac97_codec(struct snd_soc_codec *codec)
 {
        struct snd_ac97 *ac97;
-        int ret;
        ac97 = kzalloc(sizeof(struct snd_ac97), GFP_KERNEL);
        if (ac97 == NULL)
@@ -73,7 +76,28 @@ struct snd_ac97 *snd_soc_new_ac97_codec(struct snd_soc_codec *codec)
                     codec->component.card->snd_card->number, 0,
                     codec->component.name);
-        ret = device_register(&ac97->dev);
+        device_initialize(&ac97->dev);
+        return ac97;
+}
+EXPORT_SYMBOL(snd_soc_alloc_ac97_codec);
+/**
+ * snd_soc_new_ac97_codec - initailise AC97 device
+ * @codec: audio codec
+ *
+ * Initialises AC97 codec resources for use by ad-hoc devices only.
+ */
+struct snd_ac97 *snd_soc_new_ac97_codec(struct snd_soc_codec *codec)
+{
+        struct snd_ac97 *ac97;
+        int ret;
+        ac97 = snd_soc_alloc_ac97_codec(codec);
+        if (IS_ERR(ac97))
+                return ac97;
+        ret = device_add(&ac97->dev);
        if (ret) {
                put_device(&ac97->dev);
                return ERR_PTR(ret);
diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index 590a82f01d0b..025c38fbe3c0 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -659,7 +659,8 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
                        rtd->dai_link->stream_name);
                ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num,
-                                1, 0, &be_pcm);
+                                rtd->dai_link->dpcm_playback,
+                                rtd->dai_link->dpcm_capture, &be_pcm);
                if (ret < 0) {
                        dev_err(rtd->card->dev, "ASoC: can't create compressed for %s\n",
                                rtd->dai_link->name);
@@ -668,8 +669,10 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
                rtd->pcm = be_pcm;
                rtd->fe_compr = 1;
-                be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
+                if (rtd->dai_link->dpcm_playback)
-                be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
+                        be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
+                else if (rtd->dai_link->dpcm_capture)
+                        be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
                memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops));
        } else
                memcpy(compr->ops, &soc_compr_ops, sizeof(soc_compr_ops));
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 985052b3fbed..2c62620abca6 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -3230,7 +3230,7 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
                                   const char *propname)
 {
        struct device_node *np = card->dev->of_node;
-        int num_routes, old_routes;
+        int num_routes;
        struct snd_soc_dapm_route *routes;
        int i, ret;
@@ -3248,9 +3248,7 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
                return -EINVAL;
        }
-        old_routes = card->num_dapm_routes;
+        routes = devm_kzalloc(card->dev, num_routes * sizeof(*routes),
-        routes = devm_kzalloc(card->dev,
-                              (old_routes + num_routes) * sizeof(*routes),
                              GFP_KERNEL);
        if (!routes) {
                dev_err(card->dev,
@@ -3258,11 +3256,9 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
                return -EINVAL;
        }
-        memcpy(routes, card->dapm_routes, old_routes * sizeof(*routes));
        for (i = 0; i < num_routes; i++) {
                ret = of_property_read_string_index(np, propname,
-                        2 * i, &routes[old_routes + i].sink);
+                        2 * i, &routes[i].sink);
                if (ret) {
                        dev_err(card->dev,
                                "ASoC: Property '%s' index %d could not be read: %d\n",
@@ -3270,7 +3266,7 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
                        return -EINVAL;
                }
                ret = of_property_read_string_index(np, propname,
-                        (2 * i) + 1, &routes[old_routes + i].source);
+                        (2 * i) + 1, &routes[i].source);
                if (ret) {
                        dev_err(card->dev,
                                "ASoC: Property '%s' index %d could not be read: %d\n",
@@ -3279,7 +3275,7 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
                }
        }
-        card->num_dapm_routes += num_routes;
+        card->num_dapm_routes = num_routes;
        card->dapm_routes = routes;
        return 0;
diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
index 272844746135..327f8642ca80 100644
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -816,7 +816,7 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev)
                return -EINVAL;
        }
-        if (cdev->n_streams < 2) {
+        if (cdev->n_streams < 1) {
                dev_err(dev, "bogus number of streams: %d\n", cdev->n_streams);
                return -EINVAL;
        }
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 41650d5b93b7..3e2ef61c627b 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -913,6 +913,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
        case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
        case USB_ID(0x046d, 0x0808):
        case USB_ID(0x046d, 0x0809):
+        case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */
        case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
        case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
        case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
diff --git a/tools/include/asm-generic/bitops.h b/tools/include/asm-generic/bitops.h
index 6eedba1f7732..653d1bad77de 100644
--- a/tools/include/asm-generic/bitops.h
+++ b/tools/include/asm-generic/bitops.h
@@ -22,6 +22,8 @@
 #error only <linux/bitops.h> can be included directly
 #endif
+#include <asm-generic/bitops/hweight.h>
 #include <asm-generic/bitops/atomic.h>
 #endif /* __TOOLS_ASM_GENERIC_BITOPS_H */
diff --git a/tools/include/asm-generic/bitops/arch_hweight.h b/tools/include/asm-generic/bitops/arch_hweight.h
new file mode 100644
index 000000000000..318bb2b202b0
--- /dev/null
+++ b/tools/include/asm-generic/bitops/arch_hweight.h
@@ -0,0 +1 @@
+#include "../../../../include/asm-generic/bitops/arch_hweight.h"
diff --git a/tools/include/asm-generic/bitops/const_hweight.h b/tools/include/asm-generic/bitops/const_hweight.h
new file mode 100644
index 000000000000..0afd644aff83
--- /dev/null
+++ b/tools/include/asm-generic/bitops/const_hweight.h
@@ -0,0 +1 @@
+#include "../../../../include/asm-generic/bitops/const_hweight.h"
diff --git a/tools/include/asm-generic/bitops/hweight.h b/tools/include/asm-generic/bitops/hweight.h
new file mode 100644
index 000000000000..290120c01a8e
--- /dev/null
+++ b/tools/include/asm-generic/bitops/hweight.h
@@ -0,0 +1,7 @@
+#ifndef _TOOLS_LINUX_ASM_GENERIC_BITOPS_HWEIGHT_H_
+#define _TOOLS_LINUX_ASM_GENERIC_BITOPS_HWEIGHT_H_
+#include <asm-generic/bitops/arch_hweight.h>
+#include <asm-generic/bitops/const_hweight.h>
+#endif /* _TOOLS_LINUX_ASM_GENERIC_BITOPS_HWEIGHT_H_ */
diff --git a/tools/include/linux/bitops.h b/tools/include/linux/bitops.h
index 26005a15e7e2..5ad9ee1dd7f6 100644
--- a/tools/include/linux/bitops.h
+++ b/tools/include/linux/bitops.h
@@ -1,9 +1,9 @@
 #ifndef _TOOLS_LINUX_BITOPS_H_
 #define _TOOLS_LINUX_BITOPS_H_
+#include <asm/types.h>
 #include <linux/kernel.h>
 #include <linux/compiler.h>
-#include <asm/hweight.h>
 #ifndef __WORDSIZE
 #define __WORDSIZE (__SIZEOF_LONG__ * 8)
@@ -19,6 +19,11 @@
 #define BITS_TO_U32(nr)         DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(u32))
 #define BITS_TO_BYTES(nr)       DIV_ROUND_UP(nr, BITS_PER_BYTE)
+extern unsigned int __sw_hweight8(unsigned int w);
+extern unsigned int __sw_hweight16(unsigned int w);
+extern unsigned int __sw_hweight32(unsigned int w);
+extern unsigned long __sw_hweight64(__u64 w);
 /*
 * Include this here because some architectures need generic_ffs/fls in
 * scope
diff --git a/tools/lib/api/fs/debugfs.c b/tools/lib/api/fs/debugfs.c
index a74fba6d7743..d2b18e887071 100644
--- a/tools/lib/api/fs/debugfs.c
+++ b/tools/lib/api/fs/debugfs.c
@@ -1,3 +1,4 @@
+#define _GNU_SOURCE
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -67,7 +68,7 @@ int debugfs_valid_mountpoint(const char *debugfs)
        if (statfs(debugfs, &st_fs) < 0)
                return -ENOENT;
-        else if (st_fs.f_type != (long) DEBUGFS_MAGIC)
+        else if ((long)st_fs.f_type != (long)DEBUGFS_MAGIC)
                return -ENOENT;
        return 0;
@@ -98,3 +99,45 @@ char *debugfs_mount(const char *mountpoint)
 out:
        return debugfs_mountpoint;
 }
+int debugfs__strerror_open(int err, char *buf, size_t size, const char *filename)
+{
+        char sbuf[128];
+        switch (err) {
+        case ENOENT:
+                if (debugfs_found) {
+                        snprintf(buf, size,
+                                 "Error:\tFile %s/%s not found.\n"
+                                 "Hint:\tPerhaps this kernel misses some CONFIG_ setting to enable this feature?.\n",
+                                 debugfs_mountpoint, filename);
+                        break;
+                }
+                snprintf(buf, size, "%s",
+                         "Error:\tUnable to find debugfs\n"
+                         "Hint:\tWas your kernel compiled with debugfs support?\n"
+                         "Hint:\tIs the debugfs filesystem mounted?\n"
+                         "Hint:\tTry 'sudo mount -t debugfs nodev /sys/kernel/debug'");
+                break;
+        case EACCES:
+                snprintf(buf, size,
+                         "Error:\tNo permissions to read %s/%s\n"
+                         "Hint:\tTry 'sudo mount -o remount,mode=755 %s'\n",
+                         debugfs_mountpoint, filename, debugfs_mountpoint);
+                break;
+        default:
+                snprintf(buf, size, "%s", strerror_r(err, sbuf, sizeof(sbuf)));
+                break;
+        }
+        return 0;
+}
+int debugfs__strerror_open_tp(int err, char *buf, size_t size, const char *sys, const char *name)
+{
+        char path[PATH_MAX];
+        snprintf(path, PATH_MAX, "tracing/events/%s/%s", sys, name ?: "*");
+        return debugfs__strerror_open(err, buf, size, path);
+}
diff --git a/tools/lib/api/fs/debugfs.h b/tools/lib/api/fs/debugfs.h
index f19d3df9609d..0739881a9897 100644
--- a/tools/lib/api/fs/debugfs.h
+++ b/tools/lib/api/fs/debugfs.h
@@ -26,4 +26,7 @@ char *debugfs_mount(const char *mountpoint);
 extern char debugfs_mountpoint[];
+int debugfs__strerror_open(int err, char *buf, size_t size, const char *filename);
+int debugfs__strerror_open_tp(int err, char *buf, size_t size, const char *sys, const char *name);
 #endif /* __API_DEBUGFS_H__ */
diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
index 65d9be3f9887..128ef6332a6b 100644
--- a/tools/lib/api/fs/fs.c
+++ b/tools/lib/api/fs/fs.c
@@ -79,7 +79,7 @@ static int fs__valid_mount(const char *fs, long magic)
        if (statfs(fs, &st_fs) < 0)
                return -ENOENT;
-        else if (st_fs.f_type != magic)
+        else if ((long)st_fs.f_type != magic)
                return -ENOENT;
        return 0;
diff --git a/tools/lib/lockdep/.gitignore b/tools/lib/lockdep/.gitignore
new file mode 100644
index 000000000000..cc0e7a9f99e3
--- /dev/null
+++ b/tools/lib/lockdep/.gitignore
@@ -0,0 +1 @@
+liblockdep.so.*
diff --git a/tools/lib/lockdep/Makefile b/tools/lib/lockdep/Makefile
index 52f9279c6c13..4b866c54f624 100644
--- a/tools/lib/lockdep/Makefile
+++ b/tools/lib/lockdep/Makefile
@@ -104,7 +104,7 @@ N		=
 export Q VERBOSE
-INCLUDES = -I. -I/usr/local/include -I./uinclude -I./include -I../../include $(CONFIG_INCLUDES)
+INCLUDES = -I. -I./uinclude -I./include -I../../include $(CONFIG_INCLUDES)
 # Set compile option CFLAGS if not set elsewhere
 CFLAGS ?= -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"$(LIBLOCKDEP_VERSION)"' -rdynamic -O0 -g
diff --git a/tools/lib/lockdep/preload.c b/tools/lib/lockdep/preload.c
index 6f803609e498..0b0112c80f22 100644
--- a/tools/lib/lockdep/preload.c
+++ b/tools/lib/lockdep/preload.c
@@ -317,7 +317,7 @@ int pthread_mutex_destroy(pthread_mutex_t *mutex)
         *
         * TODO: Hook into free() and add that check there as well.
         */
-        debug_check_no_locks_freed(mutex, mutex + sizeof(*mutex));
+        debug_check_no_locks_freed(mutex, sizeof(*mutex));
        __del_lock(__get_lock(mutex));
        return ll_pthread_mutex_destroy(mutex);
 }
@@ -341,7 +341,7 @@ int pthread_rwlock_destroy(pthread_rwlock_t *rwlock)
 {
        try_init_preload();
-        debug_check_no_locks_freed(rwlock, rwlock + sizeof(*rwlock));
+        debug_check_no_locks_freed(rwlock, sizeof(*rwlock));
        __del_lock(__get_lock(rwlock));
        return ll_pthread_rwlock_destroy(rwlock);
 }
diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
index cf3a44bf1ec3..afe20ed9fac8 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -32,6 +32,7 @@
 #include <stdint.h>
 #include <limits.h>
+#include <netinet/ip6.h>
 #include "event-parse.h"
 #include "event-utils.h"
@@ -4149,6 +4150,324 @@ static void print_mac_arg(struct trace_seq *s, int mac, void *data, int size,
        trace_seq_printf(s, fmt, buf[0], buf[1], buf[2], buf[3], buf[4], buf[5]);
 }
+static void print_ip4_addr(struct trace_seq *s, char i, unsigned char *buf)
+{
+        const char *fmt;
+        if (i == 'i')
+                fmt = "%03d.%03d.%03d.%03d";
+        else
+                fmt = "%d.%d.%d.%d";
+        trace_seq_printf(s, fmt, buf[0], buf[1], buf[2], buf[3]);
+}
+static inline bool ipv6_addr_v4mapped(const struct in6_addr *a)
+{
+        return ((unsigned long)(a->s6_addr32[0] | a->s6_addr32[1]) |
+                (unsigned long)(a->s6_addr32[2] ^ htonl(0x0000ffff))) == 0UL;
+}
+static inline bool ipv6_addr_is_isatap(const struct in6_addr *addr)
+{
+        return (addr->s6_addr32[2] | htonl(0x02000000)) == htonl(0x02005EFE);
+}
+static void print_ip6c_addr(struct trace_seq *s, unsigned char *addr)
+{
+        int i, j, range;
+        unsigned char zerolength[8];
+        int longest = 1;
+        int colonpos = -1;
+        uint16_t word;
+        uint8_t hi, lo;
+        bool needcolon = false;
+        bool useIPv4;
+        struct in6_addr in6;
+        memcpy(&in6, addr, sizeof(struct in6_addr));
+        useIPv4 = ipv6_addr_v4mapped(&in6) || ipv6_addr_is_isatap(&in6);
+        memset(zerolength, 0, sizeof(zerolength));
+        if (useIPv4)
+                range = 6;
+        else
+                range = 8;
+        /* find position of longest 0 run */
+        for (i = 0; i < range; i++) {
+                for (j = i; j < range; j++) {
+                        if (in6.s6_addr16[j] != 0)
+                                break;
+                        zerolength[i]++;
+                }
+        }
+        for (i = 0; i < range; i++) {
+                if (zerolength[i] > longest) {
+                        longest = zerolength[i];
+                        colonpos = i;
+                }
+        }
+        if (longest == 1)               /* don't compress a single 0 */
+                colonpos = -1;
+        /* emit address */
+        for (i = 0; i < range; i++) {
+                if (i == colonpos) {
+                        if (needcolon || i == 0)
+                                trace_seq_printf(s, ":");
+                        trace_seq_printf(s, ":");
+                        needcolon = false;
+                        i += longest - 1;
+                        continue;
+                }
+                if (needcolon) {
+                        trace_seq_printf(s, ":");
+                        needcolon = false;
+                }
+                /* hex u16 without leading 0s */
+                word = ntohs(in6.s6_addr16[i]);
+                hi = word >> 8;
+                lo = word & 0xff;
+                if (hi)
+                        trace_seq_printf(s, "%x%02x", hi, lo);
+                else
+                        trace_seq_printf(s, "%x", lo);
+                needcolon = true;
+        }
+        if (useIPv4) {
+                if (needcolon)
+                        trace_seq_printf(s, ":");
+                print_ip4_addr(s, 'I', &in6.s6_addr[12]);
+        }
+        return;
+}
+static void print_ip6_addr(struct trace_seq *s, char i, unsigned char *buf)
+{
+        int j;
+        for (j = 0; j < 16; j += 2) {
+                trace_seq_printf(s, "%02x%02x", buf[j], buf[j+1]);
+                if (i == 'I' && j < 14)
+                        trace_seq_printf(s, ":");
+        }
+}
+/*
+ * %pi4   print an IPv4 address with leading zeros
+ * %pI4   print an IPv4 address without leading zeros
+ * %pi6   print an IPv6 address without colons
+ * %pI6   print an IPv6 address with colons
+ * %pI6c  print an IPv6 address in compressed form with colons
+ * %pISpc print an IP address based on sockaddr; p adds port.
+ */
+static int print_ipv4_arg(struct trace_seq *s, const char *ptr, char i,
+                          void *data, int size, struct event_format *event,
+                          struct print_arg *arg)
+{
+        unsigned char *buf;
+        if (arg->type == PRINT_FUNC) {
+                process_defined_func(s, data, size, event, arg);
+                return 0;
+        }
+        if (arg->type != PRINT_FIELD) {
+                trace_seq_printf(s, "ARG TYPE NOT FIELD BUT %d", arg->type);
+                return 0;
+        }
+        if (!arg->field.field) {
+                arg->field.field =
+                        pevent_find_any_field(event, arg->field.name);
+                if (!arg->field.field) {
+                        do_warning("%s: field %s not found",
+                                   __func__, arg->field.name);
+                        return 0;
+                }
+        }
+        buf = data + arg->field.field->offset;
+        if (arg->field.field->size != 4) {
+                trace_seq_printf(s, "INVALIDIPv4");
+                return 0;
+        }
+        print_ip4_addr(s, i, buf);
+        return 0;
+}
+static int print_ipv6_arg(struct trace_seq *s, const char *ptr, char i,
+                          void *data, int size, struct event_format *event,
+                          struct print_arg *arg)
+{
+        char have_c = 0;
+        unsigned char *buf;
+        int rc = 0;
+        /* pI6c */
+        if (i == 'I' && *ptr == 'c') {
+                have_c = 1;
+                ptr++;
+                rc++;
+        }
+        if (arg->type == PRINT_FUNC) {
+                process_defined_func(s, data, size, event, arg);
+                return rc;
+        }
+        if (arg->type != PRINT_FIELD) {
+                trace_seq_printf(s, "ARG TYPE NOT FIELD BUT %d", arg->type);
+                return rc;
+        }
+        if (!arg->field.field) {
+                arg->field.field =
+                        pevent_find_any_field(event, arg->field.name);
+                if (!arg->field.field) {
+                        do_warning("%s: field %s not found",
+                                   __func__, arg->field.name);
+                        return rc;
+                }
+        }
+        buf = data + arg->field.field->offset;
+        if (arg->field.field->size != 16) {
+                trace_seq_printf(s, "INVALIDIPv6");
+                return rc;
+        }
+        if (have_c)
+                print_ip6c_addr(s, buf);
+        else
+                print_ip6_addr(s, i, buf);
+        return rc;
+}
+static int print_ipsa_arg(struct trace_seq *s, const char *ptr, char i,
+                          void *data, int size, struct event_format *event,
+                          struct print_arg *arg)
+{
+        char have_c = 0, have_p = 0;
+        unsigned char *buf;
+        struct sockaddr_storage *sa;
+        int rc = 0;
+        /* pISpc */
+        if (i == 'I') {
+                if (*ptr == 'p') {
+                        have_p = 1;
+                        ptr++;
+                        rc++;
+                }
+                if (*ptr == 'c') {
+                        have_c = 1;
+                        ptr++;
+                        rc++;
+                }
+        }
+        if (arg->type == PRINT_FUNC) {
+                process_defined_func(s, data, size, event, arg);
+                return rc;
+        }
+        if (arg->type != PRINT_FIELD) {
+                trace_seq_printf(s, "ARG TYPE NOT FIELD BUT %d", arg->type);
+                return rc;
+        }
+        if (!arg->field.field) {
+                arg->field.field =
+                        pevent_find_any_field(event, arg->field.name);
+                if (!arg->field.field) {
+                        do_warning("%s: field %s not found",
+                                   __func__, arg->field.name);
+                        return rc;
+                }
+        }
+        sa = (struct sockaddr_storage *) (data + arg->field.field->offset);
+        if (sa->ss_family == AF_INET) {
+                struct sockaddr_in *sa4 = (struct sockaddr_in *) sa;
+                if (arg->field.field->size < sizeof(struct sockaddr_in)) {
+                        trace_seq_printf(s, "INVALIDIPv4");
+                        return rc;
+                }
+                print_ip4_addr(s, i, (unsigned char *) &sa4->sin_addr);
+                if (have_p)
+                        trace_seq_printf(s, ":%d", ntohs(sa4->sin_port));
+        } else if (sa->ss_family == AF_INET6) {
+                struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *) sa;
+                if (arg->field.field->size < sizeof(struct sockaddr_in6)) {
+                        trace_seq_printf(s, "INVALIDIPv6");
+                        return rc;
+                }
+                if (have_p)
+                        trace_seq_printf(s, "[");
+                buf = (unsigned char *) &sa6->sin6_addr;
+                if (have_c)
+                        print_ip6c_addr(s, buf);
+                else
+                        print_ip6_addr(s, i, buf);
+                if (have_p)
+                        trace_seq_printf(s, "]:%d", ntohs(sa6->sin6_port));
+        }
+        return rc;
+}
+static int print_ip_arg(struct trace_seq *s, const char *ptr,
+                        void *data, int size, struct event_format *event,
+                        struct print_arg *arg)
+{
+        char i = *ptr;  /* 'i' or 'I' */
+        char ver;
+        int rc = 0;
+        ptr++;
+        rc++;
+        ver = *ptr;
+        ptr++;
+        rc++;
+        switch (ver) {
+        case '4':
+                rc += print_ipv4_arg(s, ptr, i, data, size, event, arg);
+                break;
+        case '6':
+                rc += print_ipv6_arg(s, ptr, i, data, size, event, arg);
+                break;
+        case 'S':
+                rc += print_ipsa_arg(s, ptr, i, data, size, event, arg);
+                break;
+        default:
+                return 0;
+        }
+        return rc;
+}
 static int is_printable_array(char *p, unsigned int len)
 {
        unsigned int i;
@@ -4337,6 +4656,15 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event
                                        ptr++;
                                        arg = arg->next;
                                        break;
+                                } else if (*(ptr+1) == 'I' || *(ptr+1) == 'i') {
+                                        int n;
+                                        n = print_ip_arg(s, ptr+1, data, size, event, arg);
+                                        if (n > 0) {
+                                                ptr += n;
+                                                arg = arg->next;
+                                                break;
+                                        }
                                }
                                /* fall through */
diff --git a/tools/perf/Documentation/perf-buildid-cache.txt b/tools/perf/Documentation/perf-buildid-cache.txt
index fd77d81ea748..0294c57b1f5e 100644
--- a/tools/perf/Documentation/perf-buildid-cache.txt
+++ b/tools/perf/Documentation/perf-buildid-cache.txt
@@ -38,7 +38,7 @@ OPTIONS
 --remove=::
        Remove specified file from the cache.
