449 files changed, 3719 insertions, 2472 deletions

diff --git a/.mailmap b/.mailmap
index 093a8ac9996e..de22daefd9da 100644
--- a/.mailmap
+++ b/.mailmap
@@ -88,6 +88,7 @@ Kay Sievers <kay.sievers@vrfy.org>
 Kenneth W Chen <kenneth.w.chen@intel.com>
 Konstantin Khlebnikov <koct9i@gmail.com> <k.khlebnikov@samsung.com>
 Koushik <raghavendra.koushik@neterion.com>
+Krzysztof Kozlowski <krzk@kernel.org> <k.kozlowski@samsung.com>
 Krzysztof Kozlowski <krzk@kernel.org> <k.kozlowski.k@gmail.com>
 Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
 Leonid I Ananiev <leonid.i.ananiev@intel.com>
diff --git a/Documentation/arm/CCN.txt b/Documentation/arm/CCN.txt
index ffca443a19b4..15cdb7bc57c3 100644
--- a/Documentation/arm/CCN.txt
+++ b/Documentation/arm/CCN.txt
@@ -18,13 +18,17 @@ and config2 fields of the perf_event_attr structure. The "events"
 directory provides configuration templates for all documented
 events, that can be used with perf tool. For example "xp_valid_flit"
 is an equivalent of "type=0x8,event=0x4". Other parameters must be
-explicitly specified. For events originating from device, "node"
-defines its index. All crosspoint events require "xp" (index),
-"port" (device port number) and "vc" (virtual channel ID) and
-"dir" (direction). Watchpoints (special "event" value 0xfe) also
-require comparator values ("cmp_l" and "cmp_h") and "mask", being
-index of the comparator mask.
+explicitly specified.
 
+For events originating from device, "node" defines its index.
+
+Crosspoint PMU events require "xp" (index), "bus" (bus number)
+and "vc" (virtual channel ID).
+
+Crosspoint watchpoint-based events (special "event" value 0xfe)
+require "xp" and "vc" as as above plus "port" (device port index),
+"dir" (transmit/receive direction), comparator values ("cmp_l"
+and "cmp_h") and "mask", being index of the comparator mask.
 Masks are defined separately from the event description
 (due to limited number of the config values) in the "cmp_mask"
 directory, with first 8 configurable by user and additional
diff --git a/Documentation/cpu-freq/cpufreq-stats.txt b/Documentation/cpu-freq/cpufreq-stats.txt
index fc647492e940..8d9773f23550 100644
--- a/Documentation/cpu-freq/cpufreq-stats.txt
+++ b/Documentation/cpu-freq/cpufreq-stats.txt
@@ -103,7 +103,7 @@ Config Main Menu
         Power management options (ACPI, APM)  --->
                 CPU Frequency scaling  --->
                         [*] CPU Frequency scaling
-                        <*>   CPU frequency translation statistics 
+                        [*]   CPU frequency translation statistics
                         [*]     CPU frequency translation statistics details
 
 
diff --git a/Documentation/devicetree/bindings/mmc/sdhci-st.txt b/Documentation/devicetree/bindings/mmc/sdhci-st.txt
index 88faa91125bf..3cd4c43a3260 100644
--- a/Documentation/devicetree/bindings/mmc/sdhci-st.txt
+++ b/Documentation/devicetree/bindings/mmc/sdhci-st.txt
@@ -10,7 +10,7 @@ Required properties:
                         subsystem (mmcss) inside the FlashSS (available in STiH407 SoC
                         family).
 
-- clock-names:          Should be "mmc".
+- clock-names:          Should be "mmc" and "icn".  (NB: The latter is not compulsory)
                         See: Documentation/devicetree/bindings/resource-names.txt
 - clocks:               Phandle to the clock.
                         See: Documentation/devicetree/bindings/clock/clock-bindings.txt
diff --git a/Documentation/i2c/slave-interface b/Documentation/i2c/slave-interface
index 80807adb8ded..7e2a228f21bc 100644
--- a/Documentation/i2c/slave-interface
+++ b/Documentation/i2c/slave-interface
@@ -145,6 +145,11 @@ If you want to add slave support to the bus driver:
 
 * Catch the slave interrupts and send appropriate i2c_slave_events to the backend.
 
