Merge branch 'linus' into x86/asm, to pick up fixes

Signed-off-by: Ingo Molnar <mingo@kernel.org>
author: Ingo Molnar <mingo@kernel.org> 2016-09-20 02:29:21 -0400
committer: Ingo Molnar <mingo@kernel.org> 2016-09-20 02:29:21 -0400
commit: b2c16e1efddeb517c62d242fb8ec30a383843468 (patch)
tree: fbfbe6f124a9423abf9a288ad46feb6db7469c42
parent: 81539169f283329fd8bc58457cc15754f683ba69 (diff)
parent: d2ffb0103aaefa9b169da042cf39ce27bfb6cdbb (diff)
136 files changed, 1224 insertions, 835 deletions
diff --git a/Documentation/devicetree/bindings/mmc/sdhci-st.txt b/Documentation/devicetree/bindings/mmc/sdhci-st.txt
index 88faa91125bf..3cd4c43a3260 100644
--- a/Documentation/devicetree/bindings/mmc/sdhci-st.txt
+++ b/Documentation/devicetree/bindings/mmc/sdhci-st.txt
@@ -10,7 +10,7 @@ Required properties:
                        subsystem (mmcss) inside the FlashSS (available in STiH407 SoC
                        family).
- clock-names:          Should be "mmc".
+- clock-names:          Should be "mmc" and "icn".  (NB: The latter is not compulsory)
                        See: Documentation/devicetree/bindings/resource-names.txt
 - clocks:               Phandle to the clock.
                        See: Documentation/devicetree/bindings/clock/clock-bindings.txt
diff --git a/MAINTAINERS b/MAINTAINERS
index a5e1270dfbf1..a0ce40f4c66c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1625,6 +1625,7 @@ N:	rockchip
 ARM/SAMSUNG EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene@kernel.org>
 M:      Krzysztof Kozlowski <krzk@kernel.org>
+R:      Javier Martinez Canillas <javier@osg.samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
@@ -6102,7 +6103,7 @@ S:	Supported
 F:      drivers/cpufreq/intel_pstate.c
 INTEL FRAMEBUFFER DRIVER (excluding 810 and 815)
-M:      Maik Broemme <mbroemme@plusserver.de>
+M:      Maik Broemme <mbroemme@libmpq.org>
 L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/fb/intelfb.txt
@@ -12568,7 +12569,7 @@ F:	include/linux/if_*vlan.h
 F:      net/8021q/
 VLYNQ BUS
-M:      Florian Fainelli <florian@openwrt.org>
+M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      openwrt-devel@lists.openwrt.org (subscribers-only)
 S:      Maintained
 F:      drivers/vlynq/vlynq.c
diff --git a/Makefile b/Makefile
index 1a8c8ddcb22f..74e22c2f408b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Psychotic Stoned Sheep
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
index caf2707680c1..e9b47b2bbc33 100644
--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
@@ -2,6 +2,7 @@
 / {
        memory {
+                device_type = "memory";
                reg = <0 0x10000000>;
        };
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index b98252232d20..445624a1a1de 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -2,7 +2,6 @@
 #include <dt-bindings/clock/bcm2835.h>
 #include <dt-bindings/clock/bcm2835-aux.h>
 #include <dt-bindings/gpio/gpio.h>
-#include "skeleton.dtsi"
 /* This include file covers the common peripherals and configuration between
 * bcm2835 and bcm2836 implementations, leaving the CPU configuration to
@@ -13,6 +12,8 @@
        compatible = "brcm,bcm2835";
        model = "BCM2835";
        interrupt-parent = <&intc>;
+        #address-cells = <1>;
+        #size-cells = <1>;
        chosen {
                bootargs = "earlyprintk console=ttyAMA0";
diff --git a/arch/arm/boot/dts/stih407-family.dtsi b/arch/arm/boot/dts/stih407-family.dtsi
index d294e82447a2..8b063ab10c19 100644
--- a/arch/arm/boot/dts/stih407-family.dtsi
+++ b/arch/arm/boot/dts/stih407-family.dtsi
@@ -550,8 +550,9 @@
                        interrupt-names = "mmcirq";
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_mmc0>;
-                        clock-names = "mmc";
+                        clock-names = "mmc", "icn";
-                        clocks = <&clk_s_c0_flexgen CLK_MMC_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_MMC_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_HVA>;
                        bus-width = <8>;
                        non-removable;
                };
@@ -565,8 +566,9 @@
                        interrupt-names = "mmcirq";
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_sd1>;
-                        clock-names = "mmc";
+                        clock-names = "mmc", "icn";
-                        clocks = <&clk_s_c0_flexgen CLK_MMC_1>;
+                        clocks = <&clk_s_c0_flexgen CLK_MMC_1>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_HVA>;
                        resets = <&softreset STIH407_MMC1_SOFTRESET>;
                        bus-width = <4>;
                };
diff --git a/arch/arm/boot/dts/stih410.dtsi b/arch/arm/boot/dts/stih410.dtsi
index 18ed1ad10d32..40318869c733 100644
--- a/arch/arm/boot/dts/stih410.dtsi
+++ b/arch/arm/boot/dts/stih410.dtsi
@@ -41,7 +41,8 @@
                        compatible = "st,st-ohci-300x";
                        reg = <0x9a03c00 0x100>;
                        interrupts = <GIC_SPI 180 IRQ_TYPE_NONE>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                        resets = <&powerdown STIH407_USB2_PORT0_POWERDOWN>,
                                 <&softreset STIH407_USB2_PORT0_SOFTRESET>;
                        reset-names = "power", "softreset";
@@ -57,7 +58,8 @@
                        interrupts = <GIC_SPI 151 IRQ_TYPE_NONE>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb0>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                        resets = <&powerdown STIH407_USB2_PORT0_POWERDOWN>,
                                 <&softreset STIH407_USB2_PORT0_SOFTRESET>;
                        reset-names = "power", "softreset";
@@ -71,7 +73,8 @@
                        compatible = "st,st-ohci-300x";
                        reg = <0x9a83c00 0x100>;
                        interrupts = <GIC_SPI 181 IRQ_TYPE_NONE>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                        resets = <&powerdown STIH407_USB2_PORT1_POWERDOWN>,
                                 <&softreset STIH407_USB2_PORT1_SOFTRESET>;
                        reset-names = "power", "softreset";
@@ -87,7 +90,8 @@
                        interrupts = <GIC_SPI 153 IRQ_TYPE_NONE>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb1>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                        resets = <&powerdown STIH407_USB2_PORT1_POWERDOWN>,
                                 <&softreset STIH407_USB2_PORT1_SOFTRESET>;
                        reset-names = "power", "softreset";
diff --git a/arch/arm/common/locomo.c b/arch/arm/common/locomo.c
index 0e97b4b871f9..6c7b06854fce 100644
--- a/arch/arm/common/locomo.c
+++ b/arch/arm/common/locomo.c
@@ -140,7 +140,7 @@ static struct locomo_dev_info locomo_devices[] = {
 static void locomo_handler(struct irq_desc *desc)
 {
-        struct locomo *lchip = irq_desc_get_chip_data(desc);
+        struct locomo *lchip = irq_desc_get_handler_data(desc);
        int req, i;
        /* Acknowledge the parent IRQ */
@@ -200,8 +200,7 @@ static void locomo_setup_irq(struct locomo *lchip)
         * Install handler for IRQ_LOCOMO_HW.
         */
        irq_set_irq_type(lchip->irq, IRQ_TYPE_EDGE_FALLING);
-        irq_set_chip_data(lchip->irq, lchip);
+        irq_set_chained_handler_and_data(lchip->irq, locomo_handler, lchip);
-        irq_set_chained_handler(lchip->irq, locomo_handler);
        /* Install handlers for IRQ_LOCOMO_* */
        for ( ; irq <= lchip->irq_base + 3; irq++) {
diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
index fb0a0a4dfea4..2e076c492005 100644
--- a/arch/arm/common/sa1111.c
+++ b/arch/arm/common/sa1111.c
@@ -472,8 +472,8 @@ static int sa1111_setup_irq(struct sa1111 *sachip, unsigned irq_base)
         * specifies that S0ReadyInt and S1ReadyInt should be '1'.
         */
        sa1111_writel(0, irqbase + SA1111_INTPOL0);
-        sa1111_writel(SA1111_IRQMASK_HI(IRQ_S0_READY_NINT) |
+        sa1111_writel(BIT(IRQ_S0_READY_NINT & 31) |
-                      SA1111_IRQMASK_HI(IRQ_S1_READY_NINT),
+                      BIT(IRQ_S1_READY_NINT & 31),
                      irqbase + SA1111_INTPOL1);
        /* clear all IRQs */
@@ -754,7 +754,7 @@ static int __sa1111_probe(struct device *me, struct resource *mem, int irq)
        if (sachip->irq != NO_IRQ) {
                ret = sa1111_setup_irq(sachip, pd->irq_base);
                if (ret)
-                        goto err_unmap;
+                        goto err_clk;
        }
 #ifdef CONFIG_ARCH_SA1100
@@ -799,6 +799,8 @@ static int __sa1111_probe(struct device *me, struct resource *mem, int irq)
        return 0;
+ err_clk:
+        clk_disable(sachip->clk);
 err_unmap:
        iounmap(sachip->base);
 err_clk_unprep:
@@ -869,9 +871,9 @@ struct sa1111_save_data {
 #ifdef CONFIG_PM
-static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
+static int sa1111_suspend_noirq(struct device *dev)
 {
-        struct sa1111 *sachip = platform_get_drvdata(dev);
+        struct sa1111 *sachip = dev_get_drvdata(dev);
        struct sa1111_save_data *save;
        unsigned long flags;
        unsigned int val;
@@ -934,9 +936,9 @@ static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
 *      restored by their respective drivers, and must be called
 *      via LDM after this function.
 */
-static int sa1111_resume(struct platform_device *dev)
+static int sa1111_resume_noirq(struct device *dev)
 {
-        struct sa1111 *sachip = platform_get_drvdata(dev);
+        struct sa1111 *sachip = dev_get_drvdata(dev);
        struct sa1111_save_data *save;
        unsigned long flags, id;
        void __iomem *base;
@@ -952,7 +954,7 @@ static int sa1111_resume(struct platform_device *dev)
        id = sa1111_readl(sachip->base + SA1111_SKID);
        if ((id & SKID_ID_MASK) != SKID_SA1111_ID) {
                __sa1111_remove(sachip);
-                platform_set_drvdata(dev, NULL);
+                dev_set_drvdata(dev, NULL);
                kfree(save);
                return 0;
        }
@@ -1003,8 +1005,8 @@ static int sa1111_resume(struct platform_device *dev)
 }
 #else
-#define sa1111_suspend NULL
+#define sa1111_suspend_noirq NULL
-#define sa1111_resume  NULL
+#define sa1111_resume_noirq  NULL
 #endif
 static int sa1111_probe(struct platform_device *pdev)
@@ -1017,7 +1019,7 @@ static int sa1111_probe(struct platform_device *pdev)
                return -EINVAL;
        irq = platform_get_irq(pdev, 0);
        if (irq < 0)
-                return -ENXIO;
+                return irq;
        return __sa1111_probe(&pdev->dev, mem, irq);
 }
@@ -1038,6 +1040,11 @@ static int sa1111_remove(struct platform_device *pdev)
        return 0;
 }
+static struct dev_pm_ops sa1111_pm_ops = {
+        .suspend_noirq = sa1111_suspend_noirq,
+        .resume_noirq = sa1111_resume_noirq,
+};
 /*
 *      Not sure if this should be on the system bus or not yet.
 *      We really want some way to register a system device at
@@ -1050,10 +1057,9 @@ static int sa1111_remove(struct platform_device *pdev)
 static struct platform_driver sa1111_device_driver = {
        .probe          = sa1111_probe,
        .remove         = sa1111_remove,
-        .suspend        = sa1111_suspend,
-        .resume         = sa1111_resume,
        .driver         = {
                .name   = "sa1111",
+                .pm     = &sa1111_pm_ops,
        },
 };
diff --git a/arch/arm/configs/keystone_defconfig b/arch/arm/configs/keystone_defconfig
index 71b42e66488a..78cd2f197e01 100644
--- a/arch/arm/configs/keystone_defconfig
+++ b/arch/arm/configs/keystone_defconfig
@@ -161,6 +161,7 @@ CONFIG_USB_MON=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC3=y
+CONFIG_NOP_USB_XCEIV=y
 CONFIG_KEYSTONE_USB_PHY=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 2c8665cd9dc5..ea3566fb92e2 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -781,7 +781,7 @@ CONFIG_MXS_DMA=y
 CONFIG_DMA_BCM2835=y
 CONFIG_DMA_OMAP=y
 CONFIG_QCOM_BAM_DMA=y
-CONFIG_XILINX_VDMA=y
+CONFIG_XILINX_DMA=y
 CONFIG_DMA_SUN6I=y
 CONFIG_STAGING=y
 CONFIG_SENSORS_ISL29018=y
diff --git a/arch/arm/crypto/aes-ce-glue.c b/arch/arm/crypto/aes-ce-glue.c
index da3c0428507b..aef022a87c53 100644
--- a/arch/arm/crypto/aes-ce-glue.c
+++ b/arch/arm/crypto/aes-ce-glue.c
@@ -284,7 +284,7 @@ static int ctr_encrypt(struct blkcipher_desc *desc, struct scatterlist *dst,
                err = blkcipher_walk_done(desc, &walk,
                                          walk.nbytes % AES_BLOCK_SIZE);
        }
-        if (nbytes) {
+        if (walk.nbytes % AES_BLOCK_SIZE) {
                u8 *tdst = walk.dst.virt.addr + blocks * AES_BLOCK_SIZE;
                u8 *tsrc = walk.src.virt.addr + blocks * AES_BLOCK_SIZE;
                u8 __aligned(8) tail[AES_BLOCK_SIZE];
diff --git a/arch/arm/include/asm/pgtable-2level-hwdef.h b/arch/arm/include/asm/pgtable-2level-hwdef.h
index d0131ee6f6af..3f82e9da7cec 100644
--- a/arch/arm/include/asm/pgtable-2level-hwdef.h
+++ b/arch/arm/include/asm/pgtable-2level-hwdef.h
@@ -47,6 +47,7 @@
 #define PMD_SECT_WB             (PMD_SECT_CACHEABLE | PMD_SECT_BUFFERABLE)
 #define PMD_SECT_MINICACHE      (PMD_SECT_TEX(1) | PMD_SECT_CACHEABLE)
 #define PMD_SECT_WBWA           (PMD_SECT_TEX(1) | PMD_SECT_CACHEABLE | PMD_SECT_BUFFERABLE)
+#define PMD_SECT_CACHE_MASK     (PMD_SECT_TEX(1) | PMD_SECT_CACHEABLE | PMD_SECT_BUFFERABLE)
 #define PMD_SECT_NONSHARED_DEV  (PMD_SECT_TEX(2))
 /*
diff --git a/arch/arm/include/asm/pgtable-3level-hwdef.h b/arch/arm/include/asm/pgtable-3level-hwdef.h
index f8f1cff62065..4cd664abfcd3 100644
--- a/arch/arm/include/asm/pgtable-3level-hwdef.h
+++ b/arch/arm/include/asm/pgtable-3level-hwdef.h
@@ -62,6 +62,7 @@
 #define PMD_SECT_WT             (_AT(pmdval_t, 2) << 2) /* normal inner write-through */
 #define PMD_SECT_WB             (_AT(pmdval_t, 3) << 2) /* normal inner write-back */
 #define PMD_SECT_WBWA           (_AT(pmdval_t, 7) << 2) /* normal inner write-alloc */
+#define PMD_SECT_CACHE_MASK     (_AT(pmdval_t, 7) << 2)
 /*
 * + Level 3 descriptor (PTE)
diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
index 3750575c73c5..06332f626565 100644
--- a/arch/arm/mach-exynos/suspend.c
+++ b/arch/arm/mach-exynos/suspend.c
@@ -255,6 +255,12 @@ static int __init exynos_pmu_irq_init(struct device_node *node,
                return -ENOMEM;
        }
+        /*
+         * Clear the OF_POPULATED flag set in of_irq_init so that
+         * later the Exynos PMU platform device won't be skipped.