 -M::
--missing=:: 
+--missing=::
        List missing build ids in the cache for the specified file.
 -u::
 --update::
diff --git a/tools/perf/Documentation/perf-list.txt b/tools/perf/Documentation/perf-list.txt
index cbb4f743d921..3e2aec94f806 100644
--- a/tools/perf/Documentation/perf-list.txt
+++ b/tools/perf/Documentation/perf-list.txt
@@ -89,6 +89,19 @@ raw encoding of 0x1A8 can be used:
 You should refer to the processor specific documentation for getting these
 details. Some of them are referenced in the SEE ALSO section below.
+PARAMETERIZED EVENTS
+--------------------
+Some pmu events listed by 'perf-list' will be displayed with '?' in them. For
+example:
+  hv_gpci/dtbp_ptitc,phys_processor_idx=?/
+This means that when provided as an event, a value for '?' must
+also be supplied. For example:
+  perf stat -C 0 -e 'hv_gpci/dtbp_ptitc,phys_processor_idx=0x2/' ...
 OPTIONS
 -------
diff --git a/tools/perf/Documentation/perf-mem.txt b/tools/perf/Documentation/perf-mem.txt
index 1d78a4064da4..43310d8661fe 100644
--- a/tools/perf/Documentation/perf-mem.txt
+++ b/tools/perf/Documentation/perf-mem.txt
@@ -12,11 +12,12 @@ SYNOPSIS
 DESCRIPTION
 -----------
-"perf mem -t <TYPE> record" runs a command and gathers memory operation data
+"perf mem record" runs a command and gathers memory operation data
 from it, into perf.data. Perf record options are accepted and are passed through.
-"perf mem -t <TYPE> report" displays the result. It invokes perf report with the
+"perf mem report" displays the result. It invokes perf report with the
-right set of options to display a memory access profile.
+right set of options to display a memory access profile. By default, loads
+and stores are sampled. Use the -t option to limit to loads or stores.
 Note that on Intel systems the memory latency reported is the use-latency,
 not the pure load (or store latency). Use latency includes any pipeline
@@ -29,7 +30,7 @@ OPTIONS
 -t::
 --type=::
-        Select the memory operation type: load or store (default: load)
+        Select the memory operation type: load or store (default: load,store)
 -D::
 --dump-raw-samples=::
diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index af9a54ece024..31e977459c51 100644
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -33,12 +33,27 @@ OPTIONS
        - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a
          hexadecimal event descriptor.
-        - a hardware breakpoint event in the form of '\mem:addr[:access]'
+        - a symbolically formed PMU event like 'pmu/param1=0x3,param2/' where
+          'param1', 'param2', etc are defined as formats for the PMU in
+          /sys/bus/event_sources/devices/<pmu>/format/*.
+        - a symbolically formed event like 'pmu/config=M,config1=N,config3=K/'
+          where M, N, K are numbers (in decimal, hex, octal format). Acceptable
+          values for each of 'config', 'config1' and 'config2' are defined by
+          corresponding entries in /sys/bus/event_sources/devices/<pmu>/format/*
+          param1 and param2 are defined as formats for the PMU in:
+          /sys/bus/event_sources/devices/<pmu>/format/*
+        - a hardware breakpoint event in the form of '\mem:addr[/len][:access]'
          where addr is the address in memory you want to break in.
          Access is the memory access type (read, write, execute) it can
-          be passed as follows: '\mem:addr[:[r][w][x]]'.
+          be passed as follows: '\mem:addr[:[r][w][x]]'. len is the range,
+          number of bytes from specified addr, which the breakpoint will cover.
          If you want to profile read-write accesses in 0x1000, just set
          'mem:0x1000:rw'.
+          If you want to profile write accesses in [0x1000~1008), just set
+          'mem:0x1000/8:w'.
 --filter=<filter>::
        Event filter.
diff --git a/tools/perf/Documentation/perf-script.txt b/tools/perf/Documentation/perf-script.txt
index 21494806c0ab..a21eec05bc42 100644
--- a/tools/perf/Documentation/perf-script.txt
+++ b/tools/perf/Documentation/perf-script.txt
@@ -125,46 +125,46 @@ OPTIONS
        is equivalent to:
                perf script -f trace:<fields> -f sw:<fields> -f hw:<fields>
-    
        i.e., the specified fields apply to all event types if the type string
        is not given.
-    
        The arguments are processed in the order received. A later usage can
        reset a prior request. e.g.:
-    
                -f trace: -f comm,tid,time,ip,sym
-    
        The first -f suppresses trace events (field list is ""), but then the
        second invocation sets the fields to comm,tid,time,ip,sym. In this case a
        warning is given to the user:
-    
                "Overriding previous field request for all events."
-    
        Alternatively, consider the order:
-    
                -f comm,tid,time,ip,sym -f trace:
-    
        The first -f sets the fields for all events and the second -f
        suppresses trace events. The user is given a warning message about
        the override, and the result of the above is that only S/W and H/W
        events are displayed with the given fields.
-    
        For the 'wildcard' option if a user selected field is invalid for an
        event type, a message is displayed to the user that the option is
        ignored for that type. For example:
-    
                $ perf script -f comm,tid,trace
                'trace' not valid for hardware events. Ignoring.
                'trace' not valid for software events. Ignoring.
-    
        Alternatively, if the type is given an invalid field is specified it
        is an error. For example:
-    
        perf script -v -f sw:comm,tid,trace
        'trace' not valid for software events.
-    
        At this point usage is displayed, and perf-script exits.
-    
        Finally, a user may not set fields to none for all event types.
        i.e., -f "" is not allowed.
diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
index 29ee857c09c6..04e150d83e7d 100644
--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -25,10 +25,22 @@ OPTIONS
 -e::
 --event=::
-        Select the PMU event. Selection can be a symbolic event name
+        Select the PMU event. Selection can be:
-        (use 'perf list' to list all events) or a raw PMU
-        event (eventsel+umask) in the form of rNNN where NNN is a
+        - a symbolic event name (use 'perf list' to list all events)
-         hexadecimal event descriptor.
+        - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a
+          hexadecimal event descriptor.
+        - a symbolically formed event like 'pmu/param1=0x3,param2/' where
+          param1 and param2 are defined as formats for the PMU in
+          /sys/bus/event_sources/devices/<pmu>/format/*
+        - a symbolically formed event like 'pmu/config=M,config1=N,config2=K/'
+          where M, N, K are numbers (in decimal, hex, octal format).
+          Acceptable values for each of 'config', 'config1' and 'config2'
+          parameters are defined by corresponding entries in
+          /sys/bus/event_sources/devices/<pmu>/format/*
 -i::
 --no-inherit::
diff --git a/tools/perf/MANIFEST b/tools/perf/MANIFEST
index 83e2887f91a3..fbbfdc39271d 100644
--- a/tools/perf/MANIFEST
+++ b/tools/perf/MANIFEST
@@ -6,12 +6,15 @@ tools/lib/symbol/kallsyms.c
 tools/lib/symbol/kallsyms.h
 tools/lib/util/find_next_bit.c
 tools/include/asm/bug.h
+tools/include/asm-generic/bitops/arch_hweight.h
 tools/include/asm-generic/bitops/atomic.h
+tools/include/asm-generic/bitops/const_hweight.h
 tools/include/asm-generic/bitops/__ffs.h
 tools/include/asm-generic/bitops/__fls.h
 tools/include/asm-generic/bitops/find.h
 tools/include/asm-generic/bitops/fls64.h
 tools/include/asm-generic/bitops/fls.h
+tools/include/asm-generic/bitops/hweight.h
 tools/include/asm-generic/bitops.h
 tools/include/linux/bitops.h
 tools/include/linux/compiler.h
@@ -19,6 +22,8 @@ tools/include/linux/export.h
 tools/include/linux/hash.h
 tools/include/linux/log2.h
 tools/include/linux/types.h
+include/asm-generic/bitops/arch_hweight.h
+include/asm-generic/bitops/const_hweight.h
 include/asm-generic/bitops/fls64.h
 include/asm-generic/bitops/__fls.h
 include/asm-generic/bitops/fls.h
@@ -29,6 +34,7 @@ include/linux/list.h
 include/linux/hash.h
 include/linux/stringify.h
 lib/find_next_bit.c
+lib/hweight.c
 lib/rbtree.c
 include/linux/swab.h
 arch/*/include/asm/unistd*.h
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 67a03a825b3c..aa6a50447c32 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -232,12 +232,15 @@ LIB_H += ../include/linux/hash.h
 LIB_H += ../../include/linux/stringify.h
 LIB_H += util/include/linux/bitmap.h
 LIB_H += ../include/linux/bitops.h
+LIB_H += ../include/asm-generic/bitops/arch_hweight.h
 LIB_H += ../include/asm-generic/bitops/atomic.h
+LIB_H += ../include/asm-generic/bitops/const_hweight.h
 LIB_H += ../include/asm-generic/bitops/find.h
 LIB_H += ../include/asm-generic/bitops/fls64.h
 LIB_H += ../include/asm-generic/bitops/fls.h
 LIB_H += ../include/asm-generic/bitops/__ffs.h
 LIB_H += ../include/asm-generic/bitops/__fls.h
+LIB_H += ../include/asm-generic/bitops/hweight.h
 LIB_H += ../include/asm-generic/bitops.h
 LIB_H += ../include/linux/compiler.h
 LIB_H += ../include/linux/log2.h
@@ -255,7 +258,6 @@ LIB_H += util/include/linux/linkage.h
 LIB_H += util/include/asm/asm-offsets.h
 LIB_H += ../include/asm/bug.h
 LIB_H += util/include/asm/byteorder.h
-LIB_H += util/include/asm/hweight.h
 LIB_H += util/include/asm/swab.h
 LIB_H += util/include/asm/system.h
 LIB_H += util/include/asm/uaccess.h
@@ -462,10 +464,12 @@ BUILTIN_OBJS += $(OUTPUT)builtin-bench.o
 # Benchmark modules
 BUILTIN_OBJS += $(OUTPUT)bench/sched-messaging.o
 BUILTIN_OBJS += $(OUTPUT)bench/sched-pipe.o
-ifeq ($(RAW_ARCH),x86_64)
+ifeq ($(ARCH), x86)
+ifeq ($(IS_64_BIT), 1)
 BUILTIN_OBJS += $(OUTPUT)bench/mem-memcpy-x86-64-asm.o
 BUILTIN_OBJS += $(OUTPUT)bench/mem-memset-x86-64-asm.o
 endif
+endif
 BUILTIN_OBJS += $(OUTPUT)bench/mem-memcpy.o
 BUILTIN_OBJS += $(OUTPUT)bench/futex-hash.o
 BUILTIN_OBJS += $(OUTPUT)bench/futex-wake.o
@@ -743,6 +747,9 @@ $(OUTPUT)util/kallsyms.o: ../lib/symbol/kallsyms.c $(OUTPUT)PERF-CFLAGS
 $(OUTPUT)util/rbtree.o: ../../lib/rbtree.c $(OUTPUT)PERF-CFLAGS
        $(QUIET_CC)$(CC) -o $@ -c $(CFLAGS) -Wno-unused-parameter -DETC_PERFCONFIG='"$(ETC_PERFCONFIG_SQ)"' $<
+$(OUTPUT)util/hweight.o: ../../lib/hweight.c $(OUTPUT)PERF-CFLAGS
+        $(QUIET_CC)$(CC) -o $@ -c $(CFLAGS) -Wno-unused-parameter -DETC_PERFCONFIG='"$(ETC_PERFCONFIG_SQ)"' $<
 $(OUTPUT)util/find_next_bit.o: ../lib/util/find_next_bit.c $(OUTPUT)PERF-CFLAGS
        $(QUIET_CC)$(CC) -o $@ -c $(CFLAGS) -Wno-unused-parameter -DETC_PERFCONFIG='"$(ETC_PERFCONFIG_SQ)"' $<
diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
index 3bb50eac5542..0c370f81e002 100644
--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
@@ -103,7 +103,7 @@ static Dwarf_Frame *get_eh_frame(Dwfl_Module *mod, Dwarf_Addr pc)
                return NULL;
        }
-        result = dwarf_cfi_addrframe(cfi, pc, &frame);
+        result = dwarf_cfi_addrframe(cfi, pc-bias, &frame);
        if (result) {
                pr_debug("%s(): %s\n", __func__, dwfl_errmsg(-1));
                return NULL;
@@ -128,7 +128,7 @@ static Dwarf_Frame *get_dwarf_frame(Dwfl_Module *mod, Dwarf_Addr pc)
                return NULL;
        }
-        result = dwarf_cfi_addrframe(cfi, pc, &frame);
+        result = dwarf_cfi_addrframe(cfi, pc-bias, &frame);
        if (result) {
                pr_debug("%s(): %s\n", __func__, dwfl_errmsg(-1));
                return NULL;
@@ -145,7 +145,7 @@ static Dwarf_Frame *get_dwarf_frame(Dwfl_Module *mod, Dwarf_Addr pc)
 *              yet used)
 *      -1 in case of errors
 */
-static int check_return_addr(struct dso *dso, Dwarf_Addr pc)
+static int check_return_addr(struct dso *dso, u64 map_start, Dwarf_Addr pc)
 {
        int             rc = -1;
        Dwfl            *dwfl;
@@ -155,6 +155,7 @@ static int check_return_addr(struct dso *dso, Dwarf_Addr pc)
        Dwarf_Addr      start = pc;
        Dwarf_Addr      end = pc;
        bool            signalp;
+        const char      *exec_file = dso->long_name;
        dwfl = dso->dwfl;
@@ -165,8 +166,10 @@ static int check_return_addr(struct dso *dso, Dwarf_Addr pc)
                        return -1;
                }
-                if (dwfl_report_offline(dwfl, "", dso->long_name, -1) == NULL) {
+                mod = dwfl_report_elf(dwfl, exec_file, exec_file, -1,
-                        pr_debug("dwfl_report_offline() failed %s\n",
+                                                map_start, false);
+                if (!mod) {
+                        pr_debug("dwfl_report_elf() failed %s\n",
                                                dwarf_errmsg(-1));
                        /*
                         * We normally cache the DWARF debug info and never
@@ -256,10 +259,10 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain)
                return skip_slot;
        }
-        rc = check_return_addr(dso, ip);
+        rc = check_return_addr(dso, al.map->start, ip);
-        pr_debug("DSO %s, nr %" PRIx64 ", ip 0x%" PRIx64 "rc %d\n",
+        pr_debug("[DSO %s, sym %s, ip 0x%" PRIx64 "] rc %d\n",
-                                dso->long_name, chain->nr, ip, rc);
+                                dso->long_name, al.sym->name, ip, rc);
        if (rc == 0) {
                /*
diff --git a/tools/perf/bench/futex.h b/tools/perf/bench/futex.h
index 71f2844cf97f..7ed22ff1e1ac 100644
--- a/tools/perf/bench/futex.h
+++ b/tools/perf/bench/futex.h
@@ -68,4 +68,17 @@ futex_cmp_requeue(u_int32_t *uaddr, u_int32_t val, u_int32_t *uaddr2, int nr_wak
                 val, opflags);
 }
+#ifndef HAVE_PTHREAD_ATTR_SETAFFINITY_NP
+#include <pthread.h>
+static inline int pthread_attr_setaffinity_np(pthread_attr_t *attr,
+                                              size_t cpusetsize,
+                                              cpu_set_t *cpuset)
+{
+        attr = attr;
+        cpusetsize = cpusetsize;
+        cpuset = cpuset;
+        return 0;
+}
+#endif
 #endif /* _FUTEX_H */
diff --git a/tools/perf/bench/sched-pipe.c b/tools/perf/bench/sched-pipe.c
index 07a8d7646a15..005cc283790c 100644
--- a/tools/perf/bench/sched-pipe.c
+++ b/tools/perf/bench/sched-pipe.c
@@ -19,12 +19,12 @@
 #include <stdlib.h>
 #include <signal.h>
 #include <sys/wait.h>
-#include <linux/unistd.h>
 #include <string.h>
 #include <errno.h>
 #include <assert.h>
 #include <sys/time.h>
 #include <sys/types.h>
+#include <sys/syscall.h>
 #include <pthread.h>
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index e7417fe97a97..747f86103599 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -232,7 +232,7 @@ static int __cmd_annotate(struct perf_annotate *ann)
                if (nr_samples > 0) {
                        total_nr_samples += nr_samples;
                        hists__collapse_resort(hists, NULL);
-                        hists__output_resort(hists);
+                        hists__output_resort(hists, NULL);
                        if (symbol_conf.event_group &&
                            !perf_evsel__is_group_leader(pos))
diff --git a/tools/perf/builtin-buildid-cache.c b/tools/perf/builtin-buildid-cache.c
index 77d5cae54c6a..50e6b66aea1f 100644
--- a/tools/perf/builtin-buildid-cache.c
+++ b/tools/perf/builtin-buildid-cache.c
@@ -236,10 +236,10 @@ static bool dso__missing_buildid_cache(struct dso *dso, int parm __maybe_unused)
                if (errno == ENOENT)
                        return false;
-                pr_warning("Problems with %s file, consider removing it from the cache\n", 
+                pr_warning("Problems with %s file, consider removing it from the cache\n",
                           filename);
        } else if (memcmp(dso->build_id, build_id, sizeof(dso->build_id))) {
-                pr_warning("Problems with %s file, consider removing it from the cache\n", 
+                pr_warning("Problems with %s file, consider removing it from the cache\n",
                           filename);
        }
diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c
index 1ce425d101a9..74aada554b12 100644
--- a/tools/perf/builtin-diff.c
+++ b/tools/perf/builtin-diff.c
@@ -390,6 +390,15 @@ static void perf_evlist__collapse_resort(struct perf_evlist *evlist)
        }
 }
+static struct data__file *fmt_to_data_file(struct perf_hpp_fmt *fmt)
+{
+        struct diff_hpp_fmt *dfmt = container_of(fmt, struct diff_hpp_fmt, fmt);
+        void *ptr = dfmt - dfmt->idx;
+        struct data__file *d = container_of(ptr, struct data__file, fmt);
+        return d;
+}
 static struct hist_entry*
 get_pair_data(struct hist_entry *he, struct data__file *d)
 {
@@ -407,8 +416,7 @@ get_pair_data(struct hist_entry *he, struct data__file *d)
 static struct hist_entry*
 get_pair_fmt(struct hist_entry *he, struct diff_hpp_fmt *dfmt)
 {
-        void *ptr = dfmt - dfmt->idx;
+        struct data__file *d = fmt_to_data_file(&dfmt->fmt);
-        struct data__file *d = container_of(ptr, struct data__file, fmt);
        return get_pair_data(he, d);
 }
@@ -430,7 +438,7 @@ static void hists__baseline_only(struct hists *hists)
                next = rb_next(&he->rb_node_in);
                if (!hist_entry__next_pair(he)) {
                        rb_erase(&he->rb_node_in, root);
-                        hist_entry__free(he);
+                        hist_entry__delete(he);
                }
        }
 }
@@ -448,26 +456,30 @@ static void hists__precompute(struct hists *hists)
        next = rb_first(root);
        while (next != NULL) {
                struct hist_entry *he, *pair;
+                struct data__file *d;
+                int i;
                he   = rb_entry(next, struct hist_entry, rb_node_in);
                next = rb_next(&he->rb_node_in);
-                pair = get_pair_data(he, &data__files[sort_compute]);
+                data__for_each_file_new(i, d) {
-                if (!pair)
+                        pair = get_pair_data(he, d);
-                        continue;
+                        if (!pair)
+                                continue;
-                switch (compute) {
+                        switch (compute) {
-                case COMPUTE_DELTA:
+                        case COMPUTE_DELTA:
-                        compute_delta(he, pair);
+                                compute_delta(he, pair);
-                        break;
+                                break;
-                case COMPUTE_RATIO:
+                        case COMPUTE_RATIO:
-                        compute_ratio(he, pair);
+                                compute_ratio(he, pair);
-                        break;
+                                break;
-                case COMPUTE_WEIGHTED_DIFF:
+                        case COMPUTE_WEIGHTED_DIFF:
-                        compute_wdiff(he, pair);
+                                compute_wdiff(he, pair);
-                        break;
+                                break;
-                default:
+                        default:
-                        BUG_ON(1);
+                                BUG_ON(1);
+                        }
                }
        }
 }
@@ -517,7 +529,7 @@ __hist_entry__cmp_compute(struct hist_entry *left, struct hist_entry *right,
 static int64_t
 hist_entry__cmp_compute(struct hist_entry *left, struct hist_entry *right,
-                        int c)
+                        int c, int sort_idx)
 {
        bool pairs_left  = hist_entry__has_pairs(left);
        bool pairs_right = hist_entry__has_pairs(right);
@@ -529,8 +541,8 @@ hist_entry__cmp_compute(struct hist_entry *left, struct hist_entry *right,
        if (!pairs_left || !pairs_right)
                return pairs_left ? -1 : 1;
-        p_left  = get_pair_data(left,  &data__files[sort_compute]);
+        p_left  = get_pair_data(left,  &data__files[sort_idx]);
-        p_right = get_pair_data(right, &data__files[sort_compute]);
+        p_right = get_pair_data(right, &data__files[sort_idx]);
        if (!p_left && !p_right)
                return 0;
@@ -545,55 +557,103 @@ hist_entry__cmp_compute(struct hist_entry *left, struct hist_entry *right,
        return __hist_entry__cmp_compute(p_left, p_right, c);
 }
-static void insert_hist_entry_by_compute(struct rb_root *root,
+static int64_t
-                                         struct hist_entry *he,
+hist_entry__cmp_compute_idx(struct hist_entry *left, struct hist_entry *right,
-                                         int c)
+                            int c, int sort_idx)
 {
-        struct rb_node **p = &root->rb_node;
+        struct hist_entry *p_right, *p_left;
-        struct rb_node *parent = NULL;
-        struct hist_entry *iter;
+        p_left  = get_pair_data(left,  &data__files[sort_idx]);
+        p_right = get_pair_data(right, &data__files[sort_idx]);
-        while (*p != NULL) {
-                parent = *p;
+        if (!p_left && !p_right)
-                iter = rb_entry(parent, struct hist_entry, rb_node);
+                return 0;
-                if (hist_entry__cmp_compute(he, iter, c) < 0)
-                        p = &(*p)->rb_left;
+        if (!p_left || !p_right)
-                else
+                return p_left ? -1 : 1;
-                        p = &(*p)->rb_right;
+        if (c != COMPUTE_DELTA) {
+                /*
+                 * The delta can be computed without the baseline, but
+                 * others are not.  Put those entries which have no
+                 * values below.