+Note that most hardware supports being master _and_ slave on the same bus. So,
+if you extend a bus driver, please make sure that the driver supports that as
+well. In almost all cases, slave support does not need to disable the master
+functionality.
+
 Check the i2c-rcar driver as an example.
 
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 007d05acbb5f..1a5d07053e11 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1624,7 +1624,8 @@ N:	rockchip
 
 ARM/SAMSUNG EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene@kernel.org>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+R:      Javier Martinez Canillas <javier@osg.samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
@@ -1644,7 +1645,6 @@ F:	drivers/*/*s3c64xx*
 F:      drivers/*/*s5pv210*
 F:      drivers/memory/samsung/*
 F:      drivers/soc/samsung/*
-F:      drivers/spi/spi-s3c*
 F:      Documentation/arm/Samsung/
 F:      Documentation/devicetree/bindings/arm/samsung/
 F:      Documentation/devicetree/bindings/sram/samsung-sram.txt
@@ -1832,6 +1832,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson.git
 ARM/UNIPHIER ARCHITECTURE
 M:      Masahiro Yamada <yamada.masahiro@socionext.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-uniphier.git
 S:      Maintained
 F:      arch/arm/boot/dts/uniphier*
 F:      arch/arm/include/asm/hardware/cache-uniphier.h
@@ -2485,7 +2486,7 @@ F:	include/net/bluetooth/
 BONDING DRIVER
 M:      Jay Vosburgh <j.vosburgh@gmail.com>
 M:      Veaceslav Falico <vfalico@gmail.com>
-M:      Andy Gospodarek <gospo@cumulusnetworks.com>
+M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
 S:      Supported
@@ -3269,7 +3270,7 @@ S:	Maintained
 F:      drivers/net/wan/cosa*
 
 CPMAC ETHERNET DRIVER
-M:      Florian Fainelli <florian@openwrt.org>
+M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/ti/cpmac.c
@@ -6109,7 +6110,7 @@ S:	Supported
 F:      drivers/cpufreq/intel_pstate.c
 
 INTEL FRAMEBUFFER DRIVER (excluding 810 and 815)
-M:      Maik Broemme <mbroemme@plusserver.de>
+M:      Maik Broemme <mbroemme@libmpq.org>
 L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/fb/intelfb.txt
@@ -7472,7 +7473,8 @@ F:	Documentation/devicetree/bindings/sound/max9860.txt
 F:      sound/soc/codecs/max9860.*
 
 MAXIM MUIC CHARGER DRIVERS FOR EXYNOS BASED BOARDS
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-pm@vger.kernel.org
 S:      Supported
 F:      drivers/power/max14577_charger.c
@@ -7488,7 +7490,8 @@ F:	include/dt-bindings/*/*max77802.h
 
 MAXIM PMIC AND MUIC DRIVERS FOR EXYNOS BASED BOARDS
 M:      Chanwoo Choi <cw00.choi@samsung.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-kernel@vger.kernel.org
 S:      Supported
 F:      drivers/*/max14577*.c
@@ -9254,7 +9257,7 @@ F:	drivers/pinctrl/sh-pfc/
 
 PIN CONTROLLER - SAMSUNG
 M:      Tomasz Figa <tomasz.figa@gmail.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
 M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
@@ -10187,7 +10190,7 @@ S:	Maintained
 F:      drivers/platform/x86/samsung-laptop.c
 
 SAMSUNG AUDIO (ASoC) DRIVERS
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
 M:      Sangbeom Kim <sbkim73@samsung.com>
 M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
@@ -10202,7 +10205,8 @@ F:	drivers/video/fbdev/s3c-fb.c
 
 SAMSUNG MULTIFUNCTION PMIC DEVICE DRIVERS
 M:      Sangbeom Kim <sbkim73@samsung.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-kernel@vger.kernel.org
 L:      linux-samsung-soc@vger.kernel.org
 S:      Supported
@@ -10261,6 +10265,17 @@ S:	Supported
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 F:      drivers/clk/samsung/
 
+SAMSUNG SPI DRIVERS
+M:      Kukjin Kim <kgene@kernel.org>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Andi Shyti <andi.shyti@samsung.com>
+L:      linux-spi@vger.kernel.org
+L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
+S:      Maintained
+F:      Documentation/devicetree/bindings/spi/spi-samsung.txt
+F:      drivers/spi/spi-s3c*
+F:      include/linux/platform_data/spi-s3c64xx.h
+
 SAMSUNG SXGBE DRIVERS
 M:      Byungho An <bh74.an@samsung.com>
 M:      Girish K S <ks.giri@samsung.com>
@@ -12561,7 +12576,7 @@ F:	include/linux/if_*vlan.h
 F:      net/8021q/
 