+         */
+        of_node_clear_flag(node, OF_POPULATED);
        return 0;
 }
diff --git a/arch/arm/mach-pxa/lubbock.c b/arch/arm/mach-pxa/lubbock.c
index 7245f3359564..d6159f8ef0c2 100644
--- a/arch/arm/mach-pxa/lubbock.c
+++ b/arch/arm/mach-pxa/lubbock.c
@@ -137,6 +137,18 @@ static struct pxa2xx_udc_mach_info udc_info __initdata = {
        // no D+ pullup; lubbock can't connect/disconnect in software
 };
+static void lubbock_init_pcmcia(void)
+{
+        struct clk *clk;
+        /* Add an alias for the SA1111 PCMCIA clock */
+        clk = clk_get_sys("pxa2xx-pcmcia", NULL);
+        if (!IS_ERR(clk)) {
+                clkdev_create(clk, NULL, "1800");
+                clk_put(clk);
+        }
+}
 static struct resource sa1111_resources[] = {
        [0] = {
                .start  = 0x10000000,
@@ -467,6 +479,8 @@ static void __init lubbock_init(void)
        pxa_set_btuart_info(NULL);
        pxa_set_stuart_info(NULL);
+        lubbock_init_pcmcia();
        clk_add_alias("SA1111_CLK", NULL, "GPIO11_CLK", NULL);
        pxa_set_udc_info(&udc_info);
        pxa_set_fb_info(NULL, &sharp_lm8v31);
diff --git a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
index 62437b57813e..73e3adbc1330 100644
--- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
+++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
@@ -41,39 +41,26 @@
 #define REGULATOR_IRQ_MASK      BIT(2)  /* IRQ2, active low */
-static void __iomem *irqc;
+/* start of DA9210 System Control and Event Registers */
-static const u8 da9063_mask_regs[] = {
-        DA9063_REG_IRQ_MASK_A,
-        DA9063_REG_IRQ_MASK_B,
-        DA9063_REG_IRQ_MASK_C,
-        DA9063_REG_IRQ_MASK_D,
-};
-/* DA9210 System Control and Event Registers */
 #define DA9210_REG_MASK_A               0x54
-#define DA9210_REG_MASK_B               0x55
-static const u8 da9210_mask_regs[] = {
-        DA9210_REG_MASK_A,
-        DA9210_REG_MASK_B,
-};
-static void da9xxx_mask_irqs(struct i2c_client *client, const u8 regs[],
-                             unsigned int nregs)
-{
-        unsigned int i;
-        dev_info(&client->dev, "Masking %s interrupt sources\n", client->name);
+static void __iomem *irqc;
-        for (i = 0; i < nregs; i++) {
+/* first byte sets the memory pointer, following are consecutive reg values */
-                int error = i2c_smbus_write_byte_data(client, regs[i], ~0);
+static u8 da9063_irq_clr[] = { DA9063_REG_IRQ_MASK_A, 0xff, 0xff, 0xff, 0xff };
-                if (error) {
+static u8 da9210_irq_clr[] = { DA9210_REG_MASK_A, 0xff, 0xff };
-                        dev_err(&client->dev, "i2c error %d\n", error);
-                        return;
+static struct i2c_msg da9xxx_msgs[2] = {
-                }
+        {
-        }
+                .addr = 0x58,
-}
+                .len = ARRAY_SIZE(da9063_irq_clr),
+                .buf = da9063_irq_clr,
+        }, {
+                .addr = 0x68,
+                .len = ARRAY_SIZE(da9210_irq_clr),
+                .buf = da9210_irq_clr,
+        },
+};
 static int regulator_quirk_notify(struct notifier_block *nb,
                                  unsigned long action, void *data)
@@ -93,12 +80,15 @@ static int regulator_quirk_notify(struct notifier_block *nb,
        client = to_i2c_client(dev);
        dev_dbg(dev, "Detected %s\n", client->name);
-        if ((client->addr == 0x58 && !strcmp(client->name, "da9063")))
+        if ((client->addr == 0x58 && !strcmp(client->name, "da9063")) ||
-                da9xxx_mask_irqs(client, da9063_mask_regs,
+            (client->addr == 0x68 && !strcmp(client->name, "da9210"))) {
-                                 ARRAY_SIZE(da9063_mask_regs));
+                int ret;
-        else if (client->addr == 0x68 && !strcmp(client->name, "da9210"))
-                da9xxx_mask_irqs(client, da9210_mask_regs,
+                dev_info(&client->dev, "clearing da9063/da9210 interrupts\n");
-                                 ARRAY_SIZE(da9210_mask_regs));
+                ret = i2c_transfer(client->adapter, da9xxx_msgs, ARRAY_SIZE(da9xxx_msgs));
+                if (ret != ARRAY_SIZE(da9xxx_msgs))
+                        dev_err(&client->dev, "i2c error %d\n", ret);
+        }
        mon = ioread32(irqc + IRQC_MONITOR);
        if (mon & REGULATOR_IRQ_MASK)
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 6344913f0804..30fe03f95c85 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -137,7 +137,7 @@ void __init init_default_cache_policy(unsigned long pmd)
        initial_pmd_value = pmd;
-        pmd &= PMD_SECT_TEX(1) | PMD_SECT_BUFFERABLE | PMD_SECT_CACHEABLE;
+        pmd &= PMD_SECT_CACHE_MASK;
        for (i = 0; i < ARRAY_SIZE(cache_policies); i++)
                if (cache_policies[i].pmd == pmd) {
diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
index 445aa678f914..c2b9bcb0ef61 100644
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
@@ -255,10 +255,10 @@
                /* Local timer */
                timer {
                        compatible = "arm,armv8-timer";
-                        interrupts = <1 13 0xf01>,
+                        interrupts = <1 13 0xf08>,
-                                     <1 14 0xf01>,
+                                     <1 14 0xf08>,
-                                     <1 11 0xf01>,
+                                     <1 11 0xf08>,
-                                     <1 10 0xf01>;
+                                     <1 10 0xf08>;
                };
                timer0: timer0@ffc03000 {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
index e502c24b0ac7..bf6c8d051002 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
@@ -102,13 +102,13 @@
        timer {
                compatible = "arm,armv8-timer";
                interrupts = <GIC_PPI 13
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>,
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>,
                             <GIC_PPI 14
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>,
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>,
                             <GIC_PPI 11
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>,
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>,
                             <GIC_PPI 10
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>;
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>;
        };
        xtal: xtal-clk {
diff --git a/arch/arm64/boot/dts/apm/apm-storm.dtsi b/arch/arm64/boot/dts/apm/apm-storm.dtsi
index f1c2c713f9b0..c29dab9d1834 100644
--- a/arch/arm64/boot/dts/apm/apm-storm.dtsi
+++ b/arch/arm64/boot/dts/apm/apm-storm.dtsi
@@ -110,10 +110,10 @@
        timer {
                compatible = "arm,armv8-timer";
-                interrupts = <1 0 0xff01>,      /* Secure Phys IRQ */
+                interrupts = <1 0 0xff08>,      /* Secure Phys IRQ */
-                             <1 13 0xff01>,     /* Non-secure Phys IRQ */
+                             <1 13 0xff08>,     /* Non-secure Phys IRQ */
-                             <1 14 0xff01>,     /* Virt IRQ */
+                             <1 14 0xff08>,     /* Virt IRQ */
-                             <1 15 0xff01>;     /* Hyp IRQ */
+                             <1 15 0xff08>;     /* Hyp IRQ */
                clock-frequency = <50000000>;
        };
diff --git a/arch/arm64/boot/dts/broadcom/bcm2835-rpi.dtsi b/arch/arm64/boot/dts/broadcom/bcm2835-rpi.dtsi
new file mode 120000
index 000000000000..3937b77cb310
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm2835-rpi.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm2835-rpi.dtsi
+\ No newline at end of file
diff --git a/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
index 6f47dd2bb1db..7841b724e340 100644
--- a/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
+++ b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
@@ -1,7 +1,7 @@
 /dts-v1/;
 #include "bcm2837.dtsi"
-#include "../../../../arm/boot/dts/bcm2835-rpi.dtsi"
+#include "bcm2835-rpi.dtsi"
-#include "../../../../arm/boot/dts/bcm283x-rpi-smsc9514.dtsi"
+#include "bcm283x-rpi-smsc9514.dtsi"
 / {
        compatible = "raspberrypi,3-model-b", "brcm,bcm2837";
diff --git a/arch/arm64/boot/dts/broadcom/bcm2837.dtsi b/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
index f2a31d06845d..8216bbb29fe0 100644
--- a/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
+++ b/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
@@ -1,4 +1,4 @@
-#include "../../../../arm/boot/dts/bcm283x.dtsi"
+#include "bcm283x.dtsi"
 / {
        compatible = "brcm,bcm2836";
diff --git a/arch/arm64/boot/dts/broadcom/bcm283x-rpi-smsc9514.dtsi b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-smsc9514.dtsi
new file mode 120000
index 000000000000..dca7c057d5a5
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-smsc9514.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm283x-rpi-smsc9514.dtsi
+\ No newline at end of file
diff --git a/arch/arm64/boot/dts/broadcom/bcm283x.dtsi b/arch/arm64/boot/dts/broadcom/bcm283x.dtsi
new file mode 120000
index 000000000000..5f54e4cab99b
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm283x.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm283x.dtsi
+\ No newline at end of file
diff --git a/arch/arm64/boot/dts/broadcom/ns2.dtsi b/arch/arm64/boot/dts/broadcom/ns2.dtsi
index f53b0955bfd3..d4a12fad8afd 100644
--- a/arch/arm64/boot/dts/broadcom/ns2.dtsi
+++ b/arch/arm64/boot/dts/broadcom/ns2.dtsi
@@ -88,13 +88,13 @@
        timer {
                compatible = "arm,armv8-timer";
                interrupts = <GIC_PPI 13 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>,
+                              IRQ_TYPE_LEVEL_LOW)>,
                             <GIC_PPI 14 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>,
+                              IRQ_TYPE_LEVEL_LOW)>,
                             <GIC_PPI 11 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>,
+                              IRQ_TYPE_LEVEL_LOW)>,
                             <GIC_PPI 10 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>;
+                              IRQ_TYPE_LEVEL_LOW)>;
        };
        pmu {
diff --git a/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi b/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
index 2eb9b225f0bc..04dc8a8d1539 100644
--- a/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
+++ b/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
@@ -354,10 +354,10 @@
        timer {
                compatible = "arm,armv8-timer";
-                interrupts = <1 13 0xff01>,
+                interrupts = <1 13 4>,
-                             <1 14 0xff01>,
+                             <1 14 4>,
-                             <1 11 0xff01>,
+                             <1 11 4>,
-                             <1 10 0xff01>;
+                             <1 10 4>;
        };
        pmu {
diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index ca663dfe5189..162831546e18 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -473,10 +473,10 @@
                timer {
                        compatible = "arm,armv8-timer";
-                        interrupts = <1 13 0xff01>,
+                        interrupts = <1 13 0xff08>,
-                                     <1 14 0xff01>,
+                                     <1 14 0xff08>,
-                                     <1 11 0xff01>,
+                                     <1 11 0xff08>,
-                                     <1 10 0xff01>;
+                                     <1 10 0xff08>;
                };
                pmu_system_controller: system-controller@105c0000 {
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
index e669fbd7f9c3..a67e210e2019 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
@@ -119,10 +119,10 @@
        timer {
                compatible = "arm,armv8-timer";
-                interrupts = <1 13 0x1>, /* Physical Secure PPI */
+                interrupts = <1 13 0xf08>, /* Physical Secure PPI */
-                             <1 14 0x1>, /* Physical Non-Secure PPI */
+                             <1 14 0xf08>, /* Physical Non-Secure PPI */
-                             <1 11 0x1>, /* Virtual PPI */
+                             <1 11 0xf08>, /* Virtual PPI */
-                             <1 10 0x1>; /* Hypervisor PPI */
+                             <1 10 0xf08>; /* Hypervisor PPI */
        };
        pmu {
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
index 21023a388c29..e3b6034ea5d9 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
@@ -191,10 +191,10 @@
        timer {
                compatible = "arm,armv8-timer";
-                interrupts = <1 13 0x8>, /* Physical Secure PPI, active-low */
+                interrupts = <1 13 4>, /* Physical Secure PPI, active-low */
-                             <1 14 0x8>, /* Physical Non-Secure PPI, active-low */
+                             <1 14 4>, /* Physical Non-Secure PPI, active-low */
-                             <1 11 0x8>, /* Virtual PPI, active-low */
+                             <1 11 4>, /* Virtual PPI, active-low */
-                             <1 10 0x8>; /* Hypervisor PPI, active-low */
+                             <1 10 4>; /* Hypervisor PPI, active-low */
        };
        pmu {
diff --git a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
index eab1a42fb934..c2a6745f168c 100644
--- a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
@@ -122,10 +122,10 @@
                        timer {
                                compatible = "arm,armv8-timer";
-                                interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>,
+                                interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
-                                             <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>,
+                                             <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
-                                             <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>,
+                                             <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
-                                             <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
+                                             <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>;
                        };
                        odmi: odmi@300000 {
diff --git a/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi
index c223915f0907..d73bdc8c9115 100644
--- a/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi
+++ b/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi
@@ -129,10 +129,10 @@
        timer {
                compatible = "arm,armv8-timer";
-                interrupts = <1 13 0xf01>,
+                interrupts = <1 13 4>,
-                             <1 14 0xf01>,
+                             <1 14 4>,
-                             <1 11 0xf01>,
+                             <1 11 4>,
-                             <1 10 0xf01>;
+                             <1 10 4>;
        };
        soc {
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
index e595f22e7e4b..3e2e51fbd2bc 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
@@ -65,10 +65,10 @@
        timer {
                compatible = "arm,armv8-timer";
                interrupt-parent = <&gic>;
-                interrupts = <1 13 0xf01>,
+                interrupts = <1 13 0xf08>,
-                             <1 14 0xf01>,
+                             <1 14 0xf08>,
-                             <1 11 0xf01>,
+                             <1 11 0xf08>,
-                             <1 10 0xf01>;
+                             <1 10 0xf08>;
        };
        amba_apu {
diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
index 5c888049d061..6b2aa0fd6cd0 100644
--- a/arch/arm64/crypto/aes-glue.c
+++ b/arch/arm64/crypto/aes-glue.c
@@ -216,7 +216,7 @@ static int ctr_encrypt(struct blkcipher_desc *desc, struct scatterlist *dst,
                err = blkcipher_walk_done(desc, &walk,
                                          walk.nbytes % AES_BLOCK_SIZE);
        }
-        if (nbytes) {
+        if (walk.nbytes % AES_BLOCK_SIZE) {
                u8 *tdst = walk.dst.virt.addr + blocks * AES_BLOCK_SIZE;
                u8 *tsrc = walk.src.virt.addr + blocks * AES_BLOCK_SIZE;
                u8 __aligned(8) tail[AES_BLOCK_SIZE];
diff --git a/arch/avr32/lib/copy_user.S b/arch/avr32/lib/copy_user.S
index 96a6de9d578f..075373471da1 100644
--- a/arch/avr32/lib/copy_user.S
+++ b/arch/avr32/lib/copy_user.S
@@ -23,8 +23,8 @@
         */
        .text
        .align  1
-        .global copy_from_user
+        .global ___copy_from_user
-        .type   copy_from_user, @function
+        .type   ___copy_from_user, @function
 ___copy_from_user:
        branch_if_kernel r8, __copy_user
        ret_if_privileged r8, r11, r10, r10
diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h
index cbad29b5a131..5cc6b4f1b795 100644
--- a/arch/openrisc/include/asm/uaccess.h
+++ b/arch/openrisc/include/asm/uaccess.h
@@ -276,7 +276,7 @@ copy_from_user(void *to, const void *from, unsigned long n)
        unsigned long res = n;
        if (likely(access_ok(VERIFY_READ, from, n)))
-                n = __copy_tofrom_user(to, from, n);
+                res = __copy_tofrom_user(to, from, n);
        if (unlikely(res))
                memset(to + (n - res), 0, res);
        return res;
diff --git a/arch/powerpc/include/asm/cpu_has_feature.h b/arch/powerpc/include/asm/cpu_has_feature.h
index 2ef55f8968a2..b312b152461b 100644
--- a/arch/powerpc/include/asm/cpu_has_feature.h
+++ b/arch/powerpc/include/asm/cpu_has_feature.h
@@ -15,7 +15,7 @@ static inline bool early_cpu_has_feature(unsigned long feature)
 #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECKS
 #include <linux/jump_label.h>
-#define NUM_CPU_FTR_KEYS        64
+#define NUM_CPU_FTR_KEYS        BITS_PER_LONG
 extern struct static_key_true cpu_feature_keys[NUM_CPU_FTR_KEYS];
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index 2265c6398a17..bd739fed26e3 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -411,7 +411,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
 *
 * r13 - PACA
 * cr3 - gt if waking up with partial/complete hypervisor state loss
- * cr4 - eq if waking up from complete hypervisor state loss.
+ * cr4 - gt or eq if waking up from complete hypervisor state loss.
 */
 _GLOBAL(pnv_wakeup_tb_loss)
        ld      r1,PACAR1(r13)
@@ -453,7 +453,7 @@ lwarx_loop2:
         * At this stage
         * cr2 - eq if first thread to wakeup in core
         * cr3-  gt if waking up with partial/complete hypervisor state loss
-         * cr4 - eq if waking up from complete hypervisor state loss.
+         * cr4 - gt or eq if waking up from complete hypervisor state loss.
         */
        ori     r15,r15,PNV_CORE_IDLE_LOCK_BIT
@@ -481,7 +481,7 @@ first_thread_in_subcore:
         * If waking up from sleep, subcore state is not lost. Hence
         * skip subcore state restore
         */
-        bne     cr4,subcore_state_restored
+        blt     cr4,subcore_state_restored
        /* Restore per-subcore state */
        ld      r4,_SDR1(r1)
@@ -526,7 +526,7 @@ timebase_resync:
         * If waking up from sleep, per core state is not lost, skip to
         * clear_lock.
         */
-        bne     cr4,clear_lock
+        blt     cr4,clear_lock
        /*
         * First thread in the core to wake up and its waking up with
@@ -557,7 +557,7 @@ common_exit:
         * If waking up from sleep, hypervisor state is not lost. Hence
         * skip hypervisor state restore.
         */
-        bne     cr4,hypervisor_state_restored
+        blt     cr4,hypervisor_state_restored
        /* Waking up from winkle */
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index c16d790808f1..bc0c91e84ca0 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -2217,7 +2217,7 @@ static long pnv_pci_ioda2_set_window(struct iommu_table_group *table_group,
        pnv_pci_link_table_and_group(phb->hose->node, num,
                        tbl, &pe->table_group);
-        pnv_pci_phb3_tce_invalidate_pe(pe);
+        pnv_pci_ioda2_tce_invalidate_pe(pe);
        return 0;
 }
@@ -2355,7 +2355,7 @@ static long pnv_pci_ioda2_unset_window(struct iommu_table_group *table_group,
        if (ret)
                pe_warn(pe, "Unmapping failed, ret = %ld\n", ret);
        else
-                pnv_pci_phb3_tce_invalidate_pe(pe);
+                pnv_pci_ioda2_tce_invalidate_pe(pe);
        pnv_pci_unlink_table_and_group(table_group->tables[num], table_group);
@@ -3426,7 +3426,17 @@ static void pnv_ioda_release_pe(struct pnv_ioda_pe *pe)
                }
        }
-        pnv_ioda_free_pe(pe);
+        /*
+         * The PE for root bus can be removed because of hotplug in EEH
+         * recovery for fenced PHB error. We need to mark the PE dead so
+         * that it can be populated again in PCI hot add path. The PE
+         * shouldn't be destroyed as it's the global reserved resource.
+         */
+        if (phb->ioda.root_pe_populated &&
+            phb->ioda.root_pe_idx == pe->pe_number)
+                phb->ioda.root_pe_populated = false;
+        else
+                pnv_ioda_free_pe(pe);
 }
 static void pnv_pci_release_device(struct pci_dev *pdev)
@@ -3442,7 +3452,17 @@ static void pnv_pci_release_device(struct pci_dev *pdev)
        if (!pdn || pdn->pe_number == IODA_INVALID_PE)
                return;
+        /*
+         * PCI hotplug can happen as part of EEH error recovery. The @pdn
+         * isn't removed and added afterwards in this scenario. We should
+         * set the PE number in @pdn to an invalid one. Otherwise, the PE's
+         * device count is decreased on removing devices while failing to
+         * be increased on adding devices. It leads to unbalanced PE's device
+         * count and eventually make normal PCI hotplug path broken.
+         */
        pe = &phb->ioda.pe_array[pdn->pe_number];
+        pdn->pe_number = IODA_INVALID_PE;
        WARN_ON(--pe->device_count < 0);
        if (pe->device_count == 0)
                pnv_ioda_release_pe(pe);
diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
index e07a22bb9308..f5f4b3fbbbc2 100644
--- a/arch/x86/events/amd/core.c
+++ b/arch/x86/events/amd/core.c
@@ -119,8 +119,8 @@ static const u64 amd_perfmon_event_map[PERF_COUNT_HW_MAX] =
 {
  [PERF_COUNT_HW_CPU_CYCLES]                    = 0x0076,
  [PERF_COUNT_HW_INSTRUCTIONS]                  = 0x00c0,
-  [PERF_COUNT_HW_CACHE_REFERENCES]              = 0x0080,
+  [PERF_COUNT_HW_CACHE_REFERENCES]              = 0x077d,
-  [PERF_COUNT_HW_CACHE_MISSES]                  = 0x0081,
+  [PERF_COUNT_HW_CACHE_MISSES]                  = 0x077e,
  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]           = 0x00c2,
  [PERF_COUNT_HW_BRANCH_MISSES]                 = 0x00c3,
  [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND]       = 0x00d0, /* "Decoder empty" event */
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 2cbde2f449aa..4c9a79b9cd69 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -1730,9 +1730,11 @@ static __initconst const u64 knl_hw_cache_extra_regs
 * disabled state if called consecutively.
 *
 * During consecutive calls, the same disable value will be written to related
- * registers, so the PMU state remains unchanged. hw.state in
+ * registers, so the PMU state remains unchanged.
- * intel_bts_disable_local will remain PERF_HES_STOPPED too in consecutive
+ *
- * calls.
+ * intel_bts events don't coexist with intel PMU's BTS events because of
+ * x86_add_exclusive(x86_lbr_exclusive_lbr); there's no need to keep them
+ * disabled around intel PMU's event batching etc, only inside the PMI handler.
 */
 static void __intel_pmu_disable_all(void)
 {
@@ -1742,8 +1744,6 @@ static void __intel_pmu_disable_all(void)
        if (test_bit(INTEL_PMC_IDX_FIXED_BTS, cpuc->active_mask))
                intel_pmu_disable_bts();
-        else
-                intel_bts_disable_local();
        intel_pmu_pebs_disable_all();
 }
@@ -1771,8 +1771,7 @@ static void __intel_pmu_enable_all(int added, bool pmi)
                        return;
                intel_pmu_enable_bts(event->hw.config);
-        } else
+        }
-                intel_bts_enable_local();
 }
 static void intel_pmu_enable_all(int added)
@@ -2073,6 +2072,7 @@ static int intel_pmu_handle_irq(struct pt_regs *regs)
         */
        if (!x86_pmu.late_ack)
                apic_write(APIC_LVTPC, APIC_DM_NMI);
+        intel_bts_disable_local();
        __intel_pmu_disable_all();
        handled = intel_pmu_drain_bts_buffer();
        handled += intel_bts_interrupt();
@@ -2172,6 +2172,7 @@ done:
        /* Only restore PMU state when it's active. See x86_pmu_disable(). */
        if (cpuc->enabled)
                __intel_pmu_enable_all(0, true);
+        intel_bts_enable_local();
        /*
         * Only unmask the NMI after the overflow counters
diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index 04bb5fb5a8d7..861a7d9cb60f 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -1074,6 +1074,11 @@ static void pt_addr_filters_fini(struct perf_event *event)
        event->hw.addr_filters = NULL;
 }
+static inline bool valid_kernel_ip(unsigned long ip)
+{
+        return virt_addr_valid(ip) && kernel_ip(ip);
+}
 static int pt_event_addr_filters_validate(struct list_head *filters)
 {
        struct perf_addr_filter *filter;
@@ -1081,11 +1086,16 @@ static int pt_event_addr_filters_validate(struct list_head *filters)
        list_for_each_entry(filter, filters, entry) {
                /* PT doesn't support single address triggers */
-                if (!filter->range)
+                if (!filter->range || !filter->size)
                        return -EOPNOTSUPP;
-                if (!filter->inode && !kernel_ip(filter->offset))
+                if (!filter->inode) {
-                        return -EINVAL;
+                        if (!valid_kernel_ip(filter->offset))
+                                return -EINVAL;
+                        if (!valid_kernel_ip(filter->offset + filter->size))
+                                return -EINVAL;
+                }
                if (++range > pt_cap_get(PT_CAP_num_address_ranges))
                        return -EOPNOTSUPP;
@@ -1111,7 +1121,7 @@ static void pt_event_addr_filters_sync(struct perf_event *event)
                } else {
                        /* apply the offset */
                        msr_a = filter->offset + offs[range];
-                        msr_b = filter->size + msr_a;
+                        msr_b = filter->size + msr_a - 1;
                }
                filters->filter[range].msr_a  = msr_a;
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index e3af86f58eaf..2131c4ce7d8a 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -433,7 +433,11 @@ do {									\
 #define __get_user_asm_ex(x, addr, itype, rtype, ltype)                 \
        asm volatile("1:        mov"itype" %1,%"rtype"0\n"              \
                     "2:\n"                                             \
-                     _ASM_EXTABLE_EX(1b, 2b)                            \
+                     ".section .fixup,\"ax\"\n"                         \
+                     "3:xor"itype" %"rtype"0,%"rtype"0\n"               \
+                     "  jmp 2b\n"                                       \
+                     ".previous\n"                                      \
+                     _ASM_EXTABLE_EX(1b, 3b)                            \
                     : ltype(x) : "m" (__m(addr)))
 #define __put_user_nocheck(x, ptr, size)                        \
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 5f42d038fcb4..c7220ba94aa7 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -109,6 +109,7 @@ static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
 {
        bool new_val, old_val;
        struct kvm_ioapic *ioapic = vcpu->kvm->arch.vioapic;
+        struct dest_map *dest_map = &ioapic->rtc_status.dest_map;
        union kvm_ioapic_redirect_entry *e;
        e = &ioapic->redirtbl[RTC_GSI];
@@ -117,16 +118,17 @@ static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
                return;
        new_val = kvm_apic_pending_eoi(vcpu, e->fields.vector);
-        old_val = test_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
+        old_val = test_bit(vcpu->vcpu_id, dest_map->map);
        if (new_val == old_val)
                return;
        if (new_val) {
-                __set_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
+                __set_bit(vcpu->vcpu_id, dest_map->map);
+                dest_map->vectors[vcpu->vcpu_id] = e->fields.vector;
                ioapic->rtc_status.pending_eoi++;
        } else {
-                __clear_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
+                __clear_bit(vcpu->vcpu_id, dest_map->map);
                ioapic->rtc_status.pending_eoi--;
                rtc_status_pending_eoi_check_valid(ioapic);
        }
diff --git a/arch/x86/kvm/pmu_amd.c b/arch/x86/kvm/pmu_amd.c
index 39b91127ef07..cd944435dfbd 100644
--- a/arch/x86/kvm/pmu_amd.c
+++ b/arch/x86/kvm/pmu_amd.c
@@ -23,8 +23,8 @@
 static struct kvm_event_hw_type_mapping amd_event_mapping[] = {
        [0] = { 0x76, 0x00, PERF_COUNT_HW_CPU_CYCLES },
        [1] = { 0xc0, 0x00, PERF_COUNT_HW_INSTRUCTIONS },
-        [2] = { 0x80, 0x00, PERF_COUNT_HW_CACHE_REFERENCES },
+        [2] = { 0x7d, 0x07, PERF_COUNT_HW_CACHE_REFERENCES },
-        [3] = { 0x81, 0x00, PERF_COUNT_HW_CACHE_MISSES },
+        [3] = { 0x7e, 0x07, PERF_COUNT_HW_CACHE_MISSES },
        [4] = { 0xc2, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS },
        [5] = { 0xc3, 0x00, PERF_COUNT_HW_BRANCH_MISSES },
        [6] = { 0xd0, 0x00, PERF_COUNT_HW_STALLED_CYCLES_FRONTEND },
diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
index 369999530108..a832426820e8 100644
--- a/crypto/blkcipher.c
+++ b/crypto/blkcipher.c
@@ -233,6 +233,8 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
                return blkcipher_walk_done(desc, walk, -EINVAL);
        }
+        bsize = min(walk->walk_blocksize, n);
        walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY |
                         BLKCIPHER_WALK_DIFF);
        if (!scatterwalk_aligned(&walk->in, walk->alignmask) ||
@@ -245,7 +247,6 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
                }
        }
-        bsize = min(walk->walk_blocksize, n);
        n = scatterwalk_clamp(&walk->in, n);
        n = scatterwalk_clamp(&walk->out, n);
diff --git a/crypto/echainiv.c b/crypto/echainiv.c
index 1b01fe98e91f..e3d889b122e0 100644
--- a/crypto/echainiv.c
+++ b/crypto/echainiv.c
@@ -1,8 +1,8 @@
 /*
 * echainiv: Encrypted Chain IV Generator
 *
- * This generator generates an IV based on a sequence number by xoring it
+ * This generator generates an IV based on a sequence number by multiplying
- * with a salt and then encrypting it with the same key as used to encrypt
+ * it with a salt and then encrypting it with the same key as used to encrypt
 * the plain text.  This algorithm requires that the block size be equal
 * to the IV size.  It is mainly useful for CBC.