+                 */
+                if (left->dummy && right->dummy)
+                        return 0;
+                if (left->dummy || right->dummy)
+                        return left->dummy ? 1 : -1;
        }
-        rb_link_node(&he->rb_node, parent, p);
+        return __hist_entry__cmp_compute(p_left, p_right, c);
-        rb_insert_color(&he->rb_node, root);
 }
-static void hists__compute_resort(struct hists *hists)
+static int64_t
+hist_entry__cmp_nop(struct perf_hpp_fmt *fmt __maybe_unused,
+                    struct hist_entry *left __maybe_unused,
+                    struct hist_entry *right __maybe_unused)
 {
-        struct rb_root *root;
+        return 0;
-        struct rb_node *next;
+}
-        if (sort__need_collapse)
+static int64_t
-                root = &hists->entries_collapsed;
+hist_entry__cmp_baseline(struct perf_hpp_fmt *fmt __maybe_unused,
-        else
+                         struct hist_entry *left, struct hist_entry *right)
-                root = hists->entries_in;
+{
+        if (left->stat.period == right->stat.period)
+                return 0;
+        return left->stat.period > right->stat.period ? 1 : -1;
+}
-        hists->entries = RB_ROOT;
+static int64_t
-        next = rb_first(root);
+hist_entry__cmp_delta(struct perf_hpp_fmt *fmt,
+                      struct hist_entry *left, struct hist_entry *right)
+{
+        struct data__file *d = fmt_to_data_file(fmt);
-        hists__reset_stats(hists);
+        return hist_entry__cmp_compute(right, left, COMPUTE_DELTA, d->idx);
-        hists__reset_col_len(hists);
+}
-        while (next != NULL) {
+static int64_t
-                struct hist_entry *he;
+hist_entry__cmp_ratio(struct perf_hpp_fmt *fmt,
+                      struct hist_entry *left, struct hist_entry *right)
+{
+        struct data__file *d = fmt_to_data_file(fmt);
-                he = rb_entry(next, struct hist_entry, rb_node_in);
+        return hist_entry__cmp_compute(right, left, COMPUTE_RATIO, d->idx);
-                next = rb_next(&he->rb_node_in);
+}
+static int64_t
+hist_entry__cmp_wdiff(struct perf_hpp_fmt *fmt,
+                      struct hist_entry *left, struct hist_entry *right)
+{
+        struct data__file *d = fmt_to_data_file(fmt);
-                insert_hist_entry_by_compute(&hists->entries, he, compute);
+        return hist_entry__cmp_compute(right, left, COMPUTE_WEIGHTED_DIFF, d->idx);
-                hists__inc_stats(hists, he);
+}
-                if (!he->filtered)
+static int64_t
-                        hists__calc_col_len(hists, he);
+hist_entry__cmp_delta_idx(struct perf_hpp_fmt *fmt __maybe_unused,
-        }
+                          struct hist_entry *left, struct hist_entry *right)
+{
+        return hist_entry__cmp_compute_idx(right, left, COMPUTE_DELTA,
+                                           sort_compute);
+}
+static int64_t
+hist_entry__cmp_ratio_idx(struct perf_hpp_fmt *fmt __maybe_unused,
+                          struct hist_entry *left, struct hist_entry *right)
+{
+        return hist_entry__cmp_compute_idx(right, left, COMPUTE_RATIO,
+                                           sort_compute);
+}
+static int64_t
+hist_entry__cmp_wdiff_idx(struct perf_hpp_fmt *fmt __maybe_unused,
+                          struct hist_entry *left, struct hist_entry *right)
+{
+        return hist_entry__cmp_compute_idx(right, left, COMPUTE_WEIGHTED_DIFF,
+                                           sort_compute);
 }
 static void hists__process(struct hists *hists)
@@ -601,12 +661,8 @@ static void hists__process(struct hists *hists)
        if (show_baseline_only)
                hists__baseline_only(hists);
-        if (sort_compute) {
+        hists__precompute(hists);
-                hists__precompute(hists);
+        hists__output_resort(hists, NULL);
-                hists__compute_resort(hists);
-        } else {
-                hists__output_resort(hists);
-        }
        hists__fprintf(hists, true, 0, 0, 0, stdout);
 }
@@ -805,7 +861,7 @@ static int __hpp__color_compare(struct perf_hpp_fmt *fmt,
        char pfmt[20] = " ";
        if (!pair)
-                goto dummy_print;
+                goto no_print;
        switch (comparison_method) {
        case COMPUTE_DELTA:
@@ -814,8 +870,6 @@ static int __hpp__color_compare(struct perf_hpp_fmt *fmt,
                else
                        diff = compute_delta(he, pair);
-                if (fabs(diff) < 0.01)
-                        goto dummy_print;
                scnprintf(pfmt, 20, "%%%+d.2f%%%%", dfmt->header_width - 1);
                return percent_color_snprintf(hpp->buf, hpp->size,
                                        pfmt, diff);
@@ -847,6 +901,9 @@ static int __hpp__color_compare(struct perf_hpp_fmt *fmt,
        }
 dummy_print:
        return scnprintf(hpp->buf, hpp->size, "%*s",
+                        dfmt->header_width, "N/A");
+no_print:
+        return scnprintf(hpp->buf, hpp->size, "%*s",
                        dfmt->header_width, pfmt);
 }
@@ -896,14 +953,15 @@ hpp__entry_pair(struct hist_entry *he, struct hist_entry *pair,
                else
                        diff = compute_delta(he, pair);
-                if (fabs(diff) >= 0.01)
+                scnprintf(buf, size, "%+4.2F%%", diff);
-                        scnprintf(buf, size, "%+4.2F%%", diff);
                break;
        case PERF_HPP_DIFF__RATIO:
                /* No point for ratio number if we are dummy.. */
-                if (he->dummy)
+                if (he->dummy) {
+                        scnprintf(buf, size, "N/A");
                        break;
+                }
                if (pair->diff.computed)
                        ratio = pair->diff.period_ratio;
@@ -916,8 +974,10 @@ hpp__entry_pair(struct hist_entry *he, struct hist_entry *pair,
        case PERF_HPP_DIFF__WEIGHTED_DIFF:
                /* No point for wdiff number if we are dummy.. */
-                if (he->dummy)
+                if (he->dummy) {
+                        scnprintf(buf, size, "N/A");
                        break;
+                }
                if (pair->diff.computed)
                        wdiff = pair->diff.wdiff;
@@ -1038,32 +1098,41 @@ static void data__hpp_register(struct data__file *d, int idx)
        fmt->header = hpp__header;
        fmt->width  = hpp__width;
        fmt->entry  = hpp__entry_global;
+        fmt->cmp    = hist_entry__cmp_nop;
+        fmt->collapse = hist_entry__cmp_nop;
        /* TODO more colors */
        switch (idx) {
        case PERF_HPP_DIFF__BASELINE:
                fmt->color = hpp__color_baseline;
+                fmt->sort  = hist_entry__cmp_baseline;
                break;
        case PERF_HPP_DIFF__DELTA:
                fmt->color = hpp__color_delta;
+                fmt->sort  = hist_entry__cmp_delta;
                break;
        case PERF_HPP_DIFF__RATIO:
                fmt->color = hpp__color_ratio;
+                fmt->sort  = hist_entry__cmp_ratio;
                break;
        case PERF_HPP_DIFF__WEIGHTED_DIFF:
                fmt->color = hpp__color_wdiff;
+                fmt->sort  = hist_entry__cmp_wdiff;
                break;
        default:
+                fmt->sort  = hist_entry__cmp_nop;
                break;
        }
        init_header(d, dfmt);
        perf_hpp__column_register(fmt);
+        perf_hpp__register_sort_field(fmt);
 }
-static void ui_init(void)
+static int ui_init(void)
 {
        struct data__file *d;
+        struct perf_hpp_fmt *fmt;
        int i;
        data__for_each_file(i, d) {
@@ -1093,6 +1162,46 @@ static void ui_init(void)
                        data__hpp_register(d, i ? PERF_HPP_DIFF__PERIOD :
                                                  PERF_HPP_DIFF__PERIOD_BASELINE);
        }
+        if (!sort_compute)
+                return 0;
+        /*
+         * Prepend an fmt to sort on columns at 'sort_compute' first.
+         * This fmt is added only to the sort list but not to the
+         * output fields list.
+         *
+         * Note that this column (data) can be compared twice - one
+         * for this 'sort_compute' fmt and another for the normal
+         * diff_hpp_fmt.  But it shouldn't a problem as most entries
+         * will be sorted out by first try or baseline and comparing
+         * is not a costly operation.
+         */
+        fmt = zalloc(sizeof(*fmt));
+        if (fmt == NULL) {
+                pr_err("Memory allocation failed\n");
+                return -1;
+        }
+        fmt->cmp      = hist_entry__cmp_nop;
+        fmt->collapse = hist_entry__cmp_nop;
+        switch (compute) {
+        case COMPUTE_DELTA:
+                fmt->sort = hist_entry__cmp_delta_idx;
+                break;
+        case COMPUTE_RATIO:
+                fmt->sort = hist_entry__cmp_ratio_idx;
+                break;
+        case COMPUTE_WEIGHTED_DIFF:
+                fmt->sort = hist_entry__cmp_wdiff_idx;
+                break;
+        default:
+                BUG_ON(1);
+        }
+        list_add(&fmt->sort_list, &perf_hpp__sort_list);
+        return 0;
 }
 static int data_init(int argc, const char **argv)
@@ -1158,7 +1267,8 @@ int cmd_diff(int argc, const char **argv, const char *prefix __maybe_unused)
        if (data_init(argc, argv) < 0)
                return -1;
-        ui_init();
+        if (ui_init() < 0)
+                return -1;
        sort__mode = SORT_MODE__DIFF;
diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
index 84df2deed988..a13641e066f5 100644
--- a/tools/perf/builtin-inject.c
+++ b/tools/perf/builtin-inject.c
@@ -343,6 +343,7 @@ static int __cmd_inject(struct perf_inject *inject)
        int ret = -EINVAL;
        struct perf_session *session = inject->session;
        struct perf_data_file *file_out = &inject->output;
+        int fd = perf_data_file__fd(file_out);
        signal(SIGINT, sig_handler);
@@ -376,7 +377,7 @@ static int __cmd_inject(struct perf_inject *inject)
        }
        if (!file_out->is_pipe)
-                lseek(file_out->fd, session->header.data_offset, SEEK_SET);
+                lseek(fd, session->header.data_offset, SEEK_SET);
        ret = perf_session__process_events(session, &inject->tool);
@@ -385,7 +386,7 @@ static int __cmd_inject(struct perf_inject *inject)
                        perf_header__set_feat(&session->header,
                                              HEADER_BUILD_ID);
                session->header.data_size = inject->bytes_written;
-                perf_session__write_header(session, session->evlist, file_out->fd, true);
+                perf_session__write_header(session, session->evlist, fd, true);
        }
        return ret;
diff --git a/tools/perf/builtin-list.c b/tools/perf/builtin-list.c
index 011195e38f21..198f3c3aff95 100644
--- a/tools/perf/builtin-list.c
+++ b/tools/perf/builtin-list.c
@@ -19,7 +19,9 @@
 int cmd_list(int argc, const char **argv, const char *prefix __maybe_unused)
 {
        int i;
-        const struct option list_options[] = {
+        bool raw_dump = false;
+        struct option list_options[] = {
+                OPT_BOOLEAN(0, "raw-dump", &raw_dump, "Dump raw events"),
                OPT_END()
        };
        const char * const list_usage[] = {
@@ -27,11 +29,18 @@ int cmd_list(int argc, const char **argv, const char *prefix __maybe_unused)
                NULL
        };
+        set_option_flag(list_options, 0, "raw-dump", PARSE_OPT_HIDDEN);
        argc = parse_options(argc, argv, list_options, list_usage,
                             PARSE_OPT_STOP_AT_NON_OPTION);
        setup_pager();
+        if (raw_dump) {
+                print_events(NULL, true);
+                return 0;
+        }
        if (argc == 0) {
                print_events(NULL, false);
                return 0;
@@ -53,8 +62,6 @@ int cmd_list(int argc, const char **argv, const char *prefix __maybe_unused)
                        print_hwcache_events(NULL, false);
                else if (strcmp(argv[i], "pmu") == 0)
                        print_pmu_events(NULL, false);
-                else if (strcmp(argv[i], "--raw-dump") == 0)
-                        print_events(NULL, true);
                else {
                        char *sep = strchr(argv[i], ':'), *s;
                        int sep_idx;
diff --git a/tools/perf/builtin-mem.c b/tools/perf/builtin-mem.c
index 24db6ffe2957..9b5663950a4d 100644
--- a/tools/perf/builtin-mem.c
+++ b/tools/perf/builtin-mem.c
@@ -7,44 +7,47 @@
 #include "util/session.h"
 #include "util/data.h"
-#define MEM_OPERATION_LOAD      "load"
+#define MEM_OPERATION_LOAD      0x1
-#define MEM_OPERATION_STORE     "store"
+#define MEM_OPERATION_STORE     0x2
-static const char       *mem_operation          = MEM_OPERATION_LOAD;
 struct perf_mem {
        struct perf_tool        tool;
        char const              *input_name;
        bool                    hide_unresolved;
        bool                    dump_raw;
+        int                     operation;
        const char              *cpu_list;
        DECLARE_BITMAP(cpu_bitmap, MAX_NR_CPUS);
 };
-static int __cmd_record(int argc, const char **argv)
+static int __cmd_record(int argc, const char **argv, struct perf_mem *mem)
 {
        int rec_argc, i = 0, j;
        const char **rec_argv;
-        char event[64];
        int ret;
-        rec_argc = argc + 4;
+        rec_argc = argc + 7; /* max number of arguments */
        rec_argv = calloc(rec_argc + 1, sizeof(char *));
        if (!rec_argv)
                return -1;
-        rec_argv[i++] = strdup("record");
+        rec_argv[i++] = "record";
-        if (!strcmp(mem_operation, MEM_OPERATION_LOAD))
-                rec_argv[i++] = strdup("-W");
-        rec_argv[i++] = strdup("-d");
-        rec_argv[i++] = strdup("-e");
-        if (strcmp(mem_operation, MEM_OPERATION_LOAD))
+        if (mem->operation & MEM_OPERATION_LOAD)
-                sprintf(event, "cpu/mem-stores/pp");
+                rec_argv[i++] = "-W";
-        else
-                sprintf(event, "cpu/mem-loads/pp");
+        rec_argv[i++] = "-d";
+        if (mem->operation & MEM_OPERATION_LOAD) {
+                rec_argv[i++] = "-e";
+                rec_argv[i++] = "cpu/mem-loads/pp";
+        }
+        if (mem->operation & MEM_OPERATION_STORE) {
+                rec_argv[i++] = "-e";
+                rec_argv[i++] = "cpu/mem-stores/pp";
+        }
-        rec_argv[i++] = strdup(event);
        for (j = 1; j < argc; j++, i++)
                rec_argv[i] = argv[j];
@@ -162,17 +165,17 @@ static int report_events(int argc, const char **argv, struct perf_mem *mem)
        if (!rep_argv)
                return -1;
-        rep_argv[i++] = strdup("report");
+        rep_argv[i++] = "report";
-        rep_argv[i++] = strdup("--mem-mode");
+        rep_argv[i++] = "--mem-mode";
-        rep_argv[i++] = strdup("-n"); /* display number of samples */
+        rep_argv[i++] = "-n"; /* display number of samples */
        /*
         * there is no weight (cost) associated with stores, so don't print
         * the column
         */
-        if (strcmp(mem_operation, MEM_OPERATION_LOAD))
+        if (!(mem->operation & MEM_OPERATION_LOAD))
-                rep_argv[i++] = strdup("--sort=mem,sym,dso,symbol_daddr,"
+                rep_argv[i++] = "--sort=mem,sym,dso,symbol_daddr,"
-                                       "dso_daddr,tlb,locked");
+                                "dso_daddr,tlb,locked";
        for (j = 1; j < argc; j++, i++)
                rep_argv[i] = argv[j];
@@ -182,6 +185,75 @@ static int report_events(int argc, const char **argv, struct perf_mem *mem)
        return ret;
 }
+struct mem_mode {
+        const char *name;
+        int mode;
+};
+#define MEM_OPT(n, m) \
+        { .name = n, .mode = (m) }
+#define MEM_END { .name = NULL }
+static const struct mem_mode mem_modes[]={
+        MEM_OPT("load", MEM_OPERATION_LOAD),
+        MEM_OPT("store", MEM_OPERATION_STORE),
+        MEM_END
+};
+static int
+parse_mem_ops(const struct option *opt, const char *str, int unset)
+{
+        int *mode = (int *)opt->value;
+        const struct mem_mode *m;
+        char *s, *os = NULL, *p;
+        int ret = -1;
+        if (unset)
+                return 0;
+        /* str may be NULL in case no arg is passed to -t */
+        if (str) {
+                /* because str is read-only */
+                s = os = strdup(str);
+                if (!s)
+                        return -1;
+                /* reset mode */
+                *mode = 0;
+                for (;;) {
+                        p = strchr(s, ',');
+                        if (p)
+                                *p = '\0';
+                        for (m = mem_modes; m->name; m++) {
+                                if (!strcasecmp(s, m->name))
+                                        break;
+                        }
+                        if (!m->name) {
+                                fprintf(stderr, "unknown sampling op %s,"
+                                            " check man page\n", s);
+                                goto error;
+                        }
+                        *mode |= m->mode;
+                        if (!p)
+                                break;
+                        s = p + 1;
+                }
+        }
+        ret = 0;
+        if (*mode == 0)
+                *mode = MEM_OPERATION_LOAD;
+error:
+        free(os);
+        return ret;
+}
 int cmd_mem(int argc, const char **argv, const char *prefix __maybe_unused)
 {
        struct stat st;
@@ -197,10 +269,15 @@ int cmd_mem(int argc, const char **argv, const char *prefix __maybe_unused)
                        .ordered_events = true,
                },
                .input_name              = "perf.data",
+                /*
+                 * default to both load an store sampling
+                 */
+                .operation               = MEM_OPERATION_LOAD | MEM_OPERATION_STORE,
        };
        const struct option mem_options[] = {
-        OPT_STRING('t', "type", &mem_operation,
+        OPT_CALLBACK('t', "type", &mem.operation,
-                   "type", "memory operations(load/store)"),
+                   "type", "memory operations(load,store) Default load,store",
+                    parse_mem_ops),
        OPT_BOOLEAN('D', "dump-raw-samples", &mem.dump_raw,
                    "dump raw samples in ASCII"),
        OPT_BOOLEAN('U', "hide-unresolved", &mem.hide_unresolved,
@@ -225,7 +302,7 @@ int cmd_mem(int argc, const char **argv, const char *prefix __maybe_unused)
        argc = parse_options_subcommand(argc, argv, mem_options, mem_subcommands,
                                        mem_usage, PARSE_OPT_STOP_AT_NON_OPTION);
-        if (!argc || !(strncmp(argv[0], "rec", 3) || mem_operation))
+        if (!argc || !(strncmp(argv[0], "rec", 3) || mem.operation))
                usage_with_options(mem_usage, mem_options);
        if (!mem.input_name || !strlen(mem.input_name)) {
@@ -236,7 +313,7 @@ int cmd_mem(int argc, const char **argv, const char *prefix __maybe_unused)
        }
        if (!strncmp(argv[0], "rec", 3))
-                return __cmd_record(argc, argv);
+                return __cmd_record(argc, argv, &mem);
        else if (!strncmp(argv[0], "rep", 3))
                return report_events(argc, argv, &mem);
        else
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 8648c6d3003d..404ab3434052 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -190,16 +190,30 @@ out:
        return rc;
 }
+static int process_sample_event(struct perf_tool *tool,
+                                union perf_event *event,
+                                struct perf_sample *sample,
+                                struct perf_evsel *evsel,
+                                struct machine *machine)
+{
+        struct record *rec = container_of(tool, struct record, tool);
+        rec->samples++;
+        return build_id__mark_dso_hit(tool, event, sample, evsel, machine);
+}
 static int process_buildids(struct record *rec)
 {
        struct perf_data_file *file  = &rec->file;
        struct perf_session *session = rec->session;
-        u64 start = session->header.data_offset;
-        u64 size = lseek(file->fd, 0, SEEK_CUR);
+        u64 size = lseek(perf_data_file__fd(file), 0, SEEK_CUR);
        if (size == 0)
                return 0;
+        file->size = size;
        /*
         * During this process, it'll load kernel map and replace the
         * dso->long_name to a real pathname it found.  In this case
@@ -211,9 +225,7 @@ static int process_buildids(struct record *rec)
         */
        symbol_conf.ignore_vmlinux_buildid = true;
-        return __perf_session__process_events(session, start,
+        return perf_session__process_events(session, &rec->tool);
-                                              size - start,
-                                              size, &build_id__mark_dso_hit_ops);
 }
 static void perf_event__synthesize_guest_os(struct machine *machine, void *data)
@@ -322,6 +334,7 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
        struct perf_data_file *file = &rec->file;
        struct perf_session *session;
        bool disabled = false, draining = false;
+        int fd;
        rec->progname = argv[0];
@@ -336,6 +349,7 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
                return -1;
        }
+        fd = perf_data_file__fd(file);
        rec->session = session;
        record__init_features(rec);
@@ -360,12 +374,11 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
                perf_header__clear_feat(&session->header, HEADER_GROUP_DESC);
        if (file->is_pipe) {
-                err = perf_header__write_pipe(file->fd);
+                err = perf_header__write_pipe(fd);
                if (err < 0)
                        goto out_child;
        } else {
-                err = perf_session__write_header(session, rec->evlist,
+                err = perf_session__write_header(session, rec->evlist, fd, false);
-                                                 file->fd, false);
                if (err < 0)
                        goto out_child;
        }
@@ -397,7 +410,7 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
                         * return this more properly and also
                         * propagate errors that now are calling die()
                         */
-                        err = perf_event__synthesize_tracing_data(tool, file->fd, rec->evlist,
+                        err = perf_event__synthesize_tracing_data(tool, fd, rec->evlist,
                                                                  process_synthesized_event);
                        if (err <= 0) {
                                pr_err("Couldn't record tracing data.\n");
@@ -504,19 +517,9 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
                goto out_child;
        }
-        if (!quiet) {
+        if (!quiet)
                fprintf(stderr, "[ perf record: Woken up %ld times to write data ]\n", waking);
-                /*
-                 * Approximate RIP event size: 24 bytes.