 VLYNQ BUS
-M:      Florian Fainelli <florian@openwrt.org>
+M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      openwrt-devel@lists.openwrt.org (subscribers-only)
 S:      Maintained
 F:      drivers/vlynq/vlynq.c
diff --git a/Makefile b/Makefile
index a4e6cc531f81..74e22c2f408b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc7
 NAME = Psychotic Stoned Sheep
 
 # *DOCUMENTATION*
diff --git a/arch/Kconfig b/arch/Kconfig
index e9c9334507dd..fd6e9712af81 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -336,17 +336,6 @@ config HAVE_ARCH_SECCOMP_FILTER
             results in the system call being skipped immediately.
           - seccomp syscall wired up
 
-          For best performance, an arch should use seccomp_phase1 and
-          seccomp_phase2 directly.  It should call seccomp_phase1 for all
-          syscalls if TIF_SECCOMP is set, but seccomp_phase1 does not
-          need to be called from a ptrace-safe context.  It must then
-          call seccomp_phase2 if seccomp_phase1 returns anything other
-          than SECCOMP_PHASE1_OK or SECCOMP_PHASE1_SKIP.
-
-          As an additional optimization, an arch may provide seccomp_data
-          directly to seccomp_phase1; this avoids multiple calls
-          to the syscall_xyz helpers for every syscall.
-
 config SECCOMP_FILTER
         def_bool y
         depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET
diff --git a/arch/alpha/include/asm/uaccess.h b/arch/alpha/include/asm/uaccess.h
index c419b43c461d..466e42e96bfa 100644
--- a/arch/alpha/include/asm/uaccess.h
+++ b/arch/alpha/include/asm/uaccess.h
@@ -371,14 +371,6 @@ __copy_tofrom_user_nocheck(void *to, const void *from, long len)
         return __cu_len;
 }
 
-extern inline long
-__copy_tofrom_user(void *to, const void *from, long len, const void __user *validate)
-{
-        if (__access_ok((unsigned long)validate, len, get_fs()))
-                len = __copy_tofrom_user_nocheck(to, from, len);
-        return len;
-}
-
 #define __copy_to_user(to, from, n)                                     \
 ({                                                                      \
         __chk_user_ptr(to);                                             \
@@ -393,17 +385,22 @@ __copy_tofrom_user(void *to, const void *from, long len, const void __user *vali
 #define __copy_to_user_inatomic __copy_to_user
 #define __copy_from_user_inatomic __copy_from_user
 
-
 extern inline long
 copy_to_user(void __user *to, const void *from, long n)
 {
-        return __copy_tofrom_user((__force void *)to, from, n, to);
+        if (likely(__access_ok((unsigned long)to, n, get_fs())))
+                n = __copy_tofrom_user_nocheck((__force void *)to, from, n);
+        return n;
 }
 
 extern inline long
 copy_from_user(void *to, const void __user *from, long n)
 {
-        return __copy_tofrom_user(to, (__force void *)from, n, from);
+        if (likely(__access_ok((unsigned long)from, n, get_fs())))
+                n = __copy_tofrom_user_nocheck(to, (__force void *)from, n);
+        else
+                memset(to, 0, n);
+        return n;
 }
 
