Merge 4.4-rc6 into tty-next

We want the serial/tty fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

263 files changed, 2272 insertions, 1236 deletions

diff --git a/Documentation/devicetree/bindings/dma/ti-edma.txt b/Documentation/devicetree/bindings/dma/ti-edma.txt
index d3d0a4fb1c73..079b42a81d7c 100644
--- a/Documentation/devicetree/bindings/dma/ti-edma.txt
+++ b/Documentation/devicetree/bindings/dma/ti-edma.txt
@@ -22,8 +22,7 @@ Required properties:
 Optional properties:
 - ti,hwmods:    Name of the hwmods associated to the eDMA CC
 - ti,edma-memcpy-channels: List of channels allocated to be used for memcpy, iow
-                these channels will be SW triggered channels. The list must
-                contain 16 bits numbers, see example.
+                these channels will be SW triggered channels. See example.
 - ti,edma-reserved-slot-ranges: PaRAM slot ranges which should not be used by
                 the driver, they are allocated to be used by for example the
                 DSP. See example.
@@ -56,10 +55,9 @@ edma: edma@49000000 {
         ti,tptcs = <&edma_tptc0 7>, <&edma_tptc1 7>, <&edma_tptc2 0>;
 
         /* Channel 20 and 21 is allocated for memcpy */
-        ti,edma-memcpy-channels = /bits/ 16 <20 21>;
-        /* The following PaRAM slots are reserved: 35-45 and 100-110 */
-        ti,edma-reserved-slot-ranges = /bits/ 16 <35 10>,
-                                       /bits/ 16 <100 10>;
+        ti,edma-memcpy-channels = <20 21>;
+        /* The following PaRAM slots are reserved: 35-44 and 100-109 */
+        ti,edma-reserved-slot-ranges = <35 10>, <100 10>;
 };
 
 edma_tptc0: tptc@49800000 {
diff --git a/Documentation/devicetree/bindings/input/sun4i-lradc-keys.txt b/Documentation/devicetree/bindings/input/sun4i-lradc-keys.txt
index b9c32f6fd687..4357e498ef04 100644
--- a/Documentation/devicetree/bindings/input/sun4i-lradc-keys.txt
+++ b/Documentation/devicetree/bindings/input/sun4i-lradc-keys.txt
@@ -12,7 +12,7 @@ Each key is represented as a sub-node of "allwinner,sun4i-a10-lradc-keys":
 Required subnode-properties:
         - label: Descriptive name of the key.
         - linux,code: Keycode to emit.
-        - channel: Channel this key is attached to, mut be 0 or 1.
+        - channel: Channel this key is attached to, must be 0 or 1.
         - voltage: Voltage in µV at lradc input when this key is pressed.
 
 Example:
diff --git a/Documentation/devicetree/bindings/mtd/partition.txt b/Documentation/devicetree/bindings/mtd/partition.txt
index f1e2a02381a4..1c63e40659fc 100644
--- a/Documentation/devicetree/bindings/mtd/partition.txt
+++ b/Documentation/devicetree/bindings/mtd/partition.txt
@@ -6,7 +6,9 @@ used for what purposes, but which don't use an on-flash partition table such
 as RedBoot.
 
 The partition table should be a subnode of the mtd node and should be named
-'partitions'. Partitions are defined in subnodes of the partitions node.
+'partitions'. This node should have the following property:
+- compatible : (required) must be "fixed-partitions"
+Partitions are then defined in subnodes of the partitions node.
 
 For backwards compatibility partitions as direct subnodes of the mtd device are
 supported. This use is discouraged.
@@ -36,6 +38,7 @@ Examples:
 
 flash@0 {
         partitions {
+                compatible = "fixed-partitions";
                 #address-cells = <1>;
                 #size-cells = <1>;
 
@@ -53,6 +56,7 @@ flash@0 {
 
 flash@1 {
         partitions {
+                compatible = "fixed-partitions";
                 #address-cells = <1>;
                 #size-cells = <2>;
 
@@ -66,6 +70,7 @@ flash@1 {
 
 flash@2 {
         partitions {
+                compatible = "fixed-partitions";
                 #address-cells = <2>;
                 #size-cells = <2>;
 
diff --git a/Documentation/networking/e100.txt b/Documentation/networking/e100.txt
index f862cf3aff34..42ddbd4b52a9 100644
--- a/Documentation/networking/e100.txt
+++ b/Documentation/networking/e100.txt
@@ -181,17 +181,3 @@ For general information, go to the Intel support website at:
 If an issue is identified with the released source code on the supported
 kernel with a supported adapter, email the specific information related to the
 issue to e1000-devel@lists.sourceforge.net.
-
-
-License
-=======
-
-This software program is released under the terms of a license agreement
-between you ('Licensee') and Intel. Do not use or load this software or any
-associated materials (collectively, the 'Software') until you have carefully
-read the full terms and conditions of the file COPYING located in this software
-package. By loading or using the Software, you agree to the terms of this
-Agreement. If you do not agree with the terms of this Agreement, do not install
-or use the Software.
-
-* Other names and brands may be claimed as the property of others.
diff --git a/MAINTAINERS b/MAINTAINERS
index 9bff63cf326e..233f83464814 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5578,7 +5578,7 @@ R:	Jesse Brandeburg <jesse.brandeburg@intel.com>
 R:      Shannon Nelson <shannon.nelson@intel.com>
 R:      Carolyn Wyborny <carolyn.wyborny@intel.com>
 R:      Don Skidmore <donald.c.skidmore@intel.com>
-R:      Matthew Vick <matthew.vick@intel.com>
+R:      Bruce Allan <bruce.w.allan@intel.com>
 R:      John Ronciak <john.ronciak@intel.com>
 R:      Mitch Williams <mitch.a.williams@intel.com>
 L:      intel-wired-lan@lists.osuosl.org
@@ -8380,6 +8380,14 @@ L:	linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
 F:      drivers/pinctrl/samsung/
 
+PIN CONTROLLER - SINGLE
+M:      Tony Lindgren <tony@atomide.com>
+M:      Haojian Zhuang <haojian.zhuang@linaro.org>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+L:      linux-omap@vger.kernel.org
+S:      Maintained
+F:      drivers/pinctrl/pinctrl-single.c
+
 PIN CONTROLLER - ST SPEAR
 M:      Viresh Kumar <vireshk@kernel.org>
 L:      spear-devel@list.st.com
@@ -8946,6 +8954,13 @@ F:	drivers/rpmsg/
 F:      Documentation/rpmsg.txt
 F:      include/linux/rpmsg.h
 
+RENESAS ETHERNET DRIVERS
+R:      Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+L:      netdev@vger.kernel.org
+L:      linux-sh@vger.kernel.org
+F:      drivers/net/ethernet/renesas/
+F:      include/linux/sh_eth.h
+
 RESET CONTROLLER FRAMEWORK
 M:      Philipp Zabel <p.zabel@pengutronix.de>
 S:      Maintained
diff --git a/Makefile b/Makefile
index bc0165d0f5cf..4e2b18d56091 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 4
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Blurry Fish Butt
 
 # *DOCUMENTATION*
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 2c2ac3f3ff80..6312f607932f 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -445,6 +445,7 @@ config LINUX_LINK_BASE
           However some customers have peripherals mapped at this addr, so
           Linux needs to be scooted a bit.
           If you don't know what the above means, leave this setting alone.
+          This needs to match memory start address specified in Device Tree
 
 config HIGHMEM
         bool "High Memory Support"
diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi
index f3db32154973..44a578c10732 100644
--- a/arch/arc/boot/dts/axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/axs10x_mb.dtsi
@@ -46,6 +46,7 @@
                         snps,pbl = < 32 >;
                         clocks = <&apbclk>;
                         clock-names = "stmmaceth";
+                        max-speed = <100>;
                 };
 
                 ehci@0x40000 {
diff --git a/arch/arc/boot/dts/nsim_hs.dts b/arch/arc/boot/dts/nsim_hs.dts
index b0eb0e7fe21d..fc81879bc1f5 100644
--- a/arch/arc/boot/dts/nsim_hs.dts
+++ b/arch/arc/boot/dts/nsim_hs.dts
@@ -17,7 +17,8 @@
 
         memory {
                 device_type = "memory";
-                reg = <0x0 0x80000000 0x0 0x40000000    /* 1 GB low mem */
+                /* CONFIG_LINUX_LINK_BASE needs to match low mem start */
+                reg = <0x0 0x80000000 0x0 0x20000000    /* 512 MB low mem */
                        0x1 0x00000000 0x0 0x40000000>;  /* 1 GB highmem */
         };
 
diff --git a/arch/arc/include/asm/mach_desc.h b/arch/arc/include/asm/mach_desc.h
index 6ff657a904b6..c28e6c347b49 100644
--- a/arch/arc/include/asm/mach_desc.h
+++ b/arch/arc/include/asm/mach_desc.h
@@ -23,7 +23,7 @@
  * @dt_compat:          Array of device tree 'compatible' strings
  *                      (XXX: although only 1st entry is looked at)
  * @init_early:         Very early callback [called from setup_arch()]
- * @init_cpu_smp:       for each CPU as it is coming up (SMP as well as UP)
+ * @init_per_cpu:       for each CPU as it is coming up (SMP as well as UP)
  *                      [(M):init_IRQ(), (o):start_kernel_secondary()]
  * @init_machine:       arch initcall level callback (e.g. populate static
  *                      platform devices or parse Devicetree)
@@ -35,7 +35,7 @@ struct machine_desc {
         const char              **dt_compat;
         void                    (*init_early)(void);
 #ifdef CONFIG_SMP
-        void                    (*init_cpu_smp)(unsigned int);
+        void                    (*init_per_cpu)(unsigned int);
 #endif
         void                    (*init_machine)(void);
         void                    (*init_late)(void);
diff --git a/arch/arc/include/asm/smp.h b/arch/arc/include/asm/smp.h
index 133c867d15af..991380438d6b 100644
--- a/arch/arc/include/asm/smp.h
+++ b/arch/arc/include/asm/smp.h
@@ -48,7 +48,7 @@ extern int smp_ipi_irq_setup(int cpu, int irq);
  * @init_early_smp:     A SMP specific h/w block can init itself
  *                      Could be common across platforms so not covered by
  *                      mach_desc->init_early()
- * @init_irq_cpu:       Called for each core so SMP h/w block driver can do
+ * @init_per_cpu:       Called for each core so SMP h/w block driver can do
  *                      any needed setup per cpu (e.g. IPI request)
  * @cpu_kick:           For Master to kickstart a cpu (optionally at a PC)
  * @ipi_send:           To send IPI to a @cpu
@@ -57,7 +57,7 @@ extern int smp_ipi_irq_setup(int cpu, int irq);
 struct plat_smp_ops {
         const char      *info;
         void            (*init_early_smp)(void);
-        void            (*init_irq_cpu)(int cpu);
+        void            (*init_per_cpu)(int cpu);
         void            (*cpu_kick)(int cpu, unsigned long pc);
         void            (*ipi_send)(int cpu);
         void            (*ipi_clear)(int irq);
diff --git a/arch/arc/include/asm/unwind.h b/arch/arc/include/asm/unwind.h
index 7ca628b6ee2a..c11a25bb8158 100644
--- a/arch/arc/include/asm/unwind.h
+++ b/arch/arc/include/asm/unwind.h
@@ -112,7 +112,6 @@ struct unwind_frame_info {
 
 extern int arc_unwind(struct unwind_frame_info *frame);
 extern void arc_unwind_init(void);
-extern void arc_unwind_setup(void);
 extern void *unwind_add_table(struct module *module, const void *table_start,
                               unsigned long table_size);
 extern void unwind_remove_table(void *handle, int init_only);
@@ -152,9 +151,6 @@ static inline void arc_unwind_init(void)
 {
 }
 
-static inline void arc_unwind_setup(void)
-{
-}
 #define unwind_add_table(a, b, c)
 #define unwind_remove_table(a, b)
 
diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c
index 26c156827479..0394f9f61b46 100644
--- a/arch/arc/kernel/intc-arcv2.c
+++ b/arch/arc/kernel/intc-arcv2.c
@@ -106,10 +106,21 @@ static struct irq_chip arcv2_irq_chip = {
 static int arcv2_irq_map(struct irq_domain *d, unsigned int irq,
                          irq_hw_number_t hw)
 {
-        if (irq == TIMER0_IRQ || irq == IPI_IRQ)
+        /*
+         * core intc IRQs [16, 23]:
+         * Statically assigned always private-per-core (Timers, WDT, IPI, PCT)
+         */
+        if (hw < 24) {
+                /*
+                 * A subsequent request_percpu_irq() fails if percpu_devid is
+                 * not set. That in turns sets NOAUTOEN, meaning each core needs
+                 * to call enable_percpu_irq()
+                 */
+                irq_set_percpu_devid(irq);
                 irq_set_chip_and_handler(irq, &arcv2_irq_chip, handle_percpu_irq);
-        else
+        } else {
                 irq_set_chip_and_handler(irq, &arcv2_irq_chip, handle_level_irq);
+        }
 
         return 0;
 }
diff --git a/arch/arc/kernel/irq.c b/arch/arc/kernel/irq.c
index 2ee226546c6a..ba17f85285cf 100644
--- a/arch/arc/kernel/irq.c
+++ b/arch/arc/kernel/irq.c
@@ -29,11 +29,11 @@ void __init init_IRQ(void)
 
 #ifdef CONFIG_SMP
         /* a SMP H/w block could do IPI IRQ request here */
-        if (plat_smp_ops.init_irq_cpu)
-                plat_smp_ops.init_irq_cpu(smp_processor_id());
+        if (plat_smp_ops.init_per_cpu)
+                plat_smp_ops.init_per_cpu(smp_processor_id());
 
-        if (machine_desc->init_cpu_smp)
-                machine_desc->init_cpu_smp(smp_processor_id());
+        if (machine_desc->init_per_cpu)
+                machine_desc->init_per_cpu(smp_processor_id());
 #endif
 }
 
@@ -51,6 +51,18 @@ void arch_do_IRQ(unsigned int irq, struct pt_regs *regs)
         set_irq_regs(old_regs);
 }
 
+/*
+ * API called for requesting percpu interrupts - called by each CPU
+ *  - For boot CPU, actually request the IRQ with genirq core + enables
+ *  - For subsequent callers only enable called locally
+ *
+ * Relies on being called by boot cpu first (i.e. request called ahead) of
+ * any enable as expected by genirq. Hence Suitable only for TIMER, IPI
+ * which are guaranteed to be setup on boot core first.
+ * Late probed peripherals such as perf can't use this as there no guarantee
+ * of being called on boot CPU first.
+ */
+
 void arc_request_percpu_irq(int irq, int cpu,
                             irqreturn_t (*isr)(int irq, void *dev),
                             const char *irq_nm,
@@ -60,14 +72,17 @@ void arc_request_percpu_irq(int irq, int cpu,
         if (!cpu) {
                 int rc;
 
+#ifdef CONFIG_ISA_ARCOMPACT
                 /*
-                 * These 2 calls are essential to making percpu IRQ APIs work
-                 * Ideally these details could be hidden in irq chip map function
-                 * but the issue is IPIs IRQs being static (non-DT) and platform
-                 * specific, so we can't identify them there.
+                 * A subsequent request_percpu_irq() fails if percpu_devid is
+                 * not set. That in turns sets NOAUTOEN, meaning each core needs
+                 * to call enable_percpu_irq()
+                 *
+                 * For ARCv2, this is done in irq map function since we know
+                 * which irqs are strictly per cpu
                  */
                 irq_set_percpu_devid(irq);
-                irq_modify_status(irq, IRQ_NOAUTOEN, 0);  /* @irq, @clr, @set */
+#endif
 
                 rc = request_percpu_irq(irq, isr, irq_nm, percpu_dev);
                 if (rc)
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index 74a9b074ac3e..bd237acdf4f2 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -132,7 +132,7 @@ static void mcip_probe_n_setup(void)
 struct plat_smp_ops plat_smp_ops = {
         .info           = smp_cpuinfo_buf,
         .init_early_smp = mcip_probe_n_setup,
-        .init_irq_cpu   = mcip_setup_per_cpu,
+        .init_per_cpu   = mcip_setup_per_cpu,
         .ipi_send       = mcip_ipi_send,
         .ipi_clear      = mcip_ipi_clear,
 };
diff --git a/arch/arc/kernel/perf_event.c b/arch/arc/kernel/perf_event.c
index 0c08bb1ce15a..8b134cfe5e1f 100644
--- a/arch/arc/kernel/perf_event.c
+++ b/arch/arc/kernel/perf_event.c
@@ -428,12 +428,11 @@ static irqreturn_t arc_pmu_intr(int irq, void *dev)
 
 #endif /* CONFIG_ISA_ARCV2 */
 
-void arc_cpu_pmu_irq_init(void)
+static void arc_cpu_pmu_irq_init(void *data)
 {
-        struct arc_pmu_cpu *pmu_cpu = this_cpu_ptr(&arc_pmu_cpu);
+        int irq = *(int *)data;
 
-        arc_request_percpu_irq(arc_pmu->irq, smp_processor_id(), arc_pmu_intr,
-                               "ARC perf counters", pmu_cpu);
+        enable_percpu_irq(irq, IRQ_TYPE_NONE);
 
         /* Clear all pending interrupt flags */
         write_aux_reg(ARC_REG_PCT_INT_ACT, 0xffffffff);
@@ -515,7 +514,6 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
 
         if (has_interrupts) {
                 int irq = platform_get_irq(pdev, 0);
-                unsigned long flags;
 
                 if (irq < 0) {
                         pr_err("Cannot get IRQ number for the platform\n");
@@ -524,24 +522,12 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
 
                 arc_pmu->irq = irq;
 
-                /*
-                 * arc_cpu_pmu_irq_init() needs to be called on all cores for
-                 * their respective local PMU.
-                 * However we use opencoded on_each_cpu() to ensure it is called
-                 * on core0 first, so that arc_request_percpu_irq() sets up
-                 * AUTOEN etc. Otherwise enable_percpu_irq() fails to enable
-                 * perf IRQ on non master cores.
-                 * see arc_request_percpu_irq()
-                 */
-                preempt_disable();
-                local_irq_save(flags);
-                arc_cpu_pmu_irq_init();
-                local_irq_restore(flags);
-                smp_call_function((smp_call_func_t)arc_cpu_pmu_irq_init, 0, 1);
-                preempt_enable();
-
-                /* Clean all pending interrupt flags */
-                write_aux_reg(ARC_REG_PCT_INT_ACT, 0xffffffff);
+                /* intc map function ensures irq_set_percpu_devid() called */
+                request_percpu_irq(irq, arc_pmu_intr, "ARC perf counters",
+                                   this_cpu_ptr(&arc_pmu_cpu));
+
+                on_each_cpu(arc_cpu_pmu_irq_init, &irq, 1);
+
         } else
                 arc_pmu->pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT;
 
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index c33e77c0ad3e..e1b87444ea9a 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -429,7 +429,6 @@ void __init setup_arch(char **cmdline_p)
 #endif
 
         arc_unwind_init();
-        arc_unwind_setup();
 }
 
 static int __init customize_machine(void)
diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
index 580587805fa3..ef6e9e15b82a 100644
--- a/arch/arc/kernel/smp.c
+++ b/arch/arc/kernel/smp.c
@@ -132,11 +132,11 @@ void start_kernel_secondary(void)
         pr_info("## CPU%u LIVE ##: Executing Code...\n", cpu);
 
         /* Some SMP H/w setup - for each cpu */
-        if (plat_smp_ops.init_irq_cpu)
-                plat_smp_ops.init_irq_cpu(cpu);
+        if (plat_smp_ops.init_per_cpu)
+                plat_smp_ops.init_per_cpu(cpu);
 
-        if (machine_desc->init_cpu_smp)
-                machine_desc->init_cpu_smp(cpu);
+        if (machine_desc->init_per_cpu)
+                machine_desc->init_per_cpu(cpu);
 
         arc_local_timer_setup();
 
diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index 7352475451f6..cf2828ab0905 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -170,6 +170,23 @@ static struct unwind_table *find_table(unsigned long pc)
 
 static unsigned long read_pointer(const u8 **pLoc,
                                   const void *end, signed ptrType);
+static void init_unwind_hdr(struct unwind_table *table,
+                            void *(*alloc) (unsigned long));
+
+/*
+ * wrappers for header alloc (vs. calling one vs. other at call site)
+ * to elide section mismatches warnings
+ */
+static void *__init unw_hdr_alloc_early(unsigned long sz)
+{
+        return __alloc_bootmem_nopanic(sz, sizeof(unsigned int),
+                                       MAX_DMA_ADDRESS);
+}
+
+static void *unw_hdr_alloc(unsigned long sz)
+{
+        return kmalloc(sz, GFP_KERNEL);
+}
 
 static void init_unwind_table(struct unwind_table *table, const char *name,
                               const void *core_start, unsigned long core_size,
@@ -209,6 +226,8 @@ void __init arc_unwind_init(void)
                           __start_unwind, __end_unwind - __start_unwind,
                           NULL, 0);
           /*__start_unwind_hdr, __end_unwind_hdr - __start_unwind_hdr);*/
+
+        init_unwind_hdr(&root_table, unw_hdr_alloc_early);
 }
 
 static const u32 bad_cie, not_fde;
@@ -241,8 +260,8 @@ static void swap_eh_frame_hdr_table_entries(void *p1, void *p2, int size)
         e2->fde = v;
 }
 
-static void __init setup_unwind_table(struct unwind_table *table,
-                                      void *(*alloc) (unsigned long))
+static void init_unwind_hdr(struct unwind_table *table,
+                            void *(*alloc) (unsigned long))
 {
         const u8 *ptr;
         unsigned long tableSize = table->size, hdrSize;
@@ -274,13 +293,13 @@ static void __init setup_unwind_table(struct unwind_table *table,
                 const u32 *cie = cie_for_fde(fde, table);
                 signed ptrType;
 
-                if (cie == &not_fde)
+                if (cie == &not_fde)    /* only process FDE here */
                         continue;
                 if (cie == NULL || cie == &bad_cie)
-                        return;
+                        continue;       /* say FDE->CIE.version != 1 */
                 ptrType = fde_pointer_type(cie);
                 if (ptrType < 0)
-                        return;
+                        continue;
 
                 ptr = (const u8 *)(fde + 2);
                 if (!read_pointer(&ptr, (const u8 *)(fde + 1) + *fde,
@@ -300,9 +319,11 @@ static void __init setup_unwind_table(struct unwind_table *table,
 
         hdrSize = 4 + sizeof(unsigned long) + sizeof(unsigned int)
             + 2 * n * sizeof(unsigned long);
+
         header = alloc(hdrSize);
         if (!header)
                 return;
+
         header->version = 1;
         header->eh_frame_ptr_enc = DW_EH_PE_abs | DW_EH_PE_native;
         header->fde_count_enc = DW_EH_PE_abs | DW_EH_PE_data4;
@@ -322,6 +343,10 @@ static void __init setup_unwind_table(struct unwind_table *table,
 
                 if (fde[1] == 0xffffffff)
                         continue;       /* this is a CIE */
+
+                if (*(u8 *)(cie + 2) != 1)
+                        continue;       /* FDE->CIE.version not supported */
+
                 ptr = (const u8 *)(fde + 2);
                 header->table[n].start = read_pointer(&ptr,
                                                       (const u8 *)(fde + 1) +
@@ -342,18 +367,6 @@ static void __init setup_unwind_table(struct unwind_table *table,
         table->header = (const void *)header;
 }
 
-static void *__init balloc(unsigned long sz)
-{
-        return __alloc_bootmem_nopanic(sz,
-                                       sizeof(unsigned int),
-                                       __pa(MAX_DMA_ADDRESS));
-}
-
-void __init arc_unwind_setup(void)
-{
-        setup_unwind_table(&root_table, balloc);
-}
-
 #ifdef CONFIG_MODULES
 
 static struct unwind_table *last_table;
@@ -377,6 +390,8 @@ void *unwind_add_table(struct module *module, const void *table_start,
                           table_start, table_size,
                           NULL, 0);
 
+        init_unwind_hdr(table, unw_hdr_alloc);
+
 #ifdef UNWIND_DEBUG
         unw_debug("Table added for [%s] %lx %lx\n",
                 module->name, table->core.pc, table->core.range);
@@ -439,6 +454,7 @@ void unwind_remove_table(void *handle, int init_only)
         info.init_only = init_only;
 
         unlink_table(&info); /* XXX: SMP */
+        kfree(table->header);
         kfree(table);
 }
 
@@ -507,7 +523,8 @@ static const u32 *cie_for_fde(const u32 *fde, const struct unwind_table *table)
 
         if (*cie <= sizeof(*cie) + 4 || *cie >= fde[1] - sizeof(*fde)
             || (*cie & (sizeof(*cie) - 1))
-            || (cie[1] != 0xffffffff))
+            || (cie[1] != 0xffffffff)
+            || ( *(u8 *)(cie + 2) != 1))   /* version 1 supported */
                 return NULL;    /* this is not a (valid) CIE */
         return cie;
 }
diff --git a/arch/arc/mm/init.c b/arch/arc/mm/init.c
index a9305b5a2cd4..7d2c4fbf4f22 100644
--- a/arch/arc/mm/init.c
+++ b/arch/arc/mm/init.c
@@ -51,7 +51,9 @@ void __init early_init_dt_add_memory_arch(u64 base, u64 size)
         int in_use = 0;
 
         if (!low_mem_sz) {
-                BUG_ON(base != low_mem_start);
+                if (base != low_mem_start)
+                        panic("CONFIG_LINUX_LINK_BASE != DT memory { }");
+
                 low_mem_sz = size;
                 in_use = 1;
         } else {
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 8cc85a4ebec2..35c9db857ebe 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -510,10 +510,14 @@ __copy_to_user_std(void __user *to, const void *from, unsigned long n);
 static inline unsigned long __must_check
 __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
+#ifndef CONFIG_UACCESS_WITH_MEMCPY
         unsigned int __ua_flags = uaccess_save_and_enable();
         n = arm_copy_to_user(to, from, n);
         uaccess_restore(__ua_flags);
         return n;
+#else
+        return arm_copy_to_user(to, from, n);
+#endif
 }
 
 extern unsigned long __must_check
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 7a7c4cea5523..4adfb46e3ee9 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -95,6 +95,22 @@ void __show_regs(struct pt_regs *regs)
 {
         unsigned long flags;
         char buf[64];
+#ifndef CONFIG_CPU_V7M
+        unsigned int domain;
+#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+        /*
+         * Get the domain register for the parent context. In user
+         * mode, we don't save the DACR, so lets use what it should
+         * be. For other modes, we place it after the pt_regs struct.
+         */
+        if (user_mode(regs))
+                domain = DACR_UACCESS_ENABLE;
+        else
+                domain = *(unsigned int *)(regs + 1);
+#else
+        domain = get_domain();
+#endif
+#endif
 
         show_regs_print_info(KERN_DEFAULT);
 
@@ -123,21 +139,8 @@ void __show_regs(struct pt_regs *regs)
 
 #ifndef CONFIG_CPU_V7M
         {
-                unsigned int domain = get_domain();
                 const char *segment;
 
-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
-                /*
-                 * Get the domain register for the parent context. In user
-                 * mode, we don't save the DACR, so lets use what it should
-                 * be. For other modes, we place it after the pt_regs struct.
-                 */
-                if (user_mode(regs))
-                        domain = DACR_UACCESS_ENABLE;
-                else
-                        domain = *(unsigned int *)(regs + 1);
-#endif
-
                 if ((domain & domain_mask(DOMAIN_USER)) ==
                     domain_val(DOMAIN_USER, DOMAIN_NOACCESS))
                         segment = "none";
@@ -163,11 +166,11 @@ void __show_regs(struct pt_regs *regs)
                 buf[0] = '\0';
 #ifdef CONFIG_CPU_CP15_MMU
                 {
-                        unsigned int transbase, dac = get_domain();
+                        unsigned int transbase;
                         asm("mrc p15, 0, %0, c2, c0\n\t"
                             : "=r" (transbase));
                         snprintf(buf, sizeof(buf), "  Table: %08x  DAC: %08x",
-                                transbase, dac);
+                                transbase, domain);
                 }
 #endif
                 asm("mrc p15, 0, %0, c1, c0\n" : "=r" (ctrl));
diff --git a/arch/arm/kernel/swp_emulate.c b/arch/arm/kernel/swp_emulate.c
index 5b26e7efa9ea..c3fe769d7558 100644
--- a/arch/arm/kernel/swp_emulate.c
+++ b/arch/arm/kernel/swp_emulate.c
@@ -36,10 +36,10 @@
  */
 #define __user_swpX_asm(data, addr, res, temp, B)               \
         __asm__ __volatile__(                                   \
-        "       mov             %2, %1\n"                       \
-        "0:     ldrex"B"        %1, [%3]\n"                     \
-        "1:     strex"B"        %0, %2, [%3]\n"                 \
+        "0:     ldrex"B"        %2, [%3]\n"                     \
+        "1:     strex"B"        %0, %1, [%3]\n"                 \
         "       cmp             %0, #0\n"                       \
+        "       moveq           %1, %2\n"                       \
         "       movne           %0, %4\n"                       \
         "2:\n"                                                  \
         "       .section         .text.fixup,\"ax\"\n"          \
diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
index d72b90905132..588bbc288396 100644
--- a/arch/arm/lib/uaccess_with_memcpy.c
+++ b/arch/arm/lib/uaccess_with_memcpy.c
@@ -88,6 +88,7 @@ pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
 static unsigned long noinline
 __copy_to_user_memcpy(void __user *to, const void *from, unsigned long n)
 {
+        unsigned long ua_flags;
         int atomic;
 
         if (unlikely(segment_eq(get_fs(), KERNEL_DS))) {
@@ -118,7 +119,9 @@ __copy_to_user_memcpy(void __user *to, const void *from, unsigned long n)
                 if (tocopy > n)
                         tocopy = n;
 
+                ua_flags = uaccess_save_and_enable();
                 memcpy((void *)to, from, tocopy);
+                uaccess_restore(ua_flags);
                 to += tocopy;
                 from += tocopy;
                 n -= tocopy;
@@ -145,14 +148,21 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
          * With frame pointer disabled, tail call optimization kicks in
          * as well making this test almost invisible.
          */
-        if (n < 64)
-                return __copy_to_user_std(to, from, n);
-        return __copy_to_user_memcpy(to, from, n);
+        if (n < 64) {
+                unsigned long ua_flags = uaccess_save_and_enable();
+                n = __copy_to_user_std(to, from, n);
+                uaccess_restore(ua_flags);
+        } else {
+                n = __copy_to_user_memcpy(to, from, n);
+        }
+        return n;
 }
         
 static unsigned long noinline
 __clear_user_memset(void __user *addr, unsigned long n)
 {
+        unsigned long ua_flags;
+
         if (unlikely(segment_eq(get_fs(), KERNEL_DS))) {
                 memset((void *)addr, 0, n);
                 return 0;
@@ -175,7 +185,9 @@ __clear_user_memset(void __user *addr, unsigned long n)
                 if (tocopy > n)
                         tocopy = n;
 
+                ua_flags = uaccess_save_and_enable();
                 memset((void *)addr, 0, tocopy);
+                uaccess_restore(ua_flags);
                 addr += tocopy;
                 n -= tocopy;
 
@@ -193,9 +205,14 @@ out:
 unsigned long arm_clear_user(void __user *addr, unsigned long n)
 {
         /* See rational for this in __copy_to_user() above. */
-        if (n < 64)
-                return __clear_user_std(addr, n);
-        return __clear_user_memset(addr, n);
+        if (n < 64) {
+                unsigned long ua_flags = uaccess_save_and_enable();
+                n = __clear_user_std(addr, n);
+                uaccess_restore(ua_flags);
+        } else {
+                n = __clear_user_memset(addr, n);
+        }
+        return n;
 }
 
 #if 0
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index 845769e41332..c8c8b9ed02e0 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -165,13 +165,28 @@ static void flush_context(unsigned int cpu)
                 __flush_icache_all();
 }
 
-static int is_reserved_asid(u64 asid)
+static bool check_update_reserved_asid(u64 asid, u64 newasid)
 {
         int cpu;
-        for_each_possible_cpu(cpu)
-                if (per_cpu(reserved_asids, cpu) == asid)
-                        return 1;
-        return 0;
+        bool hit = false;
+
+        /*
+         * Iterate over the set of reserved ASIDs looking for a match.
+         * If we find one, then we can update our mm to use newasid
+         * (i.e. the same ASID in the current generation) but we can't
+         * exit the loop early, since we need to ensure that all copies
+         * of the old ASID are updated to reflect the mm. Failure to do
+         * so could result in us missing the reserved ASID in a future
+         * generation.
+         */
+        for_each_possible_cpu(cpu) {
+                if (per_cpu(reserved_asids, cpu) == asid) {
+                        hit = true;
+                        per_cpu(reserved_asids, cpu) = newasid;
+                }
+        }
+
+        return hit;
 }
 
 static u64 new_context(struct mm_struct *mm, unsigned int cpu)
@@ -181,12 +196,14 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
         u64 generation = atomic64_read(&asid_generation);
 
         if (asid != 0) {
+                u64 newasid = generation | (asid & ~ASID_MASK);
+
                 /*
                  * If our current ASID was active during a rollover, we
                  * can continue to use it and this was just a false alarm.
                  */
-                if (is_reserved_asid(asid))
-                        return generation | (asid & ~ASID_MASK);
+                if (check_update_reserved_asid(asid, newasid))
+                        return newasid;
 
                 /*
                  * We had a valid ASID in a previous life, so try to re-use
@@ -194,7 +211,7 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
                  */
                 asid &= ~ASID_MASK;
                 if (!__test_and_set_bit(asid, asid_map))
-                        goto bump_gen;
+                        return newasid;
         }
 
         /*
@@ -216,11 +233,8 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
 
         __set_bit(asid, asid_map);
         cur_idx = asid;
-
-bump_gen:
-        asid |= generation;
         cpumask_clear(mm_cpumask(mm));
-        return asid;
+        return asid | generation;
 }
 
 void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index e62400e5fb99..534a60ae282e 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1521,7 +1521,7 @@ static int __map_sg_chunk(struct device *dev, struct scatterlist *sg,
                 return -ENOMEM;
 
         for (count = 0, s = sg; count < (size >> PAGE_SHIFT); s = sg_next(s)) {
-                phys_addr_t phys = sg_phys(s) & PAGE_MASK;
+                phys_addr_t phys = page_to_phys(sg_page(s));
                 unsigned int len = PAGE_ALIGN(s->offset + s->length);
 
                 if (!is_coherent &&
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 8a63b4cdc0f2..7f8cd1b3557f 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -22,6 +22,7 @@
 #include <linux/memblock.h>
 #include <linux/dma-contiguous.h>
 #include <linux/sizes.h>
+#include <linux/stop_machine.h>
 
 #include <asm/cp15.h>
 #include <asm/mach-types.h>
@@ -627,12 +628,10 @@ static struct section_perm ro_perms[] = {
  * safe to be called with preemption disabled, as under stop_machine().
  */
 static inline void section_update(unsigned long addr, pmdval_t mask,
-                                  pmdval_t prot)
+                                  pmdval_t prot, struct mm_struct *mm)
 {
-        struct mm_struct *mm;
         pmd_t *pmd;
 
-        mm = current->active_mm;
         pmd = pmd_offset(pud_offset(pgd_offset(mm, addr), addr), addr);
 
 #ifdef CONFIG_ARM_LPAE
@@ -656,49 +655,82 @@ static inline bool arch_has_strict_perms(void)
         return !!(get_cr() & CR_XP);
 }
 
-#define set_section_perms(perms, field) {                               \
-        size_t i;                                                       \
-        unsigned long addr;                                             \
-                                                                        \
-        if (!arch_has_strict_perms())                                   \
-                return;                                                 \
-                                                                        \
-        for (i = 0; i < ARRAY_SIZE(perms); i++) {                       \
-                if (!IS_ALIGNED(perms[i].start, SECTION_SIZE) ||        \
-                    !IS_ALIGNED(perms[i].end, SECTION_SIZE)) {          \
-                        pr_err("BUG: section %lx-%lx not aligned to %lx\n", \
-                                perms[i].start, perms[i].end,           \
-                                SECTION_SIZE);                          \
-                        continue;                                       \
-                }                                                       \
-                                                                        \
-                for (addr = perms[i].start;                             \
-                     addr < perms[i].end;                               \
-                     addr += SECTION_SIZE)                              \
-                        section_update(addr, perms[i].mask,             \
-                                       perms[i].field);                 \
-        }                                                               \
+void set_section_perms(struct section_perm *perms, int n, bool set,
+                        struct mm_struct *mm)
+{
+        size_t i;
+        unsigned long addr;
+
+        if (!arch_has_strict_perms())
+                return;
+
+        for (i = 0; i < n; i++) {
+                if (!IS_ALIGNED(perms[i].start, SECTION_SIZE) ||
+                    !IS_ALIGNED(perms[i].end, SECTION_SIZE)) {
+                        pr_err("BUG: section %lx-%lx not aligned to %lx\n",
+                                perms[i].start, perms[i].end,
+                                SECTION_SIZE);
+                        continue;
+                }
+
+                for (addr = perms[i].start;
+                     addr < perms[i].end;
+                     addr += SECTION_SIZE)
+                        section_update(addr, perms[i].mask,
+                                set ? perms[i].prot : perms[i].clear, mm);
+        }
+
 }
 
-static inline void fix_kernmem_perms(void)
+static void update_sections_early(struct section_perm perms[], int n)
 {
-        set_section_perms(nx_perms, prot);
+        struct task_struct *t, *s;
+
+        read_lock(&tasklist_lock);
+        for_each_process(t) {
+                if (t->flags & PF_KTHREAD)
+                        continue;
+                for_each_thread(t, s)
+                        set_section_perms(perms, n, true, s->mm);
+        }
+        read_unlock(&tasklist_lock);
+        set_section_perms(perms, n, true, current->active_mm);
+        set_section_perms(perms, n, true, &init_mm);
+}
+
+int __fix_kernmem_perms(void *unused)
+{
+        update_sections_early(nx_perms, ARRAY_SIZE(nx_perms));
+        return 0;
+}
+
+void fix_kernmem_perms(void)
+{
+        stop_machine(__fix_kernmem_perms, NULL, NULL);
 }
 
 #ifdef CONFIG_DEBUG_RODATA
+int __mark_rodata_ro(void *unused)
+{
+        update_sections_early(ro_perms, ARRAY_SIZE(ro_perms));
+        return 0;
+}
+
 void mark_rodata_ro(void)
 {
-        set_section_perms(ro_perms, prot);
+        stop_machine(__mark_rodata_ro, NULL, NULL);
 }
 
 void set_kernel_text_rw(void)
 {
-        set_section_perms(ro_perms, clear);
+        set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), false,
+                                current->active_mm);
 }
 
 void set_kernel_text_ro(void)
 {
-        set_section_perms(ro_perms, prot);
+        set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), true,
+                                current->active_mm);
 }
 #endif /* CONFIG_DEBUG_RODATA */
 
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index de2b246fed38..8e1ea433c3f1 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -95,7 +95,7 @@ ENDPROC(cpu_v7_dcache_clean_area)
 .equ    cpu_v7_suspend_size, 4 * 9
 #ifdef CONFIG_ARM_CPU_SUSPEND
 ENTRY(cpu_v7_do_suspend)
-        stmfd   sp!, {r4 - r10, lr}
+        stmfd   sp!, {r4 - r11, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ FCSE/PID
         mrc     p15, 0, r5, c13, c0, 3  @ User r/o thread ID
         stmia   r0!, {r4 - r5}
@@ -112,7 +112,7 @@ ENTRY(cpu_v7_do_suspend)
         mrc     p15, 0, r9, c1, c0, 1   @ Auxiliary control register
         mrc     p15, 0, r10, c1, c0, 2  @ Co-processor access control
         stmia   r0, {r5 - r11}
-        ldmfd   sp!, {r4 - r10, pc}
+        ldmfd   sp!, {r4 - r11, pc}
 ENDPROC(cpu_v7_do_suspend)
 
 ENTRY(cpu_v7_do_resume)
diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
index db73390568c8..74c132d901bd 100644
--- a/arch/ia64/include/asm/unistd.h
+++ b/arch/ia64/include/asm/unistd.h
@@ -11,7 +11,7 @@
 
 
 
-#define NR_syscalls                     322 /* length of syscall table */
+#define NR_syscalls                     323 /* length of syscall table */
 
 /*
  * The following defines stop scripts/checksyscalls.sh from complaining about
diff --git a/arch/ia64/include/uapi/asm/unistd.h b/arch/ia64/include/uapi/asm/unistd.h
index 9038726e7d26..762edce7572e 100644
--- a/arch/ia64/include/uapi/asm/unistd.h
+++ b/arch/ia64/include/uapi/asm/unistd.h
@@ -335,5 +335,6 @@
 #define __NR_userfaultfd                1343
 #define __NR_membarrier                 1344
 #define __NR_kcmp                       1345
+#define __NR_mlock2                     1346
 
 #endif /* _UAPI_ASM_IA64_UNISTD_H */
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index dcd97f84d065..534a74acb849 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1771,5 +1771,6 @@ sys_call_table:
         data8 sys_userfaultfd
         data8 sys_membarrier
         data8 sys_kcmp                          // 1345
+        data8 sys_mlock2
 
         .org sys_call_table + 8*NR_syscalls     // guard against failures to increase NR_syscalls
diff --git a/arch/microblaze/kernel/dma.c b/arch/microblaze/kernel/dma.c
index c89da6312954..bf4dec229437 100644
--- a/arch/microblaze/kernel/dma.c
+++ b/arch/microblaze/kernel/dma.c
@@ -61,7 +61,8 @@ static int dma_direct_map_sg(struct device *dev, struct scatterlist *sgl,
         /* FIXME this part of code is untested */
         for_each_sg(sgl, sg, nents, i) {
                 sg->dma_address = sg_phys(sg);
-                __dma_sync(sg_phys(sg), sg->length, direction);
+                __dma_sync(page_to_phys(sg_page(sg)) + sg->offset,
+                                                        sg->length, direction);
         }
 
         return nents;
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index f2b0b1b0c72a..5654ece02c0d 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -370,16 +370,16 @@ COMPAT_SYS(execveat)
 PPC64ONLY(switch_endian)
 SYSCALL_SPU(userfaultfd)
 SYSCALL_SPU(membarrier)
-SYSCALL(semop)
-SYSCALL(semget)
-COMPAT_SYS(semctl)
-COMPAT_SYS(semtimedop)
-COMPAT_SYS(msgsnd)
-COMPAT_SYS(msgrcv)
-SYSCALL(msgget)
-COMPAT_SYS(msgctl)
-COMPAT_SYS(shmat)
-SYSCALL(shmdt)
-SYSCALL(shmget)
-COMPAT_SYS(shmctl)
+SYSCALL(ni_syscall)
+SYSCALL(ni_syscall)
+SYSCALL(ni_syscall)
+SYSCALL(ni_syscall)
+SYSCALL(ni_syscall)
+SYSCALL(ni_syscall)
+SYSCALL(ni_syscall)
+SYSCALL(ni_syscall)
+SYSCALL(ni_syscall)
+SYSCALL(ni_syscall)
+SYSCALL(ni_syscall)
+SYSCALL(ni_syscall)
 SYSCALL(mlock2)
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index 1effea5193d6..12a05652377a 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -388,18 +388,6 @@
 #define __NR_switch_endian      363
 #define __NR_userfaultfd        364
 #define __NR_membarrier         365
-#define __NR_semop              366
-#define __NR_semget             367
-#define __NR_semctl             368
-#define __NR_semtimedop         369
-#define __NR_msgsnd             370
-#define __NR_msgrcv             371
-#define __NR_msgget             372
-#define __NR_msgctl             373
-#define __NR_shmat              374
-#define __NR_shmdt              375
-#define __NR_shmget             376
-#define __NR_shmctl             377
 #define __NR_mlock2             378
 
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c
index 0a00e2aed393..e505223b4ec5 100644
--- a/arch/powerpc/platforms/powernv/opal-irqchip.c
+++ b/arch/powerpc/platforms/powernv/opal-irqchip.c
@@ -83,7 +83,19 @@ static void opal_event_unmask(struct irq_data *d)
         set_bit(d->hwirq, &opal_event_irqchip.mask);
 
         opal_poll_events(&events);
-        opal_handle_events(be64_to_cpu(events));
+        last_outstanding_events = be64_to_cpu(events);
+
+        /*
+         * We can't just handle the events now with opal_handle_events().
+         * If we did we would deadlock when opal_event_unmask() is called from
+         * handle_level_irq() with the irq descriptor lock held, because
+         * calling opal_handle_events() would call generic_handle_irq() and
+         * then handle_level_irq() which would try to take the descriptor lock
+         * again. Instead queue the events for later.
+         */
+        if (last_outstanding_events & opal_event_irqchip.mask)
+                /* Need to retrigger the interrupt */
+                irq_work_queue(&opal_event_irq_work);
 }
 
 static int opal_event_set_type(struct irq_data *d, unsigned int flow_type)
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index 4296d55e88f3..57cffb80bc36 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -278,7 +278,7 @@ static void opal_handle_message(void)
 
         /* Sanity check */
         if (type >= OPAL_MSG_TYPE_MAX) {
-                pr_warning("%s: Unknown message type: %u\n", __func__, type);
+                pr_warn_once("%s: Unknown message type: %u\n", __func__, type);
                 return;
         }
         opal_message_do_notify(type, (void *)&msg);
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index a035c2aa7801..0f1c6fc3ddd8 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -89,7 +89,7 @@ static struct addr_marker address_markers[] = {
         { 0/* VMALLOC_START */, "vmalloc() Area" },
         { 0/*VMALLOC_END*/,     "vmalloc() End" },
 # ifdef CONFIG_HIGHMEM
-        { 0/*PKMAP_BASE*/,      "Persisent kmap() Area" },
+        { 0/*PKMAP_BASE*/,      "Persistent kmap() Area" },
 # endif
         { 0/*FIXADDR_START*/,   "Fixmap Area" },
 #endif
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index ac161db63388..cb5e266a8bf7 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -2495,14 +2495,9 @@ void __init xen_init_mmu_ops(void)
 {
         x86_init.paging.pagetable_init = xen_pagetable_init;
 