-                 */
-                fprintf(stderr,
-                        "[ perf record: Captured and wrote %.3f MB %s (~%" PRIu64 " samples) ]\n",
-                        (double)rec->bytes_written / 1024.0 / 1024.0,
-                        file->path,
-                        rec->bytes_written / 24);
-        }
 out_child:
        if (forks) {
                int exit_status;
@@ -535,13 +538,29 @@ out_child:
        } else
                status = err;
+        /* this will be recalculated during process_buildids() */
+        rec->samples = 0;
        if (!err && !file->is_pipe) {
                rec->session->header.data_size += rec->bytes_written;
                if (!rec->no_buildid)
                        process_buildids(rec);
-                perf_session__write_header(rec->session, rec->evlist,
+                perf_session__write_header(rec->session, rec->evlist, fd, true);
-                                           file->fd, true);
+        }
+        if (!err && !quiet) {
+                char samples[128];
+                if (rec->samples)
+                        scnprintf(samples, sizeof(samples),
+                                  " (%" PRIu64 " samples)", rec->samples);
+                else
+                        samples[0] = '\0';
+                fprintf(stderr, "[ perf record: Captured and wrote %.3f MB %s%s ]\n",
+                        perf_data_file__size(file) / 1024.0 / 1024.0,
+                        file->path, samples);
        }
 out_delete_session:
@@ -720,6 +739,13 @@ static struct record record = {
                        .default_per_cpu = true,
                },
        },
+        .tool = {
+                .sample         = process_sample_event,
+                .fork           = perf_event__process_fork,
+                .comm           = perf_event__process_comm,
+                .mmap           = perf_event__process_mmap,
+                .mmap2          = perf_event__process_mmap2,
+        },
 };
 #define CALLCHAIN_HELP "setup and enables call-graph (stack chain/backtrace) recording: "
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 39367609c707..2f91094e228b 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -86,17 +86,6 @@ static int report__config(const char *var, const char *value, void *cb)
        return perf_default_config(var, value, cb);
 }
-static void report__inc_stats(struct report *rep, struct hist_entry *he)
-{
-        /*
-         * The @he is either of a newly created one or an existing one
-         * merging current sample.  We only want to count a new one so
-         * checking ->nr_events being 1.
-         */
-        if (he->stat.nr_events == 1)
-                rep->nr_entries++;
-}
 static int hist_iter__report_callback(struct hist_entry_iter *iter,
                                      struct addr_location *al, bool single,
                                      void *arg)
@@ -108,8 +97,6 @@ static int hist_iter__report_callback(struct hist_entry_iter *iter,
        struct mem_info *mi;
        struct branch_info *bi;
-        report__inc_stats(rep, he);
        if (!ui__has_annotation())
                return 0;
@@ -457,6 +444,19 @@ static void report__collapse_hists(struct report *rep)
        ui_progress__finish();
 }
+static void report__output_resort(struct report *rep)
+{
+        struct ui_progress prog;
+        struct perf_evsel *pos;
+        ui_progress__init(&prog, rep->nr_entries, "Sorting events for output...");
+        evlist__for_each(rep->session->evlist, pos)
+                hists__output_resort(evsel__hists(pos), &prog);
+        ui_progress__finish();
+}
 static int __cmd_report(struct report *rep)
 {
        int ret;
@@ -486,6 +486,9 @@ static int __cmd_report(struct report *rep)
        report__warn_kptr_restrict(rep);
+        evlist__for_each(session->evlist, pos)
+                rep->nr_entries += evsel__hists(pos)->nr_entries;
        if (use_browser == 0) {
                if (verbose > 3)
                        perf_session__fprintf(session, stdout);
@@ -505,13 +508,20 @@ static int __cmd_report(struct report *rep)
        if (session_done())
                return 0;
+        /*
+         * recalculate number of entries after collapsing since it
+         * might be changed during the collapse phase.
+         */
+        rep->nr_entries = 0;
+        evlist__for_each(session->evlist, pos)
+                rep->nr_entries += evsel__hists(pos)->nr_entries;
        if (rep->nr_entries == 0) {
                ui__error("The %s file has no samples!\n", file->path);
                return 0;
        }
-        evlist__for_each(session->evlist, pos)
+        report__output_resort(rep);
-                hists__output_resort(evsel__hists(pos));
        return report__browse_hists(rep);
 }
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 891086376381..e598e4e98170 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -1730,7 +1730,7 @@ int cmd_stat(int argc, const char **argv, const char *prefix __maybe_unused)
                    "detailed run - start a lot of events"),
        OPT_BOOLEAN('S', "sync", &sync_run,
                    "call sync() before starting a run"),
-        OPT_CALLBACK_NOOPT('B', "big-num", NULL, NULL, 
+        OPT_CALLBACK_NOOPT('B', "big-num", NULL, NULL,
                           "print large numbers with thousands\' separators",
                           stat__set_big_num),
        OPT_STRING('C', "cpu", &target.cpu_list, "cpu",
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 0aa7747ff139..c4c7eac69de4 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -66,7 +66,6 @@
 #include <sys/utsname.h>
 #include <sys/mman.h>
-#include <linux/unistd.h>
 #include <linux/types.h>
 static volatile int done;
@@ -166,7 +165,7 @@ static void ui__warn_map_erange(struct map *map, struct symbol *sym, u64 ip)
                    err ? "[unknown]" : uts.release, perf_version_string);
        if (use_browser <= 0)
                sleep(5);
-        
        map->erange_warned = true;
 }
@@ -285,7 +284,7 @@ static void perf_top__print_sym_table(struct perf_top *top)
        }
        hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
        hists__output_recalc_col_len(hists, top->print_entries - printed);
        putchar('\n');
@@ -554,7 +553,7 @@ static void perf_top__sort_new_samples(void *arg)
        }
        hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
 }
 static void *display_thread_tui(void *arg)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index badfabc6a01f..7e935f1083ec 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -929,66 +929,66 @@ static struct syscall_fmt {
          .arg_scnprintf = { [0] = SCA_HEX, /* brk */ }, },
        { .name     = "clock_gettime",  .errmsg = true, STRARRAY(0, clk_id, clockid), },
        { .name     = "close",      .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_CLOSE_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_CLOSE_FD, /* fd */ }, },
        { .name     = "connect",    .errmsg = true, },
        { .name     = "dup",        .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "dup2",       .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "dup3",       .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "epoll_ctl",  .errmsg = true, STRARRAY(1, op, epoll_ctl_ops), },
        { .name     = "eventfd2",   .errmsg = true,
          .arg_scnprintf = { [1] = SCA_EFD_FLAGS, /* flags */ }, },
        { .name     = "faccessat",  .errmsg = true,
          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },
        { .name     = "fadvise64",  .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "fallocate",  .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "fchdir",     .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "fchmod",     .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "fchmodat",   .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },
        { .name     = "fchown",     .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "fchownat",   .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },
        { .name     = "fcntl",      .errmsg = true,
          .arg_scnprintf = { [0] = SCA_FD, /* fd */
                             [1] = SCA_STRARRAY, /* cmd */ },
          .arg_parm      = { [1] = &strarray__fcntl_cmds, /* cmd */ }, },
        { .name     = "fdatasync",  .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "flock",      .errmsg = true,
          .arg_scnprintf = { [0] = SCA_FD, /* fd */
                             [1] = SCA_FLOCK, /* cmd */ }, },
        { .name     = "fsetxattr",  .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "fstat",      .errmsg = true, .alias = "newfstat",
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "fstatat",    .errmsg = true, .alias = "newfstatat",
-          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },
        { .name     = "fstatfs",    .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "fsync",    .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "ftruncate", .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "futex",      .errmsg = true,
          .arg_scnprintf = { [1] = SCA_FUTEX_OP, /* op */ }, },
        { .name     = "futimesat", .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },
        { .name     = "getdents",   .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "getdents64", .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "getitimer",  .errmsg = true, STRARRAY(0, which, itimers), },
        { .name     = "getrlimit",  .errmsg = true, STRARRAY(0, resource, rlimit_resources), },
        { .name     = "ioctl",      .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */
 #if defined(__i386__) || defined(__x86_64__)
 /*
 * FIXME: Make this available to all arches.
@@ -1002,7 +1002,7 @@ static struct syscall_fmt {
        { .name     = "kill",       .errmsg = true,
          .arg_scnprintf = { [1] = SCA_SIGNUM, /* sig */ }, },
        { .name     = "linkat",     .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },
        { .name     = "lseek",      .errmsg = true,
          .arg_scnprintf = { [0] = SCA_FD, /* fd */
                             [2] = SCA_STRARRAY, /* whence */ },
@@ -1012,9 +1012,9 @@ static struct syscall_fmt {
          .arg_scnprintf = { [0] = SCA_HEX,      /* start */
                             [2] = SCA_MADV_BHV, /* behavior */ }, },
        { .name     = "mkdirat",    .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },
        { .name     = "mknodat",    .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },
        { .name     = "mlock",      .errmsg = true,
          .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, },
        { .name     = "mlockall",   .errmsg = true,
@@ -1036,9 +1036,9 @@ static struct syscall_fmt {
        { .name     = "munmap",     .errmsg = true,
          .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, },
        { .name     = "name_to_handle_at", .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },
        { .name     = "newfstatat", .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },
        { .name     = "open",       .errmsg = true,
          .arg_scnprintf = { [1] = SCA_OPEN_FLAGS, /* flags */ }, },
        { .name     = "open_by_handle_at", .errmsg = true,
@@ -1052,20 +1052,20 @@ static struct syscall_fmt {
        { .name     = "poll",       .errmsg = true, .timeout = true, },
        { .name     = "ppoll",      .errmsg = true, .timeout = true, },
        { .name     = "pread",      .errmsg = true, .alias = "pread64",
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "preadv",     .errmsg = true, .alias = "pread",
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "prlimit64",  .errmsg = true, STRARRAY(1, resource, rlimit_resources), },
        { .name     = "pwrite",     .errmsg = true, .alias = "pwrite64",
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "pwritev",    .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "read",       .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "readlinkat", .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },
        { .name     = "readv",      .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "recvfrom",   .errmsg = true,
          .arg_scnprintf = { [3] = SCA_MSG_FLAGS, /* flags */ }, },
        { .name     = "recvmmsg",   .errmsg = true,
@@ -1073,7 +1073,7 @@ static struct syscall_fmt {
        { .name     = "recvmsg",    .errmsg = true,
          .arg_scnprintf = { [2] = SCA_MSG_FLAGS, /* flags */ }, },
        { .name     = "renameat",   .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },
        { .name     = "rt_sigaction", .errmsg = true,
          .arg_scnprintf = { [0] = SCA_SIGNUM, /* sig */ }, },
        { .name     = "rt_sigprocmask",  .errmsg = true, STRARRAY(0, how, sighow), },
@@ -1091,7 +1091,7 @@ static struct syscall_fmt {
        { .name     = "setitimer",  .errmsg = true, STRARRAY(0, which, itimers), },
        { .name     = "setrlimit",  .errmsg = true, STRARRAY(0, resource, rlimit_resources), },
        { .name     = "shutdown",   .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "socket",     .errmsg = true,
          .arg_scnprintf = { [0] = SCA_STRARRAY, /* family */
                             [1] = SCA_SK_TYPE, /* type */ },
@@ -1102,7 +1102,7 @@ static struct syscall_fmt {
          .arg_parm      = { [0] = &strarray__socket_families, /* family */ }, },
        { .name     = "stat",       .errmsg = true, .alias = "newstat", },
        { .name     = "symlinkat",  .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },
        { .name     = "tgkill",     .errmsg = true,
          .arg_scnprintf = { [2] = SCA_SIGNUM, /* sig */ }, },
        { .name     = "tkill",      .errmsg = true,
@@ -1113,9 +1113,9 @@ static struct syscall_fmt {
        { .name     = "utimensat",  .errmsg = true,
          .arg_scnprintf = { [0] = SCA_FDAT, /* dirfd */ }, },
        { .name     = "write",      .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
        { .name     = "writev",     .errmsg = true,
-          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, }, 
+          .arg_scnprintf = { [0] = SCA_FD, /* fd */ }, },
 };
 static int syscall_fmt__cmp(const void *name, const void *fmtp)
@@ -1191,7 +1191,7 @@ static struct thread_trace *thread__trace(struct thread *thread, FILE *fp)
        if (thread__priv(thread) == NULL)
                thread__set_priv(thread, thread_trace__new());
-                
        if (thread__priv(thread) == NULL)
                goto fail;
@@ -2056,23 +2056,24 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
        if (trace->trace_syscalls &&
            perf_evlist__add_syscall_newtp(evlist, trace__sys_enter,
                                           trace__sys_exit))
-                goto out_error_tp;
+                goto out_error_raw_syscalls;
        if (trace->trace_syscalls)
                perf_evlist__add_vfs_getname(evlist);
        if ((trace->trace_pgfaults & TRACE_PFMAJ) &&
-            perf_evlist__add_pgfault(evlist, PERF_COUNT_SW_PAGE_FAULTS_MAJ))
+            perf_evlist__add_pgfault(evlist, PERF_COUNT_SW_PAGE_FAULTS_MAJ)) {
-                goto out_error_tp;
+                goto out_error_mem;
+        }
        if ((trace->trace_pgfaults & TRACE_PFMIN) &&
            perf_evlist__add_pgfault(evlist, PERF_COUNT_SW_PAGE_FAULTS_MIN))
-                goto out_error_tp;
+                goto out_error_mem;
        if (trace->sched &&
-                perf_evlist__add_newtp(evlist, "sched", "sched_stat_runtime",
+            perf_evlist__add_newtp(evlist, "sched", "sched_stat_runtime",
-                                trace__sched_stat_runtime))
+                                   trace__sched_stat_runtime))
-                goto out_error_tp;
+                goto out_error_sched_stat_runtime;
        err = perf_evlist__create_maps(evlist, &trace->opts.target);
        if (err < 0) {
@@ -2202,8 +2203,12 @@ out:
 {
        char errbuf[BUFSIZ];
-out_error_tp:
+out_error_sched_stat_runtime:
-        perf_evlist__strerror_tp(evlist, errno, errbuf, sizeof(errbuf));
+        debugfs__strerror_open_tp(errno, errbuf, sizeof(errbuf), "sched", "sched_stat_runtime");
+        goto out_error;
+out_error_raw_syscalls:
+        debugfs__strerror_open_tp(errno, errbuf, sizeof(errbuf), "raw_syscalls", "sys_(enter|exit)");
        goto out_error;
 out_error_mmap:
@@ -2217,6 +2222,9 @@ out_error:
        fprintf(trace->output, "%s\n", errbuf);
        goto out_delete_evlist;
 }
+out_error_mem:
+        fprintf(trace->output, "Not enough memory to run!\n");
+        goto out_delete_evlist;
 }
 static int trace__replay(struct trace *trace)
diff --git a/tools/perf/config/Makefile b/tools/perf/config/Makefile
index 5d4b039fe1ed..cc224080b525 100644
--- a/tools/perf/config/Makefile
+++ b/tools/perf/config/Makefile
@@ -20,7 +20,7 @@ NO_PERF_REGS := 1
 # Additional ARCH settings for x86
 ifeq ($(ARCH),x86)
-  ifeq (${IS_X86_64}, 1)
+  ifeq (${IS_64_BIT}, 1)
    CFLAGS += -DHAVE_ARCH_X86_64_SUPPORT
    ARCH_INCLUDE = ../../arch/x86/lib/memcpy_64.S ../../arch/x86/lib/memset_64.S
    LIBUNWIND_LIBS = -lunwind -lunwind-x86_64
@@ -198,6 +198,7 @@ CORE_FEATURE_TESTS =			\
        libpython-version               \
        libslang                        \
        libunwind                       \
+        pthread-attr-setaffinity-np     \
        stackprotector-all              \
        timerfd                         \
        libdw-dwarf-unwind              \
@@ -226,6 +227,7 @@ VF_FEATURE_TESTS =			\
        libelf-getphdrnum               \
        libelf-mmap                     \
        libpython-version               \
+        pthread-attr-setaffinity-np     \
        stackprotector-all              \
        timerfd                         \
        libunwind-debug-frame           \
@@ -301,6 +303,10 @@ ifeq ($(feature-sync-compare-and-swap), 1)
  CFLAGS += -DHAVE_SYNC_COMPARE_AND_SWAP_SUPPORT
 endif
+ifeq ($(feature-pthread-attr-setaffinity-np), 1)
+  CFLAGS += -DHAVE_PTHREAD_ATTR_SETAFFINITY_NP
+endif
 ifndef NO_BIONIC
  $(call feature_check,bionic)
  ifeq ($(feature-bionic), 1)
diff --git a/tools/perf/config/Makefile.arch b/tools/perf/config/Makefile.arch
index 851cd0172a76..ff95a68741d1 100644
--- a/tools/perf/config/Makefile.arch
+++ b/tools/perf/config/Makefile.arch
@@ -1,7 +1,7 @@
 uname_M := $(shell uname -m 2>/dev/null || echo not)
-ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
+RAW_ARCH := $(shell echo $(uname_M) | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
                                  -e s/arm.*/arm/ -e s/sa110/arm/ \
                                  -e s/s390x/s390/ -e s/parisc64/parisc/ \
                                  -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
@@ -9,23 +9,23 @@ ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
                                  -e s/tile.*/tile/ )
 # Additional ARCH settings for x86
-ifeq ($(ARCH),i386)
+ifeq ($(RAW_ARCH),i386)
-  override ARCH := x86
+  ARCH ?= x86
 endif
-ifeq ($(ARCH),x86_64)
+ifeq ($(RAW_ARCH),x86_64)
-  override ARCH := x86
+  ARCH ?= x86
-  IS_X86_64 := 0
-  ifeq (, $(findstring m32,$(CFLAGS)))
+  ifneq (, $(findstring m32,$(CFLAGS)))
-    IS_X86_64 := $(shell echo __x86_64__ | ${CC} -E -x c - | tail -n 1)
+    RAW_ARCH := x86_32
-    RAW_ARCH := x86_64
  endif
 endif
-ifeq (${IS_X86_64}, 1)
+ARCH ?= $(RAW_ARCH)
+LP64 := $(shell echo __LP64__ | ${CC} ${CFLAGS} -E -x c - | tail -n 1)
+ifeq ($(LP64), 1)
  IS_64_BIT := 1
-else ifeq ($(ARCH),x86)
-  IS_64_BIT := 0
 else
-  IS_64_BIT := $(shell echo __LP64__ | ${CC} ${CFLAGS} -E -x c - | tail -n 1)
+  IS_64_BIT := 0
 endif
diff --git a/tools/perf/config/feature-checks/Makefile b/tools/perf/config/feature-checks/Makefile
index 53f19b5dbc37..42ac05aaf8ac 100644
--- a/tools/perf/config/feature-checks/Makefile
+++ b/tools/perf/config/feature-checks/Makefile
@@ -25,6 +25,7 @@ FILES=					\
        test-libslang.bin               \
        test-libunwind.bin              \
        test-libunwind-debug-frame.bin  \
+        test-pthread-attr-setaffinity-np.bin    \
        test-stackprotector-all.bin     \
        test-timerfd.bin                \
        test-libdw-dwarf-unwind.bin     \
@@ -47,6 +48,9 @@ test-all.bin:
 test-hello.bin:
        $(BUILD)
+test-pthread-attr-setaffinity-np.bin:
+        $(BUILD) -Werror -lpthread
 test-stackprotector-all.bin:
        $(BUILD) -Werror -fstack-protector-all
diff --git a/tools/perf/config/feature-checks/test-all.c b/tools/perf/config/feature-checks/test-all.c
index 652e0098eba6..6d4d09323922 100644
--- a/tools/perf/config/feature-checks/test-all.c
+++ b/tools/perf/config/feature-checks/test-all.c
@@ -97,6 +97,10 @@
 # include "test-zlib.c"
 #undef main
+#define main main_test_pthread_attr_setaffinity_np
+# include "test-pthread_attr_setaffinity_np.c"
+#undef main
 int main(int argc, char *argv[])
 {
        main_test_libpython();
@@ -121,6 +125,7 @@ int main(int argc, char *argv[])
        main_test_libdw_dwarf_unwind();
        main_test_sync_compare_and_swap(argc, argv);
        main_test_zlib();
+        main_test_pthread_attr_setaffinity_np();
        return 0;
 }
diff --git a/tools/perf/config/feature-checks/test-pthread-attr-setaffinity-np.c b/tools/perf/config/feature-checks/test-pthread-attr-setaffinity-np.c
new file mode 100644
index 000000000000..0a0d3ecb4e8a
--- /dev/null
+++ b/tools/perf/config/feature-checks/test-pthread-attr-setaffinity-np.c
@@ -0,0 +1,14 @@
+#include <stdint.h>
+#include <pthread.h>
+int main(void)
+{
+        int ret = 0;
+        pthread_attr_t thread_attr;
+        pthread_attr_init(&thread_attr);
+        /* don't care abt exact args, just the API itself in libpthread */
+        ret = pthread_attr_setaffinity_np(&thread_attr, 0, NULL);
+        return ret;
+}
diff --git a/tools/perf/perf-sys.h b/tools/perf/perf-sys.h
index a3b13d7dc1d4..6ef68165c9db 100644
--- a/tools/perf/perf-sys.h
+++ b/tools/perf/perf-sys.h
@@ -6,7 +6,6 @@
 #include <sys/syscall.h>
 #include <linux/types.h>
 #include <linux/perf_event.h>
-#include <asm/unistd.h>
 #if defined(__i386__)
 #define mb()            asm volatile("lock; addl $0,0(%%esp)" ::: "memory")
diff --git a/tools/perf/scripts/perl/Perf-Trace-Util/Context.c b/tools/perf/scripts/perl/Perf-Trace-Util/Context.c
index 790ceba6ad3f..28431d1bbcf5 100644
--- a/tools/perf/scripts/perl/Perf-Trace-Util/Context.c
+++ b/tools/perf/scripts/perl/Perf-Trace-Util/Context.c
@@ -5,7 +5,10 @@
 *      ANY CHANGES MADE HERE WILL BE LOST! 