 extern void __do_clear_user(void);
diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
index a78d5670884f..41faf17cd28d 100644
--- a/arch/arc/include/asm/uaccess.h
+++ b/arch/arc/include/asm/uaccess.h
@@ -83,7 +83,10 @@
         "2:     ;nop\n"                         \
         "       .section .fixup, \"ax\"\n"      \
         "       .align 4\n"                     \
-        "3:     mov %0, %3\n"                   \
+        "3:     # return -EFAULT\n"             \
+        "       mov %0, %3\n"                   \
+        "       # zero out dst ptr\n"           \
+        "       mov %1,  0\n"                   \
         "       j   2b\n"                       \
         "       .previous\n"                    \
         "       .section __ex_table, \"a\"\n"   \
@@ -101,7 +104,11 @@
         "2:     ;nop\n"                         \
         "       .section .fixup, \"ax\"\n"      \
         "       .align 4\n"                     \
-        "3:     mov %0, %3\n"                   \
+        "3:     # return -EFAULT\n"             \
+        "       mov %0, %3\n"                   \
+        "       # zero out dst ptr\n"           \
+        "       mov %1,  0\n"                   \
+        "       mov %R1, 0\n"                   \
         "       j   2b\n"                       \
         "       .previous\n"                    \
         "       .section __ex_table, \"a\"\n"   \
diff --git a/arch/arm/boot/dts/am335x-baltos.dtsi b/arch/arm/boot/dts/am335x-baltos.dtsi
index c8609d8d2c55..b689172632ef 100644
--- a/arch/arm/boot/dts/am335x-baltos.dtsi
+++ b/arch/arm/boot/dts/am335x-baltos.dtsi
@@ -226,7 +226,7 @@
 
                 #address-cells = <1>;
                 #size-cells = <1>;
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
         };
 };
 
diff --git a/arch/arm/boot/dts/am335x-igep0033.dtsi b/arch/arm/boot/dts/am335x-igep0033.dtsi
index df63484ef9b3..e7d9ca1305fa 100644
--- a/arch/arm/boot/dts/am335x-igep0033.dtsi
+++ b/arch/arm/boot/dts/am335x-igep0033.dtsi
@@ -161,7 +161,7 @@
 
                 #address-cells = <1>;
                 #size-cells = <1>;
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
 
                 /* MTD partition table */
                 partition@0 {
diff --git a/arch/arm/boot/dts/am335x-phycore-som.dtsi b/arch/arm/boot/dts/am335x-phycore-som.dtsi
index 86f773165d5c..1263c9d4cba3 100644
--- a/arch/arm/boot/dts/am335x-phycore-som.dtsi
+++ b/arch/arm/boot/dts/am335x-phycore-som.dtsi
@@ -197,7 +197,7 @@
                 gpmc,wr-access-ns = <30>;
                 gpmc,wr-data-mux-bus-ns = <0>;
 
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
 
                 #address-cells = <1>;
                 #size-cells = <1>;
diff --git a/arch/arm/boot/dts/armada-388-clearfog.dts b/arch/arm/boot/dts/armada-388-clearfog.dts
index 2e0556af6e5e..d3e6bd805006 100644
--- a/arch/arm/boot/dts/armada-388-clearfog.dts
+++ b/arch/arm/boot/dts/armada-388-clearfog.dts
@@ -390,12 +390,12 @@
 
                         port@0 {
                                 reg = <0>;
-                                label = "lan1";
+                                label = "lan5";
                         };
 
                         port@1 {
                                 reg = <1>;
-                                label = "lan2";
+                                label = "lan4";
                         };
 
                         port@2 {
@@ -405,12 +405,12 @@
 
                         port@3 {
                                 reg = <3>;
-                                label = "lan4";
+                                label = "lan2";
                         };
 
                         port@4 {
                                 reg = <4>;
-                                label = "lan5";
+                                label = "lan1";
                         };
 
                         port@5 {
diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
index caf2707680c1..e9b47b2bbc33 100644
--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
@@ -2,6 +2,7 @@
 
 / {
         memory {
+                device_type = "memory";
                 reg = <0 0x10000000>;
         };
 
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index b98252232d20..445624a1a1de 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -2,7 +2,6 @@
 #include <dt-bindings/clock/bcm2835.h>
 #include <dt-bindings/clock/bcm2835-aux.h>
 #include <dt-bindings/gpio/gpio.h>
-#include "skeleton.dtsi"
 
 /* This include file covers the common peripherals and configuration between
  * bcm2835 and bcm2836 implementations, leaving the CPU configuration to
@@ -13,6 +12,8 @@
         compatible = "brcm,bcm2835";
         model = "BCM2835";
         interrupt-parent = <&intc>;
+        #address-cells = <1>;
+        #size-cells = <1>;
 
