Merge branch 'linus' into locking/core, to pick up fixes

Signed-off-by: Ingo Molnar <mingo@kernel.org>

446 files changed, 3435 insertions, 1540 deletions

diff --git a/CREDITS b/CREDITS
index 837367624e45..d7ebdfbc4d4f 100644
--- a/CREDITS
+++ b/CREDITS
@@ -9,7 +9,7 @@
                         Linus
 ----------
 
-M: Matt Mackal
+N: Matt Mackal
 E: mpm@selenic.com
 D: SLOB slab allocator
 
@@ -1910,7 +1910,7 @@ S: Ra'annana, Israel
 
 N: Andi Kleen
 E: andi@firstfloor.org
-U: http://www.halobates.de
+W: http://www.halobates.de
 D: network, x86, NUMA, various hacks
 S: Schwalbenstr. 96
 S: 85551 Ottobrunn
@@ -2089,8 +2089,8 @@ D: ST Microelectronics SPEAr13xx PCI host bridge driver
 D: Synopsys Designware PCI host bridge driver
 
 N: Gabor Kuti
-M: seasons@falcon.sch.bme.hu
-M: seasons@makosteszta.sote.hu
+E: seasons@falcon.sch.bme.hu
+E: seasons@makosteszta.sote.hu
 D: Original author of software suspend
 
 N: Jaroslav Kysela
diff --git a/Documentation/devicetree/bindings/net/ethernet.txt b/Documentation/devicetree/bindings/net/ethernet.txt
index e1d76812419c..05150957ecfd 100644
--- a/Documentation/devicetree/bindings/net/ethernet.txt
+++ b/Documentation/devicetree/bindings/net/ethernet.txt
@@ -9,10 +9,26 @@ The following properties are common to the Ethernet controllers:
 - max-speed: number, specifies maximum speed in Mbit/s supported by the device;
 - max-frame-size: number, maximum transfer unit (IEEE defined MTU), rather than
   the maximum frame size (there's contradiction in ePAPR).
-- phy-mode: string, operation mode of the PHY interface; supported values are
-  "mii", "gmii", "sgmii", "qsgmii", "tbi", "rev-mii", "rmii", "rgmii", "rgmii-id",
-  "rgmii-rxid", "rgmii-txid", "rtbi", "smii", "xgmii", "trgmii"; this is now a
-  de-facto standard property;
+- phy-mode: string, operation mode of the PHY interface. This is now a de-facto
+  standard property; supported values are:
+  * "mii"
+  * "gmii"
+  * "sgmii"
+  * "qsgmii"
+  * "tbi"
+  * "rev-mii"
+  * "rmii"
+  * "rgmii" (RX and TX delays are added by the MAC when required)
+  * "rgmii-id" (RGMII with internal RX and TX delays provided by the PHY, the
+     MAC should not add the RX or TX delays in this case)
+  * "rgmii-rxid" (RGMII with internal RX delay provided by the PHY, the MAC
+     should not add an RX delay in this case)
+  * "rgmii-txid" (RGMII with internal TX delay provided by the PHY, the MAC
+     should not add an TX delay in this case)
+  * "rtbi"
+  * "smii"
+  * "xgmii"
+  * "trgmii"
 - phy-connection-type: the same as "phy-mode" property but described in ePAPR;
 - phy-handle: phandle, specifies a reference to a node representing a PHY
   device; this property is described in ePAPR and so preferred;
diff --git a/Documentation/networking/nf_conntrack-sysctl.txt b/Documentation/networking/nf_conntrack-sysctl.txt
index 399e4e866a9c..433b6724797a 100644
--- a/Documentation/networking/nf_conntrack-sysctl.txt
+++ b/Documentation/networking/nf_conntrack-sysctl.txt
@@ -62,10 +62,13 @@ nf_conntrack_generic_timeout - INTEGER (seconds)
         protocols.
 
 nf_conntrack_helper - BOOLEAN
-        0 - disabled
-        not 0 - enabled (default)
+        0 - disabled (default)
+        not 0 - enabled
 
         Enable automatic conntrack helper assignment.
+        If disabled it is required to set up iptables rules to assign
+        helpers to connections.  See the CT target description in the
+        iptables-extensions(8) man page for further information.
 
 nf_conntrack_icmp_timeout - INTEGER (seconds)
         default 30
diff --git a/MAINTAINERS b/MAINTAINERS
index ad9b965e5e44..63cefa62324c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -77,6 +77,7 @@ Descriptions of section entries:
         Q: Patchwork web based patch tracking system site
         T: SCM tree type and location.
            Type is one of: git, hg, quilt, stgit, topgit
+        B: Bug tracking system location.
         S: Status, one of the following:
            Supported:   Someone is actually paid to look after this.
            Maintained:  Someone actually looks after it.
@@ -281,6 +282,7 @@ L:	linux-acpi@vger.kernel.org
 W:      https://01.org/linux-acpi
 Q:      https://patchwork.kernel.org/project/linux-acpi/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
+B:      https://bugzilla.kernel.org
 S:      Supported
 F:      drivers/acpi/
 F:      drivers/pnp/pnpacpi/
@@ -304,6 +306,8 @@ W:	https://acpica.org/
 W:      https://github.com/acpica/acpica/
 Q:      https://patchwork.kernel.org/project/linux-acpi/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
+B:      https://bugzilla.kernel.org
+B:      https://bugs.acpica.org
 S:      Supported
 F:      drivers/acpi/acpica/
 F:      include/acpi/
@@ -313,6 +317,7 @@ ACPI FAN DRIVER
 M:      Zhang Rui <rui.zhang@intel.com>
 L:      linux-acpi@vger.kernel.org
 W:      https://01.org/linux-acpi
+B:      https://bugzilla.kernel.org
 S:      Supported
 F:      drivers/acpi/fan.c
 
@@ -328,6 +333,7 @@ ACPI THERMAL DRIVER
 M:      Zhang Rui <rui.zhang@intel.com>
 L:      linux-acpi@vger.kernel.org
 W:      https://01.org/linux-acpi
+B:      https://bugzilla.kernel.org
 S:      Supported
 F:      drivers/acpi/*thermal*
 
@@ -335,6 +341,7 @@ ACPI VIDEO DRIVER
 M:      Zhang Rui <rui.zhang@intel.com>
 L:      linux-acpi@vger.kernel.org
 W:      https://01.org/linux-acpi
+B:      https://bugzilla.kernel.org
 S:      Supported
 F:      drivers/acpi/acpi_video.c
 
@@ -5663,6 +5670,7 @@ HIBERNATION (aka Software Suspend, aka swsusp)
 M:      "Rafael J. Wysocki" <rjw@rjwysocki.net>
 M:      Pavel Machek <pavel@ucw.cz>
 L:      linux-pm@vger.kernel.org
+B:      https://bugzilla.kernel.org
 S:      Supported
 F:      arch/x86/power/
 F:      drivers/base/power/
@@ -9249,11 +9257,12 @@ S:	Maintained
 F:      drivers/pci/host/*layerscape*
 
 PCI DRIVER FOR IMX6
-M:      Richard Zhu <Richard.Zhu@freescale.com>
+M:      Richard Zhu <hongxing.zhu@nxp.com>
 M:      Lucas Stach <l.stach@pengutronix.de>
 L:      linux-pci@vger.kernel.org
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
+F:      Documentation/devicetree/bindings/pci/fsl,imx6q-pcie.txt
 F:      drivers/pci/host/*imx6*
 
 PCI DRIVER FOR TI KEYSTONE
@@ -9312,17 +9321,11 @@ F:	drivers/pci/host/pci-exynos.c
 
 PCI DRIVER FOR SYNOPSIS DESIGNWARE
 M:      Jingoo Han <jingoohan1@gmail.com>
-M:      Pratyush Anand <pratyush.anand@gmail.com>
-L:      linux-pci@vger.kernel.org
-S:      Maintained
-F:      drivers/pci/host/*designware*
-
-PCI DRIVER FOR SYNOPSYS PROTOTYPING DEVICE
-M:      Jose Abreu <Jose.Abreu@synopsys.com>
+M:      Joao Pinto <Joao.Pinto@synopsys.com>
 L:      linux-pci@vger.kernel.org
 S:      Maintained
 F:      Documentation/devicetree/bindings/pci/designware-pcie.txt
-F:      drivers/pci/host/pcie-designware-plat.c
+F:      drivers/pci/host/*designware*
 
 PCI DRIVER FOR GENERIC OF HOSTS
 M:      Will Deacon <will.deacon@arm.com>
@@ -9624,6 +9627,7 @@ POWER MANAGEMENT CORE
 M:      "Rafael J. Wysocki" <rjw@rjwysocki.net>
 L:      linux-pm@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
+B:      https://bugzilla.kernel.org
 S:      Supported
 F:      drivers/base/power/
 F:      include/linux/pm.h
@@ -11613,6 +11617,7 @@ M:	"Rafael J. Wysocki" <rjw@rjwysocki.net>
 M:      Len Brown <len.brown@intel.com>
 M:      Pavel Machek <pavel@ucw.cz>
 L:      linux-pm@vger.kernel.org
+B:      https://bugzilla.kernel.org
 S:      Supported
 F:      Documentation/power/
 F:      arch/x86/kernel/acpi/
diff --git a/Makefile b/Makefile
index 0ede48ba5aaf..369099dc0fae 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 9
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc8
 NAME = Psychotic Stoned Sheep
 
 # *DOCUMENTATION*
@@ -607,6 +607,13 @@ else
 include/config/auto.conf: ;
 endif # $(dot-config)
 
+# For the kernel to actually contain only the needed exported symbols,
+# we have to build modules as well to determine what those symbols are.
+# (this can be evaluated only once include/config/auto.conf has been included)
+ifdef CONFIG_TRIM_UNUSED_KSYMS
+  KBUILD_MODULES := 1
+endif
+
 # The all: target is the default when no target is given on the
 # command line.
 # This allow a user to issue only 'make' to build a kernel including modules
@@ -944,7 +951,7 @@ ifdef CONFIG_GDB_SCRIPTS
 endif
 ifdef CONFIG_TRIM_UNUSED_KSYMS
         $(Q)$(CONFIG_SHELL) $(srctree)/scripts/adjust_autoksyms.sh \
-          "$(MAKE) KBUILD_MODULES=1 -f $(srctree)/Makefile vmlinux_prereq"
+          "$(MAKE) -f $(srctree)/Makefile vmlinux"
 endif
 
 # standalone target for easier testing
@@ -1019,8 +1026,6 @@ prepare2: prepare3 prepare-compiler-check outputmakefile asm-generic
 prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
                    include/config/auto.conf
         $(cmd_crmodverdir)
-        $(Q)test -e include/generated/autoksyms.h || \
-            touch   include/generated/autoksyms.h
 
 archprepare: archheaders archscripts prepare1 scripts_basic
 
diff --git a/arch/arc/include/asm/delay.h b/arch/arc/include/asm/delay.h
index 08e7e2a16ac1..a36e8601114d 100644
--- a/arch/arc/include/asm/delay.h
+++ b/arch/arc/include/asm/delay.h
@@ -22,10 +22,11 @@
 static inline void __delay(unsigned long loops)
 {
         __asm__ __volatile__(
-        "       lp  1f  \n"
-        "       nop     \n"
-        "1:             \n"
-        : "+l"(loops));
+        "       mov lp_count, %0        \n"
+        "       lp  1f                  \n"
+        "       nop                     \n"
+        "1:                             \n"
+        : : "r"(loops));
 }
 
 extern void __bad_udelay(void);
diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
index 89eeb3720051..e94ca72b974e 100644
--- a/arch/arc/include/asm/pgtable.h
+++ b/arch/arc/include/asm/pgtable.h
@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep)
 
 #define pte_page(pte)           pfn_to_page(pte_pfn(pte))
 #define mk_pte(page, prot)      pfn_pte(page_to_pfn(page), prot)
-#define pfn_pte(pfn, prot)      __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
+#define pfn_pte(pfn, prot)      __pte(__pfn_to_phys(pfn) | pgprot_val(prot))
 
 /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/
 #define pte_pfn(pte)            (pte_val(pte) >> PAGE_SHIFT)
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index 2b96cfc3be75..50d71695cd4e 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -23,7 +23,7 @@
 
 static int l2_line_sz;
 static int ioc_exists;
-int slc_enable = 1, ioc_enable = 1;
+int slc_enable = 1, ioc_enable = 0;
 unsigned long perip_base = ARC_UNCACHED_ADDR_SPACE; /* legacy value for boot */
 unsigned long perip_end = 0xFFFFFFFF; /* legacy value */
 
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index befcd2619902..c558ba75cbcc 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -745,7 +745,6 @@ dtb-$(CONFIG_MACH_SUN4I) += \
         sun4i-a10-pcduino2.dtb \
         sun4i-a10-pov-protab2-ips9.dtb
 dtb-$(CONFIG_MACH_SUN5I) += \
-        ntc-gr8-evb.dtb \
         sun5i-a10s-auxtek-t003.dtb \
         sun5i-a10s-auxtek-t004.dtb \
         sun5i-a10s-mk802.dtb \
@@ -761,6 +760,7 @@ dtb-$(CONFIG_MACH_SUN5I) += \
         sun5i-a13-olinuxino-micro.dtb \
         sun5i-a13-q8-tablet.dtb \
         sun5i-a13-utoo-p66.dtb \
+        sun5i-gr8-evb.dtb \
         sun5i-r8-chip.dtb
 dtb-$(CONFIG_MACH_SUN6I) += \
         sun6i-a31-app4-evb1.dtb \
diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
index 0d7d5ac6257b..2b6cb05bc01a 100644
--- a/arch/arm/boot/dts/imx7s.dtsi
+++ b/arch/arm/boot/dts/imx7s.dtsi
@@ -643,9 +643,8 @@
                                 reg = <0x30730000 0x10000>;
                                 interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
                                 clocks = <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>,
-                                        <&clks IMX7D_CLK_DUMMY>,
-                                        <&clks IMX7D_CLK_DUMMY>;
-                                clock-names = "pix", "axi", "disp_axi";
+                                        <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>;
+                                clock-names = "pix", "axi";
                                 status = "disabled";
                         };
                 };
diff --git a/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts b/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts
index 1cf644bfd7ea..51dc734cd5b9 100644
--- a/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts
+++ b/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts
@@ -82,6 +82,10 @@
         gpios = <&gpio0 9 GPIO_ACTIVE_HIGH>;
 };
 
+&sata {
+        nr-ports = <2>;
+};
+
 &ehci1 {
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/stih407-family.dtsi b/arch/arm/boot/dts/stih407-family.dtsi
index 91096a49efa9..8f79b4147bba 100644
--- a/arch/arm/boot/dts/stih407-family.dtsi
+++ b/arch/arm/boot/dts/stih407-family.dtsi
@@ -283,6 +283,8 @@
                         clock-frequency = <400000>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_i2c0_default>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
 
                         status = "disabled";
                 };
@@ -296,6 +298,8 @@
                         clock-frequency = <400000>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_i2c1_default>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
 
                         status = "disabled";
                 };
@@ -309,6 +313,8 @@
                         clock-frequency = <400000>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_i2c2_default>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
 
                         status = "disabled";
                 };
@@ -322,6 +328,8 @@
                         clock-frequency = <400000>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_i2c3_default>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
 
                         status = "disabled";
                 };
@@ -335,6 +343,8 @@
                         clock-frequency = <400000>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_i2c4_default>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
 
                         status = "disabled";
                 };
@@ -348,6 +358,8 @@
                         clock-frequency = <400000>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_i2c5_default>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
 
                         status = "disabled";
                 };
@@ -363,6 +375,8 @@
                         clock-frequency = <400000>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_i2c10_default>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
 
                         status = "disabled";
                 };
@@ -376,6 +390,8 @@
                         clock-frequency = <400000>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_i2c11_default>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
 
                         status = "disabled";
                 };
diff --git a/arch/arm/boot/dts/ntc-gr8-evb.dts b/arch/arm/boot/dts/sun5i-gr8-evb.dts
index 4b622f3b5220..714381fd64d7 100644
--- a/arch/arm/boot/dts/ntc-gr8-evb.dts
+++ b/arch/arm/boot/dts/sun5i-gr8-evb.dts
@@ -44,7 +44,7 @@
  */
 
 /dts-v1/;
-#include "ntc-gr8.dtsi"
+#include "sun5i-gr8.dtsi"
 #include "sunxi-common-regulators.dtsi"
 
 #include <dt-bindings/gpio/gpio.h>
diff --git a/arch/arm/boot/dts/ntc-gr8.dtsi b/arch/arm/boot/dts/sun5i-gr8.dtsi
index ca54e03ef366..ca54e03ef366 100644
--- a/arch/arm/boot/dts/ntc-gr8.dtsi
+++ b/arch/arm/boot/dts/sun5i-gr8.dtsi
diff --git a/arch/arm/boot/dts/sun8i-h3.dtsi b/arch/arm/boot/dts/sun8i-h3.dtsi
index 75a865406d3e..f4ba088b225e 100644
--- a/arch/arm/boot/dts/sun8i-h3.dtsi
+++ b/arch/arm/boot/dts/sun8i-h3.dtsi
@@ -410,7 +410,7 @@
                         };
 
                         uart3_pins: uart3 {
-                                allwinner,pins = "PG13", "PG14";
+                                allwinner,pins = "PA13", "PA14";
                                 allwinner,function = "uart3";
                                 allwinner,drive = <SUN4I_PINCTRL_10_MA>;
                                 allwinner,pull = <SUN4I_PINCTRL_NO_PULL>;
diff --git a/arch/arm/include/asm/Kbuild b/arch/arm/include/asm/Kbuild
index 0745538b26d3..55e0e3ea9cb6 100644
--- a/arch/arm/include/asm/Kbuild
+++ b/arch/arm/include/asm/Kbuild
@@ -8,7 +8,6 @@ generic-y += early_ioremap.h
 generic-y += emergency-restart.h
 generic-y += errno.h
 generic-y += exec.h
-generic-y += export.h
 generic-y += ioctl.h
 generic-y += ipcbuf.h
 generic-y += irq_regs.h
diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
index 68c2c097cffe..ad325a8c7e1e 100644
--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -33,7 +33,7 @@ endif
 obj-$(CONFIG_CPU_IDLE)          += cpuidle.o
 obj-$(CONFIG_ISA_DMA_API)       += dma.o
 obj-$(CONFIG_FIQ)               += fiq.o fiqasm.o
-obj-$(CONFIG_MODULES)           += module.o
+obj-$(CONFIG_MODULES)           += armksyms.o module.o
 obj-$(CONFIG_ARM_MODULE_PLTS)   += module-plts.o
 obj-$(CONFIG_ISA_DMA)           += dma-isa.o
 obj-$(CONFIG_PCI)               += bios32.o isa.o
diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
new file mode 100644
index 000000000000..7e45f69a0ddc
--- /dev/null
+++ b/arch/arm/kernel/armksyms.c
@@ -0,0 +1,183 @@
+/*
+ *  linux/arch/arm/kernel/armksyms.c
+ *
+ *  Copyright (C) 2000 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/export.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/cryptohash.h>
+#include <linux/delay.h>
+#include <linux/in6.h>
+#include <linux/syscalls.h>
+#include <linux/uaccess.h>
+#include <linux/io.h>
+#include <linux/arm-smccc.h>
+
+#include <asm/checksum.h>
+#include <asm/ftrace.h>
+
+/*
+ * libgcc functions - functions that are used internally by the
+ * compiler...  (prototypes are not correct though, but that
+ * doesn't really matter since they're not versioned).
+ */
+extern void __ashldi3(void);
+extern void __ashrdi3(void);
+extern void __divsi3(void);
+extern void __lshrdi3(void);
+extern void __modsi3(void);
+extern void __muldi3(void);
+extern void __ucmpdi2(void);
+extern void __udivsi3(void);
+extern void __umodsi3(void);
+extern void __do_div64(void);
+extern void __bswapsi2(void);
+extern void __bswapdi2(void);
+
+extern void __aeabi_idiv(void);
+extern void __aeabi_idivmod(void);
+extern void __aeabi_lasr(void);
+extern void __aeabi_llsl(void);
+extern void __aeabi_llsr(void);
+extern void __aeabi_lmul(void);
+extern void __aeabi_uidiv(void);
+extern void __aeabi_uidivmod(void);
+extern void __aeabi_ulcmp(void);
+
+extern void fpundefinstr(void);
+
+void mmioset(void *, unsigned int, size_t);
+void mmiocpy(void *, const void *, size_t);
+
+        /* platform dependent support */
+EXPORT_SYMBOL(arm_delay_ops);
+
+        /* networking */
+EXPORT_SYMBOL(csum_partial);
+EXPORT_SYMBOL(csum_partial_copy_from_user);
+EXPORT_SYMBOL(csum_partial_copy_nocheck);
+EXPORT_SYMBOL(__csum_ipv6_magic);
+
+        /* io */
+#ifndef __raw_readsb
+EXPORT_SYMBOL(__raw_readsb);
+#endif
+#ifndef __raw_readsw
+EXPORT_SYMBOL(__raw_readsw);
+#endif
+#ifndef __raw_readsl
+EXPORT_SYMBOL(__raw_readsl);
+#endif
+#ifndef __raw_writesb
+EXPORT_SYMBOL(__raw_writesb);
+#endif
+#ifndef __raw_writesw
+EXPORT_SYMBOL(__raw_writesw);
+#endif
+#ifndef __raw_writesl
+EXPORT_SYMBOL(__raw_writesl);
+#endif
+
+        /* string / mem functions */
+EXPORT_SYMBOL(strchr);
+EXPORT_SYMBOL(strrchr);
+EXPORT_SYMBOL(memset);
+EXPORT_SYMBOL(memcpy);
+EXPORT_SYMBOL(memmove);
+EXPORT_SYMBOL(memchr);
+EXPORT_SYMBOL(__memzero);
+
+EXPORT_SYMBOL(mmioset);
+EXPORT_SYMBOL(mmiocpy);
+
+#ifdef CONFIG_MMU
+EXPORT_SYMBOL(copy_page);
+
+EXPORT_SYMBOL(arm_copy_from_user);
+EXPORT_SYMBOL(arm_copy_to_user);
+EXPORT_SYMBOL(arm_clear_user);
+
+EXPORT_SYMBOL(__get_user_1);
+EXPORT_SYMBOL(__get_user_2);
+EXPORT_SYMBOL(__get_user_4);
+EXPORT_SYMBOL(__get_user_8);
+
+#ifdef __ARMEB__
+EXPORT_SYMBOL(__get_user_64t_1);
+EXPORT_SYMBOL(__get_user_64t_2);
+EXPORT_SYMBOL(__get_user_64t_4);
+EXPORT_SYMBOL(__get_user_32t_8);
+#endif
+
+EXPORT_SYMBOL(__put_user_1);
+EXPORT_SYMBOL(__put_user_2);
+EXPORT_SYMBOL(__put_user_4);
+EXPORT_SYMBOL(__put_user_8);
+#endif
+
+        /* gcc lib functions */
+EXPORT_SYMBOL(__ashldi3);
+EXPORT_SYMBOL(__ashrdi3);
+EXPORT_SYMBOL(__divsi3);
+EXPORT_SYMBOL(__lshrdi3);
+EXPORT_SYMBOL(__modsi3);
+EXPORT_SYMBOL(__muldi3);
+EXPORT_SYMBOL(__ucmpdi2);
+EXPORT_SYMBOL(__udivsi3);
+EXPORT_SYMBOL(__umodsi3);
+EXPORT_SYMBOL(__do_div64);
+EXPORT_SYMBOL(__bswapsi2);
+EXPORT_SYMBOL(__bswapdi2);
+
+#ifdef CONFIG_AEABI
+EXPORT_SYMBOL(__aeabi_idiv);
+EXPORT_SYMBOL(__aeabi_idivmod);
+EXPORT_SYMBOL(__aeabi_lasr);
+EXPORT_SYMBOL(__aeabi_llsl);
+EXPORT_SYMBOL(__aeabi_llsr);
+EXPORT_SYMBOL(__aeabi_lmul);
+EXPORT_SYMBOL(__aeabi_uidiv);
+EXPORT_SYMBOL(__aeabi_uidivmod);
+EXPORT_SYMBOL(__aeabi_ulcmp);
+#endif
+
+        /* bitops */
+EXPORT_SYMBOL(_set_bit);
+EXPORT_SYMBOL(_test_and_set_bit);
+EXPORT_SYMBOL(_clear_bit);
+EXPORT_SYMBOL(_test_and_clear_bit);
+EXPORT_SYMBOL(_change_bit);
+EXPORT_SYMBOL(_test_and_change_bit);
+EXPORT_SYMBOL(_find_first_zero_bit_le);
+EXPORT_SYMBOL(_find_next_zero_bit_le);
+EXPORT_SYMBOL(_find_first_bit_le);
+EXPORT_SYMBOL(_find_next_bit_le);
+
+#ifdef __ARMEB__
+EXPORT_SYMBOL(_find_first_zero_bit_be);
+EXPORT_SYMBOL(_find_next_zero_bit_be);
+EXPORT_SYMBOL(_find_first_bit_be);
+EXPORT_SYMBOL(_find_next_bit_be);
+#endif
+
+#ifdef CONFIG_FUNCTION_TRACER
+#ifdef CONFIG_OLD_MCOUNT
+EXPORT_SYMBOL(mcount);
+#endif
+EXPORT_SYMBOL(__gnu_mcount_nc);
+#endif
+
+#ifdef CONFIG_ARM_PATCH_PHYS_VIRT
+EXPORT_SYMBOL(__pv_phys_pfn_offset);
+EXPORT_SYMBOL(__pv_offset);
+#endif
+
+#ifdef CONFIG_HAVE_ARM_SMCCC
+EXPORT_SYMBOL(arm_smccc_smc);
+EXPORT_SYMBOL(arm_smccc_hvc);
+#endif
diff --git a/arch/arm/kernel/entry-ftrace.S b/arch/arm/kernel/entry-ftrace.S
index b629d3f11c3d..c73c4030ca5d 100644
--- a/arch/arm/kernel/entry-ftrace.S
+++ b/arch/arm/kernel/entry-ftrace.S
@@ -7,7 +7,6 @@
 #include <asm/assembler.h>
 #include <asm/ftrace.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
 #include "entry-header.S"
 
@@ -154,7 +153,6 @@ ENTRY(mcount)
         __mcount _old
 #endif
 ENDPROC(mcount)
-EXPORT_SYMBOL(mcount)
 
 #ifdef CONFIG_DYNAMIC_FTRACE
 ENTRY(ftrace_caller_old)
@@ -207,7 +205,6 @@ UNWIND(.fnstart)
 #endif
 UNWIND(.fnend)
 ENDPROC(__gnu_mcount_nc)
-EXPORT_SYMBOL(__gnu_mcount_nc)
 
 #ifdef CONFIG_DYNAMIC_FTRACE
 ENTRY(ftrace_caller)
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index f41cee4c5746..04286fd9e09c 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -22,7 +22,6 @@
 #include <asm/memory.h>
 #include <asm/thread_info.h>
 #include <asm/pgtable.h>
-#include <asm/export.h>
 
 #if defined(CONFIG_DEBUG_LL) && !defined(CONFIG_DEBUG_SEMIHOSTING)
 #include CONFIG_DEBUG_LL_INCLUDE
@@ -728,8 +727,6 @@ __pv_phys_pfn_offset:
 __pv_offset:
         .quad   0
         .size   __pv_offset, . -__pv_offset
-EXPORT_SYMBOL(__pv_phys_pfn_offset)
-EXPORT_SYMBOL(__pv_offset)
 #endif
 
 #include "head-common.S"
diff --git a/arch/arm/kernel/smccc-call.S b/arch/arm/kernel/smccc-call.S
index 37669e7e13af..2e48b674aab1 100644
--- a/arch/arm/kernel/smccc-call.S
+++ b/arch/arm/kernel/smccc-call.S
@@ -16,7 +16,6 @@
 #include <asm/opcodes-sec.h>
 #include <asm/opcodes-virt.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
         /*
          * Wrap c macros in asm macros to delay expansion until after the
@@ -52,7 +51,6 @@ UNWIND(	.fnend)
 ENTRY(arm_smccc_smc)
         SMCCC SMCCC_SMC
 ENDPROC(arm_smccc_smc)
-EXPORT_SYMBOL(arm_smccc_smc)
 
 /*
  * void smccc_hvc(unsigned long a0, unsigned long a1, unsigned long a2,
@@ -62,4 +60,3 @@ EXPORT_SYMBOL(arm_smccc_smc)
 ENTRY(arm_smccc_hvc)
         SMCCC SMCCC_HVC
 ENDPROC(arm_smccc_hvc)
-EXPORT_SYMBOL(arm_smccc_hvc)
diff --git a/arch/arm/lib/ashldi3.S b/arch/arm/lib/ashldi3.S
index a7e7de89bd75..b05e95840651 100644
--- a/arch/arm/lib/ashldi3.S
+++ b/arch/arm/lib/ashldi3.S
@@ -28,7 +28,6 @@ Boston, MA 02110-1301, USA.  */
 
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 #ifdef __ARMEB__
 #define al r1
@@ -53,5 +52,3 @@ ENTRY(__aeabi_llsl)
 
 ENDPROC(__ashldi3)
 ENDPROC(__aeabi_llsl)
-EXPORT_SYMBOL(__ashldi3)
-EXPORT_SYMBOL(__aeabi_llsl)
diff --git a/arch/arm/lib/ashrdi3.S b/arch/arm/lib/ashrdi3.S
index 490336e42518..275d7d2341a4 100644
--- a/arch/arm/lib/ashrdi3.S
+++ b/arch/arm/lib/ashrdi3.S
@@ -28,7 +28,6 @@ Boston, MA 02110-1301, USA.  */
 
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 #ifdef __ARMEB__
 #define al r1
@@ -53,5 +52,3 @@ ENTRY(__aeabi_lasr)
 
 ENDPROC(__ashrdi3)
 ENDPROC(__aeabi_lasr)
-EXPORT_SYMBOL(__ashrdi3)
-EXPORT_SYMBOL(__aeabi_lasr)
diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
index df06638b327c..7d807cfd8ef5 100644
--- a/arch/arm/lib/bitops.h
+++ b/arch/arm/lib/bitops.h
@@ -1,6 +1,5 @@
 #include <asm/assembler.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
 #if __LINUX_ARM_ARCH__ >= 6
         .macro  bitop, name, instr
@@ -26,7 +25,6 @@ UNWIND(	.fnstart	)
         bx      lr
 UNWIND( .fnend          )
 ENDPROC(\name           )
-EXPORT_SYMBOL(\name     )
         .endm
 
         .macro  testop, name, instr, store
@@ -57,7 +55,6 @@ UNWIND(	.fnstart	)
 2:      bx      lr
 UNWIND( .fnend          )
 ENDPROC(\name           )
-EXPORT_SYMBOL(\name     )
         .endm
 #else
         .macro  bitop, name, instr
@@ -77,7 +74,6 @@ UNWIND(	.fnstart	)
         ret     lr
 UNWIND( .fnend          )
 ENDPROC(\name           )
-EXPORT_SYMBOL(\name     )
         .endm
 
 /**
@@ -106,6 +102,5 @@ UNWIND(	.fnstart	)
         ret     lr
 UNWIND( .fnend          )
 ENDPROC(\name           )
-EXPORT_SYMBOL(\name     )
         .endm
 #endif
diff --git a/arch/arm/lib/bswapsdi2.S b/arch/arm/lib/bswapsdi2.S
index f05f78247304..07cda737bb11 100644
--- a/arch/arm/lib/bswapsdi2.S
+++ b/arch/arm/lib/bswapsdi2.S
@@ -1,6 +1,5 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 #if __LINUX_ARM_ARCH__ >= 6
 ENTRY(__bswapsi2)
@@ -36,5 +35,3 @@ ENTRY(__bswapdi2)
         ret lr
 ENDPROC(__bswapdi2)
 #endif
-EXPORT_SYMBOL(__bswapsi2)
-EXPORT_SYMBOL(__bswapdi2)
diff --git a/arch/arm/lib/clear_user.S b/arch/arm/lib/clear_user.S
index b566154f5cf4..e936352ccb00 100644
--- a/arch/arm/lib/clear_user.S
+++ b/arch/arm/lib/clear_user.S
@@ -10,7 +10,6 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
                 .text
 
@@ -51,9 +50,6 @@ USER(		strnebt	r2, [r0])
 UNWIND(.fnend)
 ENDPROC(arm_clear_user)
 ENDPROC(__clear_user_std)
-#ifndef CONFIG_UACCESS_WITH_MEMCPY
-EXPORT_SYMBOL(arm_clear_user)
-#endif
 
                 .pushsection .text.fixup,"ax"
                 .align  0
diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
index 63e4c1ed0225..7a4b06049001 100644
--- a/arch/arm/lib/copy_from_user.S
+++ b/arch/arm/lib/copy_from_user.S
@@ -13,7 +13,6 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
 /*
  * Prototype:
@@ -95,7 +94,6 @@ ENTRY(arm_copy_from_user)
 #include "copy_template.S"
 
 ENDPROC(arm_copy_from_user)
-EXPORT_SYMBOL(arm_copy_from_user)
 
         .pushsection .fixup,"ax"
         .align 0
diff --git a/arch/arm/lib/copy_page.S b/arch/arm/lib/copy_page.S
index d97851d4af7a..6ee2f6706f86 100644
--- a/arch/arm/lib/copy_page.S
+++ b/arch/arm/lib/copy_page.S
@@ -13,7 +13,6 @@
 #include <asm/assembler.h>
 #include <asm/asm-offsets.h>
 #include <asm/cache.h>
-#include <asm/export.h>
 
 #define COPY_COUNT (PAGE_SZ / (2 * L1_CACHE_BYTES) PLD( -1 ))
 
@@ -46,4 +45,3 @@ ENTRY(copy_page)
         PLD(    beq     2b                      )
                 ldmfd   sp!, {r4, pc}                   @       3
 ENDPROC(copy_page)
-EXPORT_SYMBOL(copy_page)
diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
index 592c179112d1..caf5019d8161 100644
--- a/arch/arm/lib/copy_to_user.S
+++ b/arch/arm/lib/copy_to_user.S
@@ -13,7 +13,6 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
 /*
  * Prototype:
@@ -100,9 +99,6 @@ WEAK(arm_copy_to_user)
 
 ENDPROC(arm_copy_to_user)
 ENDPROC(__copy_to_user_std)
-#ifndef CONFIG_UACCESS_WITH_MEMCPY
-EXPORT_SYMBOL(arm_copy_to_user)
-#endif
 
         .pushsection .text.fixup,"ax"
         .align 0
diff --git a/arch/arm/lib/csumipv6.S b/arch/arm/lib/csumipv6.S
index 68603b5ee537..3ac6ef01bc43 100644
--- a/arch/arm/lib/csumipv6.S
+++ b/arch/arm/lib/csumipv6.S
@@ -9,7 +9,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
                 .text
 
@@ -31,4 +30,4 @@ ENTRY(__csum_ipv6_magic)
                 adcs    r0, r0, #0
                 ldmfd   sp!, {pc}
 ENDPROC(__csum_ipv6_magic)
-EXPORT_SYMBOL(__csum_ipv6_magic)
+
diff --git a/arch/arm/lib/csumpartial.S b/arch/arm/lib/csumpartial.S
index 830b20e81c37..984e0f29d548 100644
--- a/arch/arm/lib/csumpartial.S
+++ b/arch/arm/lib/csumpartial.S
@@ -9,7 +9,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
                 .text
 
@@ -141,4 +140,3 @@ ENTRY(csum_partial)
                 bne     4b
                 b       .Lless4
 ENDPROC(csum_partial)
-EXPORT_SYMBOL(csum_partial)
diff --git a/arch/arm/lib/csumpartialcopy.S b/arch/arm/lib/csumpartialcopy.S
index 9c3383fed129..d03fc71fc88c 100644
--- a/arch/arm/lib/csumpartialcopy.S
+++ b/arch/arm/lib/csumpartialcopy.S
@@ -49,6 +49,5 @@
 
 #define FN_ENTRY        ENTRY(csum_partial_copy_nocheck)
 #define FN_EXIT         ENDPROC(csum_partial_copy_nocheck)
-#define FN_EXPORT       EXPORT_SYMBOL(csum_partial_copy_nocheck)
 
 #include "csumpartialcopygeneric.S"
diff --git a/arch/arm/lib/csumpartialcopygeneric.S b/arch/arm/lib/csumpartialcopygeneric.S
index 8b94d20e51d1..10b45909610c 100644
--- a/arch/arm/lib/csumpartialcopygeneric.S
+++ b/arch/arm/lib/csumpartialcopygeneric.S
@@ -8,7 +8,6 @@
  * published by the Free Software Foundation.
  */
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 /*
  * unsigned int
@@ -332,4 +331,3 @@ FN_ENTRY
                 mov     r5, r4, get_byte_1
                 b       .Lexit
 FN_EXIT
-FN_EXPORT
diff --git a/arch/arm/lib/csumpartialcopyuser.S b/arch/arm/lib/csumpartialcopyuser.S
index 5d495edf3d83..1712f132b80d 100644
--- a/arch/arm/lib/csumpartialcopyuser.S
+++ b/arch/arm/lib/csumpartialcopyuser.S
@@ -73,7 +73,6 @@
 
 #define FN_ENTRY        ENTRY(csum_partial_copy_from_user)
 #define FN_EXIT         ENDPROC(csum_partial_copy_from_user)
-#define FN_EXPORT       EXPORT_SYMBOL(csum_partial_copy_from_user)
 
 #include "csumpartialcopygeneric.S"
 
diff --git a/arch/arm/lib/delay.c b/arch/arm/lib/delay.c
index 69aad80a3af4..2cef11884857 100644
--- a/arch/arm/lib/delay.c
+++ b/arch/arm/lib/delay.c
@@ -24,7 +24,6 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/export.h>
 #include <linux/timex.h>
 
 /*
@@ -35,7 +34,6 @@ struct arm_delay_ops arm_delay_ops __ro_after_init = {
         .const_udelay   = __loop_const_udelay,
         .udelay         = __loop_udelay,
 };
-EXPORT_SYMBOL(arm_delay_ops);
 
 static const struct delay_timer *delay_timer;
 static bool delay_calibrated;
diff --git a/arch/arm/lib/div64.S b/arch/arm/lib/div64.S
index 0c9e1c18fc9e..a9eafe4981eb 100644
--- a/arch/arm/lib/div64.S
+++ b/arch/arm/lib/div64.S
@@ -15,7 +15,6 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
 #ifdef __ARMEB__
 #define xh r0
@@ -211,4 +210,3 @@ Ldiv0_64:
 
 UNWIND(.fnend)
 ENDPROC(__do_div64)
-EXPORT_SYMBOL(__do_div64)
diff --git a/arch/arm/lib/findbit.S b/arch/arm/lib/findbit.S
index 26302b8cd38f..7848780e8834 100644
--- a/arch/arm/lib/findbit.S
+++ b/arch/arm/lib/findbit.S
@@ -15,7 +15,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
                 .text
 
 /*
@@ -38,7 +37,6 @@ ENTRY(_find_first_zero_bit_le)
 3:              mov     r0, r1                  @ no free bits
                 ret     lr
 ENDPROC(_find_first_zero_bit_le)
-EXPORT_SYMBOL(_find_first_zero_bit_le)
 
 /*
  * Purpose  : Find next 'zero' bit
@@ -59,7 +57,6 @@ ENTRY(_find_next_zero_bit_le)
                 add     r2, r2, #1              @ align bit pointer
                 b       2b                      @ loop for next bit
 ENDPROC(_find_next_zero_bit_le)
-EXPORT_SYMBOL(_find_next_zero_bit_le)
 
 /*
  * Purpose  : Find a 'one' bit
@@ -81,7 +78,6 @@ ENTRY(_find_first_bit_le)
 3:              mov     r0, r1                  @ no free bits
                 ret     lr
 ENDPROC(_find_first_bit_le)
-EXPORT_SYMBOL(_find_first_bit_le)
 
 /*
  * Purpose  : Find next 'one' bit
@@ -101,7 +97,6 @@ ENTRY(_find_next_bit_le)
                 add     r2, r2, #1              @ align bit pointer
                 b       2b                      @ loop for next bit
 ENDPROC(_find_next_bit_le)
-EXPORT_SYMBOL(_find_next_bit_le)
 
 #ifdef __ARMEB__
 
@@ -121,7 +116,6 @@ ENTRY(_find_first_zero_bit_be)
 3:              mov     r0, r1                  @ no free bits
                 ret     lr
 ENDPROC(_find_first_zero_bit_be)
-EXPORT_SYMBOL(_find_first_zero_bit_be)
 
 ENTRY(_find_next_zero_bit_be)
                 teq     r1, #0
@@ -139,7 +133,6 @@ ENTRY(_find_next_zero_bit_be)
                 add     r2, r2, #1              @ align bit pointer
                 b       2b                      @ loop for next bit
 ENDPROC(_find_next_zero_bit_be)
-EXPORT_SYMBOL(_find_next_zero_bit_be)
 
 ENTRY(_find_first_bit_be)
                 teq     r1, #0
@@ -157,7 +150,6 @@ ENTRY(_find_first_bit_be)
 3:              mov     r0, r1                  @ no free bits
                 ret     lr
 ENDPROC(_find_first_bit_be)
-EXPORT_SYMBOL(_find_first_bit_be)
 
 ENTRY(_find_next_bit_be)
                 teq     r1, #0
@@ -174,7 +166,6 @@ ENTRY(_find_next_bit_be)
                 add     r2, r2, #1              @ align bit pointer
                 b       2b                      @ loop for next bit
 ENDPROC(_find_next_bit_be)
-EXPORT_SYMBOL(_find_next_bit_be)
 
 #endif
 
diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
index 9d09a38e73af..8ecfd15c3a02 100644
--- a/arch/arm/lib/getuser.S
+++ b/arch/arm/lib/getuser.S
@@ -31,7 +31,6 @@
 #include <asm/assembler.h>
 #include <asm/errno.h>
 #include <asm/domain.h>
-#include <asm/export.h>
 
 ENTRY(__get_user_1)
         check_uaccess r0, 1, r1, r2, __get_user_bad
@@ -39,7 +38,6 @@ ENTRY(__get_user_1)
         mov     r0, #0
         ret     lr
 ENDPROC(__get_user_1)
-EXPORT_SYMBOL(__get_user_1)
 
 ENTRY(__get_user_2)
         check_uaccess r0, 2, r1, r2, __get_user_bad
@@ -60,7 +58,6 @@ rb	.req	r0
         mov     r0, #0
         ret     lr
 ENDPROC(__get_user_2)
-EXPORT_SYMBOL(__get_user_2)
 
 ENTRY(__get_user_4)
         check_uaccess r0, 4, r1, r2, __get_user_bad
@@ -68,7 +65,6 @@ ENTRY(__get_user_4)
         mov     r0, #0
         ret     lr
 ENDPROC(__get_user_4)
-EXPORT_SYMBOL(__get_user_4)
 
 ENTRY(__get_user_8)
         check_uaccess r0, 8, r1, r2, __get_user_bad
@@ -82,7 +78,6 @@ ENTRY(__get_user_8)
         mov     r0, #0
         ret     lr
 ENDPROC(__get_user_8)
-EXPORT_SYMBOL(__get_user_8)
 
 #ifdef __ARMEB__
 ENTRY(__get_user_32t_8)
@@ -96,7 +91,6 @@ ENTRY(__get_user_32t_8)
         mov     r0, #0
         ret     lr
 ENDPROC(__get_user_32t_8)
-EXPORT_SYMBOL(__get_user_32t_8)
 
 ENTRY(__get_user_64t_1)
         check_uaccess r0, 1, r1, r2, __get_user_bad8
@@ -104,7 +98,6 @@ ENTRY(__get_user_64t_1)
         mov     r0, #0
         ret     lr
 ENDPROC(__get_user_64t_1)
-EXPORT_SYMBOL(__get_user_64t_1)
 
 ENTRY(__get_user_64t_2)
         check_uaccess r0, 2, r1, r2, __get_user_bad8
@@ -121,7 +114,6 @@ rb	.req	r0
         mov     r0, #0
         ret     lr
 ENDPROC(__get_user_64t_2)
-EXPORT_SYMBOL(__get_user_64t_2)
 
 ENTRY(__get_user_64t_4)
         check_uaccess r0, 4, r1, r2, __get_user_bad8
@@ -129,7 +121,6 @@ ENTRY(__get_user_64t_4)
         mov     r0, #0
         ret     lr
 ENDPROC(__get_user_64t_4)
-EXPORT_SYMBOL(__get_user_64t_4)
 #endif
 
 __get_user_bad8:
diff --git a/arch/arm/lib/io-readsb.S b/arch/arm/lib/io-readsb.S
index 3dff7a3a2aef..c31b2f3153f1 100644
--- a/arch/arm/lib/io-readsb.S
+++ b/arch/arm/lib/io-readsb.S
@@ -9,7 +9,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 .Linsb_align:   rsb     ip, ip, #4
                 cmp     ip, r2
@@ -122,4 +121,3 @@ ENTRY(__raw_readsb)
 
                 ldmfd   sp!, {r4 - r6, pc}
 ENDPROC(__raw_readsb)
-EXPORT_SYMBOL(__raw_readsb)
diff --git a/arch/arm/lib/io-readsl.S b/arch/arm/lib/io-readsl.S
index bfd39682325b..2ed86fa5465f 100644
--- a/arch/arm/lib/io-readsl.S
+++ b/arch/arm/lib/io-readsl.S
@@ -9,7 +9,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 ENTRY(__raw_readsl)
                 teq     r2, #0          @ do we have to check for the zero len?
@@ -78,4 +77,3 @@ ENTRY(__raw_readsl)
                 strb    r3, [r1, #0]
                 ret     lr
 ENDPROC(__raw_readsl)
-EXPORT_SYMBOL(__raw_readsl)
diff --git a/arch/arm/lib/io-readsw-armv3.S b/arch/arm/lib/io-readsw-armv3.S
index b3af3db6caac..413da9914529 100644
--- a/arch/arm/lib/io-readsw-armv3.S
+++ b/arch/arm/lib/io-readsw-armv3.S
@@ -9,7 +9,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 .Linsw_bad_alignment:
                 adr     r0, .Linsw_bad_align_msg
@@ -104,4 +103,4 @@ ENTRY(__raw_readsw)
 
                 ldmfd   sp!, {r4, r5, r6, pc}
 
-EXPORT_SYMBOL(__raw_readsw)
+
diff --git a/arch/arm/lib/io-readsw-armv4.S b/arch/arm/lib/io-readsw-armv4.S
index 3c7a7a40b33e..d9a45e9692ae 100644
--- a/arch/arm/lib/io-readsw-armv4.S
+++ b/arch/arm/lib/io-readsw-armv4.S
@@ -9,7 +9,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
                 .macro  pack, rd, hw1, hw2
 #ifndef __ARMEB__
@@ -130,4 +129,3 @@ ENTRY(__raw_readsw)
                 strneb  ip, [r1]
                 ldmfd   sp!, {r4, pc}
 ENDPROC(__raw_readsw)
-EXPORT_SYMBOL(__raw_readsw)
diff --git a/arch/arm/lib/io-writesb.S b/arch/arm/lib/io-writesb.S
index fa3633594415..a46bbc9b168b 100644
--- a/arch/arm/lib/io-writesb.S
+++ b/arch/arm/lib/io-writesb.S
@@ -9,7 +9,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
                 .macro  outword, rd
 #ifndef __ARMEB__
@@ -93,4 +92,3 @@ ENTRY(__raw_writesb)
 
                 ldmfd   sp!, {r4, r5, pc}
 ENDPROC(__raw_writesb)
-EXPORT_SYMBOL(__raw_writesb)
diff --git a/arch/arm/lib/io-writesl.S b/arch/arm/lib/io-writesl.S
index 98ed6aec0b47..4ea2435988c1 100644
--- a/arch/arm/lib/io-writesl.S
+++ b/arch/arm/lib/io-writesl.S
@@ -9,7 +9,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 ENTRY(__raw_writesl)
                 teq     r2, #0          @ do we have to check for the zero len?
@@ -66,4 +65,3 @@ ENTRY(__raw_writesl)
                 bne     6b
                 ret     lr
 ENDPROC(__raw_writesl)
-EXPORT_SYMBOL(__raw_writesl)
diff --git a/arch/arm/lib/io-writesw-armv3.S b/arch/arm/lib/io-writesw-armv3.S
index 577184c082bb..121789eb6802 100644
--- a/arch/arm/lib/io-writesw-armv3.S
+++ b/arch/arm/lib/io-writesw-armv3.S
@@ -9,7 +9,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 .Loutsw_bad_alignment:
                 adr     r0, .Loutsw_bad_align_msg
@@ -125,4 +124,3 @@ ENTRY(__raw_writesw)
                 strne   ip, [r0]
 
                 ldmfd   sp!, {r4, r5, r6, pc}
-EXPORT_SYMBOL(__raw_writesw)
diff --git a/arch/arm/lib/io-writesw-armv4.S b/arch/arm/lib/io-writesw-armv4.S
index e335f489d1fc..269f90c51ad2 100644
--- a/arch/arm/lib/io-writesw-armv4.S
+++ b/arch/arm/lib/io-writesw-armv4.S
@@ -9,7 +9,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
                 .macro  outword, rd
 #ifndef __ARMEB__
@@ -99,4 +98,3 @@ ENTRY(__raw_writesw)
                 strneh  ip, [r0]
                 ret     lr
 ENDPROC(__raw_writesw)
-EXPORT_SYMBOL(__raw_writesw)
diff --git a/arch/arm/lib/lib1funcs.S b/arch/arm/lib/lib1funcs.S
index f541bc013bff..9397b2e532af 100644
--- a/arch/arm/lib/lib1funcs.S
+++ b/arch/arm/lib/lib1funcs.S
@@ -36,7 +36,6 @@ Boston, MA 02111-1307, USA.  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
 .macro ARM_DIV_BODY dividend, divisor, result, curbit
 
@@ -239,8 +238,6 @@ UNWIND(.fnstart)
 UNWIND(.fnend)
 ENDPROC(__udivsi3)
 ENDPROC(__aeabi_uidiv)
-EXPORT_SYMBOL(__udivsi3)
-EXPORT_SYMBOL(__aeabi_uidiv)
 
 ENTRY(__umodsi3)
 UNWIND(.fnstart)
@@ -259,7 +256,6 @@ UNWIND(.fnstart)
 
 UNWIND(.fnend)
 ENDPROC(__umodsi3)
-EXPORT_SYMBOL(__umodsi3)
 
 #ifdef CONFIG_ARM_PATCH_IDIV
         .align 3
@@ -307,8 +303,6 @@ UNWIND(.fnstart)
 UNWIND(.fnend)
 ENDPROC(__divsi3)
 ENDPROC(__aeabi_idiv)
-EXPORT_SYMBOL(__divsi3)
-EXPORT_SYMBOL(__aeabi_idiv)
 
 ENTRY(__modsi3)
 UNWIND(.fnstart)
@@ -333,7 +327,6 @@ UNWIND(.fnstart)
 
 UNWIND(.fnend)
 ENDPROC(__modsi3)
-EXPORT_SYMBOL(__modsi3)
 
 #ifdef CONFIG_AEABI
 
@@ -350,7 +343,6 @@ UNWIND(.save {r0, r1, ip, lr}	)
 
 UNWIND(.fnend)
 ENDPROC(__aeabi_uidivmod)
-EXPORT_SYMBOL(__aeabi_uidivmod)
 
 ENTRY(__aeabi_idivmod)
 UNWIND(.fnstart)
@@ -364,7 +356,6 @@ UNWIND(.save {r0, r1, ip, lr}	)
 
 UNWIND(.fnend)
 ENDPROC(__aeabi_idivmod)
-EXPORT_SYMBOL(__aeabi_idivmod)
 
 #endif
 
diff --git a/arch/arm/lib/lshrdi3.S b/arch/arm/lib/lshrdi3.S
index e40833981417..922dcd88b02b 100644
--- a/arch/arm/lib/lshrdi3.S
+++ b/arch/arm/lib/lshrdi3.S
@@ -28,7 +28,6 @@ Boston, MA 02110-1301, USA.  */
 
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 #ifdef __ARMEB__
 #define al r1
@@ -53,5 +52,3 @@ ENTRY(__aeabi_llsr)
 
 ENDPROC(__lshrdi3)
 ENDPROC(__aeabi_llsr)
-EXPORT_SYMBOL(__lshrdi3)
-EXPORT_SYMBOL(__aeabi_llsr)
diff --git a/arch/arm/lib/memchr.S b/arch/arm/lib/memchr.S
index 44182bf686a5..74a5bed6d999 100644
--- a/arch/arm/lib/memchr.S
+++ b/arch/arm/lib/memchr.S
@@ -11,7 +11,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
         .text
         .align  5
@@ -25,4 +24,3 @@ ENTRY(memchr)
 2:      movne   r0, #0
         ret     lr
 ENDPROC(memchr)
-EXPORT_SYMBOL(memchr)
diff --git a/arch/arm/lib/memcpy.S b/arch/arm/lib/memcpy.S
index 1be5b6ddf37c..64111bd4440b 100644
--- a/arch/arm/lib/memcpy.S
+++ b/arch/arm/lib/memcpy.S
@@ -13,7 +13,6 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
 #define LDR1W_SHIFT     0
 #define STR1W_SHIFT     0
@@ -69,5 +68,3 @@ ENTRY(memcpy)
 
 ENDPROC(memcpy)
 ENDPROC(mmiocpy)
-EXPORT_SYMBOL(memcpy)
-EXPORT_SYMBOL(mmiocpy)
diff --git a/arch/arm/lib/memmove.S b/arch/arm/lib/memmove.S
index 71dcc5400d02..69a9d47fc5ab 100644
--- a/arch/arm/lib/memmove.S
+++ b/arch/arm/lib/memmove.S
@@ -13,7 +13,6 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
                 .text
 
@@ -226,4 +225,3 @@ ENTRY(memmove)
 18:             backward_copy_shift     push=24 pull=8
 
 ENDPROC(memmove)
-EXPORT_SYMBOL(memmove)
diff --git a/arch/arm/lib/memset.S b/arch/arm/lib/memset.S
index 7b72044cba62..3c65e3bd790f 100644
--- a/arch/arm/lib/memset.S
+++ b/arch/arm/lib/memset.S
@@ -12,7 +12,6 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
         .text
         .align  5
@@ -136,5 +135,3 @@ UNWIND( .fnstart            )
 UNWIND( .fnend   )
 ENDPROC(memset)
 ENDPROC(mmioset)
-EXPORT_SYMBOL(memset)
-EXPORT_SYMBOL(mmioset)
diff --git a/arch/arm/lib/memzero.S b/arch/arm/lib/memzero.S
index 6dec26ed5bcc..0eded952e089 100644
--- a/arch/arm/lib/memzero.S
+++ b/arch/arm/lib/memzero.S
@@ -10,7 +10,6 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
 #include <asm/unwind.h>
-#include <asm/export.h>
 
         .text
         .align  5
@@ -136,4 +135,3 @@ UNWIND(	.fnstart			)
         ret     lr                      @ 1
 UNWIND( .fnend                          )
 ENDPROC(__memzero)
-EXPORT_SYMBOL(__memzero)
diff --git a/arch/arm/lib/muldi3.S b/arch/arm/lib/muldi3.S
index b8f12388ccac..204305956925 100644
--- a/arch/arm/lib/muldi3.S
+++ b/arch/arm/lib/muldi3.S
@@ -12,7 +12,6 @@
 
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 #ifdef __ARMEB__
 #define xh r0
@@ -47,5 +46,3 @@ ENTRY(__aeabi_lmul)
 
 ENDPROC(__muldi3)
 ENDPROC(__aeabi_lmul)
-EXPORT_SYMBOL(__muldi3)
-EXPORT_SYMBOL(__aeabi_lmul)
diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S
index 11de126e2ed6..38d660d3705f 100644
--- a/arch/arm/lib/putuser.S
+++ b/arch/arm/lib/putuser.S
@@ -31,7 +31,6 @@
 #include <asm/assembler.h>
 #include <asm/errno.h>
 #include <asm/domain.h>
-#include <asm/export.h>
 
 ENTRY(__put_user_1)
         check_uaccess r0, 1, r1, ip, __put_user_bad
@@ -39,7 +38,6 @@ ENTRY(__put_user_1)
         mov     r0, #0
         ret     lr
 ENDPROC(__put_user_1)
-EXPORT_SYMBOL(__put_user_1)
 
 ENTRY(__put_user_2)
         check_uaccess r0, 2, r1, ip, __put_user_bad
@@ -64,7 +62,6 @@ ENTRY(__put_user_2)
         mov     r0, #0
         ret     lr
 ENDPROC(__put_user_2)
-EXPORT_SYMBOL(__put_user_2)
 
 ENTRY(__put_user_4)
         check_uaccess r0, 4, r1, ip, __put_user_bad
@@ -72,7 +69,6 @@ ENTRY(__put_user_4)
         mov     r0, #0
         ret     lr
 ENDPROC(__put_user_4)
-EXPORT_SYMBOL(__put_user_4)
 
 ENTRY(__put_user_8)
         check_uaccess r0, 8, r1, ip, __put_user_bad
@@ -86,7 +82,6 @@ ENTRY(__put_user_8)
         mov     r0, #0
         ret     lr
 ENDPROC(__put_user_8)
-EXPORT_SYMBOL(__put_user_8)
 
 __put_user_bad:
         mov     r0, #-EFAULT
diff --git a/arch/arm/lib/strchr.S b/arch/arm/lib/strchr.S
index 7301f6e6046c..013d64c71e8d 100644
--- a/arch/arm/lib/strchr.S
+++ b/arch/arm/lib/strchr.S
@@ -11,7 +11,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
                 .text
                 .align  5
@@ -26,4 +25,3 @@ ENTRY(strchr)
                 subeq   r0, r0, #1
                 ret     lr
 ENDPROC(strchr)
-EXPORT_SYMBOL(strchr)
diff --git a/arch/arm/lib/strrchr.S b/arch/arm/lib/strrchr.S
index aaf9fd98b754..3cec1c7482c4 100644
--- a/arch/arm/lib/strrchr.S
+++ b/arch/arm/lib/strrchr.S
@@ -11,7 +11,6 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
                 .text
                 .align  5
@@ -25,4 +24,3 @@ ENTRY(strrchr)
                 mov     r0, r3
                 ret     lr
 ENDPROC(strrchr)
-EXPORT_SYMBOL(strrchr)
diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
index 1626e3a551a1..6bd1089b07e0 100644
--- a/arch/arm/lib/uaccess_with_memcpy.c
+++ b/arch/arm/lib/uaccess_with_memcpy.c
@@ -19,7 +19,6 @@
 #include <linux/gfp.h>
 #include <linux/highmem.h>
 #include <linux/hugetlb.h>
-#include <linux/export.h>
 #include <asm/current.h>
 #include <asm/page.h>
 
@@ -157,7 +156,6 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
         }
         return n;
 }
-EXPORT_SYMBOL(arm_copy_to_user);
         
 static unsigned long noinline
 __clear_user_memset(void __user *addr, unsigned long n)
@@ -215,7 +213,6 @@ unsigned long arm_clear_user(void __user *addr, unsigned long n)
         }
         return n;
 }
-EXPORT_SYMBOL(arm_clear_user);
 
 #if 0
 
diff --git a/arch/arm/lib/ucmpdi2.S b/arch/arm/lib/ucmpdi2.S
index 127a91af46f3..ad4a6309141a 100644
--- a/arch/arm/lib/ucmpdi2.S
+++ b/arch/arm/lib/ucmpdi2.S
@@ -12,7 +12,6 @@
 
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 #ifdef __ARMEB__
 #define xh r0
@@ -36,7 +35,6 @@ ENTRY(__ucmpdi2)
         ret     lr
 
 ENDPROC(__ucmpdi2)
-EXPORT_SYMBOL(__ucmpdi2)
 
 #ifdef CONFIG_AEABI
 
@@ -50,7 +48,6 @@ ENTRY(__aeabi_ulcmp)
         ret     lr
 
 ENDPROC(__aeabi_ulcmp)
-EXPORT_SYMBOL(__aeabi_ulcmp)
 
 #endif
 
diff --git a/arch/arm/mach-imx/Makefile b/arch/arm/mach-imx/Makefile
index 737450fe790c..cab128913e72 100644
--- a/arch/arm/mach-imx/Makefile
+++ b/arch/arm/mach-imx/Makefile
@@ -32,6 +32,7 @@ endif
 
 ifdef CONFIG_SND_IMX_SOC
 obj-y += ssi-fiq.o
+obj-y += ssi-fiq-ksym.o
 endif
 
 # i.MX21 based machines
diff --git a/arch/arm/mach-imx/ssi-fiq-ksym.c b/arch/arm/mach-imx/ssi-fiq-ksym.c
new file mode 100644
index 000000000000..792090f9a032
--- /dev/null
+++ b/arch/arm/mach-imx/ssi-fiq-ksym.c
@@ -0,0 +1,20 @@
+/*
+ * Exported ksyms for the SSI FIQ handler
+ *
+ * Copyright (C) 2009, Sascha Hauer <s.hauer@pengutronix.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+
+#include <linux/platform_data/asoc-imx-ssi.h>
+
+EXPORT_SYMBOL(imx_ssi_fiq_tx_buffer);
+EXPORT_SYMBOL(imx_ssi_fiq_rx_buffer);
+EXPORT_SYMBOL(imx_ssi_fiq_start);
+EXPORT_SYMBOL(imx_ssi_fiq_end);
+EXPORT_SYMBOL(imx_ssi_fiq_base);
+
diff --git a/arch/arm/mach-imx/ssi-fiq.S b/arch/arm/mach-imx/ssi-fiq.S
index fd7917f1c204..a8b93c5f29b5 100644
--- a/arch/arm/mach-imx/ssi-fiq.S
+++ b/arch/arm/mach-imx/ssi-fiq.S
@@ -8,7 +8,6 @@
 