 *
 */
+#include <stdbool.h>
+#ifndef HAS_BOOL
+# define HAS_BOOL 1
+#endif
 #line 1 "Context.xs"
 /*
 * Context.xs.  XS interfaces for perf script.
diff --git a/tools/perf/tests/attr.py b/tools/perf/tests/attr.py
index c9b4b6269b51..1091bd47adfd 100644
--- a/tools/perf/tests/attr.py
+++ b/tools/perf/tests/attr.py
@@ -104,7 +104,6 @@ class Event(dict):
                continue
            if not self.compare_data(self[t], other[t]):
                log.warning("expected %s=%s, got %s" % (t, self[t], other[t]))
-                
 # Test file description needs to have following sections:
 # [config]
diff --git a/tools/perf/tests/dwarf-unwind.c b/tools/perf/tests/dwarf-unwind.c
index ab28cca2cb97..0bf06bec68c7 100644
--- a/tools/perf/tests/dwarf-unwind.c
+++ b/tools/perf/tests/dwarf-unwind.c
@@ -11,6 +11,9 @@
 #include "thread.h"
 #include "callchain.h"
+/* For bsearch. We try to unwind functions in shared object. */
+#include <stdlib.h>
 static int mmap_handler(struct perf_tool *tool __maybe_unused,
                        union perf_event *event,
                        struct perf_sample *sample __maybe_unused,
@@ -28,7 +31,7 @@ static int init_live_machine(struct machine *machine)
                                                  mmap_handler, machine, true);
 }
-#define MAX_STACK 6
+#define MAX_STACK 8
 static int unwind_entry(struct unwind_entry *entry, void *arg)
 {
@@ -37,6 +40,8 @@ static int unwind_entry(struct unwind_entry *entry, void *arg)
        static const char *funcs[MAX_STACK] = {
                "test__arch_unwind_sample",
                "unwind_thread",
+                "compare",
+                "bsearch",
                "krava_3",
                "krava_2",
                "krava_1",
@@ -88,10 +93,37 @@ static int unwind_thread(struct thread *thread)
        return err;
 }
+static int global_unwind_retval = -INT_MAX;
+__attribute__ ((noinline))
+static int compare(void *p1, void *p2)
+{
+        /* Any possible value should be 'thread' */
+        struct thread *thread = *(struct thread **)p1;
+        if (global_unwind_retval == -INT_MAX)
+                global_unwind_retval = unwind_thread(thread);
+        return p1 - p2;
+}
 __attribute__ ((noinline))
 static int krava_3(struct thread *thread)
 {
-        return unwind_thread(thread);
+        struct thread *array[2] = {thread, thread};
+        void *fp = &bsearch;
+        /*
+         * make _bsearch a volatile function pointer to
+         * prevent potential optimization, which may expand
+         * bsearch and call compare directly from this function,
+         * instead of libc shared object.
+         */
+        void *(*volatile _bsearch)(void *, void *, size_t,
+                        size_t, int (*)(void *, void *));
+        _bsearch = fp;
+        _bsearch(array, &thread, 2, sizeof(struct thread **), compare);
+        return global_unwind_retval;
 }
 __attribute__ ((noinline))
diff --git a/tools/perf/tests/hists_cumulate.c b/tools/perf/tests/hists_cumulate.c
index 614d5c4978ab..18619966454c 100644
--- a/tools/perf/tests/hists_cumulate.c
+++ b/tools/perf/tests/hists_cumulate.c
@@ -140,7 +140,7 @@ static void del_hist_entries(struct hists *hists)
                he = rb_entry(node, struct hist_entry, rb_node);
                rb_erase(node, root_out);
                rb_erase(&he->rb_node_in, root_in);
-                hist_entry__free(he);
+                hist_entry__delete(he);
        }
 }
@@ -187,7 +187,7 @@ static int do_test(struct hists *hists, struct result *expected, size_t nr_expec
         * function since TEST_ASSERT_VAL() returns in case of failure.
         */
        hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
        if (verbose > 2) {
                pr_info("use callchain: %d, cumulate callchain: %d\n",
@@ -454,12 +454,12 @@ static int test3(struct perf_evsel *evsel, struct machine *machine)
         *   30.00%    10.00%     perf  perf           [.] cmd_record
         *   20.00%     0.00%     bash  libc           [.] malloc
         *   10.00%    10.00%     bash  [kernel]       [k] page_fault
-         *   10.00%    10.00%     perf  [kernel]       [k] schedule
+         *   10.00%    10.00%     bash  bash           [.] xmalloc
-         *   10.00%     0.00%     perf  [kernel]       [k] sys_perf_event_open
         *   10.00%    10.00%     perf  [kernel]       [k] page_fault
-         *   10.00%    10.00%     perf  libc           [.] free
         *   10.00%    10.00%     perf  libc           [.] malloc
-         *   10.00%    10.00%     bash  bash           [.] xmalloc
+         *   10.00%    10.00%     perf  [kernel]       [k] schedule
+         *   10.00%    10.00%     perf  libc           [.] free
+         *   10.00%     0.00%     perf  [kernel]       [k] sys_perf_event_open
         */
        struct result expected[] = {
                { 7000, 2000, "perf", "perf",     "main" },
@@ -468,12 +468,12 @@ static int test3(struct perf_evsel *evsel, struct machine *machine)
                { 3000, 1000, "perf", "perf",     "cmd_record" },
                { 2000,    0, "bash", "libc",     "malloc" },
                { 1000, 1000, "bash", "[kernel]", "page_fault" },
-                { 1000, 1000, "perf", "[kernel]", "schedule" },
+                { 1000, 1000, "bash", "bash",     "xmalloc" },
-                { 1000,    0, "perf", "[kernel]", "sys_perf_event_open" },
                { 1000, 1000, "perf", "[kernel]", "page_fault" },
+                { 1000, 1000, "perf", "[kernel]", "schedule" },
                { 1000, 1000, "perf", "libc",     "free" },
                { 1000, 1000, "perf", "libc",     "malloc" },
-                { 1000, 1000, "bash", "bash",     "xmalloc" },
+                { 1000,    0, "perf", "[kernel]", "sys_perf_event_open" },
        };
        symbol_conf.use_callchain = false;
@@ -537,10 +537,13 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
         *                  malloc
         *                  main
         *
-         *   10.00%    10.00%     perf  [kernel]       [k] schedule
+         *   10.00%    10.00%     bash  bash           [.] xmalloc
         *              |
-         *              --- schedule
+         *              --- xmalloc
-         *                  run_command
+         *                  malloc
+         *                  xmalloc     <--- NOTE: there's a cycle
+         *                  malloc
+         *                  xmalloc
         *                  main
         *
         *   10.00%     0.00%     perf  [kernel]       [k] sys_perf_event_open
@@ -556,6 +559,12 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
         *                  run_command
         *                  main
         *
+         *   10.00%    10.00%     perf  [kernel]       [k] schedule
+         *              |
+         *              --- schedule
+         *                  run_command
+         *                  main
+         *
         *   10.00%    10.00%     perf  libc           [.] free
         *              |
         *              --- free
@@ -570,15 +579,6 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
         *                  run_command
         *                  main
         *
-         *   10.00%    10.00%     bash  bash           [.] xmalloc
-         *              |
-         *              --- xmalloc
-         *                  malloc
-         *                  xmalloc     <--- NOTE: there's a cycle
-         *                  malloc
-         *                  xmalloc
-         *                  main
-         *
         */
        struct result expected[] = {
                { 7000, 2000, "perf", "perf",     "main" },
@@ -587,12 +587,12 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
                { 3000, 1000, "perf", "perf",     "cmd_record" },
                { 2000,    0, "bash", "libc",     "malloc" },
                { 1000, 1000, "bash", "[kernel]", "page_fault" },
-                { 1000, 1000, "perf", "[kernel]", "schedule" },
+                { 1000, 1000, "bash", "bash",     "xmalloc" },
                { 1000,    0, "perf", "[kernel]", "sys_perf_event_open" },
                { 1000, 1000, "perf", "[kernel]", "page_fault" },
+                { 1000, 1000, "perf", "[kernel]", "schedule" },
                { 1000, 1000, "perf", "libc",     "free" },
                { 1000, 1000, "perf", "libc",     "malloc" },
-                { 1000, 1000, "bash", "bash",     "xmalloc" },
        };
        struct callchain_result expected_callchain[] = {
                {
@@ -622,9 +622,12 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
                                { "bash",     "main" }, },
                },
                {
-                        3, {    { "[kernel]", "schedule" },
+                        6, {    { "bash",     "xmalloc" },
-                                { "perf",     "run_command" },
+                                { "libc",     "malloc" },
-                                { "perf",     "main" }, },
+                                { "bash",     "xmalloc" },
+                                { "libc",     "malloc" },
+                                { "bash",     "xmalloc" },
+                                { "bash",     "main" }, },
                },
                {
                        3, {    { "[kernel]", "sys_perf_event_open" },
@@ -638,6 +641,11 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
                                { "perf",     "main" }, },
                },
                {
+                        3, {    { "[kernel]", "schedule" },
+                                { "perf",     "run_command" },
+                                { "perf",     "main" }, },
+                },
+                {
                        4, {    { "libc",     "free" },
                                { "perf",     "cmd_record" },
                                { "perf",     "run_command" },
@@ -649,14 +657,6 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
                                { "perf",     "run_command" },
                                { "perf",     "main" }, },
                },
-                {
-                        6, {    { "bash",     "xmalloc" },
-                                { "libc",     "malloc" },
-                                { "bash",     "xmalloc" },
-                                { "libc",     "malloc" },
-                                { "bash",     "xmalloc" },
-                                { "bash",     "main" }, },
-                },
        };
        symbol_conf.use_callchain = true;
diff --git a/tools/perf/tests/hists_filter.c b/tools/perf/tests/hists_filter.c
index 74f257a81265..59e53db7914c 100644
--- a/tools/perf/tests/hists_filter.c
+++ b/tools/perf/tests/hists_filter.c
@@ -138,7 +138,7 @@ int test__hists_filter(void)
                struct hists *hists = evsel__hists(evsel);
                hists__collapse_resort(hists, NULL);
-                hists__output_resort(hists);
+                hists__output_resort(hists, NULL);
                if (verbose > 2) {
                        pr_info("Normal histogram\n");
diff --git a/tools/perf/tests/hists_output.c b/tools/perf/tests/hists_output.c
index a748f2be1222..b52c9faea224 100644
--- a/tools/perf/tests/hists_output.c
+++ b/tools/perf/tests/hists_output.c
@@ -106,7 +106,7 @@ static void del_hist_entries(struct hists *hists)
                he = rb_entry(node, struct hist_entry, rb_node);
                rb_erase(node, root_out);
                rb_erase(&he->rb_node_in, root_in);
-                hist_entry__free(he);
+                hist_entry__delete(he);
        }
 }
@@ -152,7 +152,7 @@ static int test1(struct perf_evsel *evsel, struct machine *machine)
                goto out;
        hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
        if (verbose > 2) {
                pr_info("[fields = %s, sort = %s]\n", field_order, sort_order);
@@ -252,7 +252,7 @@ static int test2(struct perf_evsel *evsel, struct machine *machine)
                goto out;
        hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
        if (verbose > 2) {
                pr_info("[fields = %s, sort = %s]\n", field_order, sort_order);
@@ -306,7 +306,7 @@ static int test3(struct perf_evsel *evsel, struct machine *machine)
                goto out;
        hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
        if (verbose > 2) {
                pr_info("[fields = %s, sort = %s]\n", field_order, sort_order);
@@ -384,7 +384,7 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
                goto out;
        hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
        if (verbose > 2) {
                pr_info("[fields = %s, sort = %s]\n", field_order, sort_order);
@@ -487,7 +487,7 @@ static int test5(struct perf_evsel *evsel, struct machine *machine)
                goto out;
        hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
        if (verbose > 2) {
                pr_info("[fields = %s, sort = %s]\n", field_order, sort_order);
diff --git a/tools/perf/tests/make b/tools/perf/tests/make
index 69a71ff84e01..75709d2b17b4 100644
--- a/tools/perf/tests/make
+++ b/tools/perf/tests/make
@@ -222,7 +222,6 @@ tarpkg:
        @cmd="$(PERF)/tests/perf-targz-src-pkg $(PERF)"; \
        echo "- $@: $$cmd" && echo $$cmd > $@ && \
        ( eval $$cmd ) >> $@ 2>&1
-        
 all: $(run) $(run_O) tarpkg
        @echo OK
diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c
index 7f2f51f93619..1cdab0ce00e2 100644
--- a/tools/perf/tests/parse-events.c
+++ b/tools/perf/tests/parse-events.c
@@ -1145,6 +1145,49 @@ static int test__pinned_group(struct perf_evlist *evlist)
        return 0;
 }
+static int test__checkevent_breakpoint_len(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel = perf_evlist__first(evlist);
+        TEST_ASSERT_VAL("wrong number of entries", 1 == evlist->nr_entries);
+        TEST_ASSERT_VAL("wrong type", PERF_TYPE_BREAKPOINT == evsel->attr.type);
+        TEST_ASSERT_VAL("wrong config", 0 == evsel->attr.config);
+        TEST_ASSERT_VAL("wrong bp_type", (HW_BREAKPOINT_R | HW_BREAKPOINT_W) ==
+                                         evsel->attr.bp_type);
+        TEST_ASSERT_VAL("wrong bp_len", HW_BREAKPOINT_LEN_1 ==
+                                        evsel->attr.bp_len);
+        return 0;
+}
+static int test__checkevent_breakpoint_len_w(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel = perf_evlist__first(evlist);
+        TEST_ASSERT_VAL("wrong number of entries", 1 == evlist->nr_entries);
+        TEST_ASSERT_VAL("wrong type", PERF_TYPE_BREAKPOINT == evsel->attr.type);
+        TEST_ASSERT_VAL("wrong config", 0 == evsel->attr.config);
+        TEST_ASSERT_VAL("wrong bp_type", HW_BREAKPOINT_W ==
+                                         evsel->attr.bp_type);
+        TEST_ASSERT_VAL("wrong bp_len", HW_BREAKPOINT_LEN_2 ==
+                                        evsel->attr.bp_len);
+        return 0;
+}
+static int
+test__checkevent_breakpoint_len_rw_modifier(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel = perf_evlist__first(evlist);
+        TEST_ASSERT_VAL("wrong exclude_user", !evsel->attr.exclude_user);
+        TEST_ASSERT_VAL("wrong exclude_kernel", evsel->attr.exclude_kernel);
+        TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
+        TEST_ASSERT_VAL("wrong precise_ip", !evsel->attr.precise_ip);
+        return test__checkevent_breakpoint_rw(evlist);
+}
 static int count_tracepoints(void)
 {
        char events_path[PATH_MAX];
@@ -1420,6 +1463,21 @@ static struct evlist_test test__events[] = {
                .check = test__pinned_group,
                .id    = 41,
        },
+        {
+                .name  = "mem:0/1",
+                .check = test__checkevent_breakpoint_len,
+                .id    = 42,
+        },
+        {
+                .name  = "mem:0/2:w",
+                .check = test__checkevent_breakpoint_len_w,
+                .id    = 43,
+        },
+        {
+                .name  = "mem:0/4:rw:u",
+                .check = test__checkevent_breakpoint_len_rw_modifier,
+                .id    = 44
+        },
 #if defined(__s390x__)
        {
                .name  = "kvm-s390:kvm_s390_create_vm",
@@ -1471,7 +1529,7 @@ static int test_event(struct evlist_test *e)
        } else {
                ret = e->check(evlist);
        }
-        
        perf_evlist__delete(evlist);
        return ret;
diff --git a/tools/perf/tests/sample-parsing.c b/tools/perf/tests/sample-parsing.c
index 4908c648a597..30c02181e78b 100644
--- a/tools/perf/tests/sample-parsing.c
+++ b/tools/perf/tests/sample-parsing.c
@@ -110,7 +110,7 @@ static bool samples_same(const struct perf_sample *s1,
        if (type & PERF_SAMPLE_STACK_USER) {
                COMP(user_stack.size);
-                if (memcmp(s1->user_stack.data, s1->user_stack.data,
+                if (memcmp(s1->user_stack.data, s2->user_stack.data,
                           s1->user_stack.size)) {
                        pr_debug("Samples differ at 'user_stack'\n");
                        return false;
diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index 1e0a2fd80115..9d32e3c0cfee 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -517,7 +517,7 @@ static bool annotate_browser__jump(struct annotate_browser *browser)
        }
        annotate_browser__set_top(browser, dl, idx);
-        
        return true;
 }
@@ -867,7 +867,6 @@ static void annotate_browser__mark_jump_targets(struct annotate_browser *browser
                ++browser->nr_jumps;
        }
-                
 }
 static inline int width_jumps(int n)
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index e6bb04b5b09b..788506eef567 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -550,7 +550,7 @@ static int hist_browser__show_callchain(struct hist_browser *browser,
        bool need_percent;
        node = rb_first(root);
-        need_percent = !!rb_next(node);
+        need_percent = node && rb_next(node);
        while (node) {
                struct callchain_node *child = rb_entry(node, struct callchain_node, rb_node);
diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index dc0d095f318c..25d608394d74 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -204,6 +204,9 @@ static int __hpp__sort_acc(struct hist_entry *a, struct hist_entry *b,
                if (ret)
                        return ret;
+                if (a->thread != b->thread || !symbol_conf.use_callchain)
+                        return 0;
                ret = b->callchain->max_depth - a->callchain->max_depth;
        }
        return ret;
@@ -282,7 +285,8 @@ static int hpp__entry_##_type(struct perf_hpp_fmt *fmt,				\
 }
 #define __HPP_SORT_FN(_type, _field)                                            \
-static int64_t hpp__sort_##_type(struct hist_entry *a, struct hist_entry *b)    \
+static int64_t hpp__sort_##_type(struct perf_hpp_fmt *fmt __maybe_unused,       \
+                                 struct hist_entry *a, struct hist_entry *b)    \
 {                                                                               \
        return __hpp__sort(a, b, he_get_##_field);                              \
 }
@@ -309,7 +313,8 @@ static int hpp__entry_##_type(struct perf_hpp_fmt *fmt,				\
 }
 #define __HPP_SORT_ACC_FN(_type, _field)                                        \
-static int64_t hpp__sort_##_type(struct hist_entry *a, struct hist_entry *b)    \
+static int64_t hpp__sort_##_type(struct perf_hpp_fmt *fmt __maybe_unused,       \
+                                 struct hist_entry *a, struct hist_entry *b)    \
 {                                                                               \
        return __hpp__sort_acc(a, b, he_get_acc_##_field);                      \
 }
@@ -328,7 +333,8 @@ static int hpp__entry_##_type(struct perf_hpp_fmt *fmt,				\
 }
 #define __HPP_SORT_RAW_FN(_type, _field)                                        \
-static int64_t hpp__sort_##_type(struct hist_entry *a, struct hist_entry *b)    \
+static int64_t hpp__sort_##_type(struct perf_hpp_fmt *fmt __maybe_unused,       \
+                                 struct hist_entry *a, struct hist_entry *b)    \
 {                                                                               \
        return __hpp__sort(a, b, he_get_raw_##_field);                          \
 }
@@ -358,7 +364,8 @@ HPP_PERCENT_ACC_FNS(overhead_acc, period)
 HPP_RAW_FNS(samples, nr_events)
 HPP_RAW_FNS(period, period)
-static int64_t hpp__nop_cmp(struct hist_entry *a __maybe_unused,
+static int64_t hpp__nop_cmp(struct perf_hpp_fmt *fmt __maybe_unused,
+                            struct hist_entry *a __maybe_unused,
                            struct hist_entry *b __maybe_unused)
 {
        return 0;
diff --git a/tools/perf/ui/progress.h b/tools/perf/ui/progress.h
index f34f89eb607c..717d39d3052b 100644
--- a/tools/perf/ui/progress.h
+++ b/tools/perf/ui/progress.h
@@ -4,12 +4,12 @@
 #include <linux/types.h>
 void ui_progress__finish(void);
- 
 struct ui_progress {
        const char *title;
        u64 curr, next, step, total;
 };
- 
 void ui_progress__init(struct ui_progress *p, u64 total, const char *title);
 void ui_progress__update(struct ui_progress *p, u64 adv);
diff --git a/tools/perf/ui/tui/helpline.c b/tools/perf/ui/tui/helpline.c
index 1c8b9afd5d6e..88f5143a5981 100644
--- a/tools/perf/ui/tui/helpline.c
+++ b/tools/perf/ui/tui/helpline.c
@@ -9,6 +9,7 @@
 #include "../libslang.h"
 char ui_helpline__last_msg[1024];
+bool tui_helpline__set;
 static void tui_helpline__pop(void)
 {
@@ -35,6 +36,8 @@ static int tui_helpline__show(const char *format, va_list ap)
                        sizeof(ui_helpline__last_msg) - backlog, format, ap);
        backlog += ret;
+        tui_helpline__set = true;
        if (ui_helpline__last_msg[backlog - 1] == '\n') {
                ui_helpline__puts(ui_helpline__last_msg);
                SLsmg_refresh();
diff --git a/tools/perf/ui/tui/setup.c b/tools/perf/ui/tui/setup.c
index 2f612562978c..b77e1d771363 100644
--- a/tools/perf/ui/tui/setup.c
+++ b/tools/perf/ui/tui/setup.c
@@ -1,5 +1,8 @@
 #include <signal.h>
 #include <stdbool.h>
+#ifdef HAVE_BACKTRACE_SUPPORT
+#include <execinfo.h>
+#endif
 #include "../../util/cache.h"
 #include "../../util/debug.h"
@@ -14,6 +17,7 @@
 static volatile int ui__need_resize;
 extern struct perf_error_ops perf_tui_eops;
+extern bool tui_helpline__set;
 extern void hist_browser__init_hpp(void);
@@ -88,6 +92,25 @@ int ui__getch(int delay_secs)
        return SLkp_getkey();
 }
+#ifdef HAVE_BACKTRACE_SUPPORT
+static void ui__signal_backtrace(int sig)
+{
+        void *stackdump[32];
+        size_t size;
+        ui__exit(false);
+        psignal(sig, "perf");
+        printf("-------- backtrace --------\n");
+        size = backtrace(stackdump, ARRAY_SIZE(stackdump));
+        backtrace_symbols_fd(stackdump, size, STDOUT_FILENO);
+        exit(0);
+}
+#else
+# define ui__signal_backtrace  ui__signal
+#endif
 static void ui__signal(int sig)
 {
        ui__exit(false);
@@ -122,8 +145,8 @@ int ui__init(void)
        ui_browser__init();
        tui_progress__init();
-        signal(SIGSEGV, ui__signal);
+        signal(SIGSEGV, ui__signal_backtrace);
-        signal(SIGFPE, ui__signal);
+        signal(SIGFPE, ui__signal_backtrace);
        signal(SIGINT, ui__signal);
        signal(SIGQUIT, ui__signal);
        signal(SIGTERM, ui__signal);
@@ -137,7 +160,7 @@ out:
 void ui__exit(bool wait_for_ok)
 {
-        if (wait_for_ok)
+        if (wait_for_ok && tui_helpline__set)
                ui__question_window("Fatal Error",
                                    ui_helpline__last_msg,
                                    "Press any key...", 0);
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 79999ceaf2be..61bf9128e1f2 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -177,14 +177,17 @@ static int lock__parse(struct ins_operands *ops)
                goto out_free_ops;
        ops->locked.ins = ins__find(name);
+        free(name);
        if (ops->locked.ins == NULL)
                goto out_free_ops;
        if (!ops->locked.ins->ops)
                return 0;
-        if (ops->locked.ins->ops->parse)
+        if (ops->locked.ins->ops->parse &&
-                ops->locked.ins->ops->parse(ops->locked.ops);
+            ops->locked.ins->ops->parse(ops->locked.ops) < 0)
+                goto out_free_ops;
        return 0;
@@ -208,6 +211,13 @@ static int lock__scnprintf(struct ins *ins, char *bf, size_t size,
 static void lock__delete(struct ins_operands *ops)
 {
+        struct ins *ins = ops->locked.ins;
+        if (ins && ins->ops->free)
+                ins->ops->free(ops->locked.ops);
+        else
+                ins__delete(ops->locked.ops);
        zfree(&ops->locked.ops);
        zfree(&ops->target.raw);
        zfree(&ops->target.name);
@@ -229,7 +239,7 @@ static int mov__parse(struct ins_operands *ops)
        *s = '\0';
        ops->source.raw = strdup(ops->raw);
        *s = ',';
-        
        if (ops->source.raw == NULL)
                return -1;
@@ -531,8 +541,8 @@ static void disasm_line__init_ins(struct disasm_line *dl)
        if (!dl->ins->ops)
                return;
-        if (dl->ins->ops->parse)
+        if (dl->ins->ops->parse && dl->ins->ops->parse(&dl->ops) < 0)
-                dl->ins->ops->parse(&dl->ops);
+                dl->ins = NULL;
 }
 static int disasm_line__parse(char *line, char **namep, char **rawp)
diff --git a/tools/perf/util/annotate.h b/tools/perf/util/annotate.h
index 0784a9420528..cadbdc90a5cb 100644
--- a/tools/perf/util/annotate.h
+++ b/tools/perf/util/annotate.h
@@ -116,11 +116,6 @@ struct annotation {
        struct annotated_source *src;
 };
-struct sannotation {
-        struct annotation annotation;
-        struct symbol     symbol;
-};
 static inline struct sym_hist *annotation__histogram(struct annotation *notes, int idx)
 {
        return (((void *)&notes->src->histograms) +
@@ -129,8 +124,7 @@ static inline struct sym_hist *annotation__histogram(struct annotation *notes, i
 static inline struct annotation *symbol__annotation(struct symbol *sym)
 {
-        struct sannotation *a = container_of(sym, struct sannotation, symbol);
+        return (void *)sym - symbol_conf.priv_size;
-        return &a->annotation;
 }
 int addr_map_symbol__inc_samples(struct addr_map_symbol *ams, int evidx);
diff --git a/tools/perf/util/cache.h b/tools/perf/util/cache.h
index 5cf9e1b5989d..d04d770d90f6 100644
--- a/tools/perf/util/cache.h
+++ b/tools/perf/util/cache.h
@@ -71,7 +71,9 @@ extern char *perf_path(const char *fmt, ...) __attribute__((format (printf, 1, 2
 extern char *perf_pathdup(const char *fmt, ...)