         chosen {
                 bootargs = "earlyprintk console=ttyAMA0";
diff --git a/arch/arm/boot/dts/exynos5410-odroidxu.dts b/arch/arm/boot/dts/exynos5410-odroidxu.dts
index d9499310a301..f6d135245a4b 100644
--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
+++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
@@ -447,14 +447,11 @@
         samsung,dw-mshc-ciu-div = <3>;
         samsung,dw-mshc-sdr-timing = <0 4>;
         samsung,dw-mshc-ddr-timing = <0 2>;
-        samsung,dw-mshc-hs400-timing = <0 2>;
-        samsung,read-strobe-delay = <90>;
         pinctrl-names = "default";
         pinctrl-0 = <&sd0_clk &sd0_cmd &sd0_bus1 &sd0_bus4 &sd0_bus8 &sd0_cd>;
         bus-width = <8>;
         cap-mmc-highspeed;
         mmc-hs200-1_8v;
-        mmc-hs400-1_8v;
         vmmc-supply = <&ldo20_reg>;
         vqmmc-supply = <&ldo11_reg>;
 };
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index b620ac884cfd..b13b0b2db881 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -243,7 +243,7 @@
                                         clocks = <&clks IMX6QDL_CLK_SPDIF_GCLK>, <&clks IMX6QDL_CLK_OSC>,
                                                  <&clks IMX6QDL_CLK_SPDIF>, <&clks IMX6QDL_CLK_ASRC>,
                                                  <&clks IMX6QDL_CLK_DUMMY>, <&clks IMX6QDL_CLK_ESAI_EXTAL>,
-                                                 <&clks IMX6QDL_CLK_IPG>, <&clks IMX6QDL_CLK_MLB>,
+                                                 <&clks IMX6QDL_CLK_IPG>, <&clks IMX6QDL_CLK_DUMMY>,
                                                  <&clks IMX6QDL_CLK_DUMMY>, <&clks IMX6QDL_CLK_SPBA>;
                                         clock-names = "core",  "rxtx0",
                                                       "rxtx1", "rxtx2",
diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
index 96ea936eeeb0..240a2864d044 100644
--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
+++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
@@ -64,7 +64,7 @@
         cd-gpios = <&gpio7 11 GPIO_ACTIVE_LOW>;
         no-1-8-v;
         keep-power-in-suspend;
-        enable-sdio-wakup;
+        wakeup-source;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index 95ee268ed510..2f33c463cbce 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -131,7 +131,7 @@
                 ti,y-min = /bits/ 16 <0>;
                 ti,y-max = /bits/ 16 <0>;
                 ti,pressure-max = /bits/ 16 <0>;
-                ti,x-plat-ohms = /bits/ 16 <400>;
+                ti,x-plate-ohms = /bits/ 16 <400>;
                 wakeup-source;
         };
 };
diff --git a/arch/arm/boot/dts/kirkwood-ib62x0.dts b/arch/arm/boot/dts/kirkwood-ib62x0.dts
index ef84d8699a76..5bf62897014c 100644
--- a/arch/arm/boot/dts/kirkwood-ib62x0.dts
+++ b/arch/arm/boot/dts/kirkwood-ib62x0.dts
@@ -113,7 +113,7 @@
 
         partition@e0000 {
                 label = "u-boot environment";
-                reg = <0xe0000 0x100000>;
+                reg = <0xe0000 0x20000>;
         };
 
         partition@100000 {
diff --git a/arch/arm/boot/dts/kirkwood-openrd.dtsi b/arch/arm/boot/dts/kirkwood-openrd.dtsi
index e4ecab112601..7175511a92da 100644
--- a/arch/arm/boot/dts/kirkwood-openrd.dtsi
+++ b/arch/arm/boot/dts/kirkwood-openrd.dtsi
@@ -116,6 +116,10 @@
         };
 };
 
+&pciec {
+        status = "okay";
+};
+
 &pcie0 {
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
index 365f39ff58bb..0ff1c2de95bf 100644
--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
+++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
@@ -35,10 +35,15 @@
         ranges = <0 0 0x00000000 0x1000000>;    /* CS0: 16MB for NAND */
 