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/export.h>
 
 /*
  * r8  = bit 0-15: tx offset, bit 16-31: tx buffer size
@@ -145,8 +144,4 @@ imx_ssi_fiq_tx_buffer:
                 .word 0x0
 .L_imx_ssi_fiq_end:
 imx_ssi_fiq_end:
-EXPORT_SYMBOL(imx_ssi_fiq_tx_buffer)
-EXPORT_SYMBOL(imx_ssi_fiq_rx_buffer)
-EXPORT_SYMBOL(imx_ssi_fiq_start)
-EXPORT_SYMBOL(imx_ssi_fiq_end)
-EXPORT_SYMBOL(imx_ssi_fiq_base)
+
diff --git a/arch/arm64/boot/dts/arm/juno-base.dtsi b/arch/arm64/boot/dts/arm/juno-base.dtsi
index 334271a25f70..7d3a2acc6a55 100644
--- a/arch/arm64/boot/dts/arm/juno-base.dtsi
+++ b/arch/arm64/boot/dts/arm/juno-base.dtsi
@@ -393,7 +393,7 @@
                 #address-cells = <3>;
                 #size-cells = <2>;
                 dma-coherent;
-                ranges = <0x01000000 0x00 0x5f800000 0x00 0x5f800000 0x0 0x00800000>,
+                ranges = <0x01000000 0x00 0x00000000 0x00 0x5f800000 0x0 0x00800000>,
                          <0x02000000 0x00 0x50000000 0x00 0x50000000 0x0 0x08000000>,
                          <0x42000000 0x40 0x00000000 0x40 0x00000000 0x1 0x00000000>;
                 #interrupt-cells = <1>;
diff --git a/arch/arm64/boot/dts/arm/juno-r1.dts b/arch/arm64/boot/dts/arm/juno-r1.dts
index 123a58b29cbd..f0b857d6d73c 100644
--- a/arch/arm64/boot/dts/arm/juno-r1.dts
+++ b/arch/arm64/boot/dts/arm/juno-r1.dts
@@ -76,7 +76,7 @@
                                 compatible = "arm,idle-state";
                                 arm,psci-suspend-param = <0x1010000>;
                                 local-timer-stop;
-                                entry-latency-us = <300>;
+                                entry-latency-us = <400>;
                                 exit-latency-us = <1200>;
                                 min-residency-us = <2500>;
                         };
diff --git a/arch/arm64/boot/dts/arm/juno-r2.dts b/arch/arm64/boot/dts/arm/juno-r2.dts
index 007be826efce..26aaa6a7670f 100644
--- a/arch/arm64/boot/dts/arm/juno-r2.dts
+++ b/arch/arm64/boot/dts/arm/juno-r2.dts
@@ -76,7 +76,7 @@
                                 compatible = "arm,idle-state";
                                 arm,psci-suspend-param = <0x1010000>;
                                 local-timer-stop;
-                                entry-latency-us = <300>;
+                                entry-latency-us = <400>;
                                 exit-latency-us = <1200>;
                                 min-residency-us = <2500>;
                         };
diff --git a/arch/arm64/boot/dts/arm/juno.dts b/arch/arm64/boot/dts/arm/juno.dts
index a7270eff6939..6e154d948a80 100644
--- a/arch/arm64/boot/dts/arm/juno.dts
+++ b/arch/arm64/boot/dts/arm/juno.dts
@@ -76,7 +76,7 @@
                                 compatible = "arm,idle-state";
                                 arm,psci-suspend-param = <0x1010000>;
                                 local-timer-stop;
-                                entry-latency-us = <300>;
+                                entry-latency-us = <400>;
                                 exit-latency-us = <1200>;
                                 min-residency-us = <2500>;
                         };
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index 55be7e3ff109..b98acd15ca22 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -95,9 +95,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -105,8 +106,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -366,6 +369,7 @@ CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_3COM is not set
+# CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_A2065=y
 CONFIG_ARIADNE=y
 # CONFIG_NET_VENDOR_ARC is not set
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index 365dda66b0e6..f80dc57e6374 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -93,9 +93,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -103,8 +104,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -347,6 +350,7 @@ CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_AMAZON is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index ce3cbfd16fcd..4e16b1821fbb 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -93,9 +93,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -103,8 +104,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -356,6 +359,7 @@ CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_ATARILANCE=y
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index 8db496a9797d..2767bbf5ad61 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -91,9 +91,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -101,8 +102,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -346,6 +349,7 @@ CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_AMAZON is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index 8314156f7149..d13ba309265e 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -93,9 +93,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -103,8 +104,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -347,6 +350,7 @@ CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_HPLANCE=y
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index 6600270b9622..78b5101c1aa6 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -92,9 +92,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -102,8 +103,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -363,6 +366,7 @@ CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_MACMACE=y
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 90abfe9eabba..38e5bcbd0d62 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -102,9 +102,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -112,8 +113,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -397,6 +400,7 @@ CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_3COM is not set
+# CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_A2065=y
 CONFIG_ARIADNE=y
 CONFIG_ATARILANCE=y
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index 0d502c2f73d5..28687192b68e 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -90,9 +90,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -100,8 +101,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -345,6 +348,7 @@ CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_MVME147_NET=y
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index 5930e91fc710..5a5f109ab3cd 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -91,9 +91,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -101,8 +102,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -346,6 +349,7 @@ CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_AMAZON is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index 74e3ad82eca9..e557c9de3fbc 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -91,9 +91,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -101,8 +102,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -353,6 +356,7 @@ CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_3COM is not set
+# CONFIG_NET_VENDOR_AMAZON is not set
 # CONFIG_NET_VENDOR_AMD is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index 4ba8606a4e69..c6a748a36daf 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -88,9 +88,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -98,8 +99,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -343,6 +346,7 @@ CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_SUN3LANCE=y
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index c6f49726a6c9..10d60857b9a6 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -88,9 +88,10 @@ CONFIG_NF_TABLES_INET=m
 CONFIG_NF_TABLES_NETDEV=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
+CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
+CONFIG_NFT_SET_RBTREE=m
+CONFIG_NFT_SET_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -98,8 +99,10 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
@@ -343,6 +346,7 @@ CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_SUN3LANCE=y
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
diff --git a/arch/m68k/include/asm/delay.h b/arch/m68k/include/asm/delay.h
index d28fa8fe26fe..c598d847d56b 100644
--- a/arch/m68k/include/asm/delay.h
+++ b/arch/m68k/include/asm/delay.h
@@ -114,6 +114,6 @@ static inline void __udelay(unsigned long usecs)
  */
 #define HZSCALE         (268435456 / (1000000 / HZ))
 
-#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000));
+#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000))
 
 #endif /* defined(_M68K_DELAY_H) */
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index 7dd2dd47909a..df78b2ca70eb 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -215,6 +215,12 @@
 #endif
 
 /*
+ * Wired register bits
+ */
+#define MIPSR6_WIRED_LIMIT      (_ULCAST_(0xffff) << 16)
+#define MIPSR6_WIRED_WIRED      (_ULCAST_(0xffff) << 0)
+
+/*
  * Values used for computation of new tlb entries
  */
 #define PL_4K           12
diff --git a/arch/mips/include/asm/tlb.h b/arch/mips/include/asm/tlb.h
index 4a2349302b55..dd179fd8acda 100644
--- a/arch/mips/include/asm/tlb.h
+++ b/arch/mips/include/asm/tlb.h
@@ -1,6 +1,9 @@
 #ifndef __ASM_TLB_H
 #define __ASM_TLB_H
 
+#include <asm/cpu-features.h>
+#include <asm/mipsregs.h>
+
 /*
  * MIPS doesn't need any special per-pte or per-vma handling, except
  * we need to flush cache for area to be unmapped.
@@ -22,6 +25,16 @@
                 ((CKSEG0 + ((idx) << (PAGE_SHIFT + 1))) |               \
                  (cpu_has_tlbinv ? MIPS_ENTRYHI_EHINV : 0))
 
+static inline unsigned int num_wired_entries(void)
+{
+        unsigned int wired = read_c0_wired();
+
+        if (cpu_has_mips_r6)
+                wired &= MIPSR6_WIRED_WIRED;
+
+        return wired;
+}
+
 #include <asm-generic/tlb.h>
 
 #endif /* __ASM_TLB_H */
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
index d56a855828c2..3bef306cdfdb 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -209,17 +209,18 @@ bad_area_nosemaphore:
                 if (show_unhandled_signals &&
                     unhandled_signal(tsk, SIGSEGV) &&
                     __ratelimit(&ratelimit_state)) {
-                        pr_info("\ndo_page_fault(): sending SIGSEGV to %s for invalid %s %0*lx",
+                        pr_info("do_page_fault(): sending SIGSEGV to %s for invalid %s %0*lx\n",
                                 tsk->comm,
                                 write ? "write access to" : "read access from",
                                 field, address);
                         pr_info("epc = %0*lx in", field,
                                 (unsigned long) regs->cp0_epc);
-                        print_vma_addr(" ", regs->cp0_epc);
+                        print_vma_addr(KERN_CONT " ", regs->cp0_epc);
+                        pr_cont("\n");
                         pr_info("ra  = %0*lx in", field,
                                 (unsigned long) regs->regs[31]);
-                        print_vma_addr(" ", regs->regs[31]);
-                        pr_info("\n");
+                        print_vma_addr(KERN_CONT " ", regs->regs[31]);
+                        pr_cont("\n");
                 }
                 current->thread.trap_nr = (regs->cp0_cause >> 2) & 0x1f;
                 info.si_signo = SIGSEGV;
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index 3a6edecc3f38..e86ebcf5c071 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -118,7 +118,7 @@ static void *__kmap_pgprot(struct page *page, unsigned long addr, pgprot_t prot)
                 writex_c0_entrylo1(entrylo);
         }
 #endif
-        tlbidx = read_c0_wired();
+        tlbidx = num_wired_entries();
         write_c0_wired(tlbidx + 1);
         write_c0_index(tlbidx);
         mtc0_tlbw_hazard();
@@ -147,7 +147,7 @@ void kunmap_coherent(void)
 
         local_irq_save(flags);
         old_ctx = read_c0_entryhi();
-        wired = read_c0_wired() - 1;
+        wired = num_wired_entries() - 1;
         write_c0_wired(wired);
         write_c0_index(wired);
         write_c0_entryhi(UNIQUE_ENTRYHI(wired));
diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index bba9c1484b41..0596505770db 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -65,7 +65,7 @@ void local_flush_tlb_all(void)
         write_c0_entrylo0(0);
         write_c0_entrylo1(0);
 
-        entry = read_c0_wired();
+        entry = num_wired_entries();
 
         /*
          * Blast 'em all away.
@@ -385,7 +385,7 @@ void add_wired_entry(unsigned long entrylo0, unsigned long entrylo1,
         old_ctx = read_c0_entryhi();
         htw_stop();
         old_pagemask = read_c0_pagemask();
-        wired = read_c0_wired();
+        wired = num_wired_entries();
         write_c0_wired(wired + 1);
         write_c0_index(wired);
         tlbw_use_hazard();      /* What is the hazard here? */
@@ -449,7 +449,7 @@ __init int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
         htw_stop();
         old_ctx = read_c0_entryhi();
         old_pagemask = read_c0_pagemask();
-        wired = read_c0_wired();
+        wired = num_wired_entries();
         if (--temp_tlb_entry < wired) {
                 printk(KERN_WARNING
                        "No TLB space left for add_temporary_entry\n");
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index 71c4a3aa3752..a14b86587013 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -34,7 +34,9 @@ config PARISC
         select HAVE_ARCH_HASH
         select HAVE_ARCH_SECCOMP_FILTER
         select HAVE_ARCH_TRACEHOOK
-        select HAVE_UNSTABLE_SCHED_CLOCK if (SMP || !64BIT)
+        select GENERIC_SCHED_CLOCK
+        select HAVE_UNSTABLE_SCHED_CLOCK if SMP
+        select GENERIC_CLOCKEVENTS
         select ARCH_NO_COHERENT_DMA_MMAP
         select CPU_NO_EFFICIENT_FFS
 
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
index c2c43f714684..3a4ed9f91d57 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -65,9 +65,9 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
                 unsigned long flags;                            \
                 spin_lock_irqsave(&pa_tlb_lock, flags);         \
                 old_pte = *ptep;                                \
-                set_pte(ptep, pteval);                          \
                 if (pte_inserted(old_pte))                      \
                         purge_tlb_entries(mm, addr);            \
+                set_pte(ptep, pteval);                          \
                 spin_unlock_irqrestore(&pa_tlb_lock, flags);    \
         } while (0)
 
@@ -478,8 +478,8 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned
                 spin_unlock_irqrestore(&pa_tlb_lock, flags);
                 return 0;
         }
-        set_pte(ptep, pte_mkold(pte));
         purge_tlb_entries(vma->vm_mm, addr);
+        set_pte(ptep, pte_mkold(pte));
         spin_unlock_irqrestore(&pa_tlb_lock, flags);
         return 1;
 }
@@ -492,9 +492,9 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
 
         spin_lock_irqsave(&pa_tlb_lock, flags);
         old_pte = *ptep;
-        set_pte(ptep, __pte(0));
         if (pte_inserted(old_pte))
                 purge_tlb_entries(mm, addr);
+        set_pte(ptep, __pte(0));
         spin_unlock_irqrestore(&pa_tlb_lock, flags);
 
         return old_pte;
@@ -504,8 +504,8 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr,
 {
         unsigned long flags;
         spin_lock_irqsave(&pa_tlb_lock, flags);
-        set_pte(ptep, pte_wrprotect(*ptep));
         purge_tlb_entries(mm, addr);
+        set_pte(ptep, pte_wrprotect(*ptep));
         spin_unlock_irqrestore(&pa_tlb_lock, flags);
 }
 
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index 629eb464d5ba..977f0a4f5ecf 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -369,6 +369,7 @@ void __init parisc_setup_cache_timing(void)
 {
         unsigned long rangetime, alltime;
         unsigned long size, start;
+        unsigned long threshold;
 
         alltime = mfctl(16);
         flush_data_cache();
@@ -382,26 +383,30 @@ void __init parisc_setup_cache_timing(void)
         printk(KERN_DEBUG "Whole cache flush %lu cycles, flushing %lu bytes %lu cycles\n",
                 alltime, size, rangetime);
 
-        /* Racy, but if we see an intermediate value, it's ok too... */
-        parisc_cache_flush_threshold = size * alltime / rangetime;
-
-        parisc_cache_flush_threshold = L1_CACHE_ALIGN(parisc_cache_flush_threshold);
-        if (!parisc_cache_flush_threshold)
-                parisc_cache_flush_threshold = FLUSH_THRESHOLD;
-
-        if (parisc_cache_flush_threshold > cache_info.dc_size)
-                parisc_cache_flush_threshold = cache_info.dc_size;
-
-        printk(KERN_INFO "Setting cache flush threshold to %lu kB\n",
+        threshold = L1_CACHE_ALIGN(size * alltime / rangetime);
+        if (threshold > cache_info.dc_size)
+                threshold = cache_info.dc_size;
+        if (threshold)
+                parisc_cache_flush_threshold = threshold;
+        printk(KERN_INFO "Cache flush threshold set to %lu KiB\n",
                 parisc_cache_flush_threshold/1024);
 
         /* calculate TLB flush threshold */
 
+        /* On SMP machines, skip the TLB measure of kernel text which
+         * has been mapped as huge pages. */
+        if (num_online_cpus() > 1 && !parisc_requires_coherency()) {
+                threshold = max(cache_info.it_size, cache_info.dt_size);
+                threshold *= PAGE_SIZE;
+                threshold /= num_online_cpus();
+                goto set_tlb_threshold;
+        }
+
         alltime = mfctl(16);
         flush_tlb_all();
         alltime = mfctl(16) - alltime;
 
-        size = PAGE_SIZE;
+        size = 0;
         start = (unsigned long) _text;
         rangetime = mfctl(16);
         while (start < (unsigned long) _end) {
@@ -414,13 +419,12 @@ void __init parisc_setup_cache_timing(void)
         printk(KERN_DEBUG "Whole TLB flush %lu cycles, flushing %lu bytes %lu cycles\n",
                 alltime, size, rangetime);
 
-        parisc_tlb_flush_threshold = size * alltime / rangetime;
-        parisc_tlb_flush_threshold *= num_online_cpus();
-        parisc_tlb_flush_threshold = PAGE_ALIGN(parisc_tlb_flush_threshold);
-        if (!parisc_tlb_flush_threshold)
-                parisc_tlb_flush_threshold = FLUSH_TLB_THRESHOLD;
+        threshold = PAGE_ALIGN(num_online_cpus() * size * alltime / rangetime);
 
-        printk(KERN_INFO "Setting TLB flush threshold to %lu kB\n",
+set_tlb_threshold:
+        if (threshold)
+                parisc_tlb_flush_threshold = threshold;
+        printk(KERN_INFO "TLB flush threshold set to %lu KiB\n",
                 parisc_tlb_flush_threshold/1024);
 }
 
diff --git a/arch/parisc/kernel/inventory.c b/arch/parisc/kernel/inventory.c
index 545f9d2fe711..c05d1876d27c 100644
--- a/arch/parisc/kernel/inventory.c
+++ b/arch/parisc/kernel/inventory.c
@@ -58,7 +58,7 @@ void __init setup_pdc(void)
         status = pdc_system_map_find_mods(&module_result, &module_path, 0);
         if (status == PDC_OK) {
                 pdc_type = PDC_TYPE_SYSTEM_MAP;
-                printk("System Map.\n");
+                pr_cont("System Map.\n");
                 return;
         }
 
@@ -77,7 +77,7 @@ void __init setup_pdc(void)
         status = pdc_pat_cell_get_number(&cell_info);
         if (status == PDC_OK) {
                 pdc_type = PDC_TYPE_PAT;
-                printk("64 bit PAT.\n");
+                pr_cont("64 bit PAT.\n");
                 return;
         }
 #endif
@@ -97,12 +97,12 @@ void __init setup_pdc(void)
         case 0xC:               /* 715/64, at least */
 
                 pdc_type = PDC_TYPE_SNAKE;
-                printk("Snake.\n");
+                pr_cont("Snake.\n");
                 return;
 
         default:                /* Everything else */
 
-                printk("Unsupported.\n");
+                pr_cont("Unsupported.\n");
                 panic("If this is a 64-bit machine, please try a 64-bit kernel.\n");
         }
 }
diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
index 985e06da37f5..adf7187f8951 100644
--- a/arch/parisc/kernel/pacache.S
+++ b/arch/parisc/kernel/pacache.S
@@ -96,7 +96,7 @@ fitmanyloop:					/* Loop if LOOP >= 2 */
 
 fitmanymiddle:                                  /* Loop if LOOP >= 2 */
         addib,COND(>)           -1, %r31, fitmanymiddle /* Adjusted inner loop decr */
-        pitlbe          0(%sr1, %r28)
+        pitlbe          %r0(%sr1, %r28)
         pitlbe,m        %arg1(%sr1, %r28)       /* Last pitlbe and addr adjust */
         addib,COND(>)           -1, %r29, fitmanymiddle /* Middle loop decr */
         copy            %arg3, %r31             /* Re-init inner loop count */
@@ -139,7 +139,7 @@ fdtmanyloop:					/* Loop if LOOP >= 2 */
 
 fdtmanymiddle:                                  /* Loop if LOOP >= 2 */
         addib,COND(>)           -1, %r31, fdtmanymiddle /* Adjusted inner loop decr */
-        pdtlbe          0(%sr1, %r28)
+        pdtlbe          %r0(%sr1, %r28)
         pdtlbe,m        %arg1(%sr1, %r28)       /* Last pdtlbe and addr adjust */
         addib,COND(>)           -1, %r29, fdtmanymiddle /* Middle loop decr */
         copy            %arg3, %r31             /* Re-init inner loop count */
@@ -626,12 +626,12 @@ ENTRY_CFI(copy_user_page_asm)
         /* Purge any old translations */
 
 #ifdef CONFIG_PA20
-        pdtlb,l         0(%r28)
-        pdtlb,l         0(%r29)
+        pdtlb,l         %r0(%r28)
+        pdtlb,l         %r0(%r29)
 #else
         tlb_lock        %r20,%r21,%r22
-        pdtlb           0(%r28)
-        pdtlb           0(%r29)
+        pdtlb           %r0(%r28)
+        pdtlb           %r0(%r29)
         tlb_unlock      %r20,%r21,%r22
 #endif
 
@@ -774,10 +774,10 @@ ENTRY_CFI(clear_user_page_asm)
         /* Purge any old translation */
 
 #ifdef CONFIG_PA20
-        pdtlb,l         0(%r28)
+        pdtlb,l         %r0(%r28)
 #else
         tlb_lock        %r20,%r21,%r22
-        pdtlb           0(%r28)
+        pdtlb           %r0(%r28)
         tlb_unlock      %r20,%r21,%r22
 #endif
 
@@ -858,10 +858,10 @@ ENTRY_CFI(flush_dcache_page_asm)
         /* Purge any old translation */
 
 #ifdef CONFIG_PA20
-        pdtlb,l         0(%r28)
+        pdtlb,l         %r0(%r28)
 #else
         tlb_lock        %r20,%r21,%r22
-        pdtlb           0(%r28)
+        pdtlb           %r0(%r28)
         tlb_unlock      %r20,%r21,%r22
 #endif
 
@@ -892,19 +892,10 @@ ENTRY_CFI(flush_dcache_page_asm)
         fdc,m           r31(%r28)
         fdc,m           r31(%r28)
         fdc,m           r31(%r28)
-        cmpb,COND(<<)           %r28, %r25,1b
+        cmpb,COND(<<)   %r28, %r25,1b
         fdc,m           r31(%r28)
 
         sync
-
-#ifdef CONFIG_PA20
-        pdtlb,l         0(%r25)
-#else
-        tlb_lock        %r20,%r21,%r22
-        pdtlb           0(%r25)
-        tlb_unlock      %r20,%r21,%r22
-#endif
-
         bv              %r0(%r2)
         nop
         .exit
@@ -931,13 +922,18 @@ ENTRY_CFI(flush_icache_page_asm)
         depwi           0, 31,PAGE_SHIFT, %r28  /* Clear any offset bits */
 #endif
 
-        /* Purge any old translation */
+        /* Purge any old translation.  Note that the FIC instruction
+         * may use either the instruction or data TLB.  Given that we
+         * have a flat address space, it's not clear which TLB will be
+         * used.  So, we purge both entries.  */
 
 #ifdef CONFIG_PA20
+        pdtlb,l         %r0(%r28)
         pitlb,l         %r0(%sr4,%r28)
 #else
         tlb_lock        %r20,%r21,%r22
-        pitlb           (%sr4,%r28)
+        pdtlb           %r0(%r28)
+        pitlb           %r0(%sr4,%r28)
         tlb_unlock      %r20,%r21,%r22
 #endif
 
@@ -974,15 +970,6 @@ ENTRY_CFI(flush_icache_page_asm)
         fic,m           %r31(%sr4,%r28)
 
         sync
-
-#ifdef CONFIG_PA20
-        pitlb,l         %r0(%sr4,%r25)
-#else
-        tlb_lock        %r20,%r21,%r22
-        pitlb           (%sr4,%r25)
-        tlb_unlock      %r20,%r21,%r22
-#endif
-
         bv              %r0(%r2)
         nop
         .exit
diff --git a/arch/parisc/kernel/pci-dma.c b/arch/parisc/kernel/pci-dma.c
index 02d9ed0f3949..494ff6e8c88a 100644
--- a/arch/parisc/kernel/pci-dma.c
+++ b/arch/parisc/kernel/pci-dma.c
@@ -95,8 +95,8 @@ static inline int map_pte_uncached(pte_t * pte,
 
                 if (!pte_none(*pte))
                         printk(KERN_ERR "map_pte_uncached: page already exists\n");
-                set_pte(pte, __mk_pte(*paddr_ptr, PAGE_KERNEL_UNC));
                 purge_tlb_start(flags);
+                set_pte(pte, __mk_pte(*paddr_ptr, PAGE_KERNEL_UNC));
                 pdtlb_kernel(orig_vaddr);
                 purge_tlb_end(flags);
                 vaddr += PAGE_SIZE;
diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
index 81d6f6391944..2e66a887788e 100644
--- a/arch/parisc/kernel/setup.c
+++ b/arch/parisc/kernel/setup.c
@@ -334,6 +334,10 @@ static int __init parisc_init(void)
         /* tell PDC we're Linux. Nevermind failure. */
         pdc_stable_write(0x40, &osid, sizeof(osid));
         
+        /* start with known state */
+        flush_cache_all_local();
+        flush_tlb_all_local(NULL);
+
         processor_init();
 #ifdef CONFIG_SMP
         pr_info("CPU(s): %d out of %d %s at %d.%06d MHz online\n",
diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
index 9b63b876a13a..325f30d82b64 100644
--- a/arch/parisc/kernel/time.c
+++ b/arch/parisc/kernel/time.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/rtc.h>
 #include <linux/sched.h>
+#include <linux/sched_clock.h>
 #include <linux/kernel.h>
 #include <linux/param.h>
 #include <linux/string.h>
@@ -39,18 +40,6 @@
 
 static unsigned long clocktick __read_mostly;   /* timer cycles per tick */
 
-#ifndef CONFIG_64BIT
-/*
- * The processor-internal cycle counter (Control Register 16) is used as time
- * source for the sched_clock() function.  This register is 64bit wide on a
- * 64-bit kernel and 32bit on a 32-bit kernel. Since sched_clock() always
- * requires a 64bit counter we emulate on the 32-bit kernel the higher 32bits
- * with a per-cpu variable which we increase every time the counter
- * wraps-around (which happens every ~4 secounds).
- */
-static DEFINE_PER_CPU(unsigned long, cr16_high_32_bits);
-#endif
-
 /*
  * We keep time on PA-RISC Linux by using the Interval Timer which is
  * a pair of registers; one is read-only and one is write-only; both
@@ -121,12 +110,6 @@ irqreturn_t __irq_entry timer_interrupt(int irq, void *dev_id)
          */
         mtctl(next_tick, 16);
 
-#if !defined(CONFIG_64BIT)
-        /* check for overflow on a 32bit kernel (every ~4 seconds). */
-        if (unlikely(next_tick < now))
-                this_cpu_inc(cr16_high_32_bits);
-#endif
-
         /* Skip one clocktick on purpose if we missed next_tick.
          * The new CR16 must be "later" than current CR16 otherwise
          * itimer would not fire until CR16 wrapped - e.g 4 seconds
@@ -208,7 +191,7 @@ EXPORT_SYMBOL(profile_pc);
 
 /* clock source code */
 
-static cycle_t read_cr16(struct clocksource *cs)
+static cycle_t notrace read_cr16(struct clocksource *cs)
 {
         return get_cycles();
 }
@@ -287,26 +270,9 @@ void read_persistent_clock(struct timespec *ts)
 }
 
 
-/*
- * sched_clock() framework
- */
-
-static u32 cyc2ns_mul __read_mostly;
-static u32 cyc2ns_shift __read_mostly;
-
-u64 sched_clock(void)
+static u64 notrace read_cr16_sched_clock(void)
 {
-        u64 now;
-
-        /* Get current cycle counter (Control Register 16). */
-#ifdef CONFIG_64BIT
-        now = mfctl(16);
-#else
-        now = mfctl(16) + (((u64) this_cpu_read(cr16_high_32_bits)) << 32);
-#endif
-
-        /* return the value in ns (cycles_2_ns) */
-        return mul_u64_u32_shr(now, cyc2ns_mul, cyc2ns_shift);
+        return get_cycles();
 }
 
 
@@ -316,17 +282,16 @@ u64 sched_clock(void)
 
 void __init time_init(void)
 {
-        unsigned long current_cr16_khz;
+        unsigned long cr16_hz;
 
-        current_cr16_khz = PAGE0->mem_10msec/10;  /* kHz */
         clocktick = (100 * PAGE0->mem_10msec) / HZ;
-
-        /* calculate mult/shift values for cr16 */
-        clocks_calc_mult_shift(&cyc2ns_mul, &cyc2ns_shift, current_cr16_khz,
-                                NSEC_PER_MSEC, 0);
-
         start_cpu_itimer();     /* get CPU 0 started */
 
+        cr16_hz = 100 * PAGE0->mem_10msec;  /* Hz */
+
         /* register at clocksource framework */
-        clocksource_register_khz(&clocksource_cr16, current_cr16_khz);
+        clocksource_register_hz(&clocksource_cr16, cr16_hz);
+
+        /* register as sched_clock source */
+        sched_clock_register(read_cr16_sched_clock, BITS_PER_LONG, cr16_hz);
 }
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index eae2dc8bc218..9d47f2efa830 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -100,7 +100,8 @@ src-wlib-y := string.S crt0.S crtsavres.S stdio.c decompress.c main.c \
                 ns16550.c serial.c simple_alloc.c div64.S util.S \
                 elf_util.c $(zlib-y) devtree.c stdlib.c \
                 oflib.c ofconsole.c cuboot.c mpsc.c cpm-serial.c \
-                uartlite.c mpc52xx-psc.c opal.c opal-calls.S
+                uartlite.c mpc52xx-psc.c opal.c
+src-wlib-$(CONFIG_PPC64_BOOT_WRAPPER) +=  opal-calls.S
 src-wlib-$(CONFIG_40x) += 4xx.c planetcore.c
 src-wlib-$(CONFIG_44x) += 4xx.c ebony.c bamboo.c
 src-wlib-$(CONFIG_8xx) += mpc8xx.c planetcore.c fsl-soc.c
diff --git a/arch/powerpc/boot/main.c b/arch/powerpc/boot/main.c
index 57d42d129033..78aaf4ffd7ab 100644
--- a/arch/powerpc/boot/main.c
+++ b/arch/powerpc/boot/main.c
@@ -232,8 +232,12 @@ void start(void)
                 console_ops.close();
 
         kentry = (kernel_entry_t) vmlinux.addr;
-        if (ft_addr)
-                kentry(ft_addr, 0, NULL);
+        if (ft_addr) {
+                if(platform_ops.kentry)
+                        platform_ops.kentry(ft_addr, vmlinux.addr);
+                else
+                        kentry(ft_addr, 0, NULL);
+        }
         else
                 kentry((unsigned long)initrd.addr, initrd.size,
                        loader_info.promptr);
diff --git a/arch/powerpc/boot/opal-calls.S b/arch/powerpc/boot/opal-calls.S
index ff2f1b97bc53..2a99fc9a3ccf 100644
--- a/arch/powerpc/boot/opal-calls.S
+++ b/arch/powerpc/boot/opal-calls.S
@@ -12,6 +12,19 @@
 
         .text
 
+        .globl opal_kentry
+opal_kentry:
+        /* r3 is the fdt ptr */
+        mtctr r4
+        li      r4, 0
+        li      r5, 0
+        li      r6, 0
+        li      r7, 0
+        ld      r11,opal@got(r2)
+        ld      r8,0(r11)
+        ld      r9,8(r11)
+        bctr
+
 #define OPAL_CALL(name, token)                          \
         .globl name;                                    \
 name:                                                   \
diff --git a/arch/powerpc/boot/opal.c b/arch/powerpc/boot/opal.c
index 1f37e1c1d6d8..0272570d02de 100644
--- a/arch/powerpc/boot/opal.c
+++ b/arch/powerpc/boot/opal.c
@@ -13,7 +13,7 @@
 #include <libfdt.h>
 #include "../include/asm/opal-api.h"
 
-#ifdef __powerpc64__
+#ifdef CONFIG_PPC64_BOOT_WRAPPER
 
 /* Global OPAL struct used by opal-call.S */
 struct opal {
@@ -23,14 +23,25 @@ struct opal {
 
 static u32 opal_con_id;
 
+/* see opal-wrappers.S */
 int64_t opal_console_write(int64_t term_number, u64 *length, const u8 *buffer);
 int64_t opal_console_read(int64_t term_number, uint64_t *length, u8 *buffer);
 int64_t opal_console_write_buffer_space(uint64_t term_number, uint64_t *length);
 int64_t opal_console_flush(uint64_t term_number);
 int64_t opal_poll_events(uint64_t *outstanding_event_mask);
 
+void opal_kentry(unsigned long fdt_addr, void *vmlinux_addr);
+
 static int opal_con_open(void)
 {
+        /*
+         * When OPAL loads the boot kernel it stashes the OPAL base and entry
+         * address in r8 and r9 so the kernel can use the OPAL console
+         * before unflattening the devicetree. While executing the wrapper will
+         * probably trash r8 and r9 so this kentry hook restores them before
+         * entering the decompressed kernel.
+         */
+        platform_ops.kentry = opal_kentry;
         return 0;
 }
 
diff --git a/arch/powerpc/boot/ops.h b/arch/powerpc/boot/ops.h
index 309d1b127e96..fad1862f4b2d 100644
--- a/arch/powerpc/boot/ops.h
+++ b/arch/powerpc/boot/ops.h
@@ -30,6 +30,7 @@ struct platform_ops {
         void *  (*realloc)(void *ptr, unsigned long size);
         void    (*exit)(void);
         void *  (*vmlinux_alloc)(unsigned long size);
+        void    (*kentry)(unsigned long fdt_addr, void *vmlinux_addr);
 };
 extern struct platform_ops platform_ops;
 
diff --git a/arch/powerpc/include/asm/asm-prototypes.h b/arch/powerpc/include/asm/asm-prototypes.h
index d1492736d852..e0baba1535e6 100644
--- a/arch/powerpc/include/asm/asm-prototypes.h
+++ b/arch/powerpc/include/asm/asm-prototypes.h
@@ -14,6 +14,10 @@
 
 #include <linux/threads.h>
 #include <linux/kprobes.h>
+#include <asm/cacheflush.h>
+#include <asm/checksum.h>
+#include <asm/uaccess.h>
+#include <asm/epapr_hcalls.h>
 
 #include <uapi/asm/ucontext.h>
 
@@ -109,4 +113,12 @@ void early_setup_secondary(void);
 /* time */
 void accumulate_stolen_time(void);
 
+/* misc runtime */
+extern u64 __bswapdi2(u64);
+extern s64 __lshrdi3(s64, int);
+extern s64 __ashldi3(s64, int);
+extern s64 __ashrdi3(s64, int);
+extern int __cmpdi2(s64, s64);
+extern int __ucmpdi2(u64, u64);
+
 #endif /* _ASM_POWERPC_ASM_PROTOTYPES_H */
diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
index e88368354e49..e311c25751a4 100644
--- a/arch/powerpc/include/asm/mmu.h
+++ b/arch/powerpc/include/asm/mmu.h
@@ -29,6 +29,12 @@
  */
 
 /*
+ * Kernel read only support.
+ * We added the ppp value 0b110 in ISA 2.04.
+ */
+#define MMU_FTR_KERNEL_RO               ASM_CONST(0x00004000)
+
+/*
  * We need to clear top 16bits of va (from the remaining 64 bits )in
  * tlbie* instructions
  */
@@ -103,10 +109,10 @@
 #define MMU_FTRS_POWER4         MMU_FTRS_DEFAULT_HPTE_ARCH_V2
 #define MMU_FTRS_PPC970         MMU_FTRS_POWER4 | MMU_FTR_TLBIE_CROP_VA
 #define MMU_FTRS_POWER5         MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE
-#define MMU_FTRS_POWER6         MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE
-#define MMU_FTRS_POWER7         MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE
-#define MMU_FTRS_POWER8         MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE
-#define MMU_FTRS_POWER9         MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE
+#define MMU_FTRS_POWER6         MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE | MMU_FTR_KERNEL_RO
+#define MMU_FTRS_POWER7         MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE | MMU_FTR_KERNEL_RO
+#define MMU_FTRS_POWER8         MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE | MMU_FTR_KERNEL_RO
+#define MMU_FTRS_POWER9         MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE | MMU_FTR_KERNEL_RO
 #define MMU_FTRS_CELL           MMU_FTRS_DEFAULT_HPTE_ARCH_V2 | \
                                 MMU_FTR_CI_LARGE_PAGE
 #define MMU_FTRS_PA6T           MMU_FTRS_DEFAULT_HPTE_ARCH_V2 | \
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index 9cd4e8cbc78c..9e1499f98def 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -355,6 +355,7 @@
 #define     LPCR_PECE0          ASM_CONST(0x0000000000004000)   /* ext. exceptions can cause exit */
 #define     LPCR_PECE1          ASM_CONST(0x0000000000002000)   /* decrementer can cause exit */
 #define     LPCR_PECE2          ASM_CONST(0x0000000000001000)   /* machine check etc can cause exit */
+#define     LPCR_PECE_HVEE      ASM_CONST(0x0000400000000000)   /* P9 Wakeup on HV interrupts */
 #define   LPCR_MER              ASM_CONST(0x0000000000000800)   /* Mediated External Exception */
 #define   LPCR_MER_SH           11
 #define   LPCR_TC               ASM_CONST(0x0000000000000200)   /* Translation control */
diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
index 52ff3f025437..37c027ca83b2 100644
--- a/arch/powerpc/kernel/cpu_setup_power.S
+++ b/arch/powerpc/kernel/cpu_setup_power.S
@@ -98,8 +98,8 @@ _GLOBAL(__setup_cpu_power9)
         li      r0,0
         mtspr   SPRN_LPID,r0
         mfspr   r3,SPRN_LPCR
-        ori     r3, r3, LPCR_PECEDH
-        ori     r3, r3, LPCR_HVICE
+        LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE)
+        or      r3, r3, r4
         bl      __init_LPCR
         bl      __init_HFSCR
         bl      __init_tlb_power9
@@ -118,8 +118,8 @@ _GLOBAL(__restore_cpu_power9)
         li      r0,0
         mtspr   SPRN_LPID,r0
         mfspr   r3,SPRN_LPCR
-        ori     r3, r3, LPCR_PECEDH
-        ori     r3, r3, LPCR_HVICE
+        LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE)
+        or      r3, r3, r4
         bl      __init_LPCR
         bl      __init_HFSCR
         bl      __init_tlb_power9
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index a62be72da274..5c31369435f2 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -671,8 +671,10 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus,
 
         /* Clear frozen state */
         rc = eeh_clear_pe_frozen_state(pe, false);
-        if (rc)
+        if (rc) {
+                pci_unlock_rescan_remove();
                 return rc;
+        }
 
         /* Give the system 5 seconds to finish running the user-space
          * hotplug shutdown scripts, e.g. ifdown for ethernet.  Yes,
diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
index 8295f51c1a5f..7394b770ae1f 100644
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -94,8 +94,17 @@ SECTIONS
          * detected, and will result in a crash at boot due to offsets being
          * wrong.
          */
+#ifdef CONFIG_PPC64
+        /*
+         * BLOCK(0) overrides the default output section alignment because
+         * this needs to start right after .head.text in order for fixed
+         * section placement to work.
+         */
+        .text BLOCK(0) : AT(ADDR(.text) - LOAD_OFFSET) {
+#else
         .text : AT(ADDR(.text) - LOAD_OFFSET) {
                 ALIGN_FUNCTION();
+#endif
                 /* careful! __ftr_alt_* sections need to be close to .text */
                 *(.text .fixup __ftr_alt_* .ref.text)
                 SCHED_TEXT
diff --git a/arch/powerpc/mm/hash64_4k.c b/arch/powerpc/mm/hash64_4k.c
index 42c702b3be1f..6fa450c12d6d 100644
--- a/arch/powerpc/mm/hash64_4k.c
+++ b/arch/powerpc/mm/hash64_4k.c
@@ -55,7 +55,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
          */
         rflags = htab_convert_pte_flags(new_pte);
 
-        if (!cpu_has_feature(CPU_FTR_NOEXECUTE) &&
+        if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
             !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
                 rflags = hash_page_do_lazy_icache(rflags, __pte(old_pte), trap);
 
diff --git a/arch/powerpc/mm/hash64_64k.c b/arch/powerpc/mm/hash64_64k.c
index 3bbbea07378c..1a68cb19b0e3 100644
--- a/arch/powerpc/mm/hash64_64k.c
+++ b/arch/powerpc/mm/hash64_64k.c
@@ -87,7 +87,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
         subpg_pte = new_pte & ~subpg_prot;
         rflags = htab_convert_pte_flags(subpg_pte);
 
-        if (!cpu_has_feature(CPU_FTR_NOEXECUTE) &&
+        if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
             !cpu_has_feature(CPU_FTR_COHERENT_ICACHE)) {
 
                 /*
@@ -258,7 +258,7 @@ int __hash_page_64K(unsigned long ea, unsigned long access,
 
         rflags = htab_convert_pte_flags(new_pte);
 
-        if (!cpu_has_feature(CPU_FTR_NOEXECUTE) &&
+        if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
             !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
                 rflags = hash_page_do_lazy_icache(rflags, __pte(old_pte), trap);
 
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 5503078090cd..78dabf065ba9 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -193,8 +193,12 @@ unsigned long htab_convert_pte_flags(unsigned long pteflags)
                 /*
                  * Kernel read only mapped with ppp bits 0b110
                  */
-                if (!(pteflags & _PAGE_WRITE))
-                        rflags |= (HPTE_R_PP0 | 0x2);
+                if (!(pteflags & _PAGE_WRITE)) {
+                        if (mmu_has_feature(MMU_FTR_KERNEL_RO))
+                                rflags |= (HPTE_R_PP0 | 0x2);
+                        else
+                                rflags |= 0x3;
+                }
         } else {
                 if (pteflags & _PAGE_RWX)
                         rflags |= 0x2;
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 9d4bf3ab049e..6e395c996900 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -69,7 +69,7 @@ u64 x86_perf_event_update(struct perf_event *event)
         int shift = 64 - x86_pmu.cntval_bits;
         u64 prev_raw_count, new_raw_count;
         int idx = hwc->idx;
-        s64 delta;
+        u64 delta;
 
         if (idx == INTEL_PMC_IDX_FIXED_BTS)
                 return 0;
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index a74a2dbc0180..cb8522290e6a 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -4034,7 +4034,7 @@ __init int intel_pmu_init(void)
 
         /* Support full width counters using alternative MSR range */
         if (x86_pmu.intel_cap.full_width_write) {
-                x86_pmu.max_period = x86_pmu.cntval_mask;
+                x86_pmu.max_period = x86_pmu.cntval_mask >> 1;
                 x86_pmu.perfctr = MSR_IA32_PMC0;
                 pr_cont("full-width counters, ");
         }
diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
index 4f5ac726335f..da51e5a3e2ff 100644
--- a/arch/x86/events/intel/cstate.c
+++ b/arch/x86/events/intel/cstate.c
@@ -540,6 +540,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
         X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_DESKTOP, snb_cstates),
 
         X86_CSTATES_MODEL(INTEL_FAM6_XEON_PHI_KNL, knl_cstates),
+        X86_CSTATES_MODEL(INTEL_FAM6_XEON_PHI_KNM, knl_cstates),
         { },
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_cstates_match);
diff --git a/arch/x86/include/asm/compat.h b/arch/x86/include/asm/compat.h
index 03d269bed941..24118c0b4640 100644
--- a/arch/x86/include/asm/compat.h
+++ b/arch/x86/include/asm/compat.h
@@ -272,7 +272,6 @@ struct compat_shmid64_ds {
 /*
  * The type of struct elf_prstatus.pr_reg in compatible core dumps.
  */
-#ifdef CONFIG_X86_X32_ABI
 typedef struct user_regs_struct compat_elf_gregset_t;
 
 /* Full regset -- prstatus on x32, otherwise on ia32 */
@@ -281,10 +280,9 @@ typedef struct user_regs_struct compat_elf_gregset_t;
   do { *(int *) (((void *) &((S)->pr_reg)) + R) = (V); } \
   while (0)
 
+#ifdef CONFIG_X86_X32_ABI
 #define COMPAT_USE_64BIT_TIME \
         (!!(task_pt_regs(current)->orig_ax & __X32_SYSCALL_BIT))
-#else
-typedef struct user_regs_struct32 compat_elf_gregset_t;
 #endif
 
 /*
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index aeef53ce93e1..35690a168cf7 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -815,9 +815,9 @@ static __init void map_mmioh_high_uv3(int index, int min_pnode, int max_pnode)
                                 l = li;
                         }
                         addr1 = (base << shift) +
-                                f * (unsigned long)(1 << m_io);
+                                f * (1ULL << m_io);
                         addr2 = (base << shift) +
-                                (l + 1) * (unsigned long)(1 << m_io);
+                                (l + 1) * (1ULL << m_io);
                         pr_info("UV: %s[%03d..%03d] NASID 0x%04x ADDR 0x%016lx - 0x%016lx\n",
                                 id, fi, li, lnasid, addr1, addr2);
                         if (max_io < l)
diff --git a/arch/x86/kernel/unwind_guess.c b/arch/x86/kernel/unwind_guess.c
index b80e8bf43cc6..22881ddcbb9f 100644
--- a/arch/x86/kernel/unwind_guess.c
+++ b/arch/x86/kernel/unwind_guess.c
@@ -7,11 +7,13 @@
 
 unsigned long unwind_get_return_address(struct unwind_state *state)
 {
-        unsigned long addr = READ_ONCE_NOCHECK(*state->sp);
+        unsigned long addr;
 
         if (unwind_done(state))
                 return 0;
 
+        addr = READ_ONCE_NOCHECK(*state->sp);
+
         return ftrace_graph_ret_addr(state->task, &state->graph_idx,
                                      addr, state->sp);
 }
@@ -25,11 +27,12 @@ bool unwind_next_frame(struct unwind_state *state)
                 return false;
 
         do {
-                unsigned long addr = READ_ONCE_NOCHECK(*state->sp);
+                for (state->sp++; state->sp < info->end; state->sp++) {
+                        unsigned long addr = READ_ONCE_NOCHECK(*state->sp);
 
-                for (state->sp++; state->sp < info->end; state->sp++)
                         if (__kernel_text_address(addr))
                                 return true;
+                }
 
                 state->sp = info->next_sp;
 
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index cbd7b92585bb..a3ce9d260d68 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -2105,16 +2105,10 @@ static int em_iret(struct x86_emulate_ctxt *ctxt)
 static int em_jmp_far(struct x86_emulate_ctxt *ctxt)
 {
         int rc;
-        unsigned short sel, old_sel;
-        struct desc_struct old_desc, new_desc;
-        const struct x86_emulate_ops *ops = ctxt->ops;
+        unsigned short sel;
+        struct desc_struct new_desc;
         u8 cpl = ctxt->ops->cpl(ctxt);
 
-        /* Assignment of RIP may only fail in 64-bit mode */
-        if (ctxt->mode == X86EMUL_MODE_PROT64)
-                ops->get_segment(ctxt, &old_sel, &old_desc, NULL,
-                                 VCPU_SREG_CS);
-
         memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2);
 
         rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl,
@@ -2124,12 +2118,10 @@ static int em_jmp_far(struct x86_emulate_ctxt *ctxt)
                 return rc;
 
         rc = assign_eip_far(ctxt, ctxt->src.val, &new_desc);
-        if (rc != X86EMUL_CONTINUE) {
-                WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
-                /* assigning eip failed; restore the old cs */
-                ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS);
-                return rc;
-        }
+        /* Error handling is not implemented. */
+        if (rc != X86EMUL_CONTINUE)
+                return X86EMUL_UNHANDLEABLE;
+
         return rc;
 }
 
@@ -2189,14 +2181,8 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
 {
         int rc;
         unsigned long eip, cs;
-        u16 old_cs;
         int cpl = ctxt->ops->cpl(ctxt);
-        struct desc_struct old_desc, new_desc;
-        const struct x86_emulate_ops *ops = ctxt->ops;
-
-        if (ctxt->mode == X86EMUL_MODE_PROT64)
-                ops->get_segment(ctxt, &old_cs, &old_desc, NULL,
-                                 VCPU_SREG_CS);
+        struct desc_struct new_desc;
 
         rc = emulate_pop(ctxt, &eip, ctxt->op_bytes);
         if (rc != X86EMUL_CONTINUE)
@@ -2213,10 +2199,10 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
         if (rc != X86EMUL_CONTINUE)
                 return rc;
         rc = assign_eip_far(ctxt, eip, &new_desc);
-        if (rc != X86EMUL_CONTINUE) {
-                WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
-                ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS);
-        }
+        /* Error handling is not implemented. */
+        if (rc != X86EMUL_CONTINUE)
+                return X86EMUL_UNHANDLEABLE;
+
         return rc;
 }
 
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 1a22de70f7f7..6e219e5c07d2 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -94,7 +94,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
 static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic)
 {
         ioapic->rtc_status.pending_eoi = 0;
-        bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPUS);
+        bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID);
 }
 
 static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);
diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h
index 7d2692a49657..1cc6e54436db 100644
--- a/arch/x86/kvm/ioapic.h
+++ b/arch/x86/kvm/ioapic.h
@@ -42,13 +42,13 @@ struct kvm_vcpu;
 
 struct dest_map {
         /* vcpu bitmap where IRQ has been sent */
-        DECLARE_BITMAP(map, KVM_MAX_VCPUS);
+        DECLARE_BITMAP(map, KVM_MAX_VCPU_ID);
 
         /*
          * Vector sent to a given vcpu, only valid when
          * the vcpu's bit in map is set
          */
-        u8 vectors[KVM_MAX_VCPUS];
+        u8 vectors[KVM_MAX_VCPU_ID];
 };
 
 
diff --git a/arch/x86/kvm/irq_comm.c b/arch/x86/kvm/irq_comm.c
index 4da03030d5a7..6c0191615f23 100644
--- a/arch/x86/kvm/irq_comm.c
+++ b/arch/x86/kvm/irq_comm.c
@@ -41,6 +41,15 @@ static int kvm_set_pic_irq(struct kvm_kernel_irq_routing_entry *e,
                            bool line_status)
 {
         struct kvm_pic *pic = pic_irqchip(kvm);
+
+        /*
+         * XXX: rejecting pic routes when pic isn't in use would be better,
+         * but the default routing table is installed while kvm->arch.vpic is
+         * NULL and KVM_CREATE_IRQCHIP can race with KVM_IRQ_LINE.
+         */
+        if (!pic)
+                return -1;
+
         return kvm_pic_set_irq(pic, e->irqchip.pin, irq_source_id, level);
 }
 
@@ -49,6 +58,10 @@ static int kvm_set_ioapic_irq(struct kvm_kernel_irq_routing_entry *e,
                               bool line_status)
 {
         struct kvm_ioapic *ioapic = kvm->arch.vioapic;
+
+        if (!ioapic)
+                return -1;
+
         return kvm_ioapic_set_irq(ioapic, e->irqchip.pin, irq_source_id, level,
                                 line_status);
 }
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 23b99f305382..6f69340f9fa3 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -138,7 +138,7 @@ static inline bool kvm_apic_map_get_logical_dest(struct kvm_apic_map *map,
                 *mask = dest_id & 0xff;
                 return true;
         case KVM_APIC_MODE_XAPIC_CLUSTER:
-                *cluster = map->xapic_cluster_map[dest_id >> 4];
+                *cluster = map->xapic_cluster_map[(dest_id >> 4) & 0xf];
                 *mask = dest_id & 0xf;
                 return true;
         default:
diff --git a/arch/x86/platform/olpc/olpc-xo15-sci.c b/arch/x86/platform/olpc/olpc-xo15-sci.c
index 55130846ac87..c0533fbc39e3 100644
--- a/arch/x86/platform/olpc/olpc-xo15-sci.c
+++ b/arch/x86/platform/olpc/olpc-xo15-sci.c
@@ -196,6 +196,7 @@ static int xo15_sci_remove(struct acpi_device *device)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int xo15_sci_resume(struct device *dev)
 {
         /* Enable all EC events */
@@ -207,6 +208,7 @@ static int xo15_sci_resume(struct device *dev)
 
         return 0;
 }
+#endif
 
 static SIMPLE_DEV_PM_OPS(xo15_sci_pm, NULL, xo15_sci_resume);
 
diff --git a/arch/x86/tools/relocs.h b/arch/x86/tools/relocs.h
index f59590645b68..1d23bf953a4a 100644
--- a/arch/x86/tools/relocs.h
+++ b/arch/x86/tools/relocs.h
@@ -16,7 +16,7 @@
 #include <regex.h>
 #include <tools/le_byteshift.h>
 
-void die(char *fmt, ...);
+void die(char *fmt, ...) __attribute__((noreturn));
 
 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
 
diff --git a/block/blk-map.c b/block/blk-map.c
index b8657fa8dc9a..27fd8d92892d 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -118,6 +118,9 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
         struct iov_iter i;
         int ret;
 
+        if (!iter_is_iovec(iter))
+                goto fail;
+
         if (map_data)
                 copy = true;
         else if (iov_iter_alignment(iter) & align)
@@ -140,6 +143,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
 
 unmap_rq:
         __blk_rq_unmap_user(bio);
+fail:
         rq->bio = NULL;
         return -EINVAL;
 }
diff --git a/crypto/Makefile b/crypto/Makefile
index 99cc64ac70ef..bd6a029094e6 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -40,6 +40,7 @@ obj-$(CONFIG_CRYPTO_ECDH) += ecdh_generic.o
 
 $(obj)/rsapubkey-asn1.o: $(obj)/rsapubkey-asn1.c $(obj)/rsapubkey-asn1.h
 $(obj)/rsaprivkey-asn1.o: $(obj)/rsaprivkey-asn1.c $(obj)/rsaprivkey-asn1.h
+$(obj)/rsa_helper.o: $(obj)/rsapubkey-asn1.h $(obj)/rsaprivkey-asn1.h
 clean-files += rsapubkey-asn1.c rsapubkey-asn1.h
 clean-files += rsaprivkey-asn1.c rsaprivkey-asn1.h
 
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 80a0f1a78551..e9c0993b131d 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -81,7 +81,11 @@ static inline bool aead_sufficient_data(struct aead_ctx *ctx)
 {
         unsigned as = crypto_aead_authsize(crypto_aead_reqtfm(&ctx->aead_req));
 
-        return ctx->used >= ctx->aead_assoclen + as;
+        /*
+         * The minimum amount of memory needed for an AEAD cipher is
+         * the AAD and in case of decryption the tag.
+         */
+        return ctx->used >= ctx->aead_assoclen + (ctx->enc ? 0 : as);
 }
 
 static void aead_reset_ctx(struct aead_ctx *ctx)
@@ -416,7 +420,7 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
         unsigned int i, reqlen = GET_REQ_SIZE(tfm);
         int err = -ENOMEM;
         unsigned long used;
-        size_t outlen;
+        size_t outlen = 0;
         size_t usedpages = 0;
 
         lock_sock(sk);
@@ -426,12 +430,15 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
                         goto unlock;
         }
 
-        used = ctx->used;
-        outlen = used;
-
         if (!aead_sufficient_data(ctx))
                 goto unlock;
 
+        used = ctx->used;
+        if (ctx->enc)
+                outlen = used + as;
+        else
+                outlen = used - as;
+
         req = sock_kmalloc(sk, reqlen, GFP_KERNEL);
         if (unlikely(!req))
                 goto unlock;
@@ -445,7 +452,7 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
         aead_request_set_ad(req, ctx->aead_assoclen);
         aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
                                   aead_async_cb, sk);
-        used -= ctx->aead_assoclen + (ctx->enc ? as : 0);
+        used -= ctx->aead_assoclen;
 
         /* take over all tx sgls from ctx */
         areq->tsgl = sock_kmalloc(sk, sizeof(*areq->tsgl) * sgl->cur,
@@ -461,7 +468,7 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
         areq->tsgls = sgl->cur;
 
         /* create rx sgls */
-        while (iov_iter_count(&msg->msg_iter)) {
+        while (outlen > usedpages && iov_iter_count(&msg->msg_iter)) {
                 size_t seglen = min_t(size_t, iov_iter_count(&msg->msg_iter),
                                       (outlen - usedpages));
 
@@ -491,16 +498,14 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
 
                 last_rsgl = rsgl;
 
-                /* we do not need more iovecs as we have sufficient memory */
-                if (outlen <= usedpages)
-                        break;
-
                 iov_iter_advance(&msg->msg_iter, err);
         }
-        err = -EINVAL;
+
         /* ensure output buffer is sufficiently large */
-        if (usedpages < outlen)
-                goto free;
+        if (usedpages < outlen) {
+                err = -EINVAL;
+                goto unlock;
+        }
 
         aead_request_set_crypt(req, areq->tsgl, areq->first_rsgl.sgl.sg, used,
                                areq->iv);
@@ -571,6 +576,7 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags)
                         goto unlock;
         }
 
+        /* data length provided by caller via sendmsg/sendpage */
         used = ctx->used;
 
         /*
@@ -585,16 +591,27 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags)
         if (!aead_sufficient_data(ctx))
                 goto unlock;
 
-        outlen = used;
+        /*
+         * Calculate the minimum output buffer size holding the result of the
+         * cipher operation. When encrypting data, the receiving buffer is
+         * larger by the tag length compared to the input buffer as the
+         * encryption operation generates the tag. For decryption, the input
+         * buffer provides the tag which is consumed resulting in only the
+         * plaintext without a buffer for the tag returned to the caller.
+         */
+        if (ctx->enc)
+                outlen = used + as;
+        else
+                outlen = used - as;
 
         /*
          * The cipher operation input data is reduced by the associated data
          * length as this data is processed separately later on.
          */
-        used -= ctx->aead_assoclen + (ctx->enc ? as : 0);
+        used -= ctx->aead_assoclen;
 
         /* convert iovecs of output buffers into scatterlists */
-        while (iov_iter_count(&msg->msg_iter)) {
+        while (outlen > usedpages && iov_iter_count(&msg->msg_iter)) {
                 size_t seglen = min_t(size_t, iov_iter_count(&msg->msg_iter),
                                       (outlen - usedpages));
 
@@ -621,16 +638,14 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags)
 
                 last_rsgl = rsgl;
 
-                /* we do not need more iovecs as we have sufficient memory */
-                if (outlen <= usedpages)
-                        break;
                 iov_iter_advance(&msg->msg_iter, err);
         }
 
-        err = -EINVAL;
         /* ensure output buffer is sufficiently large */
-        if (usedpages < outlen)
+        if (usedpages < outlen) {
+                err = -EINVAL;
                 goto unlock;
+        }
 
         sg_mark_end(sgl->sg + sgl->cur - 1);
         aead_request_set_crypt(&ctx->aead_req, sgl->sg, ctx->first_rsgl.sgl.sg,
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index 865f46ea724f..c80765b211cf 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -133,7 +133,6 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
         return cert;
 
 error_decode:
-        kfree(cert->pub->key);
         kfree(ctx);
 error_no_ctx:
         x509_free_certificate(cert);
diff --git a/crypto/drbg.c b/crypto/drbg.c
index fb33f7d3b052..053035b5c8f8 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -262,6 +262,7 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
                               u8 *inbuf, u32 inbuflen,
                               u8 *outbuf, u32 outlen);
 #define DRBG_CTR_NULL_LEN 128
+#define DRBG_OUTSCRATCHLEN DRBG_CTR_NULL_LEN
 
 /* BCC function for CTR DRBG as defined in 10.4.3 */
 static int drbg_ctr_bcc(struct drbg_state *drbg,
@@ -1644,6 +1645,9 @@ static int drbg_fini_sym_kernel(struct drbg_state *drbg)
         kfree(drbg->ctr_null_value_buf);
         drbg->ctr_null_value = NULL;
 
+        kfree(drbg->outscratchpadbuf);
+        drbg->outscratchpadbuf = NULL;
+
         return 0;
 }
 
@@ -1708,6 +1712,15 @@ static int drbg_init_sym_kernel(struct drbg_state *drbg)
         drbg->ctr_null_value = (u8 *)PTR_ALIGN(drbg->ctr_null_value_buf,
                                                alignmask + 1);
 
+        drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask,
+                                         GFP_KERNEL);
+        if (!drbg->outscratchpadbuf) {
+                drbg_fini_sym_kernel(drbg);
+                return -ENOMEM;
+        }
+        drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf,
+                                              alignmask + 1);
+
         return alignmask;
 }
 
@@ -1737,15 +1750,16 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
                               u8 *outbuf, u32 outlen)
 {
         struct scatterlist sg_in;
+        int ret;
 
         sg_init_one(&sg_in, inbuf, inlen);
 
         while (outlen) {
-                u32 cryptlen = min_t(u32, inlen, outlen);
+                u32 cryptlen = min3(inlen, outlen, (u32)DRBG_OUTSCRATCHLEN);
                 struct scatterlist sg_out;
-                int ret;
 
-                sg_init_one(&sg_out, outbuf, cryptlen);
+                /* Output buffer may not be valid for SGL, use scratchpad */
+                sg_init_one(&sg_out, drbg->outscratchpad, cryptlen);
                 skcipher_request_set_crypt(drbg->ctr_req, &sg_in, &sg_out,
                                            cryptlen, drbg->V);
                 ret = crypto_skcipher_encrypt(drbg->ctr_req);
@@ -1761,14 +1775,19 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
                                 break;
                         }
                 default:
-                        return ret;
+                        goto out;
                 }
                 init_completion(&drbg->ctr_completion);
 
+                memcpy(outbuf, drbg->outscratchpad, cryptlen);
+
                 outlen -= cryptlen;
         }
+        ret = 0;
 
-        return 0;
+out:
+        memzero_explicit(drbg->outscratchpad, DRBG_OUTSCRATCHLEN);
+        return ret;
 }
 #endif /* CONFIG_CRYPTO_DRBG_CTR */
 
diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c
index 94ee44acd465..c207458d6299 100644
--- a/crypto/mcryptd.c
+++ b/crypto/mcryptd.c
@@ -254,18 +254,22 @@ out_free_inst:
         goto out;
 }
 
-static inline void mcryptd_check_internal(struct rtattr **tb, u32 *type,
+static inline bool mcryptd_check_internal(struct rtattr **tb, u32 *type,
                                           u32 *mask)
 {
         struct crypto_attr_type *algt;
 
         algt = crypto_get_attr_type(tb);
         if (IS_ERR(algt))
-                return;
-        if ((algt->type & CRYPTO_ALG_INTERNAL))
-                *type |= CRYPTO_ALG_INTERNAL;
-        if ((algt->mask & CRYPTO_ALG_INTERNAL))
-                *mask |= CRYPTO_ALG_INTERNAL;
+                return false;
+
+        *type |= algt->type & CRYPTO_ALG_INTERNAL;
+        *mask |= algt->mask & CRYPTO_ALG_INTERNAL;
+
+        if (*type & *mask & CRYPTO_ALG_INTERNAL)
+                return true;
+        else
+                return false;
 }
 
 static int mcryptd_hash_init_tfm(struct crypto_tfm *tfm)
@@ -492,7 +496,8 @@ static int mcryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
         u32 mask = 0;
         int err;
 
-        mcryptd_check_internal(tb, &type, &mask);
+        if (!mcryptd_check_internal(tb, &type, &mask))
+                return -EINVAL;
 
         halg = ahash_attr_alg(tb[1], type, mask);
         if (IS_ERR(halg))
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 71a7d07c28c9..312c4b4dc363 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -94,7 +94,7 @@ static struct acpi_device *to_acpi_dev(struct acpi_nfit_desc *acpi_desc)
         return to_acpi_device(acpi_desc->dev);
 }
 
-static int xlat_status(void *buf, unsigned int cmd, u32 status)
+static int xlat_bus_status(void *buf, unsigned int cmd, u32 status)
 {
         struct nd_cmd_clear_error *clear_err;
         struct nd_cmd_ars_status *ars_status;
@@ -113,7 +113,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
                 flags = ND_ARS_PERSISTENT | ND_ARS_VOLATILE;
                 if ((status >> 16 & flags) == 0)
                         return -ENOTTY;
-                break;
+                return 0;
         case ND_CMD_ARS_START:
                 /* ARS is in progress */
                 if ((status & 0xffff) == NFIT_ARS_START_BUSY)
@@ -122,7 +122,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
                 /* Command failed */
                 if (status & 0xffff)
                         return -EIO;
-                break;
+                return 0;
         case ND_CMD_ARS_STATUS:
                 ars_status = buf;
                 /* Command failed */
@@ -146,7 +146,8 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
                  * then just continue with the returned results.
                  */
                 if (status == NFIT_ARS_STATUS_INTR) {
-                        if (ars_status->flags & NFIT_ARS_F_OVERFLOW)
+                        if (ars_status->out_length >= 40 && (ars_status->flags
+                                                & NFIT_ARS_F_OVERFLOW))
                                 return -ENOSPC;
                         return 0;
                 }
@@ -154,7 +155,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
                 /* Unknown status */
                 if (status >> 16)
                         return -EIO;
-                break;
+                return 0;
         case ND_CMD_CLEAR_ERROR:
                 clear_err = buf;
                 if (status & 0xffff)
@@ -163,7 +164,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
                         return -EIO;
                 if (clear_err->length > clear_err->cleared)
                         return clear_err->cleared;
-                break;
+                return 0;
         default:
                 break;
         }
@@ -174,9 +175,18 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
         return 0;
 }
 
-static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
-                struct nvdimm *nvdimm, unsigned int cmd, void *buf,
-                unsigned int buf_len, int *cmd_rc)
+static int xlat_status(struct nvdimm *nvdimm, void *buf, unsigned int cmd,
+                u32 status)
+{
+        if (!nvdimm)
+                return xlat_bus_status(buf, cmd, status);
+        if (status)
+                return -EIO;
+        return 0;
+}
+
+int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+                unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc)
 {
         struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
         union acpi_object in_obj, in_buf, *out_obj;
@@ -298,7 +308,8 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
 
         for (i = 0, offset = 0; i < desc->out_num; i++) {
                 u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i, buf,
-                                (u32 *) out_obj->buffer.pointer);
+                                (u32 *) out_obj->buffer.pointer,
+                                out_obj->buffer.length - offset);
 
                 if (offset + out_size > out_obj->buffer.length) {
                         dev_dbg(dev, "%s:%s output object underflow cmd: %s field: %d\n",
@@ -333,7 +344,8 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
                          */
                         rc = buf_len - offset - in_buf.buffer.length;
                         if (cmd_rc)
-                                *cmd_rc = xlat_status(buf, cmd, fw_status);
+                                *cmd_rc = xlat_status(nvdimm, buf, cmd,
+                                                fw_status);
                 } else {
                         dev_err(dev, "%s:%s underrun cmd: %s buf_len: %d out_len: %d\n",
                                         __func__, dimm_name, cmd_name, buf_len,
@@ -343,7 +355,7 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
         } else {
                 rc = 0;
                 if (cmd_rc)
-                        *cmd_rc = xlat_status(buf, cmd, fw_status);
+                        *cmd_rc = xlat_status(nvdimm, buf, cmd, fw_status);
         }
 
  out:
@@ -351,6 +363,7 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
 
         return rc;
 }
+EXPORT_SYMBOL_GPL(acpi_nfit_ctl);
 
 static const char *spa_type_name(u16 type)
 {
@@ -2001,19 +2014,32 @@ static int ars_get_status(struct acpi_nfit_desc *acpi_desc)
         return cmd_rc;
 }
 