-        /* Optimization - we can use the HVM one but it has no idea which
-         * VCPUs are descheduled - which means that it will needlessly IPI
-         * them. Xen knows so let it do the job.
-         */
-        if (xen_feature(XENFEAT_auto_translated_physmap)) {
-                pv_mmu_ops.flush_tlb_others = xen_flush_tlb_others;
+        if (xen_feature(XENFEAT_auto_translated_physmap))
                 return;
-        }
+
         pv_mmu_ops = xen_mmu_ops;
 
         memset(dummy_mapping, 0xff, PAGE_SIZE);
diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c
index feddabdab448..3705eabd7e22 100644
--- a/arch/x86/xen/suspend.c
+++ b/arch/x86/xen/suspend.c
@@ -68,26 +68,16 @@ static void xen_pv_post_suspend(int suspend_cancelled)
 
 void xen_arch_pre_suspend(void)
 {
-        int cpu;
-
-        for_each_online_cpu(cpu)
-                xen_pmu_finish(cpu);
-
         if (xen_pv_domain())
                 xen_pv_pre_suspend();
 }
 
 void xen_arch_post_suspend(int cancelled)
 {
-        int cpu;
-
         if (xen_pv_domain())
                 xen_pv_post_suspend(cancelled);
         else
                 xen_hvm_post_suspend(cancelled);
-
-        for_each_online_cpu(cpu)
-                xen_pmu_init(cpu);
 }
 
 static void xen_vcpu_notify_restore(void *data)
@@ -106,10 +96,20 @@ static void xen_vcpu_notify_suspend(void *data)
 
 void xen_arch_resume(void)
 {
+        int cpu;
+
         on_each_cpu(xen_vcpu_notify_restore, NULL, 1);
+
+        for_each_online_cpu(cpu)
+                xen_pmu_init(cpu);
 }
 
 void xen_arch_suspend(void)
 {
+        int cpu;
+
+        for_each_online_cpu(cpu)
+                xen_pmu_finish(cpu);
+
         on_each_cpu(xen_vcpu_notify_suspend, NULL, 1);
 }
diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
index b4ffc5be1a93..e5b5721809e2 100644
--- a/crypto/ablkcipher.c
+++ b/crypto/ablkcipher.c
@@ -277,12 +277,12 @@ static int ablkcipher_walk_first(struct ablkcipher_request *req,
         if (WARN_ON_ONCE(in_irq()))
                 return -EDEADLK;
 
+        walk->iv = req->info;
         walk->nbytes = walk->total;
         if (unlikely(!walk->total))
                 return 0;
 
         walk->iv_buffer = NULL;
-        walk->iv = req->info;
         if (unlikely(((unsigned long)walk->iv & alignmask))) {
                 int err = ablkcipher_copy_iv(walk, tfm, alignmask);
 
diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
index 11b981492031..8cc1622b2ee0 100644
--- a/crypto/blkcipher.c
+++ b/crypto/blkcipher.c
@@ -326,12 +326,12 @@ static int blkcipher_walk_first(struct blkcipher_desc *desc,
         if (WARN_ON_ONCE(in_irq()))
                 return -EDEADLK;
 
+        walk->iv = desc->info;
         walk->nbytes = walk->total;
         if (unlikely(!walk->total))
                 return 0;
 
         walk->buffer = NULL;
-        walk->iv = desc->info;
         if (unlikely(((unsigned long)walk->iv & walk->alignmask))) {
                 int err = blkcipher_copy_iv(walk);
                 if (err)
diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c
index e7ed39bab97d..aa45d4802707 100644
--- a/drivers/acpi/nfit.c
+++ b/drivers/acpi/nfit.c
@@ -1810,7 +1810,7 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
         if (!dev->driver) {
                 /* dev->driver may be null if we're being removed */
                 dev_dbg(dev, "%s: no driver found for dev\n", __func__);
-                return;
+                goto out_unlock;
         }
 
         if (!acpi_desc) {
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 167418e73445..65f50eccd49b 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -390,6 +390,7 @@ static int pm_genpd_runtime_suspend(struct device *dev)
         struct generic_pm_domain *genpd;
         bool (*stop_ok)(struct device *__dev);
         struct gpd_timing_data *td = &dev_gpd_data(dev)->td;
+        bool runtime_pm = pm_runtime_enabled(dev);
         ktime_t time_start;
         s64 elapsed_ns;
         int ret;
@@ -400,12 +401,19 @@ static int pm_genpd_runtime_suspend(struct device *dev)
         if (IS_ERR(genpd))
                 return -EINVAL;
 
+        /*
+         * A runtime PM centric subsystem/driver may re-use the runtime PM
+         * callbacks for other purposes than runtime PM. In those scenarios
+         * runtime PM is disabled. Under these circumstances, we shall skip
+         * validating/measuring the PM QoS latency.
+         */
         stop_ok = genpd->gov ? genpd->gov->stop_ok : NULL;
-        if (stop_ok && !stop_ok(dev))
+        if (runtime_pm && stop_ok && !stop_ok(dev))
                 return -EBUSY;
 
         /* Measure suspend latency. */
-        time_start = ktime_get();
+        if (runtime_pm)
+                time_start = ktime_get();
 
         ret = genpd_save_dev(genpd, dev);
         if (ret)
@@ -418,13 +426,15 @@ static int pm_genpd_runtime_suspend(struct device *dev)
         }
 
         /* Update suspend latency value if the measured time exceeds it. */
-        elapsed_ns = ktime_to_ns(ktime_sub(ktime_get(), time_start));
-        if (elapsed_ns > td->suspend_latency_ns) {
-                td->suspend_latency_ns = elapsed_ns;
-                dev_dbg(dev, "suspend latency exceeded, %lld ns\n",
-                        elapsed_ns);
-                genpd->max_off_time_changed = true;
-                td->constraint_changed = true;
+        if (runtime_pm) {
+                elapsed_ns = ktime_to_ns(ktime_sub(ktime_get(), time_start));
+                if (elapsed_ns > td->suspend_latency_ns) {
+                        td->suspend_latency_ns = elapsed_ns;
+                        dev_dbg(dev, "suspend latency exceeded, %lld ns\n",
+                                elapsed_ns);
+                        genpd->max_off_time_changed = true;
+                        td->constraint_changed = true;
+                }
         }
 
         /*
@@ -453,6 +463,7 @@ static int pm_genpd_runtime_resume(struct device *dev)
 {
         struct generic_pm_domain *genpd;
         struct gpd_timing_data *td = &dev_gpd_data(dev)->td;
+        bool runtime_pm = pm_runtime_enabled(dev);
         ktime_t time_start;
         s64 elapsed_ns;
         int ret;
@@ -479,14 +490,14 @@ static int pm_genpd_runtime_resume(struct device *dev)
 
  out:
         /* Measure resume latency. */
-        if (timed)
+        if (timed && runtime_pm)
                 time_start = ktime_get();
 
         genpd_start_dev(genpd, dev);
         genpd_restore_dev(genpd, dev);
 
         /* Update resume latency value if the measured time exceeds it. */
-        if (timed) {
+        if (timed && runtime_pm) {
                 elapsed_ns = ktime_to_ns(ktime_sub(ktime_get(), time_start));
                 if (elapsed_ns > td->resume_latency_ns) {
                         td->resume_latency_ns = elapsed_ns;
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index f9099940c272..41fb1a917b17 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -950,6 +950,8 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req,
                 goto unmap;
 
         for (n = 0, i = 0; n < nseg; n++) {
+                uint8_t first_sect, last_sect;
+
                 if ((n % SEGS_PER_INDIRECT_FRAME) == 0) {
                         /* Map indirect segments */
                         if (segments)
@@ -957,15 +959,18 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req,
                         segments = kmap_atomic(pages[n/SEGS_PER_INDIRECT_FRAME]->page);
                 }
                 i = n % SEGS_PER_INDIRECT_FRAME;
+
                 pending_req->segments[n]->gref = segments[i].gref;
-                seg[n].nsec = segments[i].last_sect -
-                        segments[i].first_sect + 1;
-                seg[n].offset = (segments[i].first_sect << 9);
-                if ((segments[i].last_sect >= (XEN_PAGE_SIZE >> 9)) ||
-                    (segments[i].last_sect < segments[i].first_sect)) {
+
+                first_sect = READ_ONCE(segments[i].first_sect);
+                last_sect = READ_ONCE(segments[i].last_sect);
+                if (last_sect >= (XEN_PAGE_SIZE >> 9) || last_sect < first_sect) {
                         rc = -EINVAL;
                         goto unmap;
                 }
+
+                seg[n].nsec = last_sect - first_sect + 1;
+                seg[n].offset = first_sect << 9;
                 preq->nr_sects += seg[n].nsec;
         }
 
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index 68e87a037b99..c929ae22764c 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -408,8 +408,8 @@ static inline void blkif_get_x86_32_req(struct blkif_request *dst,
                                         struct blkif_x86_32_request *src)
 {
         int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST, j;
-        dst->operation = src->operation;
-        switch (src->operation) {
+        dst->operation = READ_ONCE(src->operation);
+        switch (dst->operation) {
         case BLKIF_OP_READ:
         case BLKIF_OP_WRITE:
         case BLKIF_OP_WRITE_BARRIER:
@@ -456,8 +456,8 @@ static inline void blkif_get_x86_64_req(struct blkif_request *dst,
                                         struct blkif_x86_64_request *src)
 {
         int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST, j;
-        dst->operation = src->operation;
-        switch (src->operation) {
+        dst->operation = READ_ONCE(src->operation);
+        switch (dst->operation) {
         case BLKIF_OP_READ:
         case BLKIF_OP_WRITE:
         case BLKIF_OP_WRITE_BARRIER:
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 235a1ba73d92..b1f8a73e5a94 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -226,7 +226,7 @@ config ARM_TEGRA20_CPUFREQ
 
 config ARM_TEGRA124_CPUFREQ
         tristate "Tegra124 CPUFreq support"
-        depends on ARCH_TEGRA && CPUFREQ_DT
+        depends on ARCH_TEGRA && CPUFREQ_DT && REGULATOR
         default y
         help
           This adds the CPUFreq driver support for Tegra124 SOCs.
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 4d07cbd2b23c..98fb8821382d 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1123,7 +1123,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
                                    limits->max_sysfs_pct);
         limits->max_perf_pct = max(limits->min_policy_pct,
                                    limits->max_perf_pct);
-        limits->max_perf = round_up(limits->max_perf, 8);
+        limits->max_perf = round_up(limits->max_perf, FRAC_BITS);
 
         /* Make sure min_perf_pct <= max_perf_pct */
         limits->min_perf_pct = min(limits->max_perf_pct, limits->min_perf_pct);
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 7f039de143f0..370c661c7d7b 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -156,7 +156,7 @@
 #define         AT_XDMAC_CC_WRIP        (0x1 << 23)     /* Write in Progress (read only) */
 #define                 AT_XDMAC_CC_WRIP_DONE           (0x0 << 23)
 #define                 AT_XDMAC_CC_WRIP_IN_PROGRESS    (0x1 << 23)
-#define         AT_XDMAC_CC_PERID(i)    (0x7f & (h) << 24)      /* Channel Peripheral Identifier */
+#define         AT_XDMAC_CC_PERID(i)    (0x7f & (i) << 24)      /* Channel Peripheral Identifier */
 #define AT_XDMAC_CDS_MSP        0x2C    /* Channel Data Stride Memory Set Pattern */
 #define AT_XDMAC_CSUS           0x30    /* Channel Source Microblock Stride */
 #define AT_XDMAC_CDUS           0x34    /* Channel Destination Microblock Stride */
@@ -965,7 +965,9 @@ at_xdmac_prep_interleaved(struct dma_chan *chan,
                                                         NULL,
                                                         src_addr, dst_addr,
                                                         xt, xt->sgl);
-                for (i = 0; i < xt->numf; i++)
+
+                /* Length of the block is (BLEN+1) microblocks. */
+                for (i = 0; i < xt->numf - 1; i++)
                         at_xdmac_increment_block_count(chan, first);
 
                 dev_dbg(chan2dev(chan), "%s: add desc 0x%p to descs_list 0x%p\n",
@@ -1086,6 +1088,7 @@ at_xdmac_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
                 /* Check remaining length and change data width if needed. */
                 dwidth = at_xdmac_align_width(chan,
                                               src_addr | dst_addr | xfer_size);
+                chan_cc &= ~AT_XDMAC_CC_DWIDTH_MASK;
                 chan_cc |= AT_XDMAC_CC_DWIDTH(dwidth);
 
                 ublen = xfer_size >> dwidth;
@@ -1333,7 +1336,7 @@ at_xdmac_prep_dma_memset_sg(struct dma_chan *chan, struct scatterlist *sgl,
                  * since we don't care about the stride anymore.
                  */
                 if ((i == (sg_len - 1)) &&
-                    sg_dma_len(ppsg) == sg_dma_len(psg)) {
+                    sg_dma_len(psg) == sg_dma_len(sg)) {
                         dev_dbg(chan2dev(chan),
                                 "%s: desc 0x%p can be merged with desc 0x%p\n",
                                 __func__, desc, pdesc);
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index c92d6a70ccf3..996c4b00d323 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -31,6 +31,7 @@
  */
 #include <linux/dmaengine.h>
 #include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
@@ -62,6 +63,11 @@ struct bcm2835_dma_cb {
         uint32_t pad[2];
 };
 
+struct bcm2835_cb_entry {
+        struct bcm2835_dma_cb *cb;
+        dma_addr_t paddr;
+};
+
 struct bcm2835_chan {
         struct virt_dma_chan vc;
         struct list_head node;
@@ -72,18 +78,18 @@ struct bcm2835_chan {
 
         int ch;
         struct bcm2835_desc *desc;
+        struct dma_pool *cb_pool;
 
         void __iomem *chan_base;
         int irq_number;
 };
 
 struct bcm2835_desc {
+        struct bcm2835_chan *c;
         struct virt_dma_desc vd;
         enum dma_transfer_direction dir;
 
-        unsigned int control_block_size;
-        struct bcm2835_dma_cb *control_block_base;
-        dma_addr_t control_block_base_phys;
+        struct bcm2835_cb_entry *cb_list;
 
         unsigned int frames;
         size_t size;
@@ -143,10 +149,13 @@ static inline struct bcm2835_desc *to_bcm2835_dma_desc(
 static void bcm2835_dma_desc_free(struct virt_dma_desc *vd)
 {
         struct bcm2835_desc *desc = container_of(vd, struct bcm2835_desc, vd);
-        dma_free_coherent(desc->vd.tx.chan->device->dev,
-                        desc->control_block_size,
-                        desc->control_block_base,
-                        desc->control_block_base_phys);
+        int i;
+
+        for (i = 0; i < desc->frames; i++)
+                dma_pool_free(desc->c->cb_pool, desc->cb_list[i].cb,
+                              desc->cb_list[i].paddr);
+
+        kfree(desc->cb_list);
         kfree(desc);
 }
 
@@ -199,7 +208,7 @@ static void bcm2835_dma_start_desc(struct bcm2835_chan *c)
 
         c->desc = d = to_bcm2835_dma_desc(&vd->tx);
 
-        writel(d->control_block_base_phys, c->chan_base + BCM2835_DMA_ADDR);
+        writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
         writel(BCM2835_DMA_ACTIVE, c->chan_base + BCM2835_DMA_CS);
 }
 
@@ -232,9 +241,16 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
 static int bcm2835_dma_alloc_chan_resources(struct dma_chan *chan)
 {
         struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+        struct device *dev = c->vc.chan.device->dev;
+
+        dev_dbg(dev, "Allocating DMA channel %d\n", c->ch);
 
-        dev_dbg(c->vc.chan.device->dev,
-                        "Allocating DMA channel %d\n", c->ch);
+        c->cb_pool = dma_pool_create(dev_name(dev), dev,
+                                     sizeof(struct bcm2835_dma_cb), 0, 0);
+        if (!c->cb_pool) {
+                dev_err(dev, "unable to allocate descriptor pool\n");
+                return -ENOMEM;
+        }
 
         return request_irq(c->irq_number,
                         bcm2835_dma_callback, 0, "DMA IRQ", c);
@@ -246,6 +262,7 @@ static void bcm2835_dma_free_chan_resources(struct dma_chan *chan)
 
         vchan_free_chan_resources(&c->vc);
         free_irq(c->irq_number, c);
+        dma_pool_destroy(c->cb_pool);
 
         dev_dbg(c->vc.chan.device->dev, "Freeing DMA channel %u\n", c->ch);
 }
@@ -261,8 +278,7 @@ static size_t bcm2835_dma_desc_size_pos(struct bcm2835_desc *d, dma_addr_t addr)
         size_t size;
 
         for (size = i = 0; i < d->frames; i++) {
-                struct bcm2835_dma_cb *control_block =
-                        &d->control_block_base[i];
+                struct bcm2835_dma_cb *control_block = d->cb_list[i].cb;
                 size_t this_size = control_block->length;
                 dma_addr_t dma;
 
@@ -343,6 +359,7 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_dma_cyclic(
         dma_addr_t dev_addr;
         unsigned int es, sync_type;
         unsigned int frame;
+        int i;
 
         /* Grab configuration */
         if (!is_slave_direction(direction)) {
@@ -374,27 +391,31 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_dma_cyclic(
         if (!d)
                 return NULL;
 
+        d->c = c;
         d->dir = direction;
         d->frames = buf_len / period_len;
 
-        /* Allocate memory for control blocks */
-        d->control_block_size = d->frames * sizeof(struct bcm2835_dma_cb);
-        d->control_block_base = dma_zalloc_coherent(chan->device->dev,
-                        d->control_block_size, &d->control_block_base_phys,
-                        GFP_NOWAIT);
-
-        if (!d->control_block_base) {
+        d->cb_list = kcalloc(d->frames, sizeof(*d->cb_list), GFP_KERNEL);
+        if (!d->cb_list) {
                 kfree(d);
                 return NULL;
         }
+        /* Allocate memory for control blocks */
+        for (i = 0; i < d->frames; i++) {
+                struct bcm2835_cb_entry *cb_entry = &d->cb_list[i];
+
+                cb_entry->cb = dma_pool_zalloc(c->cb_pool, GFP_ATOMIC,
+                                               &cb_entry->paddr);
+                if (!cb_entry->cb)
+                        goto error_cb;
+        }
 
         /*
          * Iterate over all frames, create a control block
          * for each frame and link them together.
          */
         for (frame = 0; frame < d->frames; frame++) {
-                struct bcm2835_dma_cb *control_block =
-                        &d->control_block_base[frame];
+                struct bcm2835_dma_cb *control_block = d->cb_list[frame].cb;
 
                 /* Setup adresses */
                 if (d->dir == DMA_DEV_TO_MEM) {
@@ -428,12 +449,21 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_dma_cyclic(
                  * This DMA engine driver currently only supports cyclic DMA.
                  * Therefore, wrap around at number of frames.
                  */
-                control_block->next = d->control_block_base_phys +
-                        sizeof(struct bcm2835_dma_cb)
-                        * ((frame + 1) % d->frames);
+                control_block->next = d->cb_list[((frame + 1) % d->frames)].paddr;
         }
 
         return vchan_tx_prep(&c->vc, &d->vd, flags);
+error_cb:
+        i--;
+        for (; i >= 0; i--) {
+                struct bcm2835_cb_entry *cb_entry = &d->cb_list[i];
+
+                dma_pool_free(c->cb_pool, cb_entry->cb, cb_entry->paddr);
+        }
+
+        kfree(d->cb_list);
+        kfree(d);
+        return NULL;
 }
 
 static int bcm2835_dma_slave_config(struct dma_chan *chan,
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 0675e268d577..16fe773fb846 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -1752,16 +1752,14 @@ static enum dma_status edma_tx_status(struct dma_chan *chan,
         return ret;
 }
 
-static bool edma_is_memcpy_channel(int ch_num, u16 *memcpy_channels)
+static bool edma_is_memcpy_channel(int ch_num, s32 *memcpy_channels)
 {
-        s16 *memcpy_ch = memcpy_channels;
-
         if (!memcpy_channels)
                 return false;
-        while (*memcpy_ch != -1) {
-                if (*memcpy_ch == ch_num)
+        while (*memcpy_channels != -1) {
+                if (*memcpy_channels == ch_num)
                         return true;
-                memcpy_ch++;
+                memcpy_channels++;
         }
         return false;
 }
@@ -1775,7 +1773,7 @@ static void edma_dma_init(struct edma_cc *ecc, bool legacy_mode)
 {
         struct dma_device *s_ddev = &ecc->dma_slave;
         struct dma_device *m_ddev = NULL;
-        s16 *memcpy_channels = ecc->info->memcpy_channels;
+        s32 *memcpy_channels = ecc->info->memcpy_channels;
         int i, j;
 
         dma_cap_zero(s_ddev->cap_mask);
@@ -1996,16 +1994,16 @@ static struct edma_soc_info *edma_setup_info_from_dt(struct device *dev,
         prop = of_find_property(dev->of_node, "ti,edma-memcpy-channels", &sz);
         if (prop) {
                 const char pname[] = "ti,edma-memcpy-channels";
-                size_t nelm = sz / sizeof(s16);
-                s16 *memcpy_ch;
+                size_t nelm = sz / sizeof(s32);
+                s32 *memcpy_ch;
 
-                memcpy_ch = devm_kcalloc(dev, nelm + 1, sizeof(s16),
+                memcpy_ch = devm_kcalloc(dev, nelm + 1, sizeof(s32),
                                          GFP_KERNEL);
                 if (!memcpy_ch)
                         return ERR_PTR(-ENOMEM);
 
-                ret = of_property_read_u16_array(dev->of_node, pname,
-                                                 (u16 *)memcpy_ch, nelm);
+                ret = of_property_read_u32_array(dev->of_node, pname,
+                                                 (u32 *)memcpy_ch, nelm);
                 if (ret)
                         return ERR_PTR(ret);
 
@@ -2017,31 +2015,50 @@ static struct edma_soc_info *edma_setup_info_from_dt(struct device *dev,
                                 &sz);
         if (prop) {
                 const char pname[] = "ti,edma-reserved-slot-ranges";
+                u32 (*tmp)[2];
                 s16 (*rsv_slots)[2];
-                size_t nelm = sz / sizeof(*rsv_slots);
+                size_t nelm = sz / sizeof(*tmp);
                 struct edma_rsv_info *rsv_info;
+                int i;
 
                 if (!nelm)
                         return info;
 
+                tmp = kcalloc(nelm, sizeof(*tmp), GFP_KERNEL);
+                if (!tmp)
+                        return ERR_PTR(-ENOMEM);
+
                 rsv_info = devm_kzalloc(dev, sizeof(*rsv_info), GFP_KERNEL);
-                if (!rsv_info)
+                if (!rsv_info) {
+                        kfree(tmp);
                         return ERR_PTR(-ENOMEM);
+                }
 
                 rsv_slots = devm_kcalloc(dev, nelm + 1, sizeof(*rsv_slots),
                                          GFP_KERNEL);
-                if (!rsv_slots)
+                if (!rsv_slots) {
+                        kfree(tmp);
                         return ERR_PTR(-ENOMEM);
+                }
 
-                ret = of_property_read_u16_array(dev->of_node, pname,
-                                                 (u16 *)rsv_slots, nelm * 2);
-                if (ret)
+                ret = of_property_read_u32_array(dev->of_node, pname,
+                                                 (u32 *)tmp, nelm * 2);
+                if (ret) {
+                        kfree(tmp);
                         return ERR_PTR(ret);
+                }
 
+                for (i = 0; i < nelm; i++) {
+                        rsv_slots[i][0] = tmp[i][0];
+                        rsv_slots[i][1] = tmp[i][1];
+                }
                 rsv_slots[nelm][0] = -1;
                 rsv_slots[nelm][1] = -1;
+
                 info->rsv = rsv_info;
                 info->rsv->rsv_slots = (const s16 (*)[2])rsv_slots;
+
+                kfree(tmp);
         }
 
         return info;
diff --git a/drivers/dma/mic_x100_dma.c b/drivers/dma/mic_x100_dma.c
index 068e920ecb68..cddfa8dbf4bd 100644
--- a/drivers/dma/mic_x100_dma.c
+++ b/drivers/dma/mic_x100_dma.c
@@ -317,6 +317,7 @@ mic_dma_prep_memcpy_lock(struct dma_chan *ch, dma_addr_t dma_dest,
         struct mic_dma_chan *mic_ch = to_mic_dma_chan(ch);
         struct device *dev = mic_dma_ch_to_device(mic_ch);
         int result;
+        struct dma_async_tx_descriptor *tx = NULL;
 
         if (!len && !flags)
                 return NULL;
@@ -324,10 +325,13 @@ mic_dma_prep_memcpy_lock(struct dma_chan *ch, dma_addr_t dma_dest,
         spin_lock(&mic_ch->prep_lock);
         result = mic_dma_do_dma(mic_ch, flags, dma_src, dma_dest, len);
         if (result >= 0)
-                return allocate_tx(mic_ch);
-        dev_err(dev, "Error enqueueing dma, error=%d\n", result);
+                tx = allocate_tx(mic_ch);
+
+        if (!tx)
+                dev_err(dev, "Error enqueueing dma, error=%d\n", result);
+
         spin_unlock(&mic_ch->prep_lock);
-        return NULL;
+        return tx;
 }
 
 static struct dma_async_tx_descriptor *
@@ -335,13 +339,14 @@ mic_dma_prep_interrupt_lock(struct dma_chan *ch, unsigned long flags)
 {
         struct mic_dma_chan *mic_ch = to_mic_dma_chan(ch);
         int ret;
+        struct dma_async_tx_descriptor *tx = NULL;
 
         spin_lock(&mic_ch->prep_lock);
         ret = mic_dma_do_dma(mic_ch, flags, 0, 0, 0);
         if (!ret)
-                return allocate_tx(mic_ch);
+                tx = allocate_tx(mic_ch);
         spin_unlock(&mic_ch->prep_lock);
-        return NULL;
+        return tx;
 }
 
 /* Return the status of the transaction */
diff --git a/drivers/gpio/gpio-ath79.c b/drivers/gpio/gpio-ath79.c
index e5827a56ff3b..5eaea8b812cf 100644
--- a/drivers/gpio/gpio-ath79.c
+++ b/drivers/gpio/gpio-ath79.c
@@ -113,7 +113,7 @@ static int ar934x_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
                 __raw_writel(BIT(offset), ctrl->base + AR71XX_GPIO_REG_CLEAR);
 
         __raw_writel(
-                __raw_readl(ctrl->base + AR71XX_GPIO_REG_OE) & BIT(offset),
+                __raw_readl(ctrl->base + AR71XX_GPIO_REG_OE) & ~BIT(offset),
                 ctrl->base + AR71XX_GPIO_REG_OE);
 
         spin_unlock_irqrestore(&ctrl->lock, flags);
diff --git a/drivers/gpio/gpio-generic.c b/drivers/gpio/gpio-generic.c
index bd5193c67a9c..88ae70ddb127 100644
--- a/drivers/gpio/gpio-generic.c
+++ b/drivers/gpio/gpio-generic.c
@@ -141,9 +141,9 @@ static int bgpio_get_set(struct gpio_chip *gc, unsigned int gpio)
         unsigned long pinmask = bgc->pin2mask(bgc, gpio);
 
         if (bgc->dir & pinmask)
-                return bgc->read_reg(bgc->reg_set) & pinmask;
+                return !!(bgc->read_reg(bgc->reg_set) & pinmask);
         else
-                return bgc->read_reg(bgc->reg_dat) & pinmask;
+                return !!(bgc->read_reg(bgc->reg_dat) & pinmask);
 }
 
 static int bgpio_get(struct gpio_chip *gc, unsigned int gpio)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 2a91f3287e3b..4e4c3083ae56 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1279,7 +1279,13 @@ static int _gpiod_get_raw_value(const struct gpio_desc *desc)
         chip = desc->chip;
         offset = gpio_chip_hwgpio(desc);
         value = chip->get ? chip->get(chip, offset) : -EIO;
-        value = value < 0 ? value : !!value;
+        /*
+         * FIXME: fix all drivers to clamp to [0,1] or return negative,
+         * then change this to:
+         * value = value < 0 ? value : !!value;
+         * so we can properly propagate error codes.
+         */
+        value = !!value;
         trace_gpio_value(desc_to_gpio(desc), 1, value);
         return value;
 }
diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
index a18164f2f6d2..f8b5fcfa91a2 100644
--- a/drivers/gpu/drm/drm_probe_helper.c
+++ b/drivers/gpu/drm/drm_probe_helper.c
@@ -229,7 +229,8 @@ static int drm_helper_probe_single_connector_modes_merge_bits(struct drm_connect
                 mode_flags |= DRM_MODE_FLAG_3D_MASK;
 
         list_for_each_entry(mode, &connector->modes, head) {
-                mode->status = drm_mode_validate_basic(mode);
+                if (mode->status == MODE_OK)
+                        mode->status = drm_mode_validate_basic(mode);
 
                 if (mode->status == MODE_OK)
                         mode->status = drm_mode_validate_size(mode, maxX, maxY);
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 8c688a5f1589..02ceb7a4b481 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -141,8 +141,6 @@ static void i915_gem_context_clean(struct intel_context *ctx)
         if (!ppgtt)
                 return;
 
-        WARN_ON(!list_empty(&ppgtt->base.active_list));
-
         list_for_each_entry_safe(vma, next, &ppgtt->base.inactive_list,
                                  mm_list) {
                 if (WARN_ON(__i915_vma_unbind_no_wait(vma)))
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 22e86d2e408d..62211abe4922 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -6309,9 +6309,11 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc)
         if (to_intel_plane_state(crtc->primary->state)->visible) {
                 intel_crtc_wait_for_pending_flips(crtc);
                 intel_pre_disable_primary(crtc);
+
+                intel_crtc_disable_planes(crtc, 1 << drm_plane_index(crtc->primary));
+                to_intel_plane_state(crtc->primary->state)->visible = false;
         }
 
-        intel_crtc_disable_planes(crtc, crtc->state->plane_mask);
         dev_priv->display.crtc_disable(crtc);
         intel_crtc->active = false;
         intel_update_watermarks(crtc);
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 071a76b9ac52..f091ad12d694 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4782,8 +4782,7 @@ static void gen9_enable_rc6(struct drm_device *dev)
         /* 2b: Program RC6 thresholds.*/
 
         /* WaRsDoubleRc6WrlWithCoarsePowerGating: Doubling WRL only when CPG is enabled */
-        if (IS_SKYLAKE(dev) && !((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) &&
-                                 (INTEL_REVID(dev) <= SKL_REVID_E0)))
+        if (IS_SKYLAKE(dev))
                 I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 108 << 16);
         else
                 I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 54 << 16);
@@ -4825,7 +4824,7 @@ static void gen9_enable_rc6(struct drm_device *dev)
          * WaRsDisableCoarsePowerGating:skl,bxt - Render/Media PG need to be disabled with RC6.
          */
         if ((IS_BROXTON(dev) && (INTEL_REVID(dev) < BXT_REVID_B0)) ||
-            ((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && (INTEL_REVID(dev) <= SKL_REVID_E0)))
+            ((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && (INTEL_REVID(dev) <= SKL_REVID_F0)))
                 I915_WRITE(GEN9_PG_ENABLE, 0);
         else
                 I915_WRITE(GEN9_PG_ENABLE, (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ?
diff --git a/drivers/gpu/drm/omapdrm/omap_fbdev.c b/drivers/gpu/drm/omapdrm/omap_fbdev.c
index b8e4cdec28c3..24f92bea39c7 100644
--- a/drivers/gpu/drm/omapdrm/omap_fbdev.c
+++ b/drivers/gpu/drm/omapdrm/omap_fbdev.c
@@ -112,11 +112,8 @@ static int omap_fbdev_create(struct drm_fb_helper *helper,
         dma_addr_t paddr;
         int ret;
 
-        /* only doing ARGB32 since this is what is needed to alpha-blend
-         * with video overlays:
-         */
         sizes->surface_bpp = 32;
-        sizes->surface_depth = 32;
+        sizes->surface_depth = 24;
 
         DBG("create fbdev: %dx%d@%d (%dx%d)", sizes->surface_width,
                         sizes->surface_height, sizes->surface_bpp,
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 8f59f057cdf4..80a73bfc1a65 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1217,6 +1217,7 @@ config SENSORS_PWM_FAN
 config SENSORS_SHT15
         tristate "Sensiron humidity and temperature sensors. SHT15 and compat."
         depends on GPIOLIB || COMPILE_TEST
+        select BITREVERSE
         help
           If you say yes here you get support for the Sensiron SHT10, SHT11,
           SHT15, SHT71, SHT75 humidity and temperature sensors.
diff --git a/drivers/hwmon/tmp102.c b/drivers/hwmon/tmp102.c
index 65482624ea2c..5289aa0980a8 100644
--- a/drivers/hwmon/tmp102.c
+++ b/drivers/hwmon/tmp102.c
@@ -58,6 +58,7 @@ struct tmp102 {
         u16 config_orig;
         unsigned long last_update;
         int temp[3];
+        bool first_time;
 };
 
 /* convert left adjusted 13-bit TMP102 register value to milliCelsius */
@@ -93,6 +94,7 @@ static struct tmp102 *tmp102_update_device(struct device *dev)
                                 tmp102->temp[i] = tmp102_reg_to_mC(status);
                 }
                 tmp102->last_update = jiffies;
+                tmp102->first_time = false;
         }
         mutex_unlock(&tmp102->lock);
         return tmp102;
@@ -102,6 +104,12 @@ static int tmp102_read_temp(void *dev, int *temp)
 {
         struct tmp102 *tmp102 = tmp102_update_device(dev);
 
+        /* Is it too early even to return a conversion? */
+        if (tmp102->first_time) {
+                dev_dbg(dev, "%s: Conversion not ready yet..\n", __func__);
+                return -EAGAIN;
+        }
+
         *temp = tmp102->temp[0];
 
         return 0;
@@ -114,6 +122,10 @@ static ssize_t tmp102_show_temp(struct device *dev,
         struct sensor_device_attribute *sda = to_sensor_dev_attr(attr);
         struct tmp102 *tmp102 = tmp102_update_device(dev);
 
+        /* Is it too early even to return a read? */
+        if (tmp102->first_time)
+                return -EAGAIN;
+
         return sprintf(buf, "%d\n", tmp102->temp[sda->index]);
 }
 
@@ -207,7 +219,9 @@ static int tmp102_probe(struct i2c_client *client,
                 status = -ENODEV;
                 goto fail_restore_config;
         }
-        tmp102->last_update = jiffies - HZ;
+        tmp102->last_update = jiffies;
+        /* Mark that we are not ready with data until conversion is complete */
+        tmp102->first_time = true;
         mutex_init(&tmp102->lock);
 
         hwmon_dev = hwmon_device_register_with_groups(dev, client->name,
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index c5628a42170a..a8bdcb5292f5 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -202,8 +202,15 @@ static void i2c_davinci_calc_clk_dividers(struct davinci_i2c_dev *dev)
          * d is always 6 on Keystone I2C controller
          */
 
-        /* get minimum of 7 MHz clock, but max of 12 MHz */
-        psc = (input_clock / 7000000) - 1;
+        /*
+         * Both Davinci and current Keystone User Guides recommend a value
+         * between 7MHz and 12MHz. In reality 7MHz module clock doesn't
+         * always produce enough margin between SDA and SCL transitions.
+         * Measurements show that the higher the module clock is, the
+         * bigger is the margin, providing more reliable communication.
+         * So we better target for 12MHz.
+         */
+        psc = (input_clock / 12000000) - 1;
         if ((input_clock / (psc + 1)) > 12000000)
                 psc++;  /* better to run under spec than over */
         d = (psc >= 2) ? 5 : 7 - psc;
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 8c48b27ba059..de7fbbb374cd 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -813,6 +813,12 @@ static irqreturn_t i2c_dw_isr(int this_irq, void *dev_id)
 tx_aborted:
         if ((stat & (DW_IC_INTR_TX_ABRT | DW_IC_INTR_STOP_DET)) || dev->msg_err)
                 complete(&dev->cmd_complete);
+        else if (unlikely(dev->accessor_flags & ACCESS_INTR_MASK)) {
+                /* workaround to trigger pending interrupt */
+                stat = dw_readl(dev, DW_IC_INTR_MASK);
+                i2c_dw_disable_int(dev);
+                dw_writel(dev, stat, DW_IC_INTR_MASK);
+        }
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
index 1d50898e7b24..9ffb63a60f95 100644
--- a/drivers/i2c/busses/i2c-designware-core.h
+++ b/drivers/i2c/busses/i2c-designware-core.h
@@ -111,6 +111,7 @@ struct dw_i2c_dev {
 
 #define ACCESS_SWAP             0x00000001
 #define ACCESS_16BIT            0x00000002
+#define ACCESS_INTR_MASK        0x00000004
 
 extern int i2c_dw_init(struct dw_i2c_dev *dev);
 extern void i2c_dw_disable(struct dw_i2c_dev *dev);
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 809579ecb5a4..6b00061c3746 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -93,6 +93,7 @@ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[],
 static int dw_i2c_acpi_configure(struct platform_device *pdev)
 {
         struct dw_i2c_dev *dev = platform_get_drvdata(pdev);
+        const struct acpi_device_id *id;
 
         dev->adapter.nr = -1;
         dev->tx_fifo_depth = 32;
@@ -106,6 +107,10 @@ static int dw_i2c_acpi_configure(struct platform_device *pdev)
         dw_i2c_acpi_params(pdev, "FMCN", &dev->fs_hcnt, &dev->fs_lcnt,
                            &dev->sda_hold_time);
 
+        id = acpi_match_device(pdev->dev.driver->acpi_match_table, &pdev->dev);
+        if (id && id->driver_data)
+                dev->accessor_flags |= (u32)id->driver_data;
+
         return 0;
 }
 
@@ -116,7 +121,7 @@ static const struct acpi_device_id dw_i2c_acpi_match[] = {
         { "INT3433", 0 },
         { "80860F41", 0 },
         { "808622C1", 0 },
-        { "AMD0010", 0 },
+        { "AMD0010", ACCESS_INTR_MASK },
         { }
 };
 MODULE_DEVICE_TABLE(acpi, dw_i2c_acpi_match);
@@ -240,12 +245,10 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
         }
 
         r = i2c_dw_probe(dev);
-        if (r) {
+        if (r && !dev->pm_runtime_disabled)
                 pm_runtime_disable(&pdev->dev);
-                return r;
-        }
 
-        return 0;
+        return r;
 }
 
 static int dw_i2c_plat_remove(struct platform_device *pdev)
@@ -260,7 +263,8 @@ static int dw_i2c_plat_remove(struct platform_device *pdev)
 
         pm_runtime_dont_use_autosuspend(&pdev->dev);
         pm_runtime_put_sync(&pdev->dev);
-        pm_runtime_disable(&pdev->dev);
+        if (!dev->pm_runtime_disabled)
+                pm_runtime_disable(&pdev->dev);
 
         return 0;
 }
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 9bb0b056b25f..d4d853680ae4 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -1119,6 +1119,8 @@ static int i2c_imx_probe(struct platform_device *pdev)
                         i2c_imx, IMX_I2C_I2CR);
         imx_i2c_write_reg(i2c_imx->hwdata->i2sr_clr_opcode, i2c_imx, IMX_I2C_I2SR);
 
+        i2c_imx_init_recovery_info(i2c_imx, pdev);
+
         /* Add I2C adapter */
         ret = i2c_add_numbered_adapter(&i2c_imx->adapter);
         if (ret < 0) {
@@ -1126,8 +1128,6 @@ static int i2c_imx_probe(struct platform_device *pdev)
                 goto clk_disable;
         }
 
-        i2c_imx_init_recovery_info(i2c_imx, pdev);
-
         /* Set up platform driver data */
         platform_set_drvdata(pdev, i2c_imx);
         clk_disable_unprepare(i2c_imx->clk);
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index 5801227b97ab..43207f52e5a3 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -146,6 +146,8 @@ struct mv64xxx_i2c_data {
         bool                    errata_delay;
         struct reset_control    *rstc;
         bool                    irq_clear_inverted;
+        /* Clk div is 2 to the power n, not 2 to the power n + 1 */
+        bool                    clk_n_base_0;
 };
 
 static struct mv64xxx_i2c_regs mv64xxx_i2c_regs_mv64xxx = {
@@ -757,25 +759,29 @@ MODULE_DEVICE_TABLE(of, mv64xxx_i2c_of_match_table);
 #ifdef CONFIG_OF
 #ifdef CONFIG_HAVE_CLK
 static int
-mv64xxx_calc_freq(const int tclk, const int n, const int m)
+mv64xxx_calc_freq(struct mv64xxx_i2c_data *drv_data,
+                  const int tclk, const int n, const int m)
 {
-        return tclk / (10 * (m + 1) * (2 << n));
+        if (drv_data->clk_n_base_0)
+                return tclk / (10 * (m + 1) * (1 << n));
+        else
+                return tclk / (10 * (m + 1) * (2 << n));
 }
 
 static bool
-mv64xxx_find_baud_factors(const u32 req_freq, const u32 tclk, u32 *best_n,
-                          u32 *best_m)
+mv64xxx_find_baud_factors(struct mv64xxx_i2c_data *drv_data,
+                          const u32 req_freq, const u32 tclk)
 {
         int freq, delta, best_delta = INT_MAX;
         int m, n;
 
         for (n = 0; n <= 7; n++)
                 for (m = 0; m <= 15; m++) {
-                        freq = mv64xxx_calc_freq(tclk, n, m);
+                        freq = mv64xxx_calc_freq(drv_data, tclk, n, m);
                         delta = req_freq - freq;
                         if (delta >= 0 && delta < best_delta) {
-                                *best_m = m;
-                                *best_n = n;
+                                drv_data->freq_m = m;
+                                drv_data->freq_n = n;
                                 best_delta = delta;
                         }
                         if (best_delta == 0)
@@ -813,8 +819,11 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
         if (of_property_read_u32(np, "clock-frequency", &bus_freq))
                 bus_freq = 100000; /* 100kHz by default */
 
-        if (!mv64xxx_find_baud_factors(bus_freq, tclk,
-                                       &drv_data->freq_n, &drv_data->freq_m)) {
+        if (of_device_is_compatible(np, "allwinner,sun4i-a10-i2c") ||
+            of_device_is_compatible(np, "allwinner,sun6i-a31-i2c"))
+                drv_data->clk_n_base_0 = true;
+
+        if (!mv64xxx_find_baud_factors(drv_data, bus_freq, tclk)) {
                 rc = -EINVAL;
                 goto out;
         }
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index b0ae560b38c3..599c0d7bd906 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -576,7 +576,7 @@ static int rcar_reg_slave(struct i2c_client *slave)
         if (slave->flags & I2C_CLIENT_TEN)
                 return -EAFNOSUPPORT;
 
-        pm_runtime_forbid(rcar_i2c_priv_to_dev(priv));
+        pm_runtime_get_sync(rcar_i2c_priv_to_dev(priv));
 
         priv->slave = slave;
         rcar_i2c_write(priv, ICSAR, slave->addr);
@@ -598,7 +598,7 @@ static int rcar_unreg_slave(struct i2c_client *slave)
 
         priv->slave = NULL;
 
-        pm_runtime_allow(rcar_i2c_priv_to_dev(priv));
+        pm_runtime_put(rcar_i2c_priv_to_dev(priv));
 
         return 0;
 }
diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
index c1935ebd6a9c..9096d17beb5b 100644
--- a/drivers/i2c/busses/i2c-rk3x.c
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -908,7 +908,7 @@ static int rk3x_i2c_probe(struct platform_device *pdev)
                                  &i2c->scl_fall_ns))
                 i2c->scl_fall_ns = 300;
         if (of_property_read_u32(pdev->dev.of_node, "i2c-sda-falling-time-ns",
-                                 &i2c->scl_fall_ns))
+                                 &i2c->sda_fall_ns))
                 i2c->sda_fall_ns = i2c->scl_fall_ns;
 
         strlcpy(i2c->adap.name, "rk3x-i2c", sizeof(i2c->adap.name));
diff --git a/drivers/i2c/busses/i2c-st.c b/drivers/i2c/busses/i2c-st.c
index ea72dca32fdf..25020ec777c9 100644
--- a/drivers/i2c/busses/i2c-st.c
+++ b/drivers/i2c/busses/i2c-st.c
@@ -822,7 +822,7 @@ static int st_i2c_probe(struct platform_device *pdev)
 
         adap = &i2c_dev->adap;
         i2c_set_adapdata(adap, i2c_dev);
-        snprintf(adap->name, sizeof(adap->name), "ST I2C(0x%pa)", &res->start);
+        snprintf(adap->name, sizeof(adap->name), "ST I2C(%pa)", &res->start);
         adap->owner = THIS_MODULE;
         adap->timeout = 2 * HZ;
         adap->retries = 0;
diff --git a/drivers/input/joystick/db9.c b/drivers/input/joystick/db9.c
index 932d07307454..da326090c2b0 100644
--- a/drivers/input/joystick/db9.c
+++ b/drivers/input/joystick/db9.c
@@ -592,6 +592,7 @@ static void db9_attach(struct parport *pp)
                 return;
         }
 