        __attribute__((format (printf, 1, 2)));
+#ifndef __UCLIBC__
 /* Matches the libc/libbsd function attribute so we declare this unconditionally: */
 extern size_t strlcpy(char *dest, const char *src, size_t size);
+#endif
 #endif /* __PERF_CACHE_H */
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 64b377e591e4..14e7a123d43b 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -841,3 +841,33 @@ char *callchain_list__sym_name(struct callchain_list *cl,
        return bf;
 }
+static void free_callchain_node(struct callchain_node *node)
+{
+        struct callchain_list *list, *tmp;
+        struct callchain_node *child;
+        struct rb_node *n;
+        list_for_each_entry_safe(list, tmp, &node->val, list) {
+                list_del(&list->list);
+                free(list);
+        }
+        n = rb_first(&node->rb_root_in);
+        while (n) {
+                child = container_of(n, struct callchain_node, rb_node_in);
+                n = rb_next(n);
+                rb_erase(&child->rb_node_in, &node->rb_root_in);
+                free_callchain_node(child);
+                free(child);
+        }
+}
+void free_callchain(struct callchain_root *root)
+{
+        if (!symbol_conf.use_callchain)
+                return;
+        free_callchain_node(&root->node);
+}
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index dbc08cf5f970..c0ec1acc38e4 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -198,4 +198,6 @@ static inline int arch_skip_callchain_idx(struct thread *thread __maybe_unused,
 char *callchain_list__sym_name(struct callchain_list *cl,
                               char *bf, size_t bfsize, bool show_dso);
+void free_callchain(struct callchain_root *root);
 #endif  /* __PERF_CALLCHAIN_H */
diff --git a/tools/perf/util/color.c b/tools/perf/util/color.c
index f4654183d391..55355b3d4f85 100644
--- a/tools/perf/util/color.c
+++ b/tools/perf/util/color.c
@@ -5,132 +5,6 @@
 int perf_use_color_default = -1;
-static int parse_color(const char *name, int len)
-{
-        static const char * const color_names[] = {
-                "normal", "black", "red", "green", "yellow",
-                "blue", "magenta", "cyan", "white"
-        };
-        char *end;
-        int i;
-        for (i = 0; i < (int)ARRAY_SIZE(color_names); i++) {
-                const char *str = color_names[i];
-                if (!strncasecmp(name, str, len) && !str[len])
-                        return i - 1;
-        }
-        i = strtol(name, &end, 10);
-        if (end - name == len && i >= -1 && i <= 255)
-                return i;
-        return -2;
-}
-static int parse_attr(const char *name, int len)
-{
-        static const int attr_values[] = { 1, 2, 4, 5, 7 };
-        static const char * const attr_names[] = {
-                "bold", "dim", "ul", "blink", "reverse"
-        };
-        unsigned int i;
-        for (i = 0; i < ARRAY_SIZE(attr_names); i++) {
-                const char *str = attr_names[i];
-                if (!strncasecmp(name, str, len) && !str[len])
-                        return attr_values[i];
-        }
-        return -1;
-}
-void color_parse(const char *value, const char *var, char *dst)
-{
-        color_parse_mem(value, strlen(value), var, dst);
-}
-void color_parse_mem(const char *value, int value_len, const char *var,
-                char *dst)
-{
-        const char *ptr = value;
-        int len = value_len;
-        int attr = -1;
-        int fg = -2;
-        int bg = -2;
-        if (!strncasecmp(value, "reset", len)) {
-                strcpy(dst, PERF_COLOR_RESET);
-                return;
-        }
-        /* [fg [bg]] [attr] */
-        while (len > 0) {
-                const char *word = ptr;
-                int val, wordlen = 0;
-                while (len > 0 && !isspace(word[wordlen])) {
-                        wordlen++;
-                        len--;
-                }
-                ptr = word + wordlen;
-                while (len > 0 && isspace(*ptr)) {
-                        ptr++;
-                        len--;
-                }
-                val = parse_color(word, wordlen);
-                if (val >= -1) {
-                        if (fg == -2) {
-                                fg = val;
-                                continue;
-                        }
-                        if (bg == -2) {
-                                bg = val;
-                                continue;
-                        }
-                        goto bad;
-                }
-                val = parse_attr(word, wordlen);
-                if (val < 0 || attr != -1)
-                        goto bad;
-                attr = val;
-        }
-        if (attr >= 0 || fg >= 0 || bg >= 0) {
-                int sep = 0;
-                *dst++ = '\033';
-                *dst++ = '[';
-                if (attr >= 0) {
-                        *dst++ = '0' + attr;
-                        sep++;
-                }
-                if (fg >= 0) {
-                        if (sep++)
-                                *dst++ = ';';
-                        if (fg < 8) {
-                                *dst++ = '3';
-                                *dst++ = '0' + fg;
-                        } else {
-                                dst += sprintf(dst, "38;5;%d", fg);
-                        }
-                }
-                if (bg >= 0) {
-                        if (sep++)
-                                *dst++ = ';';
-                        if (bg < 8) {
-                                *dst++ = '4';
-                                *dst++ = '0' + bg;
-                        } else {
-                                dst += sprintf(dst, "48;5;%d", bg);
-                        }
-                }
-                *dst++ = 'm';
-        }
-        *dst = 0;
-        return;
-bad:
-        die("bad color value '%.*s' for variable '%s'", value_len, value, var);
-}
 int perf_config_colorbool(const char *var, const char *value, int stdout_is_tty)
 {
        if (value) {
diff --git a/tools/perf/util/color.h b/tools/perf/util/color.h
index 0a594b8a0c26..38146f922c54 100644
--- a/tools/perf/util/color.h
+++ b/tools/perf/util/color.h
@@ -30,8 +30,6 @@ extern int perf_use_color_default;
 int perf_color_default_config(const char *var, const char *value, void *cb);
 int perf_config_colorbool(const char *var, const char *value, int stdout_is_tty);
-void color_parse(const char *value, const char *var, char *dst);
-void color_parse_mem(const char *value, int len, const char *var, char *dst);
 int color_vsnprintf(char *bf, size_t size, const char *color,
                    const char *fmt, va_list args);
 int color_vfprintf(FILE *fp, const char *color, const char *fmt, va_list args);
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index 45be944d450a..c2f7d3b90966 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -532,12 +532,8 @@ dso_cache__read(struct dso *dso, u64 offset, u8 *data, ssize_t size)
                        break;
                cache_offset = offset & DSO__DATA_CACHE_MASK;
-                ret = -EINVAL;
-                if (-1 == lseek(dso->data.fd, cache_offset, SEEK_SET))
+                ret = pread(dso->data.fd, cache->data, DSO__DATA_CACHE_SIZE, cache_offset);
-                        break;
-                ret = read(dso->data.fd, cache->data, DSO__DATA_CACHE_SIZE);
                if (ret <= 0)
                        break;
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index 3782c82c6e44..ced92841ff97 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -139,6 +139,7 @@ struct dso {
                u32              status_seen;
                size_t           file_size;
                struct list_head open_entry;
+                u64              frame_offset;
        } data;
        union { /* Tool specific area */
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index cbab1fb77b1d..28b8ce86bf12 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -1436,33 +1436,6 @@ size_t perf_evlist__fprintf(struct perf_evlist *evlist, FILE *fp)
        return printed + fprintf(fp, "\n");
 }
-int perf_evlist__strerror_tp(struct perf_evlist *evlist __maybe_unused,
-                             int err, char *buf, size_t size)
-{
-        char sbuf[128];
-        switch (err) {
-        case ENOENT:
-                scnprintf(buf, size, "%s",
-                          "Error:\tUnable to find debugfs\n"
-                          "Hint:\tWas your kernel was compiled with debugfs support?\n"
-                          "Hint:\tIs the debugfs filesystem mounted?\n"
-                          "Hint:\tTry 'sudo mount -t debugfs nodev /sys/kernel/debug'");
-                break;
-        case EACCES:
-                scnprintf(buf, size,
-                          "Error:\tNo permissions to read %s/tracing/events/raw_syscalls\n"
-                          "Hint:\tTry 'sudo mount -o remount,mode=755 %s'\n",
-                          debugfs_mountpoint, debugfs_mountpoint);
-                break;
-        default:
-                scnprintf(buf, size, "%s", strerror_r(err, sbuf, sizeof(sbuf)));
-                break;
-        }
-        return 0;
-}
 int perf_evlist__strerror_open(struct perf_evlist *evlist __maybe_unused,
                               int err, char *buf, size_t size)
 {
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 0ba93f67ab94..c94a9e03ecf1 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -183,7 +183,6 @@ static inline struct perf_evsel *perf_evlist__last(struct perf_evlist *evlist)
 size_t perf_evlist__fprintf(struct perf_evlist *evlist, FILE *fp);
-int perf_evlist__strerror_tp(struct perf_evlist *evlist, int err, char *buf, size_t size);
 int perf_evlist__strerror_open(struct perf_evlist *evlist, int err, char *buf, size_t size);
 int perf_evlist__strerror_mmap(struct perf_evlist *evlist, int err, char *buf, size_t size);
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 1e90c8557ede..ea51a90e20a0 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -709,6 +709,7 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts)
        if (opts->sample_weight)
                perf_evsel__set_sample_bit(evsel, WEIGHT);
+        attr->task  = track;
        attr->mmap  = track;
        attr->mmap2 = track && !perf_missing_features.mmap2;
        attr->comm  = track;
@@ -797,6 +798,9 @@ int perf_evsel__enable(struct perf_evsel *evsel, int ncpus, int nthreads)
 int perf_evsel__alloc_id(struct perf_evsel *evsel, int ncpus, int nthreads)
 {
+        if (ncpus == 0 || nthreads == 0)
+                return 0;
        if (evsel->system_wide)
                nthreads = 1;
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index b20e40c74468..1f407f7352a7 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -2237,6 +2237,7 @@ static int check_magic_endian(u64 magic, uint64_t hdr_sz,
         * - unique number to identify actual perf.data files
         * - encode endianness of file
         */
+        ph->version = PERF_HEADER_VERSION_2;
        /* check magic number with one endianness */
        if (magic == __perf_magic2)
@@ -2247,7 +2248,6 @@ static int check_magic_endian(u64 magic, uint64_t hdr_sz,
                return -1;
        ph->needs_swap = true;
-        ph->version = PERF_HEADER_VERSION_2;
        return 0;
 }
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 6e88b9e395df..70b48a65064c 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -6,6 +6,7 @@
 #include "evlist.h"
 #include "evsel.h"
 #include "annotate.h"
+#include "ui/progress.h"
 #include <math.h>
 static bool hists__filter_entry_by_dso(struct hists *hists,
@@ -240,6 +241,20 @@ static bool hists__decay_entry(struct hists *hists, struct hist_entry *he)
        return he->stat.period == 0;
 }
+static void hists__delete_entry(struct hists *hists, struct hist_entry *he)
+{
+        rb_erase(&he->rb_node, &hists->entries);
+        if (sort__need_collapse)
+                rb_erase(&he->rb_node_in, &hists->entries_collapsed);
+        --hists->nr_entries;
+        if (!he->filtered)
+                --hists->nr_non_filtered_entries;
+        hist_entry__delete(he);
+}
 void hists__decay_entries(struct hists *hists, bool zap_user, bool zap_kernel)
 {
        struct rb_node *next = rb_first(&hists->entries);
@@ -257,16 +272,7 @@ void hists__decay_entries(struct hists *hists, bool zap_user, bool zap_kernel)
                     (zap_kernel && n->level != '.') ||
                     hists__decay_entry(hists, n)) &&
                    !n->used) {
-                        rb_erase(&n->rb_node, &hists->entries);
+                        hists__delete_entry(hists, n);
-                        if (sort__need_collapse)
-                                rb_erase(&n->rb_node_in, &hists->entries_collapsed);
-                        --hists->nr_entries;
-                        if (!n->filtered)
-                                --hists->nr_non_filtered_entries;
-                        hist_entry__free(n);
                }
        }
 }
@@ -280,16 +286,7 @@ void hists__delete_entries(struct hists *hists)
                n = rb_entry(next, struct hist_entry, rb_node);
                next = rb_next(&n->rb_node);
-                rb_erase(&n->rb_node, &hists->entries);
+                hists__delete_entry(hists, n);
-                if (sort__need_collapse)
-                        rb_erase(&n->rb_node_in, &hists->entries_collapsed);
-                --hists->nr_entries;
-                if (!n->filtered)
-                        --hists->nr_non_filtered_entries;
-                hist_entry__free(n);
        }
 }
@@ -303,7 +300,7 @@ static struct hist_entry *hist_entry__new(struct hist_entry *template,
        size_t callchain_size = 0;
        struct hist_entry *he;
-        if (symbol_conf.use_callchain || symbol_conf.cumulate_callchain)
+        if (symbol_conf.use_callchain)
                callchain_size = sizeof(struct callchain_root);
        he = zalloc(sizeof(*he) + callchain_size);
@@ -432,6 +429,8 @@ static struct hist_entry *add_hist_entry(struct hists *hists,
        if (!he)
                return NULL;
+        hists->nr_entries++;
        rb_link_node(&he->rb_node_in, parent, p);
        rb_insert_color(&he->rb_node_in, hists->entries_in);
 out:
@@ -736,7 +735,7 @@ iter_add_single_cumulative_entry(struct hist_entry_iter *iter,
        iter->he = he;
        he_cache[iter->curr++] = he;
-        callchain_append(he->callchain, &callchain_cursor, sample->period);
+        hist_entry__append_callchain(he, sample);
        /*
         * We need to re-initialize the cursor since callchain_append()
@@ -809,7 +808,8 @@ iter_add_next_cumulative_entry(struct hist_entry_iter *iter,
        iter->he = he;
        he_cache[iter->curr++] = he;
-        callchain_append(he->callchain, &cursor, sample->period);
+        if (symbol_conf.use_callchain)
+                callchain_append(he->callchain, &cursor, sample->period);
        return 0;
 }
@@ -913,7 +913,7 @@ hist_entry__cmp(struct hist_entry *left, struct hist_entry *right)
                if (perf_hpp__should_skip(fmt))
                        continue;
-                cmp = fmt->cmp(left, right);
+                cmp = fmt->cmp(fmt, left, right);
                if (cmp)
                        break;
        }
@@ -931,7 +931,7 @@ hist_entry__collapse(struct hist_entry *left, struct hist_entry *right)
                if (perf_hpp__should_skip(fmt))
                        continue;
-                cmp = fmt->collapse(left, right);
+                cmp = fmt->collapse(fmt, left, right);
                if (cmp)
                        break;
        }
@@ -939,12 +939,13 @@ hist_entry__collapse(struct hist_entry *left, struct hist_entry *right)
        return cmp;
 }
-void hist_entry__free(struct hist_entry *he)
+void hist_entry__delete(struct hist_entry *he)
 {
        zfree(&he->branch_info);
        zfree(&he->mem_info);
        zfree(&he->stat_acc);
        free_srcline(he->srcline);
+        free_callchain(he->callchain);
        free(he);
 }
@@ -978,7 +979,7 @@ static bool hists__collapse_insert_entry(struct hists *hists __maybe_unused,
                                                iter->callchain,
                                                he->callchain);
                        }
-                        hist_entry__free(he);
+                        hist_entry__delete(he);
                        return false;
                }
@@ -987,6 +988,7 @@ static bool hists__collapse_insert_entry(struct hists *hists __maybe_unused,
                else
                        p = &(*p)->rb_right;
        }
+        hists->nr_entries++;
        rb_link_node(&he->rb_node_in, parent, p);
        rb_insert_color(&he->rb_node_in, root);
@@ -1024,7 +1026,10 @@ void hists__collapse_resort(struct hists *hists, struct ui_progress *prog)
        if (!sort__need_collapse)
                return;
+        hists->nr_entries = 0;
        root = hists__get_rotate_entries_in(hists);
        next = rb_first(root);
        while (next) {
@@ -1056,7 +1061,7 @@ static int hist_entry__sort(struct hist_entry *a, struct hist_entry *b)
                if (perf_hpp__should_skip(fmt))
                        continue;
-                cmp = fmt->sort(a, b);
+                cmp = fmt->sort(fmt, a, b);
                if (cmp)
                        break;
        }
@@ -1119,7 +1124,7 @@ static void __hists__insert_output_entry(struct rb_root *entries,
        rb_insert_color(&he->rb_node, entries);
 }
-void hists__output_resort(struct hists *hists)
+void hists__output_resort(struct hists *hists, struct ui_progress *prog)
 {
        struct rb_root *root;
        struct rb_node *next;
@@ -1148,6 +1153,9 @@ void hists__output_resort(struct hists *hists)
                if (!n->filtered)
                        hists__calc_col_len(hists, n);
+                if (prog)
+                        ui_progress__update(prog, 1);
        }
 }
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index d0ef9a19a744..2b690d028907 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -119,9 +119,9 @@ int64_t hist_entry__collapse(struct hist_entry *left, struct hist_entry *right);
 int hist_entry__transaction_len(void);
 int hist_entry__sort_snprintf(struct hist_entry *he, char *bf, size_t size,
                              struct hists *hists);
-void hist_entry__free(struct hist_entry *);
+void hist_entry__delete(struct hist_entry *he);
-void hists__output_resort(struct hists *hists);
+void hists__output_resort(struct hists *hists, struct ui_progress *prog);
 void hists__collapse_resort(struct hists *hists, struct ui_progress *prog);
 void hists__decay_entries(struct hists *hists, bool zap_user, bool zap_kernel);
@@ -195,9 +195,12 @@ struct perf_hpp_fmt {
                     struct hist_entry *he);
        int (*entry)(struct perf_hpp_fmt *fmt, struct perf_hpp *hpp,
                     struct hist_entry *he);
-        int64_t (*cmp)(struct hist_entry *a, struct hist_entry *b);
+        int64_t (*cmp)(struct perf_hpp_fmt *fmt,
-        int64_t (*collapse)(struct hist_entry *a, struct hist_entry *b);
+                       struct hist_entry *a, struct hist_entry *b);
-        int64_t (*sort)(struct hist_entry *a, struct hist_entry *b);
+        int64_t (*collapse)(struct perf_hpp_fmt *fmt,
+                            struct hist_entry *a, struct hist_entry *b);
+        int64_t (*sort)(struct perf_hpp_fmt *fmt,
+                        struct hist_entry *a, struct hist_entry *b);
        struct list_head list;
        struct list_head sort_list;
diff --git a/tools/perf/util/hweight.c b/tools/perf/util/hweight.c
deleted file mode 100644
index 5c1d0d099f0d..000000000000
--- a/tools/perf/util/hweight.c
+++ /dev/null
@@ -1,31 +0,0 @@
-#include <linux/bitops.h>
-/**
- * hweightN - returns the hamming weight of a N-bit word
- * @x: the word to weigh
- *
- * The Hamming Weight of a number is the total number of bits set in it.
- */
-unsigned int hweight32(unsigned int w)
-{
-        unsigned int res = w - ((w >> 1) & 0x55555555);
-        res = (res & 0x33333333) + ((res >> 2) & 0x33333333);
-        res = (res + (res >> 4)) & 0x0F0F0F0F;
-        res = res + (res >> 8);
-        return (res + (res >> 16)) & 0x000000FF;
-}
-unsigned long hweight64(__u64 w)
-{
-#if BITS_PER_LONG == 32
-        return hweight32((unsigned int)(w >> 32)) + hweight32((unsigned int)w);
-#elif BITS_PER_LONG == 64
-        __u64 res = w - ((w >> 1) & 0x5555555555555555ul);
-        res = (res & 0x3333333333333333ul) + ((res >> 2) & 0x3333333333333333ul);
-        res = (res + (res >> 4)) & 0x0F0F0F0F0F0F0F0Ful;
-        res = res + (res >> 8);
-        res = res + (res >> 16);
-        return (res + (res >> 32)) & 0x00000000000000FFul;
-#endif
-}
diff --git a/tools/perf/util/include/asm/hweight.h b/tools/perf/util/include/asm/hweight.h
deleted file mode 100644
index 36cf26d434a5..000000000000
--- a/tools/perf/util/include/asm/hweight.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef PERF_HWEIGHT_H
-#define PERF_HWEIGHT_H
-#include <linux/types.h>
-unsigned int hweight32(unsigned int w);
-unsigned long hweight64(__u64 w);
-#endif /* PERF_HWEIGHT_H */
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 94de3e48b490..1bca3a9f2b16 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -389,7 +389,6 @@ static struct thread *__machine__findnew_thread(struct machine *machine,
        if (th != NULL) {
                rb_link_node(&th->rb_node, parent, p);
                rb_insert_color(&th->rb_node, &machine->threads);
-                machine->last_match = th;
                /*
                 * We have to initialize map_groups separately
@@ -400,9 +399,12 @@ static struct thread *__machine__findnew_thread(struct machine *machine,
                 * leader and that would screwed the rb tree.