-static int ars_status_process_records(struct nvdimm_bus *nvdimm_bus,
+static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc,
                 struct nd_cmd_ars_status *ars_status)
 {
+        struct nvdimm_bus *nvdimm_bus = acpi_desc->nvdimm_bus;
         int rc;
         u32 i;
 
+        /*
+         * First record starts at 44 byte offset from the start of the
+         * payload.
+         */
+        if (ars_status->out_length < 44)
+                return 0;
         for (i = 0; i < ars_status->num_records; i++) {
+                /* only process full records */
+                if (ars_status->out_length
+                                < 44 + sizeof(struct nd_ars_record) * (i + 1))
+                        break;
                 rc = nvdimm_bus_add_poison(nvdimm_bus,
                                 ars_status->records[i].err_address,
                                 ars_status->records[i].length);
                 if (rc)
                         return rc;
         }
+        if (i < ars_status->num_records)
+                dev_warn(acpi_desc->dev, "detected truncated ars results\n");
 
         return 0;
 }
@@ -2266,8 +2292,7 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc,
         if (rc < 0 && rc != -ENOSPC)
                 return rc;
 
-        if (ars_status_process_records(acpi_desc->nvdimm_bus,
-                                acpi_desc->ars_status))
+        if (ars_status_process_records(acpi_desc, acpi_desc->ars_status))
                 return -ENOMEM;
 
         return 0;
diff --git a/drivers/acpi/nfit/nfit.h b/drivers/acpi/nfit/nfit.h
index 14296f5267c8..fc29c2e9832e 100644
--- a/drivers/acpi/nfit/nfit.h
+++ b/drivers/acpi/nfit/nfit.h
@@ -240,5 +240,7 @@ const u8 *to_nfit_uuid(enum nfit_uuids id);
 int acpi_nfit_init(struct acpi_nfit_desc *acpi_desc, void *nfit, acpi_size sz);
 void __acpi_nfit_notify(struct device *dev, acpi_handle handle, u32 event);
 void __acpi_nvdimm_notify(struct device *dev, u32 event);
+int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+                unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc);
 void acpi_nfit_desc_init(struct acpi_nfit_desc *acpi_desc, struct device *dev);
 #endif /* __NFIT_H__ */
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index deb0ff78eba8..54abb26b7366 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -47,32 +47,15 @@ static void acpi_sleep_tts_switch(u32 acpi_state)
         }
 }
 
-static void acpi_sleep_pts_switch(u32 acpi_state)
-{
-        acpi_status status;
-
-        status = acpi_execute_simple_method(NULL, "\\_PTS", acpi_state);
-        if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
-                /*
-                 * OS can't evaluate the _PTS object correctly. Some warning
-                 * message will be printed. But it won't break anything.
-                 */
-                printk(KERN_NOTICE "Failure in evaluating _PTS object\n");
-        }
-}
-
-static int sleep_notify_reboot(struct notifier_block *this,
+static int tts_notify_reboot(struct notifier_block *this,
                         unsigned long code, void *x)
 {
         acpi_sleep_tts_switch(ACPI_STATE_S5);
-
-        acpi_sleep_pts_switch(ACPI_STATE_S5);
-
         return NOTIFY_DONE;
 }
 
-static struct notifier_block sleep_notifier = {
-        .notifier_call  = sleep_notify_reboot,
+static struct notifier_block tts_notifier = {
+        .notifier_call  = tts_notify_reboot,
         .next           = NULL,
         .priority       = 0,
 };
@@ -916,9 +899,9 @@ int __init acpi_sleep_init(void)
         pr_info(PREFIX "(supports%s)\n", supported);
 
         /*
-         * Register the sleep_notifier to reboot notifier list so that the _TTS
-         * and _PTS object can also be evaluated when the system enters S5.
+         * Register the tts_notifier to reboot notifier list so that the _TTS
+         * object can also be evaluated when the system enters S5.
          */
-        register_reboot_notifier(&sleep_notifier);
+        register_reboot_notifier(&tts_notifier);
         return 0;
 }
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 9669fc7c19df..74f4c662f776 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1436,13 +1436,6 @@ static int ahci_init_msi(struct pci_dev *pdev, unsigned int n_ports,
                                 "ahci: MRSM is on, fallback to single MSI\n");
                         pci_free_irq_vectors(pdev);
                 }
-
-                /*
-                 * -ENOSPC indicated we don't have enough vectors.  Don't bother
-                 * trying a single vectors for any other error:
-                 */
-                if (nvec < 0 && nvec != -ENOSPC)
-                        return nvec;
         }
 
         /*
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 9cceb4a875a5..8e575fbdf31d 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1088,7 +1088,7 @@ static void ata_gen_passthru_sense(struct ata_queued_cmd *qc)
                 desc[1] = tf->command; /* status */
                 desc[2] = tf->device;
                 desc[3] = tf->nsect;
-                desc[0] = 0;
+                desc[7] = 0;
                 if (tf->flags & ATA_TFLAG_LBA48)  {
                         desc[8] |= 0x80;
                         if (tf->hob_nsect)
@@ -1159,6 +1159,7 @@ static void ata_scsi_sdev_config(struct scsi_device *sdev)
 {
         sdev->use_10_for_rw = 1;
         sdev->use_10_for_ms = 1;
+        sdev->no_write_same = 1;
 
         /* Schedule policy is determined by ->qc_defer() callback and
          * it needs to see every deferred qc.  Set dev_blocked to 1 to
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index efc48bf89d51..823e938c9a78 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4090,7 +4090,20 @@ static int mv_platform_probe(struct platform_device *pdev)
 
         /* allocate host */
         if (pdev->dev.of_node) {
-                of_property_read_u32(pdev->dev.of_node, "nr-ports", &n_ports);
+                rc = of_property_read_u32(pdev->dev.of_node, "nr-ports",
+                                           &n_ports);
+                if (rc) {
+                        dev_err(&pdev->dev,
+                                "error parsing nr-ports property: %d\n", rc);
+                        return rc;
+                }
+
+                if (n_ports <= 0) {
+                        dev_err(&pdev->dev, "nr-ports must be positive: %d\n",
+                                n_ports);
+                        return -EINVAL;
+                }
+
                 irq = irq_of_parse_and_map(pdev->dev.of_node, 0);
         } else {
                 mv_platform_data = dev_get_platdata(&pdev->dev);
diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
index f2aaf9e32a36..40c2d561417b 100644
--- a/drivers/atm/eni.c
+++ b/drivers/atm/eni.c
@@ -1727,7 +1727,7 @@ static int eni_do_init(struct atm_dev *dev)
                 printk("\n");
                 printk(KERN_ERR DEV_LABEL "(itf %d): can't set up page "
                     "mapping\n",dev->number);
-                return error;
+                return -ENOMEM;
         }
         eni_dev->ioaddr = base;
         eni_dev->base_diff = real_base - (unsigned long) base;
diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
index ce43ae3e87b3..445505d9ea07 100644
--- a/drivers/atm/lanai.c
+++ b/drivers/atm/lanai.c
@@ -2143,6 +2143,7 @@ static int lanai_dev_open(struct atm_dev *atmdev)
         lanai->base = (bus_addr_t) ioremap(raw_base, LANAI_MAPPING_SIZE);
         if (lanai->base == NULL) {
                 printk(KERN_ERR DEV_LABEL ": couldn't remap I/O space\n");
+                result = -ENOMEM;
                 goto error_pci;
         }
         /* 3.3: Reset lanai and PHY */
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 04365b17ee67..5497f7fc44d0 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1403,7 +1403,8 @@ static ssize_t hot_remove_store(struct class *class,
         zram = idr_find(&zram_index_idr, dev_id);
         if (zram) {
                 ret = zram_remove(zram);
-                idr_remove(&zram_index_idr, dev_id);
+                if (!ret)
+                        idr_remove(&zram_index_idr, dev_id);
         } else {
                 ret = -ENODEV;
         }
@@ -1412,8 +1413,14 @@ static ssize_t hot_remove_store(struct class *class,
         return ret ? ret : count;
 }
 
+/*
+ * NOTE: hot_add attribute is not the usual read-only sysfs attribute. In a
+ * sense that reading from this file does alter the state of your system -- it
+ * creates a new un-initialized zram device and returns back this device's
+ * device_id (or an error code if it fails to create a new device).
+ */
 static struct class_attribute zram_control_class_attrs[] = {
-        __ATTR_RO(hot_add),
+        __ATTR(hot_add, 0400, hot_add_show, NULL),
         __ATTR_WO(hot_remove),
         __ATTR_NULL,
 };
diff --git a/drivers/clk/bcm/Kconfig b/drivers/clk/bcm/Kconfig
index f21e9b7afd1a..e3eed5a78404 100644
--- a/drivers/clk/bcm/Kconfig
+++ b/drivers/clk/bcm/Kconfig
@@ -20,7 +20,7 @@ config CLK_BCM_KONA
 
 config COMMON_CLK_IPROC
         bool "Broadcom iProc clock support"
-        depends on ARCH_BCM_IPROC || COMPILE_TEST
+        depends on ARCH_BCM_IPROC || ARCH_BCM_63XX || COMPILE_TEST
         depends on COMMON_CLK
         default ARCH_BCM_IPROC
         help
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
index 4a82a49cff5e..fc75a335a7ce 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
@@ -143,7 +143,7 @@ static SUNXI_CCU_NKM_WITH_MUX_GATE_LOCK(pll_mipi_clk, "pll-mipi",
                                         4, 2,   /* K */
                                         0, 4,   /* M */
                                         21, 0,  /* mux */
-                                        BIT(31),        /* gate */
+                                        BIT(31) | BIT(23) | BIT(22), /* gate */
                                         BIT(28),        /* lock */
                                         CLK_SET_RATE_UNGATE);
 
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
index 96b40ca57697..9bd1f78a0547 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
@@ -131,7 +131,7 @@ static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_mipi_clk, "pll-mipi",
                                     8, 4,               /* N */
                                     4, 2,               /* K */
                                     0, 4,               /* M */
-                                    BIT(31),            /* gate */
+                                    BIT(31) | BIT(23) | BIT(22), /* gate */
                                     BIT(28),            /* lock */
                                     CLK_SET_RATE_UNGATE);
 
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index 72ff19658985..e483b78c6343 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -558,8 +558,9 @@ static int caam_probe(struct platform_device *pdev)
          * Enable DECO watchdogs and, if this is a PHYS_ADDR_T_64BIT kernel,
          * long pointers in master configuration register
          */
-        clrsetbits_32(&ctrl->mcr, MCFGR_AWCACHE_MASK, MCFGR_AWCACHE_CACH |
-                      MCFGR_AWCACHE_BUFF | MCFGR_WDENABLE | MCFGR_LARGE_BURST |
+        clrsetbits_32(&ctrl->mcr, MCFGR_AWCACHE_MASK | MCFGR_LONG_PTR,
+                      MCFGR_AWCACHE_CACH | MCFGR_AWCACHE_BUFF |
+                      MCFGR_WDENABLE | MCFGR_LARGE_BURST |
                       (sizeof(dma_addr_t) == sizeof(u64) ? MCFGR_LONG_PTR : 0));
 
         /*
diff --git a/drivers/crypto/chelsio/chcr_algo.h b/drivers/crypto/chelsio/chcr_algo.h
index ec64fbcdeb49..199b0bb69b89 100644
--- a/drivers/crypto/chelsio/chcr_algo.h
+++ b/drivers/crypto/chelsio/chcr_algo.h
@@ -422,7 +422,7 @@ static inline void get_aes_decrypt_key(unsigned char *dec_key,
 {
         u32 temp;
         u32 w_ring[MAX_NK];
-        int i, j, k = 0;
+        int i, j, k;
         u8  nr, nk;
 
         switch (keylength) {
@@ -460,6 +460,7 @@ static inline void get_aes_decrypt_key(unsigned char *dec_key,
                 temp = w_ring[i % nk];
                 i++;
         }
+        i--;
         for (k = 0, j = i % nk; k < nk; k++) {
                 *((u32 *)dec_key + k) = htonl(w_ring[j]);
                 j--;
diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
index 9f284682c091..77712b375b84 100644
--- a/drivers/crypto/marvell/hash.c
+++ b/drivers/crypto/marvell/hash.c
@@ -168,12 +168,11 @@ static void mv_cesa_ahash_std_step(struct ahash_request *req)
         mv_cesa_adjust_op(engine, &creq->op_tmpl);
         memcpy_toio(engine->sram, &creq->op_tmpl, sizeof(creq->op_tmpl));
 
-        digsize = crypto_ahash_digestsize(crypto_ahash_reqtfm(req));
-        for (i = 0; i < digsize / 4; i++)
-                writel_relaxed(creq->state[i], engine->regs + CESA_IVDIG(i));
-
-        mv_cesa_adjust_op(engine, &creq->op_tmpl);
-        memcpy_toio(engine->sram, &creq->op_tmpl, sizeof(creq->op_tmpl));
+        if (!sreq->offset) {
+                digsize = crypto_ahash_digestsize(crypto_ahash_reqtfm(req));
+                for (i = 0; i < digsize / 4; i++)
+                        writel_relaxed(creq->state[i], engine->regs + CESA_IVDIG(i));
+        }
 
         if (creq->cache_ptr)
                 memcpy_toio(engine->sram + CESA_SA_DATA_SRAM_OFFSET,
diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
index 0e499bfca41c..286447a83dab 100644
--- a/drivers/dax/dax.c
+++ b/drivers/dax/dax.c
@@ -270,8 +270,8 @@ static int check_vma(struct dax_dev *dax_dev, struct vm_area_struct *vma,
         if (!dax_dev->alive)
                 return -ENXIO;
 
-        /* prevent private / writable mappings from being established */
-        if ((vma->vm_flags & (VM_NORESERVE|VM_SHARED|VM_WRITE)) == VM_WRITE) {
+        /* prevent private mappings from being established */
+        if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) {
                 dev_info(dev, "%s: %s: fail, attempted private mapping\n",
                                 current->comm, func);
                 return -EINVAL;
diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
index 4a15fa5df98b..73c6ce93a0d9 100644
--- a/drivers/dax/pmem.c
+++ b/drivers/dax/pmem.c
@@ -78,7 +78,9 @@ static int dax_pmem_probe(struct device *dev)
         nsio = to_nd_namespace_io(&ndns->dev);
 
         /* parse the 'pfn' info block via ->rw_bytes */
-        devm_nsio_enable(dev, nsio);
+        rc = devm_nsio_enable(dev, nsio);
+        if (rc)
+                return rc;
         altmap = nvdimm_setup_pfn(nd_pfn, &res, &__altmap);
         if (IS_ERR(altmap))
                 return PTR_ERR(altmap);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 496f72b134eb..05c2850c04b0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -2472,6 +2472,7 @@ void amdgpu_driver_postclose_kms(struct drm_device *dev,
                                  struct drm_file *file_priv);
 void amdgpu_driver_preclose_kms(struct drm_device *dev,
                                 struct drm_file *file_priv);
+int amdgpu_suspend(struct amdgpu_device *adev);
 int amdgpu_device_suspend(struct drm_device *dev, bool suspend, bool fbcon);
 int amdgpu_device_resume(struct drm_device *dev, bool resume, bool fbcon);
 u32 amdgpu_get_vblank_counter_kms(struct drm_device *dev, unsigned int pipe);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index dae35a96a694..6c343a933182 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -34,6 +34,7 @@ struct amdgpu_atpx {
 
 static struct amdgpu_atpx_priv {
         bool atpx_detected;
+        bool bridge_pm_usable;
         /* handle for device - and atpx */
         acpi_handle dhandle;
         acpi_handle other_handle;
@@ -205,7 +206,11 @@ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
         atpx->is_hybrid = false;
         if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
                 printk("ATPX Hybrid Graphics\n");
-                atpx->functions.power_cntl = false;
+                /*
+                 * Disable legacy PM methods only when pcie port PM is usable,
+                 * otherwise the device might fail to power off or power on.
+                 */
+                atpx->functions.power_cntl = !amdgpu_atpx_priv.bridge_pm_usable;
                 atpx->is_hybrid = true;
         }
 
@@ -555,17 +560,25 @@ static bool amdgpu_atpx_detect(void)
         struct pci_dev *pdev = NULL;
         bool has_atpx = false;
         int vga_count = 0;
+        bool d3_supported = false;
+        struct pci_dev *parent_pdev;
 
         while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
                 vga_count++;
 
                 has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true);
+
+                parent_pdev = pci_upstream_bridge(pdev);
+                d3_supported |= parent_pdev && parent_pdev->bridge_d3;
         }
 
         while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
                 vga_count++;
 
                 has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true);
+
+                parent_pdev = pci_upstream_bridge(pdev);
+                d3_supported |= parent_pdev && parent_pdev->bridge_d3;
         }
 
         if (has_atpx && vga_count == 2) {
@@ -573,6 +586,7 @@ static bool amdgpu_atpx_detect(void)
                 printk(KERN_INFO "vga_switcheroo: detected switching method %s handle\n",
                        acpi_method_name);
                 amdgpu_atpx_priv.atpx_detected = true;
+                amdgpu_atpx_priv.bridge_pm_usable = d3_supported;
                 amdgpu_atpx_init();
                 return true;
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 3161d77bf299..e41d4baebf86 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1493,7 +1493,7 @@ static int amdgpu_fini(struct amdgpu_device *adev)
         return 0;
 }
 
-static int amdgpu_suspend(struct amdgpu_device *adev)
+int amdgpu_suspend(struct amdgpu_device *adev)
 {
         int i, r;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 02ff0747197c..e0890deccb2f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -479,12 +479,15 @@ amdgpu_pci_remove(struct pci_dev *pdev)
 static void
 amdgpu_pci_shutdown(struct pci_dev *pdev)
 {
+        struct drm_device *dev = pci_get_drvdata(pdev);
+        struct amdgpu_device *adev = dev->dev_private;
+
         /* if we are running in a VM, make sure the device
          * torn down properly on reboot/shutdown.
          * unfortunately we can't detect certain
          * hypervisors so just do this all the time.
          */
-        amdgpu_pci_remove(pdev);
+        amdgpu_suspend(adev);
 }
 
 static int amdgpu_pmops_suspend(struct device *dev)
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index 13f2b705ea49..08cd0bd3ebe5 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -2984,19 +2984,19 @@ static int smu7_get_pp_table_entry_callback_func_v0(struct pp_hwmgr *hwmgr,
         if (!(data->mc_micro_code_feature & DISABLE_MC_LOADMICROCODE) && memory_clock > data->highest_mclk)
                 data->highest_mclk = memory_clock;
 
-        performance_level = &(ps->performance_levels
-                        [ps->performance_level_count++]);
-
         PP_ASSERT_WITH_CODE(
                         (ps->performance_level_count < smum_get_mac_definition(hwmgr->smumgr, SMU_MAX_LEVELS_GRAPHICS)),
                         "Performance levels exceeds SMC limit!",
                         return -EINVAL);
 
         PP_ASSERT_WITH_CODE(
-                        (ps->performance_level_count <=
+                        (ps->performance_level_count <
                                         hwmgr->platform_descriptor.hardwareActivityPerformanceLevels),
-                        "Performance levels exceeds Driver limit!",
-                        return -EINVAL);
+                        "Performance levels exceeds Driver limit, Skip!",
+                        return 0);
+
+        performance_level = &(ps->performance_levels
+                        [ps->performance_level_count++]);
 
         /* Performance levels are arranged from low to high. */
         performance_level->memory_clock = memory_clock;
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c
index 4ccc0b72324d..71bb2f8dc157 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c
@@ -2214,6 +2214,7 @@ uint32_t polaris10_get_mac_definition(uint32_t value)
 int polaris10_process_firmware_header(struct pp_hwmgr *hwmgr)
 {
         struct polaris10_smumgr *smu_data = (struct polaris10_smumgr *)(hwmgr->smumgr->backend);
+        struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
         uint32_t tmp;
         int result;
         bool error = false;
@@ -2233,8 +2234,10 @@ int polaris10_process_firmware_header(struct pp_hwmgr *hwmgr)
                         offsetof(SMU74_Firmware_Header, SoftRegisters),
                         &tmp, SMC_RAM_END);
 
-        if (!result)
+        if (!result) {
+                data->soft_regs_start = tmp;
                 smu_data->smu7_data.soft_regs_start = tmp;
+        }
 
         error |= (0 != result);
 
diff --git a/drivers/gpu/drm/arm/hdlcd_crtc.c b/drivers/gpu/drm/arm/hdlcd_crtc.c
index 48019ae22ddb..28341b32067f 100644
--- a/drivers/gpu/drm/arm/hdlcd_crtc.c
+++ b/drivers/gpu/drm/arm/hdlcd_crtc.c
@@ -150,15 +150,14 @@ static void hdlcd_crtc_enable(struct drm_crtc *crtc)
         clk_prepare_enable(hdlcd->clk);
         hdlcd_crtc_mode_set_nofb(crtc);
         hdlcd_write(hdlcd, HDLCD_REG_COMMAND, 1);
+        drm_crtc_vblank_on(crtc);
 }
 
 static void hdlcd_crtc_disable(struct drm_crtc *crtc)
 {
         struct hdlcd_drm_private *hdlcd = crtc_to_hdlcd_priv(crtc);
 
-        if (!crtc->state->active)
-                return;
-
+        drm_crtc_vblank_off(crtc);
         hdlcd_write(hdlcd, HDLCD_REG_COMMAND, 0);
         clk_disable_unprepare(hdlcd->clk);
 }
diff --git a/drivers/gpu/drm/arm/hdlcd_drv.c b/drivers/gpu/drm/arm/hdlcd_drv.c
index fb6a418ce6be..e138fb51e8ce 100644
--- a/drivers/gpu/drm/arm/hdlcd_drv.c
+++ b/drivers/gpu/drm/arm/hdlcd_drv.c
@@ -375,7 +375,6 @@ static int hdlcd_drm_bind(struct device *dev)
 
 err_fbdev:
         drm_kms_helper_poll_fini(drm);
-        drm_mode_config_cleanup(drm);
         drm_vblank_cleanup(drm);
 err_vblank:
         pm_runtime_disable(drm->dev);
@@ -387,6 +386,7 @@ err_unload:
         drm_irq_uninstall(drm);
         of_reserved_mem_device_release(drm->dev);
 err_free:
+        drm_mode_config_cleanup(drm);
         dev_set_drvdata(dev, NULL);
         drm_dev_unref(drm);
 
diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
index 0ad2c47f808f..71c3473476c7 100644
--- a/drivers/gpu/drm/drm_ioctl.c
+++ b/drivers/gpu/drm/drm_ioctl.c
@@ -254,10 +254,12 @@ static int drm_getcap(struct drm_device *dev, void *data, struct drm_file *file_
                 req->value = dev->mode_config.async_page_flip;
                 break;
         case DRM_CAP_PAGE_FLIP_TARGET:
-                req->value = 1;
-                drm_for_each_crtc(crtc, dev) {
-                        if (!crtc->funcs->page_flip_target)
-                                req->value = 0;
+                if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+                        req->value = 1;
+                        drm_for_each_crtc(crtc, dev) {
+                                if (!crtc->funcs->page_flip_target)
+                                        req->value = 0;
+                        }
                 }
                 break;
         case DRM_CAP_CURSOR_WIDTH:
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index e8fb6ef947ee..38eaa63afb31 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -1907,6 +1907,8 @@ err_disable_pm_runtime:
 err_hdmiphy:
         if (hdata->hdmiphy_port)
                 put_device(&hdata->hdmiphy_port->dev);
+        if (hdata->regs_hdmiphy)
+                iounmap(hdata->regs_hdmiphy);
 err_ddc:
         put_device(&hdata->ddc_adpt->dev);
 
@@ -1929,6 +1931,9 @@ static int hdmi_remove(struct platform_device *pdev)
         if (hdata->hdmiphy_port)
                 put_device(&hdata->hdmiphy_port->dev);
 
+        if (hdata->regs_hdmiphy)
+                iounmap(hdata->regs_hdmiphy);
+
         put_device(&hdata->ddc_adpt->dev);
 
         return 0;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 91ab7e9d6d2e..00eb4814b913 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2268,7 +2268,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                         page = shmem_read_mapping_page(mapping, i);
                         if (IS_ERR(page)) {
                                 ret = PTR_ERR(page);
-                                goto err_pages;
+                                goto err_sg;
                         }
                 }
 #ifdef CONFIG_SWIOTLB
@@ -2311,8 +2311,9 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
 
         return 0;
 
-err_pages:
+err_sg:
         sg_mark_end(sg);
+err_pages:
         for_each_sgt_page(page, sgt_iter, st)
                 put_page(page);
         sg_free_table(st);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 81c11499bcf0..3cb70d73239b 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -12260,7 +12260,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
         intel_crtc->reset_count = i915_reset_count(&dev_priv->gpu_error);
         if (i915_reset_in_progress_or_wedged(&dev_priv->gpu_error)) {
                 ret = -EIO;
-                goto cleanup;
+                goto unlock;
         }
 
         atomic_inc(&intel_crtc->unpin_work_count);
@@ -12352,6 +12352,7 @@ cleanup_unpin:
         intel_unpin_fb_obj(fb, crtc->primary->state->rotation);
 cleanup_pending:
         atomic_dec(&intel_crtc->unpin_work_count);
+unlock:
         mutex_unlock(&dev->struct_mutex);
 cleanup:
         crtc->primary->fb = old_fb;
diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
index f75c5b5a536c..c70310206ac5 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
@@ -251,13 +251,6 @@ static int mtk_disp_ovl_probe(struct platform_device *pdev)
         if (irq < 0)
                 return irq;
 
-        ret = devm_request_irq(dev, irq, mtk_disp_ovl_irq_handler,
-                               IRQF_TRIGGER_NONE, dev_name(dev), priv);
-        if (ret < 0) {
-                dev_err(dev, "Failed to request irq %d: %d\n", irq, ret);
-                return ret;
-        }
-
         comp_id = mtk_ddp_comp_get_id(dev->of_node, MTK_DISP_OVL);
         if (comp_id < 0) {
                 dev_err(dev, "Failed to identify by alias: %d\n", comp_id);
@@ -273,6 +266,13 @@ static int mtk_disp_ovl_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, priv);
 
+        ret = devm_request_irq(dev, irq, mtk_disp_ovl_irq_handler,
+                               IRQF_TRIGGER_NONE, dev_name(dev), priv);
+        if (ret < 0) {
+                dev_err(dev, "Failed to request irq %d: %d\n", irq, ret);
+                return ret;
+        }
+
         ret = component_add(dev, &mtk_disp_ovl_component_ops);
         if (ret)
                 dev_err(dev, "Failed to add component: %d\n", ret);
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
index df33b3ca6ffd..48cc01fd20c7 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
@@ -123,7 +123,7 @@ static void mtk_od_config(struct mtk_ddp_comp *comp, unsigned int w,
                           unsigned int bpc)
 {
         writel(w << 16 | h, comp->regs + DISP_OD_SIZE);
-        writel(OD_RELAYMODE, comp->regs + OD_RELAYMODE);
+        writel(OD_RELAYMODE, comp->regs + DISP_OD_CFG);
         mtk_dither_set(comp, bpc, DISP_OD_CFG);
 }
 
diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
index 28b2044ed9f2..eaa5a2240c0c 100644
--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -86,7 +86,7 @@
 
 #define DSI_PHY_TIMECON0        0x110
 #define LPX                             (0xff << 0)
-#define HS_PRPR                         (0xff << 8)
+#define HS_PREP                         (0xff << 8)
 #define HS_ZERO                         (0xff << 16)
 #define HS_TRAIL                        (0xff << 24)
 
@@ -102,10 +102,16 @@
 #define CLK_TRAIL                       (0xff << 24)
 
 #define DSI_PHY_TIMECON3        0x11c
-#define CLK_HS_PRPR                     (0xff << 0)
+#define CLK_HS_PREP                     (0xff << 0)
 #define CLK_HS_POST                     (0xff << 8)
 #define CLK_HS_EXIT                     (0xff << 16)
 
+#define T_LPX           5
+#define T_HS_PREP       6
+#define T_HS_TRAIL      8
+#define T_HS_EXIT       7
+#define T_HS_ZERO       10
+
 #define NS_TO_CYCLE(n, c)    ((n) / (c) + (((n) % (c)) ? 1 : 0))
 
 struct phy;
@@ -161,20 +167,18 @@ static void mtk_dsi_mask(struct mtk_dsi *dsi, u32 offset, u32 mask, u32 data)
 static void dsi_phy_timconfig(struct mtk_dsi *dsi)
 {
         u32 timcon0, timcon1, timcon2, timcon3;
-        unsigned int ui, cycle_time;
-        unsigned int lpx;
+        u32 ui, cycle_time;
 
         ui = 1000 / dsi->data_rate + 0x01;
         cycle_time = 8000 / dsi->data_rate + 0x01;
-        lpx = 5;
 
-        timcon0 = (8 << 24) | (0xa << 16) | (0x6 << 8) | lpx;
-        timcon1 = (7 << 24) | (5 * lpx << 16) | ((3 * lpx) / 2) << 8 |
-                  (4 * lpx);
+        timcon0 = T_LPX | T_HS_PREP << 8 | T_HS_ZERO << 16 | T_HS_TRAIL << 24;
+        timcon1 = 4 * T_LPX | (3 * T_LPX / 2) << 8 | 5 * T_LPX << 16 |
+                  T_HS_EXIT << 24;
         timcon2 = ((NS_TO_CYCLE(0x64, cycle_time) + 0xa) << 24) |
                   (NS_TO_CYCLE(0x150, cycle_time) << 16);
-        timcon3 = (2 * lpx) << 16 | NS_TO_CYCLE(80 + 52 * ui, cycle_time) << 8 |
-                   NS_TO_CYCLE(0x40, cycle_time);
+        timcon3 = NS_TO_CYCLE(0x40, cycle_time) | (2 * T_LPX) << 16 |
+                  NS_TO_CYCLE(80 + 52 * ui, cycle_time) << 8;
 
         writel(timcon0, dsi->regs + DSI_PHY_TIMECON0);
         writel(timcon1, dsi->regs + DSI_PHY_TIMECON1);
@@ -202,19 +206,47 @@ static int mtk_dsi_poweron(struct mtk_dsi *dsi)
 {
         struct device *dev = dsi->dev;
         int ret;
+        u64 pixel_clock, total_bits;
+        u32 htotal, htotal_bits, bit_per_pixel, overhead_cycles, overhead_bits;
 
         if (++dsi->refcount != 1)
                 return 0;
 
+        switch (dsi->format) {
+        case MIPI_DSI_FMT_RGB565:
+                bit_per_pixel = 16;
+                break;
+        case MIPI_DSI_FMT_RGB666_PACKED:
+                bit_per_pixel = 18;
+                break;
+        case MIPI_DSI_FMT_RGB666:
+        case MIPI_DSI_FMT_RGB888:
+        default:
+                bit_per_pixel = 24;
+                break;
+        }
+
         /**
-         * data_rate = (pixel_clock / 1000) * pixel_dipth * mipi_ratio;
-         * pixel_clock unit is Khz, data_rata unit is MHz, so need divide 1000.
-         * mipi_ratio is mipi clk coefficient for balance the pixel clk in mipi.
-         * we set mipi_ratio is 1.05.
+         * vm.pixelclock is in kHz, pixel_clock unit is Hz, so multiply by 1000
+         * htotal_time = htotal * byte_per_pixel / num_lanes
+         * overhead_time = lpx + hs_prepare + hs_zero + hs_trail + hs_exit
+         * mipi_ratio = (htotal_time + overhead_time) / htotal_time
+         * data_rate = pixel_clock * bit_per_pixel * mipi_ratio / num_lanes;
          */
-        dsi->data_rate = dsi->vm.pixelclock * 3 * 21 / (1 * 1000 * 10);
+        pixel_clock = dsi->vm.pixelclock * 1000;
+        htotal = dsi->vm.hactive + dsi->vm.hback_porch + dsi->vm.hfront_porch +
+                        dsi->vm.hsync_len;
+        htotal_bits = htotal * bit_per_pixel;
+
+        overhead_cycles = T_LPX + T_HS_PREP + T_HS_ZERO + T_HS_TRAIL +
+                        T_HS_EXIT;
+        overhead_bits = overhead_cycles * dsi->lanes * 8;
+        total_bits = htotal_bits + overhead_bits;
+
+        dsi->data_rate = DIV_ROUND_UP_ULL(pixel_clock * total_bits,
+                                          htotal * dsi->lanes);
 
-        ret = clk_set_rate(dsi->hs_clk, dsi->data_rate * 1000000);
+        ret = clk_set_rate(dsi->hs_clk, dsi->data_rate);
         if (ret < 0) {
                 dev_err(dev, "Failed to set data rate: %d\n", ret);
                 goto err_refcount;
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 2fdcd04bc93f..0ae13cd2adda 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -34,6 +34,7 @@ struct radeon_atpx {
 
 static struct radeon_atpx_priv {
         bool atpx_detected;
+        bool bridge_pm_usable;
         /* handle for device - and atpx */
         acpi_handle dhandle;
         struct radeon_atpx atpx;
@@ -203,7 +204,11 @@ static int radeon_atpx_validate(struct radeon_atpx *atpx)
         atpx->is_hybrid = false;
         if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
                 printk("ATPX Hybrid Graphics\n");
-                atpx->functions.power_cntl = false;
+                /*
+                 * Disable legacy PM methods only when pcie port PM is usable,
+                 * otherwise the device might fail to power off or power on.
+                 */
+                atpx->functions.power_cntl = !radeon_atpx_priv.bridge_pm_usable;
                 atpx->is_hybrid = true;
         }
 
@@ -548,11 +553,16 @@ static bool radeon_atpx_detect(void)
         struct pci_dev *pdev = NULL;
         bool has_atpx = false;
         int vga_count = 0;
+        bool d3_supported = false;
+        struct pci_dev *parent_pdev;
 
         while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
                 vga_count++;
 
                 has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
+
+                parent_pdev = pci_upstream_bridge(pdev);
+                d3_supported |= parent_pdev && parent_pdev->bridge_d3;
         }
 
         /* some newer PX laptops mark the dGPU as a non-VGA display device */
@@ -560,6 +570,9 @@ static bool radeon_atpx_detect(void)
                 vga_count++;
 
                 has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
+
+                parent_pdev = pci_upstream_bridge(pdev);
+                d3_supported |= parent_pdev && parent_pdev->bridge_d3;
         }
 
         if (has_atpx && vga_count == 2) {
@@ -567,6 +580,7 @@ static bool radeon_atpx_detect(void)
                 printk(KERN_INFO "vga_switcheroo: detected switching method %s handle\n",
                        acpi_method_name);
                 radeon_atpx_priv.atpx_detected = true;
+                radeon_atpx_priv.bridge_pm_usable = d3_supported;
                 radeon_atpx_init();
                 return true;
         }
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index 086d8a507157..60d30203a5fa 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -32,6 +32,11 @@
 #include <linux/usb/ch9.h>
 #include "hid-ids.h"
 
+#define CP2112_REPORT_MAX_LENGTH                64
+#define CP2112_GPIO_CONFIG_LENGTH               5
+#define CP2112_GPIO_GET_LENGTH                  2
+#define CP2112_GPIO_SET_LENGTH                  3
+
 enum {
         CP2112_GPIO_CONFIG              = 0x02,
         CP2112_GPIO_GET                 = 0x03,
@@ -161,6 +166,8 @@ struct cp2112_device {
         atomic_t read_avail;
         atomic_t xfer_avail;
         struct gpio_chip gc;
+        u8 *in_out_buffer;
+        spinlock_t lock;
 };
 
 static int gpio_push_pull = 0xFF;
@@ -171,62 +178,86 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 {
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
-        u8 buf[5];
+        u8 *buf = dev->in_out_buffer;
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&dev->lock, flags);
+
         ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
-                                       sizeof(buf), HID_FEATURE_REPORT,
-                                       HID_REQ_GET_REPORT);
-        if (ret != sizeof(buf)) {
+                                 CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
+                                 HID_REQ_GET_REPORT);
+        if (ret != CP2112_GPIO_CONFIG_LENGTH) {
                 hid_err(hdev, "error requesting GPIO config: %d\n", ret);
-                return ret;
+                goto exit;
         }
 
         buf[1] &= ~(1 << offset);
         buf[2] = gpio_push_pull;
 
-        ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf, sizeof(buf),
-                                 HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+        ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
+                                 CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
+                                 HID_REQ_SET_REPORT);
         if (ret < 0) {
                 hid_err(hdev, "error setting GPIO config: %d\n", ret);
-                return ret;
+                goto exit;
         }
 
-        return 0;
+        ret = 0;
+
+exit:
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return ret <= 0 ? ret : -EIO;
 }
 
 static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
 {
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
-        u8 buf[3];
+        u8 *buf = dev->in_out_buffer;
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&dev->lock, flags);
+
         buf[0] = CP2112_GPIO_SET;
         buf[1] = value ? 0xff : 0;
         buf[2] = 1 << offset;
 
-        ret = hid_hw_raw_request(hdev, CP2112_GPIO_SET, buf, sizeof(buf),
-                                 HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+        ret = hid_hw_raw_request(hdev, CP2112_GPIO_SET, buf,
+                                 CP2112_GPIO_SET_LENGTH, HID_FEATURE_REPORT,
+                                 HID_REQ_SET_REPORT);
         if (ret < 0)
                 hid_err(hdev, "error setting GPIO values: %d\n", ret);
+
+        spin_unlock_irqrestore(&dev->lock, flags);
 }
 
 static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
-        u8 buf[2];
+        u8 *buf = dev->in_out_buffer;
+        unsigned long flags;
         int ret;
 
-        ret = hid_hw_raw_request(hdev, CP2112_GPIO_GET, buf, sizeof(buf),
-                                       HID_FEATURE_REPORT, HID_REQ_GET_REPORT);
-        if (ret != sizeof(buf)) {
+        spin_lock_irqsave(&dev->lock, flags);
+
+        ret = hid_hw_raw_request(hdev, CP2112_GPIO_GET, buf,
+                                 CP2112_GPIO_GET_LENGTH, HID_FEATURE_REPORT,
+                                 HID_REQ_GET_REPORT);
+        if (ret != CP2112_GPIO_GET_LENGTH) {
                 hid_err(hdev, "error requesting GPIO values: %d\n", ret);
-                return ret;
+                ret = ret < 0 ? ret : -EIO;
+                goto exit;
         }
 
-        return (buf[1] >> offset) & 1;
+        ret = (buf[1] >> offset) & 1;
+
+exit:
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        return ret;
 }
 
 static int cp2112_gpio_direction_output(struct gpio_chip *chip,
@@ -234,27 +265,33 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
 {
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
-        u8 buf[5];
+        u8 *buf = dev->in_out_buffer;
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&dev->lock, flags);
+
         ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
-                                       sizeof(buf), HID_FEATURE_REPORT,
-                                       HID_REQ_GET_REPORT);
-        if (ret != sizeof(buf)) {
+                                 CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
+                                 HID_REQ_GET_REPORT);
+        if (ret != CP2112_GPIO_CONFIG_LENGTH) {
                 hid_err(hdev, "error requesting GPIO config: %d\n", ret);
-                return ret;
+                goto fail;
         }
 
         buf[1] |= 1 << offset;
         buf[2] = gpio_push_pull;
 
-        ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf, sizeof(buf),
-                                 HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+        ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
+                                 CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
+                                 HID_REQ_SET_REPORT);
         if (ret < 0) {
                 hid_err(hdev, "error setting GPIO config: %d\n", ret);
-                return ret;
+                goto fail;
         }
 
+        spin_unlock_irqrestore(&dev->lock, flags);
+
         /*
          * Set gpio value when output direction is already set,
          * as specified in AN495, Rev. 0.2, cpt. 4.4
@@ -262,6 +299,10 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
         cp2112_gpio_set(chip, offset, value);
 
         return 0;
+
+fail:
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return ret < 0 ? ret : -EIO;
 }
 
 static int cp2112_hid_get(struct hid_device *hdev, unsigned char report_number,
@@ -1007,6 +1048,17 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
         struct cp2112_smbus_config_report config;
         int ret;
 
+        dev = devm_kzalloc(&hdev->dev, sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
+
+        dev->in_out_buffer = devm_kzalloc(&hdev->dev, CP2112_REPORT_MAX_LENGTH,
+                                          GFP_KERNEL);
+        if (!dev->in_out_buffer)
+                return -ENOMEM;
+
+        spin_lock_init(&dev->lock);
+
         ret = hid_parse(hdev);
         if (ret) {
                 hid_err(hdev, "parse failed\n");
@@ -1063,12 +1115,6 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 goto err_power_normal;
         }
 
-        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
-        if (!dev) {
-                ret = -ENOMEM;
-                goto err_power_normal;
-        }
-
         hid_set_drvdata(hdev, (void *)dev);
         dev->hdev               = hdev;
         dev->adap.owner         = THIS_MODULE;
@@ -1087,7 +1133,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
 
         if (ret) {
                 hid_err(hdev, "error registering i2c adapter\n");
-                goto err_free_dev;
+                goto err_power_normal;
         }
 
         hid_dbg(hdev, "adapter registered\n");
@@ -1123,8 +1169,6 @@ err_gpiochip_remove:
         gpiochip_remove(&dev->gc);
 err_free_i2c:
         i2c_del_adapter(&dev->adap);
-err_free_dev:
-        kfree(dev);
 err_power_normal:
         hid_hw_power(hdev, PM_HINT_NORMAL);
 err_hid_close:
@@ -1149,7 +1193,6 @@ static void cp2112_remove(struct hid_device *hdev)
          */
         hid_hw_close(hdev);
         hid_hw_stop(hdev);
-        kfree(dev);
 }
 
 static int cp2112_raw_event(struct hid_device *hdev, struct hid_report *report,
diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index 76f644deb0a7..c5c5fbe9d605 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -756,11 +756,16 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
 
         /* Setup wireless link with Logitech Wii wheel */
         if (hdev->product == USB_DEVICE_ID_LOGITECH_WII_WHEEL) {
-                unsigned char buf[] = { 0x00, 0xAF,  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+                const unsigned char cbuf[] = { 0x00, 0xAF,  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+                u8 *buf = kmemdup(cbuf, sizeof(cbuf), GFP_KERNEL);
 
-                ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(buf),
-                                        HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+                if (!buf) {
+                        ret = -ENOMEM;
+                        goto err_free;
+                }
 
+                ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(cbuf),
+                                        HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
                 if (ret >= 0) {
                         /* insert a little delay of 10 jiffies ~ 40ms */
                         wait_queue_head_t wait;
@@ -772,9 +777,10 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
                         buf[1] = 0xB2;
                         get_random_bytes(&buf[2], 2);
 
-                        ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(buf),
+                        ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(cbuf),
                                         HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
                 }
+                kfree(buf);
         }
 
         if (drv_data->quirks & LG_FF)
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index d6fa496d0ca2..20b40ad26325 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -493,7 +493,8 @@ static int magicmouse_input_configured(struct hid_device *hdev,
 static int magicmouse_probe(struct hid_device *hdev,
         const struct hid_device_id *id)
 {
-        __u8 feature[] = { 0xd7, 0x01 };
+        const u8 feature[] = { 0xd7, 0x01 };
+        u8 *buf;
         struct magicmouse_sc *msc;
         struct hid_report *report;
         int ret;
@@ -544,6 +545,12 @@ static int magicmouse_probe(struct hid_device *hdev,
         }
         report->size = 6;
 
+        buf = kmemdup(feature, sizeof(feature), GFP_KERNEL);
+        if (!buf) {
+                ret = -ENOMEM;
+                goto err_stop_hw;
+        }
+
         /*
          * Some devices repond with 'invalid report id' when feature
          * report switching it into multitouch mode is sent to it.
@@ -552,8 +559,9 @@ static int magicmouse_probe(struct hid_device *hdev,
          * but there seems to be no other way of switching the mode.
          * Thus the super-ugly hacky success check below.
          */
-        ret = hid_hw_raw_request(hdev, feature[0], feature, sizeof(feature),
+        ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(feature),
                                 HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+        kfree(buf);
         if (ret != -EIO && ret != sizeof(feature)) {
                 hid_err(hdev, "unable to request touch data (%d)\n", ret);
                 goto err_stop_hw;
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index 9cd2ca34a6be..be89bcbf6a71 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -188,10 +188,16 @@ static int rmi_set_page(struct hid_device *hdev, u8 page)
 static int rmi_set_mode(struct hid_device *hdev, u8 mode)
 {
         int ret;
-        u8 txbuf[2] = {RMI_SET_RMI_MODE_REPORT_ID, mode};
+        const u8 txbuf[2] = {RMI_SET_RMI_MODE_REPORT_ID, mode};
+        u8 *buf;
 
-        ret = hid_hw_raw_request(hdev, RMI_SET_RMI_MODE_REPORT_ID, txbuf,
+        buf = kmemdup(txbuf, sizeof(txbuf), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        ret = hid_hw_raw_request(hdev, RMI_SET_RMI_MODE_REPORT_ID, buf,
                         sizeof(txbuf), HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+        kfree(buf);
         if (ret < 0) {
                 dev_err(&hdev->dev, "unable to set rmi mode to %d (%d)\n", mode,
                         ret);
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index c5c3d6111729..60875625cbdf 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -212,6 +212,7 @@ int sensor_hub_set_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
         __s32 value;
         int ret = 0;
 
+        memset(buffer, 0, buffer_size);
         mutex_lock(&data->mutex);
         report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
         if (!report || (field_index >= report->maxfield)) {
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 11e866d05368..b403fa5ecf49 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -91,9 +91,7 @@
                                          DW_IC_INTR_TX_ABRT | \
                                          DW_IC_INTR_STOP_DET)
 
-#define DW_IC_STATUS_ACTIVITY           0x1
-#define DW_IC_STATUS_TFE                BIT(2)
-#define DW_IC_STATUS_MST_ACTIVITY       BIT(5)
+#define DW_IC_STATUS_ACTIVITY   0x1
 
 #define DW_IC_SDA_HOLD_RX_SHIFT         16
 #define DW_IC_SDA_HOLD_RX_MASK          GENMASK(23, DW_IC_SDA_HOLD_RX_SHIFT)
@@ -478,25 +476,9 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
 {
         struct i2c_msg *msgs = dev->msgs;
         u32 ic_tar = 0;
-        bool enabled;
 
-        enabled = dw_readl(dev, DW_IC_ENABLE_STATUS) & 1;
-
-        if (enabled) {
-                u32 ic_status;
-
-                /*
-                 * Only disable adapter if ic_tar and ic_con can't be
-                 * dynamically updated
-                 */
-                ic_status = dw_readl(dev, DW_IC_STATUS);
-                if (!dev->dynamic_tar_update_enabled ||
-                    (ic_status & DW_IC_STATUS_MST_ACTIVITY) ||
-                    !(ic_status & DW_IC_STATUS_TFE)) {
-                        __i2c_dw_enable_and_wait(dev, false);
-                        enabled = false;
-                }
-        }
+        /* Disable the adapter */
+        __i2c_dw_enable_and_wait(dev, false);
 
         /* if the slave address is ten bit address, enable 10BITADDR */
         if (dev->dynamic_tar_update_enabled) {
@@ -526,8 +508,8 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
         /* enforce disabled interrupts (due to HW issues) */
         i2c_dw_disable_int(dev);
 
-        if (!enabled)
-                __i2c_dw_enable(dev, true);
+        /* Enable the adapter */
+        __i2c_dw_enable(dev, true);
 
         /* Clear and enable interrupts */
         dw_readl(dev, DW_IC_CLR_INTR);
@@ -611,7 +593,7 @@ i2c_dw_xfer_msg(struct dw_i2c_dev *dev)
                         if (msgs[dev->msg_write_idx].flags & I2C_M_RD) {
 
                                 /* avoid rx buffer overrun */
-                                if (rx_limit - dev->rx_outstanding <= 0)
+                                if (dev->rx_outstanding >= dev->rx_fifo_depth)
                                         break;
 
                                 dw_writel(dev, cmd | 0x100, DW_IC_DATA_CMD);
@@ -708,8 +690,7 @@ static int i2c_dw_handle_tx_abort(struct dw_i2c_dev *dev)
 }
 
 /*
- * Prepare controller for a transaction and start transfer by calling
- * i2c_dw_xfer_init()
+ * Prepare controller for a transaction and call i2c_dw_xfer_msg
  */
 static int
 i2c_dw_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
@@ -752,13 +733,23 @@ i2c_dw_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
                 goto done;
         }
 
+        /*
+         * We must disable the adapter before returning and signaling the end
+         * of the current transfer. Otherwise the hardware might continue
+         * generating interrupts which in turn causes a race condition with
+         * the following transfer.  Needs some more investigation if the
+         * additional interrupts are a hardware bug or this driver doesn't
+         * handle them correctly yet.
+         */
+        __i2c_dw_enable(dev, false);
+
         if (dev->msg_err) {
                 ret = dev->msg_err;
                 goto done;
         }
 
         /* no error */
-        if (likely(!dev->cmd_err)) {
+        if (likely(!dev->cmd_err && !dev->status)) {
                 ret = num;
                 goto done;
         }
@@ -768,6 +759,11 @@ i2c_dw_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
                 ret = i2c_dw_handle_tx_abort(dev);
                 goto done;
         }
+
+        if (dev->status)
+                dev_err(dev->dev,
+                        "transfer terminated early - interrupt latency too high?\n");
+
         ret = -EIO;
 
 done:
@@ -888,19 +884,9 @@ static irqreturn_t i2c_dw_isr(int this_irq, void *dev_id)
          */
 
 tx_aborted:
-        if ((stat & (DW_IC_INTR_TX_ABRT | DW_IC_INTR_STOP_DET))
-                        || dev->msg_err) {
-                /*
-                 * We must disable interruts before returning and signaling
-                 * the end of the current transfer. Otherwise the hardware
-                 * might continue generating interrupts for non-existent
-                 * transfers.
-                 */
-                i2c_dw_disable_int(dev);
-                dw_readl(dev, DW_IC_CLR_INTR);
-
+        if ((stat & (DW_IC_INTR_TX_ABRT | DW_IC_INTR_STOP_DET)) || dev->msg_err)
                 complete(&dev->cmd_complete);
-        } else if (unlikely(dev->accessor_flags & ACCESS_INTR_MASK)) {
+        else if (unlikely(dev->accessor_flags & ACCESS_INTR_MASK)) {
                 /* workaround to trigger pending interrupt */
                 stat = dw_readl(dev, DW_IC_INTR_MASK);
                 i2c_dw_disable_int(dev);
diff --git a/drivers/i2c/busses/i2c-octeon-core.c b/drivers/i2c/busses/i2c-octeon-core.c
index 419b54bfc7c7..5e63b17f935d 100644
--- a/drivers/i2c/busses/i2c-octeon-core.c
+++ b/drivers/i2c/busses/i2c-octeon-core.c
@@ -381,9 +381,7 @@ static int octeon_i2c_read(struct octeon_i2c *i2c, int target,
                 if (result)
                         return result;
 
-                data[i] = octeon_i2c_data_read(i2c, &result);
-                if (result)
-                        return result;
+                data[i] = octeon_i2c_data_read(i2c);
                 if (recv_len && i == 0) {
                         if (data[i] > I2C_SMBUS_BLOCK_MAX + 1)
                                 return -EPROTO;
diff --git a/drivers/i2c/busses/i2c-octeon-core.h b/drivers/i2c/busses/i2c-octeon-core.h
index 1db7c835a454..87151ea74acd 100644
--- a/drivers/i2c/busses/i2c-octeon-core.h
+++ b/drivers/i2c/busses/i2c-octeon-core.h
@@ -5,7 +5,6 @@
 #include <linux/i2c.h>
 #include <linux/i2c-smbus.h>
 #include <linux/io.h>
-#include <linux/iopoll.h>
 #include <linux/kernel.h>
 #include <linux/pci.h>
 
@@ -145,9 +144,9 @@ static inline void octeon_i2c_reg_write(struct octeon_i2c *i2c, u64 eop_reg, u8
         u64 tmp;
 
         __raw_writeq(SW_TWSI_V | eop_reg | data, i2c->twsi_base + SW_TWSI(i2c));
-
-        readq_poll_timeout(i2c->twsi_base + SW_TWSI(i2c), tmp, tmp & SW_TWSI_V,
-                           I2C_OCTEON_EVENT_WAIT, i2c->adap.timeout);
+        do {
+                tmp = __raw_readq(i2c->twsi_base + SW_TWSI(i2c));
+        } while ((tmp & SW_TWSI_V) != 0);
 }
 
 #define octeon_i2c_ctl_write(i2c, val)                                  \
@@ -164,28 +163,24 @@ static inline void octeon_i2c_reg_write(struct octeon_i2c *i2c, u64 eop_reg, u8
  *
  * The I2C core registers are accessed indirectly via the SW_TWSI CSR.
  */
-static inline int octeon_i2c_reg_read(struct octeon_i2c *i2c, u64 eop_reg,
-                                      int *error)
+static inline u8 octeon_i2c_reg_read(struct octeon_i2c *i2c, u64 eop_reg)
 {
         u64 tmp;
-        int ret;
 
         __raw_writeq(SW_TWSI_V | eop_reg | SW_TWSI_R, i2c->twsi_base + SW_TWSI(i2c));
+        do {
+                tmp = __raw_readq(i2c->twsi_base + SW_TWSI(i2c));
+        } while ((tmp & SW_TWSI_V) != 0);
 
-        ret = readq_poll_timeout(i2c->twsi_base + SW_TWSI(i2c), tmp,
-                                 tmp & SW_TWSI_V, I2C_OCTEON_EVENT_WAIT,
-                                 i2c->adap.timeout);
-        if (error)
-                *error = ret;
         return tmp & 0xFF;
 }
 
 #define octeon_i2c_ctl_read(i2c)                                        \
-        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_CTL, NULL)
-#define octeon_i2c_data_read(i2c, error)                                \
-        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_DATA, error)
+        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_CTL)
+#define octeon_i2c_data_read(i2c)                                       \
+        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_DATA)
 #define octeon_i2c_stat_read(i2c)                                       \
-        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_STAT, NULL)
+        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_STAT)
 
 /**
  * octeon_i2c_read_int - read the TWSI_INT register
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index fb4b185dea96..bee267424972 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1115,10 +1115,6 @@ static int psmouse_extensions(struct psmouse *psmouse,
                 if (psmouse_try_protocol(psmouse, PSMOUSE_TOUCHKIT_PS2,
                                          &max_proto, set_properties, true))
                         return PSMOUSE_TOUCHKIT_PS2;
-
-                if (psmouse_try_protocol(psmouse, PSMOUSE_BYD,
-                                         &max_proto, set_properties, true))
-                        return PSMOUSE_BYD;
         }
 
         /*
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 58470f5ced04..8c53748a769d 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -338,7 +338,9 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb,
         struct pci_dev *pdev = to_pci_dev(data);
         struct dmar_pci_notify_info *info;
 
-        /* Only care about add/remove events for physical functions */
+        /* Only care about add/remove events for physical functions.
+         * For VFs we actually do the lookup based on the corresponding
+         * PF in device_to_iommu() anyway. */
         if (pdev->is_virtfn)
                 return NOTIFY_DONE;
         if (action != BUS_NOTIFY_ADD_DEVICE &&
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 3965e73db51c..d8376c2d18b3 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -892,7 +892,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
                 return NULL;
 
         if (dev_is_pci(dev)) {
+                struct pci_dev *pf_pdev;
+
                 pdev = to_pci_dev(dev);
+                /* VFs aren't listed in scope tables; we need to look up
+                 * the PF instead to find the IOMMU. */
+                pf_pdev = pci_physfn(pdev);
+                dev = &pf_pdev->dev;
                 segment = pci_domain_nr(pdev->bus);
         } else if (has_acpi_companion(dev))
                 dev = &ACPI_COMPANION(dev)->dev;
@@ -905,6 +911,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
                 for_each_active_dev_scope(drhd->devices,
                                           drhd->devices_cnt, i, tmp) {
                         if (tmp == dev) {
+                                /* For a VF use its original BDF# not that of the PF
+                                 * which we used for the IOMMU lookup. Strictly speaking
+                                 * we could do this for all PCI devices; we only need to
+                                 * get the BDF# from the scope table for ACPI matches. */
+                                if (pdev->is_virtfn)
+                                        goto got_pdev;
+
                                 *bus = drhd->devices[i].bus;
                                 *devfn = drhd->devices[i].devfn;
                                 goto out;
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index 8ebb3530afa7..cb72e0011310 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -39,10 +39,18 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu)
         struct page *pages;
         int order;
 
-        order = ecap_pss(iommu->ecap) + 7 - PAGE_SHIFT;
-        if (order < 0)
-                order = 0;
-
+        /* Start at 2 because it's defined as 2^(1+PSS) */
+        iommu->pasid_max = 2 << ecap_pss(iommu->ecap);
+
+        /* Eventually I'm promised we will get a multi-level PASID table
+         * and it won't have to be physically contiguous. Until then,
+         * limit the size because 8MiB contiguous allocations can be hard
+         * to come by. The limit of 0x20000, which is 1MiB for each of
+         * the PASID and PASID-state tables, is somewhat arbitrary. */
+        if (iommu->pasid_max > 0x20000)
+                iommu->pasid_max = 0x20000;
+
+        order = get_order(sizeof(struct pasid_entry) * iommu->pasid_max);
         pages = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
         if (!pages) {
                 pr_warn("IOMMU: %s: Failed to allocate PASID table\n",
@@ -53,6 +61,8 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu)
         pr_info("%s: Allocated order %d PASID table.\n", iommu->name, order);
 
         if (ecap_dis(iommu->ecap)) {
+                /* Just making it explicit... */
+                BUILD_BUG_ON(sizeof(struct pasid_entry) != sizeof(struct pasid_state_entry));
                 pages = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
                 if (pages)
                         iommu->pasid_state_table = page_address(pages);
@@ -68,11 +78,7 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu)
 
 int intel_svm_free_pasid_tables(struct intel_iommu *iommu)
 {
-        int order;
-
-        order = ecap_pss(iommu->ecap) + 7 - PAGE_SHIFT;
-        if (order < 0)
-                order = 0;
+        int order = get_order(sizeof(struct pasid_entry) * iommu->pasid_max);
 
         if (iommu->pasid_table) {
                 free_pages((unsigned long)iommu->pasid_table, order);
@@ -371,8 +377,8 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_
                 }
                 svm->iommu = iommu;
 
-                if (pasid_max > 2 << ecap_pss(iommu->ecap))
-                        pasid_max = 2 << ecap_pss(iommu->ecap);
+                if (pasid_max > iommu->pasid_max)
+                        pasid_max = iommu->pasid_max;
 
                 /* Do not use PASID 0 in caching mode (virtualised IOMMU) */
                 ret = idr_alloc(&iommu->pasid_idr, svm,
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index d1f8ab915b15..b90776ef56ec 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -755,8 +755,10 @@ static int __init ser_gigaset_init(void)
         driver = gigaset_initdriver(GIGASET_MINOR, GIGASET_MINORS,
                                     GIGASET_MODULENAME, GIGASET_DEVNAME,
                                     &ops, THIS_MODULE);
-        if (!driver)
+        if (!driver) {
+                rc = -ENOMEM;
                 goto error;
+        }
 
         rc = tty_register_ldisc(N_GIGASET_M101, &gigaset_ldisc);
         if (rc != 0) {
diff --git a/drivers/isdn/hisax/hfc4s8s_l1.c b/drivers/isdn/hisax/hfc4s8s_l1.c
index 9600cd771f1a..e034ed847ff3 100644
--- a/drivers/isdn/hisax/hfc4s8s_l1.c
+++ b/drivers/isdn/hisax/hfc4s8s_l1.c
@@ -1499,6 +1499,7 @@ hfc4s8s_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 printk(KERN_INFO
                        "HFC-4S/8S: failed to request address space at 0x%04x\n",
                        hw->iobase);
+                err = -EBUSY;
                 goto out;
         }
 
diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c
index 317ef63ee789..8d96a22647b3 100644
--- a/drivers/media/tuners/tuner-xc2028.c
+++ b/drivers/media/tuners/tuner-xc2028.c
@@ -281,6 +281,14 @@ static void free_firmware(struct xc2028_data *priv)
         int i;
         tuner_dbg("%s called\n", __func__);
 
+        /* free allocated f/w string */
+        if (priv->fname != firmware_name)
+                kfree(priv->fname);
+        priv->fname = NULL;
+
+        priv->state = XC2028_NO_FIRMWARE;
+        memset(&priv->cur_fw, 0, sizeof(priv->cur_fw));
+
         if (!priv->firm)
                 return;
 
@@ -291,9 +299,6 @@ static void free_firmware(struct xc2028_data *priv)
 
         priv->firm = NULL;
         priv->firm_size = 0;
-        priv->state = XC2028_NO_FIRMWARE;
-
-        memset(&priv->cur_fw, 0, sizeof(priv->cur_fw));
 }
 
 static int load_all_firmwares(struct dvb_frontend *fe,
@@ -884,9 +889,8 @@ read_not_reliable:
         return 0;
 
 fail:
-        priv->state = XC2028_NO_FIRMWARE;
+        free_firmware(priv);
 
-        memset(&priv->cur_fw, 0, sizeof(priv->cur_fw));
         if (retry_count < 8) {
                 msleep(50);
                 retry_count++;
@@ -1332,11 +1336,8 @@ static int xc2028_dvb_release(struct dvb_frontend *fe)
         mutex_lock(&xc2028_list_mutex);
 
         /* only perform final cleanup if this is the last instance */
-        if (hybrid_tuner_report_instance_count(priv) == 1) {
+        if (hybrid_tuner_report_instance_count(priv) == 1)
                 free_firmware(priv);
-                kfree(priv->ctrl.fname);
-                priv->ctrl.fname = NULL;
-        }
 
         if (priv)
                 hybrid_tuner_release_state(priv);
@@ -1399,19 +1400,8 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg)
 
         /*
          * Copy the config data.
-         * For the firmware name, keep a local copy of the string,
-         * in order to avoid troubles during device release.
          */
-        kfree(priv->ctrl.fname);
-        priv->ctrl.fname = NULL;
         memcpy(&priv->ctrl, p, sizeof(priv->ctrl));
-        if (p->fname) {
-                priv->ctrl.fname = kstrdup(p->fname, GFP_KERNEL);
-                if (priv->ctrl.fname == NULL) {
-                        rc = -ENOMEM;
-                        goto unlock;
-                }
-        }
 
         /*
          * If firmware name changed, frees firmware. As free_firmware will
@@ -1426,10 +1416,15 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg)
 
         if (priv->state == XC2028_NO_FIRMWARE) {
                 if (!firmware_name[0])
-                        priv->fname = priv->ctrl.fname;
+                        priv->fname = kstrdup(p->fname, GFP_KERNEL);
                 else
                         priv->fname = firmware_name;
 
+                if (!priv->fname) {
+                        rc = -ENOMEM;
+                        goto unlock;
+                }
+
                 rc = request_firmware_nowait(THIS_MODULE, 1,
                                              priv->fname,
                                              priv->i2c_props.adap->dev.parent,
diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c
index 2f2225e845ef..b93fe4c4957a 100644
--- a/drivers/mfd/syscon.c
+++ b/drivers/mfd/syscon.c
@@ -73,8 +73,10 @@ static struct syscon *of_syscon_register(struct device_node *np)
         /* Parse the device's DT node for an endianness specification */
         if (of_property_read_bool(np, "big-endian"))
                 syscon_config.val_format_endian = REGMAP_ENDIAN_BIG;
-         else if (of_property_read_bool(np, "little-endian"))
+        else if (of_property_read_bool(np, "little-endian"))
                 syscon_config.val_format_endian = REGMAP_ENDIAN_LITTLE;
+        else if (of_property_read_bool(np, "native-endian"))
+                syscon_config.val_format_endian = REGMAP_ENDIAN_NATIVE;
 