+        memset(&db9_parport_cb, 0, sizeof(db9_parport_cb));
         db9_parport_cb.flags = PARPORT_FLAG_EXCL;
 
         pd = parport_register_dev_model(pp, "db9", &db9_parport_cb, port_idx);
diff --git a/drivers/input/joystick/gamecon.c b/drivers/input/joystick/gamecon.c
index 5a672dcac0d8..eae14d512353 100644
--- a/drivers/input/joystick/gamecon.c
+++ b/drivers/input/joystick/gamecon.c
@@ -951,6 +951,7 @@ static void gc_attach(struct parport *pp)
         pads = gc_cfg[port_idx].args + 1;
         n_pads = gc_cfg[port_idx].nargs - 1;
 
+        memset(&gc_parport_cb, 0, sizeof(gc_parport_cb));
         gc_parport_cb.flags = PARPORT_FLAG_EXCL;
 
         pd = parport_register_dev_model(pp, "gamecon", &gc_parport_cb,
diff --git a/drivers/input/joystick/turbografx.c b/drivers/input/joystick/turbografx.c
index 9f5bca26bd2f..77f575dd0901 100644
--- a/drivers/input/joystick/turbografx.c
+++ b/drivers/input/joystick/turbografx.c
@@ -181,6 +181,7 @@ static void tgfx_attach(struct parport *pp)
         n_buttons = tgfx_cfg[port_idx].args + 1;
         n_devs = tgfx_cfg[port_idx].nargs - 1;
 
+        memset(&tgfx_parport_cb, 0, sizeof(tgfx_parport_cb));
         tgfx_parport_cb.flags = PARPORT_FLAG_EXCL;
 
         pd = parport_register_dev_model(pp, "turbografx", &tgfx_parport_cb,
diff --git a/drivers/input/joystick/walkera0701.c b/drivers/input/joystick/walkera0701.c
index 9c07fe911075..70a893a17467 100644
--- a/drivers/input/joystick/walkera0701.c
+++ b/drivers/input/joystick/walkera0701.c
@@ -218,6 +218,7 @@ static void walkera0701_attach(struct parport *pp)
 
         w->parport = pp;
 
+        memset(&walkera0701_parport_cb, 0, sizeof(walkera0701_parport_cb));
         walkera0701_parport_cb.flags = PARPORT_FLAG_EXCL;
         walkera0701_parport_cb.irq_func = walkera0701_irq_handler;
         walkera0701_parport_cb.private = w;
diff --git a/drivers/input/misc/arizona-haptics.c b/drivers/input/misc/arizona-haptics.c
index 4bf678541496..d5994a745ffa 100644
--- a/drivers/input/misc/arizona-haptics.c
+++ b/drivers/input/misc/arizona-haptics.c
@@ -97,8 +97,7 @@ static void arizona_haptics_work(struct work_struct *work)
 
                 ret = regmap_update_bits(arizona->regmap,
                                          ARIZONA_HAPTICS_CONTROL_1,
-                                         ARIZONA_HAP_CTRL_MASK,
-                                         1 << ARIZONA_HAP_CTRL_SHIFT);
+                                         ARIZONA_HAP_CTRL_MASK, 0);
                 if (ret != 0) {
                         dev_err(arizona->dev, "Failed to stop haptics: %d\n",
                                 ret);
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 5e1665bbaa0b..2f589857a039 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -41,6 +41,7 @@
 
 #define DRIVER_NAME             "elan_i2c"
 #define ELAN_DRIVER_VERSION     "1.6.1"
+#define ELAN_VENDOR_ID          0x04f3
 #define ETP_MAX_PRESSURE        255
 #define ETP_FWIDTH_REDUCE       90
 #define ETP_FINGER_WIDTH        15
@@ -914,6 +915,8 @@ static int elan_setup_input_device(struct elan_tp_data *data)
 
         input->name = "Elan Touchpad";
         input->id.bustype = BUS_I2C;
+        input->id.vendor = ELAN_VENDOR_ID;
+        input->id.product = data->product_id;
         input_set_drvdata(input, data);
 
         error = input_mt_init_slots(input, ETP_MAX_FINGERS,
diff --git a/drivers/input/serio/parkbd.c b/drivers/input/serio/parkbd.c
index 92c31b8f8fb4..1edfac78d4ac 100644
--- a/drivers/input/serio/parkbd.c
+++ b/drivers/input/serio/parkbd.c
@@ -145,6 +145,7 @@ static int parkbd_getport(struct parport *pp)
 {
         struct pardev_cb parkbd_parport_cb;
 
+        memset(&parkbd_parport_cb, 0, sizeof(parkbd_parport_cb));
         parkbd_parport_cb.irq_func = parkbd_interrupt;
         parkbd_parport_cb.flags = PARPORT_FLAG_EXCL;
 
diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
index e7f966da6efa..78ca44840d60 100644
--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -1819,6 +1819,14 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
         input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0);
         input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0);
 
+        /* Verify that a device really has an endpoint */
+        if (intf->altsetting[0].desc.bNumEndpoints < 1) {
+                dev_err(&intf->dev,
+                        "interface has %d endpoints, but must have minimum 1\n",
+                        intf->altsetting[0].desc.bNumEndpoints);
+                err = -EINVAL;
+                goto fail3;
+        }
         endpoint = &intf->altsetting[0].endpoint[0].desc;
 
         /* Go set up our URB, which is called when the tablet receives
@@ -1861,6 +1869,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
         if (i == ARRAY_SIZE(speeds)) {
                 dev_info(&intf->dev,
                          "Aiptek tried all speeds, no sane response\n");
+                err = -EINVAL;
                 goto fail3;
         }
 
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index c5622058c22b..2d5794ec338b 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -2487,6 +2487,31 @@ static struct mxt_acpi_platform_data samus_platform_data[] = {
         { }
 };
 
+static unsigned int chromebook_tp_buttons[] = {
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        BTN_LEFT
+};
+
+static struct mxt_acpi_platform_data chromebook_platform_data[] = {
+        {
+                /* Touchpad */
+                .hid    = "ATML0000",
+                .pdata  = {
+                        .t19_num_keys   = ARRAY_SIZE(chromebook_tp_buttons),
+                        .t19_keymap     = chromebook_tp_buttons,
+                },
+        },
+        {
+                /* Touchscreen */
+                .hid    = "ATML0001",
+        },
+        { }
+};
+
 static const struct dmi_system_id mxt_dmi_table[] = {
         {
                 /* 2015 Google Pixel */
@@ -2497,6 +2522,14 @@ static const struct dmi_system_id mxt_dmi_table[] = {
                 },
                 .driver_data = samus_platform_data,
         },
+        {
+                /* Other Google Chromebooks */
+                .ident = "Chromebook",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+                },
+                .driver_data = chromebook_platform_data,
+        },
         { }
 };
 
@@ -2701,6 +2734,7 @@ static const struct i2c_device_id mxt_id[] = {
         { "qt602240_ts", 0 },
         { "atmel_mxt_ts", 0 },
         { "atmel_mxt_tp", 0 },
+        { "maxtouch", 0 },
         { "mXT224", 0 },
         { }
 };
diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c
index 17cc20ef4923..ac09855fa435 100644
--- a/drivers/input/touchscreen/elants_i2c.c
+++ b/drivers/input/touchscreen/elants_i2c.c
@@ -1316,7 +1316,13 @@ static int __maybe_unused elants_i2c_suspend(struct device *dev)
 
         disable_irq(client->irq);
 
-        if (device_may_wakeup(dev) || ts->keep_power_in_suspend) {
+        if (device_may_wakeup(dev)) {
+                /*
+                 * The device will automatically enter idle mode
+                 * that has reduced power consumption.
+                 */
+                ts->wake_irq_enabled = (enable_irq_wake(client->irq) == 0);
+        } else if (ts->keep_power_in_suspend) {
                 for (retry_cnt = 0; retry_cnt < MAX_RETRIES; retry_cnt++) {
                         error = elants_i2c_send(client, set_sleep_cmd,
                                                 sizeof(set_sleep_cmd));
@@ -1326,10 +1332,6 @@ static int __maybe_unused elants_i2c_suspend(struct device *dev)
                         dev_err(&client->dev,
                                 "suspend command failed: %d\n", error);
                 }
-
-                if (device_may_wakeup(dev))
-                        ts->wake_irq_enabled =
-                                        (enable_irq_wake(client->irq) == 0);
         } else {
                 elants_i2c_power_off(ts);
         }
@@ -1345,10 +1347,11 @@ static int __maybe_unused elants_i2c_resume(struct device *dev)
         int retry_cnt;
         int error;
 
-        if (device_may_wakeup(dev) && ts->wake_irq_enabled)
-                disable_irq_wake(client->irq);
-
-        if (ts->keep_power_in_suspend) {
+        if (device_may_wakeup(dev)) {
+                if (ts->wake_irq_enabled)
+                        disable_irq_wake(client->irq);
+                elants_i2c_sw_reset(client);
+        } else if (ts->keep_power_in_suspend) {
                 for (retry_cnt = 0; retry_cnt < MAX_RETRIES; retry_cnt++) {
                         error = elants_i2c_send(client, set_active_cmd,
                                                 sizeof(set_active_cmd));
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index d21d4edf7236..7caf2fa237f2 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -494,6 +494,22 @@ static void handle_fault_error(struct fault *fault)
         }
 }
 
+static bool access_error(struct vm_area_struct *vma, struct fault *fault)
+{
+        unsigned long requested = 0;
+
+        if (fault->flags & PPR_FAULT_EXEC)
+                requested |= VM_EXEC;
+
+        if (fault->flags & PPR_FAULT_READ)
+                requested |= VM_READ;
+
+        if (fault->flags & PPR_FAULT_WRITE)
+                requested |= VM_WRITE;
+
+        return (requested & ~vma->vm_flags) != 0;
+}
+
 static void do_fault(struct work_struct *work)
 {
         struct fault *fault = container_of(work, struct fault, work);
@@ -516,8 +532,8 @@ static void do_fault(struct work_struct *work)
                 goto out;
         }
 
-        if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))) {
-                /* handle_mm_fault would BUG_ON() */
+        /* Check if we have the right permissions on the vma */
+        if (access_error(vma, fault)) {
                 up_read(&mm->mmap_sem);
                 handle_fault_error(fault);
                 goto out;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index f1042daef9ad..ac7387686ddc 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2159,7 +2159,7 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
                         sg_res = aligned_nrpages(sg->offset, sg->length);
                         sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + sg->offset;
                         sg->dma_length = sg->length;
-                        pteval = (sg_phys(sg) & PAGE_MASK) | prot;
+                        pteval = page_to_phys(sg_page(sg)) | prot;
                         phys_pfn = pteval >> VTD_PAGE_SHIFT;
                 }
 
@@ -3704,7 +3704,7 @@ static int intel_nontranslate_map_sg(struct device *hddev,
 
         for_each_sg(sglist, sg, nelems, i) {
                 BUG_ON(!sg_page(sg));
-                sg->dma_address = sg_phys(sg);
+                sg->dma_address = page_to_phys(sg_page(sg)) + sg->offset;
                 sg->dma_length = sg->length;
         }
         return nelems;
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index c69e3f9ec958..50464833d0b8 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -484,6 +484,23 @@ struct page_req_dsc {
 };
 
 #define PRQ_RING_MASK ((0x1000 << PRQ_ORDER) - 0x10)
+
+static bool access_error(struct vm_area_struct *vma, struct page_req_dsc *req)
+{
+        unsigned long requested = 0;
+
+        if (req->exe_req)
+                requested |= VM_EXEC;
+
+        if (req->rd_req)
+                requested |= VM_READ;
+
+        if (req->wr_req)
+                requested |= VM_WRITE;
+
+        return (requested & ~vma->vm_flags) != 0;
+}
+
 static irqreturn_t prq_event_thread(int irq, void *d)
 {
         struct intel_iommu *iommu = d;
@@ -539,6 +556,9 @@ static irqreturn_t prq_event_thread(int irq, void *d)
                 if (!vma || address < vma->vm_start)
                         goto invalid;
 
+                if (access_error(vma, req))
+                        goto invalid;
+
                 ret = handle_mm_fault(svm->mm, vma, address,
                                       req->wr_req ? FAULT_FLAG_WRITE : 0);
                 if (ret & VM_FAULT_ERROR)
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index abae363c7b9b..0e3b0092ec92 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -1430,7 +1430,7 @@ size_t default_iommu_map_sg(struct iommu_domain *domain, unsigned long iova,
         min_pagesz = 1 << __ffs(domain->ops->pgsize_bitmap);
 
         for_each_sg(sg, s, nents, i) {
-                phys_addr_t phys = sg_phys(s);
+                phys_addr_t phys = page_to_phys(sg_page(s)) + s->offset;
 
                 /*
                  * We are mapping on IOMMU page boundaries, so offset within
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index 375be509e95f..2a506fe0c8a4 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -67,8 +67,7 @@ static int write_modem(struct cardstate *cs)
         struct sk_buff *skb = bcs->tx_skb;
         int sent = -EOPNOTSUPP;
 
-        if (!tty || !tty->driver || !skb)
-                return -EINVAL;
+        WARN_ON(!tty || !tty->ops || !skb);
 
         if (!skb->len) {
                 dev_kfree_skb_any(skb);
@@ -109,8 +108,7 @@ static int send_cb(struct cardstate *cs)
         unsigned long flags;
         int sent = 0;
 
-        if (!tty || !tty->driver)
-                return -EFAULT;
+        WARN_ON(!tty || !tty->ops);
 
         cb = cs->cmdbuf;
         if (!cb)
@@ -370,19 +368,18 @@ static void gigaset_freecshw(struct cardstate *cs)
         tasklet_kill(&cs->write_tasklet);
         if (!cs->hw.ser)
                 return;
-        dev_set_drvdata(&cs->hw.ser->dev.dev, NULL);
         platform_device_unregister(&cs->hw.ser->dev);
-        kfree(cs->hw.ser);
-        cs->hw.ser = NULL;
 }
 
 static void gigaset_device_release(struct device *dev)
 {
-        struct platform_device *pdev = to_platform_device(dev);
+        struct cardstate *cs = dev_get_drvdata(dev);
 
-        /* adapted from platform_device_release() in drivers/base/platform.c */
-        kfree(dev->platform_data);
-        kfree(pdev->resource);
+        if (!cs)
+                return;
+        dev_set_drvdata(dev, NULL);
+        kfree(cs->hw.ser);
+        cs->hw.ser = NULL;
 }
 
 /*
@@ -432,7 +429,9 @@ static int gigaset_set_modem_ctrl(struct cardstate *cs, unsigned old_state,
         struct tty_struct *tty = cs->hw.ser->tty;
         unsigned int set, clear;
 
-        if (!tty || !tty->driver || !tty->ops->tiocmset)
+        WARN_ON(!tty || !tty->ops);
+        /* tiocmset is an optional tty driver method */
+        if (!tty->ops->tiocmset)
                 return -EINVAL;
         set = new_state & ~old_state;
         clear = old_state & ~new_state;
diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
index a77eea594b69..cb428b9ee441 100644
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -1170,7 +1170,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
 
         if (ipac->type & IPAC_TYPE_IPACX) {
                 ista = ReadIPAC(ipac, ISACX_ISTA);
-                while (ista && cnt--) {
+                while (ista && --cnt) {
                         pr_debug("%s: ISTA %02x\n", ipac->name, ista);
                         if (ista & IPACX__ICA)
                                 ipac_irq(&ipac->hscx[0], ista);
@@ -1182,7 +1182,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
                 }
         } else if (ipac->type & IPAC_TYPE_IPAC) {
                 ista = ReadIPAC(ipac, IPAC_ISTA);
-                while (ista && cnt--) {
+                while (ista && --cnt) {
                         pr_debug("%s: ISTA %02x\n", ipac->name, ista);
                         if (ista & (IPAC__ICD | IPAC__EXD)) {
                                 istad = ReadISAC(isac, ISAC_ISTA);
@@ -1200,7 +1200,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
                         ista = ReadIPAC(ipac, IPAC_ISTA);
                 }
         } else if (ipac->type & IPAC_TYPE_HSCX) {
-                while (cnt) {
+                while (--cnt) {
                         ista = ReadIPAC(ipac, IPAC_ISTAB + ipac->hscx[1].off);
                         pr_debug("%s: B2 ISTA %02x\n", ipac->name, ista);
                         if (ista)
@@ -1211,7 +1211,6 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
                                 mISDNisac_irq(isac, istad);
                         if (0 == (ista | istad))
                                 break;
-                        cnt--;
                 }
         }
         if (cnt > maxloop) /* only for ISAC/HSCX without PCI IRQ test */
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 807095f4c793..dbedc58d8c00 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -314,8 +314,8 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio)
  */
 void mddev_suspend(struct mddev *mddev)
 {
-        BUG_ON(mddev->suspended);
-        mddev->suspended = 1;
+        if (mddev->suspended++)
+                return;
         synchronize_rcu();
         wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0);
         mddev->pers->quiesce(mddev, 1);
@@ -326,7 +326,8 @@ EXPORT_SYMBOL_GPL(mddev_suspend);
 
 void mddev_resume(struct mddev *mddev)
 {
-        mddev->suspended = 0;
+        if (--mddev->suspended)
+                return;
         wake_up(&mddev->sb_wait);
         mddev->pers->quiesce(mddev, 0);
 
@@ -1652,7 +1653,7 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
                         rdev->journal_tail = le64_to_cpu(sb->journal_tail);
                         if (mddev->recovery_cp == MaxSector)
                                 set_bit(MD_JOURNAL_CLEAN, &mddev->flags);
-                        rdev->raid_disk = mddev->raid_disks;
+                        rdev->raid_disk = 0;
                         break;
                 default:
                         rdev->saved_raid_disk = role;
@@ -2773,6 +2774,7 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
                 /* Activating a spare .. or possibly reactivating
                  * if we ever get bitmaps working here.
                  */
+                int err;
 
                 if (rdev->raid_disk != -1)
                         return -EBUSY;
@@ -2794,9 +2796,15 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
                         rdev->saved_raid_disk = -1;
                 clear_bit(In_sync, &rdev->flags);
                 clear_bit(Bitmap_sync, &rdev->flags);
-                remove_and_add_spares(rdev->mddev, rdev);
-                if (rdev->raid_disk == -1)
-                        return -EBUSY;
+                err = rdev->mddev->pers->
+                        hot_add_disk(rdev->mddev, rdev);
+                if (err) {
+                        rdev->raid_disk = -1;
+                        return err;
+                } else
+                        sysfs_notify_dirent_safe(rdev->sysfs_state);
+                if (sysfs_link_rdev(rdev->mddev, rdev))
+                        /* failure here is OK */;
                 /* don't wakeup anyone, leave that to userspace. */
         } else {
                 if (slot >= rdev->mddev->raid_disks &&
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 2bea51edfab7..ca0b643fe3c1 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -566,7 +566,9 @@ static inline char * mdname (struct mddev * mddev)
 static inline int sysfs_link_rdev(struct mddev *mddev, struct md_rdev *rdev)
 {
         char nm[20];
-        if (!test_bit(Replacement, &rdev->flags) && mddev->kobj.sd) {
+        if (!test_bit(Replacement, &rdev->flags) &&
+            !test_bit(Journal, &rdev->flags) &&
+            mddev->kobj.sd) {
                 sprintf(nm, "rd%d", rdev->raid_disk);
                 return sysfs_create_link(&mddev->kobj, &rdev->kobj, nm);
         } else
@@ -576,7 +578,9 @@ static inline int sysfs_link_rdev(struct mddev *mddev, struct md_rdev *rdev)
 static inline void sysfs_unlink_rdev(struct mddev *mddev, struct md_rdev *rdev)
 {
         char nm[20];
-        if (!test_bit(Replacement, &rdev->flags) && mddev->kobj.sd) {
+        if (!test_bit(Replacement, &rdev->flags) &&
+            !test_bit(Journal, &rdev->flags) &&
+            mddev->kobj.sd) {
                 sprintf(nm, "rd%d", rdev->raid_disk);
                 sysfs_remove_link(&mddev->kobj, nm);
         }
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 41d70bc9ba2f..84e597e1c489 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1946,6 +1946,8 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
 
         first = i;
         fbio = r10_bio->devs[i].bio;
+        fbio->bi_iter.bi_size = r10_bio->sectors << 9;
+        fbio->bi_iter.bi_idx = 0;
 
         vcnt = (r10_bio->sectors + (PAGE_SIZE >> 9) - 1) >> (PAGE_SHIFT - 9);
         /* now find blocks with errors */
@@ -1989,7 +1991,7 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
                 bio_reset(tbio);
 
                 tbio->bi_vcnt = vcnt;
-                tbio->bi_iter.bi_size = r10_bio->sectors << 9;
+                tbio->bi_iter.bi_size = fbio->bi_iter.bi_size;
                 tbio->bi_rw = WRITE;
                 tbio->bi_private = r10_bio;
                 tbio->bi_iter.bi_sector = r10_bio->devs[i].addr;
diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
index 8616fa8193bc..c2e60b4f292d 100644
--- a/drivers/media/pci/ivtv/ivtv-driver.c
+++ b/drivers/media/pci/ivtv/ivtv-driver.c
@@ -805,11 +805,11 @@ static void ivtv_init_struct2(struct ivtv *itv)
 {
         int i;
 
-        for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS - 1; i++)
+        for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS; i++)
                 if (itv->card->video_inputs[i].video_type == 0)
                         break;
         itv->nof_inputs = i;
-        for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS - 1; i++)
+        for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS; i++)
                 if (itv->card->audio_inputs[i].audio_type == 0)
                         break;
         itv->nof_audio_inputs = i;
diff --git a/drivers/media/usb/airspy/airspy.c b/drivers/media/usb/airspy/airspy.c
index fcbb49757614..565a59310747 100644
--- a/drivers/media/usb/airspy/airspy.c
+++ b/drivers/media/usb/airspy/airspy.c
@@ -134,7 +134,7 @@ struct airspy {
         int            urbs_submitted;
 
         /* USB control message buffer */
-        #define BUF_SIZE 24
+        #define BUF_SIZE 128
         u8 buf[BUF_SIZE];
 
         /* Current configuration */
diff --git a/drivers/media/usb/hackrf/hackrf.c b/drivers/media/usb/hackrf/hackrf.c
index e05bfec90f46..0fe5cb2c260c 100644
--- a/drivers/media/usb/hackrf/hackrf.c
+++ b/drivers/media/usb/hackrf/hackrf.c
@@ -24,6 +24,15 @@
 #include <media/videobuf2-v4l2.h>
 #include <media/videobuf2-vmalloc.h>
 
+/*
+ * Used Avago MGA-81563 RF amplifier could be destroyed pretty easily with too
+ * strong signal or transmitting to bad antenna.
+ * Set RF gain control to 'grabbed' state by default for sure.
+ */
+static bool hackrf_enable_rf_gain_ctrl;
+module_param_named(enable_rf_gain_ctrl, hackrf_enable_rf_gain_ctrl, bool, 0644);
+MODULE_PARM_DESC(enable_rf_gain_ctrl, "enable RX/TX RF amplifier control (warn: could damage amplifier)");
+
 /* HackRF USB API commands (from HackRF Library) */
 enum {
         CMD_SET_TRANSCEIVER_MODE           = 0x01,
@@ -1451,6 +1460,7 @@ static int hackrf_probe(struct usb_interface *intf,
                 dev_err(dev->dev, "Could not initialize controls\n");
                 goto err_v4l2_ctrl_handler_free_rx;
         }
+        v4l2_ctrl_grab(dev->rx_rf_gain, !hackrf_enable_rf_gain_ctrl);
         v4l2_ctrl_handler_setup(&dev->rx_ctrl_handler);
 
         /* Register controls for transmitter */
@@ -1471,6 +1481,7 @@ static int hackrf_probe(struct usb_interface *intf,
                 dev_err(dev->dev, "Could not initialize controls\n");
                 goto err_v4l2_ctrl_handler_free_tx;
         }
+        v4l2_ctrl_grab(dev->tx_rf_gain, !hackrf_enable_rf_gain_ctrl);
         v4l2_ctrl_handler_setup(&dev->tx_ctrl_handler);
 
         /* Register the v4l2_device structure */
@@ -1530,7 +1541,7 @@ err_v4l2_ctrl_handler_free_rx:
 err_kfree:
         kfree(dev);
 err:
-        dev_dbg(dev->dev, "failed=%d\n", ret);
+        dev_dbg(&intf->dev, "failed=%d\n", ret);
         return ret;
 }
 
diff --git a/drivers/mtd/ofpart.c b/drivers/mtd/ofpart.c
index 669c3452f278..9ed6038e47d2 100644
--- a/drivers/mtd/ofpart.c
+++ b/drivers/mtd/ofpart.c
@@ -46,10 +46,18 @@ static int parse_ofpart_partitions(struct mtd_info *master,
 
         ofpart_node = of_get_child_by_name(mtd_node, "partitions");
         if (!ofpart_node) {
-                pr_warn("%s: 'partitions' subnode not found on %s. Trying to parse direct subnodes as partitions.\n",
-                        master->name, mtd_node->full_name);
+                /*
+                 * We might get here even when ofpart isn't used at all (e.g.,
+                 * when using another parser), so don't be louder than
+                 * KERN_DEBUG
+                 */
+                pr_debug("%s: 'partitions' subnode not found on %s. Trying to parse direct subnodes as partitions.\n",
+                         master->name, mtd_node->full_name);
                 ofpart_node = mtd_node;
                 dedicated = false;
+        } else if (!of_device_is_compatible(ofpart_node, "fixed-partitions")) {
+                /* The 'partitions' subnode might be used by another parser */
+                return 0;
         }
 
         /* First count the subnodes */
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 970781a9e677..f6a7161e3b85 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -1849,7 +1849,7 @@ static int xgbe_exit(struct xgbe_prv_data *pdata)
         usleep_range(10, 15);
 
         /* Poll Until Poll Condition */
-        while (count-- && XGMAC_IOREAD_BITS(pdata, DMA_MR, SWR))
+        while (--count && XGMAC_IOREAD_BITS(pdata, DMA_MR, SWR))
                 usleep_range(500, 600);
 
         if (!count)
@@ -1873,7 +1873,7 @@ static int xgbe_flush_tx_queues(struct xgbe_prv_data *pdata)
         /* Poll Until Poll Condition */
         for (i = 0; i < pdata->tx_q_count; i++) {
                 count = 2000;
-                while (count-- && XGMAC_MTL_IOREAD_BITS(pdata, i,
+                while (--count && XGMAC_MTL_IOREAD_BITS(pdata, i,
                                                         MTL_Q_TQOMR, FTQ))
                         usleep_range(500, 600);
 
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 9147a0107c44..d0ae1a6cc212 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -289,6 +289,7 @@ static int xgene_enet_setup_tx_desc(struct xgene_enet_desc_ring *tx_ring,
                                     struct sk_buff *skb)
 {
         struct device *dev = ndev_to_dev(tx_ring->ndev);
+        struct xgene_enet_pdata *pdata = netdev_priv(tx_ring->ndev);
         struct xgene_enet_raw_desc *raw_desc;
         __le64 *exp_desc = NULL, *exp_bufs = NULL;
         dma_addr_t dma_addr, pbuf_addr, *frag_dma_addr;
@@ -419,6 +420,7 @@ out:
         raw_desc->m0 = cpu_to_le64(SET_VAL(LL, ll) | SET_VAL(NV, nv) |
                                    SET_VAL(USERINFO, tx_ring->tail));
         tx_ring->cp_ring->cp_skb[tx_ring->tail] = skb;
+        pdata->tx_level += count;
         tx_ring->tail = tail;
 
         return count;
@@ -429,14 +431,13 @@ static netdev_tx_t xgene_enet_start_xmit(struct sk_buff *skb,
 {
         struct xgene_enet_pdata *pdata = netdev_priv(ndev);
         struct xgene_enet_desc_ring *tx_ring = pdata->tx_ring;
-        struct xgene_enet_desc_ring *cp_ring = tx_ring->cp_ring;
-        u32 tx_level, cq_level;
+        u32 tx_level = pdata->tx_level;
         int count;
 
-        tx_level = pdata->ring_ops->len(tx_ring);
-        cq_level = pdata->ring_ops->len(cp_ring);
-        if (unlikely(tx_level > pdata->tx_qcnt_hi ||
-                     cq_level > pdata->cp_qcnt_hi)) {
+        if (tx_level < pdata->txc_level)
+                tx_level += ((typeof(pdata->tx_level))~0U);
+
+        if ((tx_level - pdata->txc_level) > pdata->tx_qcnt_hi) {
                 netif_stop_queue(ndev);
                 return NETDEV_TX_BUSY;
         }
@@ -539,10 +540,13 @@ static int xgene_enet_process_ring(struct xgene_enet_desc_ring *ring,
         struct xgene_enet_raw_desc *raw_desc, *exp_desc;
         u16 head = ring->head;
         u16 slots = ring->slots - 1;
-        int ret, count = 0, processed = 0;
+        int ret, desc_count, count = 0, processed = 0;
+        bool is_completion;
 
         do {
                 raw_desc = &ring->raw_desc[head];
+                desc_count = 0;
+                is_completion = false;
                 exp_desc = NULL;
                 if (unlikely(xgene_enet_is_desc_slot_empty(raw_desc)))
                         break;
@@ -559,18 +563,24 @@ static int xgene_enet_process_ring(struct xgene_enet_desc_ring *ring,
                         }
                         dma_rmb();
                         count++;
+                        desc_count++;
                 }
-                if (is_rx_desc(raw_desc))
+                if (is_rx_desc(raw_desc)) {
                         ret = xgene_enet_rx_frame(ring, raw_desc);
-                else
+                } else {
                         ret = xgene_enet_tx_completion(ring, raw_desc);
+                        is_completion = true;
+                }
                 xgene_enet_mark_desc_slot_empty(raw_desc);
                 if (exp_desc)
                         xgene_enet_mark_desc_slot_empty(exp_desc);
 
                 head = (head + 1) & slots;
                 count++;
+                desc_count++;
                 processed++;
+                if (is_completion)
+                        pdata->txc_level += desc_count;
 
                 if (ret)
                         break;
@@ -580,10 +590,8 @@ static int xgene_enet_process_ring(struct xgene_enet_desc_ring *ring,
                 pdata->ring_ops->wr_cmd(ring, -count);
                 ring->head = head;
 
-                if (netif_queue_stopped(ring->ndev)) {
-                        if (pdata->ring_ops->len(ring) < pdata->cp_qcnt_low)
-                                netif_wake_queue(ring->ndev);
-                }
+                if (netif_queue_stopped(ring->ndev))
+                        netif_start_queue(ring->ndev);
         }
 
         return processed;
@@ -1033,9 +1041,7 @@ static int xgene_enet_create_desc_rings(struct net_device *ndev)
         pdata->tx_ring->cp_ring = cp_ring;
         pdata->tx_ring->dst_ring_num = xgene_enet_dst_ring_num(cp_ring);
 
-        pdata->tx_qcnt_hi = pdata->tx_ring->slots / 2;
-        pdata->cp_qcnt_hi = pdata->rx_ring->slots / 2;
-        pdata->cp_qcnt_low = pdata->cp_qcnt_hi / 2;
+        pdata->tx_qcnt_hi = pdata->tx_ring->slots - 128;
 
         return 0;
 
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.h b/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
index a6e56b88c0a0..1aa72c787f8d 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
@@ -155,11 +155,11 @@ struct xgene_enet_pdata {
         enum xgene_enet_id enet_id;
         struct xgene_enet_desc_ring *tx_ring;
         struct xgene_enet_desc_ring *rx_ring;
+        u16 tx_level;
+        u16 txc_level;
         char *dev_name;
         u32 rx_buff_cnt;
         u32 tx_qcnt_hi;
-        u32 cp_qcnt_hi;
-        u32 cp_qcnt_low;
         u32 rx_irq;
         u32 txc_irq;
         u8 cq_cnt;
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 2795d6db10e1..8b5988e210d5 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -1016,13 +1016,12 @@ static int atl1c_setup_ring_resources(struct atl1c_adapter *adapter)
                 sizeof(struct atl1c_recv_ret_status) * rx_desc_count +
                 8 * 4;
 
-        ring_header->desc = pci_alloc_consistent(pdev, ring_header->size,
-                                &ring_header->dma);
+        ring_header->desc = dma_zalloc_coherent(&pdev->dev, ring_header->size,
+                                                &ring_header->dma, GFP_KERNEL);
         if (unlikely(!ring_header->desc)) {
-                dev_err(&pdev->dev, "pci_alloc_consistend failed\n");
+                dev_err(&pdev->dev, "could not get memory for DMA buffer\n");
                 goto err_nomem;
         }
-        memset(ring_header->desc, 0, ring_header->size);
         /* init TPD ring */
 
         tpd_ring[0].dma = roundup(ring_header->dma, 8);
diff --git a/drivers/net/ethernet/aurora/Kconfig b/drivers/net/ethernet/aurora/Kconfig
index a3c7106fdf85..8ba7f8ff3434 100644
--- a/drivers/net/ethernet/aurora/Kconfig
+++ b/drivers/net/ethernet/aurora/Kconfig
@@ -13,6 +13,7 @@ if NET_VENDOR_AURORA
 
 config AURORA_NB8800
         tristate "Aurora AU-NB8800 support"
+        depends on HAS_DMA
         select PHYLIB
         help
          Support for the AU-NB8800 gigabit Ethernet controller.
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index bdf094fb6ef9..07f5f239cb65 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -2693,17 +2693,16 @@ static int bnxt_hwrm_func_drv_rgtr(struct bnxt *bp)
         req.ver_upd = DRV_VER_UPD;
 
         if (BNXT_PF(bp)) {
-                unsigned long vf_req_snif_bmap[4];
+                DECLARE_BITMAP(vf_req_snif_bmap, 256);
                 u32 *data = (u32 *)vf_req_snif_bmap;
 
-                memset(vf_req_snif_bmap, 0, 32);
+                memset(vf_req_snif_bmap, 0, sizeof(vf_req_snif_bmap));
                 for (i = 0; i < ARRAY_SIZE(bnxt_vf_req_snif); i++)
                         __set_bit(bnxt_vf_req_snif[i], vf_req_snif_bmap);
 
-                for (i = 0; i < 8; i++) {
-                        req.vf_req_fwd[i] = cpu_to_le32(*data);
-                        data++;
-                }
+                for (i = 0; i < 8; i++)
+                        req.vf_req_fwd[i] = cpu_to_le32(data[i]);
+
                 req.enables |=
                         cpu_to_le32(FUNC_DRV_RGTR_REQ_ENABLES_VF_REQ_FWD);
         }
@@ -4603,7 +4602,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
                         bp->nge_port_cnt = 1;
         }
 
-        bp->state = BNXT_STATE_OPEN;
+        set_bit(BNXT_STATE_OPEN, &bp->state);
         bnxt_enable_int(bp);
         /* Enable TX queues */
         bnxt_tx_enable(bp);
@@ -4679,8 +4678,10 @@ int bnxt_close_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
         /* Change device state to avoid TX queue wake up's */
         bnxt_tx_disable(bp);
 
-        bp->state = BNXT_STATE_CLOSED;
-        cancel_work_sync(&bp->sp_task);
+        clear_bit(BNXT_STATE_OPEN, &bp->state);
+        smp_mb__after_atomic();
+        while (test_bit(BNXT_STATE_IN_SP_TASK, &bp->state))
+                msleep(20);
 
         /* Flush rings before disabling interrupts */
         bnxt_shutdown_nic(bp, irq_re_init);
@@ -5030,8 +5031,10 @@ static void bnxt_dbg_dump_states(struct bnxt *bp)
 static void bnxt_reset_task(struct bnxt *bp)
 {
         bnxt_dbg_dump_states(bp);
-        if (netif_running(bp->dev))
-                bnxt_tx_disable(bp); /* prevent tx timout again */
+        if (netif_running(bp->dev)) {
+                bnxt_close_nic(bp, false, false);
+                bnxt_open_nic(bp, false, false);
+        }
 }
 
 static void bnxt_tx_timeout(struct net_device *dev)
@@ -5081,8 +5084,12 @@ static void bnxt_sp_task(struct work_struct *work)
         struct bnxt *bp = container_of(work, struct bnxt, sp_task);
         int rc;
 
-        if (bp->state != BNXT_STATE_OPEN)
+        set_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
+        smp_mb__after_atomic();
+        if (!test_bit(BNXT_STATE_OPEN, &bp->state)) {
+                clear_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
                 return;
+        }
 
         if (test_and_clear_bit(BNXT_RX_MASK_SP_EVENT, &bp->sp_event))
                 bnxt_cfg_rx_mode(bp);
@@ -5106,8 +5113,19 @@ static void bnxt_sp_task(struct work_struct *work)
                 bnxt_hwrm_tunnel_dst_port_free(
                         bp, TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_VXLAN);
         }
-        if (test_and_clear_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event))
+        if (test_and_clear_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event)) {
+                /* bnxt_reset_task() calls bnxt_close_nic() which waits
+                 * for BNXT_STATE_IN_SP_TASK to clear.
+                 */
+                clear_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
+                rtnl_lock();
                 bnxt_reset_task(bp);
+                set_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
+                rtnl_unlock();
+        }
+
+        smp_mb__before_atomic();
+        clear_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
 }
 
 static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
@@ -5186,7 +5204,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
         bp->timer.function = bnxt_timer;
         bp->current_interval = BNXT_TIMER_INTERVAL;
 
-        bp->state = BNXT_STATE_CLOSED;
+        clear_bit(BNXT_STATE_OPEN, &bp->state);
 
         return 0;
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 674bc5159b91..f199f4cc8ffe 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -925,9 +925,9 @@ struct bnxt {
 
         struct timer_list       timer;
 
-        int                     state;
-#define BNXT_STATE_CLOSED       0
-#define BNXT_STATE_OPEN         1
+        unsigned long           state;
+#define BNXT_STATE_OPEN         0
+#define BNXT_STATE_IN_SP_TASK   1
 
         struct bnxt_irq *irq_tbl;
         u8                      mac_addr[ETH_ALEN];
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index 7a9af2887d8e..ea044bbcd384 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -21,7 +21,7 @@
 #ifdef CONFIG_BNXT_SRIOV
 static int bnxt_vf_ndo_prep(struct bnxt *bp, int vf_id)
 {
-        if (bp->state != BNXT_STATE_OPEN) {
+        if (!test_bit(BNXT_STATE_OPEN, &bp->state)) {
                 netdev_err(bp->dev, "vf ndo called though PF is down\n");
                 return -EINVAL;
         }
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 4b7fd63ae57c..5f24d11cb16a 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -37,7 +37,6 @@ struct nicpf {
 #define NIC_GET_BGX_FROM_VF_LMAC_MAP(map)       ((map >> 4) & 0xF)
 #define NIC_GET_LMAC_FROM_VF_LMAC_MAP(map)      (map & 0xF)
         u8                      vf_lmac_map[MAX_LMAC];
-        u8                      lmac_cnt;
         struct delayed_work     dwork;
         struct workqueue_struct *check_link;
         u8                      link[MAX_LMAC];
@@ -280,7 +279,6 @@ static void nic_set_lmac_vf_mapping(struct nicpf *nic)
         u64 lmac_credit;
 
         nic->num_vf_en = 0;
-        nic->lmac_cnt = 0;
 
         for (bgx = 0; bgx < NIC_MAX_BGX; bgx++) {
                 if (!(bgx_map & (1 << bgx)))
@@ -290,7 +288,6 @@ static void nic_set_lmac_vf_mapping(struct nicpf *nic)
                         nic->vf_lmac_map[next_bgx_lmac++] =
                                                 NIC_SET_VF_LMAC_MAP(bgx, lmac);
                 nic->num_vf_en += lmac_cnt;
-                nic->lmac_cnt += lmac_cnt;
 
                 /* Program LMAC credits */
                 lmac_credit = (1ull << 1); /* channel credit enable */
@@ -618,6 +615,21 @@ static int nic_config_loopback(struct nicpf *nic, struct set_loopback *lbk)
         return 0;
 }
 
+static void nic_enable_vf(struct nicpf *nic, int vf, bool enable)
+{
+        int bgx, lmac;
+
+        nic->vf_enabled[vf] = enable;
+
+        if (vf >= nic->num_vf_en)
+                return;
+
+        bgx = NIC_GET_BGX_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]);
+        lmac = NIC_GET_LMAC_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]);
+
+        bgx_lmac_rx_tx_enable(nic->node, bgx, lmac, enable);
+}
+
 /* Interrupt handler to handle mailbox messages from VFs */
 static void nic_handle_mbx_intr(struct nicpf *nic, int vf)
 {
@@ -717,29 +729,14 @@ static void nic_handle_mbx_intr(struct nicpf *nic, int vf)
                 break;
         case NIC_MBOX_MSG_CFG_DONE:
                 /* Last message of VF config msg sequence */
-                nic->vf_enabled[vf] = true;
-                if (vf >= nic->lmac_cnt)
-                        goto unlock;
-
-                bgx = NIC_GET_BGX_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]);
-                lmac = NIC_GET_LMAC_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]);
-
-                bgx_lmac_rx_tx_enable(nic->node, bgx, lmac, true);
+                nic_enable_vf(nic, vf, true);
                 goto unlock;
         case NIC_MBOX_MSG_SHUTDOWN:
                 /* First msg in VF teardown sequence */
-                nic->vf_enabled[vf] = false;
                 if (vf >= nic->num_vf_en)
                         nic->sqs_used[vf - nic->num_vf_en] = false;
                 nic->pqs_vf[vf] = 0;
-
-                if (vf >= nic->lmac_cnt)
-                        break;
-
-                bgx = NIC_GET_BGX_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]);
-                lmac = NIC_GET_LMAC_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]);
-
-                bgx_lmac_rx_tx_enable(nic->node, bgx, lmac, false);
+                nic_enable_vf(nic, vf, false);
                 break;
         case NIC_MBOX_MSG_ALLOC_SQS:
                 nic_alloc_sqs(nic, &mbx.sqs_alloc);
@@ -958,7 +955,7 @@ static void nic_poll_for_link(struct work_struct *work)
 
         mbx.link_status.msg = NIC_MBOX_MSG_BGX_LINK_CHANGE;
 
-        for (vf = 0; vf < nic->lmac_cnt; vf++) {
+        for (vf = 0; vf < nic->num_vf_en; vf++) {
                 /* Poll only if VF is UP */
                 if (!nic->vf_enabled[vf])
                         continue;
diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c
index 63c2bcf8031a..b1026689b78f 100644
--- a/drivers/net/ethernet/ezchip/nps_enet.c
+++ b/drivers/net/ethernet/ezchip/nps_enet.c
@@ -48,21 +48,15 @@ static void nps_enet_read_rx_fifo(struct net_device *ndev,
                         *reg = nps_enet_reg_get(priv, NPS_ENET_REG_RX_BUF);
         else { /* !dst_is_aligned */
                 for (i = 0; i < len; i++, reg++) {
-                        u32 buf =
-                                nps_enet_reg_get(priv, NPS_ENET_REG_RX_BUF);
-
-                        /* to accommodate word-unaligned address of "reg"
-                         * we have to do memcpy_toio() instead of simple "=".
-                         */
-                        memcpy_toio((void __iomem *)reg, &buf, sizeof(buf));
+                        u32 buf = nps_enet_reg_get(priv, NPS_ENET_REG_RX_BUF);
+                        put_unaligned(buf, reg);
                 }
         }
 
         /* copy last bytes (if any) */
         if (last) {
                 u32 buf = nps_enet_reg_get(priv, NPS_ENET_REG_RX_BUF);
-
-                memcpy_toio((void __iomem *)reg, &buf, last);
+                memcpy((u8*)reg, &buf, last);
         }
 }
 
@@ -367,7 +361,7 @@ static void nps_enet_send_frame(struct net_device *ndev,
         struct nps_enet_tx_ctl tx_ctrl;
         short length = skb->len;
         u32 i, len = DIV_ROUND_UP(length, sizeof(u32));
-        u32 *src = (u32 *)virt_to_phys(skb->data);
+        u32 *src = (void *)skb->data;
         bool src_is_aligned = IS_ALIGNED((unsigned long)src, sizeof(u32));
 
         tx_ctrl.value = 0;
@@ -375,17 +369,11 @@ static void nps_enet_send_frame(struct net_device *ndev,
         if (src_is_aligned)
                 for (i = 0; i < len; i++, src++)
                         nps_enet_reg_set(priv, NPS_ENET_REG_TX_BUF, *src);
-        else { /* !src_is_aligned */
-                for (i = 0; i < len; i++, src++) {
-                        u32 buf;
-
-                        /* to accommodate word-unaligned address of "src"
-                         * we have to do memcpy_fromio() instead of simple "="
-                         */
-                        memcpy_fromio(&buf, (void __iomem *)src, sizeof(buf));
-                        nps_enet_reg_set(priv, NPS_ENET_REG_TX_BUF, buf);
-                }
-        }
+        else /* !src_is_aligned */
+                for (i = 0; i < len; i++, src++)
+                        nps_enet_reg_set(priv, NPS_ENET_REG_TX_BUF,
+                                         get_unaligned(src));
+
         /* Write the length of the Frame */
         tx_ctrl.nt = length;
 
diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-fcc.c b/drivers/net/ethernet/freescale/fs_enet/mac-fcc.c
index 08f5b911d96b..52e0091b4fb2 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mac-fcc.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mac-fcc.c
@@ -552,7 +552,7 @@ static void tx_restart(struct net_device *dev)
         cbd_t __iomem *prev_bd;
         cbd_t __iomem *last_tx_bd;
 
-        last_tx_bd = fep->tx_bd_base + (fpi->tx_ring * sizeof(cbd_t));
+        last_tx_bd = fep->tx_bd_base + ((fpi->tx_ring - 1) * sizeof(cbd_t));
 