         nand@0,0 {
-                linux,mtd-name = "micron,mt29f4g16abbda3w";
+                compatible = "ti,omap2-nand";
                 reg = <0 0 4>; /* CS0, offset 0, IO size 4 */
+                interrupt-parent = <&gpmc>;
+                interrupts = <0 IRQ_TYPE_NONE>, /* fifoevent */
+                             <1 IRQ_TYPE_NONE>; /* termcount */
+                linux,mtd-name = "micron,mt29f4g16abbda3w";
                 nand-bus-width = <16>;
                 ti,nand-ecc-opt = "bch8";
+                rb-gpios = <&gpmc 0 GPIO_ACTIVE_HIGH>; /* gpmc_wait0 */
                 gpmc,sync-clk-ps = <0>;
                 gpmc,cs-on-ns = <0>;
                 gpmc,cs-rd-off-ns = <44>;
@@ -54,10 +59,6 @@
                 gpmc,wr-access-ns = <40>;
                 gpmc,wr-data-mux-bus-ns = <0>;
                 gpmc,device-width = <2>;
-
-                gpmc,page-burst-access-ns = <5>;
-                gpmc,cycle2cycle-delay-ns = <50>;
-
                 #address-cells = <1>;
                 #size-cells = <1>;
 
diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
index 5e9a13c0eaf7..1c2c74655416 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
@@ -46,6 +46,7 @@
                 linux,mtd-name = "micron,mt29f4g16abbda3w";
                 nand-bus-width = <16>;
                 ti,nand-ecc-opt = "bch8";
+                rb-gpios = <&gpmc 0 GPIO_ACTIVE_HIGH>; /* gpmc_wait0 */
                 gpmc,sync-clk-ps = <0>;
                 gpmc,cs-on-ns = <0>;
                 gpmc,cs-rd-off-ns = <44>;
diff --git a/arch/arm/boot/dts/omap3-overo-base.dtsi b/arch/arm/boot/dts/omap3-overo-base.dtsi
index de256fa8da48..3e946cac55f3 100644
--- a/arch/arm/boot/dts/omap3-overo-base.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-base.dtsi
@@ -223,7 +223,9 @@
 };
 
 &gpmc {
-        ranges = <0 0 0x00000000 0x20000000>;
+        ranges = <0 0 0x30000000 0x1000000>,    /* CS0 */
+                 <4 0 0x2b000000 0x1000000>,    /* CS4 */
+                 <5 0 0x2c000000 0x1000000>;    /* CS5 */
 