         /*
          * search for reg-io-width property in DT. If it is not provided,
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index 7eec619a6023..8588dbad3301 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -393,8 +393,13 @@ static int wm8994_device_init(struct wm8994 *wm8994, int irq)
                 BUG();
                 goto err;
         }
-                
-        ret = devm_regulator_bulk_get(wm8994->dev, wm8994->num_supplies,
+
+        /*
+         * Can't use devres helper here as some of the supplies are provided by
+         * wm8994->dev's children (regulators) and those regulators are
+         * unregistered by the devres core before the supplies are freed.
+         */
+        ret = regulator_bulk_get(wm8994->dev, wm8994->num_supplies,
                                  wm8994->supplies);
         if (ret != 0) {
                 dev_err(wm8994->dev, "Failed to get supplies: %d\n", ret);
@@ -405,7 +410,7 @@ static int wm8994_device_init(struct wm8994 *wm8994, int irq)
                                     wm8994->supplies);
         if (ret != 0) {
                 dev_err(wm8994->dev, "Failed to enable supplies: %d\n", ret);
-                goto err;
+                goto err_regulator_free;
         }
 
         ret = wm8994_reg_read(wm8994, WM8994_SOFTWARE_RESET);
@@ -596,6 +601,8 @@ err_irq:
 err_enable:
         regulator_bulk_disable(wm8994->num_supplies,
                                wm8994->supplies);
+err_regulator_free:
+        regulator_bulk_free(wm8994->num_supplies, wm8994->supplies);
 err:
         mfd_remove_devices(wm8994->dev);
         return ret;
@@ -604,10 +611,11 @@ err:
 static void wm8994_device_exit(struct wm8994 *wm8994)
 {
         pm_runtime_disable(wm8994->dev);
-        mfd_remove_devices(wm8994->dev);
         wm8994_irq_exit(wm8994);
         regulator_bulk_disable(wm8994->num_supplies,
                                wm8994->supplies);
+        regulator_bulk_free(wm8994->num_supplies, wm8994->supplies);
+        mfd_remove_devices(wm8994->dev);
 }
 
 static const struct of_device_id wm8994_of_match[] = {
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 50a674be6655..df478ae72e23 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1058,6 +1058,7 @@ static int dw_mci_submit_data_dma(struct dw_mci *host, struct mmc_data *data)
         spin_unlock_irqrestore(&host->irq_lock, irqflags);
 
         if (host->dma_ops->start(host, sg_len)) {
+                host->dma_ops->stop(host);
                 /* We can't do DMA, try PIO for this one */
                 dev_dbg(host->dev,
                         "%s: fall back to PIO mode for current transfer\n",
diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
index fb71c866eacc..1bb11e4a9fe5 100644
--- a/drivers/mmc/host/sdhci-of-esdhc.c
+++ b/drivers/mmc/host/sdhci-of-esdhc.c
@@ -66,6 +66,20 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host,
                         return ret;
                 }
         }
+        /*
+         * The DAT[3:0] line signal levels and the CMD line signal level are
+         * not compatible with standard SDHC register. The line signal levels
+         * DAT[7:0] are at bits 31:24 and the command line signal level is at
+         * bit 23. All other bits are the same as in the standard SDHC
+         * register.
+         */
+        if (spec_reg == SDHCI_PRESENT_STATE) {
+                ret = value & 0x000fffff;
+                ret |= (value >> 4) & SDHCI_DATA_LVL_MASK;
+                ret |= (value << 1) & SDHCI_CMD_LVL;
+                return ret;
+        }
+
         ret = value;
         return ret;
 }
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index 766df17fb7eb..2570455b219a 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -73,6 +73,7 @@
 #define  SDHCI_DATA_LVL_MASK    0x00F00000
 #define   SDHCI_DATA_LVL_SHIFT  20
 #define   SDHCI_DATA_0_LVL_MASK 0x00100000
+#define  SDHCI_CMD_LVL          0x01000000
 
 #define SDHCI_HOST_CONTROL      0x28
 #define  SDHCI_CTRL_LED         0x01
diff --git a/drivers/net/can/usb/peak_usb/pcan_ucan.h b/drivers/net/can/usb/peak_usb/pcan_ucan.h
index e8fc4952c6b0..2147678f0225 100644
--- a/drivers/net/can/usb/peak_usb/pcan_ucan.h
+++ b/drivers/net/can/usb/peak_usb/pcan_ucan.h
@@ -43,11 +43,22 @@ struct __packed pucan_command {
         u16     args[3];
 };
 
+#define PUCAN_TSLOW_BRP_BITS            10
+#define PUCAN_TSLOW_TSGEG1_BITS         8
+#define PUCAN_TSLOW_TSGEG2_BITS         7
+#define PUCAN_TSLOW_SJW_BITS            7
+
+#define PUCAN_TSLOW_BRP_MASK            ((1 << PUCAN_TSLOW_BRP_BITS) - 1)
+#define PUCAN_TSLOW_TSEG1_MASK          ((1 << PUCAN_TSLOW_TSGEG1_BITS) - 1)
+#define PUCAN_TSLOW_TSEG2_MASK          ((1 << PUCAN_TSLOW_TSGEG2_BITS) - 1)
+#define PUCAN_TSLOW_SJW_MASK            ((1 << PUCAN_TSLOW_SJW_BITS) - 1)
+
 /* uCAN TIMING_SLOW command fields */
-#define PUCAN_TSLOW_SJW_T(s, t)         (((s) & 0xf) | ((!!(t)) << 7))
-#define PUCAN_TSLOW_TSEG2(t)            ((t) & 0xf)
-#define PUCAN_TSLOW_TSEG1(t)            ((t) & 0x3f)
-#define PUCAN_TSLOW_BRP(b)              ((b) & 0x3ff)
+#define PUCAN_TSLOW_SJW_T(s, t)         (((s) & PUCAN_TSLOW_SJW_MASK) | \
+                                                                ((!!(t)) << 7))
+#define PUCAN_TSLOW_TSEG2(t)            ((t) & PUCAN_TSLOW_TSEG2_MASK)
+#define PUCAN_TSLOW_TSEG1(t)            ((t) & PUCAN_TSLOW_TSEG1_MASK)
+#define PUCAN_TSLOW_BRP(b)              ((b) & PUCAN_TSLOW_BRP_MASK)
 
 struct __packed pucan_timing_slow {
         __le16  opcode_channel;
@@ -60,11 +71,21 @@ struct __packed pucan_timing_slow {
         __le16  brp;            /* BaudRate Prescaler */
 };
 
+#define PUCAN_TFAST_BRP_BITS            10
+#define PUCAN_TFAST_TSGEG1_BITS         5
+#define PUCAN_TFAST_TSGEG2_BITS         4
+#define PUCAN_TFAST_SJW_BITS            4
+
+#define PUCAN_TFAST_BRP_MASK            ((1 << PUCAN_TFAST_BRP_BITS) - 1)
+#define PUCAN_TFAST_TSEG1_MASK          ((1 << PUCAN_TFAST_TSGEG1_BITS) - 1)
+#define PUCAN_TFAST_TSEG2_MASK          ((1 << PUCAN_TFAST_TSGEG2_BITS) - 1)
+#define PUCAN_TFAST_SJW_MASK            ((1 << PUCAN_TFAST_SJW_BITS) - 1)
+
 /* uCAN TIMING_FAST command fields */
-#define PUCAN_TFAST_SJW(s)              ((s) & 0x3)
-#define PUCAN_TFAST_TSEG2(t)            ((t) & 0x7)
-#define PUCAN_TFAST_TSEG1(t)            ((t) & 0xf)
-#define PUCAN_TFAST_BRP(b)              ((b) & 0x3ff)
+#define PUCAN_TFAST_SJW(s)              ((s) & PUCAN_TFAST_SJW_MASK)
+#define PUCAN_TFAST_TSEG2(t)            ((t) & PUCAN_TFAST_TSEG2_MASK)
+#define PUCAN_TFAST_TSEG1(t)            ((t) & PUCAN_TFAST_TSEG1_MASK)
+#define PUCAN_TFAST_BRP(b)              ((b) & PUCAN_TFAST_BRP_MASK)
 
 struct __packed pucan_timing_fast {
         __le16  opcode_channel;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index c06382cdfdfe..0b0302af3bd2 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -39,6 +39,7 @@ static struct usb_device_id peak_usb_table[] = {
         {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBPRO_PRODUCT_ID)},
         {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBFD_PRODUCT_ID)},
         {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBPROFD_PRODUCT_ID)},
+        {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBX6_PRODUCT_ID)},
         {} /* Terminating entry */
 };
 
@@ -50,6 +51,7 @@ static const struct peak_usb_adapter *const peak_usb_adapters_list[] = {
         &pcan_usb_pro,
         &pcan_usb_fd,
         &pcan_usb_pro_fd,
+        &pcan_usb_x6,
 };
 
 /*
@@ -868,23 +870,25 @@ lbl_free_candev:
 static void peak_usb_disconnect(struct usb_interface *intf)
 {
         struct peak_usb_device *dev;
+        struct peak_usb_device *dev_prev_siblings;
 
         /* unregister as many netdev devices as siblings */
-        for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) {
+        for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) {
                 struct net_device *netdev = dev->netdev;
                 char name[IFNAMSIZ];
 
+                dev_prev_siblings = dev->prev_siblings;
                 dev->state &= ~PCAN_USB_STATE_CONNECTED;
                 strncpy(name, netdev->name, IFNAMSIZ);
 
                 unregister_netdev(netdev);
-                free_candev(netdev);
 
                 kfree(dev->cmd_buf);
                 dev->next_siblings = NULL;
                 if (dev->adapter->dev_free)
                         dev->adapter->dev_free(dev);
 
+                free_candev(netdev);
                 dev_info(&intf->dev, "%s removed\n", name);
         }
 
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.h b/drivers/net/can/usb/peak_usb/pcan_usb_core.h
index 506fe506c9d3..3cbfb069893d 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.h
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.h
@@ -27,6 +27,7 @@
 #define PCAN_USBPRO_PRODUCT_ID          0x000d
 #define PCAN_USBPROFD_PRODUCT_ID        0x0011
 #define PCAN_USBFD_PRODUCT_ID           0x0012
+#define PCAN_USBX6_PRODUCT_ID           0x0014
 
 #define PCAN_USB_DRIVER_NAME            "peak_usb"
 
@@ -90,6 +91,7 @@ extern const struct peak_usb_adapter pcan_usb;
 extern const struct peak_usb_adapter pcan_usb_pro;
 extern const struct peak_usb_adapter pcan_usb_fd;
 extern const struct peak_usb_adapter pcan_usb_pro_fd;
+extern const struct peak_usb_adapter pcan_usb_x6;
 
 struct peak_time_ref {
         struct timeval tv_host_0, tv_host;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index ce44a033f63b..304732550f0a 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -993,24 +993,24 @@ static void pcan_usb_fd_free(struct peak_usb_device *dev)
 static const struct can_bittiming_const pcan_usb_fd_const = {
         .name = "pcan_usb_fd",
         .tseg1_min = 1,
-        .tseg1_max = 64,
+        .tseg1_max = (1 << PUCAN_TSLOW_TSGEG1_BITS),
         .tseg2_min = 1,
-        .tseg2_max = 16,
-        .sjw_max = 16,
+        .tseg2_max = (1 << PUCAN_TSLOW_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TSLOW_SJW_BITS),
         .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TSLOW_BRP_BITS),
         .brp_inc = 1,
 };
 
 static const struct can_bittiming_const pcan_usb_fd_data_const = {
         .name = "pcan_usb_fd",
         .tseg1_min = 1,
-        .tseg1_max = 16,
+        .tseg1_max = (1 << PUCAN_TFAST_TSGEG1_BITS),
         .tseg2_min = 1,
-        .tseg2_max = 8,
-        .sjw_max = 4,
+        .tseg2_max = (1 << PUCAN_TFAST_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TFAST_SJW_BITS),
         .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TFAST_BRP_BITS),
         .brp_inc = 1,
 };
 
@@ -1065,24 +1065,24 @@ const struct peak_usb_adapter pcan_usb_fd = {
 static const struct can_bittiming_const pcan_usb_pro_fd_const = {
         .name = "pcan_usb_pro_fd",
         .tseg1_min = 1,
-        .tseg1_max = 64,
+        .tseg1_max = (1 << PUCAN_TSLOW_TSGEG1_BITS),
         .tseg2_min = 1,
-        .tseg2_max = 16,
-        .sjw_max = 16,
+        .tseg2_max = (1 << PUCAN_TSLOW_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TSLOW_SJW_BITS),
         .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TSLOW_BRP_BITS),
         .brp_inc = 1,
 };
 
 static const struct can_bittiming_const pcan_usb_pro_fd_data_const = {
         .name = "pcan_usb_pro_fd",
         .tseg1_min = 1,
-        .tseg1_max = 16,
+        .tseg1_max = (1 << PUCAN_TFAST_TSGEG1_BITS),
         .tseg2_min = 1,
-        .tseg2_max = 8,
-        .sjw_max = 4,
+        .tseg2_max = (1 << PUCAN_TFAST_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TFAST_SJW_BITS),
         .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TFAST_BRP_BITS),
         .brp_inc = 1,
 };
 
@@ -1132,3 +1132,75 @@ const struct peak_usb_adapter pcan_usb_pro_fd = {
 
         .do_get_berr_counter = pcan_usb_fd_get_berr_counter,
 };
+
+/* describes the PCAN-USB X6 adapter */
+static const struct can_bittiming_const pcan_usb_x6_const = {
+        .name = "pcan_usb_x6",
+        .tseg1_min = 1,
+        .tseg1_max = (1 << PUCAN_TSLOW_TSGEG1_BITS),
+        .tseg2_min = 1,
+        .tseg2_max = (1 << PUCAN_TSLOW_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TSLOW_SJW_BITS),
+        .brp_min = 1,
+        .brp_max = (1 << PUCAN_TSLOW_BRP_BITS),
+        .brp_inc = 1,
+};
+
+static const struct can_bittiming_const pcan_usb_x6_data_const = {
+        .name = "pcan_usb_x6",
+        .tseg1_min = 1,
+        .tseg1_max = (1 << PUCAN_TFAST_TSGEG1_BITS),
+        .tseg2_min = 1,
+        .tseg2_max = (1 << PUCAN_TFAST_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TFAST_SJW_BITS),
+        .brp_min = 1,
+        .brp_max = (1 << PUCAN_TFAST_BRP_BITS),
+        .brp_inc = 1,
+};
+
+const struct peak_usb_adapter pcan_usb_x6 = {
+        .name = "PCAN-USB X6",
+        .device_id = PCAN_USBX6_PRODUCT_ID,
+        .ctrl_count = PCAN_USBPROFD_CHANNEL_COUNT,
+        .ctrlmode_supported = CAN_CTRLMODE_FD |
+                        CAN_CTRLMODE_3_SAMPLES | CAN_CTRLMODE_LISTENONLY,
+        .clock = {
+                .freq = PCAN_UFD_CRYSTAL_HZ,
+        },
+        .bittiming_const = &pcan_usb_x6_const,
+        .data_bittiming_const = &pcan_usb_x6_data_const,
+
+        /* size of device private data */
+        .sizeof_dev_private = sizeof(struct pcan_usb_fd_device),
+
+        /* timestamps usage */
+        .ts_used_bits = 32,
+        .ts_period = 1000000, /* calibration period in ts. */
+        .us_per_ts_scale = 1, /* us = (ts * scale) >> shift */
+        .us_per_ts_shift = 0,
+
+        /* give here messages in/out endpoints */
+        .ep_msg_in = PCAN_USBPRO_EP_MSGIN,
+        .ep_msg_out = {PCAN_USBPRO_EP_MSGOUT_0, PCAN_USBPRO_EP_MSGOUT_1},
+
+        /* size of rx/tx usb buffers */
+        .rx_buffer_size = PCAN_UFD_RX_BUFFER_SIZE,
+        .tx_buffer_size = PCAN_UFD_TX_BUFFER_SIZE,
+
+        /* device callbacks */
+        .intf_probe = pcan_usb_pro_probe,       /* same as PCAN-USB Pro */
+        .dev_init = pcan_usb_fd_init,
+
+        .dev_exit = pcan_usb_fd_exit,
+        .dev_free = pcan_usb_fd_free,
+        .dev_set_bus = pcan_usb_fd_set_bus,
+        .dev_set_bittiming = pcan_usb_fd_set_bittiming_slow,
+        .dev_set_data_bittiming = pcan_usb_fd_set_bittiming_fast,
+        .dev_decode_buf = pcan_usb_fd_decode_buf,
+        .dev_start = pcan_usb_fd_start,
+        .dev_stop = pcan_usb_fd_stop,
+        .dev_restart_async = pcan_usb_fd_restart_async,
+        .dev_encode_msg = pcan_usb_fd_encode_msg,
+
+        .do_get_berr_counter = pcan_usb_fd_get_berr_counter,
+};
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index e3ee27ce13dd..9ec33b51a0ed 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -588,6 +588,7 @@ static void bcm_sf2_sw_adjust_link(struct dsa_switch *ds, int port,
                                    struct phy_device *phydev)
 {
         struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
+        struct ethtool_eee *p = &priv->port_sts[port].eee;
         u32 id_mode_dis = 0, port_mode;
         const char *str = NULL;
         u32 reg;
@@ -662,6 +663,9 @@ force_link:
                 reg |= DUPLX_MODE;
 
         core_writel(priv, reg, CORE_STS_OVERRIDE_GMIIP_PORT(port));
+
+        if (!phydev->is_pseudo_fixed_link)
+                p->eee_enabled = bcm_sf2_eee_init(ds, port, phydev);
 }
 
 static void bcm_sf2_sw_fixed_link_update(struct dsa_switch *ds, int port,
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index bda31f308cc2..a0eee7218695 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -400,12 +400,6 @@ static int tse_rx(struct altera_tse_private *priv, int limit)
 
                 skb_put(skb, pktlength);
 
-                /* make cache consistent with receive packet buffer */
-                dma_sync_single_for_cpu(priv->device,
-                                        priv->rx_ring[entry].dma_addr,
-                                        priv->rx_ring[entry].len,
-                                        DMA_FROM_DEVICE);
-
                 dma_unmap_single(priv->device, priv->rx_ring[entry].dma_addr,
                                  priv->rx_ring[entry].len, DMA_FROM_DEVICE);
 
@@ -469,7 +463,6 @@ static int tse_tx_complete(struct altera_tse_private *priv)
 
         if (unlikely(netif_queue_stopped(priv->dev) &&
                      tse_tx_avail(priv) > TSE_TX_THRESH(priv))) {
-                netif_tx_lock(priv->dev);
                 if (netif_queue_stopped(priv->dev) &&
                     tse_tx_avail(priv) > TSE_TX_THRESH(priv)) {
                         if (netif_msg_tx_done(priv))
@@ -477,7 +470,6 @@ static int tse_tx_complete(struct altera_tse_private *priv)
                                            __func__);
                         netif_wake_queue(priv->dev);
                 }
-                netif_tx_unlock(priv->dev);
         }
 
         spin_unlock(&priv->tx_lock);
@@ -592,10 +584,6 @@ static int tse_start_xmit(struct sk_buff *skb, struct net_device *dev)
         buffer->dma_addr = dma_addr;
         buffer->len = nopaged_len;
 
-        /* Push data out of the cache hierarchy into main memory */
-        dma_sync_single_for_device(priv->device, buffer->dma_addr,
-                                   buffer->len, DMA_TO_DEVICE);
-
         priv->dmaops->tx_buffer(priv, buffer);
 
         skb_tx_timestamp(skb);
@@ -819,6 +807,8 @@ static int init_phy(struct net_device *dev)
 
         if (!phydev) {
                 netdev_err(dev, "Could not find the PHY\n");
+                if (fixed_link)
+                        of_phy_deregister_fixed_link(priv->device->of_node);
                 return -ENODEV;
         }
 
@@ -1545,10 +1535,15 @@ err_free_netdev:
 static int altera_tse_remove(struct platform_device *pdev)
 {
         struct net_device *ndev = platform_get_drvdata(pdev);
+        struct altera_tse_private *priv = netdev_priv(ndev);
 
-        if (ndev->phydev)
+        if (ndev->phydev) {
                 phy_disconnect(ndev->phydev);
 
+                if (of_phy_is_fixed_link(priv->device->of_node))
+                        of_phy_deregister_fixed_link(priv->device->of_node);
+        }
+
         platform_set_drvdata(pdev, NULL);
         altera_tse_mdio_destroy(ndev);
         unregister_netdev(ndev);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
index 9de078819aa6..4f7635178200 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
@@ -829,7 +829,7 @@ static int xgbe_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int xgbe_suspend(struct device *dev)
 {
         struct net_device *netdev = dev_get_drvdata(dev);
@@ -874,7 +874,7 @@ static int xgbe_resume(struct device *dev)
 
         return ret;
 }
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id xgbe_acpi_match[] = {
diff --git a/drivers/net/ethernet/aurora/nb8800.c b/drivers/net/ethernet/aurora/nb8800.c
index 00c38bf151e6..e078d8da978c 100644
--- a/drivers/net/ethernet/aurora/nb8800.c
+++ b/drivers/net/ethernet/aurora/nb8800.c
@@ -1466,12 +1466,12 @@ static int nb8800_probe(struct platform_device *pdev)
 
         ret = nb8800_hw_init(dev);
         if (ret)
-                goto err_free_bus;
+                goto err_deregister_fixed_link;
 
         if (ops && ops->init) {
                 ret = ops->init(dev);
                 if (ret)
-                        goto err_free_bus;
+                        goto err_deregister_fixed_link;
         }
 
         dev->netdev_ops = &nb8800_netdev_ops;
@@ -1504,6 +1504,9 @@ static int nb8800_probe(struct platform_device *pdev)
 
 err_free_dma:
         nb8800_dma_free(dev);
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                of_phy_deregister_fixed_link(pdev->dev.of_node);
 err_free_bus:
         of_node_put(priv->phy_node);
         mdiobus_unregister(bus);
@@ -1521,6 +1524,8 @@ static int nb8800_remove(struct platform_device *pdev)
         struct nb8800_priv *priv = netdev_priv(ndev);
 
         unregister_netdev(ndev);
+        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                of_phy_deregister_fixed_link(pdev->dev.of_node);
         of_node_put(priv->phy_node);
 
         mdiobus_unregister(priv->mii_bus);
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index c3354b9941d1..25d1eb4933d0 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1755,13 +1755,13 @@ static int bcm_sysport_probe(struct platform_device *pdev)
         if (priv->irq0 <= 0 || priv->irq1 <= 0) {
                 dev_err(&pdev->dev, "invalid interrupts\n");
                 ret = -EINVAL;
-                goto err;
+                goto err_free_netdev;
         }
 
         priv->base = devm_ioremap_resource(&pdev->dev, r);
         if (IS_ERR(priv->base)) {
                 ret = PTR_ERR(priv->base);
-                goto err;
+                goto err_free_netdev;
         }
 
         priv->netdev = dev;
@@ -1779,7 +1779,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
                 ret = of_phy_register_fixed_link(dn);
                 if (ret) {
                         dev_err(&pdev->dev, "failed to register fixed PHY\n");
-                        goto err;
+                        goto err_free_netdev;
                 }
 
                 priv->phy_dn = dn;
@@ -1821,7 +1821,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
         ret = register_netdev(dev);
         if (ret) {
                 dev_err(&pdev->dev, "failed to register net_device\n");
-                goto err;
+                goto err_deregister_fixed_link;
         }
 
         priv->rev = topctrl_readl(priv, REV_CNTL) & REV_MASK;
@@ -1832,7 +1832,11 @@ static int bcm_sysport_probe(struct platform_device *pdev)
                  priv->base, priv->irq0, priv->irq1, txq, rxq);
 
         return 0;
-err:
+
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
+err_free_netdev:
         free_netdev(dev);
         return ret;
 }
@@ -1840,11 +1844,14 @@ err:
 static int bcm_sysport_remove(struct platform_device *pdev)
 {
         struct net_device *dev = dev_get_drvdata(&pdev->dev);
+        struct device_node *dn = pdev->dev.of_node;
 
         /* Not much to do, ndo_close has been called
          * and we use managed allocations
          */
         unregister_netdev(dev);
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
         free_netdev(dev);
         dev_set_drvdata(&pdev->dev, NULL);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 85a7800bfc12..5f19427c7b27 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -1872,8 +1872,16 @@ static void bnx2x_get_ringparam(struct net_device *dev,
 
         ering->rx_max_pending = MAX_RX_AVAIL;
 
+        /* If size isn't already set, we give an estimation of the number
+         * of buffers we'll have. We're neglecting some possible conditions
+         * [we couldn't know for certain at this point if number of queues
+         * might shrink] but the number would be correct for the likely
+         * scenario.
+         */
         if (bp->rx_ring_size)
                 ering->rx_pending = bp->rx_ring_size;
+        else if (BNX2X_NUM_RX_QUEUES(bp))
+                ering->rx_pending = MAX_RX_AVAIL / BNX2X_NUM_RX_QUEUES(bp);
         else
                 ering->rx_pending = MAX_RX_AVAIL;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 0cee4c0283f9..4febe60eadc2 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -10138,7 +10138,7 @@ static void __bnx2x_add_udp_port(struct bnx2x *bp, u16 port,
 {
         struct bnx2x_udp_tunnel *udp_port = &bp->udp_tunnel_ports[type];
 
-        if (!netif_running(bp->dev) || !IS_PF(bp))
+        if (!netif_running(bp->dev) || !IS_PF(bp) || CHIP_IS_E1x(bp))
                 return;
 
         if (udp_port->count && udp_port->dst_port == port) {
@@ -10163,7 +10163,7 @@ static void __bnx2x_del_udp_port(struct bnx2x *bp, u16 port,
 {
         struct bnx2x_udp_tunnel *udp_port = &bp->udp_tunnel_ports[type];
 
-        if (!IS_PF(bp))
+        if (!IS_PF(bp) || CHIP_IS_E1x(bp))
                 return;
 
         if (!udp_port->count || udp_port->dst_port != port) {
@@ -13505,6 +13505,7 @@ static int bnx2x_init_firmware(struct bnx2x *bp)
 
         /* Initialize the pointers to the init arrays */
         /* Blob */
+        rc = -ENOMEM;
         BNX2X_ALLOC_AND_SET(init_data, request_firmware_exit, be32_to_cpu_n);
 
         /* Opcodes */
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index e18635b2a002..f08a20b921e7 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1811,6 +1811,9 @@ static int bnxt_busy_poll(struct napi_struct *napi)
         if (atomic_read(&bp->intr_sem) != 0)
                 return LL_FLUSH_FAILED;
 
+        if (!bp->link_info.link_up)
+                return LL_FLUSH_FAILED;
+
         if (!bnxt_lock_poll(bnapi))
                 return LL_FLUSH_BUSY;
 
@@ -3210,11 +3213,17 @@ static int bnxt_hwrm_tunnel_dst_port_alloc(struct bnxt *bp, __be16 port,
                 goto err_out;
         }
 
-        if (tunnel_type & TUNNEL_DST_PORT_ALLOC_REQ_TUNNEL_TYPE_VXLAN)
+        switch (tunnel_type) {
+        case TUNNEL_DST_PORT_ALLOC_REQ_TUNNEL_TYPE_VXLAN:
                 bp->vxlan_fw_dst_port_id = resp->tunnel_dst_port_id;
-
-        else if (tunnel_type & TUNNEL_DST_PORT_ALLOC_REQ_TUNNEL_TYPE_GENEVE)
+                break;
+        case TUNNEL_DST_PORT_ALLOC_REQ_TUNNEL_TYPE_GENEVE:
                 bp->nge_fw_dst_port_id = resp->tunnel_dst_port_id;
+                break;
+        default:
+                break;
+        }
+
 err_out:
         mutex_unlock(&bp->hwrm_cmd_lock);
         return rc;
@@ -4111,7 +4120,7 @@ static int bnxt_hwrm_stat_ctx_alloc(struct bnxt *bp)
                 bp->grp_info[i].fw_stats_ctx = cpr->hw_stats_ctx_id;
         }
         mutex_unlock(&bp->hwrm_cmd_lock);
-        return 0;
+        return rc;
 }
 
 static int bnxt_hwrm_func_qcfg(struct bnxt *bp)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 4464bc5db934..a4e60e56c14f 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1172,6 +1172,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
                                           struct bcmgenet_tx_ring *ring)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
+        struct device *kdev = &priv->pdev->dev;
         struct enet_cb *tx_cb_ptr;
         struct netdev_queue *txq;
         unsigned int pkts_compl = 0;
@@ -1199,13 +1200,13 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
                 if (tx_cb_ptr->skb) {
                         pkts_compl++;
                         bytes_compl += GENET_CB(tx_cb_ptr->skb)->bytes_sent;
-                        dma_unmap_single(&dev->dev,
+                        dma_unmap_single(kdev,
                                          dma_unmap_addr(tx_cb_ptr, dma_addr),
                                          dma_unmap_len(tx_cb_ptr, dma_len),
                                          DMA_TO_DEVICE);
                         bcmgenet_free_cb(tx_cb_ptr);
                 } else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) {
-                        dma_unmap_page(&dev->dev,
+                        dma_unmap_page(kdev,
                                        dma_unmap_addr(tx_cb_ptr, dma_addr),
                                        dma_unmap_len(tx_cb_ptr, dma_len),
                                        DMA_TO_DEVICE);
@@ -1775,6 +1776,7 @@ static int bcmgenet_alloc_rx_buffers(struct bcmgenet_priv *priv,
 
 static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv)
 {
+        struct device *kdev = &priv->pdev->dev;
         struct enet_cb *cb;
         int i;
 
@@ -1782,7 +1784,7 @@ static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv)
                 cb = &priv->rx_cbs[i];
 
                 if (dma_unmap_addr(cb, dma_addr)) {
-                        dma_unmap_single(&priv->dev->dev,
+                        dma_unmap_single(kdev,
                                          dma_unmap_addr(cb, dma_addr),
                                          priv->rx_buf_len, DMA_FROM_DEVICE);
                         dma_unmap_addr_set(cb, dma_addr, 0);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 457c3bc8cfff..e87607621e62 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -542,8 +542,10 @@ static int bcmgenet_mii_of_init(struct bcmgenet_priv *priv)
         /* Make sure we initialize MoCA PHYs with a link down */
         if (phy_mode == PHY_INTERFACE_MODE_MOCA) {
                 phydev = of_phy_find_device(dn);
-                if (phydev)
+                if (phydev) {
                         phydev->link = 0;
+                        put_device(&phydev->mdio.dev);
+                }
         }
 
         return 0;
@@ -625,6 +627,7 @@ static int bcmgenet_mii_bus_init(struct bcmgenet_priv *priv)
 int bcmgenet_mii_init(struct net_device *dev)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
+        struct device_node *dn = priv->pdev->dev.of_node;
         int ret;
 
         ret = bcmgenet_mii_alloc(priv);
@@ -638,6 +641,8 @@ int bcmgenet_mii_init(struct net_device *dev)
         return 0;
 
 out:
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
         of_node_put(priv->phy_dn);
         mdiobus_unregister(priv->mii_bus);
         mdiobus_free(priv->mii_bus);
@@ -647,7 +652,10 @@ out:
 void bcmgenet_mii_exit(struct net_device *dev)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
+        struct device_node *dn = priv->pdev->dev.of_node;
 
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
         of_node_put(priv->phy_dn);
         mdiobus_unregister(priv->mii_bus);
         mdiobus_free(priv->mii_bus);
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 533653bd7aec..ec09fcece711 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -975,6 +975,7 @@ static inline void macb_init_rx_ring(struct macb *bp)
                 addr += bp->rx_buffer_size;
         }
         bp->rx_ring[RX_RING_SIZE - 1].addr |= MACB_BIT(RX_WRAP);
+        bp->rx_tail = 0;
 }
 
 static int macb_rx(struct macb *bp, int budget)
@@ -1156,6 +1157,7 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                 if (status & MACB_BIT(RXUBR)) {
                         ctrl = macb_readl(bp, NCR);
                         macb_writel(bp, NCR, ctrl & ~MACB_BIT(RE));
+                        wmb();
                         macb_writel(bp, NCR, ctrl | MACB_BIT(RE));
 
                         if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
@@ -1616,8 +1618,6 @@ static void macb_init_rings(struct macb *bp)
         bp->queues[0].tx_head = 0;
         bp->queues[0].tx_tail = 0;
         bp->queues[0].tx_ring[TX_RING_SIZE - 1].ctrl |= MACB_BIT(TX_WRAP);
-
-        bp->rx_tail = 0;
 }
 
 static void macb_reset_hw(struct macb *bp)
@@ -2770,6 +2770,7 @@ static irqreturn_t at91ether_interrupt(int irq, void *dev_id)
         if (intstatus & MACB_BIT(RXUBR)) {
                 ctl = macb_readl(lp, NCR);
                 macb_writel(lp, NCR, ctl & ~MACB_BIT(RE));
+                wmb();
                 macb_writel(lp, NCR, ctl | MACB_BIT(RE));
         }
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 57eb4e1345cb..19dc9e25aa72 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4931,6 +4931,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
          */
         for_each_port(adapter, i) {
                 pi = adap2pinfo(adapter, i);
+                adapter->port[i]->dev_port = pi->lport;
                 netif_set_real_num_tx_queues(adapter->port[i], pi->nqsets);
                 netif_set_real_num_rx_queues(adapter->port[i], pi->nqsets);
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 20dec85da63d..e8139514d32c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -7851,7 +7851,6 @@ int t4_port_init(struct adapter *adap, int mbox, int pf, int vf)
                         return ret;
 
                 memcpy(adap->port[i]->dev_addr, addr, ETH_ALEN);
-                adap->port[i]->dev_port = j;
                 j++;
         }
         return 0;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
index df1573c4a659..ecf3ccc257bc 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
@@ -168,6 +168,7 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
         CH_PCI_ID_TABLE_FENTRY(0x509a), /* Custom T520-CR */
         CH_PCI_ID_TABLE_FENTRY(0x509b), /* Custom T540-CR LOM */
         CH_PCI_ID_TABLE_FENTRY(0x509c), /* Custom T520-CR*/
+        CH_PCI_ID_TABLE_FENTRY(0x509d), /* Custom T540-CR*/
 
         /* T6 adapters:
          */
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index 100b2cc064a3..a37481c04a87 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2969,6 +2969,7 @@ static int cxgb4vf_pci_probe(struct pci_dev *pdev,
 
                 netdev->netdev_ops = &cxgb4vf_netdev_ops;
                 netdev->ethtool_ops = &cxgb4vf_ethtool_ops;
+                netdev->dev_port = pi->port_id;
 
                 /*
                  * Initialize the hardware/software state for the port.
diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c
index de9f7c97d916..9a161e981529 100644
--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c
+++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c
@@ -468,6 +468,9 @@ static void ep93xx_free_buffers(struct ep93xx_priv *ep)
         struct device *dev = ep->dev->dev.parent;
         int i;
 
+        if (!ep->descs)
+                return;
+
         for (i = 0; i < RX_QUEUE_ENTRIES; i++) {
                 dma_addr_t d;
 
@@ -490,6 +493,7 @@ static void ep93xx_free_buffers(struct ep93xx_priv *ep)
 
         dma_free_coherent(dev, sizeof(struct ep93xx_descs), ep->descs,
                                                         ep->descs_dma_addr);
+        ep->descs = NULL;
 }
 
 static int ep93xx_alloc_buffers(struct ep93xx_priv *ep)
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 1fb5d7239254..0e74529a4209 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -90,7 +90,8 @@ static struct be_cmd_priv_map cmd_priv_map[] = {
         {
                 OPCODE_COMMON_SET_HSW_CONFIG,
                 CMD_SUBSYSTEM_COMMON,
-                BE_PRIV_DEVCFG | BE_PRIV_VHADM
+                BE_PRIV_DEVCFG | BE_PRIV_VHADM |
+                BE_PRIV_DEVSEC
         },
         {
                 OPCODE_COMMON_GET_EXT_FAT_CAPABILITIES,
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index c865135f3cb9..5ea740b4cf14 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -574,6 +574,8 @@ struct fec_enet_private {
         unsigned int reload_period;
         int pps_enable;
         unsigned int next_counter;
+
+        u64 ethtool_stats[0];
 };
 
 void fec_ptp_init(struct platform_device *pdev);
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 5aa9d4ded214..12aef1b15356 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -2313,14 +2313,26 @@ static const struct fec_stat {
         { "IEEE_rx_octets_ok", IEEE_R_OCTETS_OK },
 };
 
-static void fec_enet_get_ethtool_stats(struct net_device *dev,
-        struct ethtool_stats *stats, u64 *data)
+#define FEC_STATS_SIZE          (ARRAY_SIZE(fec_stats) * sizeof(u64))
+
+static void fec_enet_update_ethtool_stats(struct net_device *dev)
 {
         struct fec_enet_private *fep = netdev_priv(dev);
         int i;
 
         for (i = 0; i < ARRAY_SIZE(fec_stats); i++)
-                data[i] = readl(fep->hwp + fec_stats[i].offset);
+                fep->ethtool_stats[i] = readl(fep->hwp + fec_stats[i].offset);
+}
+
+static void fec_enet_get_ethtool_stats(struct net_device *dev,
+                                       struct ethtool_stats *stats, u64 *data)
+{
+        struct fec_enet_private *fep = netdev_priv(dev);
+
+        if (netif_running(dev))
+                fec_enet_update_ethtool_stats(dev);
+
+        memcpy(data, fep->ethtool_stats, FEC_STATS_SIZE);
 }
 
 static void fec_enet_get_strings(struct net_device *netdev,
@@ -2345,6 +2357,12 @@ static int fec_enet_get_sset_count(struct net_device *dev, int sset)
                 return -EOPNOTSUPP;
         }
 }
+
+#else   /* !defined(CONFIG_M5272) */
+#define FEC_STATS_SIZE  0
+static inline void fec_enet_update_ethtool_stats(struct net_device *dev)
+{
+}
 #endif /* !defined(CONFIG_M5272) */
 
 static int fec_enet_nway_reset(struct net_device *dev)
@@ -2874,6 +2892,8 @@ fec_enet_close(struct net_device *ndev)
         if (fep->quirks & FEC_QUIRK_ERR006687)
                 imx6q_cpuidle_fec_irqs_unused();
 
+        fec_enet_update_ethtool_stats(ndev);
+
         fec_enet_clk_enable(ndev, false);
         pinctrl_pm_select_sleep_state(&fep->pdev->dev);
         pm_runtime_mark_last_busy(&fep->pdev->dev);
@@ -3180,6 +3200,8 @@ static int fec_enet_init(struct net_device *ndev)
 
         fec_restart(ndev);
 
+        fec_enet_update_ethtool_stats(ndev);
+
         return 0;
 }
 
@@ -3278,8 +3300,8 @@ fec_probe(struct platform_device *pdev)
         fec_enet_get_queue_num(pdev, &num_tx_qs, &num_rx_qs);
 
         /* Init network device */
-        ndev = alloc_etherdev_mqs(sizeof(struct fec_enet_private),
-                                  num_tx_qs, num_rx_qs);
+        ndev = alloc_etherdev_mqs(sizeof(struct fec_enet_private) +
+                                  FEC_STATS_SIZE, num_tx_qs, num_rx_qs);
         if (!ndev)
                 return -ENOMEM;
 
@@ -3475,6 +3497,8 @@ failed_regulator:
 failed_clk_ipg:
         fec_enet_clk_enable(ndev, false);
 failed_clk:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
 failed_phy:
         of_node_put(phy_node);
 failed_ioremap:
@@ -3488,6 +3512,7 @@ fec_drv_remove(struct platform_device *pdev)
 {
         struct net_device *ndev = platform_get_drvdata(pdev);
         struct fec_enet_private *fep = netdev_priv(ndev);
+        struct device_node *np = pdev->dev.of_node;
 
         cancel_work_sync(&fep->tx_timeout_work);
         fec_ptp_stop(pdev);
@@ -3495,6 +3520,8 @@ fec_drv_remove(struct platform_device *pdev)
         fec_enet_mii_remove(fep);
         if (fep->reg_phy)
                 regulator_disable(fep->reg_phy);
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
         of_node_put(fep->phy_node);
         free_netdev(ndev);
 
diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
index 53ef51e3bd9e..71a5ded9d1de 100644
--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
+++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
@@ -1107,6 +1107,9 @@ int memac_free(struct fman_mac *memac)
 {
         free_init_resources(memac);
 
+        if (memac->pcsphy)
+                put_device(&memac->pcsphy->mdio.dev);
+
         kfree(memac->memac_drv_param);
         kfree(memac);
 
diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c
index efabb04a1ae8..4b0f3a50b293 100644
--- a/drivers/net/ethernet/freescale/fman/fman_tgec.c
+++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c
@@ -722,9 +722,6 @@ int tgec_free(struct fman_mac *tgec)
 {
         free_init_resources(tgec);
 
-        if (tgec->cfg)
-                tgec->cfg = NULL;
-
         kfree(tgec->cfg);
         kfree(tgec);
 
diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
index 8fe6b3e253fa..736db9d9b0ad 100644
--- a/drivers/net/ethernet/freescale/fman/mac.c
+++ b/drivers/net/ethernet/freescale/fman/mac.c
@@ -892,6 +892,8 @@ static int mac_probe(struct platform_device *_of_dev)
                 priv->fixed_link->duplex = phy->duplex;
                 priv->fixed_link->pause = phy->pause;
                 priv->fixed_link->asym_pause = phy->asym_pause;
+
+                put_device(&phy->mdio.dev);
         }
 
         err = mac_dev->init(mac_dev);
diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
index dc120c148d97..4b86260584a0 100644
--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
@@ -980,7 +980,7 @@ static int fs_enet_probe(struct platform_device *ofdev)
                 err = clk_prepare_enable(clk);
                 if (err) {
                         ret = err;
-                        goto out_free_fpi;
+                        goto out_deregister_fixed_link;
                 }
                 fpi->clk_per = clk;
         }
@@ -1061,6 +1061,9 @@ out_put:
         of_node_put(fpi->phy_node);
         if (fpi->clk_per)
                 clk_disable_unprepare(fpi->clk_per);
+out_deregister_fixed_link:
+        if (of_phy_is_fixed_link(ofdev->dev.of_node))
+                of_phy_deregister_fixed_link(ofdev->dev.of_node);
 out_free_fpi:
         kfree(fpi);
         return ret;
@@ -1079,6 +1082,8 @@ static int fs_enet_remove(struct platform_device *ofdev)
         of_node_put(fep->fpi->phy_node);
         if (fep->fpi->clk_per)
                 clk_disable_unprepare(fep->fpi->clk_per);
+        if (of_phy_is_fixed_link(ofdev->dev.of_node))
+                of_phy_deregister_fixed_link(ofdev->dev.of_node);
         free_netdev(ndev);
         return 0;
 }
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 4b4f5bc0e279..9061c2f82b9c 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1312,6 +1312,7 @@ static void gfar_init_addr_hash_table(struct gfar_private *priv)
  */
 static int gfar_probe(struct platform_device *ofdev)
 {
+        struct device_node *np = ofdev->dev.of_node;
         struct net_device *dev = NULL;
         struct gfar_private *priv = NULL;
         int err = 0, i;
@@ -1462,6 +1463,8 @@ static int gfar_probe(struct platform_device *ofdev)
         return 0;
 
 register_fail:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
         unmap_group_regs(priv);
         gfar_free_rx_queues(priv);
         gfar_free_tx_queues(priv);
@@ -1474,11 +1477,16 @@ register_fail:
 static int gfar_remove(struct platform_device *ofdev)
 {
         struct gfar_private *priv = platform_get_drvdata(ofdev);
+        struct device_node *np = ofdev->dev.of_node;
 
         of_node_put(priv->phy_node);
         of_node_put(priv->tbi_node);
 
         unregister_netdev(priv->ndev);
+
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+
         unmap_group_regs(priv);
         gfar_free_rx_queues(priv);
         gfar_free_tx_queues(priv);
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index 186ef8f16c80..f76d33279454 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -3868,9 +3868,8 @@ static int ucc_geth_probe(struct platform_device* ofdev)
         dev = alloc_etherdev(sizeof(*ugeth));
 
         if (dev == NULL) {
-                of_node_put(ug_info->tbi_node);
-                of_node_put(ug_info->phy_node);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto err_deregister_fixed_link;
         }
 
         ugeth = netdev_priv(dev);
@@ -3907,10 +3906,7 @@ static int ucc_geth_probe(struct platform_device* ofdev)
                 if (netif_msg_probe(ugeth))
                         pr_err("%s: Cannot register net device, aborting\n",
                                dev->name);
-                free_netdev(dev);
-                of_node_put(ug_info->tbi_node);
-                of_node_put(ug_info->phy_node);
-                return err;
+                goto err_free_netdev;
         }
 
         mac_addr = of_get_mac_address(np);
@@ -3923,16 +3919,29 @@ static int ucc_geth_probe(struct platform_device* ofdev)
         ugeth->node = np;
 
         return 0;
+
+err_free_netdev:
+        free_netdev(dev);
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+        of_node_put(ug_info->tbi_node);
+        of_node_put(ug_info->phy_node);
+
+        return err;
 }
 
 static int ucc_geth_remove(struct platform_device* ofdev)
 {
         struct net_device *dev = platform_get_drvdata(ofdev);
         struct ucc_geth_private *ugeth = netdev_priv(dev);
+        struct device_node *np = ofdev->dev.of_node;
 
         unregister_netdev(dev);
         free_netdev(dev);
         ucc_geth_memclean(ugeth);
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
         of_node_put(ugeth->ug_info->tbi_node);
         of_node_put(ugeth->ug_info->phy_node);
 
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index ebe60719e489..a36022ba4e42 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -58,7 +58,7 @@ static struct kobj_type ktype_veth_pool;
 
 static const char ibmveth_driver_name[] = "ibmveth";
 static const char ibmveth_driver_string[] = "IBM Power Virtual Ethernet Driver";
-#define ibmveth_driver_version "1.05"
+#define ibmveth_driver_version "1.06"
 
 MODULE_AUTHOR("Santiago Leon <santil@linux.vnet.ibm.com>");
 MODULE_DESCRIPTION("IBM Power Virtual Ethernet Driver");
@@ -137,6 +137,11 @@ static inline int ibmveth_rxq_frame_offset(struct ibmveth_adapter *adapter)
         return ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_OFF_MASK;
 }
 
+static inline int ibmveth_rxq_large_packet(struct ibmveth_adapter *adapter)
+{
+        return ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_LRG_PKT;
+}
+
 static inline int ibmveth_rxq_frame_length(struct ibmveth_adapter *adapter)
 {
         return be32_to_cpu(adapter->rx_queue.queue_addr[adapter->rx_queue.index].length);
@@ -1174,6 +1179,45 @@ map_failed:
         goto retry_bounce;
 }
 
+static void ibmveth_rx_mss_helper(struct sk_buff *skb, u16 mss, int lrg_pkt)
+{
+        int offset = 0;
+
+        /* only TCP packets will be aggregated */
+        if (skb->protocol == htons(ETH_P_IP)) {
+                struct iphdr *iph = (struct iphdr *)skb->data;
+
+                if (iph->protocol == IPPROTO_TCP) {
+                        offset = iph->ihl * 4;
+                        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
+                } else {
+                        return;
+                }
+        } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                struct ipv6hdr *iph6 = (struct ipv6hdr *)skb->data;
+
+                if (iph6->nexthdr == IPPROTO_TCP) {
+                        offset = sizeof(struct ipv6hdr);
+                        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
+                } else {
+                        return;
+                }
+        } else {
+                return;
+        }
+        /* if mss is not set through Large Packet bit/mss in rx buffer,
+         * expect that the mss will be written to the tcp header checksum.
+         */
+        if (lrg_pkt) {
+                skb_shinfo(skb)->gso_size = mss;
+        } else if (offset) {
+                struct tcphdr *tcph = (struct tcphdr *)(skb->data + offset);
+
+                skb_shinfo(skb)->gso_size = ntohs(tcph->check);
+                tcph->check = 0;
+        }
+}
+
 static int ibmveth_poll(struct napi_struct *napi, int budget)
 {
         struct ibmveth_adapter *adapter =
@@ -1182,6 +1226,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
         int frames_processed = 0;
         unsigned long lpar_rc;
         struct iphdr *iph;
+        u16 mss = 0;
 
 restart_poll:
         while (frames_processed < budget) {
@@ -1199,9 +1244,21 @@ restart_poll:
                         int length = ibmveth_rxq_frame_length(adapter);
                         int offset = ibmveth_rxq_frame_offset(adapter);
                         int csum_good = ibmveth_rxq_csum_good(adapter);
+                        int lrg_pkt = ibmveth_rxq_large_packet(adapter);
 
                         skb = ibmveth_rxq_get_buffer(adapter);
 
+                        /* if the large packet bit is set in the rx queue
+                         * descriptor, the mss will be written by PHYP eight
+                         * bytes from the start of the rx buffer, which is
+                         * skb->data at this stage
+                         */
+                        if (lrg_pkt) {
+                                __be64 *rxmss = (__be64 *)(skb->data + 8);
+
+                                mss = (u16)be64_to_cpu(*rxmss);
+                        }
+
                         new_skb = NULL;
                         if (length < rx_copybreak)
                                 new_skb = netdev_alloc_skb(netdev, length);
@@ -1235,11 +1292,15 @@ restart_poll:
                                         if (iph->check == 0xffff) {
                                                 iph->check = 0;
                                                 iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
-                                                adapter->rx_large_packets++;
                                         }
                                 }
                         }
 
+                        if (length > netdev->mtu + ETH_HLEN) {
+                                ibmveth_rx_mss_helper(skb, mss, lrg_pkt);
+                                adapter->rx_large_packets++;
+                        }
+
                         napi_gro_receive(napi, skb);    /* send it up */
 
                         netdev->stats.rx_packets++;
diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h
index 4eade67fe30c..7acda04d034e 100644
--- a/drivers/net/ethernet/ibm/ibmveth.h
+++ b/drivers/net/ethernet/ibm/ibmveth.h
@@ -209,6 +209,7 @@ struct ibmveth_rx_q_entry {
 #define IBMVETH_RXQ_TOGGLE              0x80000000
 #define IBMVETH_RXQ_TOGGLE_SHIFT        31
 #define IBMVETH_RXQ_VALID               0x40000000
+#define IBMVETH_RXQ_LRG_PKT             0x04000000
 #define IBMVETH_RXQ_NO_CSUM             0x02000000
 #define IBMVETH_RXQ_CSUM_GOOD           0x01000000
 #define IBMVETH_RXQ_OFF_MASK            0x0000FFFF
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 4f3281a03e7e..0fbf686f5e7c 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -74,7 +74,6 @@
 #include <asm/iommu.h>
 #include <linux/uaccess.h>
 #include <asm/firmware.h>
-#include <linux/seq_file.h>
 #include <linux/workqueue.h>
 
 #include "ibmvnic.h"
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index edc9a6ac5169..9affd7c198bd 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -4931,11 +4931,15 @@ static int igb_tso(struct igb_ring *tx_ring,
 
         /* initialize outer IP header fields */
         if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
+
                 /* IP header will have to cancel out any data that
                  * is not a part of the outer IP header
                  */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
-                                                  csum_unfold(l4.tcp->check)));
+                ip.v4->check = csum_fold(csum_partial(trans_start,
+                                                      csum_start - trans_start,
+                                                      0));
                 type_tucmd |= E1000_ADVTXD_TUCMD_IPV4;
 
                 ip.v4->tot_len = 0;
diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index 12bb877df860..7dff7f6239cd 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -1965,11 +1965,15 @@ static int igbvf_tso(struct igbvf_ring *tx_ring,
 
         /* initialize outer IP header fields */
         if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
+
                 /* IP header will have to cancel out any data that
                  * is not a part of the outer IP header
                  */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
-                                                  csum_unfold(l4.tcp->check)));
+                ip.v4->check = csum_fold(csum_partial(trans_start,
+                                                      csum_start - trans_start,
+                                                      0));
                 type_tucmd |= E1000_ADVTXD_TUCMD_IPV4;
 
                 ip.v4->tot_len = 0;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index bd93d823cc25..fee1f2918ead 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -7277,11 +7277,15 @@ static int ixgbe_tso(struct ixgbe_ring *tx_ring,
 
         /* initialize outer IP header fields */
         if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
+
                 /* IP header will have to cancel out any data that
                  * is not a part of the outer IP header
                  */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
-                                                  csum_unfold(l4.tcp->check)));
+                ip.v4->check = csum_fold(csum_partial(trans_start,
+                                                      csum_start - trans_start,
+                                                      0));
                 type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4;
 
                 ip.v4->tot_len = 0;
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 7eaac3234049..cbf70fe4028a 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -3329,11 +3329,15 @@ static int ixgbevf_tso(struct ixgbevf_ring *tx_ring,
 
         /* initialize outer IP header fields */
         if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
+
                 /* IP header will have to cancel out any data that
                  * is not a part of the outer IP header
                  */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
-                                                  csum_unfold(l4.tcp->check)));
+                ip.v4->check = csum_fold(csum_partial(trans_start,
+                                                      csum_start - trans_start,
+                                                      0));
                 type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4;
 
                 ip.v4->tot_len = 0;
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 91e09d68b7e2..a167fd7ee13e 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -704,6 +704,7 @@ ltq_etop_probe(struct platform_device *pdev)
         priv->pldata = dev_get_platdata(&pdev->dev);
         priv->netdev = dev;
         spin_lock_init(&priv->lock);
+        SET_NETDEV_DEV(dev, &pdev->dev);
 
         for (i = 0; i < MAX_DMA_CHAN; i++) {
                 if (IS_TX(i))
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 5cb07c2017bf..707bc4680b9b 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -4151,7 +4151,7 @@ static int mvneta_probe(struct platform_device *pdev)
         dev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
         dev->hw_features |= dev->features;
         dev->vlan_features |= dev->features;
-        dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE;
+        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
         dev->gso_max_segs = MVNETA_MAX_TSO_SEGS;
 
         err = register_netdev(dev);
@@ -4191,6 +4191,8 @@ err_clk:
         clk_disable_unprepare(pp->clk);
 err_put_phy_node:
         of_node_put(phy_node);
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
 err_free_irq:
         irq_dispose_mapping(dev->irq);
 err_free_netdev:
@@ -4202,6 +4204,7 @@ err_free_netdev:
 static int mvneta_remove(struct platform_device *pdev)
 {
         struct net_device  *dev = platform_get_drvdata(pdev);
+        struct device_node *dn = pdev->dev.of_node;
         struct mvneta_port *pp = netdev_priv(dev);
 
         unregister_netdev(dev);
@@ -4209,6 +4212,8 @@ static int mvneta_remove(struct platform_device *pdev)
         clk_disable_unprepare(pp->clk);
         free_percpu(pp->ports);
         free_percpu(pp->stats);
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
         irq_dispose_mapping(dev->irq);
         of_node_put(pp->phy_node);
         free_netdev(dev);
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 60227a3452a4..1026c452e39d 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -3293,7 +3293,7 @@ static void mvpp2_cls_init(struct mvpp2 *priv)
         mvpp2_write(priv, MVPP2_CLS_MODE_REG, MVPP2_CLS_MODE_ACTIVE_MASK);
 
         /* Clear classifier flow table */
-        memset(&fe.data, 0, MVPP2_CLS_FLOWS_TBL_DATA_WORDS);
+        memset(&fe.data, 0, sizeof(fe.data));
         for (index = 0; index < MVPP2_CLS_FLOWS_TBL_SIZE; index++) {
                 fe.index = index;
                 mvpp2_cls_flow_write(priv, &fe);
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 4a62ffd7729d..86a89cbd3ec9 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -318,6 +318,8 @@ static int mtk_phy_connect(struct net_device *dev)
         return 0;
 
 err_phy:
+        if (of_phy_is_fixed_link(mac->of_node))
+                of_phy_deregister_fixed_link(mac->of_node);
         of_node_put(np);
         dev_err(eth->dev, "%s: invalid phy\n", __func__);
         return -EINVAL;
@@ -1923,6 +1925,8 @@ static void mtk_uninit(struct net_device *dev)
         struct mtk_eth *eth = mac->hw;
 
         phy_disconnect(dev->phydev);
+        if (of_phy_is_fixed_link(mac->of_node))
+                of_phy_deregister_fixed_link(mac->of_node);
         mtk_irq_disable(eth, MTK_QDMA_INT_MASK, ~0);
         mtk_irq_disable(eth, MTK_PDMA_INT_MASK, ~0);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 3a47e83d3e07..fb8bb027b69c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -129,6 +129,9 @@ static enum mlx4_net_trans_rule_id mlx4_ip_proto_to_trans_rule_id(u8 ip_proto)
         }
 };
 
+/* Must not acquire state_lock, as its corresponding work_sync
+ * is done under it.
+ */
 static void mlx4_en_filter_work(struct work_struct *work)
 {
         struct mlx4_en_filter *filter = container_of(work,
@@ -2076,13 +2079,6 @@ err:
         return -ENOMEM;
 }
 
-static void mlx4_en_shutdown(struct net_device *dev)
-{
-        rtnl_lock();
-        netif_device_detach(dev);
-        mlx4_en_close(dev);
-        rtnl_unlock();
-}
 
 static int mlx4_en_copy_priv(struct mlx4_en_priv *dst,
                              struct mlx4_en_priv *src,
@@ -2159,8 +2155,6 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        bool shutdown = mdev->dev->persist->interface_state &
-                                            MLX4_INTERFACE_STATE_SHUTDOWN;
 
         en_dbg(DRV, priv, "Destroying netdev on port:%d\n", priv->port);
 
@@ -2168,10 +2162,7 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         if (priv->registered) {
                 devlink_port_type_clear(mlx4_get_devlink_port(mdev->dev,
                                                               priv->port));
-                if (shutdown)
-                        mlx4_en_shutdown(dev);
-                else
-                        unregister_netdev(dev);
+                unregister_netdev(dev);
         }
 
         if (priv->allocated)
@@ -2189,19 +2180,18 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         mutex_lock(&mdev->state_lock);
         mdev->pndev[priv->port] = NULL;
         mdev->upper[priv->port] = NULL;
-        mutex_unlock(&mdev->state_lock);
 
 #ifdef CONFIG_RFS_ACCEL
         mlx4_en_cleanup_filters(priv);
 #endif
 
         mlx4_en_free_resources(priv);
+        mutex_unlock(&mdev->state_lock);
 
         kfree(priv->tx_ring);
         kfree(priv->tx_cq);
 
-        if (!shutdown)
-                free_netdev(dev);
+        free_netdev(dev);
 }
 
 static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 6f4e67bc3538..75d07fa9d0b1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -4147,11 +4147,8 @@ static void mlx4_shutdown(struct pci_dev *pdev)
 
         mlx4_info(persist->dev, "mlx4_shutdown was called\n");
         mutex_lock(&persist->interface_state_mutex);
-        if (persist->interface_state & MLX4_INTERFACE_STATE_UP) {
-                /* Notify mlx4 clients that the kernel is being shut down */
-                persist->interface_state |= MLX4_INTERFACE_STATE_SHUTDOWN;
+        if (persist->interface_state & MLX4_INTERFACE_STATE_UP)
                 mlx4_unload_one(pdev);
-        }
         mutex_unlock(&persist->interface_state_mutex);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index 94b891c118c1..1a670b681555 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -1457,7 +1457,12 @@ EXPORT_SYMBOL_GPL(mlx4_multicast_detach);
 int mlx4_flow_steer_promisc_add(struct mlx4_dev *dev, u8 port,
                                 u32 qpn, enum mlx4_net_trans_promisc_mode mode)
 {
-        struct mlx4_net_trans_rule rule;
+        struct mlx4_net_trans_rule rule = {
+                .queue_mode = MLX4_NET_TRANS_Q_FIFO,
+                .exclusive = 0,
+                .allow_loopback = 1,
+        };
+
         u64 *regid_p;
 
         switch (mode) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
index aae46884bf93..521cfdb7d11e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
@@ -18,8 +18,6 @@ config MLX5_CORE_EN
         default n
         ---help---
           Ethernet support in Mellanox Technologies ConnectX-4 NIC.
-          Ethernet and Infiniband support in ConnectX-4 are currently mutually
-          exclusive.
 
 config MLX5_CORE_EN_DCB
         bool "Data Center Bridging (DCB) Support"
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 1e639f886021..bfe410e8a469 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -268,11 +268,6 @@ static void dump_buf(void *buf, int size, int data_only, int offset)
                 pr_debug("\n");
 }
 
-enum {
-        MLX5_DRIVER_STATUS_ABORTED = 0xfe,
-        MLX5_DRIVER_SYND = 0xbadd00de,
-};
-
 static int mlx5_internal_err_ret_value(struct mlx5_core_dev *dev, u16 op,
                                        u32 *synd, u8 *status)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 7a43502a89cc..71382df59fc0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -241,7 +241,7 @@ struct mlx5e_tstamp {
 };
 
 enum {
-        MLX5E_RQ_STATE_FLUSH,
+        MLX5E_RQ_STATE_ENABLED,
         MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS,
         MLX5E_RQ_STATE_AM,
 };
@@ -394,7 +394,7 @@ struct mlx5e_sq_dma {
 };
 
 enum {
-        MLX5E_SQ_STATE_FLUSH,
+        MLX5E_SQ_STATE_ENABLED,
         MLX5E_SQ_STATE_BF_ENABLE,
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 84e8b250e2af..246d98ebb588 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -759,6 +759,7 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
         if (err)
                 goto err_destroy_rq;
 
+        set_bit(MLX5E_RQ_STATE_ENABLED, &rq->state);
         err = mlx5e_modify_rq_state(rq, MLX5_RQC_STATE_RST, MLX5_RQC_STATE_RDY);
         if (err)
                 goto err_disable_rq;
@@ -773,6 +774,7 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
         return 0;
 
 err_disable_rq:
+        clear_bit(MLX5E_RQ_STATE_ENABLED, &rq->state);
         mlx5e_disable_rq(rq);
 err_destroy_rq:
         mlx5e_destroy_rq(rq);
@@ -782,7 +784,7 @@ err_destroy_rq:
 
 static void mlx5e_close_rq(struct mlx5e_rq *rq)
 {
-        set_bit(MLX5E_RQ_STATE_FLUSH, &rq->state);
+        clear_bit(MLX5E_RQ_STATE_ENABLED, &rq->state);
         napi_synchronize(&rq->channel->napi); /* prevent mlx5e_post_rx_wqes */
         cancel_work_sync(&rq->am.work);
 
@@ -1006,7 +1008,6 @@ static int mlx5e_enable_sq(struct mlx5e_sq *sq, struct mlx5e_sq_param *param)
         MLX5_SET(sqc,  sqc, min_wqe_inline_mode, sq->min_inline_mode);
         MLX5_SET(sqc,  sqc, state,              MLX5_SQC_STATE_RST);
         MLX5_SET(sqc,  sqc, tis_lst_sz, param->type == MLX5E_SQ_ICO ? 0 : 1);
-        MLX5_SET(sqc,  sqc, flush_in_error_en,  1);
 
         MLX5_SET(wq,   wq, wq_type,       MLX5_WQ_TYPE_CYCLIC);
         MLX5_SET(wq,   wq, uar_page,      sq->uar.index);
@@ -1083,6 +1084,7 @@ static int mlx5e_open_sq(struct mlx5e_channel *c,
         if (err)
                 goto err_destroy_sq;
 
+        set_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
         err = mlx5e_modify_sq(sq, MLX5_SQC_STATE_RST, MLX5_SQC_STATE_RDY,
                               false, 0);
         if (err)
@@ -1096,6 +1098,7 @@ static int mlx5e_open_sq(struct mlx5e_channel *c,
         return 0;
 
 err_disable_sq:
+        clear_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
         mlx5e_disable_sq(sq);
 err_destroy_sq:
         mlx5e_destroy_sq(sq);
@@ -1112,7 +1115,7 @@ static inline void netif_tx_disable_queue(struct netdev_queue *txq)
 
 static void mlx5e_close_sq(struct mlx5e_sq *sq)
 {
-        set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
+        clear_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
         /* prevent netif_tx_wake_queue */
         napi_synchronize(&sq->channel->napi);
 
@@ -3092,7 +3095,7 @@ static void mlx5e_tx_timeout(struct net_device *dev)
                 if (!netif_xmit_stopped(netdev_get_tx_queue(dev, i)))
                         continue;
                 sched_work = true;
-                set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
+                clear_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
                 netdev_err(dev, "TX timeout on queue: %d, SQ: 0x%x, CQ: 0x%x, SQ Cons: 0x%x SQ Prod: 0x%x\n",
                            i, sq->sqn, sq->cq.mcq.cqn, sq->cc, sq->pc);
         }
@@ -3147,13 +3150,13 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog)
         for (i = 0; i < priv->params.num_channels; i++) {
                 struct mlx5e_channel *c = priv->channel[i];
 
-                set_bit(MLX5E_RQ_STATE_FLUSH, &c->rq.state);
+                clear_bit(MLX5E_RQ_STATE_ENABLED, &c->rq.state);
                 napi_synchronize(&c->napi);
                 /* prevent mlx5e_poll_rx_cq from accessing rq->xdp_prog */
 
                 old_prog = xchg(&c->rq.xdp_prog, prog);
 