         /* get the current bd held in TBPTR  and scan back from this point */
         recheck_bd = curr_tbptr = (cbd_t __iomem *)
diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
index 55c36230e176..40071dad1c57 100644
--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
@@ -464,7 +464,7 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
                          * address). Print error message but continue anyway.
                          */
                         if ((void *)tbipa > priv->map + resource_size(&res) - 4)
-                                dev_err(&pdev->dev, "invalid register map (should be at least 0x%04x to contain TBI address)\n",
+                                dev_err(&pdev->dev, "invalid register map (should be at least 0x%04zx to contain TBI address)\n",
                                         ((void *)tbipa - priv->map) + 4);
 
                         iowrite32be(be32_to_cpup(prop), tbipa);
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 7cf898455e60..3e233d924cce 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -894,7 +894,8 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
                                      FSL_GIANFAR_DEV_HAS_VLAN |
                                      FSL_GIANFAR_DEV_HAS_MAGIC_PACKET |
                                      FSL_GIANFAR_DEV_HAS_EXTENDED_HASH |
-                                     FSL_GIANFAR_DEV_HAS_TIMER;
+                                     FSL_GIANFAR_DEV_HAS_TIMER |
+                                     FSL_GIANFAR_DEV_HAS_RX_FILER;
 
         err = of_property_read_string(np, "phy-connection-type", &ctype);
 
@@ -1396,8 +1397,9 @@ static int gfar_probe(struct platform_device *ofdev)
                 priv->rx_queue[i]->rxic = DEFAULT_RXIC;
         }
 
-        /* always enable rx filer */
-        priv->rx_filer_enable = 1;
+        /* Always enable rx filer if available */
+        priv->rx_filer_enable =
+            (priv->device_flags & FSL_GIANFAR_DEV_HAS_RX_FILER) ? 1 : 0;
         /* Enable most messages by default */
         priv->msg_enable = (NETIF_MSG_IFUP << 1 ) - 1;
         /* use pritority h/w tx queue scheduling for single queue devices */
diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
index f266b20f9ef5..cb77667971a7 100644
--- a/drivers/net/ethernet/freescale/gianfar.h
+++ b/drivers/net/ethernet/freescale/gianfar.h
@@ -923,6 +923,7 @@ struct gfar {
 #define FSL_GIANFAR_DEV_HAS_BUF_STASHING        0x00000400
 #define FSL_GIANFAR_DEV_HAS_TIMER               0x00000800
 #define FSL_GIANFAR_DEV_HAS_WAKE_ON_FILER       0x00001000
+#define FSL_GIANFAR_DEV_HAS_RX_FILER            0x00002000
 
 #if (MAXGROUPS == 2)
 #define DEFAULT_MAPPING         0xAA
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 2a98eba660c0..b674414a4d72 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -1259,12 +1259,8 @@ int hns_dsaf_set_mac_uc_entry(
         if (MAC_IS_ALL_ZEROS(mac_entry->addr) ||
             MAC_IS_BROADCAST(mac_entry->addr) ||
             MAC_IS_MULTICAST(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "set_uc %s Mac %02x:%02x:%02x:%02x:%02x:%02x err!\n",
-                        dsaf_dev->ae_dev.name, mac_entry->addr[0],
-                        mac_entry->addr[1], mac_entry->addr[2],
-                        mac_entry->addr[3], mac_entry->addr[4],
-                        mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "set_uc %s Mac %pM err!\n",
+                        dsaf_dev->ae_dev.name, mac_entry->addr);
                 return -EINVAL;
         }
 
@@ -1331,12 +1327,8 @@ int hns_dsaf_set_mac_mc_entry(
 
         /* mac addr check */
         if (MAC_IS_ALL_ZEROS(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "set uc %s Mac %02x:%02x:%02x:%02x:%02x:%02x err!\n",
-                        dsaf_dev->ae_dev.name, mac_entry->addr[0],
-                        mac_entry->addr[1], mac_entry->addr[2],
-                        mac_entry->addr[3],
-                        mac_entry->addr[4], mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "set uc %s Mac %pM err!\n",
+                        dsaf_dev->ae_dev.name, mac_entry->addr);
                 return -EINVAL;
         }
 
@@ -1410,11 +1402,8 @@ int hns_dsaf_add_mac_mc_port(struct dsaf_device *dsaf_dev,
 
         /*chechk mac addr */
         if (MAC_IS_ALL_ZEROS(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "set_entry failed,addr %02x:%02x:%02x:%02x:%02x:%02x!\n",
-                        mac_entry->addr[0], mac_entry->addr[1],
-                        mac_entry->addr[2], mac_entry->addr[3],
-                        mac_entry->addr[4], mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "set_entry failed,addr %pM!\n",
+                        mac_entry->addr);
                 return -EINVAL;
         }
 
@@ -1497,9 +1486,8 @@ int hns_dsaf_del_mac_entry(struct dsaf_device *dsaf_dev, u16 vlan_id,
 
         /*check mac addr */
         if (MAC_IS_ALL_ZEROS(addr) || MAC_IS_BROADCAST(addr)) {
-                dev_err(dsaf_dev->dev,
-                        "del_entry failed,addr %02x:%02x:%02x:%02x:%02x:%02x!\n",
-                        addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+                dev_err(dsaf_dev->dev, "del_entry failed,addr %pM!\n",
+                        addr);
                 return -EINVAL;
         }
 
@@ -1563,11 +1551,8 @@ int hns_dsaf_del_mac_mc_port(struct dsaf_device *dsaf_dev,
 
         /*check mac addr */
         if (MAC_IS_ALL_ZEROS(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "del_port failed, addr %02x:%02x:%02x:%02x:%02x:%02x!\n",
-                        mac_entry->addr[0], mac_entry->addr[1],
-                        mac_entry->addr[2], mac_entry->addr[3],
-                        mac_entry->addr[4], mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "del_port failed, addr %pM!\n",
+                        mac_entry->addr);
                 return -EINVAL;
         }
 
@@ -1644,11 +1629,8 @@ int hns_dsaf_get_mac_uc_entry(struct dsaf_device *dsaf_dev,
         /* check macaddr */
         if (MAC_IS_ALL_ZEROS(mac_entry->addr) ||
             MAC_IS_BROADCAST(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "get_entry failed,addr %02x:%02x:%02x:%02x:%02x:%02x\n",
-                        mac_entry->addr[0], mac_entry->addr[1],
-                        mac_entry->addr[2], mac_entry->addr[3],
-                        mac_entry->addr[4], mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "get_entry failed,addr %pM\n",
+                        mac_entry->addr);
                 return -EINVAL;
         }
 
@@ -1695,11 +1677,8 @@ int hns_dsaf_get_mac_mc_entry(struct dsaf_device *dsaf_dev,
         /*check mac addr */
         if (MAC_IS_ALL_ZEROS(mac_entry->addr) ||
             MAC_IS_BROADCAST(mac_entry->addr)) {
-                dev_err(dsaf_dev->dev,
-                        "get_entry failed,addr %02x:%02x:%02x:%02x:%02x:%02x\n",
-                        mac_entry->addr[0], mac_entry->addr[1],
-                        mac_entry->addr[2], mac_entry->addr[3],
-                        mac_entry->addr[4], mac_entry->addr[5]);
+                dev_err(dsaf_dev->dev, "get_entry failed,addr %pM\n",
+                        mac_entry->addr);
                 return -EINVAL;
         }
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
index b475e1bf2e6f..bdbd80423b17 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
@@ -898,7 +898,7 @@
 #define XGMAC_PAUSE_CTL_RSP_MODE_B      2
 #define XGMAC_PAUSE_CTL_TX_XOFF_B       3
 
-static inline void dsaf_write_reg(void *base, u32 reg, u32 value)
+static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
 {
         u8 __iomem *reg_addr = ACCESS_ONCE(base);
 
@@ -908,7 +908,7 @@ static inline void dsaf_write_reg(void *base, u32 reg, u32 value)
 #define dsaf_write_dev(a, reg, value) \
         dsaf_write_reg((a)->io_base, (reg), (value))
 
-static inline u32 dsaf_read_reg(u8 *base, u32 reg)
+static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg)
 {
         u8 __iomem *reg_addr = ACCESS_ONCE(base);
 
@@ -927,8 +927,8 @@ static inline u32 dsaf_read_reg(u8 *base, u32 reg)
 #define dsaf_set_bit(origin, shift, val) \
         dsaf_set_field((origin), (1ull << (shift)), (shift), (val))
 
-static inline void dsaf_set_reg_field(void *base, u32 reg, u32 mask, u32 shift,
-                                      u32 val)
+static inline void dsaf_set_reg_field(void __iomem *base, u32 reg, u32 mask,
+                                      u32 shift, u32 val)
 {
         u32 origin = dsaf_read_reg(base, reg);
 
@@ -947,7 +947,8 @@ static inline void dsaf_set_reg_field(void *base, u32 reg, u32 mask, u32 shift,
 #define dsaf_get_bit(origin, shift) \
         dsaf_get_field((origin), (1ull << (shift)), (shift))
 
-static inline u32 dsaf_get_reg_field(void *base, u32 reg, u32 mask, u32 shift)
+static inline u32 dsaf_get_reg_field(void __iomem *base, u32 reg, u32 mask,
+                                     u32 shift)
 {
         u32 origin;
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq.c b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
index 0ff8f01e57ee..1fd5ea82a9bc 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
@@ -567,10 +567,6 @@ i40e_status i40e_init_adminq(struct i40e_hw *hw)
                 goto init_adminq_exit;
         }
 
-        /* initialize locks */
-        mutex_init(&hw->aq.asq_mutex);
-        mutex_init(&hw->aq.arq_mutex);
-
         /* Set up register offsets */
         i40e_adminq_init_regs(hw);
 
@@ -664,8 +660,6 @@ i40e_status i40e_shutdown_adminq(struct i40e_hw *hw)
         i40e_shutdown_asq(hw);
         i40e_shutdown_arq(hw);
 
-        /* destroy the locks */
-
         if (hw->nvm_buff.va)
                 i40e_free_virt_mem(hw, &hw->nvm_buff);
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index b825f978d441..4a9873ec28c7 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -10295,6 +10295,12 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         /* set up a default setting for link flow control */
         pf->hw.fc.requested_mode = I40E_FC_NONE;
 
+        /* set up the locks for the AQ, do this only once in probe
+         * and destroy them only once in remove
+         */
+        mutex_init(&hw->aq.asq_mutex);
+        mutex_init(&hw->aq.arq_mutex);
+
         err = i40e_init_adminq(hw);
 
         /* provide nvm, fw, api versions */
@@ -10697,7 +10703,6 @@ static void i40e_remove(struct pci_dev *pdev)
         set_bit(__I40E_DOWN, &pf->state);
         del_timer_sync(&pf->service_timer);
         cancel_work_sync(&pf->service_task);
-        i40e_fdir_teardown(pf);
 
         if (pf->flags & I40E_FLAG_SRIOV_ENABLED) {
                 i40e_free_vfs(pf);
@@ -10740,6 +10745,10 @@ static void i40e_remove(struct pci_dev *pdev)
                          "Failed to destroy the Admin Queue resources: %d\n",
                          ret_code);
 
+        /* destroy the locks only once, here */
+        mutex_destroy(&hw->aq.arq_mutex);
+        mutex_destroy(&hw->aq.asq_mutex);
+
         /* Clear all dynamic memory lists of rings, q_vectors, and VSIs */
         i40e_clear_interrupt_scheme(pf);
         for (i = 0; i < pf->num_alloc_vsi; i++) {
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_adminq.c b/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
index fd123ca60761..3f65e39b3fe4 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
@@ -551,10 +551,6 @@ i40e_status i40evf_init_adminq(struct i40e_hw *hw)
                 goto init_adminq_exit;
         }
 
-        /* initialize locks */
-        mutex_init(&hw->aq.asq_mutex);
-        mutex_init(&hw->aq.arq_mutex);
-
         /* Set up register offsets */
         i40e_adminq_init_regs(hw);
 
@@ -596,8 +592,6 @@ i40e_status i40evf_shutdown_adminq(struct i40e_hw *hw)
         i40e_shutdown_asq(hw);
         i40e_shutdown_arq(hw);
 
-        /* destroy the locks */
-
         if (hw->nvm_buff.va)
                 i40e_free_virt_mem(hw, &hw->nvm_buff);
 
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
index d962164dfb0f..99d2cffae0cd 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
@@ -2476,6 +2476,12 @@ static int i40evf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         hw->bus.device = PCI_SLOT(pdev->devfn);
         hw->bus.func = PCI_FUNC(pdev->devfn);
 
+        /* set up the locks for the AQ, do this only once in probe
+         * and destroy them only once in remove
+         */
+        mutex_init(&hw->aq.asq_mutex);
+        mutex_init(&hw->aq.arq_mutex);
+
         INIT_LIST_HEAD(&adapter->mac_filter_list);
         INIT_LIST_HEAD(&adapter->vlan_filter_list);
 
@@ -2629,6 +2635,10 @@ static void i40evf_remove(struct pci_dev *pdev)
         if (hw->aq.asq.count)
                 i40evf_shutdown_adminq(hw);
 
+        /* destroy the locks only once, here */
+        mutex_destroy(&hw->aq.arq_mutex);
+        mutex_destroy(&hw->aq.asq_mutex);
+
         iounmap(hw->hw_addr);
         pci_release_regions(pdev);
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 47395ff5d908..aed8d029b23d 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -7920,6 +7920,9 @@ int ixgbe_setup_tc(struct net_device *dev, u8 tc)
          */
         if (netif_running(dev))
                 ixgbe_close(dev);
+        else
+                ixgbe_reset(adapter);
+
         ixgbe_clear_interrupt_scheme(adapter);
 
 #ifdef CONFIG_IXGBE_DCB
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index d9884fd15b45..a4beccf1fd46 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -3413,16 +3413,23 @@ static void mvpp2_bm_pool_bufsize_set(struct mvpp2 *priv,
 }
 
 /* Free all buffers from the pool */
-static void mvpp2_bm_bufs_free(struct mvpp2 *priv, struct mvpp2_bm_pool *bm_pool)
+static void mvpp2_bm_bufs_free(struct device *dev, struct mvpp2 *priv,
+                               struct mvpp2_bm_pool *bm_pool)
 {
         int i;
 
         for (i = 0; i < bm_pool->buf_num; i++) {
+                dma_addr_t buf_phys_addr;
                 u32 vaddr;
 
                 /* Get buffer virtual address (indirect access) */
-                mvpp2_read(priv, MVPP2_BM_PHY_ALLOC_REG(bm_pool->id));
+                buf_phys_addr = mvpp2_read(priv,
+                                           MVPP2_BM_PHY_ALLOC_REG(bm_pool->id));
                 vaddr = mvpp2_read(priv, MVPP2_BM_VIRT_ALLOC_REG);
+
+                dma_unmap_single(dev, buf_phys_addr,
+                                 bm_pool->buf_size, DMA_FROM_DEVICE);
+
                 if (!vaddr)
                         break;
                 dev_kfree_skb_any((struct sk_buff *)vaddr);
@@ -3439,7 +3446,7 @@ static int mvpp2_bm_pool_destroy(struct platform_device *pdev,
 {
         u32 val;
 
-        mvpp2_bm_bufs_free(priv, bm_pool);
+        mvpp2_bm_bufs_free(&pdev->dev, priv, bm_pool);
         if (bm_pool->buf_num) {
                 WARN(1, "cannot free all buffers in pool %d\n", bm_pool->id);
                 return 0;
@@ -3692,7 +3699,8 @@ mvpp2_bm_pool_use(struct mvpp2_port *port, int pool, enum mvpp2_bm_type type,
                                    MVPP2_BM_LONG_BUF_NUM :
                                    MVPP2_BM_SHORT_BUF_NUM;
                 else
-                        mvpp2_bm_bufs_free(port->priv, new_pool);
+                        mvpp2_bm_bufs_free(port->dev->dev.parent,
+                                           port->priv, new_pool);
 
                 new_pool->pkt_size = pkt_size;
 
@@ -3756,7 +3764,7 @@ static int mvpp2_bm_update_mtu(struct net_device *dev, int mtu)
         int pkt_size = MVPP2_RX_PKT_SIZE(mtu);
 
         /* Update BM pool with new buffer size */
-        mvpp2_bm_bufs_free(port->priv, port_pool);
+        mvpp2_bm_bufs_free(dev->dev.parent, port->priv, port_pool);
         if (port_pool->buf_num) {
                 WARN(1, "cannot free all buffers in pool %d\n", port_pool->id);
                 return -EIO;
@@ -4401,11 +4409,10 @@ static void mvpp2_txq_bufs_free(struct mvpp2_port *port,
 
                 mvpp2_txq_inc_get(txq_pcpu);
 
-                if (!skb)
-                        continue;
-
                 dma_unmap_single(port->dev->dev.parent, buf_phys_addr,
                                  skb_headlen(skb), DMA_TO_DEVICE);
+                if (!skb)
+                        continue;
                 dev_kfree_skb_any(skb);
         }
 }
@@ -5092,7 +5099,8 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                     struct mvpp2_rx_queue *rxq)
 {
         struct net_device *dev = port->dev;
-        int rx_received, rx_filled, i;
+        int rx_received;
+        int rx_done = 0;
         u32 rcvd_pkts = 0;
         u32 rcvd_bytes = 0;
 
@@ -5101,17 +5109,18 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
         if (rx_todo > rx_received)
                 rx_todo = rx_received;
 
-        rx_filled = 0;
-        for (i = 0; i < rx_todo; i++) {
+        while (rx_done < rx_todo) {
                 struct mvpp2_rx_desc *rx_desc = mvpp2_rxq_next_desc_get(rxq);
                 struct mvpp2_bm_pool *bm_pool;
                 struct sk_buff *skb;
+                dma_addr_t phys_addr;
                 u32 bm, rx_status;
                 int pool, rx_bytes, err;
 
-                rx_filled++;
+                rx_done++;
                 rx_status = rx_desc->status;
                 rx_bytes = rx_desc->data_size - MVPP2_MH_SIZE;
+                phys_addr = rx_desc->buf_phys_addr;
 
                 bm = mvpp2_bm_cookie_build(rx_desc);
                 pool = mvpp2_bm_cookie_pool_get(bm);
@@ -5128,8 +5137,10 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                  * comprised by the RX descriptor.
                  */
                 if (rx_status & MVPP2_RXD_ERR_SUMMARY) {
+                err_drop_frame:
                         dev->stats.rx_errors++;
                         mvpp2_rx_error(port, rx_desc);
+                        /* Return the buffer to the pool */
                         mvpp2_pool_refill(port, bm, rx_desc->buf_phys_addr,
                                           rx_desc->buf_cookie);
                         continue;
@@ -5137,6 +5148,15 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
 
                 skb = (struct sk_buff *)rx_desc->buf_cookie;
 
+                err = mvpp2_rx_refill(port, bm_pool, bm, 0);
+                if (err) {
+                        netdev_err(port->dev, "failed to refill BM pools\n");
+                        goto err_drop_frame;
+                }
+
+                dma_unmap_single(dev->dev.parent, phys_addr,
+                                 bm_pool->buf_size, DMA_FROM_DEVICE);
+
                 rcvd_pkts++;
                 rcvd_bytes += rx_bytes;
                 atomic_inc(&bm_pool->in_use);
@@ -5147,12 +5167,6 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                 mvpp2_rx_csum(port, rx_status, skb);
 
                 napi_gro_receive(&port->napi, skb);
-
-                err = mvpp2_rx_refill(port, bm_pool, bm, 0);
-                if (err) {
-                        netdev_err(port->dev, "failed to refill BM pools\n");
-                        rx_filled--;
-                }
         }
 
         if (rcvd_pkts) {
@@ -5166,7 +5180,7 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
 
         /* Update Rx queue management counters */
         wmb();
-        mvpp2_rxq_status_update(port, rxq->id, rx_todo, rx_filled);
+        mvpp2_rxq_status_update(port, rxq->id, rx_done, rx_done);
 
         return rx_todo;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 6fec3e993d02..cad6c44df91c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -4306,9 +4306,10 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                 return -EOPNOTSUPP;
 
         ctrl = (struct mlx4_net_trans_rule_hw_ctrl *)inbox->buf;
-        ctrl->port = mlx4_slave_convert_port(dev, slave, ctrl->port);
-        if (ctrl->port <= 0)
+        err = mlx4_slave_convert_port(dev, slave, ctrl->port);
+        if (err <= 0)
                 return -EINVAL;
+        ctrl->port = err;
         qpn = be32_to_cpu(ctrl->qpn) & 0xffffff;
         err = get_res(dev, slave, qpn, RES_QP, &rqp);
         if (err) {
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index ac17d8669b1a..1292c360390c 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -299,6 +299,7 @@ struct qed_hwfn {
 
         /* Flag indicating whether interrupts are enabled or not*/
         bool                            b_int_enabled;
+        bool                            b_int_requested;
 
         struct qed_mcp_info             *mcp_info;
 
@@ -491,6 +492,8 @@ u32 qed_unzip_data(struct qed_hwfn *p_hwfn,
                    u32 input_len, u8 *input_buf,
                    u32 max_size, u8 *unzip_buf);
 
+int qed_slowpath_irq_req(struct qed_hwfn *hwfn);
+
 #define QED_ETH_INTERFACE_VERSION       300
 
 #endif /* _QED_H */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 803b190ccada..817bbd5476ff 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -1385,52 +1385,63 @@ err0:
         return rc;
 }
 
-static u32 qed_hw_bar_size(struct qed_dev *cdev,
-                           u8 bar_id)
+static u32 qed_hw_bar_size(struct qed_hwfn      *p_hwfn,
+                           u8                   bar_id)
 {
-        u32 size = pci_resource_len(cdev->pdev, (bar_id > 0) ? 2 : 0);
+        u32 bar_reg = (bar_id == 0 ? PGLUE_B_REG_PF_BAR0_SIZE
+                       : PGLUE_B_REG_PF_BAR1_SIZE);
+        u32 val = qed_rd(p_hwfn, p_hwfn->p_main_ptt, bar_reg);
 
-        return size / cdev->num_hwfns;
+        /* Get the BAR size(in KB) from hardware given val */
+        return 1 << (val + 15);
 }
 
 int qed_hw_prepare(struct qed_dev *cdev,
                    int personality)
 {
-        int rc, i;
+        struct qed_hwfn *p_hwfn = QED_LEADING_HWFN(cdev);
+        int rc;
 
         /* Store the precompiled init data ptrs */
         qed_init_iro_array(cdev);
 
         /* Initialize the first hwfn - will learn number of hwfns */
-        rc = qed_hw_prepare_single(&cdev->hwfns[0], cdev->regview,
+        rc = qed_hw_prepare_single(p_hwfn,
+                                   cdev->regview,
                                    cdev->doorbells, personality);
         if (rc)
                 return rc;
 
-        personality = cdev->hwfns[0].hw_info.personality;
+        personality = p_hwfn->hw_info.personality;
 
         /* Initialize the rest of the hwfns */
-        for (i = 1; i < cdev->num_hwfns; i++) {
+        if (cdev->num_hwfns > 1) {
                 void __iomem *p_regview, *p_doorbell;
+                u8 __iomem *addr;
+
+                /* adjust bar offset for second engine */
+                addr = cdev->regview + qed_hw_bar_size(p_hwfn, 0) / 2;
+                p_regview = addr;
 
-                p_regview =  cdev->regview +
-                             i * qed_hw_bar_size(cdev, 0);
-                p_doorbell = cdev->doorbells +
-                             i * qed_hw_bar_size(cdev, 1);
-                rc = qed_hw_prepare_single(&cdev->hwfns[i], p_regview,
+                /* adjust doorbell bar offset for second engine */
+                addr = cdev->doorbells + qed_hw_bar_size(p_hwfn, 1) / 2;
+                p_doorbell = addr;
+
+                /* prepare second hw function */
+                rc = qed_hw_prepare_single(&cdev->hwfns[1], p_regview,
                                            p_doorbell, personality);
+
+                /* in case of error, need to free the previously
+                 * initiliazed hwfn 0.
+                 */
                 if (rc) {
-                        /* Cleanup previously initialized hwfns */
-                        while (--i >= 0) {
-                                qed_init_free(&cdev->hwfns[i]);
-                                qed_mcp_free(&cdev->hwfns[i]);
-                                qed_hw_hwfn_free(&cdev->hwfns[i]);
-                        }
-                        return rc;
+                        qed_init_free(p_hwfn);
+                        qed_mcp_free(p_hwfn);
+                        qed_hw_hwfn_free(p_hwfn);
                 }
         }
 
-        return 0;
+        return rc;
 }
 
 void qed_hw_remove(struct qed_dev *cdev)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
index de50e84902af..9cc9d62c1fec 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
@@ -783,22 +783,16 @@ void qed_int_igu_enable_int(struct qed_hwfn *p_hwfn,
         qed_wr(p_hwfn, p_ptt, IGU_REG_PF_CONFIGURATION, igu_pf_conf);
 }
 
-void qed_int_igu_enable(struct qed_hwfn *p_hwfn,
-                        struct qed_ptt *p_ptt,
-                        enum qed_int_mode int_mode)
+int qed_int_igu_enable(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+                       enum qed_int_mode int_mode)
 {
-        int i;
-
-        p_hwfn->b_int_enabled = 1;
+        int rc, i;
 
         /* Mask non-link attentions */
         for (i = 0; i < 9; i++)
                 qed_wr(p_hwfn, p_ptt,
                        MISC_REG_AEU_ENABLE1_IGU_OUT_0 + (i << 2), 0);
 
-        /* Enable interrupt Generation */
-        qed_int_igu_enable_int(p_hwfn, p_ptt, int_mode);
-
         /* Configure AEU signal change to produce attentions for link */
         qed_wr(p_hwfn, p_ptt, IGU_REG_LEADING_EDGE_LATCH, 0xfff);
         qed_wr(p_hwfn, p_ptt, IGU_REG_TRAILING_EDGE_LATCH, 0xfff);
@@ -808,6 +802,19 @@ void qed_int_igu_enable(struct qed_hwfn *p_hwfn,
 
         /* Unmask AEU signals toward IGU */
         qed_wr(p_hwfn, p_ptt, MISC_REG_AEU_MASK_ATTN_IGU, 0xff);
+        if ((int_mode != QED_INT_MODE_INTA) || IS_LEAD_HWFN(p_hwfn)) {
+                rc = qed_slowpath_irq_req(p_hwfn);
+                if (rc != 0) {
+                        DP_NOTICE(p_hwfn, "Slowpath IRQ request failed\n");
+                        return -EINVAL;
+                }
+                p_hwfn->b_int_requested = true;
+        }
+        /* Enable interrupt Generation */
+        qed_int_igu_enable_int(p_hwfn, p_ptt, int_mode);
+        p_hwfn->b_int_enabled = 1;
+
+        return rc;
 }
 
 void qed_int_igu_disable_int(struct qed_hwfn *p_hwfn,
@@ -1127,3 +1134,11 @@ int qed_int_get_num_sbs(struct qed_hwfn *p_hwfn,
 
         return info->igu_sb_cnt;
 }
+
+void qed_int_disable_post_isr_release(struct qed_dev *cdev)
+{
+        int i;
+
+        for_each_hwfn(cdev, i)
+                cdev->hwfns[i].b_int_requested = false;
+}
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.h b/drivers/net/ethernet/qlogic/qed/qed_int.h
index 16b57518e706..51e0b09a7f47 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.h
@@ -169,10 +169,14 @@ int qed_int_get_num_sbs(struct qed_hwfn *p_hwfn,
                         int *p_iov_blks);
 
 /**
- * @file
+ * @brief qed_int_disable_post_isr_release - performs the cleanup post ISR
+ *        release. The API need to be called after releasing all slowpath IRQs
+ *        of the device.
+ *
+ * @param cdev
  *
- * @brief Interrupt handler
  */
+void qed_int_disable_post_isr_release(struct qed_dev *cdev);
 
 #define QED_CAU_DEF_RX_TIMER_RES 0
 #define QED_CAU_DEF_TX_TIMER_RES 0
@@ -366,10 +370,11 @@ void qed_int_setup(struct qed_hwfn *p_hwfn,
  * @param p_hwfn
  * @param p_ptt
  * @param int_mode
+ *
+ * @return int
  */
-void qed_int_igu_enable(struct qed_hwfn *p_hwfn,
-                        struct qed_ptt *p_ptt,
-                        enum qed_int_mode int_mode);
+int qed_int_igu_enable(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+                       enum qed_int_mode int_mode);
 
 /**
  * @brief - Initialize CAU status block entry
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 947c7af72b25..174f7341c5c3 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -476,41 +476,22 @@ static irqreturn_t qed_single_int(int irq, void *dev_instance)
         return rc;
 }
 
-static int qed_slowpath_irq_req(struct qed_dev *cdev)
+int qed_slowpath_irq_req(struct qed_hwfn *hwfn)
 {
-        int i = 0, rc = 0;
+        struct qed_dev *cdev = hwfn->cdev;
+        int rc = 0;
+        u8 id;
 
         if (cdev->int_params.out.int_mode == QED_INT_MODE_MSIX) {
-                /* Request all the slowpath MSI-X vectors */
-                for (i = 0; i < cdev->num_hwfns; i++) {
-                        snprintf(cdev->hwfns[i].name, NAME_SIZE,
-                                 "sp-%d-%02x:%02x.%02x",
-                                 i, cdev->pdev->bus->number,
-                                 PCI_SLOT(cdev->pdev->devfn),
-                                 cdev->hwfns[i].abs_pf_id);
-
-                        rc = request_irq(cdev->int_params.msix_table[i].vector,
-                                         qed_msix_sp_int, 0,
-                                         cdev->hwfns[i].name,
-                                         cdev->hwfns[i].sp_dpc);
-                        if (rc)
-                                break;
-
-                        DP_VERBOSE(&cdev->hwfns[i],
-                                   (NETIF_MSG_INTR | QED_MSG_SP),
+                id = hwfn->my_id;
+                snprintf(hwfn->name, NAME_SIZE, "sp-%d-%02x:%02x.%02x",
+                         id, cdev->pdev->bus->number,
+                         PCI_SLOT(cdev->pdev->devfn), hwfn->abs_pf_id);
+                rc = request_irq(cdev->int_params.msix_table[id].vector,
+                                 qed_msix_sp_int, 0, hwfn->name, hwfn->sp_dpc);
+                if (!rc)
+                        DP_VERBOSE(hwfn, (NETIF_MSG_INTR | QED_MSG_SP),
                                    "Requested slowpath MSI-X\n");
-                }
-
-                if (i != cdev->num_hwfns) {
-                        /* Free already request MSI-X vectors */
-                        for (i--; i >= 0; i--) {
-                                unsigned int vec =
-                                        cdev->int_params.msix_table[i].vector;
-                                synchronize_irq(vec);
-                                free_irq(cdev->int_params.msix_table[i].vector,
-                                         cdev->hwfns[i].sp_dpc);
-                        }
-                }
         } else {
                 unsigned long flags = 0;
 
@@ -534,13 +515,17 @@ static void qed_slowpath_irq_free(struct qed_dev *cdev)
 
         if (cdev->int_params.out.int_mode == QED_INT_MODE_MSIX) {
                 for_each_hwfn(cdev, i) {
+                        if (!cdev->hwfns[i].b_int_requested)
+                                break;
                         synchronize_irq(cdev->int_params.msix_table[i].vector);
                         free_irq(cdev->int_params.msix_table[i].vector,
                                  cdev->hwfns[i].sp_dpc);
                 }
         } else {
-                free_irq(cdev->pdev->irq, cdev);
+                if (QED_LEADING_HWFN(cdev)->b_int_requested)
+                        free_irq(cdev->pdev->irq, cdev);
         }
+        qed_int_disable_post_isr_release(cdev);
 }
 
 static int qed_nic_stop(struct qed_dev *cdev)
@@ -765,16 +750,11 @@ static int qed_slowpath_start(struct qed_dev *cdev,
         if (rc)
                 goto err1;
 
-        /* Request the slowpath IRQ */
-        rc = qed_slowpath_irq_req(cdev);
-        if (rc)
-                goto err2;
-
         /* Allocate stream for unzipping */
         rc = qed_alloc_stream_mem(cdev);
         if (rc) {
                 DP_NOTICE(cdev, "Failed to allocate stream memory\n");
-                goto err3;
+                goto err2;
         }
 
         /* Start the slowpath */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
index 7a5ce5914ace..e8df12335a97 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
@@ -363,4 +363,8 @@
                 0x7 << 0)
 #define  MCP_REG_NVM_CFG4_FLASH_SIZE_SHIFT \
         0
+#define PGLUE_B_REG_PF_BAR0_SIZE \
+        0x2aae60UL
+#define PGLUE_B_REG_PF_BAR1_SIZE \
+        0x2aae64UL
 #endif
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
index 31a1f1eb4f56..287fadfab52d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
@@ -124,8 +124,12 @@ struct qed_spq {
         dma_addr_t              p_phys;
         struct qed_spq_entry    *p_virt;
 
-        /* Used as index for completions (returns on EQ by FW) */
-        u16                     echo_idx;
+#define SPQ_RING_SIZE \
+        (CORE_SPQE_PAGE_SIZE_BYTES / sizeof(struct slow_path_element))
+
+        /* Bitmap for handling out-of-order completions */
+        DECLARE_BITMAP(p_comp_bitmap, SPQ_RING_SIZE);
+        u8                      comp_bitmap_idx;
 
         /* Statistics */
         u32                     unlimited_pending_count;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
index 7c0b8459666e..3dd548ab8df1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
@@ -112,8 +112,6 @@ static int
 qed_spq_fill_entry(struct qed_hwfn *p_hwfn,
                    struct qed_spq_entry *p_ent)
 {
-        p_ent->elem.hdr.echo = 0;
-        p_hwfn->p_spq->echo_idx++;
         p_ent->flags = 0;
 
         switch (p_ent->comp_mode) {
@@ -195,10 +193,12 @@ static int qed_spq_hw_post(struct qed_hwfn *p_hwfn,
                            struct qed_spq *p_spq,
                            struct qed_spq_entry *p_ent)
 {
-        struct qed_chain                *p_chain = &p_hwfn->p_spq->chain;
+        struct qed_chain *p_chain = &p_hwfn->p_spq->chain;
+        u16 echo = qed_chain_get_prod_idx(p_chain);
         struct slow_path_element        *elem;
         struct core_db_data             db;
 
+        p_ent->elem.hdr.echo    = cpu_to_le16(echo);
         elem = qed_chain_produce(p_chain);
         if (!elem) {
                 DP_NOTICE(p_hwfn, "Failed to produce from SPQ chain\n");
@@ -437,7 +437,9 @@ void qed_spq_setup(struct qed_hwfn *p_hwfn)
         p_spq->comp_count               = 0;
         p_spq->comp_sent_count          = 0;
         p_spq->unlimited_pending_count  = 0;
-        p_spq->echo_idx                 = 0;
+
+        bitmap_zero(p_spq->p_comp_bitmap, SPQ_RING_SIZE);
+        p_spq->comp_bitmap_idx = 0;
 
         /* SPQ cid, cannot fail */
         qed_cxt_acquire_cid(p_hwfn, PROTOCOLID_CORE, &p_spq->cid);
@@ -582,26 +584,32 @@ qed_spq_add_entry(struct qed_hwfn *p_hwfn,
         struct qed_spq *p_spq = p_hwfn->p_spq;
 
         if (p_ent->queue == &p_spq->unlimited_pending) {
-                struct qed_spq_entry *p_en2;
 
                 if (list_empty(&p_spq->free_pool)) {
                         list_add_tail(&p_ent->list, &p_spq->unlimited_pending);
                         p_spq->unlimited_pending_count++;
 
                         return 0;
-                }
+                } else {
+                        struct qed_spq_entry *p_en2;
 
-                p_en2 = list_first_entry(&p_spq->free_pool,
-                                         struct qed_spq_entry,
-                                         list);
-                list_del(&p_en2->list);
+                        p_en2 = list_first_entry(&p_spq->free_pool,
+                                                 struct qed_spq_entry,
+                                                 list);
+                        list_del(&p_en2->list);
+
+                        /* Copy the ring element physical pointer to the new
+                         * entry, since we are about to override the entire ring
+                         * entry and don't want to lose the pointer.
+                         */
+                        p_ent->elem.data_ptr = p_en2->elem.data_ptr;
 
-                /* Strcut assignment */
-                *p_en2 = *p_ent;
+                        *p_en2 = *p_ent;
 
-                kfree(p_ent);
+                        kfree(p_ent);
 
-                p_ent = p_en2;
+                        p_ent = p_en2;
+                }
         }
 
         /* entry is to be placed in 'pending' queue */
@@ -777,13 +785,38 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
         list_for_each_entry_safe(p_ent, tmp, &p_spq->completion_pending,
                                  list) {
                 if (p_ent->elem.hdr.echo == echo) {
+                        u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE;
+
                         list_del(&p_ent->list);
 
-                        qed_chain_return_produced(&p_spq->chain);
+                        /* Avoid overriding of SPQ entries when getting
+                         * out-of-order completions, by marking the completions
+                         * in a bitmap and increasing the chain consumer only
+                         * for the first successive completed entries.
+                         */
+                        bitmap_set(p_spq->p_comp_bitmap, pos, SPQ_RING_SIZE);
+
+                        while (test_bit(p_spq->comp_bitmap_idx,
+                                        p_spq->p_comp_bitmap)) {
+                                bitmap_clear(p_spq->p_comp_bitmap,
+                                             p_spq->comp_bitmap_idx,
+                                             SPQ_RING_SIZE);
+                                p_spq->comp_bitmap_idx++;
+                                qed_chain_return_produced(&p_spq->chain);
+                        }
+
                         p_spq->comp_count++;
                         found = p_ent;
                         break;
                 }
+
+                /* This is relatively uncommon - depends on scenarios
+                 * which have mutliple per-PF sent ramrods.
+                 */
+                DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
+                           "Got completion for echo %04x - doesn't match echo %04x in completion pending list\n",
+                           le16_to_cpu(echo),
+                           le16_to_cpu(p_ent->elem.hdr.echo));
         }
 
         /* Release lock before callback, as callback may post
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
index be7d7a62cc0d..b1a452f291ee 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
@@ -246,7 +246,8 @@ int qlcnic_83xx_check_vnic_state(struct qlcnic_adapter *adapter)
         u32 state;
 
         state = QLCRDX(ahw, QLC_83XX_VNIC_STATE);
-        while (state != QLCNIC_DEV_NPAR_OPER && idc->vnic_wait_limit--) {
+        while (state != QLCNIC_DEV_NPAR_OPER && idc->vnic_wait_limit) {
+                idc->vnic_wait_limit--;
                 msleep(1000);
                 state = QLCRDX(ahw, QLC_83XX_VNIC_STATE);
         }
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 02b7115b6aaa..997976426799 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -4211,8 +4211,9 @@ static int ql_change_rx_buffers(struct ql_adapter *qdev)
 
         /* Wait for an outstanding reset to complete. */
         if (!test_bit(QL_ADAPTER_UP, &qdev->flags)) {
-                int i = 3;
-                while (i-- && !test_bit(QL_ADAPTER_UP, &qdev->flags)) {
+                int i = 4;
+
+                while (--i && !test_bit(QL_ADAPTER_UP, &qdev->flags)) {
                         netif_err(qdev, ifup, qdev->ndev,
                                   "Waiting for adapter UP...\n");
                         ssleep(1);
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index ddb2c6c6ec94..689a4a5c8dcf 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -736,9 +736,8 @@ qcaspi_netdev_tx_timeout(struct net_device *dev)
         netdev_info(qca->net_dev, "Transmit timeout at %ld, latency %ld\n",
                     jiffies, jiffies - dev->trans_start);
         qca->net_dev->stats.tx_errors++;
-        /* wake the queue if there is room */
-        if (qcaspi_tx_ring_has_space(&qca->txr))
-                netif_wake_queue(dev);
+        /* Trigger tx queue flush and QCA7000 reset */
+        qca->sync = QCASPI_SYNC_UNKNOWN;
 }
 
 static int
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index ed5da4d47668..467d41698fd5 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -905,6 +905,9 @@ static int ravb_phy_init(struct net_device *ndev)
                 netdev_info(ndev, "limited PHY to 100Mbit/s\n");
         }
 
+        /* 10BASE is not supported */
+        phydev->supported &= ~PHY_10BT_FEATURES;
+
         netdev_info(ndev, "attached PHY %d (IRQ %d) to driver %s\n",
                     phydev->addr, phydev->irq, phydev->drv->name);
 
@@ -1037,7 +1040,7 @@ static const char ravb_gstrings_stats[][ETH_GSTRING_LEN] = {
         "rx_queue_1_mcast_packets",
         "rx_queue_1_errors",
         "rx_queue_1_crc_errors",
-        "rx_queue_1_frame_errors_",
+        "rx_queue_1_frame_errors",
         "rx_queue_1_length_errors",
         "rx_queue_1_missed_errors",
         "rx_queue_1_over_errors",
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index e7bab7909ed9..a0eaf50499a2 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -52,6 +52,8 @@
                 NETIF_MSG_RX_ERR| \
                 NETIF_MSG_TX_ERR)
 
+#define SH_ETH_OFFSET_INVALID   ((u16)~0)
+
 #define SH_ETH_OFFSET_DEFAULTS                  \
         [0 ... SH_ETH_MAX_REGISTER_OFFSET - 1] = SH_ETH_OFFSET_INVALID
 
@@ -404,6 +406,28 @@ static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = {
 static void sh_eth_rcv_snd_disable(struct net_device *ndev);
 static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev);
 
+static void sh_eth_write(struct net_device *ndev, u32 data, int enum_index)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+        u16 offset = mdp->reg_offset[enum_index];
+
+        if (WARN_ON(offset == SH_ETH_OFFSET_INVALID))
+                return;
+
+        iowrite32(data, mdp->addr + offset);
+}
+
+static u32 sh_eth_read(struct net_device *ndev, int enum_index)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+        u16 offset = mdp->reg_offset[enum_index];
+
+        if (WARN_ON(offset == SH_ETH_OFFSET_INVALID))
+                return ~0U;
+
+        return ioread32(mdp->addr + offset);
+}
+
 static bool sh_eth_is_gether(struct sh_eth_private *mdp)
 {
         return mdp->reg_offset == sh_eth_offset_gigabit;
@@ -1172,7 +1196,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
                         break;
                 }
                 mdp->rx_skbuff[i] = skb;
-                rxdesc->addr = dma_addr;
+                rxdesc->addr = cpu_to_edmac(mdp, dma_addr);
                 rxdesc->status = cpu_to_edmac(mdp, RD_RACT | RD_RFP);
 
                 /* Rx descriptor address set */
@@ -1403,7 +1427,8 @@ static int sh_eth_txfree(struct net_device *ndev)
                            entry, edmac_to_cpu(mdp, txdesc->status));
                 /* Free the original skb. */
                 if (mdp->tx_skbuff[entry]) {
-                        dma_unmap_single(&ndev->dev, txdesc->addr,
+                        dma_unmap_single(&ndev->dev,
+                                         edmac_to_cpu(mdp, txdesc->addr),
                                          txdesc->buffer_length, DMA_TO_DEVICE);
                         dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
                         mdp->tx_skbuff[entry] = NULL;
@@ -1462,6 +1487,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                 if (mdp->cd->shift_rd0)
                         desc_status >>= 16;
 
+                skb = mdp->rx_skbuff[entry];
                 if (desc_status & (RD_RFS1 | RD_RFS2 | RD_RFS3 | RD_RFS4 |
                                    RD_RFS5 | RD_RFS6 | RD_RFS10)) {
                         ndev->stats.rx_errors++;
@@ -1477,16 +1503,16 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                                 ndev->stats.rx_missed_errors++;
                         if (desc_status & RD_RFS10)
                                 ndev->stats.rx_over_errors++;
-                } else {
+                } else  if (skb) {
+                        dma_addr = edmac_to_cpu(mdp, rxdesc->addr);
                         if (!mdp->cd->hw_swap)
                                 sh_eth_soft_swap(
-                                        phys_to_virt(ALIGN(rxdesc->addr, 4)),
+                                        phys_to_virt(ALIGN(dma_addr, 4)),
                                         pkt_len + 2);
-                        skb = mdp->rx_skbuff[entry];
                         mdp->rx_skbuff[entry] = NULL;
                         if (mdp->cd->rpadir)
                                 skb_reserve(skb, NET_IP_ALIGN);
-                        dma_unmap_single(&ndev->dev, rxdesc->addr,
+                        dma_unmap_single(&ndev->dev, dma_addr,
                                          ALIGN(mdp->rx_buf_sz, 32),
                                          DMA_FROM_DEVICE);
                         skb_put(skb, pkt_len);
@@ -1523,7 +1549,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         mdp->rx_skbuff[entry] = skb;
 
                         skb_checksum_none_assert(skb);
-                        rxdesc->addr = dma_addr;
+                        rxdesc->addr = cpu_to_edmac(mdp, dma_addr);
                 }
                 dma_wmb(); /* RACT bit must be set after all the above writes */
                 if (entry >= mdp->num_rx_ring - 1)
@@ -2331,8 +2357,8 @@ static void sh_eth_tx_timeout(struct net_device *ndev)
         /* Free all the skbuffs in the Rx queue. */
         for (i = 0; i < mdp->num_rx_ring; i++) {
                 rxdesc = &mdp->rx_ring[i];
-                rxdesc->status = 0;
-                rxdesc->addr = 0xBADF00D0;
+                rxdesc->status = cpu_to_edmac(mdp, 0);
+                rxdesc->addr = cpu_to_edmac(mdp, 0xBADF00D0);
                 dev_kfree_skb(mdp->rx_skbuff[i]);
                 mdp->rx_skbuff[i] = NULL;
         }
@@ -2350,6 +2376,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
         struct sh_eth_txdesc *txdesc;
+        dma_addr_t dma_addr;
         u32 entry;
         unsigned long flags;
 