 *
@@ -24,81 +24,17 @@
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/mm.h>
 #include <linux/module.h>
-#include <linux/percpu.h>
+#include <linux/slab.h>
-#include <linux/spinlock.h>
 #include <linux/string.h>
-#define MAX_IV_SIZE 16
-static DEFINE_PER_CPU(u32 [MAX_IV_SIZE / sizeof(u32)], echainiv_iv);
-/* We don't care if we get preempted and read/write IVs from the next CPU. */
-static void echainiv_read_iv(u8 *dst, unsigned size)
-{
-        u32 *a = (u32 *)dst;
-        u32 __percpu *b = echainiv_iv;
-        for (; size >= 4; size -= 4) {
-                *a++ = this_cpu_read(*b);
-                b++;
-        }
-}
-static void echainiv_write_iv(const u8 *src, unsigned size)
-{
-        const u32 *a = (const u32 *)src;
-        u32 __percpu *b = echainiv_iv;
-        for (; size >= 4; size -= 4) {
-                this_cpu_write(*b, *a);
-                a++;
-                b++;
-        }
-}
-static void echainiv_encrypt_complete2(struct aead_request *req, int err)
-{
-        struct aead_request *subreq = aead_request_ctx(req);
-        struct crypto_aead *geniv;
-        unsigned int ivsize;
-        if (err == -EINPROGRESS)
-                return;
-        if (err)
-                goto out;
-        geniv = crypto_aead_reqtfm(req);
-        ivsize = crypto_aead_ivsize(geniv);
-        echainiv_write_iv(subreq->iv, ivsize);
-        if (req->iv != subreq->iv)
-                memcpy(req->iv, subreq->iv, ivsize);
-out:
-        if (req->iv != subreq->iv)
-                kzfree(subreq->iv);
-}
-static void echainiv_encrypt_complete(struct crypto_async_request *base,
-                                         int err)
-{
-        struct aead_request *req = base->data;
-        echainiv_encrypt_complete2(req, err);
-        aead_request_complete(req, err);
-}
 static int echainiv_encrypt(struct aead_request *req)
 {
        struct crypto_aead *geniv = crypto_aead_reqtfm(req);
        struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
        struct aead_request *subreq = aead_request_ctx(req);
-        crypto_completion_t compl;
+        __be64 nseqno;
-        void *data;
+        u64 seqno;
        u8 *info;
        unsigned int ivsize = crypto_aead_ivsize(geniv);
        int err;
@@ -108,8 +44,6 @@ static int echainiv_encrypt(struct aead_request *req)
        aead_request_set_tfm(subreq, ctx->child);
-        compl = echainiv_encrypt_complete;
-        data = req;
        info = req->iv;
        if (req->src != req->dst) {
@@ -127,29 +61,30 @@ static int echainiv_encrypt(struct aead_request *req)
                        return err;
        }
-        if (unlikely(!IS_ALIGNED((unsigned long)info,
+        aead_request_set_callback(subreq, req->base.flags,
-                                 crypto_aead_alignmask(geniv) + 1))) {
+                                  req->base.complete, req->base.data);
-                info = kmalloc(ivsize, req->base.flags &
-                                       CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
-                                                                  GFP_ATOMIC);
-                if (!info)
-                        return -ENOMEM;
-                memcpy(info, req->iv, ivsize);
-        }
-        aead_request_set_callback(subreq, req->base.flags, compl, data);
        aead_request_set_crypt(subreq, req->dst, req->dst,
                               req->cryptlen, info);
        aead_request_set_ad(subreq, req->assoclen);
-        crypto_xor(info, ctx->salt, ivsize);
+        memcpy(&nseqno, info + ivsize - 8, 8);
+        seqno = be64_to_cpu(nseqno);
+        memset(info, 0, ivsize);
        scatterwalk_map_and_copy(info, req->dst, req->assoclen, ivsize, 1);
-        echainiv_read_iv(info, ivsize);
-        err = crypto_aead_encrypt(subreq);
+        do {
-        echainiv_encrypt_complete2(req, err);
+                u64 a;
-        return err;
+                memcpy(&a, ctx->salt + ivsize - 8, 8);
+                a |= 1;
+                a *= seqno;
+                memcpy(info + ivsize - 8, &a, 8);
+        } while ((ivsize -= 8));
+        return crypto_aead_encrypt(subreq);
 }
 static int echainiv_decrypt(struct aead_request *req)
@@ -196,8 +131,7 @@ static int echainiv_aead_create(struct crypto_template *tmpl,
        alg = crypto_spawn_aead_alg(spawn);
        err = -EINVAL;
-        if (inst->alg.ivsize & (sizeof(u32) - 1) ||
+        if (inst->alg.ivsize & (sizeof(u64) - 1) || !inst->alg.ivsize)
-            inst->alg.ivsize > MAX_IV_SIZE)
                goto free_inst;
        inst->alg.encrypt = echainiv_encrypt;
@@ -206,7 +140,6 @@ static int echainiv_aead_create(struct crypto_template *tmpl,
        inst->alg.init = aead_init_geniv;
        inst->alg.exit = aead_exit_geniv;
-        inst->alg.base.cra_alignmask |= __alignof__(u32) - 1;
        inst->alg.base.cra_ctxsize = sizeof(struct aead_geniv_ctx);
        inst->alg.base.cra_ctxsize += inst->alg.ivsize;
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 17995fadebd7..82a081ea4317 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -419,7 +419,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
        struct device *parent = NULL;
        int retval;
-        trace_rpm_suspend(dev, rpmflags);
+        trace_rpm_suspend_rcuidle(dev, rpmflags);
 repeat:
        retval = rpm_check_suspend_allowed(dev);
@@ -549,7 +549,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
        }
 out:
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
        return retval;
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
index a978381ef95b..9b17a66cf0e1 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
@@ -387,7 +387,7 @@ void atmel_hlcdc_crtc_irq(struct drm_crtc *c)
        atmel_hlcdc_crtc_finish_page_flip(drm_crtc_to_atmel_hlcdc_crtc(c));
 }
-void atmel_hlcdc_crtc_reset(struct drm_crtc *crtc)
+static void atmel_hlcdc_crtc_reset(struct drm_crtc *crtc)
 {
        struct atmel_hlcdc_crtc_state *state;
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
index 016c191221f3..52c527f6642a 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -320,19 +320,19 @@ atmel_hlcdc_plane_update_pos_and_size(struct atmel_hlcdc_plane *plane,
                        u32 *coeff_tab = heo_upscaling_ycoef;
                        u32 max_memsize;
-                        if (state->crtc_w < state->src_w)
+                        if (state->crtc_h < state->src_h)
                                coeff_tab = heo_downscaling_ycoef;
                        for (i = 0; i < ARRAY_SIZE(heo_upscaling_ycoef); i++)
                                atmel_hlcdc_layer_update_cfg(&plane->layer,
                                                             33 + i,
                                                             0xffffffff,
                                                             coeff_tab[i]);
-                        factor = ((8 * 256 * state->src_w) - (256 * 4)) /
+                        factor = ((8 * 256 * state->src_h) - (256 * 4)) /
-                                 state->crtc_w;
+                                 state->crtc_h;
                        factor++;
-                        max_memsize = ((factor * state->crtc_w) + (256 * 4)) /
+                        max_memsize = ((factor * state->crtc_h) + (256 * 4)) /
                                      2048;
-                        if (max_memsize > state->src_w)
+                        if (max_memsize > state->src_h)
                                factor--;
                        factor_reg |= (factor << 16) | 0x80000000;
                }
diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 57676f8d7ecf..a6289752be16 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -1015,6 +1015,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
        return 0;
 }
+#if defined(CONFIG_X86) || defined(CONFIG_IA64)
 typedef struct drm_mode_fb_cmd232 {
        u32 fb_id;
        u32 width;
@@ -1071,6 +1072,7 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
        return 0;
 }
+#endif
 static drm_ioctl_compat_t *drm_compat_ioctls[] = {
        [DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
@@ -1104,7 +1106,9 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
        [DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw,
 #endif
        [DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank,
+#if defined(CONFIG_X86) || defined(CONFIG_IA64)
        [DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)] = compat_drm_mode_addfb2,
+#endif
 };
 /**
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index e0166403b4bd..40ce841eb952 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -55,11 +55,11 @@ static int check_fb_gem_memory_type(struct drm_device *drm_dev,
        flags = exynos_gem->flags;
        /*
-         * without iommu support, not support physically non-continuous memory
+         * Physically non-contiguous memory type for framebuffer is not
-         * for framebuffer.
+         * supported without IOMMU.
         */
        if (IS_NONCONTIG_BUFFER(flags)) {
-                DRM_ERROR("cannot use this gem memory type for fb.\n");
+                DRM_ERROR("Non-contiguous GEM memory is not supported.\n");
                return -EINVAL;
        }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index 0525c56145db..147ef0d298cb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -1753,32 +1753,6 @@ static int fimc_clk_ctrl(struct fimc_context *ctx, bool enable)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
-static int fimc_suspend(struct device *dev)
-{
-        struct fimc_context *ctx = get_fimc_context(dev);
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-        if (pm_runtime_suspended(dev))
-                return 0;
-        return fimc_clk_ctrl(ctx, false);
-}
-static int fimc_resume(struct device *dev)
-{
-        struct fimc_context *ctx = get_fimc_context(dev);
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-        if (!pm_runtime_suspended(dev))
-                return fimc_clk_ctrl(ctx, true);
-        return 0;
-}
-#endif
 static int fimc_runtime_suspend(struct device *dev)
 {
        struct fimc_context *ctx = get_fimc_context(dev);
@@ -1799,7 +1773,8 @@ static int fimc_runtime_resume(struct device *dev)
 #endif
 static const struct dev_pm_ops fimc_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(fimc_suspend, fimc_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
        SET_RUNTIME_PM_OPS(fimc_runtime_suspend, fimc_runtime_resume, NULL)
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 4bf00f57ffe8..6eca8bb88648 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -1475,8 +1475,8 @@ static int g2d_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
-static int g2d_suspend(struct device *dev)
+static int g2d_runtime_suspend(struct device *dev)
 {
        struct g2d_data *g2d = dev_get_drvdata(dev);
@@ -1490,25 +1490,6 @@ static int g2d_suspend(struct device *dev)
        flush_work(&g2d->runqueue_work);
-        return 0;
-}
-static int g2d_resume(struct device *dev)
-{
-        struct g2d_data *g2d = dev_get_drvdata(dev);
-        g2d->suspended = false;
-        g2d_exec_runqueue(g2d);
-        return 0;
-}
-#endif
-#ifdef CONFIG_PM
-static int g2d_runtime_suspend(struct device *dev)
-{
-        struct g2d_data *g2d = dev_get_drvdata(dev);
        clk_disable_unprepare(g2d->gate_clk);
        return 0;
@@ -1523,12 +1504,16 @@ static int g2d_runtime_resume(struct device *dev)
        if (ret < 0)
                dev_warn(dev, "failed to enable clock.\n");
+        g2d->suspended = false;
+        g2d_exec_runqueue(g2d);
        return ret;
 }
 #endif
 static const struct dev_pm_ops g2d_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(g2d_suspend, g2d_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
        SET_RUNTIME_PM_OPS(g2d_runtime_suspend, g2d_runtime_resume, NULL)
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index 5d20da8f957e..52a9d269484e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -1760,34 +1760,7 @@ static int gsc_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
+static int __maybe_unused gsc_runtime_suspend(struct device *dev)
-static int gsc_suspend(struct device *dev)
-{
-        struct gsc_context *ctx = get_gsc_context(dev);
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-        if (pm_runtime_suspended(dev))
-                return 0;
-        return gsc_clk_ctrl(ctx, false);
-}
-static int gsc_resume(struct device *dev)
-{
-        struct gsc_context *ctx = get_gsc_context(dev);
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-        if (!pm_runtime_suspended(dev))
-                return gsc_clk_ctrl(ctx, true);
-        return 0;
-}
-#endif
-#ifdef CONFIG_PM
-static int gsc_runtime_suspend(struct device *dev)
 {
        struct gsc_context *ctx = get_gsc_context(dev);
@@ -1796,7 +1769,7 @@ static int gsc_runtime_suspend(struct device *dev)
        return  gsc_clk_ctrl(ctx, false);
 }
-static int gsc_runtime_resume(struct device *dev)
+static int __maybe_unused gsc_runtime_resume(struct device *dev)
 {
        struct gsc_context *ctx = get_gsc_context(dev);
@@ -1804,10 +1777,10 @@ static int gsc_runtime_resume(struct device *dev)
        return  gsc_clk_ctrl(ctx, true);
 }
-#endif
 static const struct dev_pm_ops gsc_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(gsc_suspend, gsc_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
        SET_RUNTIME_PM_OPS(gsc_runtime_suspend, gsc_runtime_resume, NULL)
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index 404367a430b5..6591e406084c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -794,29 +794,6 @@ static int rotator_clk_crtl(struct rot_context *rot, bool enable)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
-static int rotator_suspend(struct device *dev)
-{
-        struct rot_context *rot = dev_get_drvdata(dev);
-        if (pm_runtime_suspended(dev))
-                return 0;
-        return rotator_clk_crtl(rot, false);
-}
-static int rotator_resume(struct device *dev)
-{
-        struct rot_context *rot = dev_get_drvdata(dev);
-        if (!pm_runtime_suspended(dev))
-                return rotator_clk_crtl(rot, true);
-        return 0;
-}
-#endif
 static int rotator_runtime_suspend(struct device *dev)
 {
        struct rot_context *rot = dev_get_drvdata(dev);
@@ -833,7 +810,8 @@ static int rotator_runtime_resume(struct device *dev)
 #endif
 static const struct dev_pm_ops rotator_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(rotator_suspend, rotator_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
        SET_RUNTIME_PM_OPS(rotator_runtime_suspend, rotator_runtime_resume,
                                                                        NULL)
 };
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 95ddd56b89f0..5de36d8dcc68 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1281,6 +1281,11 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
        intel_runtime_pm_enable(dev_priv);
+        /* Everything is in place, we can now relax! */
+        DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n",
+                 driver.name, driver.major, driver.minor, driver.patchlevel,
+                 driver.date, pci_name(pdev), dev_priv->drm.primary->index);
        intel_runtime_pm_put(dev_priv);
        return 0;
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 7a30af79d799..f38ceffd82c3 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -122,8 +122,11 @@ int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
        has_full_48bit_ppgtt =
                IS_BROADWELL(dev_priv) || INTEL_GEN(dev_priv) >= 9;
-        if (intel_vgpu_active(dev_priv))
+        if (intel_vgpu_active(dev_priv)) {
-                has_full_ppgtt = false; /* emulation is too hard */
+                /* emulation is too hard */
+                has_full_ppgtt = false;
+                has_full_48bit_ppgtt = false;
+        }
        if (!has_aliasing_ppgtt)
                return 0;
@@ -158,7 +161,7 @@ int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
                return 0;
        }
-        if (INTEL_GEN(dev_priv) >= 8 && i915.enable_execlists)
+        if (INTEL_GEN(dev_priv) >= 8 && i915.enable_execlists && has_full_ppgtt)
                return has_full_48bit_ppgtt ? 3 : 2;
        else
                return has_aliasing_ppgtt ? 1 : 0;
diff --git a/drivers/gpu/drm/i915/i915_vgpu.c b/drivers/gpu/drm/i915/i915_vgpu.c
index f6acb5a0e701..b81cfb3b22ec 100644
--- a/drivers/gpu/drm/i915/i915_vgpu.c
+++ b/drivers/gpu/drm/i915/i915_vgpu.c
@@ -65,9 +65,6 @@ void i915_check_vgpu(struct drm_i915_private *dev_priv)
        BUILD_BUG_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE);
-        if (!IS_HASWELL(dev_priv))
-                return;
        magic = __raw_i915_read64(dev_priv, vgtif_reg(magic));
        if (magic != VGT_MAGIC)
                return;
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index 47bdf9dad0d3..b9e5a63a7c9e 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -554,7 +554,6 @@ void intel_dvo_init(struct drm_device *dev)
                return;
        }
-        drm_encoder_cleanup(&intel_encoder->base);
        kfree(intel_dvo);
        kfree(intel_connector);
 }
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index adca262d591a..7acbbbf97833 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -1047,6 +1047,23 @@ err_out:
        return err;
 }
+static int intel_use_opregion_panel_type_callback(const struct dmi_system_id *id)
+{
+        DRM_INFO("Using panel type from OpRegion on %s\n", id->ident);
+        return 1;
+}
+static const struct dmi_system_id intel_use_opregion_panel_type[] = {
+        {
+                .callback = intel_use_opregion_panel_type_callback,
+                .ident = "Conrac GmbH IX45GM2",
+                .matches = {DMI_MATCH(DMI_SYS_VENDOR, "Conrac GmbH"),
+                            DMI_MATCH(DMI_PRODUCT_NAME, "IX45GM2"),
+                },
+        },
+        { }
+};
 int
 intel_opregion_get_panel_type(struct drm_i915_private *dev_priv)
 {
@@ -1073,6 +1090,16 @@ intel_opregion_get_panel_type(struct drm_i915_private *dev_priv)
        }
        /*
+         * So far we know that some machined must use it, others must not use it.
+         * There doesn't seem to be any way to determine which way to go, except
+         * via a quirk list :(
+         */
+        if (!dmi_check_system(intel_use_opregion_panel_type)) {
+                DRM_DEBUG_KMS("Ignoring OpRegion panel type (%d)\n", ret - 1);
+                return -ENODEV;
+        }
+        /*
         * FIXME On Dell XPS 13 9350 the OpRegion panel type (0) gives us
         * low vswing for eDP, whereas the VBT panel type (2) gives us normal
         * vswing instead. Low vswing results in some display flickers, so
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 53e13c10e4ea..2d2481392824 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -7859,6 +7859,7 @@ static inline int gen6_check_mailbox_status(struct drm_i915_private *dev_priv)
        case GEN6_PCODE_ILLEGAL_CMD:
                return -ENXIO;
        case GEN6_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE:
+        case GEN7_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE:
                return -EOVERFLOW;
        case GEN6_PCODE_TIMEOUT:
                return -ETIMEDOUT;
diff --git a/drivers/gpu/drm/i915/intel_psr.c b/drivers/gpu/drm/i915/intel_psr.c
index 2b0d1baf15b3..cf171b4b8c67 100644
--- a/drivers/gpu/drm/i915/intel_psr.c
+++ b/drivers/gpu/drm/i915/intel_psr.c
@@ -255,14 +255,14 @@ static void hsw_psr_enable_source(struct intel_dp *intel_dp)
        struct drm_i915_private *dev_priv = to_i915(dev);
        uint32_t max_sleep_time = 0x1f;
-        /* Lately it was identified that depending on panel idle frame count
+        /*
-         * calculated at HW can be off by 1. So let's use what came
+         * Let's respect VBT in case VBT asks a higher idle_frame value.
-         * from VBT + 1.
+         * Let's use 6 as the minimum to cover all known cases including
-         * There are also other cases where panel demands at least 4
+         * the off-by-one issue that HW has in some cases. Also there are
-         * but VBT is not being set. To cover these 2 cases lets use
+         * cases where sink should be able to train
-         * at least 5 when VBT isn't set to be on the safest side.
+         * with the 5 or 6 idle patterns.
         */
-        uint32_t idle_frames = dev_priv->vbt.psr.idle_frames + 1;
+        uint32_t idle_frames = max(6, dev_priv->vbt.psr.idle_frames);
        uint32_t val = EDP_PSR_ENABLE;
        val |= max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT;
diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
index 59adcf8532dd..3f6704cf6608 100644
--- a/drivers/gpu/drm/vc4/vc4_bo.c
+++ b/drivers/gpu/drm/vc4/vc4_bo.c
@@ -144,7 +144,7 @@ static struct list_head *vc4_get_cache_list_for_size(struct drm_device *dev,
        return &vc4->bo_cache.size_list[page_index];
 }
-void vc4_bo_cache_purge(struct drm_device *dev)
+static void vc4_bo_cache_purge(struct drm_device *dev)
 {
        struct vc4_dev *vc4 = to_vc4_dev(dev);
diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
index 46527e989ce3..2543cf5b8b51 100644
--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -309,8 +309,14 @@ validate_uniform_address_write(struct vc4_validated_shader_info *validated_shade
         * of uniforms on each side.  However, this scheme is easy to
         * validate so it's all we allow for now.