-                clear_bit(MLX5E_RQ_STATE_FLUSH, &c->rq.state);
+                set_bit(MLX5E_RQ_STATE_ENABLED, &c->rq.state);
                 /* napi_schedule in case we have missed anything */
                 set_bit(MLX5E_CHANNEL_NAPI_SCHED, &c->flags);
                 napi_schedule(&c->napi);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index c6de6fba5843..33495d88aeb2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -340,7 +340,7 @@ static inline void mlx5e_post_umr_wqe(struct mlx5e_rq *rq, u16 ix)
         while ((pi = (sq->pc & wq->sz_m1)) > sq->edge) {
                 sq->db.ico_wqe[pi].opcode = MLX5_OPCODE_NOP;
                 sq->db.ico_wqe[pi].num_wqebbs = 1;
-                mlx5e_send_nop(sq, true);
+                mlx5e_send_nop(sq, false);
         }
 
         wqe = mlx5_wq_cyc_get_wqe(wq, pi);
@@ -412,7 +412,7 @@ void mlx5e_post_rx_mpwqe(struct mlx5e_rq *rq)
 
         clear_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state);
 
-        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state))) {
+        if (unlikely(!test_bit(MLX5E_RQ_STATE_ENABLED, &rq->state))) {
                 mlx5e_free_rx_mpwqe(rq, &rq->mpwqe.info[wq->head]);
                 return;
         }
@@ -445,7 +445,7 @@ void mlx5e_dealloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)
 }
 
 #define RQ_CANNOT_POST(rq) \
-        (test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state) || \
+        (!test_bit(MLX5E_RQ_STATE_ENABLED, &rq->state) || \
          test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
 
 bool mlx5e_post_rx_wqes(struct mlx5e_rq *rq)
@@ -924,7 +924,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
         struct mlx5e_sq *xdp_sq = &rq->channel->xdp_sq;
         int work_done = 0;
 
-        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state)))
+        if (unlikely(!test_bit(MLX5E_RQ_STATE_ENABLED, &rq->state)))
                 return 0;
 
         if (cq->decmprs_left)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 70a717382357..cfb68371c397 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -409,7 +409,7 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
 
         sq = container_of(cq, struct mlx5e_sq, cq);
 
-        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
+        if (unlikely(!test_bit(MLX5E_SQ_STATE_ENABLED, &sq->state)))
                 return false;
 
         npkts = 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
index 5703f19a6a24..e5c12a732aa1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
@@ -56,7 +56,7 @@ static void mlx5e_poll_ico_cq(struct mlx5e_cq *cq)
         struct mlx5_cqe64 *cqe;
         u16 sqcc;
 
-        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
+        if (unlikely(!test_bit(MLX5E_SQ_STATE_ENABLED, &sq->state)))
                 return;
 
         cqe = mlx5e_get_cqe(cq);
@@ -113,7 +113,7 @@ static inline bool mlx5e_poll_xdp_tx_cq(struct mlx5e_cq *cq)
 
         sq = container_of(cq, struct mlx5e_sq, cq);
 
-        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
+        if (unlikely(!test_bit(MLX5E_SQ_STATE_ENABLED, &sq->state)))
                 return false;
 
         /* sq->cc must be updated only after mlx5_cqwq_update_db_record(),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 3eb931585b3e..ada24e103b02 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -46,7 +46,6 @@
 #include <linux/mlx5/srq.h>
 #include <linux/debugfs.h>
 #include <linux/kmod.h>
-#include <linux/delay.h>
 #include <linux/mlx5/mlx5_ifc.h>
 #ifdef CONFIG_RFS_ACCEL
 #include <linux/cpu_rmap.h>
@@ -63,13 +62,13 @@ MODULE_DESCRIPTION("Mellanox Connect-IB, ConnectX-4 core driver");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION(DRIVER_VERSION);
 
-int mlx5_core_debug_mask;
-module_param_named(debug_mask, mlx5_core_debug_mask, int, 0644);
+unsigned int mlx5_core_debug_mask;
+module_param_named(debug_mask, mlx5_core_debug_mask, uint, 0644);
 MODULE_PARM_DESC(debug_mask, "debug mask: 1 = dump cmd data, 2 = dump cmd exec time, 3 = both. Default=0");
 
 #define MLX5_DEFAULT_PROF       2
-static int prof_sel = MLX5_DEFAULT_PROF;
-module_param_named(prof_sel, prof_sel, int, 0444);
+static unsigned int prof_sel = MLX5_DEFAULT_PROF;
+module_param_named(prof_sel, prof_sel, uint, 0444);
 MODULE_PARM_DESC(prof_sel, "profile selector. Valid range 0 - 2");
 
 enum {
@@ -733,13 +732,15 @@ static int mlx5_core_set_issi(struct mlx5_core_dev *dev)
                 u8 status;
 
                 mlx5_cmd_mbox_status(query_out, &status, &syndrome);
-                if (status == MLX5_CMD_STAT_BAD_OP_ERR) {
-                        pr_debug("Only ISSI 0 is supported\n");
-                        return 0;
+                if (!status || syndrome == MLX5_DRIVER_SYND) {
+                        mlx5_core_err(dev, "Failed to query ISSI err(%d) status(%d) synd(%d)\n",
+                                      err, status, syndrome);
+                        return err;
                 }
 
-                pr_err("failed to query ISSI err(%d)\n", err);
-                return err;
+                mlx5_core_warn(dev, "Query ISSI is not supported by FW, ISSI is 0\n");
+                dev->issi = 0;
+                return 0;
         }
 
         sup_issi = MLX5_GET(query_issi_out, query_out, supported_issi_dw0);
@@ -753,7 +754,8 @@ static int mlx5_core_set_issi(struct mlx5_core_dev *dev)
                 err = mlx5_cmd_exec(dev, set_in, sizeof(set_in),
                                     set_out, sizeof(set_out));
                 if (err) {
-                        pr_err("failed to set ISSI=1 err(%d)\n", err);
+                        mlx5_core_err(dev, "Failed to set ISSI to 1 err(%d)\n",
+                                      err);
                         return err;
                 }
 
@@ -1228,13 +1230,6 @@ static int init_one(struct pci_dev *pdev,
 
         dev->pdev = pdev;
         dev->event = mlx5_core_event;
-
-        if (prof_sel < 0 || prof_sel >= ARRAY_SIZE(profile)) {
-                mlx5_core_warn(dev,
-                               "selected profile out of range, selecting default (%d)\n",
-                               MLX5_DEFAULT_PROF);
-                prof_sel = MLX5_DEFAULT_PROF;
-        }
         dev->profile = &profile[prof_sel];
 
         INIT_LIST_HEAD(&priv->ctx_list);
@@ -1451,10 +1446,22 @@ static struct pci_driver mlx5_core_driver = {
         .sriov_configure   = mlx5_core_sriov_configure,
 };
 
+static void mlx5_core_verify_params(void)
+{
+        if (prof_sel >= ARRAY_SIZE(profile)) {
+                pr_warn("mlx5_core: WARNING: Invalid module parameter prof_sel %d, valid range 0-%zu, changing back to default(%d)\n",
+                        prof_sel,
+                        ARRAY_SIZE(profile) - 1,
+                        MLX5_DEFAULT_PROF);
+                prof_sel = MLX5_DEFAULT_PROF;
+        }
+}
+
 static int __init init(void)
 {
         int err;
 
+        mlx5_core_verify_params();
         mlx5_register_debugfs();
 
         err = pci_register_driver(&mlx5_core_driver);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index 187662c8ea96..63b9a0dba885 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -44,11 +44,11 @@
 
 #define MLX5_TOTAL_VPORTS(mdev) (1 + pci_sriov_get_totalvfs(mdev->pdev))
 
-extern int mlx5_core_debug_mask;
+extern uint mlx5_core_debug_mask;
 
 #define mlx5_core_dbg(__dev, format, ...)                               \
-        dev_dbg(&(__dev)->pdev->dev, "%s:%s:%d:(pid %d): " format,      \
-                 (__dev)->priv.name, __func__, __LINE__, current->pid,  \
+        dev_dbg(&(__dev)->pdev->dev, "%s:%d:(pid %d): " format,         \
+                 __func__, __LINE__, current->pid,                      \
                  ##__VA_ARGS__)
 
 #define mlx5_core_dbg_mask(__dev, mask, format, ...)                    \
@@ -63,8 +63,8 @@ do {									\
                ##__VA_ARGS__)
 
 #define mlx5_core_warn(__dev, format, ...)                              \
-        dev_warn(&(__dev)->pdev->dev, "%s:%s:%d:(pid %d): " format,     \
-                (__dev)->priv.name, __func__, __LINE__, current->pid,   \
+        dev_warn(&(__dev)->pdev->dev, "%s:%d:(pid %d): " format,        \
+                 __func__, __LINE__, current->pid,                      \
                 ##__VA_ARGS__)
 
 #define mlx5_core_info(__dev, format, ...)                              \
@@ -75,6 +75,11 @@ enum {
         MLX5_CMD_TIME, /* print command execution time */
 };
 
+enum {
+        MLX5_DRIVER_STATUS_ABORTED = 0xfe,
+        MLX5_DRIVER_SYND = 0xbadd00de,
+};
+
 int mlx5_query_hca_caps(struct mlx5_core_dev *dev);
 int mlx5_query_board_id(struct mlx5_core_dev *dev);
 int mlx5_cmd_init_hca(struct mlx5_core_dev *dev);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index f95385cbbd40..62ae55bd81b8 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -1730,6 +1730,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb)
                                                        mapping))) {
                                 DP_NOTICE(cdev,
                                           "Unable to map frag - dropping packet\n");
+                                rc = -ENOMEM;
                                 goto err;
                         }
                 } else {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index da4e90db4d98..99a14df28b96 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -212,6 +212,7 @@ int emac_phy_config(struct platform_device *pdev, struct emac_adapter *adpt)
 
                 phy_np = of_parse_phandle(np, "phy-handle", 0);
                 adpt->phydev = of_phy_find_device(phy_np);
+                of_node_put(phy_np);
         }
 
         if (!adpt->phydev) {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 4fede4b86538..57b35aeac51a 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -711,6 +711,8 @@ static int emac_probe(struct platform_device *pdev)
 err_undo_napi:
         netif_napi_del(&adpt->rx_q.napi);
 err_undo_mdiobus:
+        if (!has_acpi_companion(&pdev->dev))
+                put_device(&adpt->phydev->mdio.dev);
         mdiobus_unregister(adpt->mii_bus);
 err_undo_clocks:
         emac_clks_teardown(adpt);
@@ -730,6 +732,8 @@ static int emac_remove(struct platform_device *pdev)
 
         emac_clks_teardown(adpt);
 
+        if (!has_acpi_companion(&pdev->dev))
+                put_device(&adpt->phydev->mdio.dev);
         mdiobus_unregister(adpt->mii_bus);
         free_netdev(netdev);
 
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 630536bc72f9..d6a217874a8b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1008,20 +1008,18 @@ static int ravb_phy_init(struct net_device *ndev)
         of_node_put(pn);
         if (!phydev) {
                 netdev_err(ndev, "failed to connect PHY\n");
-                return -ENOENT;
+                err = -ENOENT;
+                goto err_deregister_fixed_link;
         }
 
         /* This driver only support 10/100Mbit speeds on Gen3
          * at this time.
          */
         if (priv->chip_id == RCAR_GEN3) {
-                int err;
-
                 err = phy_set_max_speed(phydev, SPEED_100);
                 if (err) {
                         netdev_err(ndev, "failed to limit PHY to 100Mbit/s\n");
-                        phy_disconnect(phydev);
-                        return err;
+                        goto err_phy_disconnect;
                 }
 
                 netdev_info(ndev, "limited PHY to 100Mbit/s\n");
@@ -1033,6 +1031,14 @@ static int ravb_phy_init(struct net_device *ndev)
         phy_attached_info(phydev);
 
         return 0;
+
+err_phy_disconnect:
+        phy_disconnect(phydev);
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+
+        return err;
 }
 
 /* PHY control start function */
@@ -1634,6 +1640,7 @@ static void ravb_set_rx_mode(struct net_device *ndev)
 /* Device close function for Ethernet AVB */
 static int ravb_close(struct net_device *ndev)
 {
+        struct device_node *np = ndev->dev.parent->of_node;
         struct ravb_private *priv = netdev_priv(ndev);
         struct ravb_tstamp_skb *ts_skb, *ts_skb2;
 
@@ -1663,6 +1670,8 @@ static int ravb_close(struct net_device *ndev)
         if (ndev->phydev) {
                 phy_stop(ndev->phydev);
                 phy_disconnect(ndev->phydev);
+                if (of_phy_is_fixed_link(np))
+                        of_phy_deregister_fixed_link(np);
         }
 
         if (priv->chip_id != RCAR_GEN2) {
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 05b0dc55de77..1a92de705199 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -518,7 +518,7 @@ static struct sh_eth_cpu_data r7s72100_data = {
 
         .ecsr_value     = ECSR_ICD,
         .ecsipr_value   = ECSIPR_ICDIP,
-        .eesipr_value   = 0xff7f009f,
+        .eesipr_value   = 0xe77f009f,
 
         .tx_check       = EESR_TC1 | EESR_FTC,
         .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index e9b8579e6241..8b0016a785c0 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -438,9 +438,16 @@ static int smsc911x_request_resources(struct platform_device *pdev)
         ret = regulator_bulk_get(&pdev->dev,
                         ARRAY_SIZE(pdata->supplies),
                         pdata->supplies);
-        if (ret)
+        if (ret) {
+                /*
+                 * Retry on deferrals, else just report the error
+                 * and try to continue.
+                 */
+                if (ret == -EPROBE_DEFER)
+                        return ret;
                 netdev_err(ndev, "couldn't get regulators %d\n",
                                 ret);
+        }
 
         /* Request optional RESET GPIO */
         pdata->reset_gpiod = devm_gpiod_get_optional(&pdev->dev,
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
index b1e5f24708c9..e6e6c2fcc4b7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
@@ -50,10 +50,23 @@ static int dwmac_generic_probe(struct platform_device *pdev)
         if (plat_dat->init) {
                 ret = plat_dat->init(pdev, plat_dat->bsp_priv);
                 if (ret)
-                        return ret;
+                        goto err_remove_config_dt;
         }
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_exit;
+
+        return 0;
+
+err_exit:
+        if (plat_dat->exit)
+                plat_dat->exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        if (pdev->dev.of_node)
+                stmmac_remove_config_dt(pdev, plat_dat);
+
+        return ret;
 }
 
 static const struct of_device_id dwmac_generic_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
index 36d3355f2fb0..866444b6c82f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
@@ -271,15 +271,17 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         gmac = devm_kzalloc(dev, sizeof(*gmac), GFP_KERNEL);
-        if (!gmac)
-                return -ENOMEM;
+        if (!gmac) {
+                err = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         gmac->pdev = pdev;
 
         err = ipq806x_gmac_of_parse(gmac);
         if (err) {
                 dev_err(dev, "device tree parsing error\n");
-                return err;
+                goto err_remove_config_dt;
         }
 
         regmap_write(gmac->qsgmii_csr, QSGMII_PCS_CAL_LCKDT_CTL,
@@ -300,7 +302,8 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
         default:
                 dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
                         phy_modes(gmac->phy_mode));
-                return -EINVAL;
+                err = -EINVAL;
+                goto err_remove_config_dt;
         }
         regmap_write(gmac->nss_common, NSS_COMMON_GMAC_CTL(gmac->id), val);
 
@@ -319,7 +322,8 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
         default:
                 dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
                         phy_modes(gmac->phy_mode));
-                return -EINVAL;
+                err = -EINVAL;
+                goto err_remove_config_dt;
         }
         regmap_write(gmac->nss_common, NSS_COMMON_CLK_SRC_CTRL, val);
 
@@ -346,7 +350,16 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
         plat_dat->bsp_priv = gmac;
         plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed;
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        err = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (err)
+                goto err_remove_config_dt;
+
+        return 0;
+
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+
+        return err;
 }
 
 static const struct of_device_id ipq806x_gmac_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c
index 78e9d1861896..3d3f43d91b98 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c
@@ -46,7 +46,8 @@ static int lpc18xx_dwmac_probe(struct platform_device *pdev)
         reg = syscon_regmap_lookup_by_compatible("nxp,lpc1850-creg");
         if (IS_ERR(reg)) {
                 dev_err(&pdev->dev, "syscon lookup failed\n");
-                return PTR_ERR(reg);
+                ret = PTR_ERR(reg);
+                goto err_remove_config_dt;
         }
 
         if (plat_dat->interface == PHY_INTERFACE_MODE_MII) {
@@ -55,13 +56,23 @@ static int lpc18xx_dwmac_probe(struct platform_device *pdev)
                 ethmode = LPC18XX_CREG_CREG6_ETHMODE_RMII;
         } else {
                 dev_err(&pdev->dev, "Only MII and RMII mode supported\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_remove_config_dt;
         }
 
         regmap_update_bits(reg, LPC18XX_CREG_CREG6,
                            LPC18XX_CREG_CREG6_ETHMODE_MASK, ethmode);
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_remove_config_dt;
+
+        return 0;
+
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+
+        return ret;
 }
 
 static const struct of_device_id lpc18xx_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c
index 309d99536a2c..7fdd1760a74c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c
@@ -64,18 +64,31 @@ static int meson6_dwmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
-                return -ENOMEM;
+        if (!dwmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         dwmac->reg = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(dwmac->reg))
-                return PTR_ERR(dwmac->reg);
+        if (IS_ERR(dwmac->reg)) {
+                ret = PTR_ERR(dwmac->reg);
+                goto err_remove_config_dt;
+        }
 
         plat_dat->bsp_priv = dwmac;
         plat_dat->fix_mac_speed = meson6_dwmac_fix_mac_speed;
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_remove_config_dt;
+
+        return 0;
+
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+
+        return ret;
 }
 
 static const struct of_device_id meson6_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
index 250e4ceafc8d..ffaed1f35efe 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
@@ -264,32 +264,48 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
-                return -ENOMEM;
+        if (!dwmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         dwmac->regs = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(dwmac->regs))
-                return PTR_ERR(dwmac->regs);
+        if (IS_ERR(dwmac->regs)) {
+                ret = PTR_ERR(dwmac->regs);
+                goto err_remove_config_dt;
+        }
 
         dwmac->pdev = pdev;
         dwmac->phy_mode = of_get_phy_mode(pdev->dev.of_node);
         if (dwmac->phy_mode < 0) {
                 dev_err(&pdev->dev, "missing phy-mode property\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_remove_config_dt;
         }
 
         ret = meson8b_init_clk(dwmac);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
 
         ret = meson8b_init_prg_eth(dwmac);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
 
         plat_dat->bsp_priv = dwmac;
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_clk_disable;
+
+        return 0;
+
+err_clk_disable:
+        clk_disable_unprepare(dwmac->m25_div_clk);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+
+        return ret;
 }
 
 static int meson8b_dwmac_remove(struct platform_device *pdev)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 3740a4417fa0..d80c88bd2bba 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -981,14 +981,27 @@ static int rk_gmac_probe(struct platform_device *pdev)
         plat_dat->resume = rk_gmac_resume;
 
         plat_dat->bsp_priv = rk_gmac_setup(pdev, data);
-        if (IS_ERR(plat_dat->bsp_priv))
-                return PTR_ERR(plat_dat->bsp_priv);
+        if (IS_ERR(plat_dat->bsp_priv)) {
+                ret = PTR_ERR(plat_dat->bsp_priv);
+                goto err_remove_config_dt;
+        }
 
         ret = rk_gmac_init(pdev, plat_dat->bsp_priv);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
+
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_gmac_exit;
+
+        return 0;
+
+err_gmac_exit:
+        rk_gmac_exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        return ret;
 }
 
 static const struct of_device_id rk_gmac_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
index bec6963ac71e..0c420e97de1e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
@@ -304,6 +304,8 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
         struct device           *dev = &pdev->dev;
         int                     ret;
         struct socfpga_dwmac    *dwmac;
+        struct net_device       *ndev;
+        struct stmmac_priv      *stpriv;
 
         ret = stmmac_get_platform_resources(pdev, &stmmac_res);
         if (ret)
@@ -314,32 +316,43 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         dwmac = devm_kzalloc(dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
-                return -ENOMEM;
+        if (!dwmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         ret = socfpga_dwmac_parse_data(dwmac, dev);
         if (ret) {
                 dev_err(dev, "Unable to parse OF data\n");
-                return ret;
+                goto err_remove_config_dt;
         }
 
         plat_dat->bsp_priv = dwmac;
         plat_dat->fix_mac_speed = socfpga_dwmac_fix_mac_speed;
 
         ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_remove_config_dt;
 
-        if (!ret) {
-                struct net_device *ndev = platform_get_drvdata(pdev);
-                struct stmmac_priv *stpriv = netdev_priv(ndev);
+        ndev = platform_get_drvdata(pdev);
+        stpriv = netdev_priv(ndev);
 
-                /* The socfpga driver needs to control the stmmac reset to
-                 * set the phy mode. Create a copy of the core reset handel
-                 * so it can be used by the driver later.
-                 */
-                dwmac->stmmac_rst = stpriv->stmmac_rst;
+        /* The socfpga driver needs to control the stmmac reset to set the phy
+         * mode. Create a copy of the core reset handle so it can be used by
+         * the driver later.
+         */
+        dwmac->stmmac_rst = stpriv->stmmac_rst;
 
-                ret = socfpga_dwmac_set_phy_mode(dwmac);
-        }
+        ret = socfpga_dwmac_set_phy_mode(dwmac);
+        if (ret)
+                goto err_dvr_remove;
+
+        return 0;
+
+err_dvr_remove:
+        stmmac_dvr_remove(&pdev->dev);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
 
         return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
index 58c05acc2aab..060b98c37a85 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
@@ -345,13 +345,15 @@ static int sti_dwmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
-                return -ENOMEM;
+        if (!dwmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         ret = sti_dwmac_parse_data(dwmac, pdev);
         if (ret) {
                 dev_err(&pdev->dev, "Unable to parse OF data\n");
-                return ret;
+                goto err_remove_config_dt;
         }
 
         dwmac->fix_retime_src = data->fix_retime_src;
@@ -363,9 +365,20 @@ static int sti_dwmac_probe(struct platform_device *pdev)
 
         ret = sti_dwmac_init(pdev, plat_dat->bsp_priv);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
+
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_dwmac_exit;
+
+        return 0;
+
+err_dwmac_exit:
+        sti_dwmac_exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        return ret;
 }
 
 static const struct sti_dwmac_of_data stih4xx_dwmac_data = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
index e5a926b8bee7..61cb24810d10 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
@@ -107,24 +107,33 @@ static int stm32_dwmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
-                return -ENOMEM;
+        if (!dwmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         ret = stm32_dwmac_parse_data(dwmac, &pdev->dev);
         if (ret) {
                 dev_err(&pdev->dev, "Unable to parse OF data\n");
-                return ret;
+                goto err_remove_config_dt;
         }
 
         plat_dat->bsp_priv = dwmac;
 
         ret = stm32_dwmac_init(plat_dat);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
 
         ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
         if (ret)
-                stm32_dwmac_clk_disable(dwmac);
+                goto err_clk_disable;
+
+        return 0;
+
+err_clk_disable:
+        stm32_dwmac_clk_disable(dwmac);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
 
         return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
index adff46375a32..d07520fb969e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
@@ -120,22 +120,27 @@ static int sun7i_gmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         gmac = devm_kzalloc(dev, sizeof(*gmac), GFP_KERNEL);
-        if (!gmac)
-                return -ENOMEM;
+        if (!gmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         gmac->interface = of_get_phy_mode(dev->of_node);
 
         gmac->tx_clk = devm_clk_get(dev, "allwinner_gmac_tx");
         if (IS_ERR(gmac->tx_clk)) {
                 dev_err(dev, "could not get tx clock\n");
-                return PTR_ERR(gmac->tx_clk);
+                ret = PTR_ERR(gmac->tx_clk);
+                goto err_remove_config_dt;
         }
 
         /* Optional regulator for PHY */
         gmac->regulator = devm_regulator_get_optional(dev, "phy");
         if (IS_ERR(gmac->regulator)) {
-                if (PTR_ERR(gmac->regulator) == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
+                if (PTR_ERR(gmac->regulator) == -EPROBE_DEFER) {
+                        ret = -EPROBE_DEFER;
+                        goto err_remove_config_dt;
+                }
                 dev_info(dev, "no regulator found\n");
                 gmac->regulator = NULL;
         }
@@ -151,11 +156,18 @@ static int sun7i_gmac_probe(struct platform_device *pdev)
 
         ret = sun7i_gmac_init(pdev, plat_dat->bsp_priv);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
 
         ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
         if (ret)
-                sun7i_gmac_exit(pdev, plat_dat->bsp_priv);
+                goto err_gmac_exit;
+
+        return 0;
+
+err_gmac_exit:
+        sun7i_gmac_exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
 
         return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
index 990746955216..f35385266fbf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
@@ -43,9 +43,11 @@ static void dwmac1000_dma_axi(void __iomem *ioaddr, struct stmmac_axi *axi)
         if (axi->axi_xit_frm)
                 value |= DMA_AXI_LPI_XIT_FRM;
 
+        value &= ~DMA_AXI_WR_OSR_LMT;
         value |= (axi->axi_wr_osr_lmt & DMA_AXI_WR_OSR_LMT_MASK) <<
                  DMA_AXI_WR_OSR_LMT_SHIFT;
 
+        value &= ~DMA_AXI_RD_OSR_LMT;
         value |= (axi->axi_rd_osr_lmt & DMA_AXI_RD_OSR_LMT_MASK) <<
                  DMA_AXI_RD_OSR_LMT_SHIFT;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
index 116151cd6a95..32bc2fc73cdc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
@@ -30,9 +30,11 @@ static void dwmac4_dma_axi(void __iomem *ioaddr, struct stmmac_axi *axi)
         if (axi->axi_xit_frm)
                 value |= DMA_AXI_LPI_XIT_FRM;
 
+        value &= ~DMA_AXI_WR_OSR_LMT;
         value |= (axi->axi_wr_osr_lmt & DMA_AXI_OSR_MAX) <<
                  DMA_AXI_WR_OSR_LMT_SHIFT;
 
+        value &= ~DMA_AXI_RD_OSR_LMT;
         value |= (axi->axi_rd_osr_lmt & DMA_AXI_OSR_MAX) <<
                  DMA_AXI_RD_OSR_LMT_SHIFT;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 1f9ec02fa7f8..caf069a465f2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3416,7 +3416,6 @@ int stmmac_dvr_remove(struct device *dev)
         stmmac_set_mac(priv->ioaddr, false);
         netif_carrier_off(ndev);
         unregister_netdev(ndev);
-        of_node_put(priv->plat->phy_node);
         if (priv->stmmac_rst)
                 reset_control_assert(priv->stmmac_rst);
         clk_disable_unprepare(priv->pclk);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 0a0d6a86f397..ac3d39c69509 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -126,8 +126,10 @@ static struct stmmac_axi *stmmac_axi_setup(struct platform_device *pdev)
         axi->axi_mb = of_property_read_bool(np, "snps,axi_mb");
         axi->axi_rb =  of_property_read_bool(np, "snps,axi_rb");
 
-        of_property_read_u32(np, "snps,wr_osr_lmt", &axi->axi_wr_osr_lmt);
-        of_property_read_u32(np, "snps,rd_osr_lmt", &axi->axi_rd_osr_lmt);
+        if (of_property_read_u32(np, "snps,wr_osr_lmt", &axi->axi_wr_osr_lmt))
+                axi->axi_wr_osr_lmt = 1;
+        if (of_property_read_u32(np, "snps,rd_osr_lmt", &axi->axi_rd_osr_lmt))
+                axi->axi_rd_osr_lmt = 1;
         of_property_read_u32_array(np, "snps,blen", axi->axi_blen, AXI_BLEN);
         of_node_put(np);
 
@@ -200,7 +202,6 @@ static int stmmac_dt_phy(struct plat_stmmacenet_data *plat,
 /**
  * stmmac_probe_config_dt - parse device-tree driver parameters
  * @pdev: platform_device structure
- * @plat: driver data platform structure
  * @mac: MAC address to use
  * Description:
  * this function is to read the driver parameters from device-tree and
@@ -306,7 +307,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
                 dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg),
                                        GFP_KERNEL);
                 if (!dma_cfg) {
-                        of_node_put(plat->phy_node);
+                        stmmac_remove_config_dt(pdev, plat);
                         return ERR_PTR(-ENOMEM);
                 }
                 plat->dma_cfg = dma_cfg;
@@ -329,14 +330,37 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
 
         return plat;
 }
+
+/**
+ * stmmac_remove_config_dt - undo the effects of stmmac_probe_config_dt()
+ * @pdev: platform_device structure
+ * @plat: driver data platform structure
+ *
+ * Release resources claimed by stmmac_probe_config_dt().
+ */
+void stmmac_remove_config_dt(struct platform_device *pdev,
+                             struct plat_stmmacenet_data *plat)
+{
+        struct device_node *np = pdev->dev.of_node;
+
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+        of_node_put(plat->phy_node);
+}
 #else
 struct plat_stmmacenet_data *
 stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
 {
         return ERR_PTR(-ENOSYS);
 }
+
+void stmmac_remove_config_dt(struct platform_device *pdev,
+                             struct plat_stmmacenet_data *plat)
+{
+}
 #endif /* CONFIG_OF */
 EXPORT_SYMBOL_GPL(stmmac_probe_config_dt);
+EXPORT_SYMBOL_GPL(stmmac_remove_config_dt);
 
 int stmmac_get_platform_resources(struct platform_device *pdev,
                                   struct stmmac_resources *stmmac_res)
@@ -392,10 +416,13 @@ int stmmac_pltfr_remove(struct platform_device *pdev)
 {
         struct net_device *ndev = platform_get_drvdata(pdev);
         struct stmmac_priv *priv = netdev_priv(ndev);
+        struct plat_stmmacenet_data *plat = priv->plat;
         int ret = stmmac_dvr_remove(&pdev->dev);
 
-        if (priv->plat->exit)
-                priv->plat->exit(pdev, priv->plat->bsp_priv);
+        if (plat->exit)
+                plat->exit(pdev, plat->bsp_priv);
+
+        stmmac_remove_config_dt(pdev, plat);
 
         return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h
index 64e147f53a9c..b72eb0de57b7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h
@@ -23,6 +23,8 @@
 
 struct plat_stmmacenet_data *
 stmmac_probe_config_dt(struct platform_device *pdev, const char **mac);
+void stmmac_remove_config_dt(struct platform_device *pdev,
+                             struct plat_stmmacenet_data *plat);
 
 int stmmac_get_platform_resources(struct platform_device *pdev,
                                   struct stmmac_resources *stmmac_res);
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index 5eedac495077..97d64bfed465 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
+++ b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -33,7 +33,6 @@
 #include <linux/stat.h>
 #include <linux/types.h>
 
-#include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/mm.h>
@@ -43,7 +42,6 @@
 
 #include <linux/phy.h>
 #include <linux/mii.h>
-#include <linux/delay.h>
 #include <linux/dma-mapping.h>
 #include <linux/vmalloc.h>
 
@@ -2883,7 +2881,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = of_get_phy_mode(lp->pdev->dev.of_node);
         if (ret < 0) {
                 dev_err(&lp->pdev->dev, "error in getting phy i/f\n");
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
 
         lp->phy_interface = ret;
@@ -2891,14 +2889,14 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = dwceqos_mii_init(lp);
         if (ret) {
                 dev_err(&lp->pdev->dev, "error in dwceqos_mii_init\n");
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
 
         ret = dwceqos_mii_probe(ndev);
         if (ret != 0) {
                 netdev_err(ndev, "mii_probe fail.\n");
                 ret = -ENXIO;
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
 
         dwceqos_set_umac_addr(lp, lp->ndev->dev_addr, 0);
@@ -2916,7 +2914,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to retrieve DT, error %d\n",
                         ret);
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
         dev_info(&lp->pdev->dev, "pdev->id %d, baseaddr 0x%08lx, irq %d\n",
                  pdev->id, ndev->base_addr, ndev->irq);
@@ -2926,7 +2924,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to request IRQ %d, error %d\n",
                         ndev->irq, ret);
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
 
         if (netif_msg_probe(lp))
@@ -2937,11 +2935,14 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = register_netdev(ndev);
         if (ret) {
                 dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
-                        goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
 
         return 0;
 
+err_out_deregister_fixed_link:
+        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                of_phy_deregister_fixed_link(pdev->dev.of_node);
 err_out_clk_dis_phy:
         clk_disable_unprepare(lp->phy_ref_clk);
 err_out_clk_dis_aper:
@@ -2961,8 +2962,11 @@ static int dwceqos_remove(struct platform_device *pdev)
         if (ndev) {
                 lp = netdev_priv(ndev);
 
-                if (ndev->phydev)
+                if (ndev->phydev) {
                         phy_disconnect(ndev->phydev);
+                        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                                of_phy_deregister_fixed_link(pdev->dev.of_node);
+                }
                 mdiobus_unregister(lp->mii_bus);
                 mdiobus_free(lp->mii_bus);
 
diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
index fa0cfda24fd9..28097be2ff28 100644
--- a/drivers/net/ethernet/ti/cpmac.c
+++ b/drivers/net/ethernet/ti/cpmac.c
@@ -1113,6 +1113,7 @@ static int cpmac_probe(struct platform_device *pdev)
         if (!dev)
                 return -ENOMEM;
 
+        SET_NETDEV_DEV(dev, &pdev->dev);
         platform_set_drvdata(pdev, dev);
         priv = netdev_priv(dev);
 
diff --git a/drivers/net/ethernet/ti/cpsw-phy-sel.c b/drivers/net/ethernet/ti/cpsw-phy-sel.c
index ba1e45ff6aae..18013645e76c 100644
--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
+++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
@@ -81,6 +81,7 @@ static void cpsw_gmii_sel_am3352(struct cpsw_phy_sel_priv *priv,
         };
 
         mask = GMII_SEL_MODE_MASK << (slave * 2) | BIT(slave + 6);
+        mask |= BIT(slave + 4);
         mode <<= slave * 2;
 
         if (priv->rmii_clock_external) {
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 58947aae31c7..b9087b828eff 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2459,20 +2459,8 @@ static void cpsw_remove_dt(struct platform_device *pdev)
                 if (strcmp(slave_node->name, "slave"))
                         continue;
 
-                if (of_phy_is_fixed_link(slave_node)) {
-                        struct phy_device *phydev;
-
-                        phydev = of_phy_find_device(slave_node);
-                        if (phydev) {
-                                fixed_phy_unregister(phydev);
-                                /* Put references taken by
-                                 * of_phy_find_device() and
-                                 * of_phy_register_fixed_link().
-                                 */
-                                phy_device_free(phydev);
-                                phy_device_free(phydev);
-                        }
-                }
+                if (of_phy_is_fixed_link(slave_node))
+                        of_phy_deregister_fixed_link(slave_node);
 
                 of_node_put(slave_data->phy_node);
 
@@ -2942,6 +2930,8 @@ static int cpsw_resume(struct device *dev)
         /* Select default pin state */
         pinctrl_pm_select_default_state(dev);
 
+        /* shut up ASSERT_RTNL() warning in netif_set_real_num_tx/rx_queues */
+        rtnl_lock();
         if (cpsw->data.dual_emac) {
                 int i;
 
@@ -2953,6 +2943,8 @@ static int cpsw_resume(struct device *dev)
                 if (netif_running(ndev))
                         cpsw_ndo_open(ndev);
         }
+        rtnl_unlock();
+
         return 0;
 }
 #endif
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 84fbe5714f8b..481c7bf0395b 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1767,6 +1767,7 @@ static int davinci_emac_try_get_mac(struct platform_device *pdev,
  */
 static int davinci_emac_probe(struct platform_device *pdev)
 {
+        struct device_node *np = pdev->dev.of_node;
         int rc = 0;
         struct resource *res, *res_ctrl;
         struct net_device *ndev;
@@ -1805,7 +1806,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
         if (!pdata) {
                 dev_err(&pdev->dev, "no platform data\n");
                 rc = -ENODEV;
-                goto no_pdata;
+                goto err_free_netdev;
         }
 
         /* MAC addr and PHY mask , RMII enable info from platform_data */
@@ -1941,6 +1942,10 @@ no_cpdma_chan:
                 cpdma_chan_destroy(priv->rxchan);
         cpdma_ctlr_destroy(priv->dma);
 no_pdata:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+        of_node_put(priv->phy_node);
+err_free_netdev:
         free_netdev(ndev);
         return rc;
 }
@@ -1956,6 +1961,7 @@ static int davinci_emac_remove(struct platform_device *pdev)
 {
         struct net_device *ndev = platform_get_drvdata(pdev);
         struct emac_priv *priv = netdev_priv(ndev);
+        struct device_node *np = pdev->dev.of_node;
 
         dev_notice(&ndev->dev, "DaVinci EMAC: davinci_emac_remove()\n");
 
@@ -1968,6 +1974,8 @@ static int davinci_emac_remove(struct platform_device *pdev)
         unregister_netdev(ndev);
         of_node_put(priv->phy_node);
         pm_runtime_disable(&pdev->dev);
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
         free_netdev(ndev);
 
         return 0;
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 42edd7b7902f..8b4822ad27cb 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -859,7 +859,6 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
         struct geneve_dev *geneve = netdev_priv(dev);
         struct geneve_sock *gs4;
         struct rtable *rt = NULL;
-        const struct iphdr *iip; /* interior IP header */
         int err = -EINVAL;
         struct flowi4 fl4;
         __u8 tos, ttl;
@@ -890,8 +889,6 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
         sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
         skb_reset_mac_header(skb);
 
-        iip = ip_hdr(skb);
-
         if (info) {
                 const struct ip_tunnel_key *key = &info->key;
                 u8 *opts = NULL;
@@ -911,7 +908,7 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                 if (unlikely(err))
                         goto tx_error;
 
-                tos = ip_tunnel_ecn_encap(key->tos, iip, skb);
+                tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
                 ttl = key->ttl;
                 df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0;
         } else {
@@ -920,7 +917,7 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                 if (unlikely(err))
                         goto tx_error;
 
-                tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, iip, skb);
+                tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, ip_hdr(skb), skb);
                 ttl = geneve->ttl;
                 if (!ttl && IN_MULTICAST(ntohl(fl4.daddr)))
                         ttl = 1;
@@ -952,7 +949,6 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
 {
         struct geneve_dev *geneve = netdev_priv(dev);
         struct dst_entry *dst = NULL;
-        const struct iphdr *iip; /* interior IP header */
         struct geneve_sock *gs6;
         int err = -EINVAL;
         struct flowi6 fl6;
@@ -982,8 +978,6 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
         sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
         skb_reset_mac_header(skb);
 
-        iip = ip_hdr(skb);
-
         if (info) {
                 const struct ip_tunnel_key *key = &info->key;
                 u8 *opts = NULL;
@@ -1004,7 +998,7 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                 if (unlikely(err))
                         goto tx_error;
 
-                prio = ip_tunnel_ecn_encap(key->tos, iip, skb);
+                prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
                 ttl = key->ttl;
                 label = info->key.label;
         } else {
@@ -1014,7 +1008,7 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                         goto tx_error;
 
                 prio = ip_tunnel_ecn_encap(ip6_tclass(fl6.flowlabel),
-                                           iip, skb);
+                                           ip_hdr(skb), skb);
                 ttl = geneve->ttl;
                 if (!ttl && ipv6_addr_is_multicast(&fl6.daddr))
                         ttl = 1;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index f6382150b16a..c9140c3aeb67 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -47,6 +47,10 @@
                                  NETIF_F_TSO | \
                                  NETIF_F_TSO6 | \
                                  NETIF_F_HW_CSUM)
+
+/* Restrict GSO size to account for NVGRE */
+#define NETVSC_GSO_MAX_SIZE     62768
+
 static int ring_size = 128;
 module_param(ring_size, int, S_IRUGO);
 MODULE_PARM_DESC(ring_size, "Ring buffer size (# of pages)");
@@ -1400,6 +1404,7 @@ static int netvsc_probe(struct hv_device *dev,
         nvdev = net_device_ctx->nvdev;
         netif_set_real_num_tx_queues(net, nvdev->num_chn);
         netif_set_real_num_rx_queues(net, nvdev->num_chn);
+        netif_set_gso_max_size(net, NETVSC_GSO_MAX_SIZE);
 
         ret = register_netdev(net);
         if (ret != 0) {
diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
index 9fa7ac9f8e68..f355df7cf84a 100644
--- a/drivers/net/ieee802154/adf7242.c
+++ b/drivers/net/ieee802154/adf7242.c
@@ -20,7 +20,6 @@
 #include <linux/skbuff.h>
 #include <linux/of.h>
 #include <linux/irq.h>
-#include <linux/delay.h>
 #include <linux/debugfs.h>
 #include <linux/bitops.h>
 #include <linux/ieee802154.h>
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index f442eb366863..dfbc4ef6d507 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -497,6 +497,7 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
         struct net_device *phy_dev;
         int err;
         u16 mode = IPVLAN_MODE_L3;
+        bool create = false;
 
         if (!tb[IFLA_LINK])
                 return -EINVAL;
@@ -513,6 +514,7 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
                 err = ipvlan_port_create(phy_dev);
                 if (err < 0)
                         return err;
+                create = true;
         }
 
         if (data && data[IFLA_IPVLAN_MODE])
@@ -536,22 +538,29 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
 
         err = register_netdevice(dev);
         if (err < 0)
-                return err;
+                goto destroy_ipvlan_port;
 
         err = netdev_upper_dev_link(phy_dev, dev);
         if (err) {
-                unregister_netdevice(dev);
-                return err;
+                goto unregister_netdev;
         }
         err = ipvlan_set_port_mode(port, mode);
         if (err) {
-                unregister_netdevice(dev);
-                return err;
+                goto unlink_netdev;
         }
 
         list_add_tail_rcu(&ipvlan->pnode, &port->ipvlans);
         netif_stacked_transfer_operstate(phy_dev, dev);
         return 0;
+
+unlink_netdev:
+        netdev_upper_dev_unlink(phy_dev, dev);
+unregister_netdev:
+        unregister_netdevice(dev);
+destroy_ipvlan_port:
+        if (create)
+                ipvlan_port_destroy(phy_dev);
+        return err;
 }
 
 static void ipvlan_link_delete(struct net_device *dev, struct list_head *head)
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index a198946bc54f..8716b8c07feb 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1723,6 +1723,7 @@ static int irda_usb_probe(struct usb_interface *intf,
         /* Don't change this buffer size and allocation without doing
          * some heavy and complete testing. Don't ask why :-(
          * Jean II */
+        ret = -ENOMEM;
         self->speed_buff = kzalloc(IRDA_USB_SPEED_MTU, GFP_KERNEL);
         if (!self->speed_buff)
                 goto err_out_3;
diff --git a/drivers/net/irda/w83977af_ir.c b/drivers/net/irda/w83977af_ir.c
index 4e3d2e7c697c..e8c3a8c32534 100644
--- a/drivers/net/irda/w83977af_ir.c
+++ b/drivers/net/irda/w83977af_ir.c
@@ -518,7 +518,9 @@ static netdev_tx_t w83977af_hard_xmit(struct sk_buff *skb,
                 
                 mtt = irda_get_mtt(skb);
                 pr_debug("%s(%ld), mtt=%d\n", __func__ , jiffies, mtt);
-                        if (mtt)
+                        if (mtt > 1000)
+                                mdelay(mtt/1000);
+                        else if (mtt)
                                 udelay(mtt);
 
                         /* Enable DMA interrupt */
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index d2d6f12a112f..26d6f0bbe14b 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -623,7 +623,8 @@ hash_add:
         return 0;
 
 clear_multi:
-        dev_set_allmulti(lowerdev, -1);
+        if (dev->flags & IFF_ALLMULTI)
+                dev_set_allmulti(lowerdev, -1);
 del_unicast:
         dev_uc_del(lowerdev, dev->dev_addr);
 out:
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 070e3290aa6e..7869b0651576 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -491,7 +491,13 @@ static int macvtap_newlink(struct net *src_net,
         /* Don't put anything that may fail after macvlan_common_newlink
          * because we can't undo what it does.
          */
-        return macvlan_common_newlink(src_net, dev, tb, data);
+        err = macvlan_common_newlink(src_net, dev, tb, data);
+        if (err) {
+                netdev_rx_handler_unregister(dev);
+                return err;
+        }
+
+        return 0;
 }
 
 static void macvtap_dellink(struct net_device *dev,
@@ -736,13 +742,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
 
         if (zerocopy)
                 err = zerocopy_sg_from_iter(skb, from);
-        else {
+        else
                 err = skb_copy_datagram_from_iter(skb, 0, from, len);
-                if (!err && m && m->msg_control) {
-                        struct ubuf_info *uarg = m->msg_control;
-                        uarg->callback(uarg, false);
-                }
-        }
 
         if (err)
                 goto err_kfree;
@@ -773,7 +774,11 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
                 skb_shinfo(skb)->destructor_arg = m->msg_control;
                 skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
                 skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
+        } else if (m && m->msg_control) {
+                struct ubuf_info *uarg = m->msg_control;
+                uarg->callback(uarg, false);
         }
+
         if (vlan) {
                 skb->dev = vlan->dev;
                 dev_queue_xmit(skb);
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 081df68d2ce1..ea92d524d5a8 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -318,12 +318,12 @@ static int ksz8041_config_init(struct phy_device *phydev)
         /* Limit supported and advertised modes in fiber mode */
         if (of_property_read_bool(of_node, "micrel,fiber-mode")) {
                 phydev->dev_flags |= MICREL_PHY_FXEN;
-                phydev->supported &= SUPPORTED_FIBRE |
-                                     SUPPORTED_100baseT_Full |
+                phydev->supported &= SUPPORTED_100baseT_Full |
                                      SUPPORTED_100baseT_Half;
-                phydev->advertising &= ADVERTISED_FIBRE |
-                                       ADVERTISED_100baseT_Full |
+                phydev->supported |= SUPPORTED_FIBRE;
+                phydev->advertising &= ADVERTISED_100baseT_Full |
                                        ADVERTISED_100baseT_Half;
+                phydev->advertising |= ADVERTISED_FIBRE;
                 phydev->autoneg = AUTONEG_DISABLE;
         }
 
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 1a4bf8acad78..c4ceb082e970 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -857,11 +857,17 @@ EXPORT_SYMBOL(phy_attached_print);
 int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                       u32 flags, phy_interface_t interface)
 {
+        struct module *ndev_owner = dev->dev.parent->driver->owner;
         struct mii_bus *bus = phydev->mdio.bus;
         struct device *d = &phydev->mdio.dev;
         int err;
 
-        if (!try_module_get(bus->owner)) {
+        /* For Ethernet device drivers that register their own MDIO bus, we
+         * will have bus->owner match ndev_mod, so we do not want to increment
+         * our own module->refcnt here, otherwise we would not be able to
+         * unload later on.
+         */
+        if (ndev_owner != bus->owner && !try_module_get(bus->owner)) {
                 dev_err(&dev->dev, "failed to get the bus module\n");
                 return -EIO;
         }
@@ -921,7 +927,8 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
 
 error:
         put_device(d);
-        module_put(bus->owner);
+        if (ndev_owner != bus->owner)
+                module_put(bus->owner);
         return err;
 }
 EXPORT_SYMBOL(phy_attach_direct);
@@ -971,6 +978,8 @@ EXPORT_SYMBOL(phy_attach);
  */
 void phy_detach(struct phy_device *phydev)
 {
+        struct net_device *dev = phydev->attached_dev;
+        struct module *ndev_owner = dev->dev.parent->driver->owner;
         struct mii_bus *bus;
         int i;
 
@@ -998,7 +1007,8 @@ void phy_detach(struct phy_device *phydev)
         bus = phydev->mdio.bus;
 
         put_device(&phydev->mdio.dev);
-        module_put(bus->owner);
+        if (ndev_owner != bus->owner)
+                module_put(bus->owner);
 }
 EXPORT_SYMBOL(phy_detach);
 
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index aadd6e9f54ad..9cbe645e3d89 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -102,15 +102,19 @@ static int rtl8211f_config_init(struct phy_device *phydev)
         if (ret < 0)
                 return ret;
 
-        if (phydev->interface == PHY_INTERFACE_MODE_RGMII) {
-                /* enable TXDLY */
-                phy_write(phydev, RTL8211F_PAGE_SELECT, 0xd08);
-                reg = phy_read(phydev, 0x11);
+        phy_write(phydev, RTL8211F_PAGE_SELECT, 0xd08);
+        reg = phy_read(phydev, 0x11);
+
+        /* enable TX-delay for rgmii-id and rgmii-txid, otherwise disable it */
+        if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID ||
+            phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
                 reg |= RTL8211F_TX_DELAY;
-                phy_write(phydev, 0x11, reg);
-                /* restore to default page 0 */
-                phy_write(phydev, RTL8211F_PAGE_SELECT, 0x0);
-        }
+        else
+                reg &= ~RTL8211F_TX_DELAY;
+
+        phy_write(phydev, 0x11, reg);
+        /* restore to default page 0 */
+        phy_write(phydev, RTL8211F_PAGE_SELECT, 0x0);
 
         return 0;
 }
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 8093e39ae263..db6acecabeaa 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1246,13 +1246,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
 
         if (zerocopy)
                 err = zerocopy_sg_from_iter(skb, from);
-        else {
+        else
                 err = skb_copy_datagram_from_iter(skb, 0, from, len);
-                if (!err && msg_control) {
-                        struct ubuf_info *uarg = msg_control;
-                        uarg->callback(uarg, false);
-                }
-        }
 
         if (err) {
                 this_cpu_inc(tun->pcpu_stats->rx_dropped);
@@ -1298,6 +1293,9 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                 skb_shinfo(skb)->destructor_arg = msg_control;
                 skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
                 skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
+        } else if (msg_control) {
+                struct ubuf_info *uarg = msg_control;
+                uarg->callback(uarg, false);
         }
 
         skb_reset_network_header(skb);
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index cce24950a0ab..dc7b6392e75a 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -603,12 +603,12 @@ static void ax88772_suspend(struct usbnet *dev)
         u16 medium;
 
         /* Stop MAC operation */
-        medium = asix_read_medium_status(dev, 0);
+        medium = asix_read_medium_status(dev, 1);
         medium &= ~AX_MEDIUM_RE;
-        asix_write_medium_mode(dev, medium, 0);
+        asix_write_medium_mode(dev, medium, 1);
 
         netdev_dbg(dev->net, "ax88772_suspend: medium=0x%04x\n",
-                   asix_read_medium_status(dev, 0));
+                   asix_read_medium_status(dev, 1));
 
         /* Preserve BMCR for restoring */
         priv->presvd_phy_bmcr =
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index c47ec0a04c8e..dd623f674487 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -388,12 +388,6 @@ void usbnet_cdc_status(struct usbnet *dev, struct urb *urb)
         case USB_CDC_NOTIFY_NETWORK_CONNECTION:
                 netif_dbg(dev, timer, dev->net, "CDC: carrier %s\n",
                           event->wValue ? "on" : "off");
-
-                /* Work-around for devices with broken off-notifications */
-                if (event->wValue &&
-                    !test_bit(__LINK_STATE_NOCARRIER, &dev->net->state))
-                        usbnet_link_change(dev, 0, 0);
-
                 usbnet_link_change(dev, !!event->wValue, 0);
                 break;
         case USB_CDC_NOTIFY_SPEED_CHANGE:       /* tx/rx rates */
@@ -466,6 +460,36 @@ static int usbnet_cdc_zte_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
         return 1;
 }
 
+/* Ensure correct link state
+ *
+ * Some devices (ZTE MF823/831/910) export two carrier on notifications when
+ * connected. This causes the link state to be incorrect. Work around this by
+ * always setting the state to off, then on.
+ */
+void usbnet_cdc_zte_status(struct usbnet *dev, struct urb *urb)
+{
+        struct usb_cdc_notification *event;
+
+        if (urb->actual_length < sizeof(*event))
+                return;
+
+        event = urb->transfer_buffer;
+
+        if (event->bNotificationType != USB_CDC_NOTIFY_NETWORK_CONNECTION) {
+                usbnet_cdc_status(dev, urb);
+                return;
+        }
+
+        netif_dbg(dev, timer, dev->net, "CDC: carrier %s\n",
+                  event->wValue ? "on" : "off");
+
+        if (event->wValue &&
+            netif_carrier_ok(dev->net))
+                netif_carrier_off(dev->net);
+
+        usbnet_link_change(dev, !!event->wValue, 0);
+}
+
 static const struct driver_info cdc_info = {
         .description =  "CDC Ethernet Device",
         .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
@@ -481,7 +505,7 @@ static const struct driver_info	zte_cdc_info = {
         .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
         .bind =         usbnet_cdc_zte_bind,
         .unbind =       usbnet_cdc_unbind,
-        .status =       usbnet_cdc_status,
+        .status =       usbnet_cdc_zte_status,
         .set_rx_mode =  usbnet_cdc_update_filter,
         .manage_power = usbnet_manage_power,
         .rx_fixup = usbnet_cdc_zte_rx_fixup,
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 96a5028621c8..3a98f3762a4c 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -602,6 +602,21 @@ static const struct driver_info cdc_mbim_info_ndp_to_end = {
         .data = CDC_NCM_FLAG_NDP_TO_END,
 };
 
+/* Some modems (e.g. Telit LE922A6) do not work properly with altsetting
+ * toggle done in cdc_ncm_bind_common. CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE
+ * flag is used to avoid this procedure.
+ */
+static const struct driver_info cdc_mbim_info_avoid_altsetting_toggle = {
+        .description = "CDC MBIM",
+        .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN,
+        .bind = cdc_mbim_bind,
+        .unbind = cdc_mbim_unbind,
+        .manage_power = cdc_mbim_manage_power,
+        .rx_fixup = cdc_mbim_rx_fixup,
+        .tx_fixup = cdc_mbim_tx_fixup,
+        .data = CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE,
+};
+
 static const struct usb_device_id mbim_devs[] = {
         /* This duplicate NCM entry is intentional. MBIM devices can
          * be disguised as NCM by default, and this is necessary to
@@ -626,6 +641,12 @@ static const struct usb_device_id mbim_devs[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info_ndp_to_end,
         },
+
+        /* Telit LE922A6 in MBIM composition */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1041, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
+        },
+
         /* default entry */
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info_zlp,
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 877c9516e781..afbfc0f656f3 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -839,11 +839,18 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
 
         iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber;
 
+        /* Device-specific flags */
+        ctx->drvflags = drvflags;
+
         /* Reset data interface. Some devices will not reset properly
          * unless they are configured first.  Toggle the altsetting to
-         * force a reset
+         * force a reset.
+         * Some other devices do not work properly with this procedure
+         * that can be avoided using quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE
          */
-        usb_set_interface(dev->udev, iface_no, data_altsetting);
+        if (!(ctx->drvflags & CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE))
+                usb_set_interface(dev->udev, iface_no, data_altsetting);
+
         temp = usb_set_interface(dev->udev, iface_no, 0);
         if (temp) {
                 dev_dbg(&intf->dev, "set interface failed\n");
@@ -890,9 +897,6 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
         /* finish setting up the device specific data */
         cdc_ncm_setup(dev);
 
-        /* Device-specific flags */
-        ctx->drvflags = drvflags;
-
         /* Allocate the delayed NDP if needed. */
         if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
                 ctx->delayed_ndp16 = kzalloc(ctx->max_ndp_size, GFP_KERNEL);
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index db558b8b32fe..f33460cec79f 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3395,6 +3395,7 @@ static int lan78xx_probe(struct usb_interface *intf,
         if (buf) {
                 dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL);
                 if (!dev->urb_intr) {
+                        ret = -ENOMEM;
                         kfree(buf);
                         goto out3;
                 } else {
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 3ff76c6db4f6..6fe1cdb0174f 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -894,6 +894,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
         {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
+        {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
         {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
         {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},    /* XS Stick W100-2 from 4G Systems */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7276d5a95bd0..cbf1c613c67a 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -969,12 +969,17 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
         struct virtnet_info *vi = netdev_priv(dev);
         struct virtio_device *vdev = vi->vdev;
         int ret;
-        struct sockaddr *addr = p;
+        struct sockaddr *addr;
         struct scatterlist sg;
 
-        ret = eth_prepare_mac_addr_change(dev, p);
+        addr = kmalloc(sizeof(*addr), GFP_KERNEL);
+        if (!addr)
+                return -ENOMEM;
+        memcpy(addr, p, sizeof(*addr));
+
+        ret = eth_prepare_mac_addr_change(dev, addr);
         if (ret)
-                return ret;
+                goto out;
 
         if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
                 sg_init_one(&sg, addr->sa_data, dev->addr_len);
@@ -982,7 +987,8 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
                                           VIRTIO_NET_CTRL_MAC_ADDR_SET, &sg)) {
                         dev_warn(&vdev->dev,
                                  "Failed to set mac address by vq command.\n");
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto out;
                 }
         } else if (virtio_has_feature(vdev, VIRTIO_NET_F_MAC) &&
                    !virtio_has_feature(vdev, VIRTIO_F_VERSION_1)) {
@@ -996,8 +1002,11 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
         }
 
         eth_commit_mac_addr_change(dev, p);
+        ret = 0;
 
-        return 0;
+out:
+        kfree(addr);
+        return ret;
 }
 
 static struct rtnl_link_stats64 *virtnet_stats(struct net_device *dev,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 24532cdebb00..2ba01ca02c9c 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -611,6 +611,7 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
         struct vxlan_rdst *rd = NULL;
         struct vxlan_fdb *f;
         int notify = 0;
+        int rc;
 
         f = __vxlan_find_mac(vxlan, mac);
         if (f) {
@@ -641,8 +642,7 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                 if ((flags & NLM_F_APPEND) &&
                     (is_multicast_ether_addr(f->eth_addr) ||
                      is_zero_ether_addr(f->eth_addr))) {
-                        int rc = vxlan_fdb_append(f, ip, port, vni, ifindex,
-                                                  &rd);
+                        rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
 
                         if (rc < 0)
                                 return rc;
@@ -673,7 +673,11 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                 INIT_LIST_HEAD(&f->remotes);
                 memcpy(f->eth_addr, mac, ETH_ALEN);
 
-                vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
+                rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
+                if (rc < 0) {
+                        kfree(f);
+                        return rc;
+                }
 
                 ++vxlan->addrcnt;
                 hlist_add_head_rcu(&f->hlist,
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 39ce76ad00bc..16241d21727b 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -2222,8 +2222,9 @@ done:
                         is_scanning_required = 1;
                 } else {
                         mwifiex_dbg(priv->adapter, MSG,
-                                    "info: trying to associate to '%s' bssid %pM\n",
-                                    (char *)req_ssid.ssid, bss->bssid);
+                                    "info: trying to associate to '%.*s' bssid %pM\n",
+                                    req_ssid.ssid_len, (char *)req_ssid.ssid,
+                                    bss->bssid);
                         memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN);
                         break;
                 }
@@ -2283,8 +2284,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
         }
 
         mwifiex_dbg(adapter, INFO,
-                    "info: Trying to associate to %s and bssid %pM\n",
-                    (char *)sme->ssid, sme->bssid);
+                    "info: Trying to associate to %.*s and bssid %pM\n",
+                    (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
 
         if (!mwifiex_stop_bg_scan(priv))
                 cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
@@ -2417,8 +2418,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
         }
 
         mwifiex_dbg(priv->adapter, MSG,
-                    "info: trying to join to %s and bssid %pM\n",
-                    (char *)params->ssid, params->bssid);
+                    "info: trying to join to %.*s and bssid %pM\n",
+                    params->ssid_len, (char *)params->ssid, params->bssid);
 
         mwifiex_set_ibss_params(priv, params);
 
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index a8b6949a8778..23d4a1728cdf 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -715,7 +715,7 @@ EXPORT_SYMBOL_GPL(nd_cmd_in_size);
 
 u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
                 const struct nd_cmd_desc *desc, int idx, const u32 *in_field,
-                const u32 *out_field)
+                const u32 *out_field, unsigned long remainder)
 {
         if (idx >= desc->out_num)
                 return UINT_MAX;
@@ -727,9 +727,24 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
                 return in_field[1];
         else if (nvdimm && cmd == ND_CMD_VENDOR && idx == 2)
                 return out_field[1];
-        else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 2)
-                return out_field[1] - 8;
-        else if (cmd == ND_CMD_CALL) {
+        else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 2) {
+                /*
+                 * Per table 9-276 ARS Data in ACPI 6.1, out_field[1] is
+                 * "Size of Output Buffer in bytes, including this
+                 * field."
+                 */
+                if (out_field[1] < 4)
+                        return 0;
+                /*
+                 * ACPI 6.1 is ambiguous if 'status' is included in the
+                 * output size. If we encounter an output size that
+                 * overshoots the remainder by 4 bytes, assume it was
+                 * including 'status'.
+                 */
+                if (out_field[1] - 8 == remainder)
+                        return remainder;
+                return out_field[1] - 4;
+        } else if (cmd == ND_CMD_CALL) {
                 struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field;
 
                 return pkg->nd_size_out;
@@ -876,7 +891,7 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
         /* process an output envelope */
         for (i = 0; i < desc->out_num; i++) {
                 u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i,
-                                (u32 *) in_env, (u32 *) out_env);
+                                (u32 *) in_env, (u32 *) out_env, 0);
                 u32 copy;
 
                 if (out_size == UINT_MAX) {
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 5a3145a02547..262281bd68fa 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -490,3 +490,18 @@ int of_phy_register_fixed_link(struct device_node *np)
         return -ENODEV;
 }
 EXPORT_SYMBOL(of_phy_register_fixed_link);
+
+void of_phy_deregister_fixed_link(struct device_node *np)
+{
+        struct phy_device *phydev;
+
+        phydev = of_phy_find_device(np);
+        if (!phydev)
+                return;
+
+        fixed_phy_unregister(phydev);
+
+        put_device(&phydev->mdio.dev);  /* of_phy_find_device() */
+        phy_device_free(phydev);        /* fixed_phy_register() */
+}
+EXPORT_SYMBOL(of_phy_deregister_fixed_link);
diff --git a/drivers/pci/host/pcie-designware-plat.c b/drivers/pci/host/pcie-designware-plat.c
index 8df6312ed300..1a02038c4640 100644
--- a/drivers/pci/host/pcie-designware-plat.c
+++ b/drivers/pci/host/pcie-designware-plat.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2015-2016 Synopsys, Inc. (www.synopsys.com)
  *
- * Authors: Joao Pinto <jpmpinto@gmail.com>
+ * Authors: Joao Pinto <Joao.Pinto@synopsys.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff --git a/drivers/pci/pcie/aer/aer_inject.c b/drivers/pci/pcie/aer/aer_inject.c
index db553dc22c8e..2b6a59266689 100644
--- a/drivers/pci/pcie/aer/aer_inject.c
+++ b/drivers/pci/pcie/aer/aer_inject.c
@@ -307,20 +307,6 @@ out:
         return 0;
 }
 
-static struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
-{
-        while (1) {
-                if (!pci_is_pcie(dev))
-                        break;
-                if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
-                        return dev;
-                if (!dev->bus->self)
-                        break;
-                dev = dev->bus->self;
-        }
-        return NULL;
-}
-
 static int find_aer_device_iter(struct device *device, void *data)
 {
         struct pcie_device **result = data;
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index ab002671fa60..104c46d53121 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1439,6 +1439,21 @@ static void program_hpp_type1(struct pci_dev *dev, struct hpp_type1 *hpp)
                 dev_warn(&dev->dev, "PCI-X settings not supported\n");
 }
 
+static bool pcie_root_rcb_set(struct pci_dev *dev)
+{
+        struct pci_dev *rp = pcie_find_root_port(dev);
+        u16 lnkctl;
+
+        if (!rp)
+                return false;
+
+        pcie_capability_read_word(rp, PCI_EXP_LNKCTL, &lnkctl);
+        if (lnkctl & PCI_EXP_LNKCTL_RCB)
+                return true;
+
+        return false;
+}
+
 static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
 {
         int pos;
@@ -1468,9 +1483,20 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
                         ~hpp->pci_exp_devctl_and, hpp->pci_exp_devctl_or);
 