@@ -2372,14 +2399,14 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         txdesc = &mdp->tx_ring[entry];
         /* soft swap. */
         if (!mdp->cd->hw_swap)
-                sh_eth_soft_swap(phys_to_virt(ALIGN(txdesc->addr, 4)),
-                                 skb->len + 2);
-        txdesc->addr = dma_map_single(&ndev->dev, skb->data, skb->len,
-                                      DMA_TO_DEVICE);
-        if (dma_mapping_error(&ndev->dev, txdesc->addr)) {
+                sh_eth_soft_swap(PTR_ALIGN(skb->data, 4), skb->len + 2);
+        dma_addr = dma_map_single(&ndev->dev, skb->data, skb->len,
+                                  DMA_TO_DEVICE);
+        if (dma_mapping_error(&ndev->dev, dma_addr)) {
                 kfree_skb(skb);
                 return NETDEV_TX_OK;
         }
+        txdesc->addr = cpu_to_edmac(mdp, dma_addr);
         txdesc->buffer_length = skb->len;
 
         dma_wmb(); /* TACT bit must be set after all the above writes */
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index 50382b1c9ddc..26ad1cf0bcf1 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -546,31 +546,6 @@ static inline void sh_eth_soft_swap(char *src, int len)
 #endif
 }
 
-#define SH_ETH_OFFSET_INVALID   ((u16) ~0)
-
-static inline void sh_eth_write(struct net_device *ndev, u32 data,
-                                int enum_index)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        u16 offset = mdp->reg_offset[enum_index];
-
-        if (WARN_ON(offset == SH_ETH_OFFSET_INVALID))
-                return;
-
-        iowrite32(data, mdp->addr + offset);
-}
-
-static inline u32 sh_eth_read(struct net_device *ndev, int enum_index)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        u16 offset = mdp->reg_offset[enum_index];
-
-        if (WARN_ON(offset == SH_ETH_OFFSET_INVALID))
-                return ~0U;
-
-        return ioread32(mdp->addr + offset);
-}
-
 static inline void *sh_eth_tsu_get_offset(struct sh_eth_private *mdp,
                                           int enum_index)
 {
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index bc6d21b471be..e6a084a6be12 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -3299,7 +3299,8 @@ static int efx_ef10_filter_remove_internal(struct efx_nic *efx,
 
                 new_spec.priority = EFX_FILTER_PRI_AUTO;
                 new_spec.flags = (EFX_FILTER_FLAG_RX |
-                                  EFX_FILTER_FLAG_RX_RSS);
+                                  (efx_rss_enabled(efx) ?
+                                   EFX_FILTER_FLAG_RX_RSS : 0));
                 new_spec.dmaq_id = 0;
                 new_spec.rss_context = EFX_FILTER_RSS_CONTEXT_DEFAULT;
                 rc = efx_ef10_filter_push(efx, &new_spec,
@@ -3921,6 +3922,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
 {
         struct efx_ef10_filter_table *table = efx->filter_state;
         struct efx_ef10_dev_addr *addr_list;
+        enum efx_filter_flags filter_flags;
         struct efx_filter_spec spec;
         u8 baddr[ETH_ALEN];
         unsigned int i, j;
@@ -3935,11 +3937,11 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
                 addr_count = table->dev_uc_count;
         }
 
+        filter_flags = efx_rss_enabled(efx) ? EFX_FILTER_FLAG_RX_RSS : 0;
+
         /* Insert/renew filters */
         for (i = 0; i < addr_count; i++) {
-                efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO,
-                                   EFX_FILTER_FLAG_RX_RSS,
-                                   0);
+                efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                 efx_filter_set_eth_local(&spec, EFX_FILTER_VID_UNSPEC,
                                          addr_list[i].addr);
                 rc = efx_ef10_filter_insert(efx, &spec, true);
@@ -3968,9 +3970,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
 
         if (multicast && rollback) {
                 /* Also need an Ethernet broadcast filter */
-                efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO,
-                                   EFX_FILTER_FLAG_RX_RSS,
-                                   0);
+                efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                 eth_broadcast_addr(baddr);
                 efx_filter_set_eth_local(&spec, EFX_FILTER_VID_UNSPEC, baddr);
                 rc = efx_ef10_filter_insert(efx, &spec, true);
@@ -4000,13 +4000,14 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx, bool multicast,
 {
         struct efx_ef10_filter_table *table = efx->filter_state;
         struct efx_ef10_nic_data *nic_data = efx->nic_data;
+        enum efx_filter_flags filter_flags;
         struct efx_filter_spec spec;
         u8 baddr[ETH_ALEN];
         int rc;
 
-        efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO,
-                           EFX_FILTER_FLAG_RX_RSS,
-                           0);
+        filter_flags = efx_rss_enabled(efx) ? EFX_FILTER_FLAG_RX_RSS : 0;
+
+        efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
 
         if (multicast)
                 efx_filter_set_mc_def(&spec);
@@ -4023,8 +4024,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx, bool multicast,
                 if (!nic_data->workaround_26807) {
                         /* Also need an Ethernet broadcast filter */
                         efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO,
-                                           EFX_FILTER_FLAG_RX_RSS,
-                                           0);
+                                           filter_flags, 0);
                         eth_broadcast_addr(baddr);
                         efx_filter_set_eth_local(&spec, EFX_FILTER_VID_UNSPEC,
                                                  baddr);
diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
index 1aaf76c1ace8..10827476bc0b 100644
--- a/drivers/net/ethernet/sfc/efx.h
+++ b/drivers/net/ethernet/sfc/efx.h
@@ -76,6 +76,11 @@ void efx_schedule_slow_fill(struct efx_rx_queue *rx_queue);
 #define EFX_TXQ_MAX_ENT(efx)    (EFX_WORKAROUND_35388(efx) ? \
                                  EFX_MAX_DMAQ_SIZE / 2 : EFX_MAX_DMAQ_SIZE)
 
+static inline bool efx_rss_enabled(struct efx_nic *efx)
+{
+        return efx->rss_spread > 1;
+}
+
 /* Filters */
 
 void efx_mac_reconfigure(struct efx_nic *efx);
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index 5a1c5a8f278a..133e9e35be9e 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -2242,7 +2242,7 @@ efx_farch_filter_init_rx_auto(struct efx_nic *efx,
          */
         spec->priority = EFX_FILTER_PRI_AUTO;
         spec->flags = (EFX_FILTER_FLAG_RX |
-                       (efx->n_rx_channels > 1 ? EFX_FILTER_FLAG_RX_RSS : 0) |
+                       (efx_rss_enabled(efx) ? EFX_FILTER_FLAG_RX_RSS : 0) |
                        (efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0));
         spec->dmaq_id = 0;
 }
diff --git a/drivers/net/ethernet/sfc/txc43128_phy.c b/drivers/net/ethernet/sfc/txc43128_phy.c
index 3d5ee3259885..194f67d9f3bf 100644
--- a/drivers/net/ethernet/sfc/txc43128_phy.c
+++ b/drivers/net/ethernet/sfc/txc43128_phy.c
@@ -418,7 +418,7 @@ static void txc_reset_logic_mmd(struct efx_nic *efx, int mmd)
 
         val |= (1 << TXC_GLCMD_LMTSWRST_LBN);
         efx_mdio_write(efx, mmd, TXC_GLRGS_GLCMD, val);
-        while (tries--) {
+        while (--tries) {
                 val = efx_mdio_read(efx, mmd, TXC_GLRGS_GLCMD);
                 if (!(val & (1 << TXC_GLCMD_LMTSWRST_LBN)))
                         break;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
index 52b8ed9bd87c..adff46375a32 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
@@ -153,7 +153,11 @@ static int sun7i_gmac_probe(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                sun7i_gmac_exit(pdev, plat_dat->bsp_priv);
+
+        return ret;
 }
 
 static const struct of_device_id sun7i_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 3c6549aee11d..a5b869eb4678 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3046,8 +3046,6 @@ int stmmac_suspend(struct net_device *ndev)
         priv->hw->dma->stop_tx(priv->ioaddr);
         priv->hw->dma->stop_rx(priv->ioaddr);
 
-        stmmac_clear_descriptors(priv);
-
         /* Enable Power down mode by programming the PMT regs */
         if (device_may_wakeup(priv->device)) {
                 priv->hw->mac->pmt(priv->hw, priv->wolopts);
@@ -3105,7 +3103,12 @@ int stmmac_resume(struct net_device *ndev)
 
         netif_device_attach(ndev);
 
-        init_dma_desc_rings(ndev, GFP_ATOMIC);
+        priv->cur_rx = 0;
+        priv->dirty_rx = 0;
+        priv->dirty_tx = 0;
+        priv->cur_tx = 0;
+        stmmac_clear_descriptors(priv);
+
         stmmac_hw_setup(ndev, false);
         stmmac_init_tx_coalesce(priv);
         stmmac_set_rx_mode(ndev);
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index de5c30c9f059..c2b79f5d1c89 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -967,8 +967,6 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
         err = udp_tunnel6_xmit_skb(dst, gs6->sock->sk, skb, dev,
                                    &fl6.saddr, &fl6.daddr, prio, ttl,
                                    sport, geneve->dst_port, !udp_csum);
-
-        iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
         return NETDEV_TX_OK;
 
 tx_error:
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 908e8d486342..7f8e7662e28c 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -149,9 +149,14 @@ int mdio_mux_init(struct device *dev,
                 }
                 cb->bus_number = v;
                 cb->parent = pb;
+
                 cb->mii_bus = mdiobus_alloc();
+                if (!cb->mii_bus) {
+                        ret_val = -ENOMEM;
+                        of_node_put(child_bus_node);
+                        break;
+                }
                 cb->mii_bus->priv = cb;
-
                 cb->mii_bus->irq = cb->phy_irq;
                 cb->mii_bus->name = "mdio_mux";
                 snprintf(cb->mii_bus->id, MII_BUS_ID_SIZE, "%x.%x",
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index cf6312fafea5..e13ad6cdcc22 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -339,9 +339,18 @@ static int ksz9021_config_init(struct phy_device *phydev)
 {
         const struct device *dev = &phydev->dev;
         const struct device_node *of_node = dev->of_node;
+        const struct device *dev_walker;
 
-        if (!of_node && dev->parent->of_node)
-                of_node = dev->parent->of_node;
+        /* The Micrel driver has a deprecated option to place phy OF
+         * properties in the MAC node. Walk up the tree of devices to
+         * find a device with an OF node.
+         */
+        dev_walker = &phydev->dev;
+        do {
+                of_node = dev_walker->of_node;
+                dev_walker = dev_walker->parent;
+
+        } while (!of_node && dev_walker);
 
         if (of_node) {
                 ksz9021_load_values_from_of(phydev, of_node,
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 5e0b43283bce..0a37f840fcc5 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -568,6 +568,9 @@ static int pppoe_create(struct net *net, struct socket *sock, int kern)
         sk->sk_family           = PF_PPPOX;
         sk->sk_protocol         = PX_PROTO_OE;
 
+        INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work,
+                  pppoe_unbind_sock_work);
+
         return 0;
 }
 
@@ -632,8 +635,6 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
 
         lock_sock(sk);
 
-        INIT_WORK(&po->proto.pppoe.padt_work, pppoe_unbind_sock_work);
-
         error = -EINVAL;
         if (sp->sa_protocol != PX_PROTO_OE)
                 goto end;
@@ -663,8 +664,13 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
                         po->pppoe_dev = NULL;
                 }
 
-                memset(sk_pppox(po) + 1, 0,
-                       sizeof(struct pppox_sock) - sizeof(struct sock));
+                po->pppoe_ifindex = 0;
+                memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa));
+                memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay));
+                memset(&po->chan, 0, sizeof(po->chan));
+                po->next = NULL;
+                po->num = 0;
+
                 sk->sk_state = PPPOX_NONE;
         }
 
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index fc69e41d0950..597c53e0a2ec 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -419,6 +419,9 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
         struct pptp_opt *opt = &po->proto.pptp;
         int error = 0;
 
+        if (sockaddr_len < sizeof(struct sockaddr_pppox))
+                return -EINVAL;
+
         lock_sock(sk);
 
         opt->src_addr = sp->sa_addr.pptp;
@@ -440,6 +443,9 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
         struct flowi4 fl4;
         int error = 0;
 
+        if (sockaddr_len < sizeof(struct sockaddr_pppox))
+                return -EINVAL;
+
         if (sp->sa_protocol != PX_PROTO_PPTP)
                 return -EINVAL;
 
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index bbde9884ab8a..8973abdec9f6 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -158,7 +158,7 @@ static int cdc_mbim_bind(struct usbnet *dev, struct usb_interface *intf)
         if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
                 goto err;
 
-        ret = cdc_ncm_bind_common(dev, intf, data_altsetting, 0);
+        ret = cdc_ncm_bind_common(dev, intf, data_altsetting, dev->driver_info->data);
         if (ret)
                 goto err;
 
@@ -582,6 +582,26 @@ static const struct driver_info cdc_mbim_info_zlp = {
         .tx_fixup = cdc_mbim_tx_fixup,
 };
 
+/* The spefication explicitly allows NDPs to be placed anywhere in the
+ * frame, but some devices fail unless the NDP is placed after the IP
+ * packets.  Using the CDC_NCM_FLAG_NDP_TO_END flags to force this
+ * behaviour.
+ *
+ * Note: The current implementation of this feature restricts each NTB
+ * to a single NDP, implying that multiplexed sessions cannot share an
+ * NTB. This might affect performace for multiplexed sessions.
+ */
+static const struct driver_info cdc_mbim_info_ndp_to_end = {
+        .description = "CDC MBIM",
+        .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN,
+        .bind = cdc_mbim_bind,
+        .unbind = cdc_mbim_unbind,
+        .manage_power = cdc_mbim_manage_power,
+        .rx_fixup = cdc_mbim_rx_fixup,
+        .tx_fixup = cdc_mbim_tx_fixup,
+        .data = CDC_NCM_FLAG_NDP_TO_END,
+};
+
 static const struct usb_device_id mbim_devs[] = {
         /* This duplicate NCM entry is intentional. MBIM devices can
          * be disguised as NCM by default, and this is necessary to
@@ -597,6 +617,10 @@ static const struct usb_device_id mbim_devs[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(0x0bdb, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info,
         },
+        /* Huawei E3372 fails unless NDP comes after the IP packets */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x12d1, 0x157d, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&cdc_mbim_info_ndp_to_end,
+        },
         /* default entry */
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info_zlp,
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 3b1ba8237768..1e9843a41168 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -955,10 +955,18 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp(struct cdc_ncm_ctx *ctx, struct sk_
         * NTH16 header as we would normally do. NDP isn't written to the SKB yet, and
         * the wNdpIndex field in the header is actually not consistent with reality. It will be later.
         */
-        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
+        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
                 if (ctx->delayed_ndp16->dwSignature == sign)
                         return ctx->delayed_ndp16;
 
+                /* We can only push a single NDP to the end. Return
+                 * NULL to send what we've already got and queue this
+                 * skb for later.
+                 */
+                else if (ctx->delayed_ndp16->dwSignature)
+                        return NULL;
+        }
+
         /* follow the chain of NDPs, looking for a match */
         while (ndpoffset) {
                 ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb->data + ndpoffset);
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index d9427ca3dba7..2e32c41536ae 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -3067,17 +3067,6 @@ static int rtl8152_open(struct net_device *netdev)
 
         mutex_lock(&tp->control);
 
-        /* The WORK_ENABLE may be set when autoresume occurs */
-        if (test_bit(WORK_ENABLE, &tp->flags)) {
-                clear_bit(WORK_ENABLE, &tp->flags);
-                usb_kill_urb(tp->intr_urb);
-                cancel_delayed_work_sync(&tp->schedule);
-
-                /* disable the tx/rx, if the workqueue has enabled them. */
-                if (netif_carrier_ok(netdev))
-                        tp->rtl_ops.disable(tp);
-        }
-
         tp->rtl_ops.up(tp);
 
         rtl8152_set_speed(tp, AUTONEG_ENABLE,
@@ -3124,12 +3113,6 @@ static int rtl8152_close(struct net_device *netdev)
         } else {
                 mutex_lock(&tp->control);
 
-                /* The autosuspend may have been enabled and wouldn't
-                 * be disable when autoresume occurs, because the
-                 * netif_running() would be false.
-                 */
-                rtl_runtime_suspend_enable(tp, false);
-
                 tp->rtl_ops.down(tp);
 
                 mutex_unlock(&tp->control);
@@ -3512,7 +3495,7 @@ static int rtl8152_resume(struct usb_interface *intf)
                 netif_device_attach(tp->netdev);
         }
 
-        if (netif_running(tp->netdev)) {
+        if (netif_running(tp->netdev) && tp->netdev->flags & IFF_UP) {
                 if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
                         rtl_runtime_suspend_enable(tp, false);
                         clear_bit(SELECTIVE_SUSPEND, &tp->flags);
@@ -3532,6 +3515,8 @@ static int rtl8152_resume(struct usb_interface *intf)
                 }
                 usb_submit_urb(tp->intr_urb, GFP_KERNEL);
         } else if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
+                if (tp->netdev->flags & IFF_UP)
+                        rtl_runtime_suspend_enable(tp, false);
                 clear_bit(SELECTIVE_SUSPEND, &tp->flags);
         }
 
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 6369a5734d4c..ba363cedef80 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1158,7 +1158,6 @@ static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb,
         struct pcpu_sw_netstats *stats;
         union vxlan_addr saddr;
         int err = 0;
-        union vxlan_addr *remote_ip;
 
         /* For flow based devices, map all packets to VNI 0 */
         if (vs->flags & VXLAN_F_COLLECT_METADATA)
@@ -1169,7 +1168,6 @@ static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb,
         if (!vxlan)
                 goto drop;
 
-        remote_ip = &vxlan->default_dst.remote_ip;
         skb_reset_mac_header(skb);
         skb_scrub_packet(skb, !net_eq(vxlan->net, dev_net(vxlan->dev)));
         skb->protocol = eth_type_trans(skb, vxlan->dev);
@@ -1179,8 +1177,8 @@ static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb,
         if (ether_addr_equal(eth_hdr(skb)->h_source, vxlan->dev->dev_addr))
                 goto drop;
 
-        /* Re-examine inner Ethernet packet */
-        if (remote_ip->sa.sa_family == AF_INET) {
+        /* Get data from the outer IP header */
+        if (vxlan_get_sk_family(vs) == AF_INET) {
                 oip = ip_hdr(skb);
                 saddr.sin.sin_addr.s_addr = oip->saddr;
                 saddr.sa.sa_family = AF_INET;
@@ -1848,6 +1846,34 @@ static int vxlan_xmit_skb(struct rtable *rt, struct sock *sk, struct sk_buff *sk
                                    !(vxflags & VXLAN_F_UDP_CSUM));
 }
 
+#if IS_ENABLED(CONFIG_IPV6)
+static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
+                                          struct sk_buff *skb, int oif,
+                                          const struct in6_addr *daddr,
+                                          struct in6_addr *saddr)
+{
+        struct dst_entry *ndst;
+        struct flowi6 fl6;
+        int err;
+
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_oif = oif;
+        fl6.daddr = *daddr;
+        fl6.saddr = vxlan->cfg.saddr.sin6.sin6_addr;
+        fl6.flowi6_mark = skb->mark;
+        fl6.flowi6_proto = IPPROTO_UDP;
+
+        err = ipv6_stub->ipv6_dst_lookup(vxlan->net,
+                                         vxlan->vn6_sock->sock->sk,
+                                         &ndst, &fl6);
+        if (err < 0)
+                return ERR_PTR(err);
+
+        *saddr = fl6.saddr;
+        return ndst;
+}
+#endif
+
 /* Bypass encapsulation if the destination is local */
 static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
                                struct vxlan_dev *dst_vxlan)
@@ -2035,21 +2061,17 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 #if IS_ENABLED(CONFIG_IPV6)
         } else {
                 struct dst_entry *ndst;
-                struct flowi6 fl6;
+                struct in6_addr saddr;
                 u32 rt6i_flags;
 
                 if (!vxlan->vn6_sock)
                         goto drop;
                 sk = vxlan->vn6_sock->sock->sk;
 
-                memset(&fl6, 0, sizeof(fl6));
-                fl6.flowi6_oif = rdst ? rdst->remote_ifindex : 0;
-                fl6.daddr = dst->sin6.sin6_addr;
-                fl6.saddr = vxlan->cfg.saddr.sin6.sin6_addr;
-                fl6.flowi6_mark = skb->mark;
-                fl6.flowi6_proto = IPPROTO_UDP;
-
-                if (ipv6_stub->ipv6_dst_lookup(vxlan->net, sk, &ndst, &fl6)) {
+                ndst = vxlan6_get_route(vxlan, skb,
+                                        rdst ? rdst->remote_ifindex : 0,
+                                        &dst->sin6.sin6_addr, &saddr);
+                if (IS_ERR(ndst)) {
                         netdev_dbg(dev, "no route to %pI6\n",
                                    &dst->sin6.sin6_addr);
                         dev->stats.tx_carrier_errors++;
@@ -2081,7 +2103,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 }
 
                 ttl = ttl ? : ip6_dst_hoplimit(ndst);
-                err = vxlan6_xmit_skb(ndst, sk, skb, dev, &fl6.saddr, &fl6.daddr,
+                err = vxlan6_xmit_skb(ndst, sk, skb, dev, &saddr, &dst->sin6.sin6_addr,
                                       0, ttl, src_port, dst_port, htonl(vni << 8), md,
                                       !net_eq(vxlan->net, dev_net(vxlan->dev)),
                                       flags);
@@ -2395,9 +2417,30 @@ static int vxlan_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
                                   vxlan->cfg.port_max, true);
         dport = info->key.tp_dst ? : vxlan->cfg.dst_port;
 
-        if (ip_tunnel_info_af(info) == AF_INET)
+        if (ip_tunnel_info_af(info) == AF_INET) {
+                if (!vxlan->vn4_sock)
+                        return -EINVAL;
                 return egress_ipv4_tun_info(dev, skb, info, sport, dport);
-        return -EINVAL;
+        } else {
+#if IS_ENABLED(CONFIG_IPV6)
+                struct dst_entry *ndst;
+
+                if (!vxlan->vn6_sock)
+                        return -EINVAL;
+                ndst = vxlan6_get_route(vxlan, skb, 0,
+                                        &info->key.u.ipv6.dst,
+                                        &info->key.u.ipv6.src);
+                if (IS_ERR(ndst))
+                        return PTR_ERR(ndst);
+                dst_release(ndst);
+
+                info->key.tp_src = sport;
+                info->key.tp_dst = dport;
+#else /* !CONFIG_IPV6 */
+                return -EPFNOSUPPORT;
+#endif
+        }
+        return 0;
 }
 
 static const struct net_device_ops vxlan_netdev_ops = {
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index e481f3710bd3..1049c34e7d43 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -258,18 +258,18 @@ static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif_queue *queue,
                                                  struct netrx_pending_operations *npo)
 {
         struct xenvif_rx_meta *meta;
-        struct xen_netif_rx_request *req;
+        struct xen_netif_rx_request req;
 
-        req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
+        RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
 
         meta = npo->meta + npo->meta_prod++;
         meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
         meta->gso_size = 0;
         meta->size = 0;
-        meta->id = req->id;
+        meta->id = req.id;
 
         npo->copy_off = 0;
-        npo->copy_gref = req->gref;
+        npo->copy_gref = req.gref;
 
         return meta;
 }
@@ -424,7 +424,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         struct xenvif *vif = netdev_priv(skb->dev);
         int nr_frags = skb_shinfo(skb)->nr_frags;
         int i;
-        struct xen_netif_rx_request *req;
+        struct xen_netif_rx_request req;
         struct xenvif_rx_meta *meta;
         unsigned char *data;
         int head = 1;
@@ -443,15 +443,15 @@ static int xenvif_gop_skb(struct sk_buff *skb,
 
         /* Set up a GSO prefix descriptor, if necessary */
         if ((1 << gso_type) & vif->gso_prefix_mask) {
-                req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
+                RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
                 meta = npo->meta + npo->meta_prod++;
                 meta->gso_type = gso_type;
                 meta->gso_size = skb_shinfo(skb)->gso_size;
                 meta->size = 0;
-                meta->id = req->id;
+                meta->id = req.id;
         }
 
-        req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
+        RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
         meta = npo->meta + npo->meta_prod++;
 
         if ((1 << gso_type) & vif->gso_mask) {
@@ -463,9 +463,9 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         }
 
         meta->size = 0;
-        meta->id = req->id;
+        meta->id = req.id;
         npo->copy_off = 0;
-        npo->copy_gref = req->gref;
+        npo->copy_gref = req.gref;
 
         data = skb->data;
         while (data < skb_tail_pointer(skb)) {
@@ -679,9 +679,7 @@ static void tx_add_credit(struct xenvif_queue *queue)
          * Allow a burst big enough to transmit a jumbo packet of up to 128kB.
          * Otherwise the interface can seize up due to insufficient credit.
          */
-        max_burst = RING_GET_REQUEST(&queue->tx, queue->tx.req_cons)->size;
-        max_burst = min(max_burst, 131072UL);
-        max_burst = max(max_burst, queue->credit_bytes);
+        max_burst = max(131072UL, queue->credit_bytes);
 
         /* Take care that adding a new chunk of credit doesn't wrap to zero. */
         max_credit = queue->remaining_credit + queue->credit_bytes;
@@ -711,7 +709,7 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
                 spin_unlock_irqrestore(&queue->response_lock, flags);
                 if (cons == end)
                         break;
-                txp = RING_GET_REQUEST(&queue->tx, cons++);
+                RING_COPY_REQUEST(&queue->tx, cons++, txp);
         } while (1);
         queue->tx.req_cons = cons;
 }
@@ -778,8 +776,7 @@ static int xenvif_count_requests(struct xenvif_queue *queue,
                 if (drop_err)
                         txp = &dropped_tx;
 
-                memcpy(txp, RING_GET_REQUEST(&queue->tx, cons + slots),
-                       sizeof(*txp));
+                RING_COPY_REQUEST(&queue->tx, cons + slots, txp);
 
                 /* If the guest submitted a frame >= 64 KiB then
                  * first->size overflowed and following slots will
@@ -1112,8 +1109,7 @@ static int xenvif_get_extras(struct xenvif_queue *queue,
                         return -EBADR;
                 }
 
-                memcpy(&extra, RING_GET_REQUEST(&queue->tx, cons),
-                       sizeof(extra));
+                RING_COPY_REQUEST(&queue->tx, cons, &extra);
                 if (unlikely(!extra.type ||
                              extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
                         queue->tx.req_cons = ++cons;
@@ -1322,7 +1318,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
 
                 idx = queue->tx.req_cons;
                 rmb(); /* Ensure that we see the request before we copy it. */
-                memcpy(&txreq, RING_GET_REQUEST(&queue->tx, idx), sizeof(txreq));
+                RING_COPY_REQUEST(&queue->tx, idx, &txreq);
 
                 /* Credit-based scheduling. */
                 if (txreq.size > queue->remaining_credit &&
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index 7eb5859dd035..03cb3ea2d2c0 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -233,6 +233,7 @@ config PHY_SUN9I_USB
         tristate "Allwinner sun9i SoC USB PHY driver"
         depends on ARCH_SUNXI && HAS_IOMEM && OF
         depends on RESET_CONTROLLER
+        depends on USB_COMMON
         select GENERIC_PHY
         help
           Enable this to support the transceiver that is part of Allwinner
diff --git a/drivers/phy/phy-bcm-cygnus-pcie.c b/drivers/phy/phy-bcm-cygnus-pcie.c
index 7ad72b7d2b98..082c03f6438f 100644
--- a/drivers/phy/phy-bcm-cygnus-pcie.c
+++ b/drivers/phy/phy-bcm-cygnus-pcie.c
@@ -128,6 +128,7 @@ static int cygnus_pcie_phy_probe(struct platform_device *pdev)
         struct phy_provider *provider;
         struct resource *res;
         unsigned cnt = 0;
+        int ret;
 
         if (of_get_child_count(node) == 0) {
                 dev_err(dev, "PHY no child node\n");
@@ -154,24 +155,28 @@ static int cygnus_pcie_phy_probe(struct platform_device *pdev)
                 if (of_property_read_u32(child, "reg", &id)) {
                         dev_err(dev, "missing reg property for %s\n",
                                 child->name);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 if (id >= MAX_NUM_PHYS) {
                         dev_err(dev, "invalid PHY id: %u\n", id);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 if (core->phys[id].phy) {
                         dev_err(dev, "duplicated PHY id: %u\n", id);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 p = &core->phys[id];
                 p->phy = devm_phy_create(dev, child, &cygnus_pcie_phy_ops);
                 if (IS_ERR(p->phy)) {
                         dev_err(dev, "failed to create PHY\n");
-                        return PTR_ERR(p->phy);
+                        ret = PTR_ERR(p->phy);
+                        goto put_child;
                 }
 
                 p->core = core;
@@ -191,6 +196,9 @@ static int cygnus_pcie_phy_probe(struct platform_device *pdev)
         dev_dbg(dev, "registered %u PCIe PHY(s)\n", cnt);
 
         return 0;
+put_child:
+        of_node_put(child);
+        return ret;
 }
 
 static const struct of_device_id cygnus_pcie_phy_match_table[] = {
diff --git a/drivers/phy/phy-berlin-sata.c b/drivers/phy/phy-berlin-sata.c
index 77a2e054fdea..f84a33a1bdd9 100644
--- a/drivers/phy/phy-berlin-sata.c
+++ b/drivers/phy/phy-berlin-sata.c
@@ -195,7 +195,7 @@ static int phy_berlin_sata_probe(struct platform_device *pdev)
         struct phy_provider *phy_provider;
         struct phy_berlin_priv *priv;
         struct resource *res;
-        int i = 0;
+        int ret, i = 0;
         u32 phy_id;
 
         priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -237,22 +237,27 @@ static int phy_berlin_sata_probe(struct platform_device *pdev)
                 if (of_property_read_u32(child, "reg", &phy_id)) {
                         dev_err(dev, "missing reg property in node %s\n",
                                 child->name);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 if (phy_id >= ARRAY_SIZE(phy_berlin_power_down_bits)) {
                         dev_err(dev, "invalid reg in node %s\n", child->name);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 phy_desc = devm_kzalloc(dev, sizeof(*phy_desc), GFP_KERNEL);
-                if (!phy_desc)
-                        return -ENOMEM;
+                if (!phy_desc) {
+                        ret = -ENOMEM;
+                        goto put_child;
+                }
 
                 phy = devm_phy_create(dev, NULL, &phy_berlin_sata_ops);
                 if (IS_ERR(phy)) {
                         dev_err(dev, "failed to create PHY %d\n", phy_id);
-                        return PTR_ERR(phy);
+                        ret = PTR_ERR(phy);
+                        goto put_child;
                 }
 
                 phy_desc->phy = phy;
@@ -269,6 +274,9 @@ static int phy_berlin_sata_probe(struct platform_device *pdev)
         phy_provider =
                 devm_of_phy_provider_register(dev, phy_berlin_sata_phy_xlate);
         return PTR_ERR_OR_ZERO(phy_provider);
+put_child:
+        of_node_put(child);
+        return ret;
 }
 
 static const struct of_device_id phy_berlin_sata_of_match[] = {
diff --git a/drivers/phy/phy-brcmstb-sata.c b/drivers/phy/phy-brcmstb-sata.c
index 8a2cb16a1937..cd9dba820566 100644
--- a/drivers/phy/phy-brcmstb-sata.c
+++ b/drivers/phy/phy-brcmstb-sata.c
@@ -140,7 +140,7 @@ static int brcm_sata_phy_probe(struct platform_device *pdev)
         struct brcm_sata_phy *priv;
         struct resource *res;
         struct phy_provider *provider;
-        int count = 0;
+        int ret, count = 0;
 
         if (of_get_child_count(dn) == 0)
                 return -ENODEV;
@@ -163,16 +163,19 @@ static int brcm_sata_phy_probe(struct platform_device *pdev)
                 if (of_property_read_u32(child, "reg", &id)) {
                         dev_err(dev, "missing reg property in node %s\n",
                                         child->name);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 if (id >= MAX_PORTS) {
                         dev_err(dev, "invalid reg: %u\n", id);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
                 if (priv->phys[id].phy) {
                         dev_err(dev, "already registered port %u\n", id);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto put_child;
                 }
 
                 port = &priv->phys[id];
@@ -182,7 +185,8 @@ static int brcm_sata_phy_probe(struct platform_device *pdev)
                 port->ssc_en = of_property_read_bool(child, "brcm,enable-ssc");
                 if (IS_ERR(port->phy)) {
                         dev_err(dev, "failed to create PHY\n");
-                        return PTR_ERR(port->phy);
+                        ret = PTR_ERR(port->phy);
+                        goto put_child;
                 }
 
                 phy_set_drvdata(port->phy, port);
@@ -198,6 +202,9 @@ static int brcm_sata_phy_probe(struct platform_device *pdev)
         dev_info(dev, "registered %d port(s)\n", count);
 
         return 0;
+put_child:
+        of_node_put(child);
+        return ret;
 }
 
 static struct platform_driver brcm_sata_phy_driver = {
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index fc48fac003a6..8c7f27db6ad3 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -636,8 +636,9 @@ EXPORT_SYMBOL_GPL(devm_of_phy_get);
  * @np: node containing the phy
  * @index: index of the phy
  *
- * Gets the phy using _of_phy_get(), and associates a device with it using
- * devres. On driver detach, release function is invoked on the devres data,
+ * Gets the phy using _of_phy_get(), then gets a refcount to it,
+ * and associates a device with it using devres. On driver detach,
+ * release function is invoked on the devres data,
  * then, devres data is freed.
  *
  */
@@ -651,13 +652,21 @@ struct phy *devm_of_phy_get_by_index(struct device *dev, struct device_node *np,
                 return ERR_PTR(-ENOMEM);
 
         phy = _of_phy_get(np, index);
-        if (!IS_ERR(phy)) {
-                *ptr = phy;
-                devres_add(dev, ptr);
-        } else {
+        if (IS_ERR(phy)) {
                 devres_free(ptr);
+                return phy;
         }
 
+        if (!try_module_get(phy->ops->owner)) {
+                devres_free(ptr);
+                return ERR_PTR(-EPROBE_DEFER);
+        }
+
+        get_device(&phy->dev);
+
+        *ptr = phy;
+        devres_add(dev, ptr);
+
         return phy;
 }
 EXPORT_SYMBOL_GPL(devm_of_phy_get_by_index);
diff --git a/drivers/phy/phy-miphy28lp.c b/drivers/phy/phy-miphy28lp.c
index c47b56b4a2b8..3acd2a1808df 100644
--- a/drivers/phy/phy-miphy28lp.c
+++ b/drivers/phy/phy-miphy28lp.c
@@ -1226,15 +1226,18 @@ static int miphy28lp_probe(struct platform_device *pdev)
 
                 miphy_phy = devm_kzalloc(&pdev->dev, sizeof(*miphy_phy),
                                          GFP_KERNEL);
-                if (!miphy_phy)
-                        return -ENOMEM;
+                if (!miphy_phy) {
+                        ret = -ENOMEM;
+                        goto put_child;
+                }
 
                 miphy_dev->phys[port] = miphy_phy;
 
                 phy = devm_phy_create(&pdev->dev, child, &miphy28lp_ops);
                 if (IS_ERR(phy)) {
                         dev_err(&pdev->dev, "failed to create PHY\n");
-                        return PTR_ERR(phy);
+                        ret = PTR_ERR(phy);
+                        goto put_child;
                 }
 
                 miphy_dev->phys[port]->phy = phy;
@@ -1242,11 +1245,11 @@ static int miphy28lp_probe(struct platform_device *pdev)
 
                 ret = miphy28lp_of_probe(child, miphy_phy);
                 if (ret)
-                        return ret;
+                        goto put_child;
 
                 ret = miphy28lp_probe_resets(child, miphy_dev->phys[port]);
                 if (ret)
-                        return ret;
+                        goto put_child;
 
                 phy_set_drvdata(phy, miphy_dev->phys[port]);
                 port++;
@@ -1255,6 +1258,9 @@ static int miphy28lp_probe(struct platform_device *pdev)
 
         provider = devm_of_phy_provider_register(&pdev->dev, miphy28lp_xlate);
         return PTR_ERR_OR_ZERO(provider);
+put_child:
+        of_node_put(child);
+        return ret;
 }
 
 static const struct of_device_id miphy28lp_of_match[] = {
diff --git a/drivers/phy/phy-miphy365x.c b/drivers/phy/phy-miphy365x.c
index 00a686a073ed..e661f3b36eaa 100644
--- a/drivers/phy/phy-miphy365x.c
+++ b/drivers/phy/phy-miphy365x.c
@@ -566,22 +566,25 @@ static int miphy365x_probe(struct platform_device *pdev)
 
                 miphy_phy = devm_kzalloc(&pdev->dev, sizeof(*miphy_phy),
                                          GFP_KERNEL);
-                if (!miphy_phy)
-                        return -ENOMEM;
+                if (!miphy_phy) {
+                        ret = -ENOMEM;
+                        goto put_child;
+                }
 
                 miphy_dev->phys[port] = miphy_phy;
 
                 phy = devm_phy_create(&pdev->dev, child, &miphy365x_ops);
                 if (IS_ERR(phy)) {
                         dev_err(&pdev->dev, "failed to create PHY\n");
-                        return PTR_ERR(phy);
+                        ret = PTR_ERR(phy);
+                        goto put_child;
                 }
 
                 miphy_dev->phys[port]->phy = phy;
 
                 ret = miphy365x_of_probe(child, miphy_phy);
                 if (ret)
-                        return ret;
+                        goto put_child;
 
                 phy_set_drvdata(phy, miphy_dev->phys[port]);
 
@@ -591,12 +594,15 @@ static int miphy365x_probe(struct platform_device *pdev)
                                         &miphy_phy->ctrlreg);
                 if (ret) {
                         dev_err(&pdev->dev, "No sysconfig offset found\n");
-                        return ret;
+                        goto put_child;
                 }
         }
 
         provider = devm_of_phy_provider_register(&pdev->dev, miphy365x_xlate);
         return PTR_ERR_OR_ZERO(provider);
+put_child:
+        of_node_put(child);
+        return ret;
 }
 
 static const struct of_device_id miphy365x_of_match[] = {
diff --git a/drivers/phy/phy-mt65xx-usb3.c b/drivers/phy/phy-mt65xx-usb3.c
index f30b28bd41fe..e427c3b788ff 100644
--- a/drivers/phy/phy-mt65xx-usb3.c
+++ b/drivers/phy/phy-mt65xx-usb3.c
@@ -415,7 +415,7 @@ static int mt65xx_u3phy_probe(struct platform_device *pdev)
         struct resource *sif_res;
         struct mt65xx_u3phy *u3phy;
         struct resource res;
-        int port;
+        int port, retval;
 
         u3phy = devm_kzalloc(dev, sizeof(*u3phy), GFP_KERNEL);
         if (!u3phy)
@@ -447,31 +447,34 @@ static int mt65xx_u3phy_probe(struct platform_device *pdev)
         for_each_child_of_node(np, child_np) {
                 struct mt65xx_phy_instance *instance;
                 struct phy *phy;
-                int retval;
 
                 instance = devm_kzalloc(dev, sizeof(*instance), GFP_KERNEL);
-                if (!instance)
-                        return -ENOMEM;
+                if (!instance) {
+                        retval = -ENOMEM;
+                        goto put_child;
+                }
 
                 u3phy->phys[port] = instance;
 
                 phy = devm_phy_create(dev, child_np, &mt65xx_u3phy_ops);
                 if (IS_ERR(phy)) {
                         dev_err(dev, "failed to create phy\n");
-                        return PTR_ERR(phy);
+                        retval = PTR_ERR(phy);
+                        goto put_child;
                 }
 
                 retval = of_address_to_resource(child_np, 0, &res);
                 if (retval) {
                         dev_err(dev, "failed to get address resource(id-%d)\n",
                                 port);
-                        return retval;
+                        goto put_child;
                 }
 
                 instance->port_base = devm_ioremap_resource(&phy->dev, &res);
                 if (IS_ERR(instance->port_base)) {
                         dev_err(dev, "failed to remap phy regs\n");
-                        return PTR_ERR(instance->port_base);
+                        retval = PTR_ERR(instance->port_base);
+                        goto put_child;
                 }
 
                 instance->phy = phy;
@@ -483,6 +486,9 @@ static int mt65xx_u3phy_probe(struct platform_device *pdev)
         provider = devm_of_phy_provider_register(dev, mt65xx_phy_xlate);
 
         return PTR_ERR_OR_ZERO(provider);
+put_child:
+        of_node_put(child_np);
+        return retval;
 }
 
 static const struct of_device_id mt65xx_u3phy_id_table[] = {
diff --git a/drivers/phy/phy-rockchip-usb.c b/drivers/phy/phy-rockchip-usb.c
index 91d6f342c565..62c43c435194 100644
--- a/drivers/phy/phy-rockchip-usb.c
+++ b/drivers/phy/phy-rockchip-usb.c
@@ -108,13 +108,16 @@ static int rockchip_usb_phy_probe(struct platform_device *pdev)
 
         for_each_available_child_of_node(dev->of_node, child) {
                 rk_phy = devm_kzalloc(dev, sizeof(*rk_phy), GFP_KERNEL);
-                if (!rk_phy)
-                        return -ENOMEM;
+                if (!rk_phy) {
+                        err = -ENOMEM;
+                        goto put_child;
+                }
 
                 if (of_property_read_u32(child, "reg", &reg_offset)) {
                         dev_err(dev, "missing reg property in node %s\n",
                                 child->name);
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto put_child;
                 }
 
                 rk_phy->reg_offset = reg_offset;
@@ -127,18 +130,22 @@ static int rockchip_usb_phy_probe(struct platform_device *pdev)
                 rk_phy->phy = devm_phy_create(dev, child, &ops);
                 if (IS_ERR(rk_phy->phy)) {
                         dev_err(dev, "failed to create PHY\n");
-                        return PTR_ERR(rk_phy->phy);
+                        err = PTR_ERR(rk_phy->phy);
+                        goto put_child;
                 }
                 phy_set_drvdata(rk_phy->phy, rk_phy);
 
                 /* only power up usb phy when it use, so disable it when init*/
                 err = rockchip_usb_phy_power(rk_phy, 1);
                 if (err)
-                        return err;
+                        goto put_child;
         }
 
         phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
         return PTR_ERR_OR_ZERO(phy_provider);
+put_child:
+        of_node_put(child);
+        return err;
 }
 
 static const struct of_device_id rockchip_usb_phy_dt_ids[] = {
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index a1ea565fcd46..2e6ca69635aa 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -342,12 +342,6 @@ static int bcm2835_gpio_get(struct gpio_chip *chip, unsigned offset)
         return bcm2835_gpio_get_bit(pc, GPLEV0, offset);
 }
 
-static int bcm2835_gpio_direction_output(struct gpio_chip *chip,
-                unsigned offset, int value)
-{
-        return pinctrl_gpio_direction_output(chip->base + offset);
-}
-
 static void bcm2835_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
 {
         struct bcm2835_pinctrl *pc = dev_get_drvdata(chip->dev);
@@ -355,6 +349,13 @@ static void bcm2835_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
         bcm2835_gpio_set_bit(pc, value ? GPSET0 : GPCLR0, offset);
 }
 
+static int bcm2835_gpio_direction_output(struct gpio_chip *chip,
+                unsigned offset, int value)
+{
+        bcm2835_gpio_set(chip, offset, value);
+        return pinctrl_gpio_direction_output(chip->base + offset);
+}
+
 static int bcm2835_gpio_to_irq(struct gpio_chip *chip, unsigned offset)
 {
         struct bcm2835_pinctrl *pc = dev_get_drvdata(chip->dev);
diff --git a/drivers/pinctrl/freescale/pinctrl-vf610.c b/drivers/pinctrl/freescale/pinctrl-vf610.c
index 37a037543d29..587d1ff6210e 100644
--- a/drivers/pinctrl/freescale/pinctrl-vf610.c
+++ b/drivers/pinctrl/freescale/pinctrl-vf610.c
@@ -299,7 +299,7 @@ static const struct pinctrl_pin_desc vf610_pinctrl_pads[] = {
 static struct imx_pinctrl_soc_info vf610_pinctrl_info = {
         .pins = vf610_pinctrl_pads,
         .npins = ARRAY_SIZE(vf610_pinctrl_pads),
-        .flags = SHARE_MUX_CONF_REG,
+        .flags = SHARE_MUX_CONF_REG | ZERO_OFFSET_VALID,
 };
 
 static const struct of_device_id vf610_pinctrl_of_match[] = {
diff --git a/drivers/pinctrl/intel/pinctrl-broxton.c b/drivers/pinctrl/intel/pinctrl-broxton.c
index e42d5d4183f5..5979d38c46b2 100644
--- a/drivers/pinctrl/intel/pinctrl-broxton.c
+++ b/drivers/pinctrl/intel/pinctrl-broxton.c
@@ -28,6 +28,7 @@
                 .padcfglock_offset = BXT_PADCFGLOCK,    \
                 .hostown_offset = BXT_HOSTSW_OWN,       \
                 .ie_offset = BXT_GPI_IE,                \
+                .gpp_size = 32,                         \
                 .pin_base = (s),                        \
                 .npins = ((e) - (s) + 1),               \
         }
diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
index 392e28d3f48d..26f6b6ffea5b 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.c
+++ b/drivers/pinctrl/intel/pinctrl-intel.c
@@ -25,9 +25,6 @@
 
 #include "pinctrl-intel.h"
 