         */
+        switch (QPU_GET_FIELD(inst, QPU_SIG)) {
-        if (QPU_GET_FIELD(inst, QPU_SIG) != QPU_SIG_NONE) {
+        case QPU_SIG_NONE:
+        case QPU_SIG_SCOREBOARD_UNLOCK:
+        case QPU_SIG_COLOR_LOAD:
+        case QPU_SIG_LOAD_TMU0:
+        case QPU_SIG_LOAD_TMU1:
+                break;
+        default:
                DRM_ERROR("uniforms address change must be "
                          "normal math\n");
                return false;
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index b6a953aed7e8..80f988984f44 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -333,6 +333,8 @@ static void remove_ep_tid(struct c4iw_ep *ep)
        spin_lock_irqsave(&ep->com.dev->lock, flags);
        _remove_handle(ep->com.dev, &ep->com.dev->hwtid_idr, ep->hwtid, 0);
+        if (idr_is_empty(&ep->com.dev->hwtid_idr))
+                wake_up(&ep->com.dev->wait);
        spin_unlock_irqrestore(&ep->com.dev->lock, flags);
 }
@@ -2117,8 +2119,10 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
                }
                ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
                                        n, pdev, rt_tos2priority(tos));
-                if (!ep->l2t)
+                if (!ep->l2t) {
+                        dev_put(pdev);
                        goto out;
+                }
                ep->mtu = pdev->mtu;
                ep->tx_chan = cxgb4_port_chan(pdev);
                ep->smac_idx = cxgb4_tp_smt_idx(adapter_type,
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 071d7332ec06..3c4b2126e0d1 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -872,9 +872,13 @@ static void c4iw_rdev_close(struct c4iw_rdev *rdev)
 static void c4iw_dealloc(struct uld_ctx *ctx)
 {
        c4iw_rdev_close(&ctx->dev->rdev);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->cqidr));
        idr_destroy(&ctx->dev->cqidr);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->qpidr));
        idr_destroy(&ctx->dev->qpidr);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->mmidr));
        idr_destroy(&ctx->dev->mmidr);
+        wait_event(ctx->dev->wait, idr_is_empty(&ctx->dev->hwtid_idr));
        idr_destroy(&ctx->dev->hwtid_idr);
        idr_destroy(&ctx->dev->stid_idr);
        idr_destroy(&ctx->dev->atid_idr);
@@ -992,6 +996,7 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
        mutex_init(&devp->rdev.stats.lock);
        mutex_init(&devp->db_mutex);
        INIT_LIST_HEAD(&devp->db_fc_list);
+        init_waitqueue_head(&devp->wait);
        devp->avail_ird = devp->rdev.lldi.max_ird_adapter;
        if (c4iw_debugfs_root) {
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index aa47e0ae80bc..4b83b84f7ddf 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -263,6 +263,7 @@ struct c4iw_dev {
        struct idr stid_idr;
        struct list_head db_fc_list;
        u32 avail_ird;
+        wait_queue_head_t wait;
 };
 static inline struct c4iw_dev *to_c4iw_dev(struct ib_device *ibdev)
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 9c2e53d28f98..0f21c3a25552 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1128,6 +1128,27 @@ void handle_port_mgmt_change_event(struct work_struct *work)
                /* Generate GUID changed event */
                if (changed_attr & MLX4_EQ_PORT_INFO_GID_PFX_CHANGE_MASK) {
+                        if (mlx4_is_master(dev->dev)) {
+                                union ib_gid gid;
+                                int err = 0;
+                                if (!eqe->event.port_mgmt_change.params.port_info.gid_prefix)
+                                        err = __mlx4_ib_query_gid(&dev->ib_dev, port, 0, &gid, 1);
+                                else
+                                        gid.global.subnet_prefix =
+                                                eqe->event.port_mgmt_change.params.port_info.gid_prefix;
+                                if (err) {
+                                        pr_warn("Could not change QP1 subnet prefix for port %d: query_gid error (%d)\n",
+                                                port, err);
+                                } else {
+                                        pr_debug("Changing QP1 subnet prefix for port %d. old=0x%llx. new=0x%llx\n",
+                                                 port,
+                                                 (u64)atomic64_read(&dev->sriov.demux[port - 1].subnet_prefix),
+                                                 be64_to_cpu(gid.global.subnet_prefix));
+                                        atomic64_set(&dev->sriov.demux[port - 1].subnet_prefix,
+                                                     be64_to_cpu(gid.global.subnet_prefix));
+                                }
+                        }
                        mlx4_ib_dispatch_event(dev, port, IB_EVENT_GID_CHANGE);
                        /*if master, notify all slaves*/
                        if (mlx4_is_master(dev->dev))
@@ -2202,6 +2223,8 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev)
                if (err)
                        goto demux_err;
                dev->sriov.demux[i].guid_cache[0] = gid.global.interface_id;
+                atomic64_set(&dev->sriov.demux[i].subnet_prefix,
+                             be64_to_cpu(gid.global.subnet_prefix));
                err = alloc_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1,
                                      &dev->sriov.sqps[i]);
                if (err)
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 2af44c2de262..87ba9bca4181 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -2202,6 +2202,9 @@ static int mlx4_ib_alloc_diag_counters(struct mlx4_ib_dev *ibdev)
        bool per_port = !!(ibdev->dev->caps.flags2 &
                MLX4_DEV_CAP_FLAG2_DIAG_PER_PORT);
+        if (mlx4_is_slave(ibdev->dev))
+                return 0;
        for (i = 0; i < MLX4_DIAG_COUNTERS_TYPES; i++) {
                /* i == 1 means we are building port counters */
                if (i && !per_port)
diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
index 8f7ad07915b0..097bfcc4ee99 100644
--- a/drivers/infiniband/hw/mlx4/mcg.c
+++ b/drivers/infiniband/hw/mlx4/mcg.c
@@ -489,7 +489,7 @@ static u8 get_leave_state(struct mcast_group *group)
                if (!group->members[i])
                        leave_state |= (1 << i);
-        return leave_state & (group->rec.scope_join_state & 7);
+        return leave_state & (group->rec.scope_join_state & 0xf);
 }
 static int join_group(struct mcast_group *group, int slave, u8 join_mask)
@@ -564,8 +564,8 @@ static void mlx4_ib_mcg_timeout_handler(struct work_struct *work)
                } else
                        mcg_warn_group(group, "DRIVER BUG\n");
        } else if (group->state == MCAST_LEAVE_SENT) {
-                if (group->rec.scope_join_state & 7)
+                if (group->rec.scope_join_state & 0xf)
-                        group->rec.scope_join_state &= 0xf8;
+                        group->rec.scope_join_state &= 0xf0;
                group->state = MCAST_IDLE;
                mutex_unlock(&group->lock);
                if (release_group(group, 1))
@@ -605,7 +605,7 @@ static int handle_leave_req(struct mcast_group *group, u8 leave_mask,
 static int handle_join_req(struct mcast_group *group, u8 join_mask,
                           struct mcast_req *req)
 {
-        u8 group_join_state = group->rec.scope_join_state & 7;
+        u8 group_join_state = group->rec.scope_join_state & 0xf;
        int ref = 0;
        u16 status;
        struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
@@ -690,8 +690,8 @@ static void mlx4_ib_mcg_work_handler(struct work_struct *work)
                        u8 cur_join_state;
                        resp_join_state = ((struct ib_sa_mcmember_data *)
-                                                group->response_sa_mad.data)->scope_join_state & 7;
+                                                group->response_sa_mad.data)->scope_join_state & 0xf;
-                        cur_join_state = group->rec.scope_join_state & 7;
+                        cur_join_state = group->rec.scope_join_state & 0xf;
                        if (method == IB_MGMT_METHOD_GET_RESP) {
                                /* successfull join */
@@ -710,7 +710,7 @@ process_requests:
                req = list_first_entry(&group->pending_list, struct mcast_req,
                                       group_list);
                sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
-                req_join_state = sa_data->scope_join_state & 0x7;
+                req_join_state = sa_data->scope_join_state & 0xf;
                /* For a leave request, we will immediately answer the VF, and
                 * update our internal counters. The actual leave will be sent
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 7c5832ede4bd..686ab48ff644 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -448,7 +448,7 @@ struct mlx4_ib_demux_ctx {
        struct workqueue_struct *wq;
        struct workqueue_struct *ud_wq;
        spinlock_t ud_lock;
-        __be64 subnet_prefix;
+        atomic64_t subnet_prefix;
        __be64 guid_cache[128];
        struct mlx4_ib_dev *dev;
        /* the following lock protects both mcg_table and mcg_mgid0_list */
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 768085f59566..7fb9629bd12b 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -2493,24 +2493,27 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_ud_wr *wr,
                sqp->ud_header.grh.flow_label    =
                        ah->av.ib.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
                sqp->ud_header.grh.hop_limit     = ah->av.ib.hop_limit;
-                if (is_eth)
+                if (is_eth) {
                        memcpy(sqp->ud_header.grh.source_gid.raw, sgid.raw, 16);
-                else {
+                } else {
-                if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
+                        if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
-                        /* When multi-function is enabled, the ib_core gid
+                                /* When multi-function is enabled, the ib_core gid
-                         * indexes don't necessarily match the hw ones, so
+                                 * indexes don't necessarily match the hw ones, so
-                         * we must use our own cache */
+                                 * we must use our own cache
-                        sqp->ud_header.grh.source_gid.global.subnet_prefix =
+                                 */
-                                to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+                                sqp->ud_header.grh.source_gid.global.subnet_prefix =
-                                                       subnet_prefix;
+                                        cpu_to_be64(atomic64_read(&(to_mdev(ib_dev)->sriov.
-                        sqp->ud_header.grh.source_gid.global.interface_id =
+                                                                    demux[sqp->qp.port - 1].
-                                to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+                                                                    subnet_prefix)));
-                                               guid_cache[ah->av.ib.gid_index];
+                                sqp->ud_header.grh.source_gid.global.interface_id =
-                } else
+                                        to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-                        ib_get_cached_gid(ib_dev,
+                                                       guid_cache[ah->av.ib.gid_index];
-                                          be32_to_cpu(ah->av.ib.port_pd) >> 24,
+                        } else {
-                                          ah->av.ib.gid_index,
+                                ib_get_cached_gid(ib_dev,
-                                          &sqp->ud_header.grh.source_gid, NULL);
+                                                  be32_to_cpu(ah->av.ib.port_pd) >> 24,
+                                                  ah->av.ib.gid_index,
+                                                  &sqp->ud_header.grh.source_gid, NULL);
+                        }
                }
                memcpy(sqp->ud_header.grh.destination_gid.raw,
                       ah->av.ib.dgid, 16);
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 8150ea372c53..e19537cf44ab 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -288,7 +288,9 @@ __be16 mlx5_get_roce_udp_sport(struct mlx5_ib_dev *dev, u8 port_num,
 static int mlx5_use_mad_ifc(struct mlx5_ib_dev *dev)
 {
-        return !MLX5_CAP_GEN(dev->mdev, ib_virt);
+        if (MLX5_CAP_GEN(dev->mdev, port_type) == MLX5_CAP_PORT_TYPE_IB)
+                return !MLX5_CAP_GEN(dev->mdev, ib_virt);
+        return 0;
 }
 enum {
@@ -1428,6 +1430,13 @@ static int parse_flow_attr(u32 *match_c, u32 *match_v,
                                             dmac_47_16),
                                ib_spec->eth.val.dst_mac);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+                                             smac_47_16),
+                                ib_spec->eth.mask.src_mac);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+                                             smac_47_16),
+                                ib_spec->eth.val.src_mac);
                if (ib_spec->eth.mask.vlan_tag) {
                        MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
                                 vlan_tag, 1);
diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
index 80c4b6b401b8..46b64970058e 100644
--- a/drivers/infiniband/sw/rdmavt/mr.c
+++ b/drivers/infiniband/sw/rdmavt/mr.c
@@ -294,7 +294,7 @@ static void __rvt_free_mr(struct rvt_mr *mr)
 {
        rvt_deinit_mregion(&mr->mr);
        rvt_free_lkey(&mr->mr);
-        vfree(mr);
+        kfree(mr);
 }
 /**
diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
index 55f0e8f0ca79..ddd59270ff6d 100644
--- a/drivers/infiniband/sw/rxe/rxe.c
+++ b/drivers/infiniband/sw/rxe/rxe.c
@@ -362,15 +362,34 @@ static int __init rxe_module_init(void)
                return err;
        }
-        err = rxe_net_init();
+        err = rxe_net_ipv4_init();
        if (err) {
-                pr_err("rxe: unable to init\n");
+                pr_err("rxe: unable to init ipv4 tunnel\n");
                rxe_cache_exit();
-                return err;
+                goto exit;
+        }
+        err = rxe_net_ipv6_init();
+        if (err) {
+                pr_err("rxe: unable to init ipv6 tunnel\n");
+                rxe_cache_exit();
+                goto exit;
        }
+        err = register_netdevice_notifier(&rxe_net_notifier);
+        if (err) {
+                pr_err("rxe: Failed to rigister netdev notifier\n");
+                goto exit;
+        }
        pr_info("rxe: loaded\n");
        return 0;
+exit:
+        rxe_release_udp_tunnel(recv_sockets.sk4);
+        rxe_release_udp_tunnel(recv_sockets.sk6);
+        return err;
 }
 static void __exit rxe_module_exit(void)
diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
index 36f67de44095..1c59ef2c67aa 100644
--- a/drivers/infiniband/sw/rxe/rxe_comp.c
+++ b/drivers/infiniband/sw/rxe/rxe_comp.c
@@ -689,7 +689,14 @@ int rxe_completer(void *arg)
                                        qp->req.need_retry = 1;
                                        rxe_run_task(&qp->req.task, 1);
                                }
+                                if (pkt) {
+                                        rxe_drop_ref(pkt->qp);
+                                        kfree_skb(skb);
+                                }
                                goto exit;
                        } else {
                                wqe->status = IB_WC_RETRY_EXC_ERR;
                                state = COMPST_ERROR;
@@ -716,6 +723,12 @@ int rxe_completer(void *arg)
                case COMPST_ERROR:
                        do_complete(qp, wqe);
                        rxe_qp_error(qp);
+                        if (pkt) {
+                                rxe_drop_ref(pkt->qp);
+                                kfree_skb(skb);
+                        }
                        goto exit;
                }
        }
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index 0b8d2ea8b41d..eedf2f1cafdf 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -275,9 +275,10 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port,
        return sock;
 }
-static void rxe_release_udp_tunnel(struct socket *sk)
+void rxe_release_udp_tunnel(struct socket *sk)
 {
-        udp_tunnel_sock_release(sk);
+        if (sk)
+                udp_tunnel_sock_release(sk);
 }
 static void prepare_udp_hdr(struct sk_buff *skb, __be16 src_port,
@@ -658,51 +659,45 @@ out:
        return NOTIFY_OK;
 }
-static struct notifier_block rxe_net_notifier = {
+struct notifier_block rxe_net_notifier = {
        .notifier_call = rxe_notify,
 };
-int rxe_net_init(void)
+int rxe_net_ipv4_init(void)
 {
-        int err;
        spin_lock_init(&dev_list_lock);
-        recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net,
-                        htons(ROCE_V2_UDP_DPORT), true);
-        if (IS_ERR(recv_sockets.sk6)) {
-                recv_sockets.sk6 = NULL;
-                pr_err("rxe: Failed to create IPv6 UDP tunnel\n");
-                return -1;
-        }
        recv_sockets.sk4 = rxe_setup_udp_tunnel(&init_net,
-                        htons(ROCE_V2_UDP_DPORT), false);
+                                htons(ROCE_V2_UDP_DPORT), false);
        if (IS_ERR(recv_sockets.sk4)) {
-                rxe_release_udp_tunnel(recv_sockets.sk6);
                recv_sockets.sk4 = NULL;
-                recv_sockets.sk6 = NULL;
                pr_err("rxe: Failed to create IPv4 UDP tunnel\n");
                return -1;
        }
-        err = register_netdevice_notifier(&rxe_net_notifier);
+        return 0;
-        if (err) {
-                rxe_release_udp_tunnel(recv_sockets.sk6);
-                rxe_release_udp_tunnel(recv_sockets.sk4);
-                pr_err("rxe: Failed to rigister netdev notifier\n");
-        }
-        return err;
 }
-void rxe_net_exit(void)
+int rxe_net_ipv6_init(void)
 {
-        if (recv_sockets.sk6)
+#if IS_ENABLED(CONFIG_IPV6)
-                rxe_release_udp_tunnel(recv_sockets.sk6);
-        if (recv_sockets.sk4)
+        spin_lock_init(&dev_list_lock);
-                rxe_release_udp_tunnel(recv_sockets.sk4);
+        recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net,
+                                                htons(ROCE_V2_UDP_DPORT), true);
+        if (IS_ERR(recv_sockets.sk6)) {
+                recv_sockets.sk6 = NULL;
+                pr_err("rxe: Failed to create IPv6 UDP tunnel\n");
+                return -1;
+        }
+#endif
+        return 0;
+}
+void rxe_net_exit(void)
+{
+        rxe_release_udp_tunnel(recv_sockets.sk6);
+        rxe_release_udp_tunnel(recv_sockets.sk4);
        unregister_netdevice_notifier(&rxe_net_notifier);
 }
diff --git a/drivers/infiniband/sw/rxe/rxe_net.h b/drivers/infiniband/sw/rxe/rxe_net.h
index 7b06f76d16cc..0daf7f09e5b5 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.h
+++ b/drivers/infiniband/sw/rxe/rxe_net.h
@@ -44,10 +44,13 @@ struct rxe_recv_sockets {
 };
 extern struct rxe_recv_sockets recv_sockets;
+extern struct notifier_block rxe_net_notifier;
+void rxe_release_udp_tunnel(struct socket *sk);
 struct rxe_dev *rxe_net_add(struct net_device *ndev);
-int rxe_net_init(void);
+int rxe_net_ipv4_init(void);
+int rxe_net_ipv6_init(void);
 void rxe_net_exit(void);
 #endif /* RXE_NET_H */
diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
index 3d464c23e08b..144d2f129fcd 100644
--- a/drivers/infiniband/sw/rxe/rxe_recv.c
+++ b/drivers/infiniband/sw/rxe/rxe_recv.c
@@ -312,7 +312,7 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
                 * make a copy of the skb to post to the next qp
                 */
                skb_copy = (mce->qp_list.next != &mcg->qp_list) ?
-                                skb_clone(skb, GFP_KERNEL) : NULL;
+                                skb_clone(skb, GFP_ATOMIC) : NULL;
                pkt->qp = qp;
                rxe_add_ref(qp);
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 33b2d9d77021..13a848a518e8 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -511,24 +511,21 @@ static int fill_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
 }
 static void update_wqe_state(struct rxe_qp *qp,
-                             struct rxe_send_wqe *wqe,
+                struct rxe_send_wqe *wqe,
-                             struct rxe_pkt_info *pkt,
+                struct rxe_pkt_info *pkt)
-                             enum wqe_state *prev_state)
 {
-        enum wqe_state prev_state_ = wqe->state;
        if (pkt->mask & RXE_END_MASK) {
                if (qp_type(qp) == IB_QPT_RC)
                        wqe->state = wqe_state_pending;
        } else {
                wqe->state = wqe_state_processing;
        }
-        *prev_state = prev_state_;
 }
-static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+static void update_wqe_psn(struct rxe_qp *qp,
-                         struct rxe_pkt_info *pkt, int payload)
+                           struct rxe_send_wqe *wqe,
+                           struct rxe_pkt_info *pkt,
+                           int payload)
 {
        /* number of packets left to send including current one */
        int num_pkt = (wqe->dma.resid + payload + qp->mtu - 1) / qp->mtu;
@@ -546,9 +543,34 @@ static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
                qp->req.psn = (wqe->first_psn + num_pkt) & BTH_PSN_MASK;
        else
                qp->req.psn = (qp->req.psn + 1) & BTH_PSN_MASK;
+}
-        qp->req.opcode = pkt->opcode;
+static void save_state(struct rxe_send_wqe *wqe,
+                       struct rxe_qp *qp,
+                       struct rxe_send_wqe *rollback_wqe,
+                       struct rxe_qp *rollback_qp)
+{
+        rollback_wqe->state     = wqe->state;
+        rollback_wqe->first_psn = wqe->first_psn;
+        rollback_wqe->last_psn  = wqe->last_psn;
+        rollback_qp->req.psn    = qp->req.psn;
+}
+static void rollback_state(struct rxe_send_wqe *wqe,
+                           struct rxe_qp *qp,
+                           struct rxe_send_wqe *rollback_wqe,
+                           struct rxe_qp *rollback_qp)
+{
+        wqe->state     = rollback_wqe->state;
+        wqe->first_psn = rollback_wqe->first_psn;
+        wqe->last_psn  = rollback_wqe->last_psn;
+        qp->req.psn    = rollback_qp->req.psn;
+}
+static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+                         struct rxe_pkt_info *pkt, int payload)
+{
+        qp->req.opcode = pkt->opcode;
        if (pkt->mask & RXE_END_MASK)
                qp->req.wqe_index = next_index(qp->sq.queue, qp->req.wqe_index);
@@ -571,7 +593,8 @@ int rxe_requester(void *arg)
        int mtu;
        int opcode;
        int ret;
-        enum wqe_state prev_state;
+        struct rxe_qp rollback_qp;
+        struct rxe_send_wqe rollback_wqe;
 next_wqe:
        if (unlikely(!qp->valid || qp->req.state == QP_STATE_ERROR))
@@ -688,13 +711,21 @@ next_wqe:
                goto err;
        }
-        update_wqe_state(qp, wqe, &pkt, &prev_state);
+        /*
+         * To prevent a race on wqe access between requester and completer,
+         * wqe members state and psn need to be set before calling
+         * rxe_xmit_packet().