         /* Initialize Link Control Register */
-        if (pcie_cap_has_lnkctl(dev))
+        if (pcie_cap_has_lnkctl(dev)) {
+
+                /*
+                 * If the Root Port supports Read Completion Boundary of
+                 * 128, set RCB to 128.  Otherwise, clear it.
+                 */
+                hpp->pci_exp_lnkctl_and |= PCI_EXP_LNKCTL_RCB;
+                hpp->pci_exp_lnkctl_or &= ~PCI_EXP_LNKCTL_RCB;
+                if (pcie_root_rcb_set(dev))
+                        hpp->pci_exp_lnkctl_or |= PCI_EXP_LNKCTL_RCB;
+
                 pcie_capability_clear_and_set_word(dev, PCI_EXP_LNKCTL,
                         ~hpp->pci_exp_lnkctl_and, hpp->pci_exp_lnkctl_or);
+        }
 
         /* Find Advanced Error Reporting Enhanced Capability */
         pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index 87e6334eab93..547ca7b3f098 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -459,8 +459,6 @@ static int twl4030_phy_power_off(struct phy *phy)
         struct twl4030_usb *twl = phy_get_drvdata(phy);
 
         dev_dbg(twl->dev, "%s\n", __func__);
-        pm_runtime_mark_last_busy(twl->dev);
-        pm_runtime_put_autosuspend(twl->dev);
 
         return 0;
 }
@@ -472,6 +470,8 @@ static int twl4030_phy_power_on(struct phy *phy)
         dev_dbg(twl->dev, "%s\n", __func__);
         pm_runtime_get_sync(twl->dev);
         schedule_delayed_work(&twl->id_workaround_work, HZ);
+        pm_runtime_mark_last_busy(twl->dev);
+        pm_runtime_put_autosuspend(twl->dev);
 
         return 0;
 }
diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
index 381871b2bb46..9d5bd7d5c610 100644
--- a/drivers/pwm/pwm-meson.c
+++ b/drivers/pwm/pwm-meson.c
@@ -474,6 +474,7 @@ static int meson_pwm_probe(struct platform_device *pdev)
         if (IS_ERR(meson->base))
                 return PTR_ERR(meson->base);
 
+        spin_lock_init(&meson->lock);
         meson->chip.dev = &pdev->dev;
         meson->chip.ops = &meson_pwm_ops;
         meson->chip.base = -1;
diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
index 0296d8178ae2..a813239300c3 100644
--- a/drivers/pwm/sysfs.c
+++ b/drivers/pwm/sysfs.c
@@ -425,6 +425,8 @@ void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
                 if (test_bit(PWMF_EXPORTED, &pwm->flags))
                         pwm_unexport_child(parent, pwm);
         }
+
+        put_device(parent);
 }
 
 static int __init pwm_sysfs_init(void)
diff --git a/drivers/scsi/be2iscsi/be_mgmt.c b/drivers/scsi/be2iscsi/be_mgmt.c
index aebc4ddb3060..ac05317bba7f 100644
--- a/drivers/scsi/be2iscsi/be_mgmt.c
+++ b/drivers/scsi/be2iscsi/be_mgmt.c
@@ -1083,7 +1083,7 @@ unsigned int beiscsi_boot_get_sinfo(struct beiscsi_hba *phba)
         nonemb_cmd = &phba->boot_struct.nonemb_cmd;
         nonemb_cmd->size = sizeof(*resp);
         nonemb_cmd->va = pci_alloc_consistent(phba->ctrl.pdev,
-                                              sizeof(nonemb_cmd->size),
+                                              nonemb_cmd->size,
                                               &nonemb_cmd->dma);
         if (!nonemb_cmd->va) {
                 mutex_unlock(&ctrl->mbox_lock);
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index d007ec18179a..a1d6ab76a514 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2009,7 +2009,7 @@ static struct hpsa_scsi_dev_t *lookup_hpsa_scsi_dev(struct ctlr_info *h,
 
 static int hpsa_slave_alloc(struct scsi_device *sdev)
 {
-        struct hpsa_scsi_dev_t *sd;
+        struct hpsa_scsi_dev_t *sd = NULL;
         unsigned long flags;
         struct ctlr_info *h;
 
@@ -2026,7 +2026,8 @@ static int hpsa_slave_alloc(struct scsi_device *sdev)
                         sd->target = sdev_id(sdev);
                         sd->lun = sdev->lun;
                 }
-        } else
+        }
+        if (!sd)
                 sd = lookup_hpsa_scsi_dev(h, sdev_channel(sdev),
                                         sdev_id(sdev), sdev->lun);
 
@@ -3840,6 +3841,7 @@ static int hpsa_update_device_info(struct ctlr_info *h,
                 sizeof(this_device->vendor));
         memcpy(this_device->model, &inq_buff[16],
                 sizeof(this_device->model));
+        this_device->rev = inq_buff[2];
         memset(this_device->device_id, 0,
                 sizeof(this_device->device_id));
         if (hpsa_get_device_id(h, scsi3addr, this_device->device_id, 8,
@@ -3929,10 +3931,14 @@ static void figure_bus_target_lun(struct ctlr_info *h,
 
         if (!is_logical_dev_addr_mode(lunaddrbytes)) {
                 /* physical device, target and lun filled in later */
-                if (is_hba_lunid(lunaddrbytes))
+                if (is_hba_lunid(lunaddrbytes)) {
+                        int bus = HPSA_HBA_BUS;
+
+                        if (!device->rev)
+                                bus = HPSA_LEGACY_HBA_BUS;
                         hpsa_set_bus_target_lun(device,
-                                        HPSA_HBA_BUS, 0, lunid & 0x3fff);
-                else
+                                        bus, 0, lunid & 0x3fff);
+                } else
                         /* defer target, lun assignment for physical devices */
                         hpsa_set_bus_target_lun(device,
                                         HPSA_PHYSICAL_DEVICE_BUS, -1, -1);
diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
index 82cdfad874f3..9ea162de80dc 100644
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -69,6 +69,7 @@ struct hpsa_scsi_dev_t {
         u64 sas_address;
         unsigned char vendor[8];        /* bytes 8-15 of inquiry data */
         unsigned char model[16];        /* bytes 16-31 of inquiry data */
+        unsigned char rev;              /* byte 2 of inquiry data */
         unsigned char raid_level;       /* from inquiry page 0xC1 */
         unsigned char volume_offline;   /* discovered via TUR or VPD */
         u16 queue_depth;                /* max queue_depth for this device */
@@ -402,6 +403,7 @@ struct offline_device_entry {
 #define HPSA_RAID_VOLUME_BUS            1
 #define HPSA_EXTERNAL_RAID_VOLUME_BUS   2
 #define HPSA_HBA_BUS                    0
+#define HPSA_LEGACY_HBA_BUS             3
 
 /*
         Send the command to the hardware
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index 04ce7cfb6d1b..50c71678a156 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -308,7 +308,7 @@ struct fc_host_statistics *fc_get_host_stats(struct Scsi_Host *shost)
         fc_stats = &lport->host_stats;
         memset(fc_stats, 0, sizeof(struct fc_host_statistics));
 
-        fc_stats->seconds_since_last_reset = (lport->boot_time - jiffies) / HZ;
+        fc_stats->seconds_since_last_reset = (jiffies - lport->boot_time) / HZ;
 
         for_each_possible_cpu(cpu) {
                 struct fc_stats *stats;
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index c5326055beee..f4f77c5b0c83 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -1323,18 +1323,20 @@ lpfc_sli_ringtxcmpl_put(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 {
         lockdep_assert_held(&phba->hbalock);
 
-        BUG_ON(!piocb || !piocb->vport);
+        BUG_ON(!piocb);
 
         list_add_tail(&piocb->list, &pring->txcmplq);
         piocb->iocb_flag |= LPFC_IO_ON_TXCMPLQ;
 
         if ((unlikely(pring->ringno == LPFC_ELS_RING)) &&
            (piocb->iocb.ulpCommand != CMD_ABORT_XRI_CN) &&
-           (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN) &&
-            (!(piocb->vport->load_flag & FC_UNLOADING)))
-                mod_timer(&piocb->vport->els_tmofunc,
-                          jiffies +
-                          msecs_to_jiffies(1000 * (phba->fc_ratov << 1)));
+           (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN)) {
+                BUG_ON(!piocb->vport);
+                if (!(piocb->vport->load_flag & FC_UNLOADING))
+                        mod_timer(&piocb->vport->els_tmofunc,
+                                  jiffies +
+                                  msecs_to_jiffies(1000 * (phba->fc_ratov << 1)));
+        }
 
         return 0;
 }
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 91b70bc46e7f..1c4744e78173 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -3885,6 +3885,11 @@ _scsih_temp_threshold_events(struct MPT3SAS_ADAPTER *ioc,
         }
 }
 
+static inline bool ata_12_16_cmd(struct scsi_cmnd *scmd)
+{
+        return (scmd->cmnd[0] == ATA_12 || scmd->cmnd[0] == ATA_16);
+}
+
 /**
  * _scsih_flush_running_cmds - completing outstanding commands.
  * @ioc: per adapter object
@@ -3906,6 +3911,9 @@ _scsih_flush_running_cmds(struct MPT3SAS_ADAPTER *ioc)
                 if (!scmd)
                         continue;
                 count++;
+                if (ata_12_16_cmd(scmd))
+                        scsi_internal_device_unblock(scmd->device,
+                                                        SDEV_RUNNING);
                 mpt3sas_base_free_smid(ioc, smid);
                 scsi_dma_unmap(scmd);
                 if (ioc->pci_error_recovery)
@@ -4010,11 +4018,6 @@ _scsih_eedp_error_handling(struct scsi_cmnd *scmd, u16 ioc_status)
             SAM_STAT_CHECK_CONDITION;
 }
 
-static inline bool ata_12_16_cmd(struct scsi_cmnd *scmd)
-{
-        return (scmd->cmnd[0] == ATA_12 || scmd->cmnd[0] == ATA_16);
-}
-
 /**
  * scsih_qcmd - main scsi request entry point
  * @scmd: pointer to scsi command object
diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
index 86eb19902bac..c7cc8035eacb 100644
--- a/drivers/scsi/mvsas/mv_sas.c
+++ b/drivers/scsi/mvsas/mv_sas.c
@@ -791,8 +791,10 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf
         slot->slot_tag = tag;
 
         slot->buf = pci_pool_alloc(mvi->dma_pool, GFP_ATOMIC, &slot->buf_dma);
-        if (!slot->buf)
+        if (!slot->buf) {
+                rc = -ENOMEM;
                 goto err_out_tag;
+        }
         memset(slot->buf, 0, MVS_SLOT_BUF_SZ);
 
         tei.task = task;
diff --git a/drivers/scsi/qlogicpti.h b/drivers/scsi/qlogicpti.h
index 4377e87ee79c..892a0b058b99 100644
--- a/drivers/scsi/qlogicpti.h
+++ b/drivers/scsi/qlogicpti.h
@@ -356,8 +356,8 @@ struct qlogicpti {
 
         /* The rest of the elements are unimportant for performance. */
         struct qlogicpti         *next;
-        __u32                     res_dvma;             /* Ptr to RESPONSE bufs (DVMA)*/
-        __u32                     req_dvma;             /* Ptr to REQUEST bufs (DVMA) */
+        dma_addr_t                res_dvma;             /* Ptr to RESPONSE bufs (DVMA)*/
+        dma_addr_t                req_dvma;             /* Ptr to REQUEST bufs (DVMA) */
         u_char                    fware_majrev, fware_minrev, fware_micrev;
         struct Scsi_Host         *qhost;
         int                       qpti_id;
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 69426e644d17..3dbb4a21ab44 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -914,6 +914,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
         if (!ci)
                 return -ENOMEM;
 
+        spin_lock_init(&ci->lock);
         ci->dev = dev;
         ci->platdata = dev_get_platdata(dev);
         ci->imx28_write_fix = !!(ci->platdata->flags &
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 661f43fe0f9e..c9e80ad48fdc 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1889,8 +1889,6 @@ static int udc_start(struct ci_hdrc *ci)
         struct usb_otg_caps *otg_caps = &ci->platdata->ci_otg_caps;
         int retval = 0;
 
-        spin_lock_init(&ci->lock);
-
         ci->gadget.ops          = &usb_gadget_ops;
         ci->gadget.speed        = USB_SPEED_UNKNOWN;
         ci->gadget.max_speed    = USB_SPEED_HIGH;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index e40d47d47d82..17989b72cdae 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3225,11 +3225,11 @@ static bool ffs_func_req_match(struct usb_function *f,
 
         switch (creq->bRequestType & USB_RECIP_MASK) {
         case USB_RECIP_INTERFACE:
-                return ffs_func_revmap_intf(func,
-                                            le16_to_cpu(creq->wIndex) >= 0);
+                return (ffs_func_revmap_intf(func,
+                                             le16_to_cpu(creq->wIndex)) >= 0);
         case USB_RECIP_ENDPOINT:
-                return ffs_func_revmap_ep(func,
-                                          le16_to_cpu(creq->wIndex) >= 0);
+                return (ffs_func_revmap_ep(func,
+                                           le16_to_cpu(creq->wIndex)) >= 0);
         default:
                 return (bool) (func->ffs->user_flags &
                                FUNCTIONFS_ALL_CTRL_RECIP);
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index e01116e4c067..c3e172e15ec3 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -986,7 +986,7 @@ b_host:
         }
 #endif
 
-        schedule_work(&musb->irq_work);
+        schedule_delayed_work(&musb->irq_work, 0);
 
         return handled;
 }
@@ -1855,14 +1855,23 @@ static void musb_pm_runtime_check_session(struct musb *musb)
                 MUSB_DEVCTL_HR;
         switch (devctl & ~s) {
         case MUSB_QUIRK_B_INVALID_VBUS_91:
-                if (!musb->session && !musb->quirk_invalid_vbus) {
-                        musb->quirk_invalid_vbus = true;
+                if (musb->quirk_retries--) {
                         musb_dbg(musb,
-                                 "First invalid vbus, assume no session");
+                                 "Poll devctl on invalid vbus, assume no session");
+                        schedule_delayed_work(&musb->irq_work,
+                                              msecs_to_jiffies(1000));
+
                         return;
                 }
-                break;
         case MUSB_QUIRK_A_DISCONNECT_19:
+                if (musb->quirk_retries--) {
+                        musb_dbg(musb,
+                                 "Poll devctl on possible host mode disconnect");
+                        schedule_delayed_work(&musb->irq_work,
+                                              msecs_to_jiffies(1000));
+
+                        return;
+                }
                 if (!musb->session)
                         break;
                 musb_dbg(musb, "Allow PM on possible host mode disconnect");
@@ -1886,9 +1895,9 @@ static void musb_pm_runtime_check_session(struct musb *musb)
                 if (error < 0)
                         dev_err(musb->controller, "Could not enable: %i\n",
                                 error);
+                musb->quirk_retries = 3;
         } else {
                 musb_dbg(musb, "Allow PM with no session: %02x", devctl);
-                musb->quirk_invalid_vbus = false;
                 pm_runtime_mark_last_busy(musb->controller);
                 pm_runtime_put_autosuspend(musb->controller);
         }
@@ -1899,7 +1908,7 @@ static void musb_pm_runtime_check_session(struct musb *musb)
 /* Only used to provide driver mode change events */
 static void musb_irq_work(struct work_struct *data)
 {
-        struct musb *musb = container_of(data, struct musb, irq_work);
+        struct musb *musb = container_of(data, struct musb, irq_work.work);
 
         musb_pm_runtime_check_session(musb);
 
@@ -1969,6 +1978,7 @@ static struct musb *allocate_instance(struct device *dev,
         INIT_LIST_HEAD(&musb->control);
         INIT_LIST_HEAD(&musb->in_bulk);
         INIT_LIST_HEAD(&musb->out_bulk);
+        INIT_LIST_HEAD(&musb->pending_list);
 
         musb->vbuserr_retry = VBUSERR_RETRY_COUNT;
         musb->a_wait_bcon = OTG_TIME_A_WAIT_BCON;
@@ -2018,6 +2028,84 @@ static void musb_free(struct musb *musb)
         musb_host_free(musb);
 }
 
+struct musb_pending_work {
+        int (*callback)(struct musb *musb, void *data);
+        void *data;
+        struct list_head node;
+};
+
+/*
+ * Called from musb_runtime_resume(), musb_resume(), and
+ * musb_queue_resume_work(). Callers must take musb->lock.
+ */
+static int musb_run_resume_work(struct musb *musb)
+{
+        struct musb_pending_work *w, *_w;
+        unsigned long flags;
+        int error = 0;
+
+        spin_lock_irqsave(&musb->list_lock, flags);
+        list_for_each_entry_safe(w, _w, &musb->pending_list, node) {
+                if (w->callback) {
+                        error = w->callback(musb, w->data);
+                        if (error < 0) {
+                                dev_err(musb->controller,
+                                        "resume callback %p failed: %i\n",
+                                        w->callback, error);
+                        }
+                }
+                list_del(&w->node);
+                devm_kfree(musb->controller, w);
+        }
+        spin_unlock_irqrestore(&musb->list_lock, flags);
+
+        return error;
+}
+
+/*
+ * Called to run work if device is active or else queue the work to happen
+ * on resume. Caller must take musb->lock and must hold an RPM reference.
+ *
+ * Note that we cowardly refuse queuing work after musb PM runtime
+ * resume is done calling musb_run_resume_work() and return -EINPROGRESS
+ * instead.
+ */
+int musb_queue_resume_work(struct musb *musb,
+                           int (*callback)(struct musb *musb, void *data),
+                           void *data)
+{
+        struct musb_pending_work *w;
+        unsigned long flags;
+        int error;
+
+        if (WARN_ON(!callback))
+                return -EINVAL;
+
+        if (pm_runtime_active(musb->controller))
+                return callback(musb, data);
+
+        w = devm_kzalloc(musb->controller, sizeof(*w), GFP_ATOMIC);
+        if (!w)
+                return -ENOMEM;
+
+        w->callback = callback;
+        w->data = data;
+        spin_lock_irqsave(&musb->list_lock, flags);
+        if (musb->is_runtime_suspended) {
+                list_add_tail(&w->node, &musb->pending_list);
+                error = 0;
+        } else {
+                dev_err(musb->controller, "could not add resume work %p\n",
+                        callback);
+                devm_kfree(musb->controller, w);
+                error = -EINPROGRESS;
+        }
+        spin_unlock_irqrestore(&musb->list_lock, flags);
+
+        return error;
+}
+EXPORT_SYMBOL_GPL(musb_queue_resume_work);
+
 static void musb_deassert_reset(struct work_struct *work)
 {
         struct musb *musb;
@@ -2065,6 +2153,7 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         }
 
         spin_lock_init(&musb->lock);
+        spin_lock_init(&musb->list_lock);
         musb->board_set_power = plat->set_power;
         musb->min_power = plat->min_power;
         musb->ops = plat->platform_ops;
@@ -2208,7 +2297,7 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         musb_generic_disable(musb);
 
         /* Init IRQ workqueue before request_irq */
-        INIT_WORK(&musb->irq_work, musb_irq_work);
+        INIT_DELAYED_WORK(&musb->irq_work, musb_irq_work);
         INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset);
         INIT_DELAYED_WORK(&musb->finish_resume_work, musb_host_finish_resume);
 
@@ -2291,6 +2380,7 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         if (status)
                 goto fail5;
 
+        musb->is_initialized = 1;
         pm_runtime_mark_last_busy(musb->controller);
         pm_runtime_put_autosuspend(musb->controller);
 
@@ -2304,7 +2394,7 @@ fail4:
         musb_host_cleanup(musb);
 
 fail3:
-        cancel_work_sync(&musb->irq_work);
+        cancel_delayed_work_sync(&musb->irq_work);
         cancel_delayed_work_sync(&musb->finish_resume_work);
         cancel_delayed_work_sync(&musb->deassert_reset_work);
         if (musb->dma_controller)
@@ -2371,7 +2461,7 @@ static int musb_remove(struct platform_device *pdev)
          */
         musb_exit_debugfs(musb);
 
-        cancel_work_sync(&musb->irq_work);
+        cancel_delayed_work_sync(&musb->irq_work);
         cancel_delayed_work_sync(&musb->finish_resume_work);
         cancel_delayed_work_sync(&musb->deassert_reset_work);
         pm_runtime_get_sync(musb->controller);
@@ -2557,6 +2647,7 @@ static int musb_suspend(struct device *dev)
 
         musb_platform_disable(musb);
         musb_generic_disable(musb);
+        WARN_ON(!list_empty(&musb->pending_list));
 
         spin_lock_irqsave(&musb->lock, flags);
 
@@ -2578,9 +2669,11 @@ static int musb_suspend(struct device *dev)
 
 static int musb_resume(struct device *dev)
 {
-        struct musb     *musb = dev_to_musb(dev);
-        u8              devctl;
-        u8              mask;
+        struct musb *musb = dev_to_musb(dev);
+        unsigned long flags;
+        int error;
+        u8 devctl;
+        u8 mask;
 
         /*
          * For static cmos like DaVinci, register values were preserved
@@ -2614,6 +2707,13 @@ static int musb_resume(struct device *dev)
 
         musb_start(musb);
 
+        spin_lock_irqsave(&musb->lock, flags);
+        error = musb_run_resume_work(musb);
+        if (error)
+                dev_err(musb->controller, "resume work failed with %i\n",
+                        error);
+        spin_unlock_irqrestore(&musb->lock, flags);
+
         return 0;
 }
 
@@ -2622,14 +2722,16 @@ static int musb_runtime_suspend(struct device *dev)
         struct musb     *musb = dev_to_musb(dev);
 
         musb_save_context(musb);
+        musb->is_runtime_suspended = 1;
 
         return 0;
 }
 
 static int musb_runtime_resume(struct device *dev)
 {
-        struct musb     *musb = dev_to_musb(dev);
-        static int      first = 1;
+        struct musb *musb = dev_to_musb(dev);
+        unsigned long flags;
+        int error;
 
         /*
          * When pm_runtime_get_sync called for the first time in driver
@@ -2640,9 +2742,10 @@ static int musb_runtime_resume(struct device *dev)
          * Also context restore without save does not make
          * any sense
          */
-        if (!first)
-                musb_restore_context(musb);
-        first = 0;
+        if (!musb->is_initialized)
+                return 0;
+
+        musb_restore_context(musb);
 
         if (musb->need_finish_resume) {
                 musb->need_finish_resume = 0;
@@ -2650,6 +2753,14 @@ static int musb_runtime_resume(struct device *dev)
                                 msecs_to_jiffies(USB_RESUME_TIMEOUT));
         }
 
+        spin_lock_irqsave(&musb->lock, flags);
+        error = musb_run_resume_work(musb);
+        if (error)
+                dev_err(musb->controller, "resume work failed with %i\n",
+                        error);
+        musb->is_runtime_suspended = 0;
+        spin_unlock_irqrestore(&musb->lock, flags);
+
         return 0;
 }
 
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index 2cb88a498f8a..91817d77d59c 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -303,13 +303,14 @@ struct musb_context_registers {
 struct musb {
         /* device lock */
         spinlock_t              lock;
+        spinlock_t              list_lock;      /* resume work list lock */
 
         struct musb_io          io;
         const struct musb_platform_ops *ops;
         struct musb_context_registers context;
 
         irqreturn_t             (*isr)(int, void *);
-        struct work_struct      irq_work;
+        struct delayed_work     irq_work;
         struct delayed_work     deassert_reset_work;
         struct delayed_work     finish_resume_work;
         struct delayed_work     gadget_work;
@@ -337,6 +338,7 @@ struct musb {
         struct list_head        control;        /* of musb_qh */
         struct list_head        in_bulk;        /* of musb_qh */
         struct list_head        out_bulk;       /* of musb_qh */
+        struct list_head        pending_list;   /* pending work list */
 
         struct timer_list       otg_timer;
         struct notifier_block   nb;
@@ -379,12 +381,15 @@ struct musb {
 
         int                     port_mode;      /* MUSB_PORT_MODE_* */
         bool                    session;
-        bool                    quirk_invalid_vbus;
+        unsigned long           quirk_retries;
         bool                    is_host;
 
         int                     a_wait_bcon;    /* VBUS timeout in msecs */
         unsigned long           idle_timeout;   /* Next timeout in jiffies */
 
+        unsigned                is_initialized:1;
+        unsigned                is_runtime_suspended:1;
+
         /* active means connected and not suspended */
         unsigned                is_active:1;
 
@@ -540,6 +545,10 @@ extern irqreturn_t musb_interrupt(struct musb *);
 
 extern void musb_hnp_stop(struct musb *musb);
 
+int musb_queue_resume_work(struct musb *musb,
+                           int (*callback)(struct musb *musb, void *data),
+                           void *data);
+
 static inline void musb_platform_set_vbus(struct musb *musb, int is_on)
 {
         if (musb->ops->set_vbus)
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 0f17d2140db6..feae1561b9ab 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -185,24 +185,19 @@ static void dsps_musb_disable(struct musb *musb)
         musb_writel(reg_base, wrp->coreintr_clear, wrp->usb_bitmap);
         musb_writel(reg_base, wrp->epintr_clear,
                          wrp->txep_bitmap | wrp->rxep_bitmap);
+        del_timer_sync(&glue->timer);
         musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
 }
 
-static void otg_timer(unsigned long _musb)
+/* Caller must take musb->lock */
+static int dsps_check_status(struct musb *musb, void *unused)
 {
-        struct musb *musb = (void *)_musb;
         void __iomem *mregs = musb->mregs;
         struct device *dev = musb->controller;
         struct dsps_glue *glue = dev_get_drvdata(dev->parent);
         const struct dsps_musb_wrapper *wrp = glue->wrp;
         u8 devctl;
-        unsigned long flags;
         int skip_session = 0;
-        int err;
-
-        err = pm_runtime_get_sync(dev);
-        if (err < 0)
-                dev_err(dev, "Poll could not pm_runtime_get: %i\n", err);
 
         /*
          * We poll because DSPS IP's won't expose several OTG-critical
@@ -212,7 +207,6 @@ static void otg_timer(unsigned long _musb)
         dev_dbg(musb->controller, "Poll devctl %02x (%s)\n", devctl,
                                 usb_otg_state_string(musb->xceiv->otg->state));
 
-        spin_lock_irqsave(&musb->lock, flags);
         switch (musb->xceiv->otg->state) {
         case OTG_STATE_A_WAIT_VRISE:
                 mod_timer(&glue->timer, jiffies +
@@ -245,8 +239,30 @@ static void otg_timer(unsigned long _musb)
         default:
                 break;
         }
-        spin_unlock_irqrestore(&musb->lock, flags);
 
+        return 0;
+}
+
+static void otg_timer(unsigned long _musb)
+{
+        struct musb *musb = (void *)_musb;
+        struct device *dev = musb->controller;
+        unsigned long flags;
+        int err;
+
+        err = pm_runtime_get(dev);
+        if ((err != -EINPROGRESS) && err < 0) {
+                dev_err(dev, "Poll could not pm_runtime_get: %i\n", err);
+                pm_runtime_put_noidle(dev);
+
+                return;
+        }
+
+        spin_lock_irqsave(&musb->lock, flags);
+        err = musb_queue_resume_work(musb, dsps_check_status, NULL);
+        if (err < 0)
+                dev_err(dev, "%s resume work: %i\n", __func__, err);
+        spin_unlock_irqrestore(&musb->lock, flags);
         pm_runtime_mark_last_busy(dev);
         pm_runtime_put_autosuspend(dev);
 }
@@ -767,28 +783,13 @@ static int dsps_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, glue);
         pm_runtime_enable(&pdev->dev);
-        pm_runtime_use_autosuspend(&pdev->dev);
-        pm_runtime_set_autosuspend_delay(&pdev->dev, 200);
-
-        ret = pm_runtime_get_sync(&pdev->dev);
-        if (ret < 0) {
-                dev_err(&pdev->dev, "pm_runtime_get_sync FAILED");
-                goto err2;
-        }
-
         ret = dsps_create_musb_pdev(glue, pdev);
         if (ret)
-                goto err3;
-
-        pm_runtime_mark_last_busy(&pdev->dev);
-        pm_runtime_put_autosuspend(&pdev->dev);
+                goto err;
 
         return 0;
 
-err3:
-        pm_runtime_put_sync(&pdev->dev);
-err2:
-        pm_runtime_dont_use_autosuspend(&pdev->dev);
+err:
         pm_runtime_disable(&pdev->dev);
         return ret;
 }
@@ -799,9 +800,6 @@ static int dsps_remove(struct platform_device *pdev)
 
         platform_device_unregister(glue->musb);
 
-        /* disable usbss clocks */
-        pm_runtime_dont_use_autosuspend(&pdev->dev);
-        pm_runtime_put_sync(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
 
         return 0;
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 4042ea017985..a55173c9e564 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1114,7 +1114,7 @@ static int musb_gadget_enable(struct usb_ep *ep,
                         musb_ep->dma ? "dma, " : "",
                         musb_ep->packet_sz);
 
-        schedule_work(&musb->irq_work);
+        schedule_delayed_work(&musb->irq_work, 0);
 
 fail:
         spin_unlock_irqrestore(&musb->lock, flags);
@@ -1158,7 +1158,7 @@ static int musb_gadget_disable(struct usb_ep *ep)
         musb_ep->desc = NULL;
         musb_ep->end_point.desc = NULL;
 
-        schedule_work(&musb->irq_work);
+        schedule_delayed_work(&musb->irq_work, 0);
 
         spin_unlock_irqrestore(&(musb->lock), flags);
 
@@ -1222,13 +1222,22 @@ void musb_ep_restart(struct musb *musb, struct musb_request *req)
                 rxstate(musb, req);
 }
 
+static int musb_ep_restart_resume_work(struct musb *musb, void *data)
+{
+        struct musb_request *req = data;
+
+        musb_ep_restart(musb, req);
+
+        return 0;
+}
+
 static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
                         gfp_t gfp_flags)
 {
         struct musb_ep          *musb_ep;
         struct musb_request     *request;
         struct musb             *musb;
-        int                     status = 0;
+        int                     status;
         unsigned long           lockflags;
 
         if (!ep || !req)
@@ -1245,6 +1254,17 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
         if (request->ep != musb_ep)
                 return -EINVAL;
 
+        status = pm_runtime_get(musb->controller);
+        if ((status != -EINPROGRESS) && status < 0) {
+                dev_err(musb->controller,
+                        "pm runtime get failed in %s\n",
+                        __func__);
+                pm_runtime_put_noidle(musb->controller);
+
+                return status;
+        }
+        status = 0;
+
         trace_musb_req_enq(request);
 
         /* request is mine now... */
@@ -1255,7 +1275,6 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
 
         map_dma_buffer(request, musb, musb_ep);
 
-        pm_runtime_get_sync(musb->controller);
         spin_lock_irqsave(&musb->lock, lockflags);
 
         /* don't queue if the ep is down */
@@ -1271,8 +1290,14 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
         list_add_tail(&request->list, &musb_ep->req_list);
 
         /* it this is the head of the queue, start i/o ... */
-        if (!musb_ep->busy && &request->list == musb_ep->req_list.next)
-                musb_ep_restart(musb, request);
+        if (!musb_ep->busy && &request->list == musb_ep->req_list.next) {
+                status = musb_queue_resume_work(musb,
+                                                musb_ep_restart_resume_work,
+                                                request);
+                if (status < 0)
+                        dev_err(musb->controller, "%s resume work: %i\n",
+                                __func__, status);
+        }
 
 unlock:
         spin_unlock_irqrestore(&musb->lock, lockflags);
@@ -1969,7 +1994,7 @@ static int musb_gadget_stop(struct usb_gadget *g)
          */
 
         /* Force check of devctl register for PM runtime */
-        schedule_work(&musb->irq_work);
+        schedule_delayed_work(&musb->irq_work, 0);
 
         pm_runtime_mark_last_busy(musb->controller);
         pm_runtime_put_autosuspend(musb->controller);
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index cc1225485509..e8be8e39ab8f 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -513,17 +513,18 @@ static int omap2430_probe(struct platform_device *pdev)
         }
 
         pm_runtime_enable(glue->dev);
-        pm_runtime_use_autosuspend(glue->dev);
-        pm_runtime_set_autosuspend_delay(glue->dev, 100);
 
         ret = platform_device_add(musb);
         if (ret) {
                 dev_err(&pdev->dev, "failed to register musb device\n");
-                goto err2;
+                goto err3;
         }
 
         return 0;
 
+err3:
+        pm_runtime_disable(glue->dev);
+
 err2:
         platform_device_put(musb);
 
@@ -535,10 +536,7 @@ static int omap2430_remove(struct platform_device *pdev)
 {
         struct omap2430_glue *glue = platform_get_drvdata(pdev);
 
-        pm_runtime_get_sync(glue->dev);
         platform_device_unregister(glue->musb);
-        pm_runtime_put_sync(glue->dev);
-        pm_runtime_dont_use_autosuspend(glue->dev);
         pm_runtime_disable(glue->dev);
 
         return 0;
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index df7c9f46be54..e85cc8e4e7a9 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -724,7 +724,7 @@ tusb_otg_ints(struct musb *musb, u32 int_src, void __iomem *tbase)
                         dev_dbg(musb->controller, "vbus change, %s, otg %03x\n",
                                 usb_otg_state_string(musb->xceiv->otg->state), otg_stat);
                         idle_timeout = jiffies + (1 * HZ);
-                        schedule_work(&musb->irq_work);
+                        schedule_delayed_work(&musb->irq_work, 0);
 
                 } else /* A-dev state machine */ {
                         dev_dbg(musb->controller, "vbus change, %s, otg %03x\n",
@@ -814,7 +814,7 @@ tusb_otg_ints(struct musb *musb, u32 int_src, void __iomem *tbase)
                         break;
                 }
         }
-        schedule_work(&musb->irq_work);
+        schedule_delayed_work(&musb->irq_work, 0);
 
         return idle_timeout;
 }
@@ -864,7 +864,7 @@ static irqreturn_t tusb_musb_interrupt(int irq, void *__hci)
                 musb_writel(tbase, TUSB_PRCM_WAKEUP_CLEAR, reg);
                 if (reg & ~TUSB_PRCM_WNORCS) {
                         musb->is_active = 1;
-                        schedule_work(&musb->irq_work);
+                        schedule_delayed_work(&musb->irq_work, 0);
                 }
                 dev_dbg(musb->controller, "wake %sactive %02x\n",
                                 musb->is_active ? "" : "in", reg);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index f61477bed3a8..243ac5ebe46a 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -131,6 +131,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
         { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
         { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+        { USB_DEVICE(0x10C4, 0x8962) }, /* Brim Brothers charging dock */
         { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
         { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
         { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 0ff7f38d7800..6e9fc8bcc285 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1012,6 +1012,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
         { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
         { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
+        { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 21011c0a4c64..48ee04c94a75 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -596,6 +596,12 @@
 #define STK541_PID              0x2109 /* Zigbee Controller */
 
 /*
+ * Texas Instruments
+ */
+#define TI_VID                  0x0451
+#define TI_CC3200_LAUNCHPAD_PID 0xC32A /* SimpleLink Wi-Fi CC3200 LaunchPad */
+
+/*
  * Blackfin gnICE JTAG
  * http://docs.blackfin.uclinux.org/doku.php?id=hw:jtag:gnice
  */
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index ffd086733421..1a59f335b063 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -954,10 +954,15 @@ int usb_stor_CB_transport(struct scsi_cmnd *srb, struct us_data *us)
 
         /* COMMAND STAGE */
         /* let's send the command via the control pipe */
+        /*
+         * Command is sometime (f.e. after scsi_eh_prep_cmnd) on the stack.
+         * Stack may be vmallocated.  So no DMA for us.  Make a copy.
+         */
+        memcpy(us->iobuf, srb->cmnd, srb->cmd_len);
         result = usb_stor_ctrl_transfer(us, us->send_ctrl_pipe,
                                       US_CBI_ADSC, 
                                       USB_TYPE_CLASS | USB_RECIP_INTERFACE, 0, 
-                                      us->ifnum, srb->cmnd, srb->cmd_len);
+                                      us->ifnum, us->iobuf, srb->cmd_len);
 
         /* check the return code for the command */
         usb_stor_dbg(us, "Call to usb_stor_ctrl_transfer() returned %d\n",
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index e3b30ea9ece5..a504e2e003da 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -506,7 +506,7 @@ static void vhost_vsock_reset_orphans(struct sock *sk)
          * executing.
          */
 
-        if (!vhost_vsock_get(vsk->local_addr.svm_cid)) {
+        if (!vhost_vsock_get(vsk->remote_addr.svm_cid)) {
                 sock_set_flag(sk, SOCK_DONE);
                 vsk->peer_shutdown = SHUTDOWN_MASK;
                 sk->sk_state = SS_UNCONNECTED;
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index fdd3228e0678..3eb58cb51e56 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -155,6 +155,7 @@ config TANGOX_WATCHDOG
 config WDAT_WDT
         tristate "ACPI Watchdog Action Table (WDAT)"
         depends on ACPI
+        select WATCHDOG_CORE
         select ACPI_WATCHDOG
         help
           This driver adds support for systems with ACPI Watchdog Action
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 78180d151730..a594c7879cc2 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -1261,26 +1261,30 @@ static int ceph_d_revalidate(struct dentry *dentry, unsigned int flags)
                         return -ECHILD;
 
                 op = ceph_snap(dir) == CEPH_SNAPDIR ?
-                        CEPH_MDS_OP_LOOKUPSNAP : CEPH_MDS_OP_LOOKUP;
+                        CEPH_MDS_OP_LOOKUPSNAP : CEPH_MDS_OP_GETATTR;
                 req = ceph_mdsc_create_request(mdsc, op, USE_ANY_MDS);
                 if (!IS_ERR(req)) {
                         req->r_dentry = dget(dentry);
-                        req->r_num_caps = 2;
+                        req->r_num_caps = op == CEPH_MDS_OP_GETATTR ? 1 : 2;
 
                         mask = CEPH_STAT_CAP_INODE | CEPH_CAP_AUTH_SHARED;
                         if (ceph_security_xattr_wanted(dir))
                                 mask |= CEPH_CAP_XATTR_SHARED;
                         req->r_args.getattr.mask = mask;
 
-                        req->r_locked_dir = dir;
                         err = ceph_mdsc_do_request(mdsc, NULL, req);
-                        if (err == 0 || err == -ENOENT) {
-                                if (dentry == req->r_dentry) {
-                                        valid = !d_unhashed(dentry);
-                                } else {
-                                        d_invalidate(req->r_dentry);
-                                        err = -EAGAIN;
-                                }
+                        switch (err) {
+                        case 0:
+                                if (d_really_is_positive(dentry) &&
+                                    d_inode(dentry) == req->r_target_inode)
+                                        valid = 1;
+                                break;
+                        case -ENOENT:
+                                if (d_really_is_negative(dentry))
+                                        valid = 1;
+                                /* Fallthrough */
+                        default:
+                                break;
                         }
                         ceph_mdsc_put_request(req);
                         dout("d_revalidate %p lookup result=%d\n",
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 8347c90cf483..5eb04129f938 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -808,7 +808,11 @@ calc_seckey(struct cifs_ses *ses)
         struct crypto_skcipher *tfm_arc4;
         struct scatterlist sgin, sgout;
         struct skcipher_request *req;
-        unsigned char sec_key[CIFS_SESS_KEY_SIZE]; /* a nonce */
+        unsigned char *sec_key;
+
+        sec_key = kmalloc(CIFS_SESS_KEY_SIZE, GFP_KERNEL);
+        if (sec_key == NULL)
+                return -ENOMEM;
 
         get_random_bytes(sec_key, CIFS_SESS_KEY_SIZE);
 
@@ -816,7 +820,7 @@ calc_seckey(struct cifs_ses *ses)
         if (IS_ERR(tfm_arc4)) {
                 rc = PTR_ERR(tfm_arc4);
                 cifs_dbg(VFS, "could not allocate crypto API arc4\n");
-                return rc;
+                goto out;
         }
 
         rc = crypto_skcipher_setkey(tfm_arc4, ses->auth_key.response,
@@ -854,7 +858,8 @@ calc_seckey(struct cifs_ses *ses)
 
 out_free_cipher:
         crypto_free_skcipher(tfm_arc4);
-
+out:
+        kfree(sec_key);
         return rc;
 }
 
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 3f3185febc58..e3fed9249a04 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -3427,6 +3427,7 @@ static __u16 ACL_to_cifs_posix(char *parm_data, const char *pACL,
         __u16 rc = 0;
         struct cifs_posix_acl *cifs_acl = (struct cifs_posix_acl *)parm_data;
         struct posix_acl_xattr_header *local_acl = (void *)pACL;
+        struct posix_acl_xattr_entry *ace = (void *)(local_acl + 1);
         int count;
         int i;
 
@@ -3453,8 +3454,7 @@ static __u16 ACL_to_cifs_posix(char *parm_data, const char *pACL,
                 return 0;
         }
         for (i = 0; i < count; i++) {
-                rc = convert_ace_to_cifs_ace(&cifs_acl->ace_array[i],
-                        (struct posix_acl_xattr_entry *)(local_acl + 1));
+                rc = convert_ace_to_cifs_ace(&cifs_acl->ace_array[i], &ace[i]);
                 if (rc != 0) {
                         /* ACE not converted */
                         break;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index aab5227979e2..4547aeddd12b 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -412,6 +412,9 @@ cifs_reconnect(struct TCP_Server_Info *server)
                 }
         } while (server->tcpStatus == CifsNeedReconnect);
 
+        if (server->tcpStatus == CifsNeedNegotiate)
+                mod_delayed_work(cifsiod_wq, &server->echo, 0);
+
         return rc;
 }
 
@@ -421,17 +424,25 @@ cifs_echo_request(struct work_struct *work)
         int rc;
         struct TCP_Server_Info *server = container_of(work,
                                         struct TCP_Server_Info, echo.work);
-        unsigned long echo_interval = server->echo_interval;
+        unsigned long echo_interval;
+
+        /*
+         * If we need to renegotiate, set echo interval to zero to
+         * immediately call echo service where we can renegotiate.
+         */
+        if (server->tcpStatus == CifsNeedNegotiate)
+                echo_interval = 0;
+        else
+                echo_interval = server->echo_interval;
 
         /*
-         * We cannot send an echo if it is disabled or until the
-         * NEGOTIATE_PROTOCOL request is done, which is indicated by
-         * server->ops->need_neg() == true. Also, no need to ping if
-         * we got a response recently.
+         * We cannot send an echo if it is disabled.
+         * Also, no need to ping if we got a response recently.
          */
 
         if (server->tcpStatus == CifsNeedReconnect ||
-            server->tcpStatus == CifsExiting || server->tcpStatus == CifsNew ||
+            server->tcpStatus == CifsExiting ||
+            server->tcpStatus == CifsNew ||
             (server->ops->can_echo && !server->ops->can_echo(server)) ||
             time_before(jiffies, server->lstrp + echo_interval - HZ))
                 goto requeue_echo;
@@ -442,7 +453,7 @@ cifs_echo_request(struct work_struct *work)
                          server->hostname);
 
 requeue_echo:
-        queue_delayed_work(cifsiod_wq, &server->echo, echo_interval);
+        queue_delayed_work(cifsiod_wq, &server->echo, server->echo_interval);
 }
 
 static bool
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index b3ebe512d64c..096f79997f75 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1739,8 +1739,6 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
                  * This should be done on write(), truncate() and chown().
                  */
                 if (!fc->handle_killpriv) {
-                        int kill;
-
                         /*
                          * ia_mode calculation may have used stale i_mode.
                          * Refresh and recalculate.
@@ -1750,12 +1748,11 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
                                 return ret;
 
                         attr->ia_mode = inode->i_mode;
-                        kill = should_remove_suid(entry);
-                        if (kill & ATTR_KILL_SUID) {
+                        if (inode->i_mode & S_ISUID) {
                                 attr->ia_valid |= ATTR_MODE;
                                 attr->ia_mode &= ~S_ISUID;
                         }
-                        if (kill & ATTR_KILL_SGID) {
+                        if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
                                 attr->ia_valid |= ATTR_MODE;
                                 attr->ia_mode &= ~S_ISGID;
                         }
diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
index 98b3eb7d8eaf..0ec137310320 100644
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -377,9 +377,9 @@ repeat:
                         {
                                 int p;
                                 for (p = 0; p < rr->u.ER.len_id; p++)
-                                        printk("%c", rr->u.ER.data[p]);
+                                        printk(KERN_CONT "%c", rr->u.ER.data[p]);
                         }
-                        printk("\n");
+                        printk(KERN_CONT "\n");
                         break;
                 case SIG('P', 'X'):
                         inode->i_mode = isonum_733(rr->u.PX.mode);
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index edd46a0e951d..0e100856c7b8 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -328,11 +328,11 @@ static struct dentry *ovl_d_real(struct dentry *dentry,
         if (!real)
                 goto bug;
 
+        /* Handle recursion */
+        real = d_real(real, inode, open_flags);
+
         if (!inode || inode == d_inode(real))
                 return real;
-
-        /* Handle recursion */
-        return d_real(real, inode, open_flags);
 bug:
         WARN(1, "ovl_d_real(%pd4, %s:%lu): real dentry not found\n", dentry,
              inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0);
diff --git a/fs/splice.c b/fs/splice.c
index dcaf185a5731..5a7750bd2eea 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -408,7 +408,8 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
         if (res <= 0)
                 return -ENOMEM;
 
-        nr_pages = res / PAGE_SIZE;
+        BUG_ON(dummy);
+        nr_pages = DIV_ROUND_UP(res, PAGE_SIZE);
 
         vec = __vec;
         if (nr_pages > PIPE_DEF_BUFFERS) {
diff --git a/include/crypto/drbg.h b/include/crypto/drbg.h
index 61580b19f9f6..22f884c97387 100644
--- a/include/crypto/drbg.h
+++ b/include/crypto/drbg.h
@@ -124,6 +124,8 @@ struct drbg_state {
         struct skcipher_request *ctr_req;       /* CTR mode request handle */
         __u8 *ctr_null_value_buf;               /* CTR mode unaligned buffer */
         __u8 *ctr_null_value;                   /* CTR mode aligned zero buf */
+        __u8 *outscratchpadbuf;                 /* CTR mode output scratchpad */
+        __u8 *outscratchpad;                    /* CTR mode aligned outbuf */
         struct completion ctr_completion;       /* CTR mode async handler */
         int ctr_async_err;                      /* CTR mode async error */
 
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 432f5c97e18f..928e5ca0caee 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -263,7 +263,9 @@
 #endif
 #endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP && !__CHECKER__ */
 
-#if GCC_VERSION >= 50000
+#if GCC_VERSION >= 70000
+#define KASAN_ABI_VERSION 5
+#elif GCC_VERSION >= 50000
 #define KASAN_ABI_VERSION 4
 #elif GCC_VERSION >= 40902
 #define KASAN_ABI_VERSION 3
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index 2d9b650047a5..d49e26c6cdc7 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -429,6 +429,7 @@ struct intel_iommu {
         struct page_req_dsc *prq;
         unsigned char prq_name[16];    /* Name for PRQ interrupt */
         struct idr pasid_idr;
+        u32 pasid_max;
 #endif
         struct q_inval  *qi;            /* Queued invalidation info */
         u32 *iommu_state; /* Store iommu states between suspend and resume.*/
diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
index f4947fda11e7..8458c5351e56 100644
--- a/include/linux/libnvdimm.h
+++ b/include/linux/libnvdimm.h
@@ -143,7 +143,7 @@ u32 nd_cmd_in_size(struct nvdimm *nvdimm, int cmd,
                 const struct nd_cmd_desc *desc, int idx, void *buf);
 u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
                 const struct nd_cmd_desc *desc, int idx, const u32 *in_field,
-                const u32 *out_field);
+                const u32 *out_field, unsigned long remainder);
 int nvdimm_bus_check_dimm_count(struct nvdimm_bus *nvdimm_bus, int dimm_count);
 struct nd_region *nvdimm_pmem_region_create(struct nvdimm_bus *nvdimm_bus,
                 struct nd_region_desc *ndr_desc);
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 3be7abd6e722..c9f379689dd0 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -476,7 +476,6 @@ enum {
 enum {
         MLX4_INTERFACE_STATE_UP         = 1 << 0,
         MLX4_INTERFACE_STATE_DELETION   = 1 << 1,
-        MLX4_INTERFACE_STATE_SHUTDOWN   = 1 << 2,
 };
 
 #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index bf04a46f6d5b..e16a2a980ea8 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1619,7 +1619,7 @@ enum netdev_priv_flags {
  *      @dcbnl_ops:     Data Center Bridging netlink ops
  *      @num_tc:        Number of traffic classes in the net device
  *      @tc_to_txq:     XXX: need comments on this one
- *      @prio_tc_map    XXX: need comments on this one
+ *      @prio_tc_map:   XXX: need comments on this one
  *
  *      @fcoe_ddp_xid:  Max exchange id for FCoE LRO by ddp
  *
diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h
index 2ab233661ae5..a58cca8bcb29 100644
--- a/include/linux/of_mdio.h
+++ b/include/linux/of_mdio.h
@@ -29,6 +29,7 @@ struct phy_device *of_phy_attach(struct net_device *dev,
 extern struct mii_bus *of_mdio_find_bus(struct device_node *mdio_np);
 extern int of_mdio_parse_addr(struct device *dev, const struct device_node *np);
 extern int of_phy_register_fixed_link(struct device_node *np);
+extern void of_phy_deregister_fixed_link(struct device_node *np);
 extern bool of_phy_is_fixed_link(struct device_node *np);
 
 #else /* CONFIG_OF */
@@ -83,6 +84,9 @@ static inline int of_phy_register_fixed_link(struct device_node *np)
 {
         return -ENOSYS;
 }
+static inline void of_phy_deregister_fixed_link(struct device_node *np)
+{
+}
 static inline bool of_phy_is_fixed_link(struct device_node *np)
 {
         return false;
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index dd15d39e1985..7dbe9148b2f8 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -374,16 +374,13 @@ static inline struct page *read_mapping_page(struct address_space *mapping,
 }
 
 /*
- * Get the offset in PAGE_SIZE.
- * (TODO: hugepage should have ->index in PAGE_SIZE)
+ * Get index of the page with in radix-tree
+ * (TODO: remove once hugetlb pages will have ->index in PAGE_SIZE)
  */
-static inline pgoff_t page_to_pgoff(struct page *page)
+static inline pgoff_t page_to_index(struct page *page)
 {
         pgoff_t pgoff;
 
-        if (unlikely(PageHeadHuge(page)))
-                return page->index << compound_order(page);
-
         if (likely(!PageTransTail(page)))
                 return page->index;
 
@@ -397,6 +394,18 @@ static inline pgoff_t page_to_pgoff(struct page *page)
 }
 
 /*
+ * Get the offset in PAGE_SIZE.
+ * (TODO: hugepage should have ->index in PAGE_SIZE)
+ */
+static inline pgoff_t page_to_pgoff(struct page *page)
+{
+        if (unlikely(PageHeadHuge(page)))
+                return page->index << compound_order(page);
+
+        return page_to_index(page);
+}
+
+/*
  * Return byte-offset into filesystem object for page.
  */
 static inline loff_t page_offset(struct page *page)
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 0e49f70dbd9b..a38772a85588 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1928,6 +1928,20 @@ static inline int pci_pcie_type(const struct pci_dev *dev)
         return (pcie_caps_reg(dev) & PCI_EXP_FLAGS_TYPE) >> 4;
 }
 
+static inline struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
+{
+        while (1) {
+                if (!pci_is_pcie(dev))
+                        break;
+                if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
+                        return dev;
+                if (!dev->bus->self)
+                        break;
+                dev = dev->bus->self;
+        }
+        return NULL;
+}
+
 void pci_request_acs(void);
 bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags);
 bool pci_acs_path_enabled(struct pci_dev *start,
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
index 3a375d07d0dc..00d232406f18 100644
--- a/include/linux/usb/cdc_ncm.h
+++ b/include/linux/usb/cdc_ncm.h
@@ -81,7 +81,8 @@
 #define CDC_NCM_TIMER_INTERVAL_MAX              (U32_MAX / NSEC_PER_USEC)
 
 /* Driver flags */
-#define CDC_NCM_FLAG_NDP_TO_END 0x02            /* NDP is placed at end of frame */
+#define CDC_NCM_FLAG_NDP_TO_END                 0x02    /* NDP is placed at end of frame */
+#define CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE   0x04    /* Avoid altsetting toggle during init */
 
 #define cdc_ncm_comm_intf_is_mbim(x)  ((x)->desc.bInterfaceSubClass == USB_CDC_SUBCLASS_MBIM && \
                                        (x)->desc.bInterfaceProtocol == USB_CDC_PROTO_NONE)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index f00bf667ec33..554671c81f4a 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1018,7 +1018,7 @@ static inline void hci_set_drvdata(struct hci_dev *hdev, void *data)
 }
 
 struct hci_dev *hci_dev_get(int index);
-struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src);
+struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, u8 src_type);
 
 struct hci_dev *hci_alloc_dev(void);
 void hci_free_dev(struct hci_dev *hdev);
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 8fed1cd78658..f11ca837361b 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -970,6 +970,8 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
 int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
                            char __user *optval, int __user *optlen);
 
+int __ip6_datagram_connect(struct sock *sk, struct sockaddr *addr,
+                           int addr_len);
 int ip6_datagram_connect(struct sock *sk, struct sockaddr *addr, int addr_len);
 int ip6_datagram_connect_v6_only(struct sock *sk, struct sockaddr *addr,
                                  int addr_len);
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 50418052a520..d9d52c020a70 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -100,6 +100,9 @@ struct nf_conn {
 
         possible_net_t ct_net;
 
+#if IS_ENABLED(CONFIG_NF_NAT)
+        struct rhlist_head nat_bysource;
+#endif
         /* all members below initialized via memset */
         u8 __nfct_init_offset[0];
 
@@ -117,9 +120,6 @@ struct nf_conn {
         /* Extensions */
         struct nf_ct_ext *ext;
 
-#if IS_ENABLED(CONFIG_NF_NAT)
-        struct rhash_head       nat_bysource;
-#endif
         /* Storage reserved for other modules, must be the last member */
         union nf_conntrack_proto proto;
 };
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index d79d1e9b9546..b02af0bf5777 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -313,7 +313,7 @@ void nft_unregister_set(struct nft_set_ops *ops);
  *      @size: maximum set size
  *      @nelems: number of elements
  *      @ndeact: number of deactivated elements queued for removal
- *      @timeout: default timeout value in msecs
+ *      @timeout: default timeout value in jiffies
  *      @gc_int: garbage collection interval in msecs
  *      @policy: set parameterization (see enum nft_set_policies)
  *      @udlen: user data length
diff --git a/include/uapi/linux/can.h b/include/uapi/linux/can.h
index 9692cda5f8fc..c48d93a28d1a 100644
--- a/include/uapi/linux/can.h
+++ b/include/uapi/linux/can.h
@@ -196,5 +196,6 @@ struct can_filter {
 };
 
 #define CAN_INV_FILTER 0x20000000U /* to be set in can_filter.can_id */
+#define CAN_RAW_FILTER_MAX 512 /* maximum number of can_filter set via setsockopt() */
 
 #endif /* !_UAPI_CAN_H */
diff --git a/include/uapi/linux/if.h b/include/uapi/linux/if.h
index e601c8c3bdc7..1158a043342a 100644
--- a/include/uapi/linux/if.h
+++ b/include/uapi/linux/if.h
@@ -31,7 +31,7 @@
 #include <linux/hdlc/ioctl.h>
 
 /* For glibc compatibility. An empty enum does not compile. */
-#if __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO != 0 && \
+#if __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO != 0 || \
     __UAPI_DEF_IF_NET_DEVICE_FLAGS != 0
 /**
  * enum net_device_flags - &struct net_device flags
@@ -99,7 +99,7 @@ enum net_device_flags {
         IFF_ECHO                        = 1<<18, /* volatile */
 #endif /* __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO */
 };
-#endif /* __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO != 0 && __UAPI_DEF_IF_NET_DEVICE_FLAGS != 0 */
+#endif /* __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO != 0 || __UAPI_DEF_IF_NET_DEVICE_FLAGS != 0 */
 
 /* for compatibility with glibc net/if.h */
 #if __UAPI_DEF_IF_NET_DEVICE_FLAGS
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index d6d071fc3c56..3af60ee69053 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -640,7 +640,7 @@
  * Control a data application associated with the currently viewed channel,
  * e.g. teletext or data broadcast application (MHEG, MHP, HbbTV, etc.)
  */
-#define KEY_DATA                        0x275
+#define KEY_DATA                        0x277
 
 #define BTN_TRIGGER_HAPPY               0x2c0
 #define BTN_TRIGGER_HAPPY1              0x2c0
diff --git a/include/uapi/linux/netfilter/Kbuild b/include/uapi/linux/netfilter/Kbuild
index cd26d7a0fd07..03f194aeadc5 100644
--- a/include/uapi/linux/netfilter/Kbuild
+++ b/include/uapi/linux/netfilter/Kbuild
@@ -5,6 +5,7 @@ header-y += nf_conntrack_ftp.h
 header-y += nf_conntrack_sctp.h
 header-y += nf_conntrack_tcp.h
 header-y += nf_conntrack_tuple_common.h
+header-y += nf_log.h
 header-y += nf_tables.h
 header-y += nf_tables_compat.h
 header-y += nf_nat.h
diff --git a/include/uapi/linux/tc_act/Kbuild b/include/uapi/linux/tc_act/Kbuild
index e3969bd939e4..e3db7403296f 100644
--- a/include/uapi/linux/tc_act/Kbuild
+++ b/include/uapi/linux/tc_act/Kbuild
@@ -11,3 +11,5 @@ header-y += tc_vlan.h
 header-y += tc_bpf.h
 header-y += tc_connmark.h
 header-y += tc_ife.h
+header-y += tc_tunnel_key.h
+header-y += tc_skbmod.h
diff --git a/init/do_mounts_rd.c b/init/do_mounts_rd.c
index 8a09b32e07d6..dd4104c9aa12 100644
--- a/init/do_mounts_rd.c
+++ b/init/do_mounts_rd.c
@@ -272,7 +272,7 @@ int __init rd_load_image(char *from)
                 sys_write(out_fd, buf, BLOCK_SIZE);
 #if !defined(CONFIG_S390)
                 if (!(i % 16)) {
-                        printk("%c\b", rotator[rotate & 0x3]);
+                        pr_cont("%c\b", rotator[rotate & 0x3]);
                         rotate++;
                 }
 #endif
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6a936159c6e0..8199821f54cf 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2454,6 +2454,7 @@ static bool states_equal(struct bpf_verifier_env *env,
                          struct bpf_verifier_state *old,
                          struct bpf_verifier_state *cur)
 {
+        bool varlen_map_access = env->varlen_map_value_access;
         struct bpf_reg_state *rold, *rcur;
         int i;
 
@@ -2467,12 +2468,17 @@ static bool states_equal(struct bpf_verifier_env *env,
                 /* If the ranges were not the same, but everything else was and
                  * we didn't do a variable access into a map then we are a-ok.
                  */
-                if (!env->varlen_map_value_access &&
+                if (!varlen_map_access &&
                     rold->type == rcur->type && rold->imm == rcur->imm)
                         continue;
 
+                /* If we didn't map access then again we don't care about the
+                 * mismatched range values and it's ok if our old type was
+                 * UNKNOWN and we didn't go to a NOT_INIT'ed reg.
+                 */
                 if (rold->type == NOT_INIT ||
-                    (rold->type == UNKNOWN_VALUE && rcur->type != NOT_INIT))
+                    (!varlen_map_access && rold->type == UNKNOWN_VALUE &&
+                     rcur->type != NOT_INIT))
                         continue;
 
                 if (rold->type == PTR_TO_PACKET && rcur->type == PTR_TO_PACKET &&
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6ee1febdf6ff..02c8421f8c01 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -903,17 +903,14 @@ list_update_cgroup_event(struct perf_event *event,
          */
         cpuctx = __get_cpu_context(ctx);
 
-        /* Only set/clear cpuctx->cgrp if current task uses event->cgrp. */
-        if (perf_cgroup_from_task(current, ctx) != event->cgrp) {
-                /*
-                 * We are removing the last cpu event in this context.
-                 * If that event is not active in this cpu, cpuctx->cgrp
-                 * should've been cleared by perf_cgroup_switch.
-                 */
-                WARN_ON_ONCE(!add && cpuctx->cgrp);
-                return;
-        }
-        cpuctx->cgrp = add ? event->cgrp : NULL;
+        /*
+         * cpuctx->cgrp is NULL until a cgroup event is sched in or
+         * ctx->nr_cgroup == 0 .
+         */
+        if (add && perf_cgroup_from_task(current, ctx) == event->cgrp)
+                cpuctx->cgrp = event->cgrp;
+        else if (!add)
+                cpuctx->cgrp = NULL;
 }
 
 #else /* !CONFIG_CGROUP_PERF */
diff --git a/kernel/kcov.c b/kernel/kcov.c
index 30e6d05aa5a9..3cbb0c879705 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -7,6 +7,7 @@
 #include <linux/fs.h>
 #include <linux/mm.h>
 #include <linux/printk.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/vmalloc.h>
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index e74b438c850b..7bd265f6b098 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -506,13 +506,13 @@ static void __print_lock_name(struct lock_class *class)
         name = class->name;
         if (!name) {
                 name = __get_key_name(class->key, str);
-                printk("%s", name);
+                printk(KERN_CONT "%s", name);
         } else {
-                printk("%s", name);
+                printk(KERN_CONT "%s", name);
                 if (class->name_version > 1)
-                        printk("#%d", class->name_version);
+                        printk(KERN_CONT "#%d", class->name_version);
                 if (class->subclass)
-                        printk("/%d", class->subclass);
+                        printk(KERN_CONT "/%d", class->subclass);
         }
 }
 
@@ -522,9 +522,9 @@ static void print_lock_name(struct lock_class *class)
 
         get_usage_chars(class, usage);
 
-        printk(" (");
+        printk(KERN_CONT " (");
         __print_lock_name(class);
-        printk("){%s}", usage);
+        printk(KERN_CONT "){%s}", usage);
 }
 
 static void print_lockdep_cache(struct lockdep_map *lock)
@@ -536,7 +536,7 @@ static void print_lockdep_cache(struct lockdep_map *lock)
         if (!name)
                 name = __get_key_name(lock->key->subkeys, str);
 
-        printk("%s", name);
+        printk(KERN_CONT "%s", name);
 }
 
 static void print_lock(struct held_lock *hlock)
@@ -551,13 +551,13 @@ static void print_lock(struct held_lock *hlock)
         barrier();
 
         if (!class_idx || (class_idx - 1) >= MAX_LOCKDEP_KEYS) {
-                printk("<RELEASED>\n");
+                printk(KERN_CONT "<RELEASED>\n");
                 return;
         }
 
         print_lock_name(lock_classes + class_idx - 1);
-        printk(", at: ");
-        print_ip_sym(hlock->acquire_ip);
+        printk(KERN_CONT ", at: [<%p>] %pS\n",
+                (void *)hlock->acquire_ip, (void *)hlock->acquire_ip);
 }
 
 static void lockdep_print_held_locks(struct task_struct *curr)
@@ -792,8 +792,8 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
 
                 printk("\nnew class %p: %s", class->key, class->name);
                 if (class->name_version > 1)
-                        printk("#%d", class->name_version);
-                printk("\n");
+                        printk(KERN_CONT "#%d", class->name_version);
+                printk(KERN_CONT "\n");
                 dump_stack();
 
                 if (!graph_lock()) {
@@ -1071,7 +1071,7 @@ print_circular_bug_entry(struct lock_list *target, int depth)
                 return 0;
         printk("\n-> #%u", depth);
         print_lock_name(target->class);
-        printk(":\n");
+        printk(KERN_CONT ":\n");
         print_stack_trace(&target->trace, 6);
 
         return 0;
@@ -1102,11 +1102,11 @@ print_circular_lock_scenario(struct held_lock *src,
         if (parent != source) {
                 printk("Chain exists of:\n  ");
                 __print_lock_name(source);
-                printk(" --> ");
+                printk(KERN_CONT " --> ");
                 __print_lock_name(parent);
-                printk(" --> ");
+                printk(KERN_CONT " --> ");
                 __print_lock_name(target);
-                printk("\n\n");
+                printk(KERN_CONT "\n\n");
         }
 
         printk(" Possible unsafe locking scenario:\n\n");
@@ -1114,16 +1114,16 @@ print_circular_lock_scenario(struct held_lock *src,
         printk("       ----                    ----\n");
         printk("  lock(");
         __print_lock_name(target);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("                               lock(");
         __print_lock_name(parent);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("                               lock(");
         __print_lock_name(target);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("  lock(");
         __print_lock_name(source);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("\n *** DEADLOCK ***\n\n");
 }
 