                 */
                if (thread__init_map_groups(th, machine)) {
+                        rb_erase(&th->rb_node, &machine->threads);
                        thread__delete(th);
                        return NULL;
                }
+                machine->last_match = th;
        }
        return th;
diff --git a/tools/perf/util/map.h b/tools/perf/util/map.h
index 6951a9d42339..0e42438b1e59 100644
--- a/tools/perf/util/map.h
+++ b/tools/perf/util/map.h
@@ -116,6 +116,22 @@ struct thread;
 #define map__for_each_symbol(map, pos, n)       \
        dso__for_each_symbol(map->dso, pos, n, map->type)
+/* map__for_each_symbol_with_name - iterate over the symbols in the given map
+ *                                  that have the given name
+ *
+ * @map: the 'struct map *' in which symbols itereated
+ * @sym_name: the symbol name
+ * @pos: the 'struct symbol *' to use as a loop cursor
+ * @filter: to use when loading the DSO
+ */
+#define __map__for_each_symbol_by_name(map, sym_name, pos, filter)      \
+        for (pos = map__find_symbol_by_name(map, sym_name, filter);     \
+             pos && strcmp(pos->name, sym_name) == 0;           \
+             pos = symbol__next_by_name(pos))
+#define map__for_each_symbol_by_name(map, sym_name, pos)                \
+        __map__for_each_symbol_by_name(map, sym_name, (pos), NULL)
 typedef int (*symbol_filter_t)(struct map *map, struct symbol *sym);
 void map__init(struct map *map, enum map_type type,
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 77b43fe43d55..7f8ec6ce2823 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -526,7 +526,7 @@ do {					\
 }
 int parse_events_add_breakpoint(struct list_head *list, int *idx,
-                                void *ptr, char *type)
+                                void *ptr, char *type, u64 len)
 {
        struct perf_event_attr attr;
@@ -536,14 +536,15 @@ int parse_events_add_breakpoint(struct list_head *list, int *idx,
        if (parse_breakpoint_type(type, &attr))
                return -EINVAL;
-        /*
+        /* Provide some defaults if len is not specified */
-         * We should find a nice way to override the access length
+        if (!len) {
-         * Provide some defaults for now
+                if (attr.bp_type == HW_BREAKPOINT_X)
-         */
+                        len = sizeof(long);
-        if (attr.bp_type == HW_BREAKPOINT_X)
+                else
-                attr.bp_len = sizeof(long);
+                        len = HW_BREAKPOINT_LEN_4;
-        else
+        }
-                attr.bp_len = HW_BREAKPOINT_LEN_4;
+        attr.bp_len = len;
        attr.type = PERF_TYPE_BREAKPOINT;
        attr.sample_period = 1;
@@ -1121,7 +1122,7 @@ void print_tracepoint_events(const char *subsys_glob, const char *event_glob,
                return;
        for_each_subsystem(sys_dir, sys_dirent, sys_next) {
-                if (subsys_glob != NULL && 
+                if (subsys_glob != NULL &&
                    !strglobmatch(sys_dirent.d_name, subsys_glob))
                        continue;
@@ -1132,7 +1133,7 @@ void print_tracepoint_events(const char *subsys_glob, const char *event_glob,
                        continue;
                for_each_event(sys_dirent, evt_dir, evt_dirent, evt_next) {
-                        if (event_glob != NULL && 
+                        if (event_glob != NULL &&
                            !strglobmatch(evt_dirent.d_name, event_glob))
                                continue;
@@ -1305,7 +1306,7 @@ static void print_symbol_events(const char *event_glob, unsigned type,
        for (i = 0; i < max; i++, syms++) {
-                if (event_glob != NULL && 
+                if (event_glob != NULL &&
                    !(strglobmatch(syms->symbol, event_glob) ||
                      (syms->alias && strglobmatch(syms->alias, event_glob))))
                        continue;
@@ -1366,7 +1367,7 @@ void print_events(const char *event_glob, bool name_only)
                printf("\n");
                printf("  %-50s [%s]\n",
-                       "mem:<addr>[:access]",
+                       "mem:<addr>[/len][:access]",
                        event_type_descriptors[PERF_TYPE_BREAKPOINT]);
                printf("\n");
        }
diff --git a/tools/perf/util/parse-events.h b/tools/perf/util/parse-events.h
index db2cf78ff0f3..ff6e1fa4111e 100644
--- a/tools/perf/util/parse-events.h
+++ b/tools/perf/util/parse-events.h
@@ -71,6 +71,7 @@ struct parse_events_term {
        int type_val;
        int type_term;
        struct list_head list;
+        bool used;
 };
 struct parse_events_evlist {
@@ -104,7 +105,7 @@ int parse_events_add_numeric(struct list_head *list, int *idx,
 int parse_events_add_cache(struct list_head *list, int *idx,
                           char *type, char *op_result1, char *op_result2);
 int parse_events_add_breakpoint(struct list_head *list, int *idx,
-                                void *ptr, char *type);
+                                void *ptr, char *type, u64 len);
 int parse_events_add_pmu(struct list_head *list, int *idx,
                         char *pmu , struct list_head *head_config);
 enum perf_pmu_event_symbol_type
diff --git a/tools/perf/util/parse-events.l b/tools/perf/util/parse-events.l
index 906630bbf8eb..94eacb6c1ef7 100644
--- a/tools/perf/util/parse-events.l
+++ b/tools/perf/util/parse-events.l
@@ -159,6 +159,7 @@ branch_type		{ return term(yyscanner, PARSE_EVENTS__TERM_TYPE_BRANCH_SAMPLE_TYPE
 <mem>{
 {modifier_bp}           { return str(yyscanner, PE_MODIFIER_BP); }
 :                       { return ':'; }
+"/"                     { return '/'; }
 {num_dec}               { return value(yyscanner, 10); }
 {num_hex}               { return value(yyscanner, 16); }
        /*
diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
index 93c4c9fbc922..72def077dbbf 100644
--- a/tools/perf/util/parse-events.y
+++ b/tools/perf/util/parse-events.y
@@ -326,6 +326,28 @@ PE_NAME_CACHE_TYPE
 }
 event_legacy_mem:
+PE_PREFIX_MEM PE_VALUE '/' PE_VALUE ':' PE_MODIFIER_BP sep_dc
+{
+        struct parse_events_evlist *data = _data;
+        struct list_head *list;
+        ALLOC_LIST(list);
+        ABORT_ON(parse_events_add_breakpoint(list, &data->idx,
+                                             (void *) $2, $6, $4));
+        $$ = list;
+}
+|
+PE_PREFIX_MEM PE_VALUE '/' PE_VALUE sep_dc
+{
+        struct parse_events_evlist *data = _data;
+        struct list_head *list;
+        ALLOC_LIST(list);
+        ABORT_ON(parse_events_add_breakpoint(list, &data->idx,
+                                             (void *) $2, NULL, $4));
+        $$ = list;
+}
+|
 PE_PREFIX_MEM PE_VALUE ':' PE_MODIFIER_BP sep_dc
 {
        struct parse_events_evlist *data = _data;
@@ -333,7 +355,7 @@ PE_PREFIX_MEM PE_VALUE ':' PE_MODIFIER_BP sep_dc
        ALLOC_LIST(list);
        ABORT_ON(parse_events_add_breakpoint(list, &data->idx,
-                                             (void *) $2, $4));
+                                             (void *) $2, $4, 0));
        $$ = list;
 }
 |
@@ -344,7 +366,7 @@ PE_PREFIX_MEM PE_VALUE sep_dc
        ALLOC_LIST(list);
        ABORT_ON(parse_events_add_breakpoint(list, &data->idx,
-                                             (void *) $2, NULL));
+                                             (void *) $2, NULL, 0));
        $$ = list;
 }
diff --git a/tools/perf/util/parse-options.c b/tools/perf/util/parse-options.c
index f62dee7bd924..4a015f77e2b5 100644
--- a/tools/perf/util/parse-options.c
+++ b/tools/perf/util/parse-options.c
@@ -46,7 +46,7 @@ static int get_value(struct parse_opt_ctx_t *p,
                return opterror(opt, "is not usable", flags);
        if (opt->flags & PARSE_OPT_EXCLUSIVE) {
-                if (p->excl_opt) {
+                if (p->excl_opt && p->excl_opt != opt) {
                        char msg[128];
                        if (((flags & OPT_SHORT) && p->excl_opt->short_name) ||
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index 5c9c4947cfb4..48411674da0f 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -551,31 +551,68 @@ static void pmu_format_value(unsigned long *format, __u64 value, __u64 *v,
 }
 /*
+ * Term is a string term, and might be a param-term. Try to look up it's value
+ * in the remaining terms.
+ * - We have a term like "base-or-format-term=param-term",
+ * - We need to find the value supplied for "param-term" (with param-term named
+ *   in a config string) later on in the term list.
+ */
+static int pmu_resolve_param_term(struct parse_events_term *term,
+                                  struct list_head *head_terms,
+                                  __u64 *value)
+{
+        struct parse_events_term *t;
+        list_for_each_entry(t, head_terms, list) {
+                if (t->type_val == PARSE_EVENTS__TERM_TYPE_NUM) {
+                        if (!strcmp(t->config, term->config)) {
+                                t->used = true;
+                                *value = t->val.num;
+                                return 0;
+                        }
+                }
+        }
+        if (verbose)
+                printf("Required parameter '%s' not specified\n", term->config);
+        return -1;
+}
+/*
 * Setup one of config[12] attr members based on the
 * user input data - term parameter.
 */
 static int pmu_config_term(struct list_head *formats,
                           struct perf_event_attr *attr,
                           struct parse_events_term *term,
+                           struct list_head *head_terms,
                           bool zero)
 {
        struct perf_pmu_format *format;
        __u64 *vp;
+        __u64 val;
+        /*
+         * If this is a parameter we've already used for parameterized-eval,
+         * skip it in normal eval.
+         */
+        if (term->used)
+                return 0;
        /*
-         * Support only for hardcoded and numnerial terms.
         * Hardcoded terms should be already in, so nothing
         * to be done for them.
         */
        if (parse_events__is_hardcoded_term(term))
                return 0;
-        if (term->type_val != PARSE_EVENTS__TERM_TYPE_NUM)
-                return -EINVAL;
        format = pmu_find_format(formats, term->config);
-        if (!format)
+        if (!format) {
+                if (verbose)
+                        printf("Invalid event/parameter '%s'\n", term->config);
                return -EINVAL;
+        }
        switch (format->value) {
        case PERF_PMU_FORMAT_VALUE_CONFIG:
@@ -592,11 +629,25 @@ static int pmu_config_term(struct list_head *formats,
        }
        /*
-         * XXX If we ever decide to go with string values for
+         * Either directly use a numeric term, or try to translate string terms
-         * non-hardcoded terms, here's the place to translate
+         * using event parameters.
-         * them into value.
         */
-        pmu_format_value(format->bits, term->val.num, vp, zero);
+        if (term->type_val == PARSE_EVENTS__TERM_TYPE_NUM)
+                val = term->val.num;
+        else if (term->type_val == PARSE_EVENTS__TERM_TYPE_STR) {
+                if (strcmp(term->val.str, "?")) {
+                        if (verbose)
+                                pr_info("Invalid sysfs entry %s=%s\n",
+                                                term->config, term->val.str);
+                        return -EINVAL;
+                }
+                if (pmu_resolve_param_term(term, head_terms, &val))
+                        return -EINVAL;
+        } else
+                return -EINVAL;
+        pmu_format_value(format->bits, val, vp, zero);
        return 0;
 }
@@ -607,9 +658,10 @@ int perf_pmu__config_terms(struct list_head *formats,
 {
        struct parse_events_term *term;
-        list_for_each_entry(term, head_terms, list)
+        list_for_each_entry(term, head_terms, list) {
-                if (pmu_config_term(formats, attr, term, zero))
+                if (pmu_config_term(formats, attr, term, head_terms, zero))
                        return -EINVAL;
+        }
        return 0;
 }
@@ -767,10 +819,36 @@ void perf_pmu__set_format(unsigned long *bits, long from, long to)
                set_bit(b, bits);
 }
+static int sub_non_neg(int a, int b)
+{
+        if (b > a)
+                return 0;
+        return a - b;
+}
 static char *format_alias(char *buf, int len, struct perf_pmu *pmu,
                          struct perf_pmu_alias *alias)
 {
-        snprintf(buf, len, "%s/%s/", pmu->name, alias->name);
+        struct parse_events_term *term;
+        int used = snprintf(buf, len, "%s/%s", pmu->name, alias->name);
+        list_for_each_entry(term, &alias->terms, list) {
+                if (term->type_val == PARSE_EVENTS__TERM_TYPE_STR)
+                        used += snprintf(buf + used, sub_non_neg(len, used),
+                                        ",%s=%s", term->config,
+                                        term->val.str);
+        }
+        if (sub_non_neg(len, used) > 0) {
+                buf[used] = '/';
+                used++;
+        }
+        if (sub_non_neg(len, used) > 0) {
+                buf[used] = '\0';
+                used++;
+        } else
+                buf[len - 1] = '\0';
        return buf;
 }
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 28eb1417cb2a..919937eb0be2 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -446,7 +446,7 @@ static int post_process_probe_trace_events(struct probe_trace_event *tevs,
        }
        for (i = 0; i < ntevs; i++) {
-                if (tevs[i].point.address) {
+                if (tevs[i].point.address && !tevs[i].point.retprobe) {
                        tmp = strdup(reloc_sym->name);
                        if (!tmp)
                                return -ENOMEM;
@@ -495,9 +495,11 @@ static int try_to_find_probe_trace_events(struct perf_probe_event *pev,
        }
        if (ntevs == 0) {       /* No error but failed to find probe point. */
-                pr_warning("Probe point '%s' not found.\n",
+                pr_warning("Probe point '%s' not found in debuginfo.\n",
                           synthesize_perf_probe_point(&pev->point));
-                return -ENOENT;
+                if (need_dwarf)
+                        return -ENOENT;
+                return 0;
        }
        /* Error path : ntevs < 0 */
        pr_debug("An error occurred in debuginfo analysis (%d).\n", ntevs);
@@ -2050,9 +2052,11 @@ static int write_probe_trace_event(int fd, struct probe_trace_event *tev)
        pr_debug("Writing event: %s\n", buf);
        if (!probe_event_dry_run) {
                ret = write(fd, buf, strlen(buf));
-                if (ret <= 0)
+                if (ret <= 0) {
+                        ret = -errno;
                        pr_warning("Failed to write event: %s\n",
                                   strerror_r(errno, sbuf, sizeof(sbuf)));
+                }
        }
        free(buf);
        return ret;
@@ -2189,18 +2193,17 @@ static int __add_probe_trace_events(struct perf_probe_event *pev,
        return ret;
 }
-static char *looking_function_name;
+static int find_probe_functions(struct map *map, char *name)
-static int num_matched_functions;
-static int probe_function_filter(struct map *map __maybe_unused,
-                                      struct symbol *sym)
 {
-        if ((sym->binding == STB_GLOBAL || sym->binding == STB_LOCAL) &&
+        int found = 0;
-            strcmp(looking_function_name, sym->name) == 0) {
+        struct symbol *sym;
-                num_matched_functions++;
-                return 0;
+        map__for_each_symbol_by_name(map, name, sym) {
+                if (sym->binding == STB_GLOBAL || sym->binding == STB_LOCAL)
+                        found++;
        }
-        return 1;
+        return found;
 }
 #define strdup_or_goto(str, label)      \
@@ -2218,10 +2221,10 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
        struct kmap *kmap = NULL;
        struct ref_reloc_sym *reloc_sym = NULL;
        struct symbol *sym;
-        struct rb_node *nd;
        struct probe_trace_event *tev;
        struct perf_probe_point *pp = &pev->point;
        struct probe_trace_point *tp;
+        int num_matched_functions;
        int ret, i;
        /* Init maps of given executable or kernel */
@@ -2238,10 +2241,8 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
         * Load matched symbols: Since the different local symbols may have
         * same name but different addresses, this lists all the symbols.
         */
-        num_matched_functions = 0;
+        num_matched_functions = find_probe_functions(map, pp->function);
-        looking_function_name = pp->function;
+        if (num_matched_functions == 0) {
-        ret = map__load(map, probe_function_filter);
-        if (ret || num_matched_functions == 0) {
                pr_err("Failed to find symbol %s in %s\n", pp->function,
                        target ? : "kernel");
                ret = -ENOENT;
@@ -2253,7 +2254,7 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
                goto out;
        }
-        if (!pev->uprobes) {
+        if (!pev->uprobes && !pp->retprobe) {
                kmap = map__kmap(map);
                reloc_sym = kmap->ref_reloc_sym;
                if (!reloc_sym) {
@@ -2271,7 +2272,8 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
        }
        ret = 0;
-        map__for_each_symbol(map, sym, nd) {
+        map__for_each_symbol_by_name(map, pp->function, sym) {
                tev = (*tevs) + ret;
                tp = &tev->point;
                if (ret == num_matched_functions) {
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index c7918f83b300..b5247d777f0e 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -989,8 +989,24 @@ static int debuginfo__find_probes(struct debuginfo *dbg,
        int ret = 0;
 #if _ELFUTILS_PREREQ(0, 142)
+        Elf *elf;
+        GElf_Ehdr ehdr;
+        GElf_Shdr shdr;
        /* Get the call frame information from this dwarf */
-        pf->cfi = dwarf_getcfi_elf(dwarf_getelf(dbg->dbg));
+        elf = dwarf_getelf(dbg->dbg);
+        if (elf == NULL)
+                return -EINVAL;
+        if (gelf_getehdr(elf, &ehdr) == NULL)
+                return -EINVAL;
+        if (elf_section_by_name(elf, &ehdr, &shdr, ".eh_frame", NULL) &&
+            shdr.sh_type == SHT_PROGBITS) {
+                pf->cfi = dwarf_getcfi_elf(elf);
+        } else {
+                pf->cfi = dwarf_getcfi(dbg->dbg);
+        }
 #endif
        off = 0;
diff --git a/tools/perf/util/python-ext-sources b/tools/perf/util/python-ext-sources
index 16a475a7d492..6c6a6953fa93 100644
--- a/tools/perf/util/python-ext-sources
+++ b/tools/perf/util/python-ext-sources
@@ -10,7 +10,7 @@ util/ctype.c
 util/evlist.c
 util/evsel.c
 util/cpumap.c
-util/hweight.c
+../../lib/hweight.c
 util/thread_map.c
 util/util.c
 util/xyarray.c
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 3dda85ca50c1..d906d0ad5d40 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -768,7 +768,7 @@ static PyObject *pyrf_evlist__get_pollfd(struct pyrf_evlist *pevlist,
                        Py_DECREF(file);
                        goto free_list;
                }
-                        
                Py_DECREF(file);
        }
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index d808a328f4dc..0c815a40a6e8 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -89,7 +89,7 @@ static void handler_call_die(const char *handler_name)
 /*
 * Insert val into into the dictionary and decrement the reference counter.
- * This is necessary for dictionaries since PyDict_SetItemString() does not 
+ * This is necessary for dictionaries since PyDict_SetItemString() does not
 * steal a reference, as opposed to PyTuple_SetItem().