+         * Otherwise, completer might initiate an unjustified retry flow.
+         */
+        save_state(wqe, qp, &rollback_wqe, &rollback_qp);
+        update_wqe_state(qp, wqe, &pkt);
+        update_wqe_psn(qp, wqe, &pkt, payload);
        ret = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp, &pkt, skb);
        if (ret) {
                qp->need_req_skb = 1;
                kfree_skb(skb);
-                wqe->state = prev_state;
+                rollback_state(wqe, qp, &rollback_wqe, &rollback_qp);
                if (ret == -EAGAIN) {
                        rxe_run_task(&qp->req.task, 1);
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index ebb03b46e2ad..3e0f0f2baace 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -972,11 +972,13 @@ static int send_atomic_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
        free_rd_atomic_resource(qp, res);
        rxe_advance_resp_resource(qp);
+        memcpy(SKB_TO_PKT(skb), &ack_pkt, sizeof(skb->cb));
        res->type = RXE_ATOMIC_MASK;
        res->atomic.skb = skb;
-        res->first_psn = qp->resp.psn;
+        res->first_psn = ack_pkt.psn;
-        res->last_psn = qp->resp.psn;
+        res->last_psn  = ack_pkt.psn;
-        res->cur_psn = qp->resp.psn;
+        res->cur_psn   = ack_pkt.psn;
        rc = rxe_xmit_packet(rxe, qp, &ack_pkt, skb_copy);
        if (rc) {
@@ -1116,8 +1118,7 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
                                rc = RESPST_CLEANUP;
                                goto out;
                        }
-                        bth_set_psn(SKB_TO_PKT(skb_copy),
-                                    qp->resp.psn - 1);
                        /* Resend the result. */
                        rc = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp,
                                             pkt, skb_copy);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index dc6d241b9406..be11d5d5b8c1 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1161,8 +1161,17 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
        }
        if (level == IPOIB_FLUSH_LIGHT) {
+                int oper_up;
                ipoib_mark_paths_invalid(dev);
+                /* Set IPoIB operation as down to prevent races between:
+                 * the flush flow which leaves MCG and on the fly joins
+                 * which can happen during that time. mcast restart task
+                 * should deal with join requests we missed.
+                 */
+                oper_up = test_and_clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
                ipoib_mcast_dev_flush(dev);
+                if (oper_up)
+                        set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
                ipoib_flush_ah(dev);
        }
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 112e17c2768b..37f952dd9fc9 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -176,6 +176,7 @@ static int aic_irq_domain_xlate(struct irq_domain *d,
 {
        struct irq_domain_chip_generic *dgc = d->gc;
        struct irq_chip_generic *gc;
+        unsigned long flags;
        unsigned smr;
        int idx;
        int ret;
@@ -194,11 +195,11 @@ static int aic_irq_domain_xlate(struct irq_domain *d,
        gc = dgc->gc[idx];
-        irq_gc_lock(gc);
+        irq_gc_lock_irqsave(gc, flags);
        smr = irq_reg_readl(gc, AT91_AIC_SMR(*out_hwirq));
        aic_common_set_priority(intspec[2], &smr);
        irq_reg_writel(gc, smr, AT91_AIC_SMR(*out_hwirq));
-        irq_gc_unlock(gc);
+        irq_gc_unlock_irqrestore(gc, flags);
        return ret;
 }
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index 4f0d068e1abe..2a624d87a035 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -258,6 +258,7 @@ static int aic5_irq_domain_xlate(struct irq_domain *d,
                                 unsigned int *out_type)
 {
        struct irq_chip_generic *bgc = irq_get_domain_generic_chip(d, 0);
+        unsigned long flags;
        unsigned smr;
        int ret;
@@ -269,12 +270,12 @@ static int aic5_irq_domain_xlate(struct irq_domain *d,
        if (ret)
                return ret;
-        irq_gc_lock(bgc);
+        irq_gc_lock_irqsave(bgc, flags);
        irq_reg_writel(bgc, *out_hwirq, AT91_AIC5_SSR);
        smr = irq_reg_readl(bgc, AT91_AIC5_SMR);
        aic_common_set_priority(intspec[2], &smr);
        irq_reg_writel(bgc, smr, AT91_AIC5_SMR);
-        irq_gc_unlock(bgc);
+        irq_gc_unlock_irqrestore(bgc, flags);
        return ret;
 }
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index f23d65eb070d..be3c49fa7382 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -1016,14 +1016,16 @@ mmc_omap_prepare_data(struct mmc_omap_host *host, struct mmc_request *req)
                /* Only reconfigure if we have a different burst size */
                if (*bp != burst) {
-                        struct dma_slave_config cfg;
+                        struct dma_slave_config cfg = {
+                                .src_addr = host->phys_base +
-                        cfg.src_addr = host->phys_base + OMAP_MMC_REG(host, DATA);
+                                            OMAP_MMC_REG(host, DATA),
-                        cfg.dst_addr = host->phys_base + OMAP_MMC_REG(host, DATA);
+                                .dst_addr = host->phys_base +
-                        cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
+                                            OMAP_MMC_REG(host, DATA),
-                        cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
+                                .src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES,
-                        cfg.src_maxburst = burst;
+                                .dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES,
-                        cfg.dst_maxburst = burst;
+                                .src_maxburst = burst,
+                                .dst_maxburst = burst,
+                        };
                        if (dmaengine_slave_config(c, &cfg))
                                goto use_pio;
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 24ebc9a8de89..5f2f24a7360d 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1409,11 +1409,18 @@ static int omap_hsmmc_pre_dma_transfer(struct omap_hsmmc_host *host,
 static int omap_hsmmc_setup_dma_transfer(struct omap_hsmmc_host *host,
                                        struct mmc_request *req)
 {
-        struct dma_slave_config cfg;
        struct dma_async_tx_descriptor *tx;
        int ret = 0, i;
        struct mmc_data *data = req->data;
        struct dma_chan *chan;
+        struct dma_slave_config cfg = {
+                .src_addr = host->mapbase + OMAP_HSMMC_DATA,
+                .dst_addr = host->mapbase + OMAP_HSMMC_DATA,
+                .src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
+                .dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
+                .src_maxburst = data->blksz / 4,
+                .dst_maxburst = data->blksz / 4,
+        };
        /* Sanity check: all the SG entries must be aligned by block size. */
        for (i = 0; i < data->sg_len; i++) {
@@ -1433,13 +1440,6 @@ static int omap_hsmmc_setup_dma_transfer(struct omap_hsmmc_host *host,
        chan = omap_hsmmc_get_dma_chan(host, data);
-        cfg.src_addr = host->mapbase + OMAP_HSMMC_DATA;
-        cfg.dst_addr = host->mapbase + OMAP_HSMMC_DATA;
-        cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        cfg.src_maxburst = data->blksz / 4;
-        cfg.dst_maxburst = data->blksz / 4;
        ret = dmaengine_slave_config(chan, &cfg);
        if (ret)
                return ret;
diff --git a/drivers/mmc/host/sdhci-st.c b/drivers/mmc/host/sdhci-st.c
index c95ba83366a0..ed92ce729dde 100644
--- a/drivers/mmc/host/sdhci-st.c
+++ b/drivers/mmc/host/sdhci-st.c
@@ -28,6 +28,7 @@
 struct st_mmc_platform_data {
        struct  reset_control *rstc;
+        struct  clk *icnclk;
        void __iomem *top_ioaddr;
 };
@@ -353,7 +354,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
        struct sdhci_host *host;
        struct st_mmc_platform_data *pdata;
        struct sdhci_pltfm_host *pltfm_host;
-        struct clk *clk;
+        struct clk *clk, *icnclk;
        int ret = 0;
        u16 host_version;
        struct resource *res;
@@ -365,6 +366,11 @@ static int sdhci_st_probe(struct platform_device *pdev)
                return PTR_ERR(clk);
        }
+        /* ICN clock isn't compulsory, but use it if it's provided. */
+        icnclk = devm_clk_get(&pdev->dev, "icn");
+        if (IS_ERR(icnclk))
+                icnclk = NULL;
        rstc = devm_reset_control_get(&pdev->dev, NULL);
        if (IS_ERR(rstc))
                rstc = NULL;
@@ -389,6 +395,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
        }
        clk_prepare_enable(clk);
+        clk_prepare_enable(icnclk);
        /* Configure the FlashSS Top registers for setting eMMC TX/RX delay */
        res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -400,6 +407,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
        }
        pltfm_host->clk = clk;
+        pdata->icnclk = icnclk;
        /* Configure the Arasan HC inside the flashSS */
        st_mmcss_cconfig(np, host);
@@ -422,6 +430,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
        return 0;
 err_out:
+        clk_disable_unprepare(icnclk);
        clk_disable_unprepare(clk);
 err_of:
        sdhci_pltfm_free(pdev);
@@ -442,6 +451,8 @@ static int sdhci_st_remove(struct platform_device *pdev)
        ret = sdhci_pltfm_unregister(pdev);
+        clk_disable_unprepare(pdata->icnclk);
        if (rstc)
                reset_control_assert(rstc);
@@ -462,6 +473,7 @@ static int sdhci_st_suspend(struct device *dev)
        if (pdata->rstc)
                reset_control_assert(pdata->rstc);
+        clk_disable_unprepare(pdata->icnclk);
        clk_disable_unprepare(pltfm_host->clk);
 out:
        return ret;
@@ -475,6 +487,7 @@ static int sdhci_st_resume(struct device *dev)
        struct device_node *np = dev->of_node;
        clk_prepare_enable(pltfm_host->clk);
+        clk_prepare_enable(pdata->icnclk);
        if (pdata->rstc)
                reset_control_deassert(pdata->rstc);
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 8dcf5a960951..60f7eab11865 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1693,7 +1693,12 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
                nvme_suspend_queue(dev->queues[i]);
        if (csts & NVME_CSTS_CFS || !(csts & NVME_CSTS_RDY)) {
-                nvme_suspend_queue(dev->queues[0]);
+                /* A device might become IO incapable very soon during
+                 * probe, before the admin queue is configured. Thus,
+                 * queue_count can be 0 here.
+                 */
+                if (dev->queue_count)
+                        nvme_suspend_queue(dev->queues[0]);
        } else {
                nvme_disable_io_queues(dev);
                nvme_disable_admin_queue(dev, shutdown);
@@ -2112,6 +2117,8 @@ static const struct pci_device_id nvme_id_table[] = {
                .driver_data = NVME_QUIRK_IDENTIFY_CNS, },
        { PCI_DEVICE(0x1c58, 0x0003),   /* HGST adapter */
                .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
+        { PCI_DEVICE(0x1c5f, 0x0540),   /* Memblaze Pblaze4 adapter */
+                .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
        { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
        { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
        { 0, }
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index ab545fb347a0..c2c2c28e6eb5 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -82,6 +82,8 @@ struct nvme_rdma_request {
 enum nvme_rdma_queue_flags {
        NVME_RDMA_Q_CONNECTED = (1 << 0),
+        NVME_RDMA_IB_QUEUE_ALLOCATED = (1 << 1),
+        NVME_RDMA_Q_DELETING = (1 << 2),
 };
 struct nvme_rdma_queue {
@@ -291,6 +293,7 @@ static int nvme_rdma_reinit_request(void *data, struct request *rq)
        if (IS_ERR(req->mr)) {
                ret = PTR_ERR(req->mr);
                req->mr = NULL;
+                goto out;
        }
        req->mr->need_inval = false;
@@ -480,9 +483,14 @@ out_err:
 static void nvme_rdma_destroy_queue_ib(struct nvme_rdma_queue *queue)
 {
-        struct nvme_rdma_device *dev = queue->device;
+        struct nvme_rdma_device *dev;
-        struct ib_device *ibdev = dev->dev;
+        struct ib_device *ibdev;
+        if (!test_and_clear_bit(NVME_RDMA_IB_QUEUE_ALLOCATED, &queue->flags))
+                return;
+        dev = queue->device;
+        ibdev = dev->dev;
        rdma_destroy_qp(queue->cm_id);
        ib_free_cq(queue->ib_cq);
@@ -533,6 +541,7 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue,
                ret = -ENOMEM;
                goto out_destroy_qp;
        }
+        set_bit(NVME_RDMA_IB_QUEUE_ALLOCATED, &queue->flags);
        return 0;
@@ -552,6 +561,7 @@ static int nvme_rdma_init_queue(struct nvme_rdma_ctrl *ctrl,
        queue = &ctrl->queues[idx];
        queue->ctrl = ctrl;
+        queue->flags = 0;
        init_completion(&queue->cm_done);
        if (idx > 0)
@@ -590,6 +600,7 @@ static int nvme_rdma_init_queue(struct nvme_rdma_ctrl *ctrl,
        return 0;
 out_destroy_cm_id:
+        nvme_rdma_destroy_queue_ib(queue);
        rdma_destroy_id(queue->cm_id);
        return ret;
 }
@@ -608,7 +619,7 @@ static void nvme_rdma_free_queue(struct nvme_rdma_queue *queue)
 static void nvme_rdma_stop_and_free_queue(struct nvme_rdma_queue *queue)
 {
-        if (!test_and_clear_bit(NVME_RDMA_Q_CONNECTED, &queue->flags))
+        if (test_and_set_bit(NVME_RDMA_Q_DELETING, &queue->flags))
                return;
        nvme_rdma_stop_queue(queue);
        nvme_rdma_free_queue(queue);
@@ -652,7 +663,7 @@ static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl)
        return 0;
 out_free_queues:
-        for (; i >= 1; i--)
+        for (i--; i >= 1; i--)
                nvme_rdma_stop_and_free_queue(&ctrl->queues[i]);
        return ret;
@@ -761,8 +772,13 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
 {
        struct nvme_rdma_ctrl *ctrl = container_of(work,
                        struct nvme_rdma_ctrl, err_work);
+        int i;
        nvme_stop_keep_alive(&ctrl->ctrl);
+        for (i = 0; i < ctrl->queue_count; i++)
+                clear_bit(NVME_RDMA_Q_CONNECTED, &ctrl->queues[i].flags);
        if (ctrl->queue_count > 1)
                nvme_stop_queues(&ctrl->ctrl);
        blk_mq_stop_hw_queues(ctrl->ctrl.admin_q);
@@ -1305,58 +1321,6 @@ out_destroy_queue_ib:
        return ret;
 }
-/**
- * nvme_rdma_device_unplug() - Handle RDMA device unplug
- * @queue:      Queue that owns the cm_id that caught the event
- *
- * DEVICE_REMOVAL event notifies us that the RDMA device is about
- * to unplug so we should take care of destroying our RDMA resources.
- * This event will be generated for each allocated cm_id.
- *
- * In our case, the RDMA resources are managed per controller and not
- * only per queue. So the way we handle this is we trigger an implicit
- * controller deletion upon the first DEVICE_REMOVAL event we see, and
- * hold the event inflight until the controller deletion is completed.
- *
- * One exception that we need to handle is the destruction of the cm_id
- * that caught the event. Since we hold the callout until the controller
- * deletion is completed, we'll deadlock if the controller deletion will
- * call rdma_destroy_id on this queue's cm_id. Thus, we claim ownership
- * of destroying this queue before-hand, destroy the queue resources,
- * then queue the controller deletion which won't destroy this queue and
- * we destroy the cm_id implicitely by returning a non-zero rc to the callout.