@@ -1359,22 +1359,22 @@ static void print_lock_class_header(struct lock_class *class, int depth)
 
         printk("%*s->", depth, "");
         print_lock_name(class);
-        printk(" ops: %lu", class->ops);
-        printk(" {\n");
+        printk(KERN_CONT " ops: %lu", class->ops);
+        printk(KERN_CONT " {\n");
 
         for (bit = 0; bit < LOCK_USAGE_STATES; bit++) {
                 if (class->usage_mask & (1 << bit)) {
                         int len = depth;
 
                         len += printk("%*s   %s", depth, "", usage_str[bit]);
-                        len += printk(" at:\n");
+                        len += printk(KERN_CONT " at:\n");
                         print_stack_trace(class->usage_traces + bit, len);
                 }
         }
         printk("%*s }\n", depth, "");
 
-        printk("%*s ... key      at: ",depth,"");
-        print_ip_sym((unsigned long)class->key);
+        printk("%*s ... key      at: [<%p>] %pS\n",
+                depth, "", class->key, class->key);
 }
 
 /*
@@ -1437,11 +1437,11 @@ print_irq_lock_scenario(struct lock_list *safe_entry,
         if (middle_class != unsafe_class) {
                 printk("Chain exists of:\n  ");
                 __print_lock_name(safe_class);
-                printk(" --> ");
+                printk(KERN_CONT " --> ");
                 __print_lock_name(middle_class);
-                printk(" --> ");
+                printk(KERN_CONT " --> ");
                 __print_lock_name(unsafe_class);
-                printk("\n\n");
+                printk(KERN_CONT "\n\n");
         }
 
         printk(" Possible interrupt unsafe locking scenario:\n\n");
@@ -1449,18 +1449,18 @@ print_irq_lock_scenario(struct lock_list *safe_entry,
         printk("       ----                    ----\n");
         printk("  lock(");
         __print_lock_name(unsafe_class);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("                               local_irq_disable();\n");
         printk("                               lock(");
         __print_lock_name(safe_class);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("                               lock(");
         __print_lock_name(middle_class);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("  <Interrupt>\n");
         printk("    lock(");
         __print_lock_name(safe_class);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("\n *** DEADLOCK ***\n\n");
 }
 
@@ -1497,9 +1497,9 @@ print_bad_irq_dependency(struct task_struct *curr,
         print_lock(prev);
         printk("which would create a new lock dependency:\n");
         print_lock_name(hlock_class(prev));
-        printk(" ->");
+        printk(KERN_CONT " ->");
         print_lock_name(hlock_class(next));
-        printk("\n");
+        printk(KERN_CONT "\n");
 
         printk("\nbut this new dependency connects a %s-irq-safe lock:\n",
                 irqclass);
@@ -1521,8 +1521,7 @@ print_bad_irq_dependency(struct task_struct *curr,
 
         lockdep_print_held_locks(curr);
 
-        printk("\nthe dependencies between %s-irq-safe lock", irqclass);
-        printk(" and the holding lock:\n");
+        printk("\nthe dependencies between %s-irq-safe lock and the holding lock:\n", irqclass);
         if (!save_trace(&prev_root->trace))
                 return 0;
         print_shortest_lock_dependencies(backwards_entry, prev_root);
@@ -1694,10 +1693,10 @@ print_deadlock_scenario(struct held_lock *nxt,
         printk("       ----\n");
         printk("  lock(");
         __print_lock_name(prev);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("  lock(");
         __print_lock_name(next);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("\n *** DEADLOCK ***\n\n");
         printk(" May be due to missing lock nesting notation\n\n");
 }
@@ -1891,9 +1890,9 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
                 graph_unlock();
                 printk("\n new dependency: ");
                 print_lock_name(hlock_class(prev));
-                printk(" => ");
+                printk(KERN_CONT " => ");
                 print_lock_name(hlock_class(next));
-                printk("\n");
+                printk(KERN_CONT "\n");
                 dump_stack();
                 return graph_lock();
         }
@@ -2343,11 +2342,11 @@ print_usage_bug_scenario(struct held_lock *lock)
         printk("       ----\n");
         printk("  lock(");
         __print_lock_name(class);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("  <Interrupt>\n");
         printk("    lock(");
         __print_lock_name(class);
-        printk(");\n");
+        printk(KERN_CONT ");\n");
         printk("\n *** DEADLOCK ***\n\n");
 }
 
@@ -2522,14 +2521,18 @@ check_usage_backwards(struct task_struct *curr, struct held_lock *this,
 void print_irqtrace_events(struct task_struct *curr)
 {
         printk("irq event stamp: %u\n", curr->irq_events);
-        printk("hardirqs last  enabled at (%u): ", curr->hardirq_enable_event);
-        print_ip_sym(curr->hardirq_enable_ip);
-        printk("hardirqs last disabled at (%u): ", curr->hardirq_disable_event);
-        print_ip_sym(curr->hardirq_disable_ip);
-        printk("softirqs last  enabled at (%u): ", curr->softirq_enable_event);
-        print_ip_sym(curr->softirq_enable_ip);
-        printk("softirqs last disabled at (%u): ", curr->softirq_disable_event);
-        print_ip_sym(curr->softirq_disable_ip);
+        printk("hardirqs last  enabled at (%u): [<%p>] %pS\n",
+                curr->hardirq_enable_event, (void *)curr->hardirq_enable_ip,
+                (void *)curr->hardirq_enable_ip);
+        printk("hardirqs last disabled at (%u): [<%p>] %pS\n",
+                curr->hardirq_disable_event, (void *)curr->hardirq_disable_ip,
+                (void *)curr->hardirq_disable_ip);
+        printk("softirqs last  enabled at (%u): [<%p>] %pS\n",
+                curr->softirq_enable_event, (void *)curr->softirq_enable_ip,
+                (void *)curr->softirq_enable_ip);
+        printk("softirqs last disabled at (%u): [<%p>] %pS\n",
+                curr->softirq_disable_event, (void *)curr->softirq_disable_ip,
+                (void *)curr->softirq_disable_ip);
 }
 
 static int HARDIRQ_verbose(struct lock_class *class)
@@ -3235,8 +3238,8 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         if (very_verbose(class)) {
                 printk("\nacquire class [%p] %s", class->key, class->name);
                 if (class->name_version > 1)
-                        printk("#%d", class->name_version);
-                printk("\n");
+                        printk(KERN_CONT "#%d", class->name_version);
+                printk(KERN_CONT "\n");
                 dump_stack();
         }
 
@@ -3378,7 +3381,7 @@ print_unlock_imbalance_bug(struct task_struct *curr, struct lockdep_map *lock,
         printk("%s/%d is trying to release lock (",
                 curr->comm, task_pid_nr(curr));
         print_lockdep_cache(lock);
-        printk(") at:\n");
+        printk(KERN_CONT ") at:\n");
         print_ip_sym(ip);
         printk("but there are no more locks to release!\n");
         printk("\nother info that might help us debug this:\n");
@@ -3871,7 +3874,7 @@ print_lock_contention_bug(struct task_struct *curr, struct lockdep_map *lock,
         printk("%s/%d is trying to contend lock (",
                 curr->comm, task_pid_nr(curr));
         print_lockdep_cache(lock);
-        printk(") at:\n");
+        printk(KERN_CONT ") at:\n");
         print_ip_sym(ip);
         printk("but there are no locks held!\n");
         printk("\nother info that might help us debug this:\n");
diff --git a/kernel/module.c b/kernel/module.c
index f57dd63186e6..0e54d5bf0097 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1301,8 +1301,9 @@ static int check_version(Elf_Shdr *sechdrs,
                 goto bad_version;
         }
 
-        pr_warn("%s: no symbol version for %s\n", mod->name, symname);
-        return 0;
+        /* Broken toolchain. Warn once, then let it go.. */
+        pr_warn_once("%s: no symbol version for %s\n", mod->name, symname);
+        return 1;
 
 bad_version:
         pr_warn("%s: disagrees about version of symbol %s\n",
diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c
index f1c8fd566246..da39489d2d80 100644
--- a/kernel/sched/auto_group.c
+++ b/kernel/sched/auto_group.c
@@ -212,6 +212,7 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice)
 {
         static unsigned long next = INITIAL_JIFFIES;
         struct autogroup *ag;
+        unsigned long shares;
         int err;
 
         if (nice < MIN_NICE || nice > MAX_NICE)
@@ -230,9 +231,10 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice)
 
         next = HZ / 10 + jiffies;
         ag = autogroup_task_get(p);
+        shares = scale_load(sched_prio_to_weight[nice + 20]);
 
         down_write(&ag->lock);
-        err = sched_group_set_shares(ag->tg, sched_prio_to_weight[nice + 20]);
+        err = sched_group_set_shares(ag->tg, shares);
         if (!err)
                 ag->nice = nice;
         up_write(&ag->lock);
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index a8e12601eb37..056052dc8e91 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -362,6 +362,7 @@ void debug_object_init(void *addr, struct debug_obj_descr *descr)
 
         __debug_object_init(addr, descr, 0);
 }
+EXPORT_SYMBOL_GPL(debug_object_init);
 
 /**
  * debug_object_init_on_stack - debug checks when an object on stack is
@@ -376,6 +377,7 @@ void debug_object_init_on_stack(void *addr, struct debug_obj_descr *descr)
 
         __debug_object_init(addr, descr, 1);
 }
+EXPORT_SYMBOL_GPL(debug_object_init_on_stack);
 
 /**
  * debug_object_activate - debug checks when an object is activated
@@ -449,6 +451,7 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
         }
         return 0;
 }
+EXPORT_SYMBOL_GPL(debug_object_activate);
 
 /**
  * debug_object_deactivate - debug checks when an object is deactivated
@@ -496,6 +499,7 @@ void debug_object_deactivate(void *addr, struct debug_obj_descr *descr)
 
         raw_spin_unlock_irqrestore(&db->lock, flags);
 }
+EXPORT_SYMBOL_GPL(debug_object_deactivate);
 
 /**
  * debug_object_destroy - debug checks when an object is destroyed
@@ -542,6 +546,7 @@ void debug_object_destroy(void *addr, struct debug_obj_descr *descr)
 out_unlock:
         raw_spin_unlock_irqrestore(&db->lock, flags);
 }
+EXPORT_SYMBOL_GPL(debug_object_destroy);
 
 /**
  * debug_object_free - debug checks when an object is freed
@@ -582,6 +587,7 @@ void debug_object_free(void *addr, struct debug_obj_descr *descr)
 out_unlock:
         raw_spin_unlock_irqrestore(&db->lock, flags);
 }
+EXPORT_SYMBOL_GPL(debug_object_free);
 
 /**
  * debug_object_assert_init - debug checks when object should be init-ed
@@ -626,6 +632,7 @@ void debug_object_assert_init(void *addr, struct debug_obj_descr *descr)
 
         raw_spin_unlock_irqrestore(&db->lock, flags);
 }
+EXPORT_SYMBOL_GPL(debug_object_assert_init);
 
 /**
  * debug_object_active_state - debug checks object usage state machine
@@ -673,6 +680,7 @@ debug_object_active_state(void *addr, struct debug_obj_descr *descr,
 
         raw_spin_unlock_irqrestore(&db->lock, flags);
 }
+EXPORT_SYMBOL_GPL(debug_object_active_state);
 
 #ifdef CONFIG_DEBUG_OBJECTS_FREE
 static void __debug_check_no_obj_freed(const void *address, unsigned long size)
diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c
index 5464c8744ea9..e24388a863a7 100644
--- a/lib/mpi/mpi-pow.c
+++ b/lib/mpi/mpi-pow.c
@@ -64,8 +64,13 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
         if (!esize) {
                 /* Exponent is zero, result is 1 mod MOD, i.e., 1 or 0
                  * depending on if MOD equals 1.  */
-                rp[0] = 1;
                 res->nlimbs = (msize == 1 && mod->d[0] == 1) ? 0 : 1;
+                if (res->nlimbs) {
+                        if (mpi_resize(res, 1) < 0)
+                                goto enomem;
+                        rp = res->d;
+                        rp[0] = 1;
+                }
                 res->sign = 0;
                 goto leave;
         }
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
index 5e51872b3fc1..fbdf87920093 100644
--- a/lib/test_kasan.c
+++ b/lib/test_kasan.c
@@ -20,6 +20,11 @@
 #include <linux/uaccess.h>
 #include <linux/module.h>
 
+/*
+ * Note: test functions are marked noinline so that their names appear in
+ * reports.
+ */
+
 static noinline void __init kmalloc_oob_right(void)
 {
         char *ptr;
@@ -411,6 +416,29 @@ static noinline void __init copy_user_test(void)
         kfree(kmem);
 }
 
+static noinline void __init use_after_scope_test(void)
+{
+        volatile char *volatile p;
+
+        pr_info("use-after-scope on int\n");
+        {
+                int local = 0;
+
+                p = (char *)&local;
+        }
+        p[0] = 1;
+        p[3] = 1;
+
+        pr_info("use-after-scope on array\n");
+        {
+                char local[1024] = {0};
+
+                p = local;
+        }
+        p[0] = 1;
+        p[1023] = 1;
+}
+
 static int __init kmalloc_tests_init(void)
 {
         kmalloc_oob_right();
@@ -436,6 +464,7 @@ static int __init kmalloc_tests_init(void)
         kasan_global_oob();
         ksize_unpoisons_memory();
         copy_user_test();
+        use_after_scope_test();
         return -EAGAIN;
 }
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index eff3de359d50..d4a6e4001512 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1456,9 +1456,9 @@ bool move_huge_pmd(struct vm_area_struct *vma, unsigned long old_addr,
                 new_ptl = pmd_lockptr(mm, new_pmd);
                 if (new_ptl != old_ptl)
                         spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
-                if (pmd_present(*old_pmd) && pmd_dirty(*old_pmd))
-                        force_flush = true;
                 pmd = pmdp_huge_get_and_clear(mm, old_addr, old_pmd);
+                if (pmd_present(pmd) && pmd_dirty(pmd))
+                        force_flush = true;
                 VM_BUG_ON(!pmd_none(*new_pmd));
 
                 if (pmd_move_must_withdraw(new_ptl, old_ptl) &&
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 70c009741aab..0e9505f66ec1 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -764,6 +764,25 @@ EXPORT_SYMBOL(__asan_storeN_noabort);
 void __asan_handle_no_return(void) {}
 EXPORT_SYMBOL(__asan_handle_no_return);
 
+/* Emitted by compiler to poison large objects when they go out of scope. */
+void __asan_poison_stack_memory(const void *addr, size_t size)
+{
+        /*
+         * Addr is KASAN_SHADOW_SCALE_SIZE-aligned and the object is surrounded
+         * by redzones, so we simply round up size to simplify logic.
+         */
+        kasan_poison_shadow(addr, round_up(size, KASAN_SHADOW_SCALE_SIZE),
+                            KASAN_USE_AFTER_SCOPE);
+}
+EXPORT_SYMBOL(__asan_poison_stack_memory);
+
+/* Emitted by compiler to unpoison large objects when they go into scope. */
+void __asan_unpoison_stack_memory(const void *addr, size_t size)
+{
+        kasan_unpoison_shadow(addr, size);
+}
+EXPORT_SYMBOL(__asan_unpoison_stack_memory);
+
 #ifdef CONFIG_MEMORY_HOTPLUG
 static int kasan_mem_notifier(struct notifier_block *nb,
                         unsigned long action, void *data)
diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index e5c2181fee6f..1c260e6b3b3c 100644
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -21,6 +21,7 @@
 #define KASAN_STACK_MID         0xF2
 #define KASAN_STACK_RIGHT       0xF3
 #define KASAN_STACK_PARTIAL     0xF4
+#define KASAN_USE_AFTER_SCOPE   0xF8
 
 /* Don't break randconfig/all*config builds */
 #ifndef KASAN_ABI_VERSION
@@ -53,6 +54,9 @@ struct kasan_global {
 #if KASAN_ABI_VERSION >= 4
         struct kasan_source_location *location;
 #endif
+#if KASAN_ABI_VERSION >= 5
+        char *odr_indicator;
+#endif
 };
 
 /**
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index 24c1211fe9d5..073325aedc68 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -90,6 +90,9 @@ static void print_error_description(struct kasan_access_info *info)
         case KASAN_KMALLOC_FREE:
                 bug_type = "use-after-free";
                 break;
+        case KASAN_USE_AFTER_SCOPE:
+                bug_type = "use-after-scope";
+                break;
         }
 
         pr_err("BUG: KASAN: %s in %pS at addr %p\n",
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 728d7790dc2d..87e1a7ca3846 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -103,6 +103,7 @@ static struct khugepaged_scan khugepaged_scan = {
         .mm_head = LIST_HEAD_INIT(khugepaged_scan.mm_head),
 };
 
+#ifdef CONFIG_SYSFS
 static ssize_t scan_sleep_millisecs_show(struct kobject *kobj,
                                          struct kobj_attribute *attr,
                                          char *buf)
@@ -295,6 +296,7 @@ struct attribute_group khugepaged_attr_group = {
         .attrs = khugepaged_attr,
         .name = "khugepaged",
 };
+#endif /* CONFIG_SYSFS */
 
 #define VM_NO_KHUGEPAGED (VM_SPECIAL | VM_HUGETLB)
 
diff --git a/mm/mlock.c b/mm/mlock.c
index 145a4258ddbc..cdbed8aaa426 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -190,10 +190,13 @@ unsigned int munlock_vma_page(struct page *page)
          */
         spin_lock_irq(zone_lru_lock(zone));
 
-        nr_pages = hpage_nr_pages(page);
-        if (!TestClearPageMlocked(page))
+        if (!TestClearPageMlocked(page)) {
+                /* Potentially, PTE-mapped THP: do not skip the rest PTEs */
+                nr_pages = 1;
                 goto unlock_out;
+        }
 
+        nr_pages = hpage_nr_pages(page);
         __mod_zone_page_state(zone, NR_MLOCK, -nr_pages);
 
         if (__munlock_isolate_lru_page(page, true)) {
diff --git a/mm/mremap.c b/mm/mremap.c
index 6ccecc03f56a..30d7d2482eea 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -149,14 +149,18 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
                 if (pte_none(*old_pte))
                         continue;
 
+                pte = ptep_get_and_clear(mm, old_addr, old_pte);
                 /*
-                 * We are remapping a dirty PTE, make sure to
-                 * flush TLB before we drop the PTL for the
+                 * If we are remapping a dirty PTE, make sure
+                 * to flush TLB before we drop the PTL for the
                  * old PTE or we may race with page_mkclean().
+                 *
+                 * This check has to be done after we removed the
+                 * old PTE from page tables or another thread may
+                 * dirty it after the check and before the removal.
                  */
-                if (pte_present(*old_pte) && pte_dirty(*old_pte))
+                if (pte_present(pte) && pte_dirty(pte))
                         force_flush = true;
-                pte = ptep_get_and_clear(mm, old_addr, old_pte);
                 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
                 pte = move_soft_dirty_pte(pte);
                 set_pte_at(mm, new_addr, new_pte, pte);
diff --git a/mm/shmem.c b/mm/shmem.c
index 166ebf5d2bce..9d32e1cb9f38 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1848,6 +1848,18 @@ unlock:
         return error;
 }
 
+/*
+ * This is like autoremove_wake_function, but it removes the wait queue
+ * entry unconditionally - even if something else had already woken the
+ * target.
+ */
+static int synchronous_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key)
+{
+        int ret = default_wake_function(wait, mode, sync, key);
+        list_del_init(&wait->task_list);
+        return ret;
+}
+
 static int shmem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
         struct inode *inode = file_inode(vma->vm_file);
@@ -1883,7 +1895,7 @@ static int shmem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                     vmf->pgoff >= shmem_falloc->start &&
                     vmf->pgoff < shmem_falloc->next) {
                         wait_queue_head_t *shmem_falloc_waitq;
-                        DEFINE_WAIT(shmem_fault_wait);
+                        DEFINE_WAIT_FUNC(shmem_fault_wait, synchronous_wake_function);
 
                         ret = VM_FAULT_NOPAGE;
                         if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) &&
@@ -2665,6 +2677,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
                 spin_lock(&inode->i_lock);
                 inode->i_private = NULL;
                 wake_up_all(&shmem_falloc_waitq);
+                WARN_ON_ONCE(!list_empty(&shmem_falloc_waitq.task_list));
                 spin_unlock(&inode->i_lock);
                 error = 0;
                 goto out;
diff --git a/mm/truncate.c b/mm/truncate.c
index a01cce450a26..8d8c62d89e6d 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -283,7 +283,7 @@ void truncate_inode_pages_range(struct address_space *mapping,
 
                         if (!trylock_page(page))
                                 continue;
-                        WARN_ON(page_to_pgoff(page) != index);
+                        WARN_ON(page_to_index(page) != index);
                         if (PageWriteback(page)) {
                                 unlock_page(page);
                                 continue;
@@ -371,7 +371,7 @@ void truncate_inode_pages_range(struct address_space *mapping,
                         }
 
                         lock_page(page);
-                        WARN_ON(page_to_pgoff(page) != index);
+                        WARN_ON(page_to_index(page) != index);
                         wait_on_page_writeback(page);
                         truncate_inode_page(mapping, page);
                         unlock_page(page);
@@ -492,7 +492,7 @@ unsigned long invalidate_mapping_pages(struct address_space *mapping,
                         if (!trylock_page(page))
                                 continue;
 
-                        WARN_ON(page_to_pgoff(page) != index);
+                        WARN_ON(page_to_index(page) != index);
 
                         /* Middle of THP: skip */
                         if (PageTransTail(page)) {
@@ -612,7 +612,7 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
                         }
 
                         lock_page(page);
-                        WARN_ON(page_to_pgoff(page) != index);
+                        WARN_ON(page_to_index(page) != index);
                         if (page->mapping != mapping) {
                                 unlock_page(page);
                                 continue;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 76fda2268148..d75cdf360730 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2354,6 +2354,8 @@ static void shrink_node_memcg(struct pglist_data *pgdat, struct mem_cgroup *memc
                         }
                 }
 
+                cond_resched();
+
                 if (nr_reclaimed < nr_to_reclaim || scan_adjusted)
                         continue;
 
diff --git a/mm/workingset.c b/mm/workingset.c
index 617475f529f4..fb1f9183d89a 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -348,7 +348,7 @@ static unsigned long count_shadow_nodes(struct shrinker *shrinker,
         shadow_nodes = list_lru_shrink_count(&workingset_shadow_nodes, sc);
         local_irq_enable();
 
-        if (memcg_kmem_enabled()) {
+        if (sc->memcg) {
                 pages = mem_cgroup_node_nr_lru_pages(sc->memcg, sc->nid,
                                                      LRU_ALL_FILE);
         } else {
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 7f663092f6de..0dc85eb1cb7a 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -3282,7 +3282,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
                                                              &tvlv_tt_data,
                                                              &tt_change,
                                                              &tt_len);
-                if (!tt_len)
+                if (!tt_len || !tvlv_len)
                         goto unlock;
 
                 /* Copy the last orig_node's OGM buffer */
@@ -3300,7 +3300,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
                                                              &tvlv_tt_data,
                                                              &tt_change,
                                                              &tt_len);
-                if (!tt_len)
+                if (!tt_len || !tvlv_len)
                         goto out;
 
                 /* fill the rest of the tvlv with the real TT entries */
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index d020299baba4..1904a93f47d5 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -1090,7 +1090,6 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
 {
         struct hci_conn *hcon;
         struct hci_dev *hdev;
-        bdaddr_t *src = BDADDR_ANY;
         int n;
 
         n = sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu",
@@ -1101,7 +1100,8 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
         if (n < 7)
                 return -EINVAL;
 
-        hdev = hci_get_route(addr, src);
+        /* The LE_PUBLIC address type is ignored because of BDADDR_ANY */
+        hdev = hci_get_route(addr, BDADDR_ANY, BDADDR_LE_PUBLIC);
         if (!hdev)
                 return -ENOENT;
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 3809617aa98d..dc59eae54717 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -613,7 +613,7 @@ int hci_conn_del(struct hci_conn *conn)
         return 0;
 }
 
-struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
+struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
 {
         int use_src = bacmp(src, BDADDR_ANY);
         struct hci_dev *hdev = NULL, *d;
@@ -634,7 +634,29 @@ struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
                  */
 
                 if (use_src) {
-                        if (!bacmp(&d->bdaddr, src)) {
+                        bdaddr_t id_addr;
+                        u8 id_addr_type;
+
+                        if (src_type == BDADDR_BREDR) {
+                                if (!lmp_bredr_capable(d))
+                                        continue;
+                                bacpy(&id_addr, &d->bdaddr);
+                                id_addr_type = BDADDR_BREDR;
+                        } else {
+                                if (!lmp_le_capable(d))
+                                        continue;
+
+                                hci_copy_identity_address(d, &id_addr,
+                                                          &id_addr_type);
+
+                                /* Convert from HCI to three-value type */
+                                if (id_addr_type == ADDR_LE_DEV_PUBLIC)
+                                        id_addr_type = BDADDR_LE_PUBLIC;
+                                else
+                                        id_addr_type = BDADDR_LE_RANDOM;
+                        }
+
+                        if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
                                 hdev = d; break;
                         }
                 } else {
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index d4cad29b033f..577f1c01454a 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7060,7 +7060,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
         BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,
                dst_type, __le16_to_cpu(psm));
 
-        hdev = hci_get_route(dst, &chan->src);
+        hdev = hci_get_route(dst, &chan->src, chan->src_type);
         if (!hdev)
                 return -EHOSTUNREACH;
 
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 8e385a0ae60e..2f2cb5e27cdd 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -178,7 +178,7 @@ static void rfcomm_reparent_device(struct rfcomm_dev *dev)
         struct hci_dev *hdev;
         struct hci_conn *conn;
 
-        hdev = hci_get_route(&dev->dst, &dev->src);
+        hdev = hci_get_route(&dev->dst, &dev->src, BDADDR_BREDR);
         if (!hdev)
                 return;
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index f52bcbf2e58c..3125ce670c2f 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -219,7 +219,7 @@ static int sco_connect(struct sock *sk)
 
         BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
 
-        hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src);
+        hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
         if (!hdev)
                 return -EHOSTUNREACH;
 
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index e120307c6e36..f88c4df3f91e 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -898,6 +898,7 @@ int br_sysfs_addbr(struct net_device *dev)
         if (!br->ifobj) {
                 pr_info("%s: can't add kobject (directory) %s/%s\n",
                         __func__, dev->name, SYSFS_BRIDGE_PORT_SUBDIR);
+                err = -ENOMEM;
                 goto out3;
         }
         return 0;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index aa209b1066c9..92cbbd2afddb 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -1107,10 +1107,7 @@ static struct net_proto_family caif_family_ops = {
 
 static int __init caif_sktinit_module(void)
 {
-        int err = sock_register(&caif_family_ops);
-        if (!err)
-                return err;
-        return 0;
+        return sock_register(&caif_family_ops);
 }
 
 static void __exit caif_sktexit_module(void)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 8af9d25ff988..436a7537e6a9 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -77,7 +77,7 @@
                      (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \
                      (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG))
 
-#define CAN_BCM_VERSION "20160617"
+#define CAN_BCM_VERSION "20161123"
 
 MODULE_DESCRIPTION("PF_CAN broadcast manager protocol");
 MODULE_LICENSE("Dual BSD/GPL");
@@ -109,8 +109,9 @@ struct bcm_op {
         u32 count;
         u32 nframes;
         u32 currframe;
-        struct canfd_frame *frames;
-        struct canfd_frame *last_frames;
+        /* void pointers to arrays of struct can[fd]_frame */
+        void *frames;
+        void *last_frames;
         struct canfd_frame sframe;
         struct canfd_frame last_sframe;
         struct sock *sk;
@@ -681,7 +682,7 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 
         if (op->flags & RX_FILTER_ID) {
                 /* the easiest case */
-                bcm_rx_update_and_send(op, &op->last_frames[0], rxframe);
+                bcm_rx_update_and_send(op, op->last_frames, rxframe);
                 goto rx_starttimer;
         }
 
@@ -1068,7 +1069,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 
                 if (msg_head->nframes) {
                         /* update CAN frames content */
-                        err = memcpy_from_msg((u8 *)op->frames, msg,
+                        err = memcpy_from_msg(op->frames, msg,
                                               msg_head->nframes * op->cfsiz);
                         if (err < 0)
                                 return err;
@@ -1118,7 +1119,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                 }
 
                 if (msg_head->nframes) {
-                        err = memcpy_from_msg((u8 *)op->frames, msg,
+                        err = memcpy_from_msg(op->frames, msg,
                                               msg_head->nframes * op->cfsiz);
                         if (err < 0) {
                                 if (op->frames != &op->sframe)
@@ -1163,6 +1164,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
         /* check flags */
 
         if (op->flags & RX_RTR_FRAME) {
+                struct canfd_frame *frame0 = op->frames;
 
                 /* no timers in RTR-mode */
                 hrtimer_cancel(&op->thrtimer);
@@ -1174,8 +1176,8 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                  * prevent a full-load-loopback-test ... ;-]
                  */
                 if ((op->flags & TX_CP_CAN_ID) ||
-                    (op->frames[0].can_id == op->can_id))
-                        op->frames[0].can_id = op->can_id & ~CAN_RTR_FLAG;
+                    (frame0->can_id == op->can_id))
+                        frame0->can_id = op->can_id & ~CAN_RTR_FLAG;
 
         } else {
                 if (op->flags & SETTIMER) {
diff --git a/net/can/raw.c b/net/can/raw.c
index 972c187d40ab..b075f028d7e2 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -499,6 +499,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
                 if (optlen % sizeof(struct can_filter) != 0)
                         return -EINVAL;
 
+                if (optlen > CAN_RAW_FILTER_MAX * sizeof(struct can_filter))
+                        return -EINVAL;
+
                 count = optlen / sizeof(struct can_filter);
 
                 if (count > 1) {
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 977489820eb9..047a1752ece1 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -2479,6 +2479,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GET_TS_INFO:
         case ETHTOOL_GEEE:
         case ETHTOOL_GTUNABLE:
+        case ETHTOOL_GLINKSETTINGS:
                 break;
         default:
                 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
diff --git a/net/core/flow.c b/net/core/flow.c
index 3937b1b68d5b..18e8893d4be5 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -95,7 +95,6 @@ static void flow_cache_gc_task(struct work_struct *work)
         list_for_each_entry_safe(fce, n, &gc_list, u.gc_list) {
                 flow_entry_kill(fce, xfrm);
                 atomic_dec(&xfrm->flow_cache_gc_count);
-                WARN_ON(atomic_read(&xfrm->flow_cache_gc_count) < 0);
         }
 }
 
@@ -236,9 +235,8 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
                 if (fcp->hash_count > fc->high_watermark)
                         flow_cache_shrink(fc, fcp);
 
-                if (fcp->hash_count > 2 * fc->high_watermark ||
-                    atomic_read(&net->xfrm.flow_cache_gc_count) > fc->high_watermark) {
-                        atomic_inc(&net->xfrm.flow_cache_genid);
+                if (atomic_read(&net->xfrm.flow_cache_gc_count) >
+                    2 * num_online_cpus() * fc->high_watermark) {
                         flo = ERR_PTR(-ENOBUFS);
                         goto ret_object;
                 }
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 69e4463a4b1b..c6d8207ffa7e 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1013,4 +1013,4 @@ static int __init init_default_flow_dissectors(void)
         return 0;
 }
 
-late_initcall_sync(init_default_flow_dissectors);
+core_initcall(init_default_flow_dissectors);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a99917b5de33..a6196cf844f6 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -931,8 +931,8 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
                + nla_total_size(4) /* IFLA_PROMISCUITY */
                + nla_total_size(4) /* IFLA_NUM_TX_QUEUES */
                + nla_total_size(4) /* IFLA_NUM_RX_QUEUES */
-               + nla_total_size(4) /* IFLA_MAX_GSO_SEGS */
-               + nla_total_size(4) /* IFLA_MAX_GSO_SIZE */
+               + nla_total_size(4) /* IFLA_GSO_MAX_SEGS */
+               + nla_total_size(4) /* IFLA_GSO_MAX_SIZE */
                + nla_total_size(1) /* IFLA_OPERSTATE */
                + nla_total_size(1) /* IFLA_LINKMODE */
                + nla_total_size(4) /* IFLA_CARRIER_CHANGES */
@@ -2737,7 +2737,7 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
                                                            ext_filter_mask));
         }
 
-        return min_ifinfo_dump_size;
+        return nlmsg_total_size(min_ifinfo_dump_size);
 }
 
 static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)
diff --git a/net/core/sock.c b/net/core/sock.c
index 5e3ca414357e..00a074dbfe9b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -715,7 +715,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
                 val = min_t(u32, val, sysctl_wmem_max);
 set_sndbuf:
                 sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
-                sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF);
+                sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
                 /* Wake up sending tasks if we upped the value. */
                 sk->sk_write_space(sk);
                 break;
@@ -751,7 +751,7 @@ set_rcvbuf:
                  * returning the value we actually used in getsockopt
                  * is the most desirable behavior.
                  */
-                sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF);
+                sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
                 break;
 
         case SO_RCVBUFFORCE:
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 4f6c1862dfd2..3202d75329b5 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -1353,6 +1353,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
 dcb_unlock:
         spin_unlock_bh(&dcb_lock);
 nla_put_failure:
+        err = -EMSGSIZE;
         return err;
 }
 
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index b567c8725aea..edbe59d203ef 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -700,6 +700,7 @@ int dccp_invalid_packet(struct sk_buff *skb)
 {
         const struct dccp_hdr *dh;
         unsigned int cscov;
+        u8 dccph_doff;
 
         if (skb->pkt_type != PACKET_HOST)
                 return 1;
@@ -721,18 +722,19 @@ int dccp_invalid_packet(struct sk_buff *skb)
         /*
          * If P.Data Offset is too small for packet type, drop packet and return
          */
-        if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
-                DCCP_WARN("P.Data Offset(%u) too small\n", dh->dccph_doff);
+        dccph_doff = dh->dccph_doff;
+        if (dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
+                DCCP_WARN("P.Data Offset(%u) too small\n", dccph_doff);
                 return 1;
         }
         /*
          * If P.Data Offset is too too large for packet, drop packet and return
          */
-        if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) {
-                DCCP_WARN("P.Data Offset(%u) too large\n", dh->dccph_doff);
+        if (!pskb_may_pull(skb, dccph_doff * sizeof(u32))) {
+                DCCP_WARN("P.Data Offset(%u) too large\n", dccph_doff);
                 return 1;
         }
-
+        dh = dccp_hdr(skb);
         /*
          * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet
          * has short sequence numbers), drop packet and return
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index a6902c1e2f28..7899919cd9f0 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -233,6 +233,8 @@ int dsa_cpu_dsa_setup(struct dsa_switch *ds, struct device *dev,
                 genphy_read_status(phydev);
                 if (ds->ops->adjust_link)
                         ds->ops->adjust_link(ds, port, phydev);
+
+                put_device(&phydev->mdio.dev);
         }
 
         return 0;
@@ -504,15 +506,8 @@ dsa_switch_setup(struct dsa_switch_tree *dst, int index,
 
 void dsa_cpu_dsa_destroy(struct device_node *port_dn)
 {
-        struct phy_device *phydev;
-
-        if (of_phy_is_fixed_link(port_dn)) {
-                phydev = of_phy_find_device(port_dn);
-                if (phydev) {
-                        phy_device_free(phydev);
-                        fixed_phy_unregister(phydev);
-                }
-        }
+        if (of_phy_is_fixed_link(port_dn))
+                of_phy_deregister_fixed_link(port_dn);
 }
 
 static void dsa_switch_destroy(struct dsa_switch *ds)
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index f8a7d9aab437..5fff951a0a49 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -28,8 +28,10 @@ static struct dsa_switch_tree *dsa_get_dst(u32 tree)
         struct dsa_switch_tree *dst;
 
         list_for_each_entry(dst, &dsa_switch_trees, list)
-                if (dst->tree == tree)
+                if (dst->tree == tree) {
+                        kref_get(&dst->refcount);
                         return dst;
+                }
         return NULL;
 }
 
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 6b1282c006b1..30e2e21d7619 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1125,7 +1125,7 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
         p->phy_interface = mode;
 
         phy_dn = of_parse_phandle(port_dn, "phy-handle", 0);
-        if (of_phy_is_fixed_link(port_dn)) {
+        if (!phy_dn && of_phy_is_fixed_link(port_dn)) {
                 /* In the case of a fixed PHY, the DT node associated
                  * to the fixed PHY is the Port DT node
                  */
@@ -1135,7 +1135,7 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                         return ret;
                 }
                 phy_is_fixed = true;
-                phy_dn = port_dn;
+                phy_dn = of_node_get(port_dn);
         }
 
         if (ds->ops->get_phy_flags)
@@ -1154,6 +1154,7 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                         ret = dsa_slave_phy_connect(p, slave_dev, phy_id);
                         if (ret) {
                                 netdev_err(slave_dev, "failed to connect to phy%d: %d\n", phy_id, ret);
+                                of_node_put(phy_dn);
                                 return ret;
                         }
                 } else {
@@ -1162,6 +1163,8 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                                                 phy_flags,
                                                 p->phy_interface);
                 }
+
+                of_node_put(phy_dn);
         }
 
         if (p->phy && phy_is_fixed)
@@ -1174,6 +1177,8 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                 ret = dsa_slave_phy_connect(p, slave_dev, p->port);
                 if (ret) {
                         netdev_err(slave_dev, "failed to connect to port %d: %d\n", p->port, ret);
+                        if (phy_is_fixed)
+                                of_phy_deregister_fixed_link(port_dn);
                         return ret;
                 }
         }
@@ -1289,10 +1294,18 @@ int dsa_slave_create(struct dsa_switch *ds, struct device *parent,
 void dsa_slave_destroy(struct net_device *slave_dev)
 {
         struct dsa_slave_priv *p = netdev_priv(slave_dev);
+        struct dsa_switch *ds = p->parent;
+        struct device_node *port_dn;
+
+        port_dn = ds->ports[p->port].dn;
 
         netif_carrier_off(slave_dev);
-        if (p->phy)
+        if (p->phy) {
                 phy_disconnect(p->phy);
+
+                if (of_phy_is_fixed_link(port_dn))
+                        of_phy_deregister_fixed_link(port_dn);
+        }
         unregister_netdev(slave_dev);
         free_netdev(slave_dev);
 }
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 300b06888fdf..b54b3ca939db 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -715,6 +715,7 @@ config DEFAULT_TCP_CONG
         default "reno" if DEFAULT_RENO
         default "dctcp" if DEFAULT_DCTCP
         default "cdg" if DEFAULT_CDG
+        default "bbr" if DEFAULT_BBR
         default "cubic"
 
 config TCP_MD5SIG
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 5ddf5cda07f4..215143246e4b 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1233,7 +1233,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
                 fixedid = !!(skb_shinfo(skb)->gso_type & SKB_GSO_TCP_FIXEDID);
 
                 /* fixed ID is invalid if DF bit is not set */
-                if (fixedid && !(iph->frag_off & htons(IP_DF)))
+                if (fixedid && !(ip_hdr(skb)->frag_off & htons(IP_DF)))
                         goto out;
         }
 
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index d95631d09248..20fb25e3027b 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -476,7 +476,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
                 esph = (void *)skb_push(skb, 4);
                 *seqhi = esph->spi;
                 esph->spi = esph->seq_no;
-                esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.input.hi);
+                esph->seq_no = XFRM_SKB_CB(skb)->seq.input.hi;
                 aead_request_set_callback(req, 0, esp_input_done_esn, skb);
         }
 
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 026f309c51e9..e3665bf7a7f3 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -719,6 +719,13 @@ static unsigned char update_suffix(struct key_vector *tn)
 {
         unsigned char slen = tn->pos;
         unsigned long stride, i;
+        unsigned char slen_max;
+
+        /* only vector 0 can have a suffix length greater than or equal to
+         * tn->pos + tn->bits, the second highest node will have a suffix
+         * length at most of tn->pos + tn->bits - 1
+         */
+        slen_max = min_t(unsigned char, tn->pos + tn->bits - 1, tn->slen);
 
         /* search though the list of children looking for nodes that might
          * have a suffix greater than the one we currently have.  This is
@@ -736,12 +743,8 @@ static unsigned char update_suffix(struct key_vector *tn)
                 slen = n->slen;
                 i &= ~(stride - 1);
 
-                /* if slen covers all but the last bit we can stop here
-                 * there will be nothing longer than that since only node
-                 * 0 and 1 << (bits - 1) could have that as their suffix
-                 * length.
-                 */
-                if ((slen + 1) >= (tn->pos + tn->bits))
+                /* stop searching if we have hit the maximum possible value */
+                if (slen >= slen_max)
                         break;
         }
 
@@ -913,39 +916,27 @@ static struct key_vector *resize(struct trie *t, struct key_vector *tn)
                 return collapse(t, tn);
 
         /* update parent in case halve failed */
-        tp = node_parent(tn);
-
-        /* Return if at least one deflate was run */
-        if (max_work != MAX_WORK)
-                return tp;
-
-        /* push the suffix length to the parent node */
-        if (tn->slen > tn->pos) {
-                unsigned char slen = update_suffix(tn);
-
-                if (slen > tp->slen)
-                        tp->slen = slen;
-        }
-
-        return tp;
+        return node_parent(tn);
 }
 
-static void leaf_pull_suffix(struct key_vector *tp, struct key_vector *l)
+static void node_pull_suffix(struct key_vector *tn, unsigned char slen)
 {
-        while ((tp->slen > tp->pos) && (tp->slen > l->slen)) {
-                if (update_suffix(tp) > l->slen)
+        unsigned char node_slen = tn->slen;
+
+        while ((node_slen > tn->pos) && (node_slen > slen)) {
+                slen = update_suffix(tn);
+                if (node_slen == slen)
                         break;
-                tp = node_parent(tp);
+
+                tn = node_parent(tn);
+                node_slen = tn->slen;
         }
 }
 
-static void leaf_push_suffix(struct key_vector *tn, struct key_vector *l)
+static void node_push_suffix(struct key_vector *tn, unsigned char slen)
 {
-        /* if this is a new leaf then tn will be NULL and we can sort
-         * out parent suffix lengths as a part of trie_rebalance
-         */
-        while (tn->slen < l->slen) {
-                tn->slen = l->slen;
+        while (tn->slen < slen) {
+                tn->slen = slen;
                 tn = node_parent(tn);
         }
 }
@@ -1066,6 +1057,7 @@ static int fib_insert_node(struct trie *t, struct key_vector *tp,
         }
 
         /* Case 3: n is NULL, and will just insert a new leaf */
+        node_push_suffix(tp, new->fa_slen);
         NODE_INIT_PARENT(l, tp);
         put_child_root(tp, key, l);
         trie_rebalance(t, tp);
@@ -1107,7 +1099,7 @@ static int fib_insert_alias(struct trie *t, struct key_vector *tp,
         /* if we added to the tail node then we need to update slen */
         if (l->slen < new->fa_slen) {
                 l->slen = new->fa_slen;
-                leaf_push_suffix(tp, l);
+                node_push_suffix(tp, new->fa_slen);
         }
 
         return 0;
@@ -1499,6 +1491,8 @@ static void fib_remove_alias(struct trie *t, struct key_vector *tp,
          * out parent suffix lengths as a part of trie_rebalance
          */
         if (hlist_empty(&l->leaf)) {
+                if (tp->slen == l->slen)
+                        node_pull_suffix(tp, tp->pos);
                 put_child_root(tp, l->key, NULL);
                 node_free(l);
                 trie_rebalance(t, tp);
@@ -1511,7 +1505,7 @@ static void fib_remove_alias(struct trie *t, struct key_vector *tp,
 
         /* update the trie with the latest suffix length */
         l->slen = fa->fa_slen;
-        leaf_pull_suffix(tp, l);
+        node_pull_suffix(tp, fa->fa_slen);
 }
 
 /* Caller must hold RTNL. */
@@ -1783,6 +1777,10 @@ void fib_table_flush_external(struct fib_table *tb)
                         if (IS_TRIE(pn))
                                 break;
 
+                        /* update the suffix to address pulled leaves */
+                        if (pn->slen > pn->pos)
+                                update_suffix(pn);
+
                         /* resize completed node */
                         pn = resize(t, pn);
                         cindex = get_index(pkey, pn);
@@ -1849,6 +1847,10 @@ int fib_table_flush(struct net *net, struct fib_table *tb)
                         if (IS_TRIE(pn))
                                 break;
 
+                        /* update the suffix to address pulled leaves */
+                        if (pn->slen > pn->pos)
+                                update_suffix(pn);
+
                         /* resize completed node */
                         pn = resize(t, pn);
                         cindex = get_index(pkey, pn);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 105908d841a3..877bdb02e887 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -107,6 +107,8 @@ int __ip_local_out(struct net *net, struct sock *sk, struct sk_buff *skb)
         if (unlikely(!skb))
                 return 0;
 
+        skb->protocol = htons(ETH_P_IP);
+
         return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT,
                        net, sk, skb, NULL, skb_dst(skb)->dev,
                        dst_output);
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index c3776ff6749f..b3cc1335adbc 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -24,10 +24,11 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t
         struct flowi4 fl4 = {};
         __be32 saddr = iph->saddr;
         __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
+        struct net_device *dev = skb_dst(skb)->dev;
         unsigned int hh_len;
 
         if (addr_type == RTN_UNSPEC)
-                addr_type = inet_addr_type(net, saddr);
+                addr_type = inet_addr_type_dev_table(net, dev, saddr);
         if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
                 flags |= FLOWI_FLAG_ANYSRC;
         else
@@ -40,6 +41,8 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t
         fl4.saddr = saddr;
         fl4.flowi4_tos = RT_TOS(iph->tos);
         fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
+        if (!fl4.flowi4_oif)
+                fl4.flowi4_oif = l3mdev_master_ifindex(dev);
         fl4.flowi4_mark = skb->mark;
         fl4.flowi4_flags = flags;
         rt = ip_route_output_key(net, &fl4);
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index b31df597fd37..697538464e6e 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1201,8 +1201,8 @@ static int translate_compat_table(struct xt_table_info **pinfo,
 
         newinfo->number = compatr->num_entries;
         for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
-                newinfo->hook_entry[i] = info->hook_entry[i];
-                newinfo->underflow[i] = info->underflow[i];
+                newinfo->hook_entry[i] = compatr->hook_entry[i];
+                newinfo->underflow[i] = compatr->underflow[i];
         }
         entry1 = newinfo->entries;
         pos = entry1;
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 205e2000d395..96b8e2b95731 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -657,6 +657,10 @@ int ping_common_sendmsg(int family, struct msghdr *msg, size_t len,
         if (len > 0xFFFF)
                 return -EMSGSIZE;
 
+        /* Must have at least a full ICMP header. */
+        if (len < icmph_len)
+                return -EINVAL;
+
         /*
          *      Check the flags.
          */
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a27b9c0e27c0..c71d49ce0c93 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -128,6 +128,23 @@ int sysctl_tcp_invalid_ratelimit __read_mostly = HZ/2;
 #define REXMIT_LOST     1 /* retransmit packets marked lost */
 #define REXMIT_NEW      2 /* FRTO-style transmit of unsent/new packets */
 
+static void tcp_gro_dev_warn(struct sock *sk, const struct sk_buff *skb)
+{
+        static bool __once __read_mostly;
+
+        if (!__once) {
+                struct net_device *dev;
+
+                __once = true;
+
+                rcu_read_lock();
+                dev = dev_get_by_index_rcu(sock_net(sk), skb->skb_iif);
+                pr_warn("%s: Driver has suspect GRO implementation, TCP performance may be compromised.\n",
+                        dev ? dev->name : "Unknown driver");
+                rcu_read_unlock();
+        }
+}
+
 /* Adapt the MSS value used to make delayed ack decision to the
  * real world.
  */
@@ -144,7 +161,10 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb)
          */
         len = skb_shinfo(skb)->gso_size ? : skb->len;
         if (len >= icsk->icsk_ack.rcv_mss) {
-                icsk->icsk_ack.rcv_mss = len;
+                icsk->icsk_ack.rcv_mss = min_t(unsigned int, len,
+                                               tcp_sk(sk)->advmss);
+                if (unlikely(icsk->icsk_ack.rcv_mss != len))
+                        tcp_gro_dev_warn(sk, skb);
         } else {
                 /* Otherwise, we make more careful check taking into account,
                  * that SACKs block is variable.
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 0de9d5d2b9ae..5bab6c3f7a2f 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1455,7 +1455,7 @@ static void udp_v4_rehash(struct sock *sk)
         udp_lib_rehash(sk, new_hash);
 }
 
-static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
 
diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h
index 7e0fe4bdd967..feb50a16398d 100644
--- a/net/ipv4/udp_impl.h
+++ b/net/ipv4/udp_impl.h
@@ -25,7 +25,7 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                 int flags, int *addr_len);
 int udp_sendpage(struct sock *sk, struct page *page, int offset, size_t size,
                  int flags);
-int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
+int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 void udp_destroy_sock(struct sock *sk);
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index af817158d830..ff450c2aad9b 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -50,7 +50,7 @@ struct proto 	udplite_prot = {
         .sendmsg           = udp_sendmsg,
         .recvmsg           = udp_recvmsg,
         .sendpage          = udp_sendpage,
-        .backlog_rcv       = udp_queue_rcv_skb,
+        .backlog_rcv       = __udp_queue_rcv_skb,
         .hash              = udp_lib_hash,
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v4_get_port,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 060dd9922018..4bc5ba3ae452 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -183,7 +183,7 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
 
 static void addrconf_dad_start(struct inet6_ifaddr *ifp);
 static void addrconf_dad_work(struct work_struct *w);
-static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
+static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id);
 static void addrconf_dad_run(struct inet6_dev *idev);
 static void addrconf_rs_timer(unsigned long data);
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
@@ -2898,6 +2898,7 @@ static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
                 spin_lock_bh(&ifp->lock);
                 ifp->flags &= ~IFA_F_TENTATIVE;
                 spin_unlock_bh(&ifp->lock);
+                rt_genid_bump_ipv6(dev_net(idev->dev));
                 ipv6_ifa_notify(RTM_NEWADDR, ifp);
                 in6_ifa_put(ifp);
         }
@@ -3740,7 +3741,7 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
 {
         struct inet6_dev *idev = ifp->idev;
         struct net_device *dev = idev->dev;
-        bool notify = false;
+        bool bump_id, notify = false;
 
         addrconf_join_solict(dev, &ifp->addr);
 
@@ -3755,11 +3756,12 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
             idev->cnf.accept_dad < 1 ||
             !(ifp->flags&IFA_F_TENTATIVE) ||
             ifp->flags & IFA_F_NODAD) {
+                bump_id = ifp->flags & IFA_F_TENTATIVE;
                 ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
                 spin_unlock(&ifp->lock);
                 read_unlock_bh(&idev->lock);
 
-                addrconf_dad_completed(ifp);
+                addrconf_dad_completed(ifp, bump_id);
                 return;
         }
 
@@ -3819,8 +3821,8 @@ static void addrconf_dad_work(struct work_struct *w)
                                                 struct inet6_ifaddr,
                                                 dad_work);
         struct inet6_dev *idev = ifp->idev;
+        bool bump_id, disable_ipv6 = false;
         struct in6_addr mcaddr;
-        bool disable_ipv6 = false;
 
         enum {
                 DAD_PROCESS,
@@ -3890,11 +3892,12 @@ static void addrconf_dad_work(struct work_struct *w)
                  * DAD was successful
                  */
 
+                bump_id = ifp->flags & IFA_F_TENTATIVE;
                 ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
                 spin_unlock(&ifp->lock);
                 write_unlock_bh(&idev->lock);
 
-                addrconf_dad_completed(ifp);
+                addrconf_dad_completed(ifp, bump_id);
 
                 goto out;
         }
@@ -3931,7 +3934,7 @@ static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp)
         return true;
 }
 
-static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
+static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id)
 {
         struct net_device *dev = ifp->idev->dev;
         struct in6_addr lladdr;
@@ -3983,6 +3986,9 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
                 spin_unlock(&ifp->lock);
                 write_unlock_bh(&ifp->idev->lock);
         }
+
+        if (bump_id)
+                rt_genid_bump_ipv6(dev_net(dev));
 }
 
 static void addrconf_dad_run(struct inet6_dev *idev)
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 37874e2f30ed..ccf40550c475 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -139,7 +139,8 @@ void ip6_datagram_release_cb(struct sock *sk)
 }
 EXPORT_SYMBOL_GPL(ip6_datagram_release_cb);
 
-static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr,
+                           int addr_len)
 {
         struct sockaddr_in6     *usin = (struct sockaddr_in6 *) uaddr;
         struct inet_sock        *inet = inet_sk(sk);
@@ -252,6 +253,7 @@ ipv4_connected:
 out:
         return err;
 }
+EXPORT_SYMBOL_GPL(__ip6_datagram_connect);
 
 int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 060a60b2f8a6..111ba55fd512 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -418,7 +418,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
                 esph = (void *)skb_push(skb, 4);
                 *seqhi = esph->spi;
                 esph->spi = esph->seq_no;
-                esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.input.hi);
+                esph->seq_no = XFRM_SKB_CB(skb)->seq.input.hi;
                 aead_request_set_callback(req, 0, esp_input_done_esn, skb);
         }
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 7370ad2e693a..2772004ba5a1 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -447,8 +447,10 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
 
         if (__ipv6_addr_needs_scope_id(addr_type))
                 iif = skb->dev->ifindex;
-        else
-                iif = l3mdev_master_ifindex(skb_dst(skb)->dev);
+        else {
+                dst = skb_dst(skb);
+                iif = l3mdev_master_ifindex(dst ? dst->dev : skb->dev);
+        }
 
         /*
          *      Must not send error if the source does not uniquely
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 1fcf61f1cbc3..89c59e656f44 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -99,7 +99,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                 segs = ops->callbacks.gso_segment(skb, features);
         }
 
-        if (IS_ERR(segs))
+        if (IS_ERR_OR_NULL(segs))
                 goto out;
 
         gso_partial = !!(skb_shinfo(segs)->gso_type & SKB_GSO_PARTIAL);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 0a4759b89da2..d76674efe523 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1181,7 +1181,6 @@ route_lookup:
         if (err)
                 return err;
 
-        skb->protocol = htons(ETH_P_IPV6);
         skb_push(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         ipv6h = ipv6_hdr(skb);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 8a02ca8a11af..c299c1e2bbf0 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -1138,6 +1138,33 @@ static struct xfrm6_protocol vti_ipcomp6_protocol __read_mostly = {
         .priority       =       100,
 };
 
+static bool is_vti6_tunnel(const struct net_device *dev)
+{
+        return dev->netdev_ops == &vti6_netdev_ops;
+}
+
+static int vti6_device_event(struct notifier_block *unused,
+                             unsigned long event, void *ptr)
+{
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct ip6_tnl *t = netdev_priv(dev);
+
+        if (!is_vti6_tunnel(dev))
+                return NOTIFY_DONE;
+
+        switch (event) {
+        case NETDEV_DOWN:
+                if (!net_eq(t->net, dev_net(dev)))
+                        xfrm_garbage_collect(t->net);
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block vti6_notifier_block __read_mostly = {
+        .notifier_call = vti6_device_event,
+};
+
 /**
  * vti6_tunnel_init - register protocol and reserve needed resources
  *
@@ -1148,6 +1175,8 @@ static int __init vti6_tunnel_init(void)
         const char *msg;
         int err;
 
+        register_netdevice_notifier(&vti6_notifier_block);
+
         msg = "tunnel device";
         err = register_pernet_device(&vti6_net_ops);
         if (err < 0)
@@ -1180,6 +1209,7 @@ xfrm_proto_ah_failed:
 xfrm_proto_esp_failed:
         unregister_pernet_device(&vti6_net_ops);
 pernet_dev_failed:
+        unregister_netdevice_notifier(&vti6_notifier_block);
         pr_err("vti6 init: failed to register %s\n", msg);
         return err;
 }
@@ -1194,6 +1224,7 @@ static void __exit vti6_tunnel_cleanup(void)
         xfrm6_protocol_deregister(&vti_ah6_protocol, IPPROTO_AH);
         xfrm6_protocol_deregister(&vti_esp6_protocol, IPPROTO_ESP);
         unregister_pernet_device(&vti6_net_ops);
+        unregister_netdevice_notifier(&vti6_notifier_block);
 }
 
 module_init(vti6_tunnel_init);
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index e4347aeb2e65..9948b5ce52da 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -576,11 +576,11 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
         /* Jumbo payload inhibits frag. header */
         if (ipv6_hdr(skb)->payload_len == 0) {
                 pr_debug("payload len = 0\n");
-                return -EINVAL;
+                return 0;
         }
 
         if (find_prev_fhdr(skb, &prevhdr, &nhoff, &fhoff) < 0)
-                return -EINVAL;
+                return 0;
 
         if (!pskb_may_pull(skb, fhoff + sizeof(*fhdr)))
                 return -ENOMEM;
diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
index f7aab5ab93a5..f06b0471f39f 100644
--- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
+++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
@@ -69,7 +69,7 @@ static unsigned int ipv6_defrag(void *priv,
         if (err == -EINPROGRESS)
                 return NF_STOLEN;
 
-        return NF_ACCEPT;
+        return err == 0 ? NF_ACCEPT : NF_DROP;
 }
 
 static struct nf_hook_ops ipv6_defrag_ops[] = {
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index a5400223fd74..10090400c72f 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -156,6 +156,7 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
         fl6.daddr = oip6h->saddr;
         fl6.fl6_sport = otcph->dest;
         fl6.fl6_dport = otcph->source;
+        fl6.flowi6_oif = l3mdev_master_ifindex(skb_dst(oldskb)->dev);
         security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6));
         dst = ip6_route_output(net, NULL, &fl6);
         if (dst->error) {
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 7cca8ac66fe9..cd4252346a32 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -155,6 +155,8 @@ int __ip6_local_out(struct net *net, struct sock *sk, struct sk_buff *skb)
         if (unlikely(!skb))
                 return 0;
 
+        skb->protocol = htons(ETH_P_IPV6);
+
         return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
                        net, sk, skb, NULL, skb_dst(skb)->dev,
                        dst_output);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index e5056d4873d1..e4a8000d59ad 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -514,7 +514,7 @@ out:
         return;
 }
 
-static int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
 
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index f6eb1ab34f4b..e78bdc76dcc3 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -26,7 +26,7 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
 int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len);
 int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                   int flags, int *addr_len);
-int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
+int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 void udpv6_destroy_sock(struct sock *sk);
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 47d0d2b87106..2f5101a12283 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -45,7 +45,7 @@ struct proto udplitev6_prot = {
         .getsockopt        = udpv6_getsockopt,
         .sendmsg           = udpv6_sendmsg,
         .recvmsg           = udpv6_recvmsg,
-        .backlog_rcv       = udpv6_queue_rcv_skb,
+        .backlog_rcv       = __udpv6_queue_rcv_skb,
         .hash              = udp_lib_hash,
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v6_get_port,
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 3dc97b4f982b..965f7e344cef 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -97,7 +97,7 @@ static int l2tp_eth_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         unsigned int len = skb->len;
         int ret = l2tp_xmit_skb(session, skb, session->hdr_len);
 
-        if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
+        if (likely(ret == NET_XMIT_SUCCESS)) {
                 atomic_long_add(len, &priv->tx_bytes);
                 atomic_long_inc(&priv->tx_packets);
         } else {
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 982f6c44ea01..8938b6ba57a0 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -61,7 +61,8 @@ static struct sock *__l2tp_ip_bind_lookup(struct net *net, __be32 laddr, int dif
                 if ((l2tp->conn_id == tunnel_id) &&
                     net_eq(sock_net(sk), net) &&
                     !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
-                    !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
+                    (!sk->sk_bound_dev_if || !dif ||
+                     sk->sk_bound_dev_if == dif))
                         goto found;
         }
 
@@ -182,15 +183,17 @@ pass_up:
                 struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
 
                 read_lock_bh(&l2tp_ip_lock);
-                sk = __l2tp_ip_bind_lookup(net, iph->daddr, 0, tunnel_id);
+                sk = __l2tp_ip_bind_lookup(net, iph->daddr, inet_iif(skb),
+                                           tunnel_id);
+                if (!sk) {
+                        read_unlock_bh(&l2tp_ip_lock);
+                        goto discard;
+                }
+
+                sock_hold(sk);
                 read_unlock_bh(&l2tp_ip_lock);
         }
 
-        if (sk == NULL)
-                goto discard;
-
-        sock_hold(sk);
-
         if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_put;
 
@@ -256,15 +259,9 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr->l2tp_family != AF_INET)
                 return -EINVAL;
 
-        ret = -EADDRINUSE;
-        read_lock_bh(&l2tp_ip_lock);
-        if (__l2tp_ip_bind_lookup(net, addr->l2tp_addr.s_addr,
-                                  sk->sk_bound_dev_if, addr->l2tp_conn_id))
-                goto out_in_use;
-
-        read_unlock_bh(&l2tp_ip_lock);
-
         lock_sock(sk);
+
+        ret = -EINVAL;
         if (!sock_flag(sk, SOCK_ZAPPED))
                 goto out;
 
@@ -281,14 +278,22 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 inet->inet_rcv_saddr = inet->inet_saddr = addr->l2tp_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
                 inet->inet_saddr = 0;  /* Use device */
-        sk_dst_reset(sk);
 
+        write_lock_bh(&l2tp_ip_lock);
+        if (__l2tp_ip_bind_lookup(net, addr->l2tp_addr.s_addr,
+                                  sk->sk_bound_dev_if, addr->l2tp_conn_id)) {
+                write_unlock_bh(&l2tp_ip_lock);
+                ret = -EADDRINUSE;
+                goto out;
+        }
+
+        sk_dst_reset(sk);
         l2tp_ip_sk(sk)->conn_id = addr->l2tp_conn_id;
 
-        write_lock_bh(&l2tp_ip_lock);
         sk_add_bind_node(sk, &l2tp_ip_bind_table);
         sk_del_node_init(sk);
         write_unlock_bh(&l2tp_ip_lock);
+
         ret = 0;
         sock_reset_flag(sk, SOCK_ZAPPED);
 
@@ -296,11 +301,6 @@ out:
         release_sock(sk);
 
         return ret;
-
-out_in_use:
-        read_unlock_bh(&l2tp_ip_lock);
-
-        return ret;
 }
 
 static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
@@ -308,21 +308,24 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
         struct sockaddr_l2tpip *lsa = (struct sockaddr_l2tpip *) uaddr;
         int rc;
 
-        if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
-                return -EINVAL;
-
         if (addr_len < sizeof(*lsa))
                 return -EINVAL;
 
         if (ipv4_is_multicast(lsa->l2tp_addr.s_addr))
                 return -EINVAL;
 
-        rc = ip4_datagram_connect(sk, uaddr, addr_len);
-        if (rc < 0)
-                return rc;
-
         lock_sock(sk);
 
+        /* Must bind first - autobinding does not work */
+        if (sock_flag(sk, SOCK_ZAPPED)) {
+                rc = -EINVAL;
+                goto out_sk;
+        }
+
+        rc = __ip4_datagram_connect(sk, uaddr, addr_len);
+        if (rc < 0)
+                goto out_sk;
+
         l2tp_ip_sk(sk)->peer_conn_id = lsa->l2tp_conn_id;
 
         write_lock_bh(&l2tp_ip_lock);
@@ -330,7 +333,9 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
         sk_add_bind_node(sk, &l2tp_ip_bind_table);
         write_unlock_bh(&l2tp_ip_lock);
 
+out_sk:
         release_sock(sk);
+
         return rc;
 }
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 9978d01ba0ba..aa821cb639e5 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -72,8 +72,9 @@ static struct sock *__l2tp_ip6_bind_lookup(struct net *net,
 
                 if ((l2tp->conn_id == tunnel_id) &&
                     net_eq(sock_net(sk), net) &&
-                    !(addr && ipv6_addr_equal(addr, laddr)) &&
-                    !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
+                    (!addr || ipv6_addr_equal(addr, laddr)) &&
+                    (!sk->sk_bound_dev_if || !dif ||
+                     sk->sk_bound_dev_if == dif))
                         goto found;
         }
 