-/* Maximum number of pads in each group */
-#define NPADS_IN_GPP                    24
-
 /* Offset from regs */
 #define PADBAR                          0x00c
 #define GPI_IS                          0x100
@@ -37,6 +34,7 @@
 #define PADOWN_BITS                     4
 #define PADOWN_SHIFT(p)                 ((p) % 8 * PADOWN_BITS)
 #define PADOWN_MASK(p)                  (0xf << PADOWN_SHIFT(p))
+#define PADOWN_GPP(p)                   ((p) / 8)
 
 /* Offset from pad_regs */
 #define PADCFG0                         0x000
@@ -142,7 +140,7 @@ static void __iomem *intel_get_padcfg(struct intel_pinctrl *pctrl, unsigned pin,
 static bool intel_pad_owned_by_host(struct intel_pinctrl *pctrl, unsigned pin)
 {
         const struct intel_community *community;
-        unsigned padno, gpp, gpp_offset, offset;
+        unsigned padno, gpp, offset, group;
         void __iomem *padown;
 
         community = intel_get_community(pctrl, pin);
@@ -152,9 +150,9 @@ static bool intel_pad_owned_by_host(struct intel_pinctrl *pctrl, unsigned pin)
                 return true;
 
         padno = pin_to_padno(community, pin);
-        gpp = padno / NPADS_IN_GPP;
-        gpp_offset = padno % NPADS_IN_GPP;
-        offset = community->padown_offset + gpp * 16 + (gpp_offset / 8) * 4;
+        group = padno / community->gpp_size;
+        gpp = PADOWN_GPP(padno % community->gpp_size);
+        offset = community->padown_offset + 0x10 * group + gpp * 4;
         padown = community->regs + offset;
 
         return !(readl(padown) & PADOWN_MASK(padno));
@@ -173,11 +171,11 @@ static bool intel_pad_acpi_mode(struct intel_pinctrl *pctrl, unsigned pin)
                 return false;
 
         padno = pin_to_padno(community, pin);
-        gpp = padno / NPADS_IN_GPP;
+        gpp = padno / community->gpp_size;
         offset = community->hostown_offset + gpp * 4;
         hostown = community->regs + offset;
 
-        return !(readl(hostown) & BIT(padno % NPADS_IN_GPP));
+        return !(readl(hostown) & BIT(padno % community->gpp_size));
 }
 
 static bool intel_pad_locked(struct intel_pinctrl *pctrl, unsigned pin)
@@ -193,7 +191,7 @@ static bool intel_pad_locked(struct intel_pinctrl *pctrl, unsigned pin)
                 return false;
 
         padno = pin_to_padno(community, pin);
-        gpp = padno / NPADS_IN_GPP;
+        gpp = padno / community->gpp_size;
 
         /*
          * If PADCFGLOCK and PADCFGLOCKTX bits are both clear for this pad,
@@ -202,12 +200,12 @@ static bool intel_pad_locked(struct intel_pinctrl *pctrl, unsigned pin)
          */
         offset = community->padcfglock_offset + gpp * 8;
         value = readl(community->regs + offset);
-        if (value & BIT(pin % NPADS_IN_GPP))
+        if (value & BIT(pin % community->gpp_size))
                 return true;
 
         offset = community->padcfglock_offset + 4 + gpp * 8;
         value = readl(community->regs + offset);
-        if (value & BIT(pin % NPADS_IN_GPP))
+        if (value & BIT(pin % community->gpp_size))
                 return true;
 
         return false;
@@ -663,8 +661,8 @@ static void intel_gpio_irq_ack(struct irq_data *d)
         community = intel_get_community(pctrl, pin);
         if (community) {
                 unsigned padno = pin_to_padno(community, pin);
-                unsigned gpp_offset = padno % NPADS_IN_GPP;
-                unsigned gpp = padno / NPADS_IN_GPP;
+                unsigned gpp_offset = padno % community->gpp_size;
+                unsigned gpp = padno / community->gpp_size;
 
                 writel(BIT(gpp_offset), community->regs + GPI_IS + gpp * 4);
         }
@@ -685,8 +683,8 @@ static void intel_gpio_irq_mask_unmask(struct irq_data *d, bool mask)
         community = intel_get_community(pctrl, pin);
         if (community) {
                 unsigned padno = pin_to_padno(community, pin);
-                unsigned gpp_offset = padno % NPADS_IN_GPP;
-                unsigned gpp = padno / NPADS_IN_GPP;
+                unsigned gpp_offset = padno % community->gpp_size;
+                unsigned gpp = padno / community->gpp_size;
                 void __iomem *reg;
                 u32 value;
 
@@ -780,8 +778,8 @@ static int intel_gpio_irq_wake(struct irq_data *d, unsigned int on)
                 return -EINVAL;
 
         padno = pin_to_padno(community, pin);
-        gpp = padno / NPADS_IN_GPP;
-        gpp_offset = padno % NPADS_IN_GPP;
+        gpp = padno / community->gpp_size;
+        gpp_offset = padno % community->gpp_size;
 
         /* Clear the existing wake status */
         writel(BIT(gpp_offset), community->regs + GPI_GPE_STS + gpp * 4);
@@ -819,14 +817,14 @@ static irqreturn_t intel_gpio_community_irq_handler(struct intel_pinctrl *pctrl,
                 /* Only interrupts that are enabled */
                 pending &= enabled;
 
-                for_each_set_bit(gpp_offset, &pending, NPADS_IN_GPP) {
+                for_each_set_bit(gpp_offset, &pending, community->gpp_size) {
                         unsigned padno, irq;
 
                         /*
                          * The last group in community can have less pins
                          * than NPADS_IN_GPP.
                          */
-                        padno = gpp_offset + gpp * NPADS_IN_GPP;
+                        padno = gpp_offset + gpp * community->gpp_size;
                         if (padno >= community->npins)
                                 break;
 
@@ -1002,7 +1000,8 @@ int intel_pinctrl_probe(struct platform_device *pdev,
 
                 community->regs = regs;
                 community->pad_regs = regs + padbar;
-                community->ngpps = DIV_ROUND_UP(community->npins, NPADS_IN_GPP);
+                community->ngpps = DIV_ROUND_UP(community->npins,
+                                                community->gpp_size);
         }
 
         irq = platform_get_irq(pdev, 0);
diff --git a/drivers/pinctrl/intel/pinctrl-intel.h b/drivers/pinctrl/intel/pinctrl-intel.h
index 4ec8b572a288..b60215793017 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.h
+++ b/drivers/pinctrl/intel/pinctrl-intel.h
@@ -55,6 +55,8 @@ struct intel_function {
  *                  ACPI).
  * @ie_offset: Register offset of GPI_IE from @regs.
  * @pin_base: Starting pin of pins in this community
+ * @gpp_size: Maximum number of pads in each group, such as PADCFGLOCK,
+ *            HOSTSW_OWN,  GPI_IS, GPI_IE, etc.
  * @npins: Number of pins in this community
  * @regs: Community specific common registers (reserved for core driver)
  * @pad_regs: Community specific pad registers (reserved for core driver)
@@ -68,6 +70,7 @@ struct intel_community {
         unsigned hostown_offset;
         unsigned ie_offset;
         unsigned pin_base;
+        unsigned gpp_size;
         size_t npins;
         void __iomem *regs;
         void __iomem *pad_regs;
diff --git a/drivers/pinctrl/intel/pinctrl-sunrisepoint.c b/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
index 1de9ae5010db..c725a5313b4e 100644
--- a/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
+++ b/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
@@ -30,6 +30,7 @@
                 .padcfglock_offset = SPT_PADCFGLOCK,    \
                 .hostown_offset = SPT_HOSTSW_OWN,       \
                 .ie_offset = SPT_GPI_IE,                \
+                .gpp_size = 24,                         \
                 .pin_base = (s),                        \
                 .npins = ((e) - (s) + 1),               \
         }
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index cc97f0869791..48747c28a43d 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -1341,10 +1341,13 @@ static int rapl_detect_domains(struct rapl_package *rp, int cpu)
 
         for (rd = rp->domains; rd < rp->domains + rp->nr_domains; rd++) {
                 /* check if the domain is locked by BIOS */
-                if (rapl_read_data_raw(rd, FW_LOCK, false, &locked)) {
+                ret = rapl_read_data_raw(rd, FW_LOCK, false, &locked);
+                if (ret)
+                        return ret;
+                if (locked) {
                         pr_info("RAPL package %d domain %s locked by BIOS\n",
                                 rp->id, rd->name);
-                                rd->state |= DOMAIN_STATE_BIOS_LOCKED;
+                        rd->state |= DOMAIN_STATE_BIOS_LOCKED;
                 }
         }
 
diff --git a/drivers/rtc/rtc-da9063.c b/drivers/rtc/rtc-da9063.c
index 284b587da65c..d6c853bbfa9f 100644
--- a/drivers/rtc/rtc-da9063.c
+++ b/drivers/rtc/rtc-da9063.c
@@ -483,24 +483,23 @@ static int da9063_rtc_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, rtc);
 
+        rtc->rtc_dev = devm_rtc_device_register(&pdev->dev, DA9063_DRVNAME_RTC,
+                                           &da9063_rtc_ops, THIS_MODULE);
+        if (IS_ERR(rtc->rtc_dev))
+                return PTR_ERR(rtc->rtc_dev);
+
+        da9063_data_to_tm(data, &rtc->alarm_time, rtc);
+        rtc->rtc_sync = false;
+
         irq_alarm = platform_get_irq_byname(pdev, "ALARM");
         ret = devm_request_threaded_irq(&pdev->dev, irq_alarm, NULL,
                                         da9063_alarm_event,
                                         IRQF_TRIGGER_LOW | IRQF_ONESHOT,
                                         "ALARM", rtc);
-        if (ret) {
+        if (ret)
                 dev_err(&pdev->dev, "Failed to request ALARM IRQ %d: %d\n",
                         irq_alarm, ret);
-                return ret;
-        }
-
-        rtc->rtc_dev = devm_rtc_device_register(&pdev->dev, DA9063_DRVNAME_RTC,
-                                           &da9063_rtc_ops, THIS_MODULE);
-        if (IS_ERR(rtc->rtc_dev))
-                return PTR_ERR(rtc->rtc_dev);
 
-        da9063_data_to_tm(data, &rtc->alarm_time, rtc);
-        rtc->rtc_sync = false;
         return ret;
 }
 
diff --git a/drivers/rtc/rtc-rk808.c b/drivers/rtc/rtc-rk808.c
index 91ca0bc1b484..35c9aada07c8 100644
--- a/drivers/rtc/rtc-rk808.c
+++ b/drivers/rtc/rtc-rk808.c
@@ -56,6 +56,42 @@ struct rk808_rtc {
         int irq;
 };
 
+/*
+ * The Rockchip calendar used by the RK808 counts November with 31 days. We use
+ * these translation functions to convert its dates to/from the Gregorian
+ * calendar used by the rest of the world. We arbitrarily define Jan 1st, 2016
+ * as the day when both calendars were in sync, and treat all other dates
+ * relative to that.
+ * NOTE: Other system software (e.g. firmware) that reads the same hardware must
+ * implement this exact same conversion algorithm, with the same anchor date.
+ */
+static time64_t nov2dec_transitions(struct rtc_time *tm)
+{
+        return (tm->tm_year + 1900) - 2016 + (tm->tm_mon + 1 > 11 ? 1 : 0);
+}
+
+static void rockchip_to_gregorian(struct rtc_time *tm)
+{
+        /* If it's Nov 31st, rtc_tm_to_time64() will count that like Dec 1st */
+        time64_t time = rtc_tm_to_time64(tm);
+        rtc_time64_to_tm(time + nov2dec_transitions(tm) * 86400, tm);
+}
+
+static void gregorian_to_rockchip(struct rtc_time *tm)
+{
+        time64_t extra_days = nov2dec_transitions(tm);
+        time64_t time = rtc_tm_to_time64(tm);
+        rtc_time64_to_tm(time - extra_days * 86400, tm);
+
+        /* Compensate if we went back over Nov 31st (will work up to 2381) */
+        if (nov2dec_transitions(tm) < extra_days) {
+                if (tm->tm_mon + 1 == 11)
+                        tm->tm_mday++;  /* This may result in 31! */
+                else
+                        rtc_time64_to_tm(time - (extra_days - 1) * 86400, tm);
+        }
+}
+
 /* Read current time and date in RTC */
 static int rk808_rtc_readtime(struct device *dev, struct rtc_time *tm)
 {
@@ -101,9 +137,10 @@ static int rk808_rtc_readtime(struct device *dev, struct rtc_time *tm)
         tm->tm_mon = (bcd2bin(rtc_data[4] & MONTHS_REG_MSK)) - 1;
         tm->tm_year = (bcd2bin(rtc_data[5] & YEARS_REG_MSK)) + 100;
         tm->tm_wday = bcd2bin(rtc_data[6] & WEEKS_REG_MSK);
+        rockchip_to_gregorian(tm);
         dev_dbg(dev, "RTC date/time %4d-%02d-%02d(%d) %02d:%02d:%02d\n",
                 1900 + tm->tm_year, tm->tm_mon + 1, tm->tm_mday,
-                tm->tm_wday, tm->tm_hour , tm->tm_min, tm->tm_sec);
+                tm->tm_wday, tm->tm_hour, tm->tm_min, tm->tm_sec);
 
         return ret;
 }
@@ -116,6 +153,10 @@ static int rk808_rtc_set_time(struct device *dev, struct rtc_time *tm)
         u8 rtc_data[NUM_TIME_REGS];
         int ret;
 
+        dev_dbg(dev, "set RTC date/time %4d-%02d-%02d(%d) %02d:%02d:%02d\n",
+                1900 + tm->tm_year, tm->tm_mon + 1, tm->tm_mday,
+                tm->tm_wday, tm->tm_hour, tm->tm_min, tm->tm_sec);
+        gregorian_to_rockchip(tm);
         rtc_data[0] = bin2bcd(tm->tm_sec);
         rtc_data[1] = bin2bcd(tm->tm_min);
         rtc_data[2] = bin2bcd(tm->tm_hour);
@@ -123,9 +164,6 @@ static int rk808_rtc_set_time(struct device *dev, struct rtc_time *tm)
         rtc_data[4] = bin2bcd(tm->tm_mon + 1);
         rtc_data[5] = bin2bcd(tm->tm_year - 100);
         rtc_data[6] = bin2bcd(tm->tm_wday);
-        dev_dbg(dev, "set RTC date/time %4d-%02d-%02d(%d) %02d:%02d:%02d\n",
-                1900 + tm->tm_year, tm->tm_mon + 1, tm->tm_mday,
-                tm->tm_wday, tm->tm_hour , tm->tm_min, tm->tm_sec);
 
         /* Stop RTC while updating the RTC registers */
         ret = regmap_update_bits(rk808->regmap, RK808_RTC_CTRL_REG,
@@ -170,6 +208,7 @@ static int rk808_rtc_readalarm(struct device *dev, struct rtc_wkalrm *alrm)
         alrm->time.tm_mday = bcd2bin(alrm_data[3] & DAYS_REG_MSK);
         alrm->time.tm_mon = (bcd2bin(alrm_data[4] & MONTHS_REG_MSK)) - 1;
         alrm->time.tm_year = (bcd2bin(alrm_data[5] & YEARS_REG_MSK)) + 100;
+        rockchip_to_gregorian(&alrm->time);
 
         ret = regmap_read(rk808->regmap, RK808_RTC_INT_REG, &int_reg);
         if (ret) {
@@ -227,6 +266,7 @@ static int rk808_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
                 alrm->time.tm_mday, alrm->time.tm_wday, alrm->time.tm_hour,
                 alrm->time.tm_min, alrm->time.tm_sec);
 
+        gregorian_to_rockchip(&alrm->time);
         alrm_data[0] = bin2bcd(alrm->time.tm_sec);
         alrm_data[1] = bin2bcd(alrm->time.tm_min);
         alrm_data[2] = bin2bcd(alrm->time.tm_hour);
diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
index e4b799837948..459abe1dcc87 100644
--- a/drivers/scsi/scsi_pm.c
+++ b/drivers/scsi/scsi_pm.c
@@ -219,13 +219,13 @@ static int sdev_runtime_suspend(struct device *dev)
         struct scsi_device *sdev = to_scsi_device(dev);
         int err = 0;
 
-        if (pm && pm->runtime_suspend) {
-                err = blk_pre_runtime_suspend(sdev->request_queue);
-                if (err)
-                        return err;
+        err = blk_pre_runtime_suspend(sdev->request_queue);
+        if (err)
+                return err;
+        if (pm && pm->runtime_suspend)
                 err = pm->runtime_suspend(dev);
-                blk_post_runtime_suspend(sdev->request_queue, err);
-        }
+        blk_post_runtime_suspend(sdev->request_queue, err);
+
         return err;
 }
 
@@ -248,11 +248,11 @@ static int sdev_runtime_resume(struct device *dev)
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int err = 0;
 
-        if (pm && pm->runtime_resume) {
-                blk_pre_runtime_resume(sdev->request_queue);
+        blk_pre_runtime_resume(sdev->request_queue);
+        if (pm && pm->runtime_resume)
                 err = pm->runtime_resume(dev);
-                blk_post_runtime_resume(sdev->request_queue, err);
-        }
+        blk_post_runtime_resume(sdev->request_queue, err);
+
         return err;
 }
 
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index dcb0d76d7312..044d06410d4c 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -84,6 +84,7 @@ static void init_device_slot_control(unsigned char *dest_desc,
 static int ses_recv_diag(struct scsi_device *sdev, int page_code,
                          void *buf, int bufflen)
 {
+        int ret;
         unsigned char cmd[] = {
                 RECEIVE_DIAGNOSTIC,
                 1,              /* Set PCV bit */
@@ -92,9 +93,26 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
                 bufflen & 0xff,
                 0
         };
+        unsigned char recv_page_code;
 
-        return scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
+        ret =  scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
                                 NULL, SES_TIMEOUT, SES_RETRIES, NULL);
+        if (unlikely(!ret))
+                return ret;
+
+        recv_page_code = ((unsigned char *)buf)[0];
+
+        if (likely(recv_page_code == page_code))
+                return ret;
+
+        /* successful diagnostic but wrong page code.  This happens to some
+         * USB devices, just print a message and pretend there was an error */
+
+        sdev_printk(KERN_ERR, sdev,
+                    "Wrong diagnostic page; asked for %d got %u\n",
+                    page_code, recv_page_code);
+
+        return -EINVAL;
 }
 
 static int ses_send_diag(struct scsi_device *sdev, int page_code,
@@ -541,7 +559,15 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
                         if (desc_ptr)
                                 desc_ptr += len;
 
-                        if (addl_desc_ptr)
+                        if (addl_desc_ptr &&
+                            /* only find additional descriptions for specific devices */
+                            (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
+                             type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE ||
+                             type_ptr[0] == ENCLOSURE_COMPONENT_SAS_EXPANDER ||
+                             /* these elements are optional */
+                             type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT ||
+                             type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT ||
+                             type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS))
                                 addl_desc_ptr += addl_desc_ptr[1] + 2;
 
                 }
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 59a11437db70..39412c9097c6 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -167,7 +167,7 @@ static inline int is_double_byte_mode(struct fsl_dspi *dspi)
 {
         unsigned int val;
 
-        regmap_read(dspi->regmap, SPI_CTAR(dspi->cs), &val);
+        regmap_read(dspi->regmap, SPI_CTAR(0), &val);
 
         return ((val & SPI_FRAME_BITS_MASK) == SPI_FRAME_BITS(8)) ? 0 : 1;
 }
@@ -257,7 +257,7 @@ static u32 dspi_data_to_pushr(struct fsl_dspi *dspi, int tx_word)
 
         return  SPI_PUSHR_TXDATA(d16) |
                 SPI_PUSHR_PCS(dspi->cs) |
-                SPI_PUSHR_CTAS(dspi->cs) |
+                SPI_PUSHR_CTAS(0) |
                 SPI_PUSHR_CONT;
 }
 
@@ -290,7 +290,7 @@ static int dspi_eoq_write(struct fsl_dspi *dspi)
                  */
                 if (tx_word && (dspi->len == 1)) {
                         dspi->dataflags |= TRAN_STATE_WORD_ODD_NUM;
-                        regmap_update_bits(dspi->regmap, SPI_CTAR(dspi->cs),
+                        regmap_update_bits(dspi->regmap, SPI_CTAR(0),
                                         SPI_FRAME_BITS_MASK, SPI_FRAME_BITS(8));
                         tx_word = 0;
                 }
@@ -339,7 +339,7 @@ static int dspi_tcfq_write(struct fsl_dspi *dspi)
 
         if (tx_word && (dspi->len == 1)) {
                 dspi->dataflags |= TRAN_STATE_WORD_ODD_NUM;
-                regmap_update_bits(dspi->regmap, SPI_CTAR(dspi->cs),
+                regmap_update_bits(dspi->regmap, SPI_CTAR(0),
                                 SPI_FRAME_BITS_MASK, SPI_FRAME_BITS(8));
                 tx_word = 0;
         }
@@ -407,7 +407,7 @@ static int dspi_transfer_one_message(struct spi_master *master,
                 regmap_update_bits(dspi->regmap, SPI_MCR,
                                 SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF,
                                 SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF);
-                regmap_write(dspi->regmap, SPI_CTAR(dspi->cs),
+                regmap_write(dspi->regmap, SPI_CTAR(0),
                                 dspi->cur_chip->ctar_val);
 
                 trans_mode = dspi->devtype_data->trans_mode;
@@ -566,7 +566,7 @@ static irqreturn_t dspi_interrupt(int irq, void *dev_id)
                 if (!dspi->len) {
                         if (dspi->dataflags & TRAN_STATE_WORD_ODD_NUM) {
                                 regmap_update_bits(dspi->regmap,
-                                                   SPI_CTAR(dspi->cs),
+                                                   SPI_CTAR(0),
                                                    SPI_FRAME_BITS_MASK,
                                                    SPI_FRAME_BITS(16));
                                 dspi->dataflags &= ~TRAN_STATE_WORD_ODD_NUM;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 2b0a8ec3affb..dee1cb87d24f 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1705,7 +1705,7 @@ struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
         master->bus_num = -1;
         master->num_chipselect = 1;
         master->dev.class = &spi_master_class;
-        master->dev.parent = get_device(dev);
+        master->dev.parent = dev;
         spi_master_set_devdata(master, &master[1]);
 
         return master;
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index 91a0fcd72423..d0e7dfc647cf 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -651,11 +651,11 @@ static int spidev_release(struct inode *inode, struct file *filp)
                 kfree(spidev->rx_buffer);
                 spidev->rx_buffer = NULL;
 
+                spin_lock_irq(&spidev->spi_lock);
                 if (spidev->spi)
                         spidev->speed_hz = spidev->spi->max_speed_hz;
 
                 /* ... after we unbound from the underlying device? */
-                spin_lock_irq(&spidev->spi_lock);
                 dofree = (spidev->spi == NULL);
                 spin_unlock_irq(&spidev->spi_lock);
 
diff --git a/drivers/staging/android/ion/ion_chunk_heap.c b/drivers/staging/android/ion/ion_chunk_heap.c
index 195c41d7bd53..0813163f962f 100644
--- a/drivers/staging/android/ion/ion_chunk_heap.c
+++ b/drivers/staging/android/ion/ion_chunk_heap.c
@@ -81,7 +81,7 @@ static int ion_chunk_heap_allocate(struct ion_heap *heap,
 err:
         sg = table->sgl;
         for (i -= 1; i >= 0; i--) {
-                gen_pool_free(chunk_heap->pool, sg_phys(sg) & PAGE_MASK,
+                gen_pool_free(chunk_heap->pool, page_to_phys(sg_page(sg)),
                               sg->length);
                 sg = sg_next(sg);
         }
@@ -109,7 +109,7 @@ static void ion_chunk_heap_free(struct ion_buffer *buffer)
                                                         DMA_BIDIRECTIONAL);
 
         for_each_sg(table->sgl, sg, table->nents, i) {
-                gen_pool_free(chunk_heap->pool, sg_phys(sg) & PAGE_MASK,
+                gen_pool_free(chunk_heap->pool, page_to_phys(sg_page(sg)),
                               sg->length);
         }
         chunk_heap->allocated -= allocated_size;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index f2f64252814f..d9a5fc28fef4 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2062,13 +2062,13 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
         size_t eol;
         size_t tail;
         int ret, found = 0;
-        bool eof_push = 0;
 
         /* N.B. avoid overrun if nr == 0 */
-        n = min(*nr, smp_load_acquire(&ldata->canon_head) - ldata->read_tail);
-        if (!n)
+        if (!*nr)
                 return 0;
 
+        n = min(*nr + 1, smp_load_acquire(&ldata->canon_head) - ldata->read_tail);
+
         tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
         size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
 
@@ -2087,12 +2087,11 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
         n = eol - tail;
         if (n > N_TTY_BUF_SIZE)
                 n += N_TTY_BUF_SIZE;
-        n += found;
-        c = n;
+        c = n + found;
 
-        if (found && !ldata->push && read_buf(ldata, eol) == __DISABLED_CHAR) {
-                n--;
-                eof_push = !n && ldata->read_tail != ldata->line_start;
+        if (!found || read_buf(ldata, eol) != __DISABLED_CHAR) {
+                c = min(*nr, c);
+                n = c;
         }
 
         n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu tail:%zu more:%zu\n",
@@ -2115,7 +2114,7 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
                         ldata->push = 0;
                 tty_audit_push(tty);
         }
-        return eof_push ? -EAGAIN : 0;
+        return 0;
 }
 
 extern ssize_t redirected_tty_write(struct file *, const char __user *,
@@ -2272,10 +2271,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
 
                 if (ldata->icanon && !L_EXTPROC(tty)) {
                         retval = canon_copy_from_read_buf(tty, &b, &nr);
-                        if (retval == -EAGAIN) {
-                                retval = 0;
-                                continue;
-                        } else if (retval)
+                        if (retval)
                                 break;
                 } else {
                         int uncopied;
diff --git a/drivers/tty/serial/8250/8250_uniphier.c b/drivers/tty/serial/8250/8250_uniphier.c
index 1e2237a9c489..bab6b3ae2540 100644
--- a/drivers/tty/serial/8250/8250_uniphier.c
+++ b/drivers/tty/serial/8250/8250_uniphier.c
@@ -139,12 +139,16 @@ static void uniphier_serial_out(struct uart_port *p, int offset, int value)
  */
 static int uniphier_serial_dl_read(struct uart_8250_port *up)
 {
-        return readl(up->port.membase + UNIPHIER_UART_DLR);
+        int offset = UNIPHIER_UART_DLR << up->port.regshift;
+
+        return readl(up->port.membase + offset);
 }
 
 static void uniphier_serial_dl_write(struct uart_8250_port *up, int value)
 {
-        writel(value, up->port.membase + UNIPHIER_UART_DLR);
+        int offset = UNIPHIER_UART_DLR << up->port.regshift;
+
+        writel(value, up->port.membase + offset);
 }
 
 static int uniphier_of_serial_setup(struct device *dev, struct uart_port *port,
diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
index 07f7393210db..3f2423690d01 100644
--- a/drivers/tty/serial/earlycon.c
+++ b/drivers/tty/serial/earlycon.c
@@ -122,6 +122,7 @@ static int __init register_earlycon(char *buf, const struct earlycon_id *match)
         if (buf && !parse_options(&early_console_dev, buf))
                 buf = NULL;
 
+        spin_lock_init(&port->lock);
         port->uartclk = BASE_BAUD * 16;
         if (port->mapbase)
                 port->membase = earlycon_map(port->mapbase, 64);
@@ -209,6 +210,7 @@ int __init of_setup_earlycon(unsigned long addr,
         int err;
         struct uart_port *port = &early_console_dev.port;
 
+        spin_lock_init(&port->lock);
         port->iotype = UPIO_MEM;
         port->mapbase = addr;
         port->uartclk = BASE_BAUD * 16;
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 960e50a97558..51c7507b0444 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1437,7 +1437,7 @@ static void sci_request_dma(struct uart_port *port)
                         sg_init_table(sg, 1);
                         s->rx_buf[i] = buf;
                         sg_dma_address(sg) = dma;
-                        sg->length = s->buf_len_rx;
+                        sg_dma_len(sg) = s->buf_len_rx;
 
                         buf += s->buf_len_rx;
                         dma += s->buf_len_rx;
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 9a479e61791a..3cd31e0d4bd9 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -450,7 +450,7 @@ receive_buf(struct tty_struct *tty, struct tty_buffer *head, int count)
                 count = disc->ops->receive_buf2(tty, p, f, count);
         else {
                 count = min_t(int, count, tty->receive_room);
-                if (count)
+                if (count && disc->ops->receive_buf)
                         disc->ops->receive_buf(tty, p, f, count);
         }
         return count;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index a5cc032ef77a..ddbf32d599cb 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1035,10 +1035,20 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
         unsigned delay;
 
         /* Continue a partial initialization */
-        if (type == HUB_INIT2)
-                goto init2;
-        if (type == HUB_INIT3)
+        if (type == HUB_INIT2 || type == HUB_INIT3) {
+                device_lock(hub->intfdev);
+
+                /* Was the hub disconnected while we were waiting? */
+                if (hub->disconnected) {
+                        device_unlock(hub->intfdev);
+                        kref_put(&hub->kref, hub_release);
+                        return;
+                }
+                if (type == HUB_INIT2)
+                        goto init2;
                 goto init3;
+        }
+        kref_get(&hub->kref);
 
         /* The superspeed hub except for root hub has to use Hub Depth
          * value as an offset into the route string to locate the bits
@@ -1236,6 +1246,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                         queue_delayed_work(system_power_efficient_wq,
                                         &hub->init_work,
                                         msecs_to_jiffies(delay));
+                        device_unlock(hub->intfdev);
                         return;         /* Continues at init3: below */
                 } else {
                         msleep(delay);
@@ -1257,6 +1268,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
         /* Allow autosuspend if it was suppressed */
         if (type <= HUB_INIT3)
                 usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
+
+        if (type == HUB_INIT2 || type == HUB_INIT3)
+                device_unlock(hub->intfdev);
+
+        kref_put(&hub->kref, hub_release);
 }
 
 /* Implement the continuations for the delays above */
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index f51a5d52c0ed..ec1b8f2c1183 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -531,7 +531,8 @@ static int ipaq_open(struct tty_struct *tty,
          * through. Since this has a reasonably high failure rate, we retry
          * several times.
          */
-        while (retries--) {
+        while (retries) {
+                retries--;
                 result = usb_control_msg(serial->dev,
                                 usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21,
                                 0x1, 0, NULL, 0, 100);
diff --git a/drivers/video/fbdev/fsl-diu-fb.c b/drivers/video/fbdev/fsl-diu-fb.c
index b335c1ae8625..fe00a07c122e 100644
--- a/drivers/video/fbdev/fsl-diu-fb.c
+++ b/drivers/video/fbdev/fsl-diu-fb.c
@@ -479,7 +479,10 @@ static enum fsl_diu_monitor_port fsl_diu_name_to_port(const char *s)
                         port = FSL_DIU_PORT_DLVDS;
         }
 
-        return diu_ops.valid_monitor_port(port);
+        if (diu_ops.valid_monitor_port)
+                port = diu_ops.valid_monitor_port(port);
+
+        return port;
 }
 
 /*
@@ -1915,6 +1918,14 @@ static int __init fsl_diu_init(void)
 #else
         monitor_port = fsl_diu_name_to_port(monitor_string);
 #endif
+
+        /*
+         * Must to verify set_pixel_clock. If not implement on platform,
+         * then that means that there is no platform support for the DIU.
+         */
+        if (!diu_ops.set_pixel_clock)
+                return -ENODEV;
+
         pr_info("Freescale Display Interface Unit (DIU) framebuffer driver\n");
 
 #ifdef CONFIG_NOT_COHERENT_CACHE
diff --git a/drivers/video/fbdev/omap2/dss/venc.c b/drivers/video/fbdev/omap2/dss/venc.c
index 99ca268c1cdd..d05a54922ba6 100644
--- a/drivers/video/fbdev/omap2/dss/venc.c
+++ b/drivers/video/fbdev/omap2/dss/venc.c
@@ -275,6 +275,12 @@ const struct omap_video_timings omap_dss_pal_timings = {
         .vbp            = 41,
 
         .interlace      = true,
+
+        .hsync_level = OMAPDSS_SIG_ACTIVE_LOW,
+        .vsync_level = OMAPDSS_SIG_ACTIVE_LOW,
+        .data_pclk_edge = OMAPDSS_DRIVE_SIG_RISING_EDGE,
+        .de_level = OMAPDSS_SIG_ACTIVE_HIGH,
+        .sync_pclk_edge = OMAPDSS_DRIVE_SIG_FALLING_EDGE,
 };
 EXPORT_SYMBOL(omap_dss_pal_timings);
 
@@ -290,6 +296,12 @@ const struct omap_video_timings omap_dss_ntsc_timings = {
         .vbp            = 31,
 
         .interlace      = true,
+
+        .hsync_level = OMAPDSS_SIG_ACTIVE_LOW,
+        .vsync_level = OMAPDSS_SIG_ACTIVE_LOW,
+        .data_pclk_edge = OMAPDSS_DRIVE_SIG_RISING_EDGE,
+        .de_level = OMAPDSS_SIG_ACTIVE_HIGH,
+        .sync_pclk_edge = OMAPDSS_DRIVE_SIG_FALLING_EDGE,
 };
 EXPORT_SYMBOL(omap_dss_ntsc_timings);
 
diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index e3e9e3d46d1b..96a1b8da5371 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -281,7 +281,8 @@ static void handle_irq_for_port(unsigned port)
 
 static void consume_one_event(unsigned cpu,
                               struct evtchn_fifo_control_block *control_block,
-                              unsigned priority, unsigned long *ready)
+                              unsigned priority, unsigned long *ready,
+                              bool drop)
 {
         struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu);
         uint32_t head;
@@ -313,13 +314,17 @@ static void consume_one_event(unsigned cpu,
         if (head == 0)
                 clear_bit(priority, ready);
 
-        if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port))
-                handle_irq_for_port(port);
+        if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port)) {
+                if (unlikely(drop))
+                        pr_warn("Dropping pending event for port %u\n", port);
+                else
+                        handle_irq_for_port(port);
+        }
 
         q->head[priority] = head;
 }
 
-static void evtchn_fifo_handle_events(unsigned cpu)
+static void __evtchn_fifo_handle_events(unsigned cpu, bool drop)
 {
         struct evtchn_fifo_control_block *control_block;
         unsigned long ready;
@@ -331,11 +336,16 @@ static void evtchn_fifo_handle_events(unsigned cpu)
 
         while (ready) {
                 q = find_first_bit(&ready, EVTCHN_FIFO_MAX_QUEUES);
-                consume_one_event(cpu, control_block, q, &ready);
+                consume_one_event(cpu, control_block, q, &ready, drop);
                 ready |= xchg(&control_block->ready, 0);
         }
 }
 
+static void evtchn_fifo_handle_events(unsigned cpu)
+{
+        __evtchn_fifo_handle_events(cpu, false);
+}
+
 static void evtchn_fifo_resume(void)
 {
         unsigned cpu;
@@ -420,6 +430,9 @@ static int evtchn_fifo_cpu_notification(struct notifier_block *self,
                 if (!per_cpu(cpu_control_block, cpu))
                         ret = evtchn_fifo_alloc_control_block(cpu);
                 break;
+        case CPU_DEAD:
+                __evtchn_fifo_handle_events(cpu, true);
+                break;
         default:
                 break;
         }
diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
index 58e38d586f52..4d529f3e40df 100644
--- a/drivers/xen/xen-pciback/pciback.h
+++ b/drivers/xen/xen-pciback/pciback.h
@@ -37,6 +37,7 @@ struct xen_pcibk_device {
         struct xen_pci_sharedinfo *sh_info;
         unsigned long flags;
         struct work_struct op_work;
+        struct xen_pci_op op;
 };
 
 struct xen_pcibk_dev_data {
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index c4a0666de6f5..73dafdc494aa 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -70,6 +70,13 @@ static void xen_pcibk_control_isr(struct pci_dev *dev, int reset)
                 enable ? "enable" : "disable");
 
         if (enable) {
+                /*
+                 * The MSI or MSI-X should not have an IRQ handler. Otherwise
+                 * if the guest terminates we BUG_ON in free_msi_irqs.
+                 */
+                if (dev->msi_enabled || dev->msix_enabled)
+                        goto out;
+
                 rc = request_irq(dev_data->irq,
                                 xen_pcibk_guest_interrupt, IRQF_SHARED,
                                 dev_data->irq_name, dev);
@@ -144,7 +151,12 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev,
         if (unlikely(verbose_request))
                 printk(KERN_DEBUG DRV_NAME ": %s: enable MSI\n", pci_name(dev));
 
-        status = pci_enable_msi(dev);
+        if (dev->msi_enabled)
+                status = -EALREADY;
+        else if (dev->msix_enabled)
+                status = -ENXIO;
+        else
+                status = pci_enable_msi(dev);
 
         if (status) {
                 pr_warn_ratelimited("%s: error enabling MSI for guest %u: err %d\n",
@@ -173,20 +185,23 @@ static
 int xen_pcibk_disable_msi(struct xen_pcibk_device *pdev,
                           struct pci_dev *dev, struct xen_pci_op *op)
 {
-        struct xen_pcibk_dev_data *dev_data;
-
         if (unlikely(verbose_request))
                 printk(KERN_DEBUG DRV_NAME ": %s: disable MSI\n",
                        pci_name(dev));
-        pci_disable_msi(dev);
 
+        if (dev->msi_enabled) {
+                struct xen_pcibk_dev_data *dev_data;
+
+                pci_disable_msi(dev);
+
+                dev_data = pci_get_drvdata(dev);
+                if (dev_data)
+                        dev_data->ack_intr = 1;
+        }
         op->value = dev->irq ? xen_pirq_from_irq(dev->irq) : 0;
         if (unlikely(verbose_request))
                 printk(KERN_DEBUG DRV_NAME ": %s: MSI: %d\n", pci_name(dev),
                         op->value);
-        dev_data = pci_get_drvdata(dev);
-        if (dev_data)
-                dev_data->ack_intr = 1;
         return 0;
 }
 
@@ -197,13 +212,26 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
         struct xen_pcibk_dev_data *dev_data;
         int i, result;
         struct msix_entry *entries;
+        u16 cmd;
 
         if (unlikely(verbose_request))
                 printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n",
                        pci_name(dev));
+
         if (op->value > SH_INFO_MAX_VEC)
                 return -EINVAL;
 
+        if (dev->msix_enabled)
+                return -EALREADY;
+
+        /*
+         * PCI_COMMAND_MEMORY must be enabled, otherwise we may not be able
+         * to access the BARs where the MSI-X entries reside.
+         */
+        pci_read_config_word(dev, PCI_COMMAND, &cmd);
+        if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY))
+                return -ENXIO;
+
         entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
         if (entries == NULL)
                 return -ENOMEM;
@@ -245,23 +273,27 @@ static
 int xen_pcibk_disable_msix(struct xen_pcibk_device *pdev,
                            struct pci_dev *dev, struct xen_pci_op *op)
 {
-        struct xen_pcibk_dev_data *dev_data;
         if (unlikely(verbose_request))
                 printk(KERN_DEBUG DRV_NAME ": %s: disable MSI-X\n",
                         pci_name(dev));
-        pci_disable_msix(dev);
 
+        if (dev->msix_enabled) {
+                struct xen_pcibk_dev_data *dev_data;
+
+                pci_disable_msix(dev);
+
+                dev_data = pci_get_drvdata(dev);
+                if (dev_data)
+                        dev_data->ack_intr = 1;
+        }
         /*
          * SR-IOV devices (which don't have any legacy IRQ) have
          * an undefined IRQ value of zero.
          */
         op->value = dev->irq ? xen_pirq_from_irq(dev->irq) : 0;
         if (unlikely(verbose_request))
-                printk(KERN_DEBUG DRV_NAME ": %s: MSI-X: %d\n", pci_name(dev),
-                        op->value);
-        dev_data = pci_get_drvdata(dev);
-        if (dev_data)
-                dev_data->ack_intr = 1;
+                printk(KERN_DEBUG DRV_NAME ": %s: MSI-X: %d\n",
+                       pci_name(dev), op->value);
         return 0;
 }
 #endif
@@ -298,9 +330,11 @@ void xen_pcibk_do_op(struct work_struct *data)
                 container_of(data, struct xen_pcibk_device, op_work);
         struct pci_dev *dev;
         struct xen_pcibk_dev_data *dev_data = NULL;
-        struct xen_pci_op *op = &pdev->sh_info->op;
+        struct xen_pci_op *op = &pdev->op;
         int test_intx = 0;
 
+        *op = pdev->sh_info->op;
+        barrier();
         dev = xen_pcibk_get_pci_dev(pdev, op->domain, op->bus, op->devfn);
 
         if (dev == NULL)
@@ -342,6 +376,17 @@ void xen_pcibk_do_op(struct work_struct *data)
                 if ((dev_data->enable_intx != test_intx))
                         xen_pcibk_control_isr(dev, 0 /* no reset */);
         }
+        pdev->sh_info->op.err = op->err;
+        pdev->sh_info->op.value = op->value;
+#ifdef CONFIG_PCI_MSI
+        if (op->cmd == XEN_PCI_OP_enable_msix && op->err == 0) {
+                unsigned int i;
+
+                for (i = 0; i < op->value; i++)
+                        pdev->sh_info->op.msix_entries[i].vector =
+                                op->msix_entries[i].vector;
+        }
+#endif
         /* Tell the driver domain that we're done. */
         wmb();
         clear_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags);
diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
index 98bc345f296e..4843741e703a 100644
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -44,7 +44,6 @@ static struct xen_pcibk_device *alloc_pdev(struct xenbus_device *xdev)
         dev_dbg(&xdev->dev, "allocated pdev @ 0x%p\n", pdev);
 
         pdev->xdev = xdev;
-        dev_set_drvdata(&xdev->dev, pdev);
 
         mutex_init(&pdev->dev_lock);
 
@@ -58,6 +57,9 @@ static struct xen_pcibk_device *alloc_pdev(struct xenbus_device *xdev)
                 kfree(pdev);
                 pdev = NULL;
         }
+
+        dev_set_drvdata(&xdev->dev, pdev);
+
 out:
         return pdev;
 }
diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 43bcae852546..ad4eb1024d1f 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -726,7 +726,7 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                 if (!pending_req)
                         return 1;
 
-                ring_req = *RING_GET_REQUEST(ring, rc);
+                RING_COPY_REQUEST(ring, rc, &ring_req);
                 ring->req_cons = ++rc;
 
                 err = prepare_pending_reqs(info, &ring_req, pending_req);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 4b89680a1923..c4661db2b72a 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -10480,11 +10480,15 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info)
                  * until transaction commit to do the actual discard.
                  */
                 if (trimming) {
-                        WARN_ON(!list_empty(&block_group->bg_list));
-                        spin_lock(&trans->transaction->deleted_bgs_lock);
+                        spin_lock(&fs_info->unused_bgs_lock);
+                        /*
+                         * A concurrent scrub might have added us to the list
+                         * fs_info->unused_bgs, so use a list_move operation
+                         * to add the block group to the deleted_bgs list.
+                         */
                         list_move(&block_group->bg_list,
                                   &trans->transaction->deleted_bgs);
-                        spin_unlock(&trans->transaction->deleted_bgs_lock);
+                        spin_unlock(&fs_info->unused_bgs_lock);
                         btrfs_get_block_group(block_group);
                 }
 end_trans:
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 72e73461c064..0f09526aa7d9 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1291,7 +1291,8 @@ out:
  * on error we return an unlocked page and the error value
  * on success we return a locked page and 0
  */
-static int prepare_uptodate_page(struct page *page, u64 pos,
+static int prepare_uptodate_page(struct inode *inode,
+                                 struct page *page, u64 pos,
                                  bool force_uptodate)
 {
         int ret = 0;
@@ -1306,6 +1307,10 @@ static int prepare_uptodate_page(struct page *page, u64 pos,
                         unlock_page(page);
                         return -EIO;
                 }
+                if (page->mapping != inode->i_mapping) {
+                        unlock_page(page);
+                        return -EAGAIN;
+                }
         }
         return 0;
 }
@@ -1324,6 +1329,7 @@ static noinline int prepare_pages(struct inode *inode, struct page **pages,
         int faili;
 
         for (i = 0; i < num_pages; i++) {
+again:
                 pages[i] = find_or_create_page(inode->i_mapping, index + i,
                                                mask | __GFP_WRITE);
                 if (!pages[i]) {
@@ -1333,13 +1339,17 @@ static noinline int prepare_pages(struct inode *inode, struct page **pages,
                 }
 
                 if (i == 0)
-                        err = prepare_uptodate_page(pages[i], pos,
+                        err = prepare_uptodate_page(inode, pages[i], pos,
                                                     force_uptodate);
-                if (i == num_pages - 1)
-                        err = prepare_uptodate_page(pages[i],
+                if (!err && i == num_pages - 1)
+                        err = prepare_uptodate_page(inode, pages[i],
                                                     pos + write_bytes, false);
                 if (err) {
                         page_cache_release(pages[i]);
+                        if (err == -EAGAIN) {
+                                err = 0;
+                                goto again;
+                        }
                         faili = i - 1;
                         goto fail;
                 }
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 85a1f8621b51..cfe99bec49de 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -891,7 +891,7 @@ out:
                 spin_unlock(&block_group->lock);
                 ret = 0;
 
-                btrfs_warn(fs_info, "failed to load free space cache for block group %llu, rebuild it now",
+                btrfs_warn(fs_info, "failed to load free space cache for block group %llu, rebuilding it now",
                         block_group->key.objectid);
         }
 
@@ -2972,7 +2972,7 @@ setup_cluster_bitmap(struct btrfs_block_group_cache *block_group,
                      u64 cont1_bytes, u64 min_bytes)
 {
         struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
-        struct btrfs_free_space *entry;
+        struct btrfs_free_space *entry = NULL;
         int ret = -ENOSPC;
         u64 bitmap_offset = offset_to_bitmap(ctl, offset);
 