- */
-static int nvme_rdma_device_unplug(struct nvme_rdma_queue *queue)
-{
-        struct nvme_rdma_ctrl *ctrl = queue->ctrl;
-        int ret = 0;
-        /* Own the controller deletion */
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING))
-                return 0;
-        dev_warn(ctrl->ctrl.device,
-                "Got rdma device removal event, deleting ctrl\n");
-        /* Get rid of reconnect work if its running */
-        cancel_delayed_work_sync(&ctrl->reconnect_work);
-        /* Disable the queue so ctrl delete won't free it */
-        if (test_and_clear_bit(NVME_RDMA_Q_CONNECTED, &queue->flags)) {
-                /* Free this queue ourselves */
-                nvme_rdma_stop_queue(queue);
-                nvme_rdma_destroy_queue_ib(queue);
-                /* Return non-zero so the cm_id will destroy implicitly */
-                ret = 1;
-        }
-        /* Queue controller deletion */
-        queue_work(nvme_rdma_wq, &ctrl->delete_work);
-        flush_work(&ctrl->delete_work);
-        return ret;
-}
 static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
                struct rdma_cm_event *ev)
 {
@@ -1398,8 +1362,8 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
                nvme_rdma_error_recovery(queue->ctrl);
                break;
        case RDMA_CM_EVENT_DEVICE_REMOVAL:
-                /* return 1 means impliciy CM ID destroy */
+                /* device removal is handled via the ib_client API */
-                return nvme_rdma_device_unplug(queue);
+                break;
        default:
                dev_err(queue->ctrl->ctrl.device,
                        "Unexpected RDMA CM event (%d)\n", ev->event);
@@ -1700,15 +1664,19 @@ static int __nvme_rdma_del_ctrl(struct nvme_rdma_ctrl *ctrl)
 static int nvme_rdma_del_ctrl(struct nvme_ctrl *nctrl)
 {
        struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(nctrl);
-        int ret;
+        int ret = 0;
+        /*
+         * Keep a reference until all work is flushed since
+         * __nvme_rdma_del_ctrl can free the ctrl mem
+         */
+        if (!kref_get_unless_zero(&ctrl->ctrl.kref))
+                return -EBUSY;
        ret = __nvme_rdma_del_ctrl(ctrl);
-        if (ret)
+        if (!ret)
-                return ret;
+                flush_work(&ctrl->delete_work);
+        nvme_put_ctrl(&ctrl->ctrl);
-        flush_work(&ctrl->delete_work);
+        return ret;
-        return 0;
 }
 static void nvme_rdma_remove_ctrl_work(struct work_struct *work)
@@ -2005,27 +1973,57 @@ static struct nvmf_transport_ops nvme_rdma_transport = {
        .create_ctrl    = nvme_rdma_create_ctrl,
 };
+static void nvme_rdma_add_one(struct ib_device *ib_device)
+{
+}
+static void nvme_rdma_remove_one(struct ib_device *ib_device, void *client_data)
+{
+        struct nvme_rdma_ctrl *ctrl;
+        /* Delete all controllers using this device */
+        mutex_lock(&nvme_rdma_ctrl_mutex);
+        list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list) {
+                if (ctrl->device->dev != ib_device)
+                        continue;
+                dev_info(ctrl->ctrl.device,
+                        "Removing ctrl: NQN \"%s\", addr %pISp\n",
+                        ctrl->ctrl.opts->subsysnqn, &ctrl->addr);
+                __nvme_rdma_del_ctrl(ctrl);
+        }
+        mutex_unlock(&nvme_rdma_ctrl_mutex);
+        flush_workqueue(nvme_rdma_wq);
+}
+static struct ib_client nvme_rdma_ib_client = {
+        .name   = "nvme_rdma",
+        .add = nvme_rdma_add_one,
+        .remove = nvme_rdma_remove_one
+};
 static int __init nvme_rdma_init_module(void)
 {
+        int ret;
        nvme_rdma_wq = create_workqueue("nvme_rdma_wq");
        if (!nvme_rdma_wq)
                return -ENOMEM;
+        ret = ib_register_client(&nvme_rdma_ib_client);
+        if (ret) {
+                destroy_workqueue(nvme_rdma_wq);
+                return ret;
+        }
        nvmf_register_transport(&nvme_rdma_transport);
        return 0;
 }
 static void __exit nvme_rdma_cleanup_module(void)
 {
-        struct nvme_rdma_ctrl *ctrl;
        nvmf_unregister_transport(&nvme_rdma_transport);
+        ib_unregister_client(&nvme_rdma_ib_client);
-        mutex_lock(&nvme_rdma_ctrl_mutex);
-        list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list)
-                __nvme_rdma_del_ctrl(ctrl);
-        mutex_unlock(&nvme_rdma_ctrl_mutex);
        destroy_workqueue(nvme_rdma_wq);
 }
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 489ea1098c96..69b5e811ea2b 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -977,7 +977,7 @@ static int pcmcia_bus_uevent(struct device *dev, struct kobj_uevent_env *env)
 /************************ runtime PM support ***************************/
-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state);
+static int pcmcia_dev_suspend(struct device *dev);
 static int pcmcia_dev_resume(struct device *dev);
 static int runtime_suspend(struct device *dev)
@@ -985,7 +985,7 @@ static int runtime_suspend(struct device *dev)
        int rc;
        device_lock(dev);
-        rc = pcmcia_dev_suspend(dev, PMSG_SUSPEND);
+        rc = pcmcia_dev_suspend(dev);
        device_unlock(dev);
        return rc;
 }
@@ -1135,7 +1135,7 @@ ATTRIBUTE_GROUPS(pcmcia_dev);
 /* PM support, also needed for reset */
-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state)
+static int pcmcia_dev_suspend(struct device *dev)
 {
        struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
        struct pcmcia_driver *p_drv = NULL;
@@ -1410,6 +1410,9 @@ static struct class_interface pcmcia_bus_interface __refdata = {
        .remove_dev = &pcmcia_bus_remove_socket,
 };
+static const struct dev_pm_ops pcmcia_bus_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(pcmcia_dev_suspend, pcmcia_dev_resume)
+};
 struct bus_type pcmcia_bus_type = {
        .name = "pcmcia",
@@ -1418,8 +1421,7 @@ struct bus_type pcmcia_bus_type = {
        .dev_groups = pcmcia_dev_groups,
        .probe = pcmcia_device_probe,
        .remove = pcmcia_device_remove,
-        .suspend = pcmcia_dev_suspend,
+        .pm = &pcmcia_bus_pm_ops,
-        .resume = pcmcia_dev_resume,
 };
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index 483f919e0d2e..91b5f5724cba 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -214,9 +214,8 @@ pxa2xx_pcmcia_frequency_change(struct soc_pcmcia_socket *skt,
 }
 #endif
-void pxa2xx_configure_sockets(struct device *dev)
+void pxa2xx_configure_sockets(struct device *dev, struct pcmcia_low_level *ops)
 {
-        struct pcmcia_low_level *ops = dev->platform_data;
        /*
         * We have at least one socket, so set MECR:CIT
         * (Card Is There)
@@ -322,7 +321,7 @@ static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
                        goto err1;
        }
-        pxa2xx_configure_sockets(&dev->dev);
+        pxa2xx_configure_sockets(&dev->dev, ops);
        dev_set_drvdata(&dev->dev, sinfo);
        return 0;
@@ -348,7 +347,9 @@ static int pxa2xx_drv_pcmcia_remove(struct platform_device *dev)
 static int pxa2xx_drv_pcmcia_resume(struct device *dev)
 {
-        pxa2xx_configure_sockets(dev);
+        struct pcmcia_low_level *ops = (struct pcmcia_low_level *)dev->platform_data;
+        pxa2xx_configure_sockets(dev, ops);
        return 0;
 }
diff --git a/drivers/pcmcia/pxa2xx_base.h b/drivers/pcmcia/pxa2xx_base.h
index b609b45469ed..e58c7a415418 100644
--- a/drivers/pcmcia/pxa2xx_base.h
+++ b/drivers/pcmcia/pxa2xx_base.h
@@ -1,4 +1,4 @@
 int pxa2xx_drv_pcmcia_add_one(struct soc_pcmcia_socket *skt);
 void pxa2xx_drv_pcmcia_ops(struct pcmcia_low_level *ops);
-void pxa2xx_configure_sockets(struct device *dev);
+void pxa2xx_configure_sockets(struct device *dev, struct pcmcia_low_level *ops);
diff --git a/drivers/pcmcia/sa1111_badge4.c b/drivers/pcmcia/sa1111_badge4.c
index 12f0dd091477..2f490930430d 100644
--- a/drivers/pcmcia/sa1111_badge4.c
+++ b/drivers/pcmcia/sa1111_badge4.c
@@ -134,20 +134,14 @@ static struct pcmcia_low_level badge4_pcmcia_ops = {
 int pcmcia_badge4_init(struct sa1111_dev *dev)
 {
-        int ret = -ENODEV;
+        printk(KERN_INFO
+               "%s: badge4_pcmvcc=%d, badge4_pcmvpp=%d, badge4_cfvcc=%d\n",
-        if (machine_is_badge4()) {
+               __func__,
-                printk(KERN_INFO
+               badge4_pcmvcc, badge4_pcmvpp, badge4_cfvcc);
-                       "%s: badge4_pcmvcc=%d, badge4_pcmvpp=%d, badge4_cfvcc=%d\n",
-                       __func__,
+        sa11xx_drv_pcmcia_ops(&badge4_pcmcia_ops);
-                       badge4_pcmvcc, badge4_pcmvpp, badge4_cfvcc);
+        return sa1111_pcmcia_add(dev, &badge4_pcmcia_ops,
+                                 sa11xx_drv_pcmcia_add_one);
-                sa11xx_drv_pcmcia_ops(&badge4_pcmcia_ops);
-                ret = sa1111_pcmcia_add(dev, &badge4_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-        return ret;
 }
 static int __init pcmv_setup(char *s)
diff --git a/drivers/pcmcia/sa1111_generic.c b/drivers/pcmcia/sa1111_generic.c
index a1531feb8460..3d95dffcff7a 100644
--- a/drivers/pcmcia/sa1111_generic.c
+++ b/drivers/pcmcia/sa1111_generic.c
@@ -18,6 +18,7 @@
 #include <mach/hardware.h>
 #include <asm/hardware/sa1111.h>
+#include <asm/mach-types.h>
 #include <asm/irq.h>
 #include "sa1111_generic.h"
@@ -203,19 +204,30 @@ static int pcmcia_probe(struct sa1111_dev *dev)
        sa1111_writel(PCSSR_S0_SLEEP | PCSSR_S1_SLEEP, base + PCSSR);
        sa1111_writel(PCCR_S0_FLT | PCCR_S1_FLT, base + PCCR);
+        ret = -ENODEV;
 #ifdef CONFIG_SA1100_BADGE4
-        pcmcia_badge4_init(dev);
+        if (machine_is_badge4())
+                ret = pcmcia_badge4_init(dev);
 #endif
 #ifdef CONFIG_SA1100_JORNADA720
-        pcmcia_jornada720_init(dev);
+        if (machine_is_jornada720())
+                ret = pcmcia_jornada720_init(dev);
 #endif
 #ifdef CONFIG_ARCH_LUBBOCK
-        pcmcia_lubbock_init(dev);
+        if (machine_is_lubbock())
+                ret = pcmcia_lubbock_init(dev);
 #endif
 #ifdef CONFIG_ASSABET_NEPONSET
-        pcmcia_neponset_init(dev);
+        if (machine_is_assabet())
+                ret = pcmcia_neponset_init(dev);
 #endif
-        return 0;
+        if (ret) {
+                release_mem_region(dev->res.start, 512);
+                sa1111_disable_device(dev);
+        }
+        return ret;
 }
 static int pcmcia_remove(struct sa1111_dev *dev)
diff --git a/drivers/pcmcia/sa1111_jornada720.c b/drivers/pcmcia/sa1111_jornada720.c
index c2c30580c83f..480a3ede27c8 100644
--- a/drivers/pcmcia/sa1111_jornada720.c
+++ b/drivers/pcmcia/sa1111_jornada720.c
@@ -94,22 +94,17 @@ static struct pcmcia_low_level jornada720_pcmcia_ops = {
 int pcmcia_jornada720_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
+        unsigned int pin = GPIO_A0 | GPIO_A1 | GPIO_A2 | GPIO_A3;
-        if (machine_is_jornada720()) {
+        /* Fixme: why messing around with SA11x0's GPIO1? */
-                unsigned int pin = GPIO_A0 | GPIO_A1 | GPIO_A2 | GPIO_A3;
+        GRER |= 0x00000002;
-                GRER |= 0x00000002;
+        /* Set GPIO_A<3:1> to be outputs for PCMCIA/CF power controller: */
+        sa1111_set_io_dir(sadev, pin, 0, 0);
+        sa1111_set_io(sadev, pin, 0);
+        sa1111_set_sleep_io(sadev, pin, 0);
-                /* Set GPIO_A<3:1> to be outputs for PCMCIA/CF power controller: */
+        sa11xx_drv_pcmcia_ops(&jornada720_pcmcia_ops);
-                sa1111_set_io_dir(sadev, pin, 0, 0);
+        return sa1111_pcmcia_add(sadev, &jornada720_pcmcia_ops,
-                sa1111_set_io(sadev, pin, 0);
+                                 sa11xx_drv_pcmcia_add_one);
-                sa1111_set_sleep_io(sadev, pin, 0);
-                sa11xx_drv_pcmcia_ops(&jornada720_pcmcia_ops);
-                ret = sa1111_pcmcia_add(sadev, &jornada720_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-        return ret;
 }
diff --git a/drivers/pcmcia/sa1111_lubbock.c b/drivers/pcmcia/sa1111_lubbock.c
index c5caf5790451..e741f499c875 100644
--- a/drivers/pcmcia/sa1111_lubbock.c
+++ b/drivers/pcmcia/sa1111_lubbock.c
@@ -210,27 +210,21 @@ static struct pcmcia_low_level lubbock_pcmcia_ops = {
 int pcmcia_lubbock_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
+        /*
+         * Set GPIO_A<3:0> to be outputs for the MAX1600,
-        if (machine_is_lubbock()) {
+         * and switch to standby mode.
-                /*
+         */
-                 * Set GPIO_A<3:0> to be outputs for the MAX1600,
+        sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
-                 * and switch to standby mode.
+        sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                 */
+        sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
-                sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                /* Set CF Socket 1 power to standby mode. */
-                lubbock_set_misc_wr((1 << 15) | (1 << 14), 0);
-                pxa2xx_drv_pcmcia_ops(&lubbock_pcmcia_ops);
+        /* Set CF Socket 1 power to standby mode. */
-                pxa2xx_configure_sockets(&sadev->dev);
+        lubbock_set_misc_wr((1 << 15) | (1 << 14), 0);
-                ret = sa1111_pcmcia_add(sadev, &lubbock_pcmcia_ops,
-                                pxa2xx_drv_pcmcia_add_one);
-        }
-        return ret;
+        pxa2xx_drv_pcmcia_ops(&lubbock_pcmcia_ops);
+        pxa2xx_configure_sockets(&sadev->dev, &lubbock_pcmcia_ops);
+        return sa1111_pcmcia_add(sadev, &lubbock_pcmcia_ops,
+                                 pxa2xx_drv_pcmcia_add_one);
 }
 MODULE_LICENSE("GPL");
diff --git a/drivers/pcmcia/sa1111_neponset.c b/drivers/pcmcia/sa1111_neponset.c
index 1d78739c4c07..019c395eb4bf 100644
--- a/drivers/pcmcia/sa1111_neponset.c
+++ b/drivers/pcmcia/sa1111_neponset.c
@@ -110,20 +110,14 @@ static struct pcmcia_low_level neponset_pcmcia_ops = {
 int pcmcia_neponset_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
+        /*
+         * Set GPIO_A<3:0> to be outputs for the MAX1600,
-        if (machine_is_assabet()) {
+         * and switch to standby mode.
-                /*
+         */
-                 * Set GPIO_A<3:0> to be outputs for the MAX1600,
+        sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
-                 * and switch to standby mode.
+        sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                 */
+        sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
+        sa11xx_drv_pcmcia_ops(&neponset_pcmcia_ops);
-                sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
+        return sa1111_pcmcia_add(sadev, &neponset_pcmcia_ops,
-                sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
+                                 sa11xx_drv_pcmcia_add_one);
-                sa11xx_drv_pcmcia_ops(&neponset_pcmcia_ops);
-                ret = sa1111_pcmcia_add(sadev, &neponset_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-        return ret;
 }
diff --git a/drivers/pcmcia/sa11xx_base.c b/drivers/pcmcia/sa11xx_base.c
index 9f6ec87b9f9e..48140ac73ed6 100644
--- a/drivers/pcmcia/sa11xx_base.c
+++ b/drivers/pcmcia/sa11xx_base.c
@@ -144,19 +144,19 @@ static int
 sa1100_pcmcia_show_timing(struct soc_pcmcia_socket *skt, char *buf)
 {
        struct soc_pcmcia_timing timing;
-        unsigned int clock = clk_get_rate(skt->clk);
+        unsigned int clock = clk_get_rate(skt->clk) / 1000;
        unsigned long mecr = MECR;
        char *p = buf;
        soc_common_pcmcia_get_timing(skt, &timing);
-        p+=sprintf(p, "I/O      : %u (%u)\n", timing.io,
+        p+=sprintf(p, "I/O      : %uns (%uns)\n", timing.io,
                   sa1100_pcmcia_cmd_time(clock, MECR_BSIO_GET(mecr, skt->nr)));
-        p+=sprintf(p, "attribute: %u (%u)\n", timing.attr,
+        p+=sprintf(p, "attribute: %uns (%uns)\n", timing.attr,
                   sa1100_pcmcia_cmd_time(clock, MECR_BSA_GET(mecr, skt->nr)));
-        p+=sprintf(p, "common   : %u (%u)\n", timing.mem,
+        p+=sprintf(p, "common   : %uns (%uns)\n", timing.mem,
                   sa1100_pcmcia_cmd_time(clock, MECR_BSM_GET(mecr, skt->nr)));
        return p - buf;
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index eed5e9c05353..d5ca760c4eb2 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -235,7 +235,7 @@ static unsigned int soc_common_pcmcia_skt_state(struct soc_pcmcia_socket *skt)
        stat |= skt->cs_state.Vcc ? SS_POWERON : 0;
        if (skt->cs_state.flags & SS_IOCARD)
-                stat |= state.bvd1 ? SS_STSCHG : 0;
+                stat |= state.bvd1 ? 0 : SS_STSCHG;
        else {
                if (state.bvd1 == 0)
                        stat |= SS_BATDEAD;
diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
index 3fa17ac8df54..cebc296463ad 100644
--- a/drivers/rapidio/rio_cm.c
+++ b/drivers/rapidio/rio_cm.c
@@ -2247,17 +2247,30 @@ static int rio_cm_shutdown(struct notifier_block *nb, unsigned long code,
 {
        struct rio_channel *ch;
        unsigned int i;
+        LIST_HEAD(list);
        riocm_debug(EXIT, ".");
+        /*
+         * If there are any channels left in connected state send
+         * close notification to the connection partner.
+         * First build a list of channels that require a closing
+         * notification because function riocm_send_close() should
+         * be called outside of spinlock protected code.
+         */
        spin_lock_bh(&idr_lock);
        idr_for_each_entry(&ch_idr, ch, i) {
-                riocm_debug(EXIT, "close ch %d", ch->id);
+                if (ch->state == RIO_CM_CONNECTED) {
-                if (ch->state == RIO_CM_CONNECTED)
+                        riocm_debug(EXIT, "close ch %d", ch->id);
-                        riocm_send_close(ch);
+                        idr_remove(&ch_idr, ch->id);
+                        list_add(&ch->ch_node, &list);
+                }
        }
        spin_unlock_bh(&idr_lock);
+        list_for_each_entry(ch, &list, ch_node)
+                riocm_send_close(ch);
        return NOTIFY_DONE;
 }
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 15ce4ab11688..a2d90aca779f 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -240,8 +240,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
        memcpy(&endpoint->desc, d, n);
        INIT_LIST_HEAD(&endpoint->urb_list);
-        /* Fix up bInterval values outside the legal range. Use 32 ms if no
+        /*
-         * proper value can be guessed. */
+         * Fix up bInterval values outside the legal range.
+         * Use 10 or 8 ms if no proper value can be guessed.
+         */
        i = 0;          /* i = min, j = max, n = default */
        j = 255;
        if (usb_endpoint_xfer_int(d)) {
@@ -250,13 +252,15 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                case USB_SPEED_SUPER_PLUS:
                case USB_SPEED_SUPER:
                case USB_SPEED_HIGH:
-                        /* Many device manufacturers are using full-speed
+                        /*
+                         * Many device manufacturers are using full-speed
                         * bInterval values in high-speed interrupt endpoint
-                         * descriptors. Try to fix those and fall back to a
+                         * descriptors. Try to fix those and fall back to an
-                         * 32 ms default value otherwise. */
+                         * 8-ms default value otherwise.
+                         */
                        n = fls(d->bInterval*8);
                        if (n == 0)
-                                n = 9;  /* 32 ms = 2^(9-1) uframes */
+                                n = 7;  /* 8 ms = 2^(7-1) uframes */
                        j = 16;
                        /*
@@ -271,10 +275,12 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                        }
                        break;
                default:                /* USB_SPEED_FULL or _LOW */
-                        /* For low-speed, 10 ms is the official minimum.
+                        /*
+                         * For low-speed, 10 ms is the official minimum.
                         * But some "overclocked" devices might want faster
-                         * polling so we'll allow it. */
+                         * polling so we'll allow it.
-                        n = 32;
+                         */
+                        n = 10;
                        break;
                }
        } else if (usb_endpoint_xfer_isoc(d)) {
@@ -282,10 +288,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                j = 16;
                switch (to_usb_device(ddev)->speed) {
                case USB_SPEED_HIGH:
-                        n = 9;          /* 32 ms = 2^(9-1) uframes */
+                        n = 7;          /* 8 ms = 2^(7-1) uframes */
                        break;
                default:                /* USB_SPEED_FULL */
-                        n = 6;          /* 32 ms = 2^(6-1) frames */
+                        n = 4;          /* 8 ms = 2^(4-1) frames */
                        break;
                }
        }
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 886526b5fcdd..73cfa13fc0dc 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -87,7 +87,7 @@ config USB_MUSB_DA8XX
 config USB_MUSB_TUSB6010
        tristate "TUSB6010"
        depends on HAS_IOMEM
-        depends on ARCH_OMAP2PLUS || COMPILE_TEST
+        depends on (ARCH_OMAP2PLUS || COMPILE_TEST) && !BLACKFIN
        depends on NOP_USB_XCEIV = USB_MUSB_HDRC # both built-in or both modules
 config USB_MUSB_OMAP2PLUS
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index a204782ae530..e98b6e57b703 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -54,7 +54,8 @@ DEVICE(funsoft, FUNSOFT_IDS);
 /* Infineon Flashloader driver */
 #define FLASHLOADER_IDS()               \
        { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
-        { USB_DEVICE(0x8087, 0x0716) }
+        { USB_DEVICE(0x8087, 0x0716) }, \
+        { USB_DEVICE(0x8087, 0x0801) }
 DEVICE(flashloader, FLASHLOADER_IDS);
 /* Google Serial USB SubClass */
diff --git a/fs/aio.c b/fs/aio.c
index fb8e45b88cd4..4fe81d1c60f9 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct file_system_type *fs_type,
        static const struct dentry_operations ops = {
                .d_dname        = simple_dname,
        };
-        return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
+        struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
+                                           AIO_RING_MAGIC);
+        if (!IS_ERR(root))
+                root->d_sb->s_iflags |= SB_I_NOEXEC;
+        return root;
 }
 /* aio_setup
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index b493909e7492..d8e6d421c27f 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -417,6 +417,7 @@ static struct dentry *should_expire(struct dentry *dentry,
        }
        return NULL;
 }
 /*
 * Find an eligible tree to time-out
 * A tree is eligible if :-
@@ -432,6 +433,7 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
        struct dentry *root = sb->s_root;
        struct dentry *dentry;
        struct dentry *expired;
+        struct dentry *found;
        struct autofs_info *ino;
        if (!root)
@@ -442,31 +444,46 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
        dentry = NULL;
        while ((dentry = get_next_positive_subdir(dentry, root))) {
+                int flags = how;
                spin_lock(&sbi->fs_lock);
                ino = autofs4_dentry_ino(dentry);
-                if (ino->flags & AUTOFS_INF_WANT_EXPIRE)
+                if (ino->flags & AUTOFS_INF_WANT_EXPIRE) {
-                        expired = NULL;
-                else
-                        expired = should_expire(dentry, mnt, timeout, how);
-                if (!expired) {
                        spin_unlock(&sbi->fs_lock);
                        continue;
                }
+                spin_unlock(&sbi->fs_lock);
+                expired = should_expire(dentry, mnt, timeout, flags);
+                if (!expired)
+                        continue;
+                spin_lock(&sbi->fs_lock);
                ino = autofs4_dentry_ino(expired);
                ino->flags |= AUTOFS_INF_WANT_EXPIRE;
                spin_unlock(&sbi->fs_lock);
                synchronize_rcu();
-                spin_lock(&sbi->fs_lock);
-                if (should_expire(expired, mnt, timeout, how)) {
-                        if (expired != dentry)
-                                dput(dentry);
-                        goto found;
-                }
+                /* Make sure a reference is not taken on found if
+                 * things have changed.
+                 */
+                flags &= ~AUTOFS_EXP_LEAVES;
+                found = should_expire(expired, mnt, timeout, how);
+                if (!found || found != expired)
+                        /* Something has changed, continue */
+                        goto next;
+                if (expired != dentry)
+                        dput(dentry);
+                spin_lock(&sbi->fs_lock);
+                goto found;
+next:
+                spin_lock(&sbi->fs_lock);
                ino->flags &= ~AUTOFS_INF_WANT_EXPIRE;
+                spin_unlock(&sbi->fs_lock);
                if (expired != dentry)
                        dput(expired);
-                spin_unlock(&sbi->fs_lock);
        }
        return NULL;
@@ -483,6 +500,7 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
        struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
        struct autofs_info *ino = autofs4_dentry_ino(dentry);
        int status;
+        int state;
        /* Block on any pending expire */
        if (!(ino->flags & AUTOFS_INF_WANT_EXPIRE))
@@ -490,8 +508,19 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
        if (rcu_walk)
                return -ECHILD;
+retry:
        spin_lock(&sbi->fs_lock);
-        if (ino->flags & AUTOFS_INF_EXPIRING) {
+        state = ino->flags & (AUTOFS_INF_WANT_EXPIRE | AUTOFS_INF_EXPIRING);
+        if (state == AUTOFS_INF_WANT_EXPIRE) {
+                spin_unlock(&sbi->fs_lock);
+                /*
+                 * Possibly being selected for expire, wait until
+                 * it's selected or not.