 */
 static void pydict_set_item_string_decref(PyObject *dict, const char *key, PyObject *val)
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 5f0e05a76c05..0baf75f12b7c 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -274,7 +274,7 @@ void perf_tool__fill_defaults(struct perf_tool *tool)
        if (tool->id_index == NULL)
                tool->id_index = process_id_index_stub;
 }
- 
 static void swap_sample_id_all(union perf_event *event, void *data)
 {
        void *end = (void *) event + event->header.size;
@@ -1251,9 +1251,9 @@ fetch_mmaped_event(struct perf_session *session,
 #define NUM_MMAPS 128
 #endif
-int __perf_session__process_events(struct perf_session *session,
+static int __perf_session__process_events(struct perf_session *session,
-                                   u64 data_offset, u64 data_size,
+                                          u64 data_offset, u64 data_size,
-                                   u64 file_size, struct perf_tool *tool)
+                                          u64 file_size, struct perf_tool *tool)
 {
        int fd = perf_data_file__fd(session->file);
        u64 head, page_offset, file_offset, file_pos, size;
diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h
index dc26ebf60fe4..6d663dc76404 100644
--- a/tools/perf/util/session.h
+++ b/tools/perf/util/session.h
@@ -49,9 +49,6 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset,
                             union perf_event **event_ptr,
                             struct perf_sample *sample);
-int __perf_session__process_events(struct perf_session *session,
-                                   u64 data_offset, u64 data_size, u64 size,
-                                   struct perf_tool *tool);
 int perf_session__process_events(struct perf_session *session,
                                 struct perf_tool *tool);
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index 9139dda9f9a3..7a39c1ed8d37 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -1304,6 +1304,37 @@ static int __sort__hpp_entry(struct perf_hpp_fmt *fmt, struct perf_hpp *hpp,
        return hse->se->se_snprintf(he, hpp->buf, hpp->size, len);
 }
+static int64_t __sort__hpp_cmp(struct perf_hpp_fmt *fmt,
+                               struct hist_entry *a, struct hist_entry *b)
+{
+        struct hpp_sort_entry *hse;
+        hse = container_of(fmt, struct hpp_sort_entry, hpp);
+        return hse->se->se_cmp(a, b);
+}
+static int64_t __sort__hpp_collapse(struct perf_hpp_fmt *fmt,
+                                    struct hist_entry *a, struct hist_entry *b)
+{
+        struct hpp_sort_entry *hse;
+        int64_t (*collapse_fn)(struct hist_entry *, struct hist_entry *);
+        hse = container_of(fmt, struct hpp_sort_entry, hpp);
+        collapse_fn = hse->se->se_collapse ?: hse->se->se_cmp;
+        return collapse_fn(a, b);
+}
+static int64_t __sort__hpp_sort(struct perf_hpp_fmt *fmt,
+                                struct hist_entry *a, struct hist_entry *b)
+{
+        struct hpp_sort_entry *hse;
+        int64_t (*sort_fn)(struct hist_entry *, struct hist_entry *);
+        hse = container_of(fmt, struct hpp_sort_entry, hpp);
+        sort_fn = hse->se->se_sort ?: hse->se->se_cmp;
+        return sort_fn(a, b);
+}
 static struct hpp_sort_entry *
 __sort_dimension__alloc_hpp(struct sort_dimension *sd)
 {
@@ -1322,9 +1353,9 @@ __sort_dimension__alloc_hpp(struct sort_dimension *sd)
        hse->hpp.entry = __sort__hpp_entry;
        hse->hpp.color = NULL;
-        hse->hpp.cmp = sd->entry->se_cmp;
+        hse->hpp.cmp = __sort__hpp_cmp;
-        hse->hpp.collapse = sd->entry->se_collapse ? : sd->entry->se_cmp;
+        hse->hpp.collapse = __sort__hpp_collapse;
-        hse->hpp.sort = sd->entry->se_sort ? : hse->hpp.collapse;
+        hse->hpp.sort = __sort__hpp_sort;
        INIT_LIST_HEAD(&hse->hpp.list);
        INIT_LIST_HEAD(&hse->hpp.sort_list);
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 06fcd1bf98b6..b24f9d8727a8 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -574,13 +574,16 @@ static int decompress_kmodule(struct dso *dso, const char *name,
        const char *ext = strrchr(name, '.');
        char tmpbuf[] = "/tmp/perf-kmod-XXXXXX";
-        if ((type != DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE_COMP &&
+        if (type != DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE_COMP &&
-             type != DSO_BINARY_TYPE__GUEST_KMODULE_COMP) ||
+            type != DSO_BINARY_TYPE__GUEST_KMODULE_COMP &&
-            type != dso->symtab_type)
+            type != DSO_BINARY_TYPE__BUILD_ID_CACHE)
                return -1;
-        if (!ext || !is_supported_compression(ext + 1))
+        if (!ext || !is_supported_compression(ext + 1)) {
-                return -1;
+                ext = strrchr(dso->name, '.');
+                if (!ext || !is_supported_compression(ext + 1))
+                        return -1;
+        }
        fd = mkstemp(tmpbuf);
        if (fd < 0)
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index c24c5b83156c..a69066865a55 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -396,6 +396,7 @@ static struct symbol *symbols__find_by_name(struct rb_root *symbols,
                                            const char *name)
 {
        struct rb_node *n;
+        struct symbol_name_rb_node *s;
        if (symbols == NULL)
                return NULL;
@@ -403,7 +404,6 @@ static struct symbol *symbols__find_by_name(struct rb_root *symbols,
        n = symbols->rb_node;
        while (n) {
-                struct symbol_name_rb_node *s;
                int cmp;
                s = rb_entry(n, struct symbol_name_rb_node, rb_node);
@@ -414,10 +414,24 @@ static struct symbol *symbols__find_by_name(struct rb_root *symbols,
                else if (cmp > 0)
                        n = n->rb_right;
                else
-                        return &s->sym;
+                        break;
        }
-        return NULL;
+        if (n == NULL)
+                return NULL;
+        /* return first symbol that has same name (if any) */
+        for (n = rb_prev(n); n; n = rb_prev(n)) {
+                struct symbol_name_rb_node *tmp;
+                tmp = rb_entry(n, struct symbol_name_rb_node, rb_node);
+                if (strcmp(tmp->sym.name, s->sym.name))
+                        break;
+                s = tmp;
+        }
+        return &s->sym;
 }
 struct symbol *dso__find_symbol(struct dso *dso,
@@ -436,6 +450,17 @@ struct symbol *dso__next_symbol(struct symbol *sym)
        return symbols__next(sym);
 }
+struct symbol *symbol__next_by_name(struct symbol *sym)
+{
+        struct symbol_name_rb_node *s = container_of(sym, struct symbol_name_rb_node, sym);
+        struct rb_node *n = rb_next(&s->rb_node);
+        return n ? &rb_entry(n, struct symbol_name_rb_node, rb_node)->sym : NULL;
+}
+ /*
+  * Teturns first symbol that matched with @name.
+  */
 struct symbol *dso__find_symbol_by_name(struct dso *dso, enum map_type type,
                                        const char *name)
 {
@@ -660,7 +685,7 @@ static int dso__split_kallsyms(struct dso *dso, struct map *map, u64 delta,
        struct machine *machine = kmaps->machine;
        struct map *curr_map = map;
        struct symbol *pos;
-        int count = 0, moved = 0;       
+        int count = 0, moved = 0;
        struct rb_root *root = &dso->symbols[map->type];
        struct rb_node *next = rb_first(root);
        int kernel_range = 0;
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 9d602e9c6f59..1650dcb3a67b 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -231,6 +231,7 @@ struct symbol *dso__find_symbol(struct dso *dso, enum map_type type,
                                u64 addr);
 struct symbol *dso__find_symbol_by_name(struct dso *dso, enum map_type type,
                                        const char *name);
+struct symbol *symbol__next_by_name(struct symbol *sym);
 struct symbol *dso__first_symbol(struct dso *dso, enum map_type type);
 struct symbol *dso__next_symbol(struct symbol *sym);
diff --git a/tools/perf/util/unwind-libunwind.c b/tools/perf/util/unwind-libunwind.c
index 371219a6daf1..e3c40a520a25 100644
--- a/tools/perf/util/unwind-libunwind.c
+++ b/tools/perf/util/unwind-libunwind.c
@@ -185,6 +185,28 @@ static u64 elf_section_offset(int fd, const char *name)
        return offset;
 }
+#ifndef NO_LIBUNWIND_DEBUG_FRAME
+static int elf_is_exec(int fd, const char *name)
+{
+        Elf *elf;
+        GElf_Ehdr ehdr;
+        int retval = 0;
+        elf = elf_begin(fd, PERF_ELF_C_READ_MMAP, NULL);
+        if (elf == NULL)
+                return 0;
+        if (gelf_getehdr(elf, &ehdr) == NULL)
+                goto out;
+        retval = (ehdr.e_type == ET_EXEC);
+out:
+        elf_end(elf);
+        pr_debug("unwind: elf_is_exec(%s): %d\n", name, retval);
+        return retval;
+}
+#endif
 struct table_entry {
        u32 start_ip_offset;
        u32 fde_offset;
@@ -244,14 +266,17 @@ static int read_unwind_spec_eh_frame(struct dso *dso, struct machine *machine,
                                     u64 *fde_count)
 {
        int ret = -EINVAL, fd;
-        u64 offset;
+        u64 offset = dso->data.frame_offset;
-        fd = dso__data_fd(dso, machine);
+        if (offset == 0) {
-        if (fd < 0)
+                fd = dso__data_fd(dso, machine);
-                return -EINVAL;
+                if (fd < 0)
+                        return -EINVAL;
-        /* Check the .eh_frame section for unwinding info */
+                /* Check the .eh_frame section for unwinding info */
-        offset = elf_section_offset(fd, ".eh_frame_hdr");
+                offset = elf_section_offset(fd, ".eh_frame_hdr");
+                dso->data.frame_offset = offset;
+        }
        if (offset)
                ret = unwind_spec_ehframe(dso, machine, offset,
@@ -265,14 +290,20 @@ static int read_unwind_spec_eh_frame(struct dso *dso, struct machine *machine,
 static int read_unwind_spec_debug_frame(struct dso *dso,
                                        struct machine *machine, u64 *offset)
 {
-        int fd = dso__data_fd(dso, machine);
+        int fd;
+        u64 ofs = dso->data.frame_offset;
-        if (fd < 0)
+        if (ofs == 0) {
-                return -EINVAL;
+                fd = dso__data_fd(dso, machine);
+                if (fd < 0)
+                        return -EINVAL;
-        /* Check the .debug_frame section for unwinding info */
+                /* Check the .debug_frame section for unwinding info */
-        *offset = elf_section_offset(fd, ".debug_frame");
+                ofs = elf_section_offset(fd, ".debug_frame");
+                dso->data.frame_offset = ofs;
+        }
+        *offset = ofs;
        if (*offset)
                return 0;
@@ -322,8 +353,12 @@ find_proc_info(unw_addr_space_t as, unw_word_t ip, unw_proc_info_t *pi,
 #ifndef NO_LIBUNWIND_DEBUG_FRAME
        /* Check the .debug_frame section for unwinding info */
        if (!read_unwind_spec_debug_frame(map->dso, ui->machine, &segbase)) {
+                int fd = dso__data_fd(map->dso, ui->machine);
+                int is_exec = elf_is_exec(fd, map->dso->name);
+                unw_word_t base = is_exec ? 0 : map->start;
                memset(&di, 0, sizeof(di));
-                if (dwarf_find_debug_frame(0, &di, ip, 0, map->dso->name,
+                if (dwarf_find_debug_frame(0, &di, ip, base, map->dso->name,
                                           map->start, map->end))
                        return dwarf_search_unwind_table(as, ip, &di, pi,
                                                         need_unwind_info, arg);
diff --git a/tools/power/cpupower/utils/cpupower.c b/tools/power/cpupower/utils/cpupower.c
index 7cdcf88659c7..9ea914378985 100644
--- a/tools/power/cpupower/utils/cpupower.c
+++ b/tools/power/cpupower/utils/cpupower.c
@@ -199,7 +199,7 @@ int main(int argc, const char *argv[])
        }
        get_cpu_info(0, &cpupower_cpu_info);
-        run_as_root = !getuid();
+        run_as_root = !geteuid();
        if (run_as_root) {
                ret = uname(&uts);
                if (!ret && !strcmp(uts.machine, "x86_64") &&
diff --git a/tools/power/cpupower/utils/helpers/sysfs.c b/tools/power/cpupower/utils/helpers/sysfs.c
index 09afe5d87f2b..4e8fe2c7b054 100644
--- a/tools/power/cpupower/utils/helpers/sysfs.c
+++ b/tools/power/cpupower/utils/helpers/sysfs.c
@@ -361,7 +361,7 @@ unsigned int sysfs_get_idlestate_count(unsigned int cpu)
        snprintf(file, SYSFS_PATH_MAX, PATH_TO_CPU "cpuidle");
        if (stat(file, &statbuf) != 0 || !S_ISDIR(statbuf.st_mode))
-                return -ENODEV;
+                return 0;
        snprintf(file, SYSFS_PATH_MAX, PATH_TO_CPU "cpu%u/cpuidle/state0", cpu);
        if (stat(file, &statbuf) != 0 || !S_ISDIR(statbuf.st_mode))
diff --git a/tools/testing/selftests/exec/execveat.c b/tools/testing/selftests/exec/execveat.c
index 33a5c06d95ca..e238c9559caf 100644
--- a/tools/testing/selftests/exec/execveat.c
+++ b/tools/testing/selftests/exec/execveat.c
@@ -62,7 +62,7 @@ static int _check_execveat_fail(int fd, const char *path, int flags,
 }
 static int check_execveat_invoked_rc(int fd, const char *path, int flags,
-                                     int expected_rc)
+                                     int expected_rc, int expected_rc2)
 {
        int status;
        int rc;
@@ -98,9 +98,10 @@ static int check_execveat_invoked_rc(int fd, const char *path, int flags,
                        child, status);
                return 1;
        }
-        if (WEXITSTATUS(status) != expected_rc) {
+        if ((WEXITSTATUS(status) != expected_rc) &&
-                printf("[FAIL] (child %d exited with %d not %d)\n",
+            (WEXITSTATUS(status) != expected_rc2)) {
-                        child, WEXITSTATUS(status), expected_rc);
+                printf("[FAIL] (child %d exited with %d not %d nor %d)\n",
+                        child, WEXITSTATUS(status), expected_rc, expected_rc2);
                return 1;
        }
        printf("[OK]\n");
@@ -109,7 +110,7 @@ static int check_execveat_invoked_rc(int fd, const char *path, int flags,
 static int check_execveat(int fd, const char *path, int flags)
 {
-        return check_execveat_invoked_rc(fd, path, flags, 99);
+        return check_execveat_invoked_rc(fd, path, flags, 99, 99);
 }
 static char *concat(const char *left, const char *right)
@@ -179,11 +180,11 @@ static int check_execveat_pathmax(int dot_dfd, const char *src, int is_script)
         */
        fd = open(longpath, O_RDONLY);
        if (fd > 0) {
-                printf("Invoke copy of '%s' via filename of length %lu:\n",
+                printf("Invoke copy of '%s' via filename of length %zu:\n",
                        src, strlen(longpath));
                fail += check_execveat(fd, "", AT_EMPTY_PATH);
        } else {
-                printf("Failed to open length %lu filename, errno=%d (%s)\n",
+                printf("Failed to open length %zu filename, errno=%d (%s)\n",
                        strlen(longpath), errno, strerror(errno));
                fail++;
        }
@@ -192,9 +193,15 @@ static int check_execveat_pathmax(int dot_dfd, const char *src, int is_script)
         * Execute as a long pathname relative to ".".  If this is a script,
         * the interpreter will launch but fail to open the script because its
         * name ("/dev/fd/5/xxx....") is bigger than PATH_MAX.
+         *
+         * The failure code is usually 127 (POSIX: "If a command is not found,
+         * the exit status shall be 127."), but some systems give 126 (POSIX:
+         * "If the command name is found, but it is not an executable utility,
+         * the exit status shall be 126."), so allow either.
         */
        if (is_script)
-                fail += check_execveat_invoked_rc(dot_dfd, longpath, 0, 127);
+                fail += check_execveat_invoked_rc(dot_dfd, longpath, 0,
+                                                  127, 126);
        else
                fail += check_execveat(dot_dfd, longpath, 0);
diff --git a/tools/testing/selftests/mqueue/mq_perf_tests.c b/tools/testing/selftests/mqueue/mq_perf_tests.c
index 94dae65eea41..8519e9ee97e3 100644
--- a/tools/testing/selftests/mqueue/mq_perf_tests.c
+++ b/tools/testing/selftests/mqueue/mq_perf_tests.c
@@ -536,10 +536,9 @@ int main(int argc, char *argv[])
 {
        struct mq_attr attr;
        char *option, *next_option;
-        int i, cpu;
+        int i, cpu, rc;
        struct sigaction sa;
        poptContext popt_context;
-        char rc;
        void *retval;
        main_thread = pthread_self();
diff --git a/tools/testing/selftests/rcutorture/bin/cpus2use.sh b/tools/testing/selftests/rcutorture/bin/cpus2use.sh
index abe14b7f36e9..bb99cde3f5f9 100755
--- a/tools/testing/selftests/rcutorture/bin/cpus2use.sh
+++ b/tools/testing/selftests/rcutorture/bin/cpus2use.sh
@@ -24,7 +24,7 @@
 ncpus=`grep '^processor' /proc/cpuinfo | wc -l`
 idlecpus=`mpstat | tail -1 | \
-        awk -v ncpus=$ncpus '{ print ncpus * ($7 + $12) / 100 }'`
+        awk -v ncpus=$ncpus '{ print ncpus * ($7 + $NF) / 100 }'`
 awk -v ncpus=$ncpus -v idlecpus=$idlecpus < /dev/null '
 BEGIN {
        cpus2use = idlecpus;
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcu.sh b/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcu.sh
index d6cc07fc137f..559e01ac86be 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcu.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcu.sh
@@ -30,6 +30,7 @@ else
        echo Unreadable results directory: $i
        exit 1
 fi
+. tools/testing/selftests/rcutorture/bin/functions.sh
 configfile=`echo $i | sed -e 's/^.*\///'`
 ngps=`grep ver: $i/console.log 2> /dev/null | tail -1 | sed -e 's/^.* ver: //' -e 's/ .*$//'`
@@ -48,4 +49,21 @@ else
                title="$title ($ngpsps per second)"
        fi
        echo $title
+        nclosecalls=`grep --binary-files=text 'torture: Reader Batch' $i/console.log | tail -1 | awk '{for (i=NF-8;i<=NF;i++) sum+=$i; } END {print sum}'`
+        if test -z "$nclosecalls"
+        then
+                exit 0
+        fi
+        if test "$nclosecalls" -eq 0
+        then
+                exit 0
+        fi
+        # Compute number of close calls per tenth of an hour
+        nclosecalls10=`awk -v nclosecalls=$nclosecalls -v dur=$dur 'BEGIN { print int(nclosecalls * 36000 / dur) }' < /dev/null`
+        if test $nclosecalls10 -gt 5 -a $nclosecalls -gt 1
+        then
+                print_bug $nclosecalls "Reader Batch close calls in" $(($dur/60)) minute run: $i
+        else
+                print_warning $nclosecalls "Reader Batch close calls in" $(($dur/60)) minute run: $i
+        fi
 fi
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh b/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
index 8ca9f21f2efc..5236e073919d 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
@@ -8,9 +8,9 @@
 #
 # Usage: kvm-test-1-run.sh config builddir resdir minutes qemu-args boot_args
 #
-# qemu-args defaults to "-nographic", along with arguments specifying the
+# qemu-args defaults to "-enable-kvm -soundhw pcspk -nographic", along with
-#                       number of CPUs and other options generated from
+#                       arguments specifying the number of CPUs and other
-#                       the underlying CPU architecture.
+#                       options generated from the underlying CPU architecture.
 # boot_args defaults to value returned by the per_version_boot_params
 #                       shell function.
 #
@@ -138,7 +138,7 @@ then
 fi
 # Generate -smp qemu argument.
-qemu_args="-nographic $qemu_args"
+qemu_args="-enable-kvm -soundhw pcspk -nographic $qemu_args"
 cpu_count=`configNR_CPUS.sh $config_template`
 cpu_count=`configfrag_boot_cpus "$boot_args" "$config_template" "$cpu_count"`
 vcpus=`identify_qemu_vcpus`
@@ -168,6 +168,7 @@ then
        touch $resdir/buildonly
        exit 0
 fi
+echo "NOTE: $QEMU either did not run or was interactive" > $builddir/console.log
 echo $QEMU $qemu_args -m 512 -kernel $resdir/bzImage -append \"$qemu_append $boot_args\" > $resdir/qemu-cmd
 ( $QEMU $qemu_args -m 512 -kernel $resdir/bzImage -append "$qemu_append $boot_args"; echo $? > $resdir/qemu-retval ) &
 qemu_pid=$!
diff --git a/tools/testing/selftests/rcutorture/bin/parse-build.sh b/tools/testing/selftests/rcutorture/bin/parse-build.sh
index 499d1e598e42..a6b57622c2e5 100755
--- a/tools/testing/selftests/rcutorture/bin/parse-build.sh
+++ b/tools/testing/selftests/rcutorture/bin/parse-build.sh
@@ -26,12 +26,15 @@
 #
 # Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
-T=$1
+F=$1
 title=$2
+T=/tmp/parse-build.sh.$$
+trap 'rm -rf $T' 0
+mkdir $T
 . functions.sh
-if grep -q CC < $T
+if grep -q CC < $F
 then
        :
 else
@@ -39,18 +42,21 @@ else
        exit 1
 fi
-if grep -q "error:" < $T
+if grep -q "error:" < $F
 then
        print_bug $title build errors:
-        grep "error:" < $T
+        grep "error:" < $F
        exit 2
 fi
-exit 0
-if egrep -q "rcu[^/]*\.c.*warning:|rcu.*\.h.*warning:" < $T
+grep warning: < $F > $T/warnings
+grep "include/linux/*rcu*\.h:" $T/warnings > $T/hwarnings
+grep "kernel/rcu/[^/]*:" $T/warnings > $T/cwarnings
+cat $T/hwarnings $T/cwarnings > $T/rcuwarnings
+if test -s $T/rcuwarnings
 then
        print_warning $title build errors:
-        egrep "rcu[^/]*\.c.*warning:|rcu.*\.h.*warning:" < $T
+        cat $T/rcuwarnings
        exit 2
 fi
 exit 0
diff --git a/tools/testing/selftests/rcutorture/bin/parse-console.sh b/tools/testing/selftests/rcutorture/bin/parse-console.sh
index f962ba4cf68b..d8f35cf116be 100755
--- a/tools/testing/selftests/rcutorture/bin/parse-console.sh
+++ b/tools/testing/selftests/rcutorture/bin/parse-console.sh
@@ -36,7 +36,7 @@ if grep -Pq '\x00' < $file
 then
        print_warning Console output contains nul bytes, old qemu still running?
 fi
-egrep 'Badness|WARNING:|Warn|BUG|===========|Call Trace:|Oops:' < $file | grep -v 'ODEBUG: ' | grep -v 'Warning: unable to open an initial console' > $T
+egrep 'Badness|WARNING:|Warn|BUG|===========|Call Trace:|Oops:|Stall ended before state dump start' < $file | grep -v 'ODEBUG: ' | grep -v 'Warning: unable to open an initial console' > $T
 if test -s $T
 then
        print_warning Assertion failure in $file $title
diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
index 4c4b1f631ecf..077828c889f1 100644
--- a/tools/testing/selftests/vm/Makefile
+++ b/tools/testing/selftests/vm/Makefile
@@ -7,7 +7,7 @@ BINARIES += transhuge-stress
 all: $(BINARIES)
 %: %.c
-        $(CC) $(CFLAGS) -o $@ $^
+        $(CC) $(CFLAGS) -o $@ $^ -lrt
 run_tests: all
        @/bin/sh ./run_vmtests || (echo "vmtests: [FAIL]"; exit 1)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index f5283438ee05..1cc6e2e19982 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -671,6 +671,7 @@ static void update_memslots(struct kvm_memslots *slots,
        WARN_ON(mslots[i].id != id);
        if (!new->npages) {
+                WARN_ON(!mslots[i].npages);
                new->base_gfn = 0;
                if (mslots[i].npages)
                        slots->used_slots--;
@@ -687,12 +688,25 @@ static void update_memslots(struct kvm_memslots *slots,
                slots->id_to_index[mslots[i].id] = i;
                i++;
        }
-        while (i > 0 &&
-               new->base_gfn > mslots[i - 1].base_gfn) {
+        /*
-                mslots[i] = mslots[i - 1];
+         * The ">=" is needed when creating a slot with base_gfn == 0,
-                slots->id_to_index[mslots[i].id] = i;
+         * so that it moves before all those with base_gfn == npages == 0.
-                i--;
+         *
-        }
+         * On the other hand, if new->npages is zero, the above loop has
+         * already left i pointing to the beginning of the empty part of
+         * mslots, and the ">=" would move the hole backwards in this
+         * case---which is wrong.  So skip the loop when deleting a slot.
+         */
+        if (new->npages) {
+                while (i > 0 &&
+                       new->base_gfn >= mslots[i - 1].base_gfn) {
+                        mslots[i] = mslots[i - 1];
+                        slots->id_to_index[mslots[i].id] = i;
+                        i--;
+                }
+        } else
+                WARN_ON_ONCE(i != slots->used_slots);
        mslots[i] = *new;
        slots->id_to_index[mslots[i].id] = i;