@@ -2983,8 +2983,10 @@ setup_cluster_bitmap(struct btrfs_block_group_cache *block_group,
          * The bitmap that covers offset won't be in the list unless offset
          * is just its start offset.
          */
-        entry = list_first_entry(bitmaps, struct btrfs_free_space, list);
-        if (entry->offset != bitmap_offset) {
+        if (!list_empty(bitmaps))
+                entry = list_first_entry(bitmaps, struct btrfs_free_space, list);
+
+        if (!entry || entry->offset != bitmap_offset) {
                 entry = tree_search_offset(ctl, bitmap_offset, 1, 0);
                 if (entry && list_empty(&entry->list))
                         list_add(&entry->list, bitmaps);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 3367a3c6f214..be8eae80ff65 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -274,7 +274,6 @@ loop:
         cur_trans->num_dirty_bgs = 0;
         spin_lock_init(&cur_trans->dirty_bgs_lock);
         INIT_LIST_HEAD(&cur_trans->deleted_bgs);
-        spin_lock_init(&cur_trans->deleted_bgs_lock);
         spin_lock_init(&cur_trans->dropped_roots_lock);
         list_add_tail(&cur_trans->list, &fs_info->trans_list);
         extent_io_tree_init(&cur_trans->dirty_pages,
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index 0da21ca9b3fb..64c8221b6165 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -77,8 +77,8 @@ struct btrfs_transaction {
          */
         struct mutex cache_write_mutex;
         spinlock_t dirty_bgs_lock;
+        /* Protected by spin lock fs_info->unused_bgs_lock. */
         struct list_head deleted_bgs;
-        spinlock_t deleted_bgs_lock;
         spinlock_t dropped_roots_lock;
         struct btrfs_delayed_ref_root delayed_refs;
         int aborted;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 456452206609..a23399e8e3ab 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3548,12 +3548,11 @@ again:
 
                         ret = btrfs_force_chunk_alloc(trans, chunk_root,
                                                       BTRFS_BLOCK_GROUP_DATA);
+                        btrfs_end_transaction(trans, chunk_root);
                         if (ret < 0) {
                                 mutex_unlock(&fs_info->delete_unused_bgs_mutex);
                                 goto error;
                         }
-
-                        btrfs_end_transaction(trans, chunk_root);
                         chunk_reserved = 1;
                 }
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index bd3e9e68125b..4bd5d3118acd 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2494,6 +2494,7 @@ static ssize_t proc_coredump_filter_write(struct file *file,
         mm = get_task_mm(task);
         if (!mm)
                 goto out_no_mm;
+        ret = 0;
 
         for (i = 0, mask = 1; i < MMF_DUMP_FILTER_BITS; i++, mask <<= 1) {
                 if (val & mask)
diff --git a/include/linux/enclosure.h b/include/linux/enclosure.h
index 7be22da321f3..a4cf57cd0f75 100644
--- a/include/linux/enclosure.h
+++ b/include/linux/enclosure.h
@@ -29,7 +29,11 @@
 /* A few generic types ... taken from ses-2 */
 enum enclosure_component_type {
         ENCLOSURE_COMPONENT_DEVICE = 0x01,
+        ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS = 0x07,
+        ENCLOSURE_COMPONENT_SCSI_TARGET_PORT = 0x14,
+        ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT = 0x15,
         ENCLOSURE_COMPONENT_ARRAY_DEVICE = 0x17,
+        ENCLOSURE_COMPONENT_SAS_EXPANDER = 0x18,
 };
 
 /* ses-2 common element status */
diff --git a/include/linux/mmdebug.h b/include/linux/mmdebug.h
index 877ef226f90f..772362adf471 100644
--- a/include/linux/mmdebug.h
+++ b/include/linux/mmdebug.h
@@ -1,6 +1,7 @@
 #ifndef LINUX_MM_DEBUG_H
 #define LINUX_MM_DEBUG_H 1
 
+#include <linux/bug.h>
 #include <linux/stringify.h>
 
 struct page;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3b5d134e945a..3143c847bddb 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2084,7 +2084,7 @@ struct pcpu_sw_netstats {
 })
 
 #define netdev_alloc_pcpu_stats(type)                                   \
-        __netdev_alloc_pcpu_stats(type, GFP_KERNEL);
+        __netdev_alloc_pcpu_stats(type, GFP_KERNEL)
 
 #include <linux/notifier.h>
 
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index 249d1bb01e03..5646b24bfc64 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -14,7 +14,7 @@ struct nfnl_callback {
         int (*call_rcu)(struct sock *nl, struct sk_buff *skb, 
                     const struct nlmsghdr *nlh,
                     const struct nlattr * const cda[]);
-        int (*call_batch)(struct sock *nl, struct sk_buff *skb,
+        int (*call_batch)(struct net *net, struct sock *nl, struct sk_buff *skb,
                           const struct nlmsghdr *nlh,
                           const struct nlattr * const cda[]);
         const struct nla_policy *policy;        /* netlink attribute policy */
diff --git a/include/linux/platform_data/edma.h b/include/linux/platform_data/edma.h
index e2878baeb90e..4299f4ba03bd 100644
--- a/include/linux/platform_data/edma.h
+++ b/include/linux/platform_data/edma.h
@@ -72,7 +72,7 @@ struct edma_soc_info {
         struct edma_rsv_info    *rsv;
 
         /* List of channels allocated for memcpy, terminated with -1 */
-        s16                     *memcpy_channels;
+        s32                     *memcpy_channels;
 
         s8      (*queue_priority_mapping)[2];
         const s16       (*xbar_chans)[2];
diff --git a/include/linux/qed/common_hsi.h b/include/linux/qed/common_hsi.h
index 6a4347639c03..1d1ba2c5ee7a 100644
--- a/include/linux/qed/common_hsi.h
+++ b/include/linux/qed/common_hsi.h
@@ -9,6 +9,8 @@
 #ifndef __COMMON_HSI__
 #define __COMMON_HSI__
 
+#define CORE_SPQE_PAGE_SIZE_BYTES                       4096
+
 #define FW_MAJOR_VERSION        8
 #define FW_MINOR_VERSION        4
 #define FW_REVISION_VERSION     2
diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h
index b920c3605c46..41b9049b57e2 100644
--- a/include/linux/qed/qed_chain.h
+++ b/include/linux/qed/qed_chain.h
@@ -111,7 +111,8 @@ static inline u16 qed_chain_get_elem_left(struct qed_chain *p_chain)
         used = ((u32)0x10000u + (u32)(p_chain->prod_idx)) -
                 (u32)p_chain->cons_idx;
         if (p_chain->mode == QED_CHAIN_MODE_NEXT_PTR)
-                used -= (used / p_chain->elem_per_page);
+                used -= p_chain->prod_idx / p_chain->elem_per_page -
+                        p_chain->cons_idx / p_chain->elem_per_page;
 
         return p_chain->capacity - used;
 }
diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
index 843ceca9a21e..e50b31d18462 100644
--- a/include/linux/rhashtable.h
+++ b/include/linux/rhashtable.h
@@ -19,6 +19,7 @@
 
 #include <linux/atomic.h>
 #include <linux/compiler.h>
+#include <linux/err.h>
 #include <linux/errno.h>
 #include <linux/jhash.h>
 #include <linux/list_nulls.h>
@@ -339,10 +340,11 @@ static inline int lockdep_rht_bucket_is_held(const struct bucket_table *tbl,
 int rhashtable_init(struct rhashtable *ht,
                     const struct rhashtable_params *params);
 
-int rhashtable_insert_slow(struct rhashtable *ht, const void *key,
-                           struct rhash_head *obj,
-                           struct bucket_table *old_tbl);
-int rhashtable_insert_rehash(struct rhashtable *ht);
+struct bucket_table *rhashtable_insert_slow(struct rhashtable *ht,
+                                            const void *key,
+                                            struct rhash_head *obj,
+                                            struct bucket_table *old_tbl);
+int rhashtable_insert_rehash(struct rhashtable *ht, struct bucket_table *tbl);
 
 int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter);
 void rhashtable_walk_exit(struct rhashtable_iter *iter);
@@ -598,9 +600,11 @@ restart:
 
         new_tbl = rht_dereference_rcu(tbl->future_tbl, ht);
         if (unlikely(new_tbl)) {
-                err = rhashtable_insert_slow(ht, key, obj, new_tbl);
-                if (err == -EAGAIN)
+                tbl = rhashtable_insert_slow(ht, key, obj, new_tbl);
+                if (!IS_ERR_OR_NULL(tbl))
                         goto slow_path;
+
+                err = PTR_ERR(tbl);
                 goto out;
         }
 
@@ -611,7 +615,7 @@ restart:
         if (unlikely(rht_grow_above_100(ht, tbl))) {
 slow_path:
                 spin_unlock_bh(lock);
-                err = rhashtable_insert_rehash(ht);
+                err = rhashtable_insert_rehash(ht, tbl);
                 rcu_read_unlock();
                 if (err)
                         return err;
diff --git a/include/net/dst.h b/include/net/dst.h
index 1279f9b09791..c7329dcd90cc 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -322,6 +322,39 @@ static inline void skb_dst_force(struct sk_buff *skb)
         }
 }
 
+/**
+ * dst_hold_safe - Take a reference on a dst if possible
+ * @dst: pointer to dst entry
+ *
+ * This helper returns false if it could not safely
+ * take a reference on a dst.
+ */
+static inline bool dst_hold_safe(struct dst_entry *dst)
+{
+        if (dst->flags & DST_NOCACHE)
+                return atomic_inc_not_zero(&dst->__refcnt);
+        dst_hold(dst);
+        return true;
+}
+
+/**
+ * skb_dst_force_safe - makes sure skb dst is refcounted
+ * @skb: buffer
+ *
+ * If dst is not yet refcounted and not destroyed, grab a ref on it.
+ */
+static inline void skb_dst_force_safe(struct sk_buff *skb)
+{
+        if (skb_dst_is_noref(skb)) {
+                struct dst_entry *dst = skb_dst(skb);
+
+                if (!dst_hold_safe(dst))
+                        dst = NULL;
+
+                skb->_skb_refdst = (unsigned long)dst;
+        }
+}
+
 
 /**
  *      __skb_tunnel_rx - prepare skb for rx reinsert
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 2134e6d815bc..625bdf95d673 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -210,18 +210,37 @@ struct inet_sock {
 #define IP_CMSG_ORIGDSTADDR     BIT(6)
 #define IP_CMSG_CHECKSUM        BIT(7)
 
-/* SYNACK messages might be attached to request sockets.
+/**
+ * sk_to_full_sk - Access to a full socket
+ * @sk: pointer to a socket
+ *
+ * SYNACK messages might be attached to request sockets.
  * Some places want to reach the listener in this case.
  */
-static inline struct sock *skb_to_full_sk(const struct sk_buff *skb)
+static inline struct sock *sk_to_full_sk(struct sock *sk)
 {
-        struct sock *sk = skb->sk;
-
+#ifdef CONFIG_INET
         if (sk && sk->sk_state == TCP_NEW_SYN_RECV)
                 sk = inet_reqsk(sk)->rsk_listener;
+#endif
+        return sk;
+}
+
+/* sk_to_full_sk() variant with a const argument */
+static inline const struct sock *sk_const_to_full_sk(const struct sock *sk)
+{
+#ifdef CONFIG_INET
+        if (sk && sk->sk_state == TCP_NEW_SYN_RECV)
+                sk = ((const struct request_sock *)sk)->rsk_listener;
+#endif
         return sk;
 }
 
+static inline struct sock *skb_to_full_sk(const struct sk_buff *skb)
+{
+        return sk_to_full_sk(skb->sk);
+}
+
 static inline struct inet_sock *inet_sk(const struct sock *sk)
 {
         return (struct inet_sock *)sk;
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 4a6009d4486b..235c7811a86a 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -78,6 +78,7 @@ void inet_initpeers(void) __init;
 static inline void inetpeer_set_addr_v4(struct inetpeer_addr *iaddr, __be32 ip)
 {
         iaddr->a4.addr = ip;
+        iaddr->a4.vif = 0;
         iaddr->family = AF_INET;
 }
 
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 7bbb71081aeb..eea9bdeecba2 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1493,7 +1493,8 @@ struct sctp_association {
                  *             : SACK's are not delayed (see Section 6).
                  */
                 __u8    sack_needed:1,     /* Do we need to sack the peer? */
-                        sack_generation:1;
+                        sack_generation:1,
+                        zero_window_announced:1;
                 __u32   sack_cnt;
 
                 __u32   adaptation_ind;  /* Adaptation Code point. */
diff --git a/include/net/sock.h b/include/net/sock.h
index 52d27ee924f4..14d3c0734007 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -388,7 +388,7 @@ struct sock {
                 struct socket_wq        *sk_wq_raw;
         };
 #ifdef CONFIG_XFRM
-        struct xfrm_policy      *sk_policy[2];
+        struct xfrm_policy __rcu *sk_policy[2];
 #endif
         struct dst_entry        *sk_rx_dst;
         struct dst_entry __rcu  *sk_dst_cache;
@@ -404,6 +404,7 @@ struct sock {
                                 sk_userlocks : 4,
                                 sk_protocol  : 8,
                                 sk_type      : 16;
+#define SK_PROTOCOL_MAX U8_MAX
         kmemcheck_bitfield_end(flags);
         int                     sk_wmem_queued;
         gfp_t                   sk_allocation;
@@ -740,6 +741,8 @@ enum sock_flags {
         SOCK_SELECT_ERR_QUEUE, /* Wake select on error queue */
 };
 
+#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
+
 static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
 {
         nsk->sk_flags = osk->sk_flags;
@@ -814,7 +817,7 @@ void sk_stream_write_space(struct sock *sk);
 static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
 {
         /* dont let skb dst not refcounted, we are going to leave rcu lock */
-        skb_dst_force(skb);
+        skb_dst_force_safe(skb);
 
         if (!sk->sk_backlog.tail)
                 sk->sk_backlog.head = skb;
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index c1c899c3a51b..e289ada6adf6 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -79,7 +79,7 @@ struct vxlanhdr {
 };
 
 /* VXLAN header flags. */
-#define VXLAN_HF_RCO BIT(24)
+#define VXLAN_HF_RCO BIT(21)
 #define VXLAN_HF_VNI BIT(27)
 #define VXLAN_HF_GBP BIT(31)
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 4a9c21f9b4ea..d6f6e5006ee9 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -548,6 +548,7 @@ struct xfrm_policy {
         u16                     family;
         struct xfrm_sec_ctx     *security;
         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
+        struct rcu_head         rcu;
 };
 
 static inline struct net *xp_net(const struct xfrm_policy *xp)
@@ -1141,12 +1142,14 @@ static inline int xfrm6_route_forward(struct sk_buff *skb)
         return xfrm_route_forward(skb, AF_INET6);
 }
 
-int __xfrm_sk_clone_policy(struct sock *sk);
+int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
 
-static inline int xfrm_sk_clone_policy(struct sock *sk)
+static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
 {
-        if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
-                return __xfrm_sk_clone_policy(sk);
+        sk->sk_policy[0] = NULL;
+        sk->sk_policy[1] = NULL;
+        if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
+                return __xfrm_sk_clone_policy(sk, osk);
         return 0;
 }
 
@@ -1154,12 +1157,16 @@ int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
 
 static inline void xfrm_sk_free_policy(struct sock *sk)
 {
-        if (unlikely(sk->sk_policy[0] != NULL)) {
-                xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
+        struct xfrm_policy *pol;
+
+        pol = rcu_dereference_protected(sk->sk_policy[0], 1);
+        if (unlikely(pol != NULL)) {
+                xfrm_policy_delete(pol, XFRM_POLICY_MAX);
                 sk->sk_policy[0] = NULL;
         }
-        if (unlikely(sk->sk_policy[1] != NULL)) {
-                xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
+        pol = rcu_dereference_protected(sk->sk_policy[1], 1);
+        if (unlikely(pol != NULL)) {
+                xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
                 sk->sk_policy[1] = NULL;
         }
 }
@@ -1169,7 +1176,7 @@ void xfrm_garbage_collect(struct net *net);
 #else
 
 static inline void xfrm_sk_free_policy(struct sock *sk) {}
-static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
+static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }  
 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 
 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index 628e6e64c2fb..c2e5d6cb34e3 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -186,6 +186,7 @@ header-y += if_tunnel.h
 header-y += if_vlan.h
 header-y += if_x25.h
 header-y += igmp.h
+header-y += ila.h
 header-y += in6.h
 header-y += inet_diag.h
 header-y += in.h
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index 28ccedd000f5..a27222d5b413 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -628,7 +628,7 @@ struct ovs_action_hash {
  * @OVS_CT_ATTR_MARK: u32 value followed by u32 mask. For each bit set in the
  * mask, the corresponding bit in the value is copied to the connection
  * tracking mark field in the connection.
- * @OVS_CT_ATTR_LABEL: %OVS_CT_LABELS_LEN value followed by %OVS_CT_LABELS_LEN
+ * @OVS_CT_ATTR_LABELS: %OVS_CT_LABELS_LEN value followed by %OVS_CT_LABELS_LEN
  * mask. For each bit set in the mask, the corresponding bit in the value is
  * copied to the connection tracking label field in the connection.
  * @OVS_CT_ATTR_HELPER: variable length string defining conntrack ALG.
diff --git a/include/xen/interface/io/ring.h b/include/xen/interface/io/ring.h
index 7d28aff605c7..7dc685b4057d 100644
--- a/include/xen/interface/io/ring.h
+++ b/include/xen/interface/io/ring.h
@@ -181,6 +181,20 @@ struct __name##_back_ring {						\
 #define RING_GET_REQUEST(_r, _idx)                                      \
     (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].req))
 
+/*
+ * Get a local copy of a request.
+ *
+ * Use this in preference to RING_GET_REQUEST() so all processing is
+ * done on a local copy that cannot be modified by the other end.
+ *
+ * Note that https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 may cause this
+ * to be ineffective where _req is a struct which consists of only bitfields.
+ */
+#define RING_COPY_REQUEST(_r, _idx, _req) do {                          \
+        /* Use volatile to force the copy into _req. */                 \
+        *(_req) = *(volatile typeof(_req))RING_GET_REQUEST(_r, _idx);   \
+} while (0)
+
 #define RING_GET_RESPONSE(_r, _idx)                                     \
     (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp))
 
diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c
index d092a0c9c2d4..05a37857ab55 100644
--- a/kernel/locking/osq_lock.c
+++ b/kernel/locking/osq_lock.c
@@ -93,10 +93,12 @@ bool osq_lock(struct optimistic_spin_queue *lock)
         node->cpu = curr;
 
         /*
-         * ACQUIRE semantics, pairs with corresponding RELEASE
-         * in unlock() uncontended, or fastpath.
+         * We need both ACQUIRE (pairs with corresponding RELEASE in
+         * unlock() uncontended, or fastpath) and RELEASE (to publish
+         * the node fields we just initialised) semantics when updating
+         * the lock tail.
          */
-        old = atomic_xchg_acquire(&lock->tail, curr);
+        old = atomic_xchg(&lock->tail, curr);
         if (old == OSQ_UNLOCKED_VAL)
                 return true;
 
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 8855f019ebe8..d34bd24c2c84 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -1464,7 +1464,7 @@ void debug_dma_alloc_coherent(struct device *dev, size_t size,
         entry->type      = dma_debug_coherent;
         entry->dev       = dev;
         entry->pfn       = page_to_pfn(virt_to_page(virt));
-        entry->offset    = (size_t) virt & PAGE_MASK;
+        entry->offset    = (size_t) virt & ~PAGE_MASK;
         entry->size      = size;
         entry->dev_addr  = dma_addr;
         entry->direction = DMA_BIDIRECTIONAL;
@@ -1480,7 +1480,7 @@ void debug_dma_free_coherent(struct device *dev, size_t size,
                 .type           = dma_debug_coherent,
                 .dev            = dev,
                 .pfn            = page_to_pfn(virt_to_page(virt)),
-                .offset         = (size_t) virt & PAGE_MASK,
+                .offset         = (size_t) virt & ~PAGE_MASK,
                 .dev_addr       = addr,
                 .size           = size,
                 .direction      = DMA_BIDIRECTIONAL,
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index a54ff8949f91..eb9240c458fa 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -389,33 +389,31 @@ static bool rhashtable_check_elasticity(struct rhashtable *ht,
         return false;
 }
 
-int rhashtable_insert_rehash(struct rhashtable *ht)
+int rhashtable_insert_rehash(struct rhashtable *ht,
+                             struct bucket_table *tbl)
 {
         struct bucket_table *old_tbl;
         struct bucket_table *new_tbl;
-        struct bucket_table *tbl;
         unsigned int size;
         int err;
 
         old_tbl = rht_dereference_rcu(ht->tbl, ht);
-        tbl = rhashtable_last_table(ht, old_tbl);
 
         size = tbl->size;
 
+        err = -EBUSY;
+
         if (rht_grow_above_75(ht, tbl))
                 size *= 2;
         /* Do not schedule more than one rehash */
         else if (old_tbl != tbl)
-                return -EBUSY;
+                goto fail;
+
+        err = -ENOMEM;
 
         new_tbl = bucket_table_alloc(ht, size, GFP_ATOMIC);
-        if (new_tbl == NULL) {
-                /* Schedule async resize/rehash to try allocation
-                 * non-atomic context.
-                 */
-                schedule_work(&ht->run_work);
-                return -ENOMEM;
-        }
+        if (new_tbl == NULL)
+                goto fail;
 
         err = rhashtable_rehash_attach(ht, tbl, new_tbl);
         if (err) {
@@ -426,12 +424,24 @@ int rhashtable_insert_rehash(struct rhashtable *ht)
                 schedule_work(&ht->run_work);
 
         return err;
+
+fail:
+        /* Do not fail the insert if someone else did a rehash. */
+        if (likely(rcu_dereference_raw(tbl->future_tbl)))
+                return 0;
+
+        /* Schedule async rehash to retry allocation in process context. */
+        if (err == -ENOMEM)
+                schedule_work(&ht->run_work);
+
+        return err;
 }
 EXPORT_SYMBOL_GPL(rhashtable_insert_rehash);
 
-int rhashtable_insert_slow(struct rhashtable *ht, const void *key,
-                           struct rhash_head *obj,
-                           struct bucket_table *tbl)
+struct bucket_table *rhashtable_insert_slow(struct rhashtable *ht,
+                                            const void *key,
+                                            struct rhash_head *obj,
+                                            struct bucket_table *tbl)
 {
         struct rhash_head *head;
         unsigned int hash;
@@ -467,7 +477,12 @@ int rhashtable_insert_slow(struct rhashtable *ht, const void *key,
 exit:
         spin_unlock(rht_bucket_lock(tbl, hash));
 
-        return err;
+        if (err == 0)
+                return NULL;
+        else if (err == -EAGAIN)
+                return tbl;
+        else
+                return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(rhashtable_insert_slow);
 
@@ -503,10 +518,10 @@ int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter)
         if (!iter->walker)
                 return -ENOMEM;
 
-        mutex_lock(&ht->mutex);
+        spin_lock(&ht->lock);
         iter->walker->tbl = rht_dereference(ht->tbl, ht);
         list_add(&iter->walker->list, &iter->walker->tbl->walkers);
-        mutex_unlock(&ht->mutex);
+        spin_unlock(&ht->lock);
 
         return 0;
 }
@@ -520,10 +535,10 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_init);
  */
 void rhashtable_walk_exit(struct rhashtable_iter *iter)
 {
-        mutex_lock(&iter->ht->mutex);
+        spin_lock(&iter->ht->lock);
         if (iter->walker->tbl)
                 list_del(&iter->walker->list);
-        mutex_unlock(&iter->ht->mutex);
+        spin_unlock(&iter->ht->lock);
         kfree(iter->walker);
 }
 EXPORT_SYMBOL_GPL(rhashtable_walk_exit);
@@ -547,14 +562,12 @@ int rhashtable_walk_start(struct rhashtable_iter *iter)
 {
         struct rhashtable *ht = iter->ht;
 
-        mutex_lock(&ht->mutex);
+        rcu_read_lock();
 
+        spin_lock(&ht->lock);
         if (iter->walker->tbl)
                 list_del(&iter->walker->list);
-
-        rcu_read_lock();
-
-        mutex_unlock(&ht->mutex);
+        spin_unlock(&ht->lock);
 
         if (!iter->walker->tbl) {
                 iter->walker->tbl = rht_dereference_rcu(ht->tbl, ht);
@@ -723,9 +736,6 @@ int rhashtable_init(struct rhashtable *ht,
         if (params->nulls_base && params->nulls_base < (1U << RHT_BASE_SHIFT))
                 return -EINVAL;
 
-        if (params->nelem_hint)
-                size = rounded_hashtable_size(params);
-
         memset(ht, 0, sizeof(*ht));
         mutex_init(&ht->mutex);
         spin_lock_init(&ht->lock);
@@ -745,6 +755,9 @@ int rhashtable_init(struct rhashtable *ht,
 
         ht->p.min_size = max(ht->p.min_size, HASH_MIN_SIZE);
 
+        if (params->nelem_hint)
+                size = rounded_hashtable_size(&ht->p);
+
         /* The maximum (not average) chain length grows with the
          * size of the hash table, at a rate of (log N)/(log log N).
          * The value of 16 is selected so that even if the hash
diff --git a/mm/zswap.c b/mm/zswap.c
index 025f8dc723de..bf14508afd64 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -541,6 +541,7 @@ static struct zswap_pool *zswap_pool_last_get(void)
         return last;
 }
 
+/* type and compressor must be null-terminated */
 static struct zswap_pool *zswap_pool_find_get(char *type, char *compressor)
 {
         struct zswap_pool *pool;
@@ -548,10 +549,9 @@ static struct zswap_pool *zswap_pool_find_get(char *type, char *compressor)
         assert_spin_locked(&zswap_pools_lock);
 
         list_for_each_entry_rcu(pool, &zswap_pools, list) {
-                if (strncmp(pool->tfm_name, compressor, sizeof(pool->tfm_name)))
+                if (strcmp(pool->tfm_name, compressor))
                         continue;
-                if (strncmp(zpool_get_type(pool->zpool), type,
-                            sizeof(zswap_zpool_type)))
+                if (strcmp(zpool_get_type(pool->zpool), type))
                         continue;
                 /* if we can't get it, it's about to be destroyed */
                 if (!zswap_pool_get(pool))
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index ae3a47f9d1d5..fbd0acf80b13 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -805,6 +805,9 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol,
         struct sock *sk;
         ax25_cb *ax25;
 
+        if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
+                return -EINVAL;
+
         if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 83bc1aaf5800..a49c705fb86b 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -566,6 +566,7 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst)
         int select;
         batadv_dat_addr_t last_max = BATADV_DAT_ADDR_MAX, ip_key;
         struct batadv_dat_candidate *res;
+        struct batadv_dat_entry dat;
 
         if (!bat_priv->orig_hash)
                 return NULL;
@@ -575,7 +576,9 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst)
         if (!res)
                 return NULL;
 
-        ip_key = (batadv_dat_addr_t)batadv_hash_dat(&ip_dst,
+        dat.ip = ip_dst;
+        dat.vid = 0;
+        ip_key = (batadv_dat_addr_t)batadv_hash_dat(&dat,
                                                     BATADV_DAT_ADDR_MAX);
 
         batadv_dbg(BATADV_DBG_DAT, bat_priv,
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 8d990b070a2e..3207667e69de 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -836,6 +836,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
         u8 *orig_addr;
         struct batadv_orig_node *orig_node = NULL;
         int check, hdr_size = sizeof(*unicast_packet);
+        enum batadv_subtype subtype;
         bool is4addr;
 
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
@@ -863,10 +864,20 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
         /* packet for me */
         if (batadv_is_my_mac(bat_priv, unicast_packet->dest)) {
                 if (is4addr) {
-                        batadv_dat_inc_counter(bat_priv,
-                                               unicast_4addr_packet->subtype);
-                        orig_addr = unicast_4addr_packet->src;
-                        orig_node = batadv_orig_hash_find(bat_priv, orig_addr);
+                        subtype = unicast_4addr_packet->subtype;
+                        batadv_dat_inc_counter(bat_priv, subtype);
+
+                        /* Only payload data should be considered for speedy
+                         * join. For example, DAT also uses unicast 4addr
+                         * types, but those packets should not be considered
+                         * for speedy join, since the clients do not actually
+                         * reside at the sending originator.
+                         */
+                        if (subtype == BATADV_P_DATA) {
+                                orig_addr = unicast_4addr_packet->src;
+                                orig_node = batadv_orig_hash_find(bat_priv,
+                                                                  orig_addr);
+                        }
                 }
 
                 if (batadv_dat_snoop_incoming_arp_request(bat_priv, skb,
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 4228b10c47ea..76f19ba62462 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -68,13 +68,15 @@ static void batadv_tt_global_del(struct batadv_priv *bat_priv,
                                  unsigned short vid, const char *message,
                                  bool roaming);
 
-/* returns 1 if they are the same mac addr */
+/* returns 1 if they are the same mac addr and vid */
 static int batadv_compare_tt(const struct hlist_node *node, const void *data2)
 {
         const void *data1 = container_of(node, struct batadv_tt_common_entry,
                                          hash_entry);
+        const struct batadv_tt_common_entry *tt1 = data1;
+        const struct batadv_tt_common_entry *tt2 = data2;
 
-        return batadv_compare_eth(data1, data2);
+        return (tt1->vid == tt2->vid) && batadv_compare_eth(data1, data2);
 }
 
 /**
@@ -1427,9 +1429,15 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
                 }
 
                 /* if the client was temporary added before receiving the first
-                 * OGM announcing it, we have to clear the TEMP flag
+                 * OGM announcing it, we have to clear the TEMP flag. Also,
+                 * remove the previous temporary orig node and re-add it
+                 * if required. If the orig entry changed, the new one which
+                 * is a non-temporary entry is preferred.
                  */
-                common->flags &= ~BATADV_TT_CLIENT_TEMP;
+                if (common->flags & BATADV_TT_CLIENT_TEMP) {
+                        batadv_tt_global_del_orig_list(tt_global_entry);
+                        common->flags &= ~BATADV_TT_CLIENT_TEMP;
+                }
 
                 /* the change can carry possible "attribute" flags like the
                  * TT_CLIENT_WIFI, therefore they have to be copied in the
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index fe129663bd3f..f52bcbf2e58c 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -526,6 +526,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
         if (!addr || addr->sa_family != AF_BLUETOOTH)
                 return -EINVAL;
 
+        if (addr_len < sizeof(struct sockaddr_sco))
+                return -EINVAL;
+
         lock_sock(sk);
 
         if (sk->sk_state != BT_OPEN) {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 152b9c70e252..b2df375ec9c2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3643,7 +3643,8 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
         serr->ee.ee_info = tstype;
         if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) {
                 serr->ee.ee_data = skb_shinfo(skb)->tskey;
-                if (sk->sk_protocol == IPPROTO_TCP)
+                if (sk->sk_protocol == IPPROTO_TCP &&
+                    sk->sk_type == SOCK_STREAM)
                         serr->ee.ee_data -= sk->sk_tskey;
         }
 
@@ -4268,7 +4269,7 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
                 return NULL;
         }
 
-        memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len,
+        memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len - VLAN_HLEN,
                 2 * ETH_ALEN);
         skb->mac_header += VLAN_HLEN;
         return skb;
diff --git a/net/core/sock.c b/net/core/sock.c
index e31dfcee1729..0d91f7dca751 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -433,8 +433,6 @@ static bool sock_needs_netstamp(const struct sock *sk)
         }
 }
 
-#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
-
 static void sock_disable_timestamp(struct sock *sk, unsigned long flags)
 {
         if (sk->sk_flags & flags) {
@@ -874,7 +872,8 @@ set_rcvbuf:
 
                 if (val & SOF_TIMESTAMPING_OPT_ID &&
                     !(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)) {
-                        if (sk->sk_protocol == IPPROTO_TCP) {
+                        if (sk->sk_protocol == IPPROTO_TCP &&
+                            sk->sk_type == SOCK_STREAM) {
                                 if (sk->sk_state != TCP_ESTABLISHED) {
                                         ret = -EINVAL;
                                         break;
@@ -1552,7 +1551,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                          */
                         is_charged = sk_filter_charge(newsk, filter);
 
-                if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk))) {
+                if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
                         /* It is still raw copy of parent, so invalidate
                          * destructor and make plain sk_free() */
                         newsk->sk_destruct = NULL;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index eebf5ac8ce18..13d6b1a6e0fc 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -678,6 +678,9 @@ static int dn_create(struct net *net, struct socket *sock, int protocol,
 {
         struct sock *sk;
 
+        if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
+                return -EINVAL;
+
         if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 11c4ca13ec3b..5c5db6636704 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -257,6 +257,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
         int try_loading_module = 0;
         int err;
 
+        if (protocol < 0 || protocol >= IPPROTO_MAX)
+                return -EINVAL;
+
         sock->state = SS_UNCONNECTED;
 
         /* Look for the requested type/protocol pair. */
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index cc8f3e506cde..473447593060 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1155,6 +1155,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
 static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct netdev_notifier_changeupper_info *info;
         struct in_device *in_dev;
         struct net *net = dev_net(dev);
         unsigned int flags;
@@ -1193,6 +1194,14 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
         case NETDEV_CHANGEMTU:
                 rt_cache_flush(net);
                 break;
+        case NETDEV_CHANGEUPPER:
+                info = ptr;
+                /* flush all routes if dev is linked to or unlinked from
+                 * an L3 master device (e.g., VRF)
+                 */
+                if (info->upper_dev && netif_is_l3_master(info->upper_dev))
+                        fib_disable_ip(dev, NETDEV_DOWN, true);
+                break;
         }
         return NOTIFY_DONE;
 }
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index e0fcbbbcfe54..bd903fe0f750 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -24,6 +24,7 @@ struct fou {
         u16 type;
         struct udp_offload udp_offloads;
         struct list_head list;
+        struct rcu_head rcu;
 };
 
 #define FOU_F_REMCSUM_NOPARTIAL BIT(0)
@@ -417,7 +418,7 @@ static void fou_release(struct fou *fou)
         list_del(&fou->list);
         udp_tunnel_sock_release(sock);
 
-        kfree(fou);
+        kfree_rcu(fou, rcu);
 }
 
 static int fou_encap_init(struct sock *sk, struct fou *fou, struct fou_cfg *cfg)
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index a35584176535..c187c60e3e0c 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -60,6 +60,7 @@ config NFT_REJECT_IPV4
 
 config NFT_DUP_IPV4
         tristate "IPv4 nf_tables packet duplication support"
+        depends on !NF_CONNTRACK || NF_CONNTRACK
         select NF_DUP_IPV4
         help
           This module enables IPv4 packet duplication support for nf_tables.
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index db003438aaf5..d8841a2f1569 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1493,7 +1493,7 @@ bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
         if (likely(sk->sk_rx_dst))
                 skb_dst_drop(skb);
         else
-                skb_dst_force(skb);
+                skb_dst_force_safe(skb);
 
         __skb_queue_tail(&tp->ucopy.prequeue, skb);
         tp->ucopy.memory += skb->truesize;
@@ -1721,8 +1721,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
 
-        if (dst) {
-                dst_hold(dst);
+        if (dst && dst_hold_safe(dst)) {
                 sk->sk_rx_dst = dst;
                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
         }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index cb7ca569052c..9bfc39ff2285 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3150,7 +3150,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_fastopen_request *fo = tp->fastopen_req;
-        int syn_loss = 0, space, err = 0, copied;
+        int syn_loss = 0, space, err = 0;
         unsigned long last_syn_loss = 0;
         struct sk_buff *syn_data;
 
@@ -3188,17 +3188,18 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
                 goto fallback;
         syn_data->ip_summed = CHECKSUM_PARTIAL;
         memcpy(syn_data->cb, syn->cb, sizeof(syn->cb));
-        copied = copy_from_iter(skb_put(syn_data, space), space,
-                                &fo->data->msg_iter);
-        if (unlikely(!copied)) {
-                kfree_skb(syn_data);
-                goto fallback;
-        }
-        if (copied != space) {
-                skb_trim(syn_data, copied);
-                space = copied;
+        if (space) {
+                int copied = copy_from_iter(skb_put(syn_data, space), space,
+                                            &fo->data->msg_iter);
+                if (unlikely(!copied)) {
+                        kfree_skb(syn_data);
+                        goto fallback;
+                }
+                if (copied != space) {
+                        skb_trim(syn_data, copied);
+                        space = copied;
+                }
         }
-
         /* No more data pending in inet_wait_for_connect() */
         if (space == fo->size)
                 fo->data = NULL;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 61f26851655c..17f8e7ea133b 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -350,6 +350,12 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
         setup_timer(&ndev->rs_timer, addrconf_rs_timer,
                     (unsigned long)ndev);
         memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
+
+        if (ndev->cnf.stable_secret.initialized)
+                ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
+        else
+                ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_EUI64;
+
         ndev->cnf.mtu6 = dev->mtu;
         ndev->cnf.sysctl = NULL;
         ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl);
@@ -2455,7 +2461,7 @@ ok:
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
                         if (in6_dev->cnf.optimistic_dad &&
                             !net->ipv6.devconf_all->forwarding && sllao)
-                                addr_flags = IFA_F_OPTIMISTIC;
+                                addr_flags |= IFA_F_OPTIMISTIC;
 #endif
 
                         /* Do not allow to create too much of autoconfigured
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 8ec0df75f1c4..9f5137cd604e 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -109,6 +109,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
         int try_loading_module = 0;
         int err;
 
+        if (protocol < 0 || protocol >= IPPROTO_MAX)
+                return -EINVAL;
+
         /* Look for the requested type/protocol pair. */
 lookup_protocol:
         err = -ESOCKTNOSUPPORT;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 3c7b9310b33f..e5ea177d34c6 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1571,13 +1571,11 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
                         return -EEXIST;
         } else {
                 t = nt;
-
-                ip6gre_tunnel_unlink(ign, t);
-                ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
-                ip6gre_tunnel_link(ign, t);
-                netdev_state_change(dev);
         }
 
+        ip6gre_tunnel_unlink(ign, t);
+        ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
+        ip6gre_tunnel_link(ign, t);
         return 0;
 }
 
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index f6a024e141e5..e10a04c9cdc7 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -49,6 +49,7 @@ config NFT_REJECT_IPV6
 
 config NFT_DUP_IPV6
         tristate "IPv6 nf_tables packet duplication support"
+        depends on !NF_CONNTRACK || NF_CONNTRACK
         select NF_DUP_IPV6
         help
           This module enables IPv6 packet duplication support for nf_tables.
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index e7aab561b7b4..6b8a8a9091fa 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -93,10 +93,9 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
 
-        if (dst) {
+        if (dst && dst_hold_safe(dst)) {
                 const struct rt6_info *rt = (const struct rt6_info *)dst;
 
-                dst_hold(dst);
                 sk->sk_rx_dst = dst;
                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index e6aa48b5395c..923abd6b3064 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1086,6 +1086,9 @@ static int irda_create(struct net *net, struct socket *sock, int protocol,
         struct sock *sk;
         struct irda_sock *self;
 
+        if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
+                return -EINVAL;
+
         if (net != &init_net)
                 return -EAFNOSUPPORT;
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index da471eef07bb..c12f348138ac 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1169,8 +1169,7 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                  * rc isn't initialized here yet, so ignore it
                  */
                 __ieee80211_vht_handle_opmode(sdata, sta,
-                                              params->opmode_notif,
-                                              band, false);
+                                              params->opmode_notif, band);
         }
 
         if (ieee80211_vif_is_mesh(&sdata->vif))
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index d832bd59236b..5322b4c71630 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1709,10 +1709,10 @@ enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta);
 void ieee80211_sta_set_rx_nss(struct sta_info *sta);
 u32 __ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
                                   struct sta_info *sta, u8 opmode,
-                                  enum ieee80211_band band, bool nss_only);
+                                  enum ieee80211_band band);
 void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
                                  struct sta_info *sta, u8 opmode,
-                                 enum ieee80211_band band, bool nss_only);
+                                 enum ieee80211_band band);
 void ieee80211_apply_vhtcap_overrides(struct ieee80211_sub_if_data *sdata,
                                       struct ieee80211_sta_vht_cap *vht_cap);
 void ieee80211_get_vht_mask_from_cap(__le16 vht_cap,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index b140cc6651f4..3aa04344942b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1379,21 +1379,26 @@ static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
          */
         if (has_80211h_pwr &&
             (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
+                new_ap_level = pwr_level_80211h;
+
+                if (sdata->ap_power_level == new_ap_level)
+                        return 0;
+
                 sdata_dbg(sdata,
                           "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
                           pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
                           sdata->u.mgd.bssid);
-                new_ap_level = pwr_level_80211h;
         } else {  /* has_cisco_pwr is always true here. */
+                new_ap_level = pwr_level_cisco;
+
+                if (sdata->ap_power_level == new_ap_level)
+                        return 0;
+
                 sdata_dbg(sdata,
                           "Limiting TX power to %d dBm as advertised by %pM\n",
                           pwr_level_cisco, sdata->u.mgd.bssid);
-                new_ap_level = pwr_level_cisco;
         }
 
-        if (sdata->ap_power_level == new_ap_level)
-                return 0;
-
         sdata->ap_power_level = new_ap_level;
         if (__ieee80211_recalc_txpower(sdata))
                 return BSS_CHANGED_TXPOWER;
@@ -3575,7 +3580,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
         if (sta && elems.opmode_notif)
                 ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
-                                            rx_status->band, true);
+                                            rx_status->band);
         mutex_unlock(&local->sta_mtx);
 
         changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 8bae5de0dc44..82af407fea7a 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2736,8 +2736,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
 
                         ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
-                                                    opmode, status->band,
-                                                    false);
+                                                    opmode, status->band);
                         goto handled;
                 }
                 default:
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 74058020b7d6..33344f5a66a8 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1641,6 +1641,29 @@ void ieee80211_stop_device(struct ieee80211_local *local)
         drv_stop(local);
 }
 
+static void ieee80211_flush_completed_scan(struct ieee80211_local *local,
+                                           bool aborted)
+{
+        /* It's possible that we don't handle the scan completion in
+         * time during suspend, so if it's still marked as completed
+         * here, queue the work and flush it to clean things up.
+         * Instead of calling the worker function directly here, we
+         * really queue it to avoid potential races with other flows
+         * scheduling the same work.
+         */
+        if (test_bit(SCAN_COMPLETED, &local->scanning)) {
+                /* If coming from reconfiguration failure, abort the scan so
+                 * we don't attempt to continue a partial HW scan - which is
+                 * possible otherwise if (e.g.) the 2.4 GHz portion was the
+                 * completed scan, and a 5 GHz portion is still pending.
+                 */
+                if (aborted)
+                        set_bit(SCAN_ABORTED, &local->scanning);
+                ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0);
+                flush_delayed_work(&local->scan_work);
+        }
+}
+
 static void ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
@@ -1660,6 +1683,8 @@ static void ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
         local->suspended = false;
         local->in_reconfig = false;
 
+        ieee80211_flush_completed_scan(local, true);
+
         /* scheduled scan clearly can't be running any more, but tell
          * cfg80211 and clear local state
          */
@@ -1698,6 +1723,27 @@ static void ieee80211_assign_chanctx(struct ieee80211_local *local,
         mutex_unlock(&local->chanctx_mtx);
 }
 
+static void ieee80211_reconfig_stations(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        /* add STAs back */
+        mutex_lock(&local->sta_mtx);
+        list_for_each_entry(sta, &local->sta_list, list) {
+                enum ieee80211_sta_state state;
+
+                if (!sta->uploaded || sta->sdata != sdata)
+                        continue;
+
+                for (state = IEEE80211_STA_NOTEXIST;
+                     state < sta->sta_state; state++)
+                        WARN_ON(drv_sta_state(local, sta->sdata, sta, state,
+                                              state + 1));
+        }
+        mutex_unlock(&local->sta_mtx);
+}
+
 int ieee80211_reconfig(struct ieee80211_local *local)
 {
         struct ieee80211_hw *hw = &local->hw;
@@ -1833,50 +1879,11 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                                 WARN_ON(drv_add_chanctx(local, ctx));
                 mutex_unlock(&local->chanctx_mtx);
 
-                list_for_each_entry(sdata, &local->interfaces, list) {
-                        if (!ieee80211_sdata_running(sdata))
-                                continue;
-                        ieee80211_assign_chanctx(local, sdata);
-                }
-
                 sdata = rtnl_dereference(local->monitor_sdata);
                 if (sdata && ieee80211_sdata_running(sdata))
                         ieee80211_assign_chanctx(local, sdata);
         }
 
-        /* add STAs back */
-        mutex_lock(&local->sta_mtx);
-        list_for_each_entry(sta, &local->sta_list, list) {
-                enum ieee80211_sta_state state;
-
-                if (!sta->uploaded)
-                        continue;
-
-                /* AP-mode stations will be added later */
-                if (sta->sdata->vif.type == NL80211_IFTYPE_AP)
-                        continue;
-
-                for (state = IEEE80211_STA_NOTEXIST;
-                     state < sta->sta_state; state++)
-                        WARN_ON(drv_sta_state(local, sta->sdata, sta, state,
-                                              state + 1));
-        }
-        mutex_unlock(&local->sta_mtx);
-
-        /* reconfigure tx conf */
-        if (hw->queues >= IEEE80211_NUM_ACS) {
-                list_for_each_entry(sdata, &local->interfaces, list) {
-                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
-                            sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-                            !ieee80211_sdata_running(sdata))
-                                continue;
-
-                        for (i = 0; i < IEEE80211_NUM_ACS; i++)
-                                drv_conf_tx(local, sdata, i,
-                                            &sdata->tx_conf[i]);
-                }
-        }
-
         /* reconfigure hardware */
         ieee80211_hw_config(local, ~0);
 