+                 */
+                schedule_timeout_uninterruptible(HZ/10);
+                goto retry;
+        }
+        if (state & AUTOFS_INF_EXPIRING) {
                spin_unlock(&sbi->fs_lock);
                pr_debug("waiting for expire %p name=%pd\n", dentry, dentry);
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 6bbec5e784cd..14ae4b8e1a3c 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -609,6 +609,9 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
        char *s, *p;
        char sep;
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
+                return dget(sb->s_root);
        full_path = cifs_build_path_to_root(vol, cifs_sb,
                                            cifs_sb_master_tcon(cifs_sb));
        if (full_path == NULL)
@@ -686,26 +689,22 @@ cifs_do_mount(struct file_system_type *fs_type,
        cifs_sb->mountdata = kstrndup(data, PAGE_SIZE, GFP_KERNEL);
        if (cifs_sb->mountdata == NULL) {
                root = ERR_PTR(-ENOMEM);
-                goto out_cifs_sb;
+                goto out_free;
        }
-        if (volume_info->prepath) {
+        rc = cifs_setup_cifs_sb(volume_info, cifs_sb);
-                cifs_sb->prepath = kstrdup(volume_info->prepath, GFP_KERNEL);
+        if (rc) {
-                if (cifs_sb->prepath == NULL) {
+                root = ERR_PTR(rc);
-                        root = ERR_PTR(-ENOMEM);
+                goto out_free;
-                        goto out_cifs_sb;
-                }
        }
-        cifs_setup_cifs_sb(volume_info, cifs_sb);
        rc = cifs_mount(cifs_sb, volume_info);
        if (rc) {
                if (!(flags & MS_SILENT))
                        cifs_dbg(VFS, "cifs_mount failed w/return code = %d\n",
                                 rc);
                root = ERR_PTR(rc);
-                goto out_mountdata;
+                goto out_free;
        }
        mnt_data.vol = volume_info;
@@ -735,11 +734,7 @@ cifs_do_mount(struct file_system_type *fs_type,
                sb->s_flags |= MS_ACTIVE;
        }
-        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
+        root = cifs_get_root(volume_info, sb);
-                root = dget(sb->s_root);
-        else
-                root = cifs_get_root(volume_info, sb);
        if (IS_ERR(root))
                goto out_super;
@@ -752,9 +747,9 @@ out:
        cifs_cleanup_volume_info(volume_info);
        return root;
-out_mountdata:
+out_free:
+        kfree(cifs_sb->prepath);
        kfree(cifs_sb->mountdata);
-out_cifs_sb:
        kfree(cifs_sb);
 out_nls:
        unload_nls(volume_info->local_nls);
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 1243bd326591..95dab43646f0 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -184,7 +184,7 @@ extern int cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
                                 unsigned int to_read);
 extern int cifs_read_page_from_socket(struct TCP_Server_Info *server,
                                      struct page *page, unsigned int to_read);
-extern void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
+extern int cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                               struct cifs_sb_info *cifs_sb);
 extern int cifs_match_super(struct super_block *, void *);
 extern void cifs_cleanup_volume_info(struct smb_vol *pvolume_info);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 7ae03283bd61..2e4f4bad8b1e 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2781,6 +2781,24 @@ compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
        return 1;
 }
+static int
+match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data)
+{
+        struct cifs_sb_info *old = CIFS_SB(sb);
+        struct cifs_sb_info *new = mnt_data->cifs_sb;
+        if (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) {
+                if (!(new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH))
+                        return 0;
+                /* The prepath should be null terminated strings */
+                if (strcmp(new->prepath, old->prepath))
+                        return 0;
+                return 1;
+        }
+        return 0;
+}
 int
 cifs_match_super(struct super_block *sb, void *data)
 {
@@ -2808,7 +2826,8 @@ cifs_match_super(struct super_block *sb, void *data)
        if (!match_server(tcp_srv, volume_info) ||
            !match_session(ses, volume_info) ||
-            !match_tcon(tcon, volume_info->UNC)) {
+            !match_tcon(tcon, volume_info->UNC) ||
+            !match_prepath(sb, mnt_data)) {
                rc = 0;
                goto out;
        }
@@ -3222,7 +3241,7 @@ void reset_cifs_unix_caps(unsigned int xid, struct cifs_tcon *tcon,
        }
 }
-void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
+int cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                        struct cifs_sb_info *cifs_sb)
 {
        INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
@@ -3316,6 +3335,14 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
        if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
                cifs_dbg(VFS, "mount option dynperm ignored if cifsacl mount option supported\n");
+        if (pvolume_info->prepath) {
+                cifs_sb->prepath = kstrdup(pvolume_info->prepath, GFP_KERNEL);
+                if (cifs_sb->prepath == NULL)
+                        return -ENOMEM;
+        }
+        return 0;
 }
 static void
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 0f56deb24ce6..c415668c86d4 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -568,7 +568,7 @@ static int ioctl_fsthaw(struct file *filp)
        return thaw_super(sb);
 }
-static long ioctl_file_dedupe_range(struct file *file, void __user *arg)
+static int ioctl_file_dedupe_range(struct file *file, void __user *arg)
 {
        struct file_dedupe_range __user *argp = arg;
        struct file_dedupe_range *same = NULL;
@@ -582,6 +582,10 @@ static long ioctl_file_dedupe_range(struct file *file, void __user *arg)
        }
        size = offsetof(struct file_dedupe_range __user, info[count]);
+        if (size > PAGE_SIZE) {
+                ret = -ENOMEM;
+                goto out;
+        }
        same = memdup_user(argp, size);
        if (IS_ERR(same)) {
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index d2f97ecca6a5..e0e5f7c3c99f 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -67,18 +67,7 @@ static int fanotify_get_response(struct fsnotify_group *group,
        pr_debug("%s: group=%p event=%p\n", __func__, group, event);
-        wait_event(group->fanotify_data.access_waitq, event->response ||
+        wait_event(group->fanotify_data.access_waitq, event->response);
-                                atomic_read(&group->fanotify_data.bypass_perm));
-        if (!event->response) { /* bypass_perm set */
-                /*
-                 * Event was canceled because group is being destroyed. Remove
-                 * it from group's event list because we are responsible for
-                 * freeing the permission event.
-                 */
-                fsnotify_remove_event(group, &event->fae.fse);
-                return 0;
-        }
        /* userspace responded, convert to something usable */
        switch (event->response) {
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 8e8e6bcd1d43..a64313868d3a 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -358,16 +358,20 @@ static int fanotify_release(struct inode *ignored, struct file *file)
 #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
        struct fanotify_perm_event_info *event, *next;
+        struct fsnotify_event *fsn_event;
        /*
-         * There may be still new events arriving in the notification queue
+         * Stop new events from arriving in the notification queue. since
-         * but since userspace cannot use fanotify fd anymore, no event can
+         * userspace cannot use fanotify fd anymore, no event can enter or
-         * enter or leave access_list by now.
+         * leave access_list by now either.
         */
-        spin_lock(&group->fanotify_data.access_lock);
+        fsnotify_group_stop_queueing(group);
-        atomic_inc(&group->fanotify_data.bypass_perm);
+        /*
+         * Process all permission events on access_list and notification queue
+         * and simulate reply from userspace.
+         */
+        spin_lock(&group->fanotify_data.access_lock);
        list_for_each_entry_safe(event, next, &group->fanotify_data.access_list,
                                 fae.fse.list) {
                pr_debug("%s: found group=%p event=%p\n", __func__, group,
@@ -379,12 +383,21 @@ static int fanotify_release(struct inode *ignored, struct file *file)
        spin_unlock(&group->fanotify_data.access_lock);
        /*
-         * Since bypass_perm is set, newly queued events will not wait for
+         * Destroy all non-permission events. For permission events just
-         * access response. Wake up the already sleeping ones now.
+         * dequeue them and set the response. They will be freed once the
-         * synchronize_srcu() in fsnotify_destroy_group() will wait for all
+         * response is consumed and fanotify_get_response() returns.
-         * processes sleeping in fanotify_handle_event() waiting for access
-         * response and thus also for all permission events to be freed.
         */
+        mutex_lock(&group->notification_mutex);
+        while (!fsnotify_notify_queue_is_empty(group)) {
+                fsn_event = fsnotify_remove_first_event(group);
+                if (!(fsn_event->mask & FAN_ALL_PERM_EVENTS))
+                        fsnotify_destroy_event(group, fsn_event);
+                else
+                        FANOTIFY_PE(fsn_event)->response = FAN_ALLOW;
+        }
+        mutex_unlock(&group->notification_mutex);
+        /* Response for all permission events it set, wakeup waiters */
        wake_up(&group->fanotify_data.access_waitq);
 #endif
@@ -755,7 +768,6 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
        spin_lock_init(&group->fanotify_data.access_lock);
        init_waitqueue_head(&group->fanotify_data.access_waitq);
        INIT_LIST_HEAD(&group->fanotify_data.access_list);
-        atomic_set(&group->fanotify_data.bypass_perm, 0);
 #endif
        switch (flags & FAN_ALL_CLASS_BITS) {
        case FAN_CLASS_NOTIF:
diff --git a/fs/notify/group.c b/fs/notify/group.c
index 3e2dd85be5dd..b47f7cfdcaa4 100644
--- a/fs/notify/group.c
+++ b/fs/notify/group.c
@@ -40,6 +40,17 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group)
 }
 /*
+ * Stop queueing new events for this group. Once this function returns
+ * fsnotify_add_event() will not add any new events to the group's queue.
+ */
+void fsnotify_group_stop_queueing(struct fsnotify_group *group)
+{
+        mutex_lock(&group->notification_mutex);
+        group->shutdown = true;
+        mutex_unlock(&group->notification_mutex);
+}
+/*
 * Trying to get rid of a group. Remove all marks, flush all events and release
 * the group reference.
 * Note that another thread calling fsnotify_clear_marks_by_group() may still
@@ -47,6 +58,14 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group)
 */
 void fsnotify_destroy_group(struct fsnotify_group *group)
 {
+        /*
+         * Stop queueing new events. The code below is careful enough to not
+         * require this but fanotify needs to stop queuing events even before
+         * fsnotify_destroy_group() is called and this makes the other callers
+         * of fsnotify_destroy_group() to see the same behavior.
+         */
+        fsnotify_group_stop_queueing(group);
        /* clear all inode marks for this group, attach them to destroy_list */
        fsnotify_detach_group_marks(group);
diff --git a/fs/notify/notification.c b/fs/notify/notification.c
index a95d8e037aeb..e455e83ceeeb 100644
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -82,7 +82,8 @@ void fsnotify_destroy_event(struct fsnotify_group *group,
 * Add an event to the group notification queue.  The group can later pull this
 * event off the queue to deal with.  The function returns 0 if the event was
 * added to the queue, 1 if the event was merged with some other queued event,
- * 2 if the queue of events has overflown.
+ * 2 if the event was not queued - either the queue of events has overflown
+ * or the group is shutting down.
 */
 int fsnotify_add_event(struct fsnotify_group *group,
                       struct fsnotify_event *event,
@@ -96,6 +97,11 @@ int fsnotify_add_event(struct fsnotify_group *group,
        mutex_lock(&group->notification_mutex);
+        if (group->shutdown) {
+                mutex_unlock(&group->notification_mutex);
+                return 2;
+        }
        if (group->q_len >= group->max_events) {
                ret = 2;
                /* Queue overflow event only if it isn't already queued */
@@ -126,21 +132,6 @@ queue:
 }
 /*
- * Remove @event from group's notification queue. It is the responsibility of
- * the caller to destroy the event.
- */
-void fsnotify_remove_event(struct fsnotify_group *group,
-                           struct fsnotify_event *event)
-{
-        mutex_lock(&group->notification_mutex);
-        if (!list_empty(&event->list)) {
-                list_del_init(&event->list);
-                group->q_len--;
-        }
-        mutex_unlock(&group->notification_mutex);
-}
-/*
 * Remove and return the first event from the notification list.  It is the
 * responsibility of the caller to destroy the obtained event
 */
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 7dabbc31060e..f165f867f332 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -5922,7 +5922,6 @@ bail:
 }
 static int ocfs2_replay_truncate_records(struct ocfs2_super *osb,
-                                         handle_t *handle,
                                         struct inode *data_alloc_inode,
                                         struct buffer_head *data_alloc_bh)
 {
@@ -5935,11 +5934,19 @@ static int ocfs2_replay_truncate_records(struct ocfs2_super *osb,
        struct ocfs2_truncate_log *tl;
        struct inode *tl_inode = osb->osb_tl_inode;
        struct buffer_head *tl_bh = osb->osb_tl_bh;
+        handle_t *handle;
        di = (struct ocfs2_dinode *) tl_bh->b_data;
        tl = &di->id2.i_dealloc;
        i = le16_to_cpu(tl->tl_used) - 1;
        while (i >= 0) {
+                handle = ocfs2_start_trans(osb, OCFS2_TRUNCATE_LOG_FLUSH_ONE_REC);
+                if (IS_ERR(handle)) {
+                        status = PTR_ERR(handle);
+                        mlog_errno(status);
+                        goto bail;
+                }
                /* Caller has given us at least enough credits to
                 * update the truncate log dinode */
                status = ocfs2_journal_access_di(handle, INODE_CACHE(tl_inode), tl_bh,
@@ -5974,12 +5981,7 @@ static int ocfs2_replay_truncate_records(struct ocfs2_super *osb,
                        }
                }
-                status = ocfs2_extend_trans(handle,
+                ocfs2_commit_trans(osb, handle);
-                                OCFS2_TRUNCATE_LOG_FLUSH_ONE_REC);
-                if (status < 0) {
-                        mlog_errno(status);
-                        goto bail;
-                }
                i--;
        }
@@ -5994,7 +5996,6 @@ int __ocfs2_flush_truncate_log(struct ocfs2_super *osb)
 {
        int status;
        unsigned int num_to_flush;
-        handle_t *handle;
        struct inode *tl_inode = osb->osb_tl_inode;
        struct inode *data_alloc_inode = NULL;
        struct buffer_head *tl_bh = osb->osb_tl_bh;
@@ -6038,21 +6039,11 @@ int __ocfs2_flush_truncate_log(struct ocfs2_super *osb)
                goto out_mutex;
        }
-        handle = ocfs2_start_trans(osb, OCFS2_TRUNCATE_LOG_FLUSH_ONE_REC);
+        status = ocfs2_replay_truncate_records(osb, data_alloc_inode,
-        if (IS_ERR(handle)) {
-                status = PTR_ERR(handle);
-                mlog_errno(status);
-                goto out_unlock;
-        }
-        status = ocfs2_replay_truncate_records(osb, handle, data_alloc_inode,
                                               data_alloc_bh);
        if (status < 0)
                mlog_errno(status);
-        ocfs2_commit_trans(osb, handle);
-out_unlock:
        brelse(data_alloc_bh);
        ocfs2_inode_unlock(data_alloc_inode, 1);
@@ -6413,43 +6404,34 @@ static int ocfs2_free_cached_blocks(struct ocfs2_super *osb,
                goto out_mutex;
        }
-        handle = ocfs2_start_trans(osb, OCFS2_SUBALLOC_FREE);
-        if (IS_ERR(handle)) {
-                ret = PTR_ERR(handle);
-                mlog_errno(ret);
-                goto out_unlock;
-        }
        while (head) {
                if (head->free_bg)
                        bg_blkno = head->free_bg;
                else
                        bg_blkno = ocfs2_which_suballoc_group(head->free_blk,
                                                              head->free_bit);
+                handle = ocfs2_start_trans(osb, OCFS2_SUBALLOC_FREE);
+                if (IS_ERR(handle)) {
+                        ret = PTR_ERR(handle);
+                        mlog_errno(ret);
+                        goto out_unlock;
+                }
                trace_ocfs2_free_cached_blocks(
                     (unsigned long long)head->free_blk, head->free_bit);
                ret = ocfs2_free_suballoc_bits(handle, inode, di_bh,
                                               head->free_bit, bg_blkno, 1);
-                if (ret) {
+                if (ret)
                        mlog_errno(ret);
-                        goto out_journal;
-                }
-                ret = ocfs2_extend_trans(handle, OCFS2_SUBALLOC_FREE);
+                ocfs2_commit_trans(osb, handle);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out_journal;
-                }
                tmp = head;
                head = head->free_next;
                kfree(tmp);
        }
-out_journal:
-        ocfs2_commit_trans(osb, handle);
 out_unlock:
        ocfs2_inode_unlock(inode, 1);
        brelse(di_bh);
diff --git a/fs/ocfs2/cluster/tcp_internal.h b/fs/ocfs2/cluster/tcp_internal.h
index 94b18369b1cc..b95e7df5b76a 100644
--- a/fs/ocfs2/cluster/tcp_internal.h
+++ b/fs/ocfs2/cluster/tcp_internal.h
@@ -44,9 +44,6 @@
 * version here in tcp_internal.h should not need to be bumped for
 * filesystem locking changes.
 *
- * New in version 12
- *      - Negotiate hb timeout when storage is down.
- *
 * New in version 11
 *      - Negotiation of filesystem locking in the dlm join.
 *
@@ -78,7 +75,7 @@
 *      - full 64 bit i_size in the metadata lock lvbs
 *      - introduction of "rw" lock and pushing meta/data locking down
 */
-#define O2NET_PROTOCOL_VERSION 12ULL
+#define O2NET_PROTOCOL_VERSION 11ULL
 struct o2net_handshake {
        __be64  protocol_version;
        __be64  connector_id;
diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
index cdeafb4e7ed6..0bb128659d4b 100644
--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -268,7 +268,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
                                  struct dlm_lock *lock, int flags, int type)
 {
        enum dlm_status status;
-        u8 old_owner = res->owner;
        mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type,
             lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS);
@@ -335,7 +334,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
        spin_lock(&res->spinlock);
        res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
-        lock->convert_pending = 0;
        /* if it failed, move it back to granted queue.
         * if master returns DLM_NORMAL and then down before sending ast,
         * it may have already been moved to granted queue, reset to
@@ -344,12 +342,14 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
                if (status != DLM_NOTQUEUED)
                        dlm_error(status);
                dlm_revert_pending_convert(res, lock);
-        } else if ((res->state & DLM_LOCK_RES_RECOVERING) ||
+        } else if (!lock->convert_pending) {
-                        (old_owner != res->owner)) {
+                mlog(0, "%s: res %.*s, owner died and lock has been moved back "
-                mlog(0, "res %.*s is in recovering or has been recovered.\n",
+                                "to granted list, retry convert.\n",
-                                res->lockname.len, res->lockname.name);
+                                dlm->name, res->lockname.len, res->lockname.name);
                status = DLM_RECOVERING;
        }
+        lock->convert_pending = 0;
 bail:
        spin_unlock(&res->spinlock);
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 4e7b0dc22450..0b055bfb8e86 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1506,7 +1506,8 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
                                       u64 start, u64 len)
 {
        int ret = 0;
-        u64 tmpend, end = start + len;
+        u64 tmpend = 0;
+        u64 end = start + len;
        struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
        unsigned int csize = osb->s_clustersize;
        handle_t *handle;
@@ -1538,18 +1539,31 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
        }
        /*
-         * We want to get the byte offset of the end of the 1st cluster.
+         * If start is on a cluster boundary and end is somewhere in another
+         * cluster, we have not COWed the cluster starting at start, unless
+         * end is also within the same cluster. So, in this case, we skip this
+         * first call to ocfs2_zero_range_for_truncate() truncate and move on
+         * to the next one.
         */
-        tmpend = (u64)osb->s_clustersize + (start & ~(osb->s_clustersize - 1));
+        if ((start & (csize - 1)) != 0) {
-        if (tmpend > end)
+                /*
-                tmpend = end;
+                 * We want to get the byte offset of the end of the 1st
+                 * cluster.
+                 */
+                tmpend = (u64)osb->s_clustersize +
+                        (start & ~(osb->s_clustersize - 1));
+                if (tmpend > end)
+                        tmpend = end;
-        trace_ocfs2_zero_partial_clusters_range1((unsigned long long)start,
+                trace_ocfs2_zero_partial_clusters_range1(
-                                                 (unsigned long long)tmpend);
+                        (unsigned long long)start,
+                        (unsigned long long)tmpend);
-        ret = ocfs2_zero_range_for_truncate(inode, handle, start, tmpend);
+                ret = ocfs2_zero_range_for_truncate(inode, handle, start,
-        if (ret)
+                                                    tmpend);
-                mlog_errno(ret);
+                if (ret)
+                        mlog_errno(ret);
+        }
        if (tmpend < end) {
                /*
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index ea47120a85ff..6ad3533940ba 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -1199,14 +1199,24 @@ retry:
                        inode_unlock((*ac)->ac_inode);
                        ret = ocfs2_try_to_free_truncate_log(osb, bits_wanted);
-                        if (ret == 1)
+                        if (ret == 1) {
+                                iput((*ac)->ac_inode);
+                                (*ac)->ac_inode = NULL;
                                goto retry;
+                        }
                        if (ret < 0)
                                mlog_errno(ret);
                        inode_lock((*ac)->ac_inode);
-                        ocfs2_inode_lock((*ac)->ac_inode, NULL, 1);
+                        ret = ocfs2_inode_lock((*ac)->ac_inode, NULL, 1);
+                        if (ret < 0) {
+                                mlog_errno(ret);
+                                inode_unlock((*ac)->ac_inode);
+                                iput((*ac)->ac_inode);
+                                (*ac)->ac_inode = NULL;
+                                goto bail;
+                        }
                }
                if (status < 0) {
                        if (status != -ENOSPC)
diff --git a/fs/ramfs/file-mmu.c b/fs/ramfs/file-mmu.c
index 183a212694bf..12af0490322f 100644
--- a/fs/ramfs/file-mmu.c
+++ b/fs/ramfs/file-mmu.c
@@ -27,9 +27,17 @@
 #include <linux/fs.h>
 #include <linux/mm.h>
 #include <linux/ramfs.h>
+#include <linux/sched.h>
 #include "internal.h"
+static unsigned long ramfs_mmu_get_unmapped_area(struct file *file,
+                unsigned long addr, unsigned long len, unsigned long pgoff,
+                unsigned long flags)
+{
+        return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
+}
 const struct file_operations ramfs_file_operations = {
        .read_iter      = generic_file_read_iter,
        .write_iter     = generic_file_write_iter,
@@ -38,6 +46,7 @@ const struct file_operations ramfs_file_operations = {
        .splice_read    = generic_file_splice_read,
        .splice_write   = iter_file_splice_write,
        .llseek         = generic_file_llseek,
+        .get_unmapped_area      = ramfs_mmu_get_unmapped_area,
 };
 const struct inode_operations ramfs_file_inode_operations = {
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index 242bf530edfc..34bd80512a0c 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -1,6 +1,8 @@
 #ifndef __CPUHOTPLUG_H
 #define __CPUHOTPLUG_H
+#include <linux/types.h>
 enum cpuhp_state {
        CPUHP_OFFLINE,
        CPUHP_CREATE_THREADS,
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 58205f33af02..7268ed076be8 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -148,6 +148,7 @@ struct fsnotify_group {
        #define FS_PRIO_1       1 /* fanotify content based access control */
        #define FS_PRIO_2       2 /* fanotify pre-content access */
        unsigned int priority;
+        bool shutdown;          /* group is being shut down, don't queue more events */
        /* stores all fastpath marks assoc with this group so they can be cleaned on unregister */
        struct mutex mark_mutex;        /* protect marks_list */
@@ -179,7 +180,6 @@ struct fsnotify_group {
                        spinlock_t access_lock;
                        struct list_head access_list;
                        wait_queue_head_t access_waitq;
-                        atomic_t bypass_perm;
 #endif /* CONFIG_FANOTIFY_ACCESS_PERMISSIONS */
                        int f_flags;
                        unsigned int max_marks;
@@ -292,6 +292,8 @@ extern struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *op
 extern void fsnotify_get_group(struct fsnotify_group *group);
 /* drop reference on a group from fsnotify_alloc_group */
 extern void fsnotify_put_group(struct fsnotify_group *group);
+/* group destruction begins, stop queuing new events */
+extern void fsnotify_group_stop_queueing(struct fsnotify_group *group);
 /* destroy group */
 extern void fsnotify_destroy_group(struct fsnotify_group *group);
 /* fasync handler function */
@@ -304,8 +306,6 @@ extern int fsnotify_add_event(struct fsnotify_group *group,
                              struct fsnotify_event *event,
                              int (*merge)(struct list_head *,
                                           struct fsnotify_event *));
-/* Remove passed event from groups notification queue */
-extern void fsnotify_remove_event(struct fsnotify_group *group, struct fsnotify_event *event);
 /* true if the group notification queue is empty */
 extern bool fsnotify_notify_queue_is_empty(struct fsnotify_group *group);
 /* return, but do not dequeue the first event on the notification queue */
diff --git a/include/linux/irq.h b/include/linux/irq.h
index b52424eaa0ed..0ac26c892fe2 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -945,6 +945,16 @@ static inline void irq_gc_lock(struct irq_chip_generic *gc) { }
 static inline void irq_gc_unlock(struct irq_chip_generic *gc) { }
 #endif
+/*
+ * The irqsave variants are for usage in non interrupt code. Do not use
+ * them in irq_chip callbacks. Use irq_gc_lock() instead.