@@ -196,16 +197,17 @@ pass_up:
                 struct ipv6hdr *iph = ipv6_hdr(skb);
 
                 read_lock_bh(&l2tp_ip6_lock);
-                sk = __l2tp_ip6_bind_lookup(net, &iph->daddr,
-                                            0, tunnel_id);
+                sk = __l2tp_ip6_bind_lookup(net, &iph->daddr, inet6_iif(skb),
+                                            tunnel_id);
+                if (!sk) {
+                        read_unlock_bh(&l2tp_ip6_lock);
+                        goto discard;
+                }
+
+                sock_hold(sk);
                 read_unlock_bh(&l2tp_ip6_lock);
         }
 
-        if (sk == NULL)
-                goto discard;
-
-        sock_hold(sk);
-
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_put;
 
@@ -266,6 +268,7 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         struct sockaddr_l2tpip6 *addr = (struct sockaddr_l2tpip6 *) uaddr;
         struct net *net = sock_net(sk);
         __be32 v4addr = 0;
+        int bound_dev_if;
         int addr_type;
         int err;
 
@@ -284,13 +287,6 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr_type & IPV6_ADDR_MULTICAST)
                 return -EADDRNOTAVAIL;
 
-        err = -EADDRINUSE;
-        read_lock_bh(&l2tp_ip6_lock);
-        if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr,
-                                   sk->sk_bound_dev_if, addr->l2tp_conn_id))
-                goto out_in_use;
-        read_unlock_bh(&l2tp_ip6_lock);
-
         lock_sock(sk);
 
         err = -EINVAL;
@@ -300,28 +296,25 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (sk->sk_state != TCP_CLOSE)
                 goto out_unlock;
 
+        bound_dev_if = sk->sk_bound_dev_if;
+
         /* Check if the address belongs to the host. */
         rcu_read_lock();
         if (addr_type != IPV6_ADDR_ANY) {
                 struct net_device *dev = NULL;
 
                 if (addr_type & IPV6_ADDR_LINKLOCAL) {
-                        if (addr_len >= sizeof(struct sockaddr_in6) &&
-                            addr->l2tp_scope_id) {
-                                /* Override any existing binding, if another
-                                 * one is supplied by user.
-                                 */
-                                sk->sk_bound_dev_if = addr->l2tp_scope_id;
-                        }
+                        if (addr->l2tp_scope_id)
+                                bound_dev_if = addr->l2tp_scope_id;
 
                         /* Binding to link-local address requires an
-                           interface */
-                        if (!sk->sk_bound_dev_if)
+                         * interface.
+                         */
+                        if (!bound_dev_if)
                                 goto out_unlock_rcu;
 
                         err = -ENODEV;
-                        dev = dev_get_by_index_rcu(sock_net(sk),
-                                                   sk->sk_bound_dev_if);
+                        dev = dev_get_by_index_rcu(sock_net(sk), bound_dev_if);
                         if (!dev)
                                 goto out_unlock_rcu;
                 }
@@ -336,13 +329,22 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         }
         rcu_read_unlock();
 
-        inet->inet_rcv_saddr = inet->inet_saddr = v4addr;
+        write_lock_bh(&l2tp_ip6_lock);
+        if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr, bound_dev_if,
+                                   addr->l2tp_conn_id)) {
+                write_unlock_bh(&l2tp_ip6_lock);
+                err = -EADDRINUSE;
+                goto out_unlock;
+        }
+
+        inet->inet_saddr = v4addr;
+        inet->inet_rcv_saddr = v4addr;
+        sk->sk_bound_dev_if = bound_dev_if;
         sk->sk_v6_rcv_saddr = addr->l2tp_addr;
         np->saddr = addr->l2tp_addr;
 
         l2tp_ip6_sk(sk)->conn_id = addr->l2tp_conn_id;
 
-        write_lock_bh(&l2tp_ip6_lock);
         sk_add_bind_node(sk, &l2tp_ip6_bind_table);
         sk_del_node_init(sk);
         write_unlock_bh(&l2tp_ip6_lock);
@@ -355,10 +357,7 @@ out_unlock_rcu:
         rcu_read_unlock();
 out_unlock:
         release_sock(sk);
-        return err;
 
-out_in_use:
-        read_unlock_bh(&l2tp_ip6_lock);
         return err;
 }
 
@@ -371,9 +370,6 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
         int     addr_type;
         int rc;
 
-        if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
-                return -EINVAL;
-
         if (addr_len < sizeof(*lsa))
                 return -EINVAL;
 
@@ -390,10 +386,18 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
                         return -EINVAL;
         }
 
-        rc = ip6_datagram_connect(sk, uaddr, addr_len);
-
         lock_sock(sk);
 
+         /* Must bind first - autobinding does not work */
+        if (sock_flag(sk, SOCK_ZAPPED)) {
+                rc = -EINVAL;
+                goto out_sk;
+        }
+
+        rc = __ip6_datagram_connect(sk, uaddr, addr_len);
+        if (rc < 0)
+                goto out_sk;
+
         l2tp_ip6_sk(sk)->peer_conn_id = lsa->l2tp_conn_id;
 
         write_lock_bh(&l2tp_ip6_lock);
@@ -401,6 +405,7 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
         sk_add_bind_node(sk, &l2tp_ip6_bind_table);
         write_unlock_bh(&l2tp_ip6_lock);
 
+out_sk:
         release_sock(sk);
 
         return rc;
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 0e4334cbde17..15fe97644ffe 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1252,7 +1252,7 @@ static int rtm_to_route_config(struct sk_buff *skb,  struct nlmsghdr *nlh,
                 if (!nla)
                         continue;
 
-                switch(index) {
+                switch (index) {
                 case RTA_OIF:
                         cfg->rc_ifindex = nla_get_u32(nla);
                         break;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index bbb8f3df79f7..5b9c884a452e 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -42,7 +42,7 @@ struct nf_nat_conn_key {
         const struct nf_conntrack_zone *zone;
 };
 
-static struct rhashtable nf_nat_bysource_table;
+static struct rhltable nf_nat_bysource_table;
 
 inline const struct nf_nat_l3proto *
 __nf_nat_l3proto_find(u8 family)
@@ -193,9 +193,12 @@ static int nf_nat_bysource_cmp(struct rhashtable_compare_arg *arg,
         const struct nf_nat_conn_key *key = arg->key;
         const struct nf_conn *ct = obj;
 
-        return same_src(ct, key->tuple) &&
-               net_eq(nf_ct_net(ct), key->net) &&
-               nf_ct_zone_equal(ct, key->zone, IP_CT_DIR_ORIGINAL);
+        if (!same_src(ct, key->tuple) ||
+            !net_eq(nf_ct_net(ct), key->net) ||
+            !nf_ct_zone_equal(ct, key->zone, IP_CT_DIR_ORIGINAL))
+                return 1;
+
+        return 0;
 }
 
 static struct rhashtable_params nf_nat_bysource_params = {
@@ -204,7 +207,6 @@ static struct rhashtable_params nf_nat_bysource_params = {
         .obj_cmpfn = nf_nat_bysource_cmp,
         .nelem_hint = 256,
         .min_size = 1024,
-        .nulls_base = (1U << RHT_BASE_SHIFT),
 };
 
 /* Only called for SRC manip */
@@ -223,12 +225,15 @@ find_appropriate_src(struct net *net,
                 .tuple = tuple,
                 .zone = zone
         };
+        struct rhlist_head *hl;
 
-        ct = rhashtable_lookup_fast(&nf_nat_bysource_table, &key,
-                                    nf_nat_bysource_params);
-        if (!ct)
+        hl = rhltable_lookup(&nf_nat_bysource_table, &key,
+                             nf_nat_bysource_params);
+        if (!hl)
                 return 0;
 
+        ct = container_of(hl, typeof(*ct), nat_bysource);
+
         nf_ct_invert_tuplepr(result,
                              &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
         result->dst = tuple->dst;
@@ -446,11 +451,17 @@ nf_nat_setup_info(struct nf_conn *ct,
         }
 
         if (maniptype == NF_NAT_MANIP_SRC) {
+                struct nf_nat_conn_key key = {
+                        .net = nf_ct_net(ct),
+                        .tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                        .zone = nf_ct_zone(ct),
+                };
                 int err;
 
-                err = rhashtable_insert_fast(&nf_nat_bysource_table,
-                                             &ct->nat_bysource,
-                                             nf_nat_bysource_params);
+                err = rhltable_insert_key(&nf_nat_bysource_table,
+                                          &key,
+                                          &ct->nat_bysource,
+                                          nf_nat_bysource_params);
                 if (err)
                         return NF_DROP;
         }
@@ -567,8 +578,8 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
          * will delete entry from already-freed table.
          */
         ct->status &= ~IPS_NAT_DONE_MASK;
-        rhashtable_remove_fast(&nf_nat_bysource_table, &ct->nat_bysource,
-                               nf_nat_bysource_params);
+        rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
+                        nf_nat_bysource_params);
 
         /* don't delete conntrack.  Although that would make things a lot
          * simpler, we'd end up flushing all conntracks on nat rmmod.
@@ -698,8 +709,8 @@ static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
         if (!nat)
                 return;
 
-        rhashtable_remove_fast(&nf_nat_bysource_table, &ct->nat_bysource,
-                               nf_nat_bysource_params);
+        rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
+                        nf_nat_bysource_params);
 }
 
 static struct nf_ct_ext_type nat_extend __read_mostly = {
@@ -834,13 +845,13 @@ static int __init nf_nat_init(void)
 {
         int ret;
 
-        ret = rhashtable_init(&nf_nat_bysource_table, &nf_nat_bysource_params);
+        ret = rhltable_init(&nf_nat_bysource_table, &nf_nat_bysource_params);
         if (ret)
                 return ret;
 
         ret = nf_ct_extend_register(&nat_extend);
         if (ret < 0) {
-                rhashtable_destroy(&nf_nat_bysource_table);
+                rhltable_destroy(&nf_nat_bysource_table);
                 printk(KERN_ERR "nf_nat_core: Unable to register extension\n");
                 return ret;
         }
@@ -864,7 +875,7 @@ static int __init nf_nat_init(void)
         return 0;
 
  cleanup_extend:
-        rhashtable_destroy(&nf_nat_bysource_table);
+        rhltable_destroy(&nf_nat_bysource_table);
         nf_ct_extend_unregister(&nat_extend);
         return ret;
 }
@@ -883,7 +894,7 @@ static void __exit nf_nat_cleanup(void)
         for (i = 0; i < NFPROTO_NUMPROTO; i++)
                 kfree(nf_nat_l4protos[i]);
 
-        rhashtable_destroy(&nf_nat_bysource_table);
+        rhltable_destroy(&nf_nat_bysource_table);
 }
 
 MODULE_LICENSE("GPL");
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 026581b04ea8..e5194f6f906c 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2570,7 +2570,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
         }
 
         if (set->timeout &&
-            nla_put_be64(skb, NFTA_SET_TIMEOUT, cpu_to_be64(set->timeout),
+            nla_put_be64(skb, NFTA_SET_TIMEOUT,
+                         cpu_to_be64(jiffies_to_msecs(set->timeout)),
                          NFTA_SET_PAD))
                 goto nla_put_failure;
         if (set->gc_int &&
@@ -2859,7 +2860,8 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
         if (nla[NFTA_SET_TIMEOUT] != NULL) {
                 if (!(flags & NFT_SET_TIMEOUT))
                         return -EINVAL;
-                timeout = be64_to_cpu(nla_get_be64(nla[NFTA_SET_TIMEOUT]));
+                timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
+                                                nla[NFTA_SET_TIMEOUT])));
         }
         gc_int = 0;
         if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
@@ -3178,7 +3180,8 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
 
         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
             nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
-                         cpu_to_be64(*nft_set_ext_timeout(ext)),
+                         cpu_to_be64(jiffies_to_msecs(
+                                                *nft_set_ext_timeout(ext))),
                          NFTA_SET_ELEM_PAD))
                 goto nla_put_failure;
 
@@ -3447,7 +3450,7 @@ void *nft_set_elem_init(const struct nft_set *set,
                 memcpy(nft_set_ext_data(ext), data, set->dlen);
         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
                 *nft_set_ext_expiration(ext) =
-                        jiffies + msecs_to_jiffies(timeout);
+                        jiffies + timeout;
         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
                 *nft_set_ext_timeout(ext) = timeout;
 
@@ -3535,7 +3538,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
         if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
                 if (!(set->flags & NFT_SET_TIMEOUT))
                         return -EINVAL;
-                timeout = be64_to_cpu(nla_get_be64(nla[NFTA_SET_ELEM_TIMEOUT]));
+                timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
+                                        nla[NFTA_SET_ELEM_TIMEOUT])));
         } else if (set->flags & NFT_SET_TIMEOUT) {
                 timeout = set->timeout;
         }
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index baf694de3935..d5447a22275c 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -53,6 +53,7 @@ static int nft_hash_init(const struct nft_ctx *ctx,
 {
         struct nft_hash *priv = nft_expr_priv(expr);
         u32 len;
+        int err;
 
         if (!tb[NFTA_HASH_SREG] ||
             !tb[NFTA_HASH_DREG] ||
@@ -67,8 +68,10 @@ static int nft_hash_init(const struct nft_ctx *ctx,
         priv->sreg = nft_parse_register(tb[NFTA_HASH_SREG]);
         priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
 
-        len = ntohl(nla_get_be32(tb[NFTA_HASH_LEN]));
-        if (len == 0 || len > U8_MAX)
+        err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len);
+        if (err < 0)
+                return err;
+        if (len == 0)
                 return -ERANGE;
 
         priv->len = len;
diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
index fbc88009ca2e..8f0aaaea1376 100644
--- a/net/netfilter/nft_range.c
+++ b/net/netfilter/nft_range.c
@@ -59,6 +59,12 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr
         int err;
         u32 op;
 
+        if (!tb[NFTA_RANGE_SREG]      ||
+            !tb[NFTA_RANGE_OP]        ||
+            !tb[NFTA_RANGE_FROM_DATA] ||
+            !tb[NFTA_RANGE_TO_DATA])
+                return -EINVAL;
+
         err = nft_data_init(NULL, &priv->data_from, sizeof(priv->data_from),
                             &desc_from, tb[NFTA_RANGE_FROM_DATA]);
         if (err < 0)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 62bea4591054..246f29d365c0 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -329,7 +329,6 @@ static void netlink_sock_destruct(struct sock *sk)
         if (nlk->cb_running) {
                 if (nlk->cb.done)
                         nlk->cb.done(&nlk->cb);
-
                 module_put(nlk->cb.module);
                 kfree_skb(nlk->cb.skb);
         }
@@ -346,6 +345,14 @@ static void netlink_sock_destruct(struct sock *sk)
         WARN_ON(nlk_sk(sk)->groups);
 }
 
+static void netlink_sock_destruct_work(struct work_struct *work)
+{
+        struct netlink_sock *nlk = container_of(work, struct netlink_sock,
+                                                work);
+
+        sk_free(&nlk->sk);
+}
+
 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
  * SMP. Look, when several writers sleep and reader wakes them up, all but one
  * immediately hit write lock and grab all the cpus. Exclusive sleep solves
@@ -648,8 +655,18 @@ out_module:
 static void deferred_put_nlk_sk(struct rcu_head *head)
 {
         struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);
+        struct sock *sk = &nlk->sk;
+
+        if (!atomic_dec_and_test(&sk->sk_refcnt))
+                return;
+
+        if (nlk->cb_running && nlk->cb.done) {
+                INIT_WORK(&nlk->work, netlink_sock_destruct_work);
+                schedule_work(&nlk->work);
+                return;
+        }
 
-        sock_put(&nlk->sk);
+        sk_free(sk);
 }
 
 static int netlink_release(struct socket *sock)
diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
index 3cfd6cc60504..4fdb38318977 100644
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -3,6 +3,7 @@
 
 #include <linux/rhashtable.h>
 #include <linux/atomic.h>
+#include <linux/workqueue.h>
 #include <net/sock.h>
 
 #define NLGRPSZ(x)      (ALIGN(x, sizeof(unsigned long) * 8) / 8)
@@ -33,6 +34,7 @@ struct netlink_sock {
 
         struct rhash_head       node;
         struct rcu_head         rcu;
+        struct work_struct      work;
 };
 
 static inline struct netlink_sock *nlk_sk(struct sock *sk)
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 31045ef44a82..fecefa2dc94e 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -370,8 +370,11 @@ static int handle_fragments(struct net *net, struct sw_flow_key *key,
                 skb_orphan(skb);
                 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
                 err = nf_ct_frag6_gather(net, skb, user);
-                if (err)
+                if (err) {
+                        if (err != -EINPROGRESS)
+                                kfree_skb(skb);
                         return err;
+                }
 
                 key->ip.proto = ipv6_hdr(skb)->nexthdr;
                 ovs_cb.mru = IP6CB(skb)->frag_max_size;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d2238b204691..dd2332390c45 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (optlen != sizeof(val))
                         return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
                 switch (val) {
                 case TPACKET_V1:
                 case TPACKET_V2:
                 case TPACKET_V3:
-                        po->tp_version = val;
-                        return 0;
+                        break;
                 default:
                         return -EINVAL;
                 }
+                lock_sock(sk);
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->tp_version = val;
+                        ret = 0;
+                }
+                release_sock(sk);
+                return ret;
         }
         case PACKET_RESERVE:
         {
@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
         /* Added to avoid minimal code churn */
         struct tpacket_req *req = &req_u->req;
 
+        lock_sock(sk);
         /* Opening a Tx-ring is NOT supported in TPACKET_V3 */
         if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
                 net_warn_ratelimited("Tx-ring is not supported.\n");
@@ -4245,7 +4252,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                         goto out;
         }
 
-        lock_sock(sk);
 
         /* Detach socket from network */
         spin_lock(&po->bind_lock);
@@ -4294,11 +4300,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 if (!tx_ring)
                         prb_shutdown_retire_blk_timer(po, rb_queue);
         }
-        release_sock(sk);
 
         if (pg_vec)
                 free_pg_vec(pg_vec, order, req->tp_block_nr);
 out:
+        release_sock(sk);
         return err;
 }
 
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index fcddacc92e01..20e2923dc827 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -659,6 +659,8 @@ out_recv:
 out_pernet:
         unregister_pernet_subsys(&rds_tcp_net_ops);
 out_slab:
+        if (unregister_netdevice_notifier(&rds_tcp_dev_notifier))
+                pr_warn("could not unregister rds_tcp_dev_notifier\n");
         kmem_cache_destroy(rds_tcp_conn_slab);
 out:
         return ret;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index b54d56d4959b..cf9b2fe8eac6 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -108,6 +108,17 @@ static void tcf_pedit_cleanup(struct tc_action *a, int bind)
         kfree(keys);
 }
 
+static bool offset_valid(struct sk_buff *skb, int offset)
+{
+        if (offset > 0 && offset > skb->len)
+                return false;
+
+        if  (offset < 0 && -offset > skb_headroom(skb))
+                return false;
+
+        return true;
+}
+
 static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
                      struct tcf_result *res)
 {
@@ -134,6 +145,11 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
                         if (tkey->offmask) {
                                 char *d, _d;
 
+                                if (!offset_valid(skb, off + tkey->at)) {
+                                        pr_info("tc filter pedit 'at' offset %d out of bounds\n",
+                                                off + tkey->at);
+                                        goto bad;
+                                }
                                 d = skb_header_pointer(skb, off + tkey->at, 1,
                                                        &_d);
                                 if (!d)
@@ -146,10 +162,10 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
                                         " offset must be on 32 bit boundaries\n");
                                 goto bad;
                         }
-                        if (offset > 0 && offset > skb->len) {
-                                pr_info("tc filter pedit"
-                                        " offset %d can't exceed pkt length %d\n",
-                                       offset, skb->len);
+
+                        if (!offset_valid(skb, off + offset)) {
+                                pr_info("tc filter pedit offset %d out of bounds\n",
+                                        offset);
                                 goto bad;
                         }
 
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 8e93d4afe5ea..b05d4a2155b0 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -112,7 +112,7 @@ static void tfilter_notify_chain(struct net *net, struct sk_buff *oskb,
 
         for (it_chain = chain; (tp = rtnl_dereference(*it_chain)) != NULL;
              it_chain = &tp->next)
-                tfilter_notify(net, oskb, n, tp, n->nlmsg_flags, event, false);
+                tfilter_notify(net, oskb, n, tp, 0, event, false);
 }
 
 /* Select new prio value from the range, managed by kernel. */
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index eb219b78cd49..5877f6061b57 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -62,9 +62,6 @@ static unsigned long basic_get(struct tcf_proto *tp, u32 handle)
         struct basic_head *head = rtnl_dereference(tp->root);
         struct basic_filter *f;
 
-        if (head == NULL)
-                return 0UL;
-
         list_for_each_entry(f, &head->flist, link) {
                 if (f->handle == handle) {
                         l = (unsigned long) f;
@@ -109,7 +106,6 @@ static bool basic_destroy(struct tcf_proto *tp, bool force)
                 tcf_unbind_filter(tp, &f->res);
                 call_rcu(&f->rcu, basic_delete_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index bb1d5a487081..0a47ba5e6109 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -292,7 +292,6 @@ static bool cls_bpf_destroy(struct tcf_proto *tp, bool force)
                 call_rcu(&prog->rcu, __cls_bpf_delete_prog);
         }
 
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
@@ -303,9 +302,6 @@ static unsigned long cls_bpf_get(struct tcf_proto *tp, u32 handle)
         struct cls_bpf_prog *prog;
         unsigned long ret = 0UL;
 
-        if (head == NULL)
-                return 0UL;
-
         list_for_each_entry(prog, &head->plist, link) {
                 if (prog->handle == handle) {
                         ret = (unsigned long) prog;
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 85233c470035..c1f20077837f 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -137,11 +137,10 @@ static bool cls_cgroup_destroy(struct tcf_proto *tp, bool force)
 
         if (!force)
                 return false;
-
-        if (head) {
-                RCU_INIT_POINTER(tp->root, NULL);
+        /* Head can still be NULL due to cls_cgroup_init(). */
+        if (head)
                 call_rcu(&head->rcu, cls_cgroup_destroy_rcu);
-        }
+
         return true;
 }
 
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index e39672394c7b..6575aba87630 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -596,7 +596,6 @@ static bool flow_destroy(struct tcf_proto *tp, bool force)
                 list_del_rcu(&f->list);
                 call_rcu(&f->rcu, flow_destroy_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index f6f40fba599b..904442421db3 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -13,6 +13,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/rhashtable.h>
+#include <linux/workqueue.h>
 
 #include <linux/if_ether.h>
 #include <linux/in6.h>
@@ -64,7 +65,10 @@ struct cls_fl_head {
         bool mask_assigned;
         struct list_head filters;
         struct rhashtable_params ht_params;
-        struct rcu_head rcu;
+        union {
+                struct work_struct work;
+                struct rcu_head rcu;
+        };
 };
 
 struct cls_fl_filter {
@@ -269,6 +273,24 @@ static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f)
         dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle, tp->protocol, &tc);
 }
 
+static void fl_destroy_sleepable(struct work_struct *work)
+{
+        struct cls_fl_head *head = container_of(work, struct cls_fl_head,
+                                                work);
+        if (head->mask_assigned)
+                rhashtable_destroy(&head->ht);
+        kfree(head);
+        module_put(THIS_MODULE);
+}
+
+static void fl_destroy_rcu(struct rcu_head *rcu)
+{
+        struct cls_fl_head *head = container_of(rcu, struct cls_fl_head, rcu);
+
+        INIT_WORK(&head->work, fl_destroy_sleepable);
+        schedule_work(&head->work);
+}
+
 static bool fl_destroy(struct tcf_proto *tp, bool force)
 {
         struct cls_fl_head *head = rtnl_dereference(tp->root);
@@ -282,10 +304,9 @@ static bool fl_destroy(struct tcf_proto *tp, bool force)
                 list_del_rcu(&f->list);
                 call_rcu(&f->rcu, fl_destroy_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
-        if (head->mask_assigned)
-                rhashtable_destroy(&head->ht);
-        kfree_rcu(head, rcu);
+
+        __module_get(THIS_MODULE);
+        call_rcu(&head->rcu, fl_destroy_rcu);
         return true;
 }
 
@@ -711,8 +732,9 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
                 goto errout;
 
         if (fold) {
-                rhashtable_remove_fast(&head->ht, &fold->ht_node,
-                                       head->ht_params);
+                if (!tc_skip_sw(fold->flags))
+                        rhashtable_remove_fast(&head->ht, &fold->ht_node,
+                                               head->ht_params);
                 fl_hw_destroy_filter(tp, (unsigned long)fold);
         }
 
@@ -739,8 +761,9 @@ static int fl_delete(struct tcf_proto *tp, unsigned long arg)
         struct cls_fl_head *head = rtnl_dereference(tp->root);
         struct cls_fl_filter *f = (struct cls_fl_filter *) arg;
 
-        rhashtable_remove_fast(&head->ht, &f->ht_node,
-                               head->ht_params);
+        if (!tc_skip_sw(f->flags))
+                rhashtable_remove_fast(&head->ht, &f->ht_node,
+                                       head->ht_params);
         list_del_rcu(&f->list);
         fl_hw_destroy_filter(tp, (unsigned long)f);
         tcf_unbind_filter(tp, &f->res);
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index 25927b6c4436..f935429bd5ef 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -114,7 +114,6 @@ static bool mall_destroy(struct tcf_proto *tp, bool force)
 
                 call_rcu(&f->rcu, mall_destroy_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 4f05a19fb073..322438fb3ffc 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -152,7 +152,8 @@ static int rsvp_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                 return -1;
         nhptr = ip_hdr(skb);
 #endif
-
+        if (unlikely(!head))
+                return -1;
 restart:
 
 #if RSVP_DST_LEN == 4
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 96144bdf30db..0751245a6ace 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -543,7 +543,6 @@ static bool tcindex_destroy(struct tcf_proto *tp, bool force)
         walker.fn = tcindex_destroy_element;
         tcindex_walk(tp, &walker);
 
-        RCU_INIT_POINTER(tp->root, NULL);
         call_rcu(&p->rcu, __tcindex_destroy);
         return true;
 }
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 975dbeb60ab0..52d74760fb68 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -421,6 +421,10 @@ int tipc_enable_l2_media(struct net *net, struct tipc_bearer *b,
         dev = dev_get_by_name(net, driver_name);
         if (!dev)
                 return -ENODEV;
+        if (tipc_mtu_bad(dev, 0)) {
+                dev_put(dev);
+                return -EINVAL;
+        }
 
         /* Associate TIPC bearer with L2 bearer */
         rcu_assign_pointer(b->media_ptr, dev);
@@ -610,8 +614,6 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
         if (!b)
                 return NOTIFY_DONE;
 
-        b->mtu = dev->mtu;
-
         switch (evt) {
         case NETDEV_CHANGE:
                 if (netif_carrier_ok(dev))
@@ -624,6 +626,11 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
                 tipc_reset_bearer(net, b);
                 break;
         case NETDEV_CHANGEMTU:
+                if (tipc_mtu_bad(dev, 0)) {
+                        bearer_disable(net, b);
+                        break;
+                }
+                b->mtu = dev->mtu;
                 tipc_reset_bearer(net, b);
                 break;
         case NETDEV_CHANGEADDR:
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 78892e2f53e3..278ff7f616f9 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -39,6 +39,7 @@
 
 #include "netlink.h"
 #include "core.h"
+#include "msg.h"
 #include <net/genetlink.h>
 
 #define MAX_MEDIA       3
@@ -59,6 +60,9 @@
 #define TIPC_MEDIA_TYPE_IB      2
 #define TIPC_MEDIA_TYPE_UDP     3
 
+/* minimum bearer MTU */
+#define TIPC_MIN_BEARER_MTU     (MAX_H_SIZE + INT_H_SIZE)
+
 /**
  * struct tipc_media_addr - destination address used by TIPC bearers
  * @value: address info (format defined by media)
@@ -215,4 +219,13 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
 void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
                          struct sk_buff_head *xmitq);
 
+/* check if device MTU is too low for tipc headers */
+static inline bool tipc_mtu_bad(struct net_device *dev, unsigned int reserve)
+{
+        if (dev->mtu >= TIPC_MIN_BEARER_MTU + reserve)
+                return false;
+        netdev_warn(dev, "MTU too low for tipc bearer\n");
+        return true;
+}
+
 #endif  /* _TIPC_BEARER_H */
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 1055164c6232..bda89bf9f4ff 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -47,8 +47,8 @@
 #include <linux/pkt_sched.h>
 
 struct tipc_stats {
-        u32 sent_info;          /* used in counting # sent packets */
-        u32 recv_info;          /* used in counting # recv'd packets */
+        u32 sent_pkts;
+        u32 recv_pkts;
         u32 sent_states;
         u32 recv_states;
         u32 sent_probes;
@@ -857,7 +857,6 @@ void tipc_link_reset(struct tipc_link *l)
         l->acked = 0;
         l->silent_intv_cnt = 0;
         l->rst_cnt = 0;
-        l->stats.recv_info = 0;
         l->stale_count = 0;
         l->bc_peer_is_up = false;
         memset(&l->mon_state, 0, sizeof(l->mon_state));
@@ -888,6 +887,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
         struct sk_buff_head *transmq = &l->transmq;
         struct sk_buff_head *backlogq = &l->backlogq;
         struct sk_buff *skb, *_skb, *bskb;
+        int pkt_cnt = skb_queue_len(list);
 
         /* Match msg importance against this and all higher backlog limits: */
         if (!skb_queue_empty(backlogq)) {
@@ -901,6 +901,11 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
                 return -EMSGSIZE;
         }
 
+        if (pkt_cnt > 1) {
+                l->stats.sent_fragmented++;
+                l->stats.sent_fragments += pkt_cnt;
+        }
+
         /* Prepare each packet for sending, and add to relevant queue: */
         while (skb_queue_len(list)) {
                 skb = skb_peek(list);
@@ -920,6 +925,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
                         __skb_queue_tail(xmitq, _skb);
                         TIPC_SKB_CB(skb)->ackers = l->ackers;
                         l->rcv_unacked = 0;
+                        l->stats.sent_pkts++;
                         seqno++;
                         continue;
                 }
@@ -968,6 +974,7 @@ void tipc_link_advance_backlog(struct tipc_link *l, struct sk_buff_head *xmitq)
                 msg_set_ack(hdr, ack);
                 msg_set_bcast_ack(hdr, bc_ack);
                 l->rcv_unacked = 0;
+                l->stats.sent_pkts++;
                 seqno++;
         }
         l->snd_nxt = seqno;
@@ -1260,7 +1267,7 @@ int tipc_link_rcv(struct tipc_link *l, struct sk_buff *skb,
 
                 /* Deliver packet */
                 l->rcv_nxt++;
-                l->stats.recv_info++;
+                l->stats.recv_pkts++;
                 if (!tipc_data_input(l, skb, l->inputq))
                         rc |= tipc_link_input(l, skb, l->inputq);
                 if (unlikely(++l->rcv_unacked >= TIPC_MIN_LINK_WIN))
@@ -1492,8 +1499,9 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
                 if (in_range(peers_tol, TIPC_MIN_LINK_TOL, TIPC_MAX_LINK_TOL))
                         l->tolerance = peers_tol;
 
-                if (peers_prio && in_range(peers_prio, TIPC_MIN_LINK_PRI,
-                                           TIPC_MAX_LINK_PRI)) {
+                /* Update own prio if peer indicates a different value */
+                if ((peers_prio != l->priority) &&
+                    in_range(peers_prio, 1, TIPC_MAX_LINK_PRI)) {
                         l->priority = peers_prio;
                         rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
                 }
@@ -1799,10 +1807,6 @@ void tipc_link_set_queue_limits(struct tipc_link *l, u32 win)
 void tipc_link_reset_stats(struct tipc_link *l)
 {
         memset(&l->stats, 0, sizeof(l->stats));
-        if (!link_is_bc_sndlink(l)) {
-                l->stats.sent_info = l->snd_nxt;
-                l->stats.recv_info = l->rcv_nxt;
-        }
 }
 
 static void link_print(struct tipc_link *l, const char *str)
@@ -1866,12 +1870,12 @@ static int __tipc_nl_add_stats(struct sk_buff *skb, struct tipc_stats *s)
         };
 
         struct nla_map map[] = {
-                {TIPC_NLA_STATS_RX_INFO, s->recv_info},
+                {TIPC_NLA_STATS_RX_INFO, 0},
                 {TIPC_NLA_STATS_RX_FRAGMENTS, s->recv_fragments},
                 {TIPC_NLA_STATS_RX_FRAGMENTED, s->recv_fragmented},
                 {TIPC_NLA_STATS_RX_BUNDLES, s->recv_bundles},
                 {TIPC_NLA_STATS_RX_BUNDLED, s->recv_bundled},
-                {TIPC_NLA_STATS_TX_INFO, s->sent_info},
+                {TIPC_NLA_STATS_TX_INFO, 0},
                 {TIPC_NLA_STATS_TX_FRAGMENTS, s->sent_fragments},
                 {TIPC_NLA_STATS_TX_FRAGMENTED, s->sent_fragmented},
                 {TIPC_NLA_STATS_TX_BUNDLES, s->sent_bundles},
@@ -1946,9 +1950,9 @@ int __tipc_nl_add_link(struct net *net, struct tipc_nl_msg *msg,
                 goto attr_msg_full;
         if (nla_put_u32(msg->skb, TIPC_NLA_LINK_MTU, link->mtu))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, link->rcv_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, link->stats.recv_pkts))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, link->snd_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, link->stats.sent_pkts))
                 goto attr_msg_full;
 
         if (tipc_link_is_up(link))
@@ -2003,12 +2007,12 @@ static int __tipc_nl_add_bc_link_stat(struct sk_buff *skb,
         };
 
         struct nla_map map[] = {
-                {TIPC_NLA_STATS_RX_INFO, stats->recv_info},
+                {TIPC_NLA_STATS_RX_INFO, stats->recv_pkts},
                 {TIPC_NLA_STATS_RX_FRAGMENTS, stats->recv_fragments},
                 {TIPC_NLA_STATS_RX_FRAGMENTED, stats->recv_fragmented},
                 {TIPC_NLA_STATS_RX_BUNDLES, stats->recv_bundles},
                 {TIPC_NLA_STATS_RX_BUNDLED, stats->recv_bundled},
-                {TIPC_NLA_STATS_TX_INFO, stats->sent_info},
+                {TIPC_NLA_STATS_TX_INFO, stats->sent_pkts},
                 {TIPC_NLA_STATS_TX_FRAGMENTS, stats->sent_fragments},
                 {TIPC_NLA_STATS_TX_FRAGMENTED, stats->sent_fragmented},
                 {TIPC_NLA_STATS_TX_BUNDLES, stats->sent_bundles},
@@ -2075,9 +2079,9 @@ int tipc_nl_add_bc_link(struct net *net, struct tipc_nl_msg *msg)
                 goto attr_msg_full;
         if (nla_put_string(msg->skb, TIPC_NLA_LINK_NAME, bcl->name))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, bcl->rcv_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, 0))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, bcl->snd_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, 0))
                 goto attr_msg_full;
 
         prop = nla_nest_start(msg->skb, TIPC_NLA_LINK_PROP);
diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
index ed97a5876ebe..9e109bb1a207 100644
--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -455,14 +455,14 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr,
         int i, applied_bef;
 
         state->probing = false;
-        if (!dlen)
-                return;
 
         /* Sanity check received domain record */
-        if ((dlen < new_dlen) || ntohs(arrv_dom->len) != new_dlen) {
-                pr_warn_ratelimited("Received illegal domain record\n");
+        if (dlen < dom_rec_len(arrv_dom, 0))
+                return;
+        if (dlen != dom_rec_len(arrv_dom, new_member_cnt))
+                return;
+        if ((dlen < new_dlen) || ntohs(arrv_dom->len) != new_dlen)
                 return;
-        }
 
         /* Synch generation numbers with peer if link just came up */
         if (!state->synched) {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index db32777ab591..41f013888f07 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -186,7 +186,7 @@ static struct tipc_sock *tipc_sk(const struct sock *sk)
 
 static bool tsk_conn_cong(struct tipc_sock *tsk)
 {
-        return tsk->snt_unacked >= tsk->snd_win;
+        return tsk->snt_unacked > tsk->snd_win;
 }
 
 /* tsk_blocks(): translate a buffer size in bytes to number of
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index 78cab9c5a445..b58dc95f3d35 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -697,6 +697,11 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
                 udp_conf.local_ip.s_addr = htonl(INADDR_ANY);
                 udp_conf.use_udp_checksums = false;
                 ub->ifindex = dev->ifindex;
+                if (tipc_mtu_bad(dev, sizeof(struct iphdr) +
+                                      sizeof(struct udphdr))) {
+                        err = -EINVAL;
+                        goto err;
+                }
                 b->mtu = dev->mtu - sizeof(struct iphdr)
                         - sizeof(struct udphdr);
 #if IS_ENABLED(CONFIG_IPV6)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index fd6986634e6f..5bf7e1bfeac7 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1268,12 +1268,14 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
                         err = security_xfrm_policy_lookup(pol->security,
                                                       fl->flowi_secid,
                                                       policy_to_flow_dir(dir));
-                        if (!err && !xfrm_pol_hold_rcu(pol))
-                                goto again;
-                        else if (err == -ESRCH)
+                        if (!err) {
+                                if (!xfrm_pol_hold_rcu(pol))
+                                        goto again;
+                        } else if (err == -ESRCH) {
                                 pol = NULL;
-                        else
+                        } else {
                                 pol = ERR_PTR(err);
+                        }
                 } else
                         pol = NULL;
         }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 08892091cfe3..671a1d0333f0 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2450,7 +2450,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 
 #ifdef CONFIG_COMPAT
         if (in_compat_syscall())
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 #endif
 
         type = nlh->nlmsg_type;
diff --git a/samples/bpf/bpf_helpers.h b/samples/bpf/bpf_helpers.h
index 90f44bd2045e..dadd5161bd91 100644
--- a/samples/bpf/bpf_helpers.h
+++ b/samples/bpf/bpf_helpers.h
@@ -113,7 +113,7 @@ static int (*bpf_skb_under_cgroup)(void *ctx, void *map, int index) =
 #define PT_REGS_FP(x) ((x)->gprs[11]) /* Works only with CONFIG_FRAME_POINTER */
 #define PT_REGS_RC(x) ((x)->gprs[2])
 #define PT_REGS_SP(x) ((x)->gprs[15])
-#define PT_REGS_IP(x) ((x)->ip)
+#define PT_REGS_IP(x) ((x)->psw.addr)
 
 #elif defined(__aarch64__)
 
diff --git a/samples/bpf/sampleip_kern.c b/samples/bpf/sampleip_kern.c
index 774a681f374a..ceabf31079cf 100644
--- a/samples/bpf/sampleip_kern.c
+++ b/samples/bpf/sampleip_kern.c
@@ -25,7 +25,7 @@ int do_sample(struct bpf_perf_event_data *ctx)
         u64 ip;
         u32 *value, init_val = 1;
 
-        ip = ctx->regs.ip;
+        ip = PT_REGS_IP(&ctx->regs);
         value = bpf_map_lookup_elem(&ip_map, &ip);
         if (value)
                 *value += 1;
diff --git a/samples/bpf/trace_event_kern.c b/samples/bpf/trace_event_kern.c
index 71a8ed32823e..41b6115a32eb 100644
--- a/samples/bpf/trace_event_kern.c
+++ b/samples/bpf/trace_event_kern.c
@@ -50,7 +50,7 @@ int bpf_prog1(struct bpf_perf_event_data *ctx)
         key.userstack = bpf_get_stackid(ctx, &stackmap, USER_STACKID_FLAGS);
         if ((int)key.kernstack < 0 && (int)key.userstack < 0) {
                 bpf_trace_printk(fmt, sizeof(fmt), cpu, ctx->sample_period,
-                                 ctx->regs.ip);
+                                 PT_REGS_IP(&ctx->regs));
                 return 0;
         }
 
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index ebced77deb9c..90a091b6ae4d 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -35,6 +35,8 @@ nconfig: $(obj)/nconf
 
 silentoldconfig: $(obj)/conf
         $(Q)mkdir -p include/config include/generated
+        $(Q)test -e include/generated/autoksyms.h || \
+            touch   include/generated/autoksyms.h
         $< $(silent) --$@ $(Kconfig)
 
 localyesconfig localmodconfig: $(obj)/streamline_config.pl $(obj)/conf
diff --git a/sound/sparc/dbri.c b/sound/sparc/dbri.c
index 0190cb6332f2..52063b262667 100644
--- a/sound/sparc/dbri.c
+++ b/sound/sparc/dbri.c
@@ -304,7 +304,7 @@ struct snd_dbri {
         spinlock_t lock;
 
         struct dbri_dma *dma;   /* Pointer to our DMA block */
-        u32 dma_dvma;           /* DBRI visible DMA address */
+        dma_addr_t dma_dvma;    /* DBRI visible DMA address */
 
         void __iomem *regs;     /* dbri HW regs */
         int dbri_irqp;          /* intr queue pointer */
@@ -657,12 +657,14 @@ static void dbri_cmdwait(struct snd_dbri *dbri)
  */
 static s32 *dbri_cmdlock(struct snd_dbri *dbri, int len)
 {
+        u32 dvma_addr = (u32)dbri->dma_dvma;
+
         /* Space for 2 WAIT cmds (replaced later by 1 JUMP cmd) */
         len += 2;
         spin_lock(&dbri->cmdlock);
         if (dbri->cmdptr - dbri->dma->cmd + len < DBRI_NO_CMDS - 2)
                 return dbri->cmdptr + 2;
-        else if (len < sbus_readl(dbri->regs + REG8) - dbri->dma_dvma)
+        else if (len < sbus_readl(dbri->regs + REG8) - dvma_addr)
                 return dbri->dma->cmd;
         else
                 printk(KERN_ERR "DBRI: no space for commands.");
@@ -680,6 +682,7 @@ static s32 *dbri_cmdlock(struct snd_dbri *dbri, int len)
  */
 static void dbri_cmdsend(struct snd_dbri *dbri, s32 *cmd, int len)
 {
+        u32 dvma_addr = (u32)dbri->dma_dvma;
         s32 tmp, addr;
         static int wait_id = 0;
 
@@ -689,7 +692,7 @@ static void dbri_cmdsend(struct snd_dbri *dbri, s32 *cmd, int len)
         *(cmd+1) = DBRI_CMD(D_WAIT, 1, wait_id);
 
         /* Replace the last command with JUMP */
-        addr = dbri->dma_dvma + (cmd - len - dbri->dma->cmd) * sizeof(s32);
+        addr = dvma_addr + (cmd - len - dbri->dma->cmd) * sizeof(s32);
         *(dbri->cmdptr+1) = addr;
         *(dbri->cmdptr) = DBRI_CMD(D_JUMP, 0, 0);
 
@@ -747,6 +750,7 @@ static void dbri_reset(struct snd_dbri *dbri)
 /* Lock must not be held before calling this */
 static void dbri_initialize(struct snd_dbri *dbri)
 {
+        u32 dvma_addr = (u32)dbri->dma_dvma;
         s32 *cmd;
         u32 dma_addr;
         unsigned long flags;
@@ -764,7 +768,7 @@ static void dbri_initialize(struct snd_dbri *dbri)
         /*
          * Initialize the interrupt ring buffer.
          */
-        dma_addr = dbri->dma_dvma + dbri_dma_off(intr, 0);
+        dma_addr = dvma_addr + dbri_dma_off(intr, 0);
         dbri->dma->intr[0] = dma_addr;
         dbri->dbri_irqp = 1;
         /*
@@ -778,7 +782,7 @@ static void dbri_initialize(struct snd_dbri *dbri)
         dbri->cmdptr = cmd;
         *(cmd++) = DBRI_CMD(D_WAIT, 1, 0);
         *(cmd++) = DBRI_CMD(D_WAIT, 1, 0);
-        dma_addr = dbri->dma_dvma + dbri_dma_off(cmd, 0);
+        dma_addr = dvma_addr + dbri_dma_off(cmd, 0);
         sbus_writel(dma_addr, dbri->regs + REG8);
         spin_unlock(&dbri->cmdlock);
 
@@ -1077,6 +1081,7 @@ static void recv_fixed(struct snd_dbri *dbri, int pipe, volatile __u32 *ptr)
 static int setup_descs(struct snd_dbri *dbri, int streamno, unsigned int period)
 {
         struct dbri_streaminfo *info = &dbri->stream_info[streamno];
+        u32 dvma_addr = (u32)dbri->dma_dvma;
         __u32 dvma_buffer;
         int desc;
         int len;
@@ -1177,7 +1182,7 @@ static int setup_descs(struct snd_dbri *dbri, int streamno, unsigned int period)
                 else {
                         dbri->next_desc[last_desc] = desc;
                         dbri->dma->desc[last_desc].nda =
-                            dbri->dma_dvma + dbri_dma_off(desc, desc);
+                            dvma_addr + dbri_dma_off(desc, desc);
                 }
 
                 last_desc = desc;
@@ -1192,7 +1197,7 @@ static int setup_descs(struct snd_dbri *dbri, int streamno, unsigned int period)
         }
 
         dbri->dma->desc[last_desc].nda =
-            dbri->dma_dvma + dbri_dma_off(desc, first_desc);
+            dvma_addr + dbri_dma_off(desc, first_desc);
         dbri->next_desc[last_desc] = first_desc;
         dbri->pipes[info->pipe].first_desc = first_desc;
         dbri->pipes[info->pipe].desc = first_desc;
@@ -1697,6 +1702,7 @@ interrupts are disabled.
 static void xmit_descs(struct snd_dbri *dbri)
 {
         struct dbri_streaminfo *info;
+        u32 dvma_addr;
         s32 *cmd;
         unsigned long flags;
         int first_td;
@@ -1704,6 +1710,7 @@ static void xmit_descs(struct snd_dbri *dbri)
         if (dbri == NULL)
                 return;         /* Disabled */
 
+        dvma_addr = (u32)dbri->dma_dvma;
         info = &dbri->stream_info[DBRI_REC];
         spin_lock_irqsave(&dbri->lock, flags);
 
@@ -1718,7 +1725,7 @@ static void xmit_descs(struct snd_dbri *dbri)
                         *(cmd++) = DBRI_CMD(D_SDP, 0,
                                             dbri->pipes[info->pipe].sdp
                                             | D_SDP_P | D_SDP_EVERY | D_SDP_C);
-                        *(cmd++) = dbri->dma_dvma +
+                        *(cmd++) = dvma_addr +
                                    dbri_dma_off(desc, first_td);
                         dbri_cmdsend(dbri, cmd, 2);
 
@@ -1740,7 +1747,7 @@ static void xmit_descs(struct snd_dbri *dbri)
                         *(cmd++) = DBRI_CMD(D_SDP, 0,
                                             dbri->pipes[info->pipe].sdp
                                             | D_SDP_P | D_SDP_EVERY | D_SDP_C);
-                        *(cmd++) = dbri->dma_dvma +
+                        *(cmd++) = dvma_addr +
                                    dbri_dma_off(desc, first_td);
                         dbri_cmdsend(dbri, cmd, 2);
 
@@ -2539,7 +2546,7 @@ static int snd_dbri_create(struct snd_card *card,
         if (!dbri->dma)
                 return -ENOMEM;
 
-        dprintk(D_GEN, "DMA Cmd Block 0x%p (0x%08x)\n",
+        dprintk(D_GEN, "DMA Cmd Block 0x%p (%pad)\n",
                 dbri->dma, dbri->dma_dvma);
 
         /* Map the registers into memory. */
diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c
index b63a31be1218..5e0dea2cdc01 100644
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -99,7 +99,7 @@ int arch_decode_instruction(struct elf *elf, struct section *sec,
                 break;
 
         case 0x8d:
-                if (insn.rex_prefix.bytes &&
+                if (insn.rex_prefix.nbytes &&
                     insn.rex_prefix.bytes[0] == 0x48 &&
                     insn.modrm.nbytes && insn.modrm.bytes[0] == 0x2c &&
                     insn.sib.nbytes && insn.sib.bytes[0] == 0x24)
diff --git a/tools/testing/nvdimm/Kbuild b/tools/testing/nvdimm/Kbuild
index 582db95127ed..405212be044a 100644
--- a/tools/testing/nvdimm/Kbuild
+++ b/tools/testing/nvdimm/Kbuild
@@ -14,6 +14,7 @@ ldflags-y += --wrap=devm_memremap_pages
 ldflags-y += --wrap=insert_resource
 ldflags-y += --wrap=remove_resource
 ldflags-y += --wrap=acpi_evaluate_object
+ldflags-y += --wrap=acpi_evaluate_dsm
 
 DRIVERS := ../../../drivers
 NVDIMM_SRC := $(DRIVERS)/nvdimm
diff --git a/tools/testing/nvdimm/test/iomap.c b/tools/testing/nvdimm/test/iomap.c
index 3ccef732fce9..64cae1a5deff 100644
--- a/tools/testing/nvdimm/test/iomap.c
+++ b/tools/testing/nvdimm/test/iomap.c
@@ -26,14 +26,17 @@ static LIST_HEAD(iomap_head);
 
 static struct iomap_ops {
         nfit_test_lookup_fn nfit_test_lookup;
+        nfit_test_evaluate_dsm_fn evaluate_dsm;
         struct list_head list;
 } iomap_ops = {
         .list = LIST_HEAD_INIT(iomap_ops.list),
 };
 
-void nfit_test_setup(nfit_test_lookup_fn lookup)
+void nfit_test_setup(nfit_test_lookup_fn lookup,
+                nfit_test_evaluate_dsm_fn evaluate)
 {
         iomap_ops.nfit_test_lookup = lookup;
+        iomap_ops.evaluate_dsm = evaluate;
         list_add_rcu(&iomap_ops.list, &iomap_head);
 }
 EXPORT_SYMBOL(nfit_test_setup);
@@ -367,4 +370,22 @@ acpi_status __wrap_acpi_evaluate_object(acpi_handle handle, acpi_string path,
 }
 EXPORT_SYMBOL(__wrap_acpi_evaluate_object);
 
+union acpi_object * __wrap_acpi_evaluate_dsm(acpi_handle handle, const u8 *uuid,
+                u64 rev, u64 func, union acpi_object *argv4)
+{
+        union acpi_object *obj = ERR_PTR(-ENXIO);
+        struct iomap_ops *ops;
+
+        rcu_read_lock();
+        ops = list_first_or_null_rcu(&iomap_head, typeof(*ops), list);
+        if (ops)
+                obj = ops->evaluate_dsm(handle, uuid, rev, func, argv4);
+        rcu_read_unlock();
+
+        if (IS_ERR(obj))
+                return acpi_evaluate_dsm(handle, uuid, rev, func, argv4);
+        return obj;
+}
+EXPORT_SYMBOL(__wrap_acpi_evaluate_dsm);
+
 MODULE_LICENSE("GPL v2");
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
index c9a6458cb63e..71620fa95953 100644
--- a/tools/testing/nvdimm/test/nfit.c
+++ b/tools/testing/nvdimm/test/nfit.c
@@ -23,6 +23,7 @@
 #include <linux/sizes.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <nd-core.h>
 #include <nfit.h>
 #include <nd.h>
 #include "nfit_test.h"
@@ -1506,6 +1507,225 @@ static int nfit_test_blk_do_io(struct nd_blk_region *ndbr, resource_size_t dpa,
         return 0;
 }
 
+static unsigned long nfit_ctl_handle;
+
+union acpi_object *result;
+
+static union acpi_object *nfit_test_evaluate_dsm(acpi_handle handle,
+                const u8 *uuid, u64 rev, u64 func, union acpi_object *argv4)
+{
+        if (handle != &nfit_ctl_handle)
+                return ERR_PTR(-ENXIO);
+
+        return result;
+}
+
+static int setup_result(void *buf, size_t size)
+{
+        result = kmalloc(sizeof(union acpi_object) + size, GFP_KERNEL);
+        if (!result)
+                return -ENOMEM;
+        result->package.type = ACPI_TYPE_BUFFER,
+        result->buffer.pointer = (void *) (result + 1);
+        result->buffer.length = size;
+        memcpy(result->buffer.pointer, buf, size);
+        memset(buf, 0, size);
+        return 0;
+}
+
+static int nfit_ctl_test(struct device *dev)
+{
+        int rc, cmd_rc;
+        struct nvdimm *nvdimm;
+        struct acpi_device *adev;
+        struct nfit_mem *nfit_mem;
+        struct nd_ars_record *record;
+        struct acpi_nfit_desc *acpi_desc;
+        const u64 test_val = 0x0123456789abcdefULL;
+        unsigned long mask, cmd_size, offset;
+        union {
+                struct nd_cmd_get_config_size cfg_size;
+                struct nd_cmd_ars_status ars_stat;
+                struct nd_cmd_ars_cap ars_cap;
+                char buf[sizeof(struct nd_cmd_ars_status)
+                        + sizeof(struct nd_ars_record)];
+        } cmds;
+
+        adev = devm_kzalloc(dev, sizeof(*adev), GFP_KERNEL);
+        if (!adev)
+                return -ENOMEM;
+        *adev = (struct acpi_device) {
+                .handle = &nfit_ctl_handle,
+                .dev = {
+                        .init_name = "test-adev",
+                },
+        };
+
+        acpi_desc = devm_kzalloc(dev, sizeof(*acpi_desc), GFP_KERNEL);
+        if (!acpi_desc)
+                return -ENOMEM;
+        *acpi_desc = (struct acpi_nfit_desc) {
+                .nd_desc = {
+                        .cmd_mask = 1UL << ND_CMD_ARS_CAP
+                                | 1UL << ND_CMD_ARS_START
+                                | 1UL << ND_CMD_ARS_STATUS
+                                | 1UL << ND_CMD_CLEAR_ERROR,
+                        .module = THIS_MODULE,
+                        .provider_name = "ACPI.NFIT",
+                        .ndctl = acpi_nfit_ctl,
+                },
+                .dev = &adev->dev,
+        };
+
+        nfit_mem = devm_kzalloc(dev, sizeof(*nfit_mem), GFP_KERNEL);
+        if (!nfit_mem)
+                return -ENOMEM;
+
+        mask = 1UL << ND_CMD_SMART | 1UL << ND_CMD_SMART_THRESHOLD
+                | 1UL << ND_CMD_DIMM_FLAGS | 1UL << ND_CMD_GET_CONFIG_SIZE
+                | 1UL << ND_CMD_GET_CONFIG_DATA | 1UL << ND_CMD_SET_CONFIG_DATA
+                | 1UL << ND_CMD_VENDOR;
+        *nfit_mem = (struct nfit_mem) {
+                .adev = adev,
+                .family = NVDIMM_FAMILY_INTEL,
+                .dsm_mask = mask,
+        };
+
+        nvdimm = devm_kzalloc(dev, sizeof(*nvdimm), GFP_KERNEL);
+        if (!nvdimm)
+                return -ENOMEM;
+        *nvdimm = (struct nvdimm) {
+                .provider_data = nfit_mem,
+                .cmd_mask = mask,
+                .dev = {
+                        .init_name = "test-dimm",
+                },
+        };
+
+
+        /* basic checkout of a typical 'get config size' command */
+        cmd_size = sizeof(cmds.cfg_size);
+        cmds.cfg_size = (struct nd_cmd_get_config_size) {
+                .status = 0,
+                .config_size = SZ_128K,
+                .max_xfer = SZ_4K,
+        };
+        rc = setup_result(cmds.buf, cmd_size);
+        if (rc)
+                return rc;
+        rc = acpi_nfit_ctl(&acpi_desc->nd_desc, nvdimm, ND_CMD_GET_CONFIG_SIZE,
+                        cmds.buf, cmd_size, &cmd_rc);
+
+        if (rc < 0 || cmd_rc || cmds.cfg_size.status != 0
+                        || cmds.cfg_size.config_size != SZ_128K
+                        || cmds.cfg_size.max_xfer != SZ_4K) {
+                dev_dbg(dev, "%s: failed at: %d rc: %d cmd_rc: %d\n",
+                                __func__, __LINE__, rc, cmd_rc);
+                return -EIO;
+        }
+
+
+        /* test ars_status with zero output */
+        cmd_size = offsetof(struct nd_cmd_ars_status, address);
+        cmds.ars_stat = (struct nd_cmd_ars_status) {
+                .out_length = 0,
+        };
+        rc = setup_result(cmds.buf, cmd_size);
+        if (rc)
+                return rc;
+        rc = acpi_nfit_ctl(&acpi_desc->nd_desc, NULL, ND_CMD_ARS_STATUS,
+                        cmds.buf, cmd_size, &cmd_rc);
+
+        if (rc < 0 || cmd_rc) {
+                dev_dbg(dev, "%s: failed at: %d rc: %d cmd_rc: %d\n",
+                                __func__, __LINE__, rc, cmd_rc);
+                return -EIO;
+        }
+
+
+        /* test ars_cap with benign extended status */
+        cmd_size = sizeof(cmds.ars_cap);
+        cmds.ars_cap = (struct nd_cmd_ars_cap) {
+                .status = ND_ARS_PERSISTENT << 16,
+        };
+        offset = offsetof(struct nd_cmd_ars_cap, status);
+        rc = setup_result(cmds.buf + offset, cmd_size - offset);
+        if (rc)
+                return rc;
+        rc = acpi_nfit_ctl(&acpi_desc->nd_desc, NULL, ND_CMD_ARS_CAP,
+                        cmds.buf, cmd_size, &cmd_rc);
+
+        if (rc < 0 || cmd_rc) {
+                dev_dbg(dev, "%s: failed at: %d rc: %d cmd_rc: %d\n",
+                                __func__, __LINE__, rc, cmd_rc);
+                return -EIO;
+        }
+
+
+        /* test ars_status with 'status' trimmed from 'out_length' */
+        cmd_size = sizeof(cmds.ars_stat) + sizeof(struct nd_ars_record);
+        cmds.ars_stat = (struct nd_cmd_ars_status) {
+                .out_length = cmd_size - 4,
+        };
+        record = &cmds.ars_stat.records[0];
+        *record = (struct nd_ars_record) {
+                .length = test_val,
+        };
+        rc = setup_result(cmds.buf, cmd_size);
+        if (rc)
+                return rc;
+        rc = acpi_nfit_ctl(&acpi_desc->nd_desc, NULL, ND_CMD_ARS_STATUS,
+                        cmds.buf, cmd_size, &cmd_rc);
+
+        if (rc < 0 || cmd_rc || record->length != test_val) {
+                dev_dbg(dev, "%s: failed at: %d rc: %d cmd_rc: %d\n",
+                                __func__, __LINE__, rc, cmd_rc);
+                return -EIO;
+        }
+
+
+        /* test ars_status with 'Output (Size)' including 'status' */
+        cmd_size = sizeof(cmds.ars_stat) + sizeof(struct nd_ars_record);
+        cmds.ars_stat = (struct nd_cmd_ars_status) {
+                .out_length = cmd_size,
+        };
+        record = &cmds.ars_stat.records[0];
+        *record = (struct nd_ars_record) {
+                .length = test_val,
+        };
+        rc = setup_result(cmds.buf, cmd_size);
+        if (rc)
+                return rc;
+        rc = acpi_nfit_ctl(&acpi_desc->nd_desc, NULL, ND_CMD_ARS_STATUS,
+                        cmds.buf, cmd_size, &cmd_rc);
+
+        if (rc < 0 || cmd_rc || record->length != test_val) {
+                dev_dbg(dev, "%s: failed at: %d rc: %d cmd_rc: %d\n",
+                                __func__, __LINE__, rc, cmd_rc);
+                return -EIO;
+        }
+
+
+        /* test extended status for get_config_size results in failure */
+        cmd_size = sizeof(cmds.cfg_size);
+        cmds.cfg_size = (struct nd_cmd_get_config_size) {
+                .status = 1 << 16,
+        };
+        rc = setup_result(cmds.buf, cmd_size);
+        if (rc)
+                return rc;
+        rc = acpi_nfit_ctl(&acpi_desc->nd_desc, nvdimm, ND_CMD_GET_CONFIG_SIZE,
+                        cmds.buf, cmd_size, &cmd_rc);
+
+        if (rc < 0 || cmd_rc >= 0) {
+                dev_dbg(dev, "%s: failed at: %d rc: %d cmd_rc: %d\n",
+                                __func__, __LINE__, rc, cmd_rc);
+                return -EIO;
+        }
+
+        return 0;
+}
+
 static int nfit_test_probe(struct platform_device *pdev)
 {
         struct nvdimm_bus_descriptor *nd_desc;
@@ -1516,6 +1736,12 @@ static int nfit_test_probe(struct platform_device *pdev)
         union acpi_object *obj;
         int rc;
 
+        if (strcmp(dev_name(&pdev->dev), "nfit_test.0") == 0) {
+                rc = nfit_ctl_test(&pdev->dev);
+                if (rc)
+                        return rc;
+        }
+
         nfit_test = to_nfit_test(&pdev->dev);
 
         /* common alloc */
@@ -1639,11 +1865,13 @@ static __init int nfit_test_init(void)
 {
         int rc, i;
 
-        nfit_test_dimm = class_create(THIS_MODULE, "nfit_test_dimm");
-        if (IS_ERR(nfit_test_dimm))
-                return PTR_ERR(nfit_test_dimm);
+        nfit_test_setup(nfit_test_lookup, nfit_test_evaluate_dsm);
 
-        nfit_test_setup(nfit_test_lookup);
+        nfit_test_dimm = class_create(THIS_MODULE, "nfit_test_dimm");
+        if (IS_ERR(nfit_test_dimm)) {
+                rc = PTR_ERR(nfit_test_dimm);
+                goto err_register;
+        }
 
         for (i = 0; i < NUM_NFITS; i++) {
                 struct nfit_test *nfit_test;
diff --git a/tools/testing/nvdimm/test/nfit_test.h b/tools/testing/nvdimm/test/nfit_test.h
index c281dd2e5e2d..f54c0032c6ff 100644
--- a/tools/testing/nvdimm/test/nfit_test.h
+++ b/tools/testing/nvdimm/test/nfit_test.h
@@ -31,11 +31,17 @@ struct nfit_test_resource {
         void *buf;
 };
 
+union acpi_object;
+typedef void *acpi_handle;
+
 typedef struct nfit_test_resource *(*nfit_test_lookup_fn)(resource_size_t);
+typedef union acpi_object *(*nfit_test_evaluate_dsm_fn)(acpi_handle handle,
+                const u8 *uuid, u64 rev, u64 func, union acpi_object *argv4);
 void __iomem *__wrap_ioremap_nocache(resource_size_t offset,
                 unsigned long size);
 void __wrap_iounmap(volatile void __iomem *addr);
-void nfit_test_setup(nfit_test_lookup_fn lookup);
+void nfit_test_setup(nfit_test_lookup_fn lookup,
+                nfit_test_evaluate_dsm_fn evaluate);
 void nfit_test_teardown(void);
 struct nfit_test_resource *get_nfit_res(resource_size_t resource);
 #endif
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 0a063af40565..9bab86757fa4 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -50,8 +50,10 @@ void vgic_v2_process_maintenance(struct kvm_vcpu *vcpu)
 
                         WARN_ON(cpuif->vgic_lr[lr] & GICH_LR_STATE);
 
-                        kvm_notify_acked_irq(vcpu->kvm, 0,
-                                             intid - VGIC_NR_PRIVATE_IRQS);
+                        /* Only SPIs require notification */
+                        if (vgic_valid_spi(vcpu->kvm, intid))
+                                kvm_notify_acked_irq(vcpu->kvm, 0,
+                                                     intid - VGIC_NR_PRIVATE_IRQS);
                 }
         }
 
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 9f0dae397d9c..5c9f9745e6ca 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -41,8 +41,10 @@ void vgic_v3_process_maintenance(struct kvm_vcpu *vcpu)
 
                         WARN_ON(cpuif->vgic_lr[lr] & ICH_LR_STATE);
 
-                        kvm_notify_acked_irq(vcpu->kvm, 0,
-                                             intid - VGIC_NR_PRIVATE_IRQS);
+                        /* Only SPIs require notification */
+                        if (vgic_valid_spi(vcpu->kvm, intid))
+                                kvm_notify_acked_irq(vcpu->kvm, 0,
+                                                     intid - VGIC_NR_PRIVATE_IRQS);
                 }
 
                 /*
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 2f38ce55016f..c55f5d6a7767 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2897,10 +2897,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
 
         ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
         if (ret < 0) {
-                ops->destroy(dev);
                 mutex_lock(&kvm->lock);
                 list_del(&dev->vm_node);
                 mutex_unlock(&kvm->lock);
+                ops->destroy(dev);
                 return ret;
         }