@@ -1889,6 +1896,22 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 if (!ieee80211_sdata_running(sdata))
                         continue;
 
+                ieee80211_assign_chanctx(local, sdata);
+
+                switch (sdata->vif.type) {
+                case NL80211_IFTYPE_AP_VLAN:
+                case NL80211_IFTYPE_MONITOR:
+                        break;
+                default:
+                        ieee80211_reconfig_stations(sdata);
+                        /* fall through */
+                case NL80211_IFTYPE_AP: /* AP stations are handled later */
+                        for (i = 0; i < IEEE80211_NUM_ACS; i++)
+                                drv_conf_tx(local, sdata, i,
+                                            &sdata->tx_conf[i]);
+                        break;
+                }
+
                 /* common change flags for all interface types */
                 changed = BSS_CHANGED_ERP_CTS_PROT |
                           BSS_CHANGED_ERP_PREAMBLE |
@@ -2074,17 +2097,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         mb();
         local->resuming = false;
 
-        /* It's possible that we don't handle the scan completion in
-         * time during suspend, so if it's still marked as completed
-         * here, queue the work and flush it to clean things up.
-         * Instead of calling the worker function directly here, we
-         * really queue it to avoid potential races with other flows
-         * scheduling the same work.
-         */
-        if (test_bit(SCAN_COMPLETED, &local->scanning)) {
-                ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0);
-                flush_delayed_work(&local->scan_work);
-        }
+        ieee80211_flush_completed_scan(local, false);
 
         if (local->open_count && !reconfig_due_to_wowlan)
                 drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_SUSPEND);
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index ff1c798921a6..c38b2f07a919 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -378,7 +378,7 @@ void ieee80211_sta_set_rx_nss(struct sta_info *sta)
 
 u32 __ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
                                   struct sta_info *sta, u8 opmode,
-                                  enum ieee80211_band band, bool nss_only)
+                                  enum ieee80211_band band)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
@@ -401,9 +401,6 @@ u32 __ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
                 changed |= IEEE80211_RC_NSS_CHANGED;
         }
 
-        if (nss_only)
-                return changed;
-
         switch (opmode & IEEE80211_OPMODE_NOTIF_CHANWIDTH_MASK) {
         case IEEE80211_OPMODE_NOTIF_CHANWIDTH_20MHZ:
                 sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_20;
@@ -430,13 +427,12 @@ u32 __ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
 
 void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
                                  struct sta_info *sta, u8 opmode,
-                                 enum ieee80211_band band, bool nss_only)
+                                 enum ieee80211_band band)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
 
-        u32 changed = __ieee80211_vht_handle_opmode(sdata, sta, opmode,
-                                                    band, nss_only);
+        u32 changed = __ieee80211_vht_handle_opmode(sdata, sta, opmode, band);
 
         if (changed > 0)
                 rate_control_rate_update(local, sband, sta, changed);
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index c70d750148b6..c32fc411a911 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -27,6 +27,8 @@
  */
 #define MAX_MP_SELECT_LABELS 4
 
+#define MPLS_NEIGH_TABLE_UNSPEC (NEIGH_LINK_TABLE + 1)
+
 static int zero = 0;
 static int label_limit = (1 << 20) - 1;
 
@@ -317,7 +319,13 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev,
                 }
         }
 
-        err = neigh_xmit(nh->nh_via_table, out_dev, mpls_nh_via(rt, nh), skb);
+        /* If via wasn't specified then send out using device address */
+        if (nh->nh_via_table == MPLS_NEIGH_TABLE_UNSPEC)
+                err = neigh_xmit(NEIGH_LINK_TABLE, out_dev,
+                                 out_dev->dev_addr, skb);
+        else
+                err = neigh_xmit(nh->nh_via_table, out_dev,
+                                 mpls_nh_via(rt, nh), skb);
         if (err)
                 net_dbg_ratelimited("%s: packet transmission failed: %d\n",
                                     __func__, err);
@@ -534,6 +542,10 @@ static int mpls_nh_assign_dev(struct net *net, struct mpls_route *rt,
         if (!mpls_dev_get(dev))
                 goto errout;
 
+        if ((nh->nh_via_table == NEIGH_LINK_TABLE) &&
+            (dev->addr_len != nh->nh_via_alen))
+                goto errout;
+
         RCU_INIT_POINTER(nh->nh_dev, dev);
 
         return 0;
@@ -592,10 +604,14 @@ static int mpls_nh_build(struct net *net, struct mpls_route *rt,
                         goto errout;
         }
 
-        err = nla_get_via(via, &nh->nh_via_alen, &nh->nh_via_table,
-                          __mpls_nh_via(rt, nh));
-        if (err)
-                goto errout;
+        if (via) {
+                err = nla_get_via(via, &nh->nh_via_alen, &nh->nh_via_table,
+                                  __mpls_nh_via(rt, nh));
+                if (err)
+                        goto errout;
+        } else {
+                nh->nh_via_table = MPLS_NEIGH_TABLE_UNSPEC;
+        }
 
         err = mpls_nh_assign_dev(net, rt, nh, oif);
         if (err)
@@ -677,9 +693,6 @@ static int mpls_nh_build_multi(struct mpls_route_config *cfg,
                         nla_newdst = nla_find(attrs, attrlen, RTA_NEWDST);
                 }
 
-                if (!nla_via)
-                        goto errout;
-
                 err = mpls_nh_build(cfg->rc_nlinfo.nl_net, rt, nh,
                                     rtnh->rtnh_ifindex, nla_via,
                                     nla_newdst);
@@ -1118,6 +1131,7 @@ static int rtm_to_route_config(struct sk_buff *skb,  struct nlmsghdr *nlh,
 
         cfg->rc_label           = LABEL_NOT_SPECIFIED;
         cfg->rc_protocol        = rtm->rtm_protocol;
+        cfg->rc_via_table       = MPLS_NEIGH_TABLE_UNSPEC;
         cfg->rc_nlflags         = nlh->nlmsg_flags;
         cfg->rc_nlinfo.portid   = NETLINK_CB(skb).portid;
         cfg->rc_nlinfo.nlh      = nlh;
@@ -1231,7 +1245,8 @@ static int mpls_dump_route(struct sk_buff *skb, u32 portid, u32 seq, int event,
                     nla_put_labels(skb, RTA_NEWDST, nh->nh_labels,
                                    nh->nh_label))
                         goto nla_put_failure;
-                if (nla_put_via(skb, nh->nh_via_table, mpls_nh_via(rt, nh),
+                if (nh->nh_via_table != MPLS_NEIGH_TABLE_UNSPEC &&
+                    nla_put_via(skb, nh->nh_via_table, mpls_nh_via(rt, nh),
                                 nh->nh_via_alen))
                         goto nla_put_failure;
                 dev = rtnl_dereference(nh->nh_dev);
@@ -1257,7 +1272,8 @@ static int mpls_dump_route(struct sk_buff *skb, u32 portid, u32 seq, int event,
                                                             nh->nh_labels,
                                                             nh->nh_label))
                                 goto nla_put_failure;
-                        if (nla_put_via(skb, nh->nh_via_table,
+                        if (nh->nh_via_table != MPLS_NEIGH_TABLE_UNSPEC &&
+                            nla_put_via(skb, nh->nh_via_table,
                                         mpls_nh_via(rt, nh),
                                         nh->nh_via_alen))
                                 goto nla_put_failure;
@@ -1319,7 +1335,8 @@ static inline size_t lfib_nlmsg_size(struct mpls_route *rt)
 
                 if (nh->nh_dev)
                         payload += nla_total_size(4); /* RTA_OIF */
-                payload += nla_total_size(2 + nh->nh_via_alen); /* RTA_VIA */
+                if (nh->nh_via_table != MPLS_NEIGH_TABLE_UNSPEC) /* RTA_VIA */
+                        payload += nla_total_size(2 + nh->nh_via_alen);
                 if (nh->nh_labels) /* RTA_NEWDST */
                         payload += nla_total_size(nh->nh_labels * 4);
         } else {
@@ -1328,7 +1345,9 @@ static inline size_t lfib_nlmsg_size(struct mpls_route *rt)
 
                 for_nexthops(rt) {
                         nhsize += nla_total_size(sizeof(struct rtnexthop));
-                        nhsize += nla_total_size(2 + nh->nh_via_alen);
+                        /* RTA_VIA */
+                        if (nh->nh_via_table != MPLS_NEIGH_TABLE_UNSPEC)
+                                nhsize += nla_total_size(2 + nh->nh_via_alen);
                         if (nh->nh_labels)
                                 nhsize += nla_total_size(nh->nh_labels * 4);
                 } endfor_nexthops(rt);
diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
index 67591aef9cae..64afd3d0b144 100644
--- a/net/mpls/mpls_iptunnel.c
+++ b/net/mpls/mpls_iptunnel.c
@@ -54,10 +54,10 @@ int mpls_output(struct net *net, struct sock *sk, struct sk_buff *skb)
         unsigned int ttl;
 
         /* Obtain the ttl */
-        if (skb->protocol == htons(ETH_P_IP)) {
+        if (dst->ops->family == AF_INET) {
                 ttl = ip_hdr(skb)->ttl;
                 rt = (struct rtable *)dst;
-        } else if (skb->protocol == htons(ETH_P_IPV6)) {
+        } else if (dst->ops->family == AF_INET6) {
                 ttl = ipv6_hdr(skb)->hop_limit;
                 rt6 = (struct rt6_info *)dst;
         } else {
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 93cc4737018f..2cb429d34c03 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -89,6 +89,7 @@ nf_tables_afinfo_lookup(struct net *net, int family, bool autoload)
 }
 
 static void nft_ctx_init(struct nft_ctx *ctx,
+                         struct net *net,
                          const struct sk_buff *skb,
                          const struct nlmsghdr *nlh,
                          struct nft_af_info *afi,
@@ -96,7 +97,7 @@ static void nft_ctx_init(struct nft_ctx *ctx,
                          struct nft_chain *chain,
                          const struct nlattr * const *nla)
 {
-        ctx->net        = sock_net(skb->sk);
+        ctx->net        = net;
         ctx->afi        = afi;
         ctx->table      = table;
         ctx->chain      = chain;
@@ -672,15 +673,14 @@ err:
         return ret;
 }
 
-static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb,
-                              const struct nlmsghdr *nlh,
+static int nf_tables_newtable(struct net *net, struct sock *nlsk,
+                              struct sk_buff *skb, const struct nlmsghdr *nlh,
                               const struct nlattr * const nla[])
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         const struct nlattr *name;
         struct nft_af_info *afi;
         struct nft_table *table;
-        struct net *net = sock_net(skb->sk);
         int family = nfmsg->nfgen_family;
         u32 flags = 0;
         struct nft_ctx ctx;
@@ -706,7 +706,7 @@ static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb,
                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
                         return -EOPNOTSUPP;
 
-                nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
+                nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
                 return nf_tables_updtable(&ctx);
         }
 
@@ -730,7 +730,7 @@ static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb,
         INIT_LIST_HEAD(&table->sets);
         table->flags = flags;
 
-        nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
+        nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
         err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
         if (err < 0)
                 goto err3;
@@ -810,18 +810,17 @@ out:
         return err;
 }
 
-static int nf_tables_deltable(struct sock *nlsk, struct sk_buff *skb,
-                              const struct nlmsghdr *nlh,
+static int nf_tables_deltable(struct net *net, struct sock *nlsk,
+                              struct sk_buff *skb, const struct nlmsghdr *nlh,
                               const struct nlattr * const nla[])
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         struct nft_af_info *afi;
         struct nft_table *table;
-        struct net *net = sock_net(skb->sk);
         int family = nfmsg->nfgen_family;
         struct nft_ctx ctx;
 
-        nft_ctx_init(&ctx, skb, nlh, NULL, NULL, NULL, nla);
+        nft_ctx_init(&ctx, net, skb, nlh, NULL, NULL, NULL, nla);
         if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
                 return nft_flush(&ctx, family);
 
@@ -1221,8 +1220,8 @@ static void nf_tables_chain_destroy(struct nft_chain *chain)
         }
 }
 
-static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
-                              const struct nlmsghdr *nlh,
+static int nf_tables_newchain(struct net *net, struct sock *nlsk,
+                              struct sk_buff *skb, const struct nlmsghdr *nlh,
                               const struct nlattr * const nla[])
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
@@ -1232,7 +1231,6 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
         struct nft_chain *chain;
         struct nft_base_chain *basechain = NULL;
         struct nlattr *ha[NFTA_HOOK_MAX + 1];
-        struct net *net = sock_net(skb->sk);
         int family = nfmsg->nfgen_family;
         struct net_device *dev = NULL;
         u8 policy = NF_ACCEPT;
@@ -1313,7 +1311,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
                                 return PTR_ERR(stats);
                 }
 
-                nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
+                nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
                 trans = nft_trans_alloc(&ctx, NFT_MSG_NEWCHAIN,
                                         sizeof(struct nft_trans_chain));
                 if (trans == NULL) {
@@ -1461,7 +1459,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
         if (err < 0)
                 goto err1;
 
-        nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
+        nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
         err = nft_trans_chain_add(&ctx, NFT_MSG_NEWCHAIN);
         if (err < 0)
                 goto err2;
@@ -1476,15 +1474,14 @@ err1:
         return err;
 }
 
-static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
-                              const struct nlmsghdr *nlh,
+static int nf_tables_delchain(struct net *net, struct sock *nlsk,
+                              struct sk_buff *skb, const struct nlmsghdr *nlh,
                               const struct nlattr * const nla[])
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         struct nft_af_info *afi;
         struct nft_table *table;
         struct nft_chain *chain;
-        struct net *net = sock_net(skb->sk);
         int family = nfmsg->nfgen_family;
         struct nft_ctx ctx;
 
@@ -1506,7 +1503,7 @@ static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
         if (chain->use > 0)
                 return -EBUSY;
 
-        nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
+        nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
 
         return nft_delchain(&ctx);
 }
@@ -2010,13 +2007,12 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
 
 static struct nft_expr_info *info;
 
-static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
-                             const struct nlmsghdr *nlh,
+static int nf_tables_newrule(struct net *net, struct sock *nlsk,
+                             struct sk_buff *skb, const struct nlmsghdr *nlh,
                              const struct nlattr * const nla[])
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         struct nft_af_info *afi;
-        struct net *net = sock_net(skb->sk);
         struct nft_table *table;
         struct nft_chain *chain;
         struct nft_rule *rule, *old_rule = NULL;
@@ -2075,7 +2071,7 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
                         return PTR_ERR(old_rule);
         }
 
-        nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
+        nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
 
         n = 0;
         size = 0;
@@ -2176,13 +2172,12 @@ err1:
         return err;
 }
 
-static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
-                             const struct nlmsghdr *nlh,
+static int nf_tables_delrule(struct net *net, struct sock *nlsk,
+                             struct sk_buff *skb, const struct nlmsghdr *nlh,
                              const struct nlattr * const nla[])
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         struct nft_af_info *afi;
-        struct net *net = sock_net(skb->sk);
         struct nft_table *table;
         struct nft_chain *chain = NULL;
         struct nft_rule *rule;
@@ -2205,7 +2200,7 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
                         return PTR_ERR(chain);
         }
 
-        nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
+        nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
 
         if (chain) {
                 if (nla[NFTA_RULE_HANDLE]) {
@@ -2344,12 +2339,11 @@ static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
         [NFTA_SET_DESC_SIZE]            = { .type = NLA_U32 },
 };
 
-static int nft_ctx_init_from_setattr(struct nft_ctx *ctx,
+static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
                                      const struct sk_buff *skb,
                                      const struct nlmsghdr *nlh,
                                      const struct nlattr * const nla[])
 {
-        struct net *net = sock_net(skb->sk);
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         struct nft_af_info *afi = NULL;
         struct nft_table *table = NULL;
@@ -2371,7 +2365,7 @@ static int nft_ctx_init_from_setattr(struct nft_ctx *ctx,
                         return -ENOENT;
         }
 
-        nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla);
+        nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
         return 0;
 }
 
@@ -2623,6 +2617,7 @@ static int nf_tables_getset(struct sock *nlsk, struct sk_buff *skb,
                             const struct nlmsghdr *nlh,
                             const struct nlattr * const nla[])
 {
+        struct net *net = sock_net(skb->sk);
         const struct nft_set *set;
         struct nft_ctx ctx;
         struct sk_buff *skb2;
@@ -2630,7 +2625,7 @@ static int nf_tables_getset(struct sock *nlsk, struct sk_buff *skb,
         int err;
 
         /* Verify existence before starting dump */
-        err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla);
+        err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla);
         if (err < 0)
                 return err;
 
@@ -2693,14 +2688,13 @@ static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
         return 0;
 }
 
-static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
-                            const struct nlmsghdr *nlh,
+static int nf_tables_newset(struct net *net, struct sock *nlsk,
+                            struct sk_buff *skb, const struct nlmsghdr *nlh,
                             const struct nlattr * const nla[])
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         const struct nft_set_ops *ops;
         struct nft_af_info *afi;
-        struct net *net = sock_net(skb->sk);
         struct nft_table *table;
         struct nft_set *set;
         struct nft_ctx ctx;
@@ -2798,7 +2792,7 @@ static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
         if (IS_ERR(table))
                 return PTR_ERR(table);
 
-        nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
+        nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
 
         set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME]);
         if (IS_ERR(set)) {
@@ -2882,8 +2876,8 @@ static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set
         nft_set_destroy(set);
 }
 
-static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb,
-                            const struct nlmsghdr *nlh,
+static int nf_tables_delset(struct net *net, struct sock *nlsk,
+                            struct sk_buff *skb, const struct nlmsghdr *nlh,
                             const struct nlattr * const nla[])
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
@@ -2896,7 +2890,7 @@ static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb,
         if (nla[NFTA_SET_TABLE] == NULL)
                 return -EINVAL;
 
-        err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla);
+        err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla);
         if (err < 0)
                 return err;
 
@@ -3024,7 +3018,7 @@ static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX +
         [NFTA_SET_ELEM_LIST_SET_ID]     = { .type = NLA_U32 },
 };
 
-static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx,
+static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
                                       const struct sk_buff *skb,
                                       const struct nlmsghdr *nlh,
                                       const struct nlattr * const nla[],
@@ -3033,7 +3027,6 @@ static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx,
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         struct nft_af_info *afi;
         struct nft_table *table;
-        struct net *net = sock_net(skb->sk);
 
         afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
         if (IS_ERR(afi))
@@ -3045,7 +3038,7 @@ static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx,
         if (!trans && (table->flags & NFT_TABLE_INACTIVE))
                 return -ENOENT;
 
-        nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla);
+        nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
         return 0;
 }
 
@@ -3135,6 +3128,7 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
 
 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct net *net = sock_net(skb->sk);
         const struct nft_set *set;
         struct nft_set_dump_args args;
         struct nft_ctx ctx;
@@ -3150,8 +3144,8 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
         if (err < 0)
                 return err;
 
-        err = nft_ctx_init_from_elemattr(&ctx, cb->skb, cb->nlh, (void *)nla,
-                                         false);
+        err = nft_ctx_init_from_elemattr(&ctx, net, cb->skb, cb->nlh,
+                                         (void *)nla, false);
         if (err < 0)
                 return err;
 
@@ -3212,11 +3206,12 @@ static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb,
                                 const struct nlmsghdr *nlh,
                                 const struct nlattr * const nla[])
 {
+        struct net *net = sock_net(skb->sk);
         const struct nft_set *set;
         struct nft_ctx ctx;
         int err;
 
-        err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, false);
+        err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, false);
         if (err < 0)
                 return err;
 
@@ -3528,11 +3523,10 @@ err1:
         return err;
 }
 
-static int nf_tables_newsetelem(struct sock *nlsk, struct sk_buff *skb,
-                                const struct nlmsghdr *nlh,
+static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
+                                struct sk_buff *skb, const struct nlmsghdr *nlh,
                                 const struct nlattr * const nla[])
 {
-        struct net *net = sock_net(skb->sk);
         const struct nlattr *attr;
         struct nft_set *set;
         struct nft_ctx ctx;
@@ -3541,7 +3535,7 @@ static int nf_tables_newsetelem(struct sock *nlsk, struct sk_buff *skb,
         if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
                 return -EINVAL;
 
-        err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, true);
+        err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, true);
         if (err < 0)
                 return err;
 
@@ -3623,8 +3617,8 @@ err1:
         return err;
 }
 
-static int nf_tables_delsetelem(struct sock *nlsk, struct sk_buff *skb,
-                                const struct nlmsghdr *nlh,
+static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
+                                struct sk_buff *skb, const struct nlmsghdr *nlh,
                                 const struct nlattr * const nla[])
 {
         const struct nlattr *attr;
@@ -3635,7 +3629,7 @@ static int nf_tables_delsetelem(struct sock *nlsk, struct sk_buff *skb,
         if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
                 return -EINVAL;
 
-        err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, false);
+        err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, false);
         if (err < 0)
                 return err;
 
@@ -4030,7 +4024,8 @@ static int nf_tables_abort(struct sk_buff *skb)
         struct nft_trans *trans, *next;
         struct nft_trans_elem *te;
 
-        list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
+        list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
+                                         list) {
                 switch (trans->msg_type) {
                 case NFT_MSG_NEWTABLE:
                         if (nft_trans_table_update(trans)) {
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 46453ab318db..77afe913d03d 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -295,8 +295,6 @@ replay:
         if (!skb)
                 return netlink_ack(oskb, nlh, -ENOMEM);
 
-        skb->sk = oskb->sk;
-
         nfnl_lock(subsys_id);
         ss = rcu_dereference_protected(table[subsys_id].subsys,
                                        lockdep_is_held(&table[subsys_id].mutex));
@@ -381,7 +379,7 @@ replay:
                                 goto ack;
 
                         if (nc->call_batch) {
-                                err = nc->call_batch(net->nfnl, skb, nlh,
+                                err = nc->call_batch(net, net->nfnl, skb, nlh,
                                                      (const struct nlattr **)cda);
                         }
 
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 7d81d280cb4f..861c6615253b 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -365,8 +365,9 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
                 break;
         }
 
+        nfnl_ct = rcu_dereference(nfnl_ct_hook);
+
         if (queue->flags & NFQA_CFG_F_CONNTRACK) {
-                nfnl_ct = rcu_dereference(nfnl_ct_hook);
                 if (nfnl_ct != NULL) {
                         ct = nfnl_ct->get_ct(entskb, &ctinfo);
                         if (ct != NULL)
@@ -1064,9 +1065,10 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
         if (entry == NULL)
                 return -ENOENT;
 
+        /* rcu lock already held from nfnl->call_rcu. */
+        nfnl_ct = rcu_dereference(nfnl_ct_hook);
+
         if (nfqa[NFQA_CT]) {
-                /* rcu lock already held from nfnl->call_rcu. */
-                nfnl_ct = rcu_dereference(nfnl_ct_hook);
                 if (nfnl_ct != NULL)
                         ct = nfqnl_ct_parse(nfnl_ct, nlh, nfqa, entry, &ctinfo);
         }
@@ -1417,6 +1419,7 @@ static int __init nfnetlink_queue_init(void)
 
 cleanup_netlink_notifier:
         netlink_unregister_notifier(&nfqnl_rtnl_notifier);
+        unregister_pernet_subsys(&nfnl_queue_net_ops);
 out:
         return status;
 }
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index c2cc11168fd5..3e8892216f94 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -53,6 +53,8 @@ struct ovs_conntrack_info {
         struct md_labels labels;
 };
 
+static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
+
 static u16 key_to_nfproto(const struct sw_flow_key *key)
 {
         switch (ntohs(key->eth.type)) {
@@ -141,6 +143,7 @@ static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
  * previously sent the packet to conntrack via the ct action.
  */
 static void ovs_ct_update_key(const struct sk_buff *skb,
+                              const struct ovs_conntrack_info *info,
                               struct sw_flow_key *key, bool post_ct)
 {
         const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
@@ -158,13 +161,15 @@ static void ovs_ct_update_key(const struct sk_buff *skb,
                 zone = nf_ct_zone(ct);
         } else if (post_ct) {
                 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
+                if (info)
+                        zone = &info->zone;
         }
         __ovs_ct_update_key(key, state, zone, ct);
 }
 
 void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
 {
-        ovs_ct_update_key(skb, key, false);
+        ovs_ct_update_key(skb, NULL, key, false);
 }
 
 int ovs_ct_put_key(const struct sw_flow_key *key, struct sk_buff *skb)
@@ -418,7 +423,7 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
                 }
         }
 
-        ovs_ct_update_key(skb, key, true);
+        ovs_ct_update_key(skb, info, key, true);
 
         return 0;
 }
@@ -708,7 +713,7 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
         nf_conntrack_get(&ct_info.ct->ct_general);
         return 0;
 err_free_ct:
-        nf_conntrack_free(ct_info.ct);
+        __ovs_ct_free_action(&ct_info);
         return err;
 }
 
@@ -750,6 +755,11 @@ void ovs_ct_free_action(const struct nlattr *a)
 {
         struct ovs_conntrack_info *ct_info = nla_data(a);
 
+        __ovs_ct_free_action(ct_info);
+}
+
+static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
+{
         if (ct_info->helper)
                 module_put(ct_info->helper->me);
         if (ct_info->ct)
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index b41e9ea2ffff..f53bf3b6558b 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -49,7 +49,6 @@
 struct rfkill {
         spinlock_t              lock;
 
-        const char              *name;
         enum rfkill_type        type;
 
         unsigned long           state;
@@ -73,6 +72,7 @@ struct rfkill {
         struct delayed_work     poll_work;
         struct work_struct      uevent_work;
         struct work_struct      sync_work;
+        char                    name[];
 };
 #define to_rfkill(d)    container_of(d, struct rfkill, dev)
 
@@ -876,14 +876,14 @@ struct rfkill * __must_check rfkill_alloc(const char *name,
         if (WARN_ON(type == RFKILL_TYPE_ALL || type >= NUM_RFKILL_TYPES))
                 return NULL;
 
-        rfkill = kzalloc(sizeof(*rfkill), GFP_KERNEL);
+        rfkill = kzalloc(sizeof(*rfkill) + strlen(name) + 1, GFP_KERNEL);
         if (!rfkill)
                 return NULL;
 
         spin_lock_init(&rfkill->lock);
         INIT_LIST_HEAD(&rfkill->node);
         rfkill->type = type;
-        rfkill->name = name;
+        strcpy(rfkill->name, name);
         rfkill->ops = ops;
         rfkill->data = ops_data;
 
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 7ec667dd4ce1..b5c2cf2aa6d4 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -950,7 +950,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
                 }
                 lockdep_set_class(qdisc_lock(sch), &qdisc_tx_lock);
                 if (!netif_is_multiqueue(dev))
-                        sch->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
+                        sch->flags |= TCQ_F_ONETXQUEUE;
         }
 
         sch->handle = handle;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index acb45b8c2a9d..ec529121f38a 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -323,14 +323,13 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
                         }
                 }
         }
-        rcu_read_unlock();
-
         if (baddr) {
                 fl6->saddr = baddr->v6.sin6_addr;
                 fl6->fl6_sport = baddr->v6.sin6_port;
                 final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);
                 dst = ip6_dst_lookup_flow(sk, fl6, final_p);
         }
+        rcu_read_unlock();
 
 out:
         if (!IS_ERR_OR_NULL(dst)) {
@@ -642,6 +641,7 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
         struct sock *newsk;
         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
         struct sctp6_sock *newsctp6sk;
+        struct ipv6_txoptions *opt;
 
         newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot, 0);
         if (!newsk)
@@ -661,6 +661,13 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
 
         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 
+        rcu_read_lock();
+        opt = rcu_dereference(np->opt);
+        if (opt)
+                opt = ipv6_dup_options(newsk, opt);
+        RCU_INIT_POINTER(newnp->opt, opt);
+        rcu_read_unlock();
+
         /* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname()
          * and getpeername().
          */
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 7e8f0a117106..c0380cfb16ae 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -324,6 +324,7 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
                                  sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type)) :
                                  "illegal chunk");
 
+                        sctp_chunk_hold(chunk);
                         sctp_outq_tail_data(q, chunk);
                         if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
                                 SCTP_INC_STATS(net, SCTP_MIB_OUTUNORDERCHUNKS);
@@ -1251,6 +1252,7 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_chunk *chunk)
          */
 
         sack_a_rwnd = ntohl(sack->a_rwnd);
+        asoc->peer.zero_window_announced = !sack_a_rwnd;
         outstanding = q->outstanding_bytes;
 
         if (outstanding < sack_a_rwnd)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 763e06a55155..5d6a03fad378 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1652,7 +1652,7 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
 
         /* Set an expiration time for the cookie.  */
         cookie->c.expiration = ktime_add(asoc->cookie_life,
-                                         ktime_get());
+                                         ktime_get_real());
 
         /* Copy the peer's init packet.  */
         memcpy(&cookie->c.peer_init[0], init_chunk->chunk_hdr,
@@ -1780,7 +1780,7 @@ no_hmac:
         if (sock_flag(ep->base.sk, SOCK_TIMESTAMP))
                 kt = skb_get_ktime(skb);
         else
-                kt = ktime_get();
+                kt = ktime_get_real();
 
         if (!asoc && ktime_before(bear_cookie->expiration, kt)) {
                 /*
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 6f46aa16cb76..cd34a4a34065 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -5412,7 +5412,8 @@ sctp_disposition_t sctp_sf_do_6_3_3_rtx(struct net *net,
         SCTP_INC_STATS(net, SCTP_MIB_T3_RTX_EXPIREDS);
 
         if (asoc->overall_error_count >= asoc->max_retrans) {
-                if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
+                if (asoc->peer.zero_window_announced &&
+                    asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
                         /*
                          * We are here likely because the receiver had its rwnd
                          * closed for a while and we have not been able to
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 03c8256063ec..9b6cc6de80d8 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1952,8 +1952,6 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
 
         /* Now send the (possibly) fragmented message. */
         list_for_each_entry(chunk, &datamsg->chunks, frag_list) {
-                sctp_chunk_hold(chunk);
-
                 /* Do accounting for the write space.  */
                 sctp_set_owner_w(chunk);
 
@@ -1966,15 +1964,13 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
          * breaks.
          */
         err = sctp_primitive_SEND(net, asoc, datamsg);
+        sctp_datamsg_put(datamsg);
         /* Did the lower layer accept the chunk? */
-        if (err) {
-                sctp_datamsg_free(datamsg);
+        if (err)
                 goto out_free;
-        }
 
         pr_debug("%s: we sent primitively\n", __func__);
 
-        sctp_datamsg_put(datamsg);
         err = msg_len;
 
         if (unlikely(wait_connect)) {
@@ -7167,6 +7163,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
         newsk->sk_type = sk->sk_type;
         newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
         newsk->sk_flags = sk->sk_flags;
+        newsk->sk_tsflags = sk->sk_tsflags;
         newsk->sk_no_check_tx = sk->sk_no_check_tx;
         newsk->sk_no_check_rx = sk->sk_no_check_rx;
         newsk->sk_reuse = sk->sk_reuse;
@@ -7199,6 +7196,9 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
         newinet->mc_ttl = 1;
         newinet->mc_index = 0;
         newinet->mc_list = NULL;
+
+        if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
+                net_enable_timestamp();
 }
 
 static inline void sctp_copy_descendant(struct sock *sk_to,
diff --git a/net/socket.c b/net/socket.c
index 456fadb3d819..29822d6dd91e 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1695,6 +1695,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
         msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
         /* We assume all kernel code knows the size of sockaddr_storage */
         msg.msg_namelen = 0;
+        msg.msg_iocb = NULL;
         if (sock->file->f_flags & O_NONBLOCK)
                 flags |= MSG_DONTWAIT;
         err = sock_recvmsg(sock, &msg, iov_iter_count(&msg.msg_iter), flags);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 45aebd966978..a4631477cedf 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2256,14 +2256,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state)
         /* Lock the socket to prevent queue disordering
          * while sleeps in memcpy_tomsg
          */
-        err = mutex_lock_interruptible(&u->readlock);
-        if (unlikely(err)) {
-                /* recvmsg() in non blocking mode is supposed to return -EAGAIN
-                 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
-                 */
-                err = noblock ? -EAGAIN : -ERESTARTSYS;
-                goto out;
-        }
+        mutex_lock(&u->readlock);
 
         if (flags & MSG_PEEK)
                 skip = sk_peek_offset(sk, flags);
@@ -2307,12 +2300,12 @@ again:
                         timeo = unix_stream_data_wait(sk, timeo, last,
                                                       last_len);
 
-                        if (signal_pending(current) ||
-                            mutex_lock_interruptible(&u->readlock)) {
+                        if (signal_pending(current)) {
                                 err = sock_intr_errno(timeo);
                                 goto out;
                         }
 
+                        mutex_lock(&u->readlock);
                         continue;
 unlock:
                         unix_state_unlock(sk);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index c71e274c810a..75b0d23ee882 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7941,8 +7941,10 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
                 if (!(rdev->wiphy.features &
                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
-                    !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
+                    !(rdev->wiphy.features & NL80211_FEATURE_QUIET)) {
+                        kzfree(connkeys);
                         return -EINVAL;
+                }
                 connect.flags |= ASSOC_REQ_USE_RRM;
         }
 
@@ -9503,6 +9505,7 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
         if (new_triggers.tcp && new_triggers.tcp->sock)
                 sock_release(new_triggers.tcp->sock);
         kfree(new_triggers.tcp);
+        kfree(new_triggers.nd_config);
         return err;
 }
 #endif
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2e8d6f39ed56..06d050da0d94 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -3029,6 +3029,7 @@ int set_regdom(const struct ieee80211_regdomain *rd,
                 break;
         default:
                 WARN(1, "invalid initiator %d\n", lr->initiator);
+                kfree(rd);
                 return -EINVAL;
         }
 
@@ -3221,8 +3222,10 @@ int __init regulatory_init(void)
         /* We always try to get an update for the static regdomain */
         err = regulatory_hint_core(cfg80211_world_regdom->alpha2);
         if (err) {
-                if (err == -ENOMEM)
+                if (err == -ENOMEM) {
+                        platform_device_unregister(reg_pdev);
                         return err;
+                }
                 /*
                  * N.B. kobject_uevent_env() can fail mainly for when we're out
                  * memory which is handled and propagated appropriately above
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 09bfcbac63bb..948fa5560de5 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -303,6 +303,14 @@ struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp)
 }
 EXPORT_SYMBOL(xfrm_policy_alloc);
 
+static void xfrm_policy_destroy_rcu(struct rcu_head *head)
+{
+        struct xfrm_policy *policy = container_of(head, struct xfrm_policy, rcu);
+
+        security_xfrm_policy_free(policy->security);
+        kfree(policy);
+}
+
 /* Destroy xfrm_policy: descendant resources must be released to this moment. */
 
 void xfrm_policy_destroy(struct xfrm_policy *policy)
@@ -312,8 +320,7 @@ void xfrm_policy_destroy(struct xfrm_policy *policy)
         if (del_timer(&policy->timer) || del_timer(&policy->polq.hold_timer))
                 BUG();
 
-        security_xfrm_policy_free(policy->security);
-        kfree(policy);
+        call_rcu(&policy->rcu, xfrm_policy_destroy_rcu);
 }
 EXPORT_SYMBOL(xfrm_policy_destroy);
 
@@ -1214,8 +1221,10 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
         struct xfrm_policy *pol;
         struct net *net = sock_net(sk);
 
+        rcu_read_lock();
         read_lock_bh(&net->xfrm.xfrm_policy_lock);
-        if ((pol = sk->sk_policy[dir]) != NULL) {
+        pol = rcu_dereference(sk->sk_policy[dir]);
+        if (pol != NULL) {
                 bool match = xfrm_selector_match(&pol->selector, fl,
                                                  sk->sk_family);
                 int err = 0;
@@ -1239,6 +1248,7 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
         }
 out:
         read_unlock_bh(&net->xfrm.xfrm_policy_lock);
+        rcu_read_unlock();
         return pol;
 }
 
@@ -1307,13 +1317,14 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
 #endif
 
         write_lock_bh(&net->xfrm.xfrm_policy_lock);
-        old_pol = sk->sk_policy[dir];
-        sk->sk_policy[dir] = pol;
+        old_pol = rcu_dereference_protected(sk->sk_policy[dir],
+                                lockdep_is_held(&net->xfrm.xfrm_policy_lock));
         if (pol) {
                 pol->curlft.add_time = get_seconds();
                 pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir, 0);
                 xfrm_sk_policy_link(pol, dir);
         }
+        rcu_assign_pointer(sk->sk_policy[dir], pol);
         if (old_pol) {
                 if (pol)
                         xfrm_policy_requeue(old_pol, pol);
@@ -1361,17 +1372,26 @@ static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir)
         return newp;
 }
 
-int __xfrm_sk_clone_policy(struct sock *sk)
+int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
 {
-        struct xfrm_policy *p0 = sk->sk_policy[0],
-                           *p1 = sk->sk_policy[1];
+        const struct xfrm_policy *p;
+        struct xfrm_policy *np;
+        int i, ret = 0;
 
-        sk->sk_policy[0] = sk->sk_policy[1] = NULL;
-        if (p0 && (sk->sk_policy[0] = clone_policy(p0, 0)) == NULL)
-                return -ENOMEM;
-        if (p1 && (sk->sk_policy[1] = clone_policy(p1, 1)) == NULL)
-                return -ENOMEM;
-        return 0;
+        rcu_read_lock();
+        for (i = 0; i < 2; i++) {
+                p = rcu_dereference(osk->sk_policy[i]);
+                if (p) {
+                        np = clone_policy(p, i);
+                        if (unlikely(!np)) {
+                                ret = -ENOMEM;
+                                break;
+                        }
+                        rcu_assign_pointer(sk->sk_policy[i], np);
+                }
+        }
+        rcu_read_unlock();
+        return ret;
 }
 
 static int
@@ -2198,6 +2218,7 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
         xdst = NULL;
         route = NULL;
 
+        sk = sk_const_to_full_sk(sk);
         if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
                 num_pols = 1;
                 pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
@@ -2477,6 +2498,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
         }
 
         pol = NULL;
+        sk = sk_to_full_sk(sk);
         if (sk && sk->sk_policy[dir]) {
                 pol = xfrm_sk_policy_lookup(sk, dir, &fl);
                 if (IS_ERR(pol)) {
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 8dd2ac13b3af..6c268dad143f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -111,6 +111,7 @@ struct alc_spec {
         void (*power_hook)(struct hda_codec *codec);
 #endif
         void (*shutup)(struct hda_codec *codec);
+        void (*reboot_notify)(struct hda_codec *codec);
 
         int init_amp;
         int codec_variant;      /* flag for other variants */
@@ -773,6 +774,25 @@ static inline void alc_shutup(struct hda_codec *codec)
                 snd_hda_shutup_pins(codec);
 }
 
+static void alc_reboot_notify(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+
+        if (spec && spec->reboot_notify)
+                spec->reboot_notify(codec);
+        else
+                alc_shutup(codec);
+}
+
+/* power down codec to D3 at reboot/shutdown; set as reboot_notify ops */
+static void alc_d3_at_reboot(struct hda_codec *codec)
+{
+        snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
+        snd_hda_codec_write(codec, codec->core.afg, 0,
+                            AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
+        msleep(10);
+}
+
 #define alc_free        snd_hda_gen_free
 
 #ifdef CONFIG_PM
@@ -818,7 +838,7 @@ static const struct hda_codec_ops alc_patch_ops = {
         .suspend = alc_suspend,
         .check_power_status = snd_hda_gen_check_power_status,
 #endif
-        .reboot_notify = alc_shutup,
+        .reboot_notify = alc_reboot_notify,
 };
 
 
@@ -4198,24 +4218,14 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
         struct alc_spec *spec = codec->spec;
 
         if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                spec->shutup = alc_no_shutup; /* reduce click noise */
+                spec->reboot_notify = alc_d3_at_reboot; /* reduce noise */
                 spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
                 codec->power_save_node = 0; /* avoid click noises */
                 snd_hda_apply_pincfgs(codec, pincfgs);
         }
 }
 
-/* additional fixup for Thinkpad T440s noise problem */
-static void alc_fixup_tpt440(struct hda_codec *codec,
-                                  const struct hda_fixup *fix, int action)
-{
-        struct alc_spec *spec = codec->spec;
-
-        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
-                spec->shutup = alc_no_shutup; /* reduce click noise */
-                spec->gen.mixer_nid = 0; /* reduce background noise */
-        }
-}
-
 static void alc_shutup_dell_xps13(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
@@ -4606,6 +4616,7 @@ enum {
         ALC288_FIXUP_DISABLE_AAMIX,
         ALC292_FIXUP_DELL_E7X,
         ALC292_FIXUP_DISABLE_AAMIX,
+        ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK,
         ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
         ALC275_FIXUP_DELL_XPS,
         ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
@@ -5066,7 +5077,7 @@ static const struct hda_fixup alc269_fixups[] = {
         },
         [ALC292_FIXUP_TPT440] = {
                 .type = HDA_FIXUP_FUNC,
-                .v.func = alc_fixup_tpt440,
+                .v.func = alc_fixup_disable_aamix,
                 .chained = true,
                 .chain_id = ALC292_FIXUP_TPT440_DOCK,
         },
@@ -5169,6 +5180,12 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC269_FIXUP_DELL2_MIC_NO_PRESENCE
         },
+        [ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_disable_aamix,
+                .chained = true,
+                .chain_id = ALC293_FIXUP_DELL1_MIC_NO_PRESENCE
+        },
         [ALC292_FIXUP_DELL_E7X] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_dell_xps13,
@@ -5247,11 +5264,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1028, 0x06db, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
-        SND_PCI_QUIRK(0x1028, 0x06dd, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
-        SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
-        SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
-        SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
+        SND_PCI_QUIRK(0x1028, 0x06db, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+        SND_PCI_QUIRK(0x1028, 0x06dd, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+        SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+        SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+        SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
         SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
@@ -5358,6 +5375,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad T440", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad X240", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index f494dced3c11..4f85757009b3 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1354,6 +1354,8 @@ static void build_feature_ctl(struct mixer_build *state, void *raw_desc,
                 }
         }
 
+        snd_usb_mixer_fu_apply_quirk(state->mixer, cval, unitid, kctl);
+
         range = (cval->max - cval->min) / cval->res;
         /*
          * Are there devices with volume range more than 255? I use a bit more
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index 6a803eff87f7..ddca6547399b 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -348,13 +348,6 @@ static struct usbmix_name_map bose_companion5_map[] = {
         { 0 }   /* terminator */
 };
 
-/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
-static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
-static struct usbmix_name_map dragonfly_1_2_map[] = {
-        { 7, NULL, .dB = &dragonfly_1_2_dB },
-        { 0 }   /* terminator */
-};
-
 /*
  * Control map entries
  */
@@ -470,11 +463,6 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
                 .id = USB_ID(0x05a7, 0x1020),
                 .map = bose_companion5_map,
         },
-        {
-                /* Dragonfly DAC 1.2 */
-                .id = USB_ID(0x21b4, 0x0081),
-                .map = dragonfly_1_2_map,
-        },
         { 0 } /* terminator */
 };
 
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index fe91184ce832..0ce888dceed0 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -37,6 +37,7 @@
 #include <sound/control.h>
 #include <sound/hwdep.h>
 #include <sound/info.h>
+#include <sound/tlv.h>
 
 #include "usbaudio.h"
 #include "mixer.h"
@@ -1825,3 +1826,39 @@ void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
         }
 }
 
+static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer,
+                                         struct snd_kcontrol *kctl)
+{
+        /* Approximation using 10 ranges based on output measurement on hw v1.2.
+         * This seems close to the cubic mapping e.g. alsamixer uses. */
+        static const DECLARE_TLV_DB_RANGE(scale,
+                 0,  1, TLV_DB_MINMAX_ITEM(-5300, -4970),
+                 2,  5, TLV_DB_MINMAX_ITEM(-4710, -4160),
+                 6,  7, TLV_DB_MINMAX_ITEM(-3884, -3710),
+                 8, 14, TLV_DB_MINMAX_ITEM(-3443, -2560),
+                15, 16, TLV_DB_MINMAX_ITEM(-2475, -2324),
+                17, 19, TLV_DB_MINMAX_ITEM(-2228, -2031),
+                20, 26, TLV_DB_MINMAX_ITEM(-1910, -1393),
+                27, 31, TLV_DB_MINMAX_ITEM(-1322, -1032),
+                32, 40, TLV_DB_MINMAX_ITEM(-968, -490),
+                41, 50, TLV_DB_MINMAX_ITEM(-441, 0),
+        );
+
+        usb_audio_info(mixer->chip, "applying DragonFly dB scale quirk\n");
+        kctl->tlv.p = scale;
+        kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
+        kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
+}
+
+void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
+                                  struct usb_mixer_elem_info *cval, int unitid,
+                                  struct snd_kcontrol *kctl)
+{
+        switch (mixer->chip->usb_id) {
+        case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */
+                if (unitid == 7 && cval->min == 0 && cval->max == 50)
+                        snd_dragonfly_quirk_db_scale(mixer, kctl);
+                break;
+        }
+}
+
diff --git a/sound/usb/mixer_quirks.h b/sound/usb/mixer_quirks.h
index bdbfab093816..177c329cd4dd 100644
--- a/sound/usb/mixer_quirks.h
+++ b/sound/usb/mixer_quirks.h
@@ -9,5 +9,9 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip,
 void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
                                     int unitid);
 
+void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
+                                  struct usb_mixer_elem_info *cval, int unitid,
+                                  struct snd_kcontrol *kctl);
+
 #endif /* SND_USB_MIXER_QUIRKS_H */
 
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 7016ad898187..b6c0c8e3b450 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1125,6 +1125,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
         case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
         case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
         case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
+        case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
                 return true;
         }
         return false;