+ */
+#define irq_gc_lock_irqsave(gc, flags)  \
+        raw_spin_lock_irqsave(&(gc)->lock, flags)
+#define irq_gc_unlock_irqrestore(gc, flags)     \
+        raw_spin_unlock_irqrestore(&(gc)->lock, flags)
 static inline void irq_reg_writel(struct irq_chip_generic *gc,
                                  u32 val, int reg_offset)
 {
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 1b5d1cd796e2..75b4aaf31a9d 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -76,7 +76,7 @@ size_t iov_iter_copy_from_user_atomic(struct page *page,
                struct iov_iter *i, unsigned long offset, size_t bytes);
 void iov_iter_advance(struct iov_iter *i, size_t bytes);
 int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes);
-int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes);
+#define iov_iter_fault_in_multipages_readable iov_iter_fault_in_readable
 size_t iov_iter_single_seg_count(const struct iov_iter *i);
 size_t copy_page_to_iter(struct page *page, size_t offset, size_t bytes,
                         struct iov_iter *i);
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index d1c51b7f5221..5e8dab5bf9ad 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -6270,6 +6270,12 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
        if (cgroup_sk_alloc_disabled)
                return;
+        /* Socket clone path */
+        if (skcd->val) {
+                cgroup_get(sock_cgroup_ptr(skcd));
+                return;
+        }
        rcu_read_lock();
        while (true) {
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 9e8c7386b3a0..7e3138cfc8c9 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -291,33 +291,13 @@ done:
 }
 /*
- * Fault in the first iovec of the given iov_iter, to a maximum length
- * of bytes. Returns 0 on success, or non-zero if the memory could not be
- * accessed (ie. because it is an invalid address).
- *
- * writev-intensive code may want this to prefault several iovecs -- that
- * would be possible (callers must not rely on the fact that _only_ the
- * first iovec will be faulted with the current implementation).
- */
-int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
-{
-        if (!(i->type & (ITER_BVEC|ITER_KVEC))) {
-                char __user *buf = i->iov->iov_base + i->iov_offset;
-                bytes = min(bytes, i->iov->iov_len - i->iov_offset);
-                return fault_in_pages_readable(buf, bytes);
-        }
-        return 0;
-}
-EXPORT_SYMBOL(iov_iter_fault_in_readable);
-/*
 * Fault in one or more iovecs of the given iov_iter, to a maximum length of
 * bytes.  For each iovec, fault in each page that constitutes the iovec.
 *
 * Return 0 on success, or non-zero if the memory could not be accessed (i.e.
 * because it is an invalid address).
 */
-int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes)
+int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
 {
        size_t skip = i->iov_offset;
        const struct iovec *iov;
@@ -334,7 +314,7 @@ int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes)
        }
        return 0;
 }
-EXPORT_SYMBOL(iov_iter_fault_in_multipages_readable);
+EXPORT_SYMBOL(iov_iter_fault_in_readable);
 void iov_iter_init(struct iov_iter *i, int direction,
                        const struct iovec *iov, unsigned long nr_segs,
diff --git a/mm/debug.c b/mm/debug.c
index 8865bfb41b0b..74c7cae4f683 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -42,9 +42,11 @@ const struct trace_print_flags vmaflag_names[] = {
 void __dump_page(struct page *page, const char *reason)
 {
+        int mapcount = PageSlab(page) ? 0 : page_mapcount(page);
        pr_emerg("page:%p count:%d mapcount:%d mapping:%p index:%#lx",
-                  page, page_ref_count(page), page_mapcount(page),
+                  page, page_ref_count(page), mapcount,
-                  page->mapping, page->index);
+                  page->mapping, page_to_pgoff(page));
        if (PageCompound(page))
                pr_cont(" compound_mapcount: %d", compound_mapcount(page));
        pr_cont("\n");
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 79c52d0061af..728d7790dc2d 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -838,7 +838,8 @@ static bool hugepage_vma_check(struct vm_area_struct *vma)
 * value (scan code).
 */
-static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address)
+static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address,
+                struct vm_area_struct **vmap)
 {
        struct vm_area_struct *vma;
        unsigned long hstart, hend;
@@ -846,7 +847,7 @@ static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address)
        if (unlikely(khugepaged_test_exit(mm)))
                return SCAN_ANY_PROCESS;
-        vma = find_vma(mm, address);
+        *vmap = vma = find_vma(mm, address);
        if (!vma)
                return SCAN_VMA_NULL;
@@ -881,6 +882,11 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
                .pmd = pmd,
        };
+        /* we only decide to swapin, if there is enough young ptes */
+        if (referenced < HPAGE_PMD_NR/2) {
+                trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
+                return false;
+        }
        fe.pte = pte_offset_map(pmd, address);
        for (; fe.address < address + HPAGE_PMD_NR*PAGE_SIZE;
                        fe.pte++, fe.address += PAGE_SIZE) {
@@ -888,17 +894,12 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
                if (!is_swap_pte(pteval))
                        continue;
                swapped_in++;
-                /* we only decide to swapin, if there is enough young ptes */
-                if (referenced < HPAGE_PMD_NR/2) {
-                        trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
-                        return false;
-                }
                ret = do_swap_page(&fe, pteval);
                /* do_swap_page returns VM_FAULT_RETRY with released mmap_sem */
                if (ret & VM_FAULT_RETRY) {
                        down_read(&mm->mmap_sem);
-                        if (hugepage_vma_revalidate(mm, address)) {
+                        if (hugepage_vma_revalidate(mm, address, &fe.vma)) {
                                /* vma is no longer available, don't continue to swapin */
                                trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
                                return false;
@@ -923,7 +924,6 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
 static void collapse_huge_page(struct mm_struct *mm,
                                   unsigned long address,
                                   struct page **hpage,
-                                   struct vm_area_struct *vma,
                                   int node, int referenced)
 {
        pmd_t *pmd, _pmd;
@@ -933,6 +933,7 @@ static void collapse_huge_page(struct mm_struct *mm,
        spinlock_t *pmd_ptl, *pte_ptl;
        int isolated = 0, result = 0;
        struct mem_cgroup *memcg;
+        struct vm_area_struct *vma;
        unsigned long mmun_start;       /* For mmu_notifiers */
        unsigned long mmun_end;         /* For mmu_notifiers */
        gfp_t gfp;
@@ -961,7 +962,7 @@ static void collapse_huge_page(struct mm_struct *mm,
        }
        down_read(&mm->mmap_sem);
-        result = hugepage_vma_revalidate(mm, address);
+        result = hugepage_vma_revalidate(mm, address, &vma);
        if (result) {
                mem_cgroup_cancel_charge(new_page, memcg, true);
                up_read(&mm->mmap_sem);
@@ -994,7 +995,7 @@ static void collapse_huge_page(struct mm_struct *mm,
         * handled by the anon_vma lock + PG_lock.
         */
        down_write(&mm->mmap_sem);
-        result = hugepage_vma_revalidate(mm, address);
+        result = hugepage_vma_revalidate(mm, address, &vma);
        if (result)
                goto out;
        /* check if the pmd is still valid */
@@ -1202,7 +1203,7 @@ out_unmap:
        if (ret) {
                node = khugepaged_find_target_node();
                /* collapse_huge_page will return with the mmap_sem released */
-                collapse_huge_page(mm, address, hpage, vma, node, referenced);
+                collapse_huge_page(mm, address, hpage, node, referenced);
        }
 out:
        trace_mm_khugepaged_scan_pmd(mm, page, writable, referenced,
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 9a6a51a7c416..4be518d4e68a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1740,17 +1740,22 @@ static DEFINE_MUTEX(percpu_charge_mutex);
 static bool consume_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
 {
        struct memcg_stock_pcp *stock;
+        unsigned long flags;
        bool ret = false;
        if (nr_pages > CHARGE_BATCH)
                return ret;
-        stock = &get_cpu_var(memcg_stock);
+        local_irq_save(flags);
+        stock = this_cpu_ptr(&memcg_stock);
        if (memcg == stock->cached && stock->nr_pages >= nr_pages) {
                stock->nr_pages -= nr_pages;
                ret = true;
        }
-        put_cpu_var(memcg_stock);
+        local_irq_restore(flags);
        return ret;
 }
@@ -1771,15 +1776,18 @@ static void drain_stock(struct memcg_stock_pcp *stock)
        stock->cached = NULL;
 }
-/*
- * This must be called under preempt disabled or must be called by
- * a thread which is pinned to local cpu.
- */
 static void drain_local_stock(struct work_struct *dummy)
 {
-        struct memcg_stock_pcp *stock = this_cpu_ptr(&memcg_stock);
+        struct memcg_stock_pcp *stock;
+        unsigned long flags;
+        local_irq_save(flags);
+        stock = this_cpu_ptr(&memcg_stock);
        drain_stock(stock);
        clear_bit(FLUSHING_CACHED_CHARGE, &stock->flags);
+        local_irq_restore(flags);
 }
 /*
@@ -1788,14 +1796,19 @@ static void drain_local_stock(struct work_struct *dummy)
 */
 static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
 {
-        struct memcg_stock_pcp *stock = &get_cpu_var(memcg_stock);
+        struct memcg_stock_pcp *stock;
+        unsigned long flags;
+        local_irq_save(flags);
+        stock = this_cpu_ptr(&memcg_stock);
        if (stock->cached != memcg) { /* reset if necessary */
                drain_stock(stock);
                stock->cached = memcg;
        }
        stock->nr_pages += nr_pages;
-        put_cpu_var(memcg_stock);
+        local_irq_restore(flags);
 }
 /*
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 41266dc29f33..b58906b6215c 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1567,7 +1567,9 @@ static struct page *new_node_page(struct page *page, unsigned long private,
                return alloc_huge_page_node(page_hstate(compound_head(page)),
                                        next_node_in(nid, nmask));
-        node_clear(nid, nmask);
+        if (nid != next_node_in(nid, nmask))
+                node_clear(nid, nmask);
        if (PageHighMem(page)
            || (zone_idx(page_zone(page)) == ZONE_MOVABLE))
                gfp_mask |= __GFP_HIGHMEM;
diff --git a/mm/page_io.c b/mm/page_io.c
index 16bd82fad38c..eafe5ddc2b54 100644
--- a/mm/page_io.c
+++ b/mm/page_io.c
@@ -264,6 +264,7 @@ int __swap_writepage(struct page *page, struct writeback_control *wbc,
        int ret;
        struct swap_info_struct *sis = page_swap_info(page);
+        BUG_ON(!PageSwapCache(page));
        if (sis->flags & SWP_FILE) {
                struct kiocb kiocb;
                struct file *swap_file = sis->swap_file;
@@ -337,6 +338,7 @@ int swap_readpage(struct page *page)
        int ret = 0;
        struct swap_info_struct *sis = page_swap_info(page);
+        BUG_ON(!PageSwapCache(page));
        VM_BUG_ON_PAGE(!PageLocked(page), page);
        VM_BUG_ON_PAGE(PageUptodate(page), page);
        if (frontswap_load(page) == 0) {
@@ -386,6 +388,7 @@ int swap_set_page_dirty(struct page *page)
        if (sis->flags & SWP_FILE) {
                struct address_space *mapping = sis->swap_file->f_mapping;
+                BUG_ON(!PageSwapCache(page));
                return mapping->a_ops->set_page_dirty(page);
        } else {
                return __set_page_dirty_no_writeback(page);
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 78cfa292a29a..2657accc6e2b 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2724,7 +2724,6 @@ int swapcache_prepare(swp_entry_t entry)
 struct swap_info_struct *page_swap_info(struct page *page)
 {
        swp_entry_t swap = { .val = page_private(page) };
-        BUG_ON(!PageSwapCache(page));
        return swap_info[swp_type(swap)];
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 25dab8b60223..fd7b41edf1ce 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1362,7 +1362,6 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
                if (!try_module_get(prot->owner))
                        goto out_free_sec;
                sk_tx_queue_clear(sk);
-                cgroup_sk_alloc(&sk->sk_cgrp_data);
        }
        return sk;
@@ -1422,6 +1421,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
                sock_net_set(sk, net);
                atomic_set(&sk->sk_wmem_alloc, 1);
+                cgroup_sk_alloc(&sk->sk_cgrp_data);
                sock_update_classid(&sk->sk_cgrp_data);
                sock_update_netprioidx(&sk->sk_cgrp_data);
        }
@@ -1566,6 +1566,9 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                newsk->sk_priority = 0;
                newsk->sk_incoming_cpu = raw_smp_processor_id();
                atomic64_set(&newsk->sk_cookie, 0);
+                cgroup_sk_alloc(&newsk->sk_cgrp_data);
                /*
                 * Before updating sk_refcnt, we must commit prior changes to memory
                 * (Documentation/RCU/rculist_nulls.txt for details)
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 1d281816f2bf..d8582028b346 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -569,9 +569,10 @@ gss_svc_searchbyctx(struct cache_detail *cd, struct xdr_netobj *handle)
        struct rsc *found;
        memset(&rsci, 0, sizeof(rsci));
-        rsci.handle.data = handle->data;
+        if (dup_to_netobj(&rsci.handle, handle->data, handle->len))
-        rsci.handle.len = handle->len;
+                return NULL;
        found = rsc_lookup(cd, &rsci);
+        rsc_free(&rsci);
        if (!found)
                return NULL;
        if (cache_check(cd, &found->h, NULL))
diff --git a/scripts/faddr2line b/scripts/faddr2line
new file mode 100755
index 000000000000..450b33257339
--- /dev/null
+++ b/scripts/faddr2line
@@ -0,0 +1,177 @@
+#!/bin/bash
+#
+# Translate stack dump function offsets.
+#
+# addr2line doesn't work with KASLR addresses.  This works similarly to
+# addr2line, but instead takes the 'func+0x123' format as input:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux meminfo_proc_show+0x5/0x568
+#   meminfo_proc_show+0x5/0x568:
+#   meminfo_proc_show at fs/proc/meminfo.c:27
+#
+# If the address is part of an inlined function, the full inline call chain is
+# printed:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux native_write_msr+0x6/0x27
+#   native_write_msr+0x6/0x27:
+#   arch_static_branch at arch/x86/include/asm/msr.h:121
+#    (inlined by) static_key_false at include/linux/jump_label.h:125
+#    (inlined by) native_write_msr at arch/x86/include/asm/msr.h:125
+#
+# The function size after the '/' in the input is optional, but recommended.
+# It's used to help disambiguate any duplicate symbol names, which can occur
+# rarely.  If the size is omitted for a duplicate symbol then it's possible for
+# multiple code sites to be printed:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux raw_ioctl+0x5
+#   raw_ioctl+0x5/0x20:
+#   raw_ioctl at drivers/char/raw.c:122
+#
+#   raw_ioctl+0x5/0xb1:
+#   raw_ioctl at net/ipv4/raw.c:876
+#
+# Multiple addresses can be specified on a single command line:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux type_show+0x10/45 free_reserved_area+0x90
+#   type_show+0x10/0x2d:
+#   type_show at drivers/video/backlight/backlight.c:213
+#
+#   free_reserved_area+0x90/0x123:
+#   free_reserved_area at mm/page_alloc.c:6429 (discriminator 2)
+set -o errexit
+set -o nounset
+command -v awk >/dev/null 2>&1 || die "awk isn't installed"
+command -v readelf >/dev/null 2>&1 || die "readelf isn't installed"
+command -v addr2line >/dev/null 2>&1 || die "addr2line isn't installed"
+usage() {
+        echo "usage: faddr2line <object file> <func+offset> <func+offset>..." >&2
+        exit 1
+}
+warn() {
+        echo "$1" >&2
+}
+die() {
+        echo "ERROR: $1" >&2
+        exit 1
+}
+# Try to figure out the source directory prefix so we can remove it from the
+# addr2line output.  HACK ALERT: This assumes that start_kernel() is in
+# kernel/init.c!  This only works for vmlinux.  Otherwise it falls back to
+# printing the absolute path.
+find_dir_prefix() {
+        local objfile=$1
+        local start_kernel_addr=$(readelf -sW $objfile | awk '$8 == "start_kernel" {printf "0x%s", $2}')
+        [[ -z $start_kernel_addr ]] && return
+        local file_line=$(addr2line -e $objfile $start_kernel_addr)
+        [[ -z $file_line ]] && return
+        local prefix=${file_line%init/main.c:*}
+        if [[ -z $prefix ]] || [[ $prefix = $file_line ]]; then
+                return
+        fi
+        DIR_PREFIX=$prefix
+        return 0
+}
+__faddr2line() {
+        local objfile=$1
+        local func_addr=$2
+        local dir_prefix=$3
+        local print_warnings=$4
+        local func=${func_addr%+*}
+        local offset=${func_addr#*+}
+        offset=${offset%/*}
+        local size=
+        [[ $func_addr =~ "/" ]] && size=${func_addr#*/}
+        if [[ -z $func ]] || [[ -z $offset ]] || [[ $func = $func_addr ]]; then
+                warn "bad func+offset $func_addr"
+                DONE=1
+                return
+        fi
+        # Go through each of the object's symbols which match the func name.
+        # In rare cases there might be duplicates.
+        while read symbol; do
+                local fields=($symbol)
+                local sym_base=0x${fields[1]}
+                local sym_size=${fields[2]}
+                local sym_type=${fields[3]}
+                # calculate the address
+                local addr=$(($sym_base + $offset))
+                if [[ -z $addr ]] || [[ $addr = 0 ]]; then
+                        warn "bad address: $sym_base + $offset"
+                        DONE=1
+                        return
+                fi
+                local hexaddr=0x$(printf %x $addr)
+                # weed out non-function symbols
+                if [[ $sym_type != "FUNC" ]]; then
+                        [[ $print_warnings = 1 ]] &&
+                                echo "skipping $func address at $hexaddr due to non-function symbol"
+                        continue
+                fi
+                # if the user provided a size, make sure it matches the symbol's size
+                if [[ -n $size ]] && [[ $size -ne $sym_size ]]; then
+                        [[ $print_warnings = 1 ]] &&
+                                echo "skipping $func address at $hexaddr due to size mismatch ($size != $sym_size)"
+                        continue;
+                fi
+                # make sure the provided offset is within the symbol's range
+                if [[ $offset -gt $sym_size ]]; then
+                        [[ $print_warnings = 1 ]] &&
+                                echo "skipping $func address at $hexaddr due to size mismatch ($offset > $sym_size)"
+                        continue
+                fi
+                # separate multiple entries with a blank line
+                [[ $FIRST = 0 ]] && echo
+                FIRST=0
+                local hexsize=0x$(printf %x $sym_size)
+                echo "$func+$offset/$hexsize:"
+                addr2line -fpie $objfile $hexaddr | sed "s; $dir_prefix\(\./\)*; ;"
+                DONE=1
+        done < <(readelf -sW $objfile | awk -v f=$func '$8 == f {print}')
+}
+[[ $# -lt 2 ]] && usage
+objfile=$1
+[[ ! -f $objfile ]] && die "can't find objfile $objfile"
+shift
+DIR_PREFIX=supercalifragilisticexpialidocious
+find_dir_prefix $objfile
+FIRST=1
+while [[ $# -gt 0 ]]; do
+        func_addr=$1
+        shift
+        # print any matches found
+        DONE=0
+        __faddr2line $objfile $func_addr $DIR_PREFIX 0
+        # if no match was found, print warnings
+        if [[ $DONE = 0 ]]; then
+                __faddr2line $objfile $func_addr $DIR_PREFIX 1
+                warn "no match for $func_addr"
+        fi
+done
author	Ingo Molnar <mingo@kernel.org>	2016-09-20 02:29:21 -0400
committer	Ingo Molnar <mingo@kernel.org>	2016-09-20 02:29:21 -0400
commit	b2c16e1efddeb517c62d242fb8ec30a383843468 (patch)
tree	fbfbe6f124a9423abf9a288ad46feb6db7469c42
parent	81539169f283329fd8bc58457cc15754f683ba69 (diff)
parent	d2ffb0103aaefa9b169da042cf39ce27bfb6cdbb (diff)