         nand@0,0 {
                 compatible = "ti,omap2-nand";
diff --git a/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi b/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
index 7df27926ead2..4f4c6efbd518 100644
--- a/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
@@ -55,8 +55,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
index 9e24b6a1d07b..1b304e2f1bd2 100644
--- a/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
@@ -27,8 +27,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
index 334109e14613..82e98ee3023a 100644
--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
@@ -15,9 +15,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <4 0 0x2b000000 0x1000000>,    /* CS4 */
-                 <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         smsc1: ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/stih407-family.dtsi b/arch/arm/boot/dts/stih407-family.dtsi
index d294e82447a2..8b063ab10c19 100644
--- a/arch/arm/boot/dts/stih407-family.dtsi
+++ b/arch/arm/boot/dts/stih407-family.dtsi
@@ -550,8 +550,9 @@
                         interrupt-names = "mmcirq";
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_mmc0>;
-                        clock-names = "mmc";
-                        clocks = <&clk_s_c0_flexgen CLK_MMC_0>;
+                        clock-names = "mmc", "icn";
+                        clocks = <&clk_s_c0_flexgen CLK_MMC_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_HVA>;
                         bus-width = <8>;
                         non-removable;
                 };
@@ -565,8 +566,9 @@
                         interrupt-names = "mmcirq";
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_sd1>;
-                        clock-names = "mmc";
-                        clocks = <&clk_s_c0_flexgen CLK_MMC_1>;
+                        clock-names = "mmc", "icn";
+                        clocks = <&clk_s_c0_flexgen CLK_MMC_1>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_HVA>;
                         resets = <&softreset STIH407_MMC1_SOFTRESET>;
                         bus-width = <4>;
                 };
diff --git a/arch/arm/boot/dts/stih410.dtsi b/arch/arm/boot/dts/stih410.dtsi
index 18ed1ad10d32..40318869c733 100644
--- a/arch/arm/boot/dts/stih410.dtsi
+++ b/arch/arm/boot/dts/stih410.dtsi
@@ -41,7 +41,8 @@
                         compatible = "st,st-ohci-300x";
                         reg = <0x9a03c00 0x100>;
                         interrupts = <GIC_SPI 180 IRQ_TYPE_NONE>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                         resets = <&powerdown STIH407_USB2_PORT0_POWERDOWN>,
                                  <&softreset STIH407_USB2_PORT0_SOFTRESET>;
                         reset-names = "power", "softreset";
@@ -57,7 +58,8 @@
                         interrupts = <GIC_SPI 151 IRQ_TYPE_NONE>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_usb0>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                         resets = <&powerdown STIH407_USB2_PORT0_POWERDOWN>,
                                  <&softreset STIH407_USB2_PORT0_SOFTRESET>;
                         reset-names = "power", "softreset";
@@ -71,7 +73,8 @@
                         compatible = "st,st-ohci-300x";
                         reg = <0x9a83c00 0x100>;
                         interrupts = <GIC_SPI 181 IRQ_TYPE_NONE>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                         resets = <&powerdown STIH407_USB2_PORT1_POWERDOWN>,
                                  <&softreset STIH407_USB2_PORT1_SOFTRESET>;
                         reset-names = "power", "softreset";
@@ -87,7 +90,8 @@
                         interrupts = <GIC_SPI 153 IRQ_TYPE_NONE>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_usb1>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                         resets = <&powerdown STIH407_USB2_PORT1_POWERDOWN>,
                                  <&softreset STIH407_USB2_PORT1_SOFTRESET>;
                         reset-names = "power", "softreset";
diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
index e012890e0cf2..a17ba0243db3 100644
--- a/arch/arm/boot/dts/sun5i-a13.dtsi
+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
@@ -84,7 +84,7 @@
                         trips {
                                 cpu_alert0: cpu_alert0 {
                                         /* milliCelsius */
-                                        temperature = <850000>;
+                                        temperature = <85000>;
                                         hysteresis = <2000>;
                                         type = "passive";
                                 };
diff --git a/arch/arm/boot/dts/tegra114-dalmore.dts b/arch/arm/boot/dts/tegra114-dalmore.dts
index 1dfc492cc004..1444fbd543e7 100644
--- a/arch/arm/boot/dts/tegra114-dalmore.dts
+++ b/arch/arm/boot/dts/tegra114-dalmore.dts
@@ -897,7 +897,7 @@
                 palmas: tps65913@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <0 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <0 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/boot/dts/tegra114-roth.dts b/arch/arm/boot/dts/tegra114-roth.dts
index 70cf40996c3f..966a7fc044af 100644
--- a/arch/arm/boot/dts/tegra114-roth.dts
+++ b/arch/arm/boot/dts/tegra114-roth.dts
@@ -802,7 +802,7 @@
                 palmas: pmic@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/boot/dts/tegra114-tn7.dts b/arch/arm/boot/dts/tegra114-tn7.dts
index 17dd14545862..a161fa1dfb61 100644
--- a/arch/arm/boot/dts/tegra114-tn7.dts
+++ b/arch/arm/boot/dts/tegra114-tn7.dts
@@ -63,7 +63,7 @@
                 palmas: pmic@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/boot/dts/tegra124-jetson-tk1.dts b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
index 6403e0de540e..e52b82449a79 100644
--- a/arch/arm/boot/dts/tegra124-jetson-tk1.dts
+++ b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
@@ -1382,7 +1382,7 @@
          *   Pin 41: BR_UART1_TXD
          *   Pin 44: BR_UART1_RXD
          */
-        serial@0,70006000 {
+        serial@70006000 {
                 compatible = "nvidia,tegra124-hsuart", "nvidia,tegra30-hsuart";
                 status = "okay";
         };
@@ -1394,7 +1394,7 @@
          *   Pin 71: UART2_CTS_L
          *   Pin 74: UART2_RTS_L
          */
-        serial@0,70006040 {
+        serial@70006040 {
                 compatible = "nvidia,tegra124-hsuart", "nvidia,tegra30-hsuart";
                 status = "okay";
         };
diff --git a/arch/arm/common/locomo.c b/arch/arm/common/locomo.c
index 0e97b4b871f9..6c7b06854fce 100644
--- a/arch/arm/common/locomo.c
+++ b/arch/arm/common/locomo.c
@@ -140,7 +140,7 @@ static struct locomo_dev_info locomo_devices[] = {
 
 static void locomo_handler(struct irq_desc *desc)
 {
-        struct locomo *lchip = irq_desc_get_chip_data(desc);
+        struct locomo *lchip = irq_desc_get_handler_data(desc);
         int req, i;
 
         /* Acknowledge the parent IRQ */
@@ -200,8 +200,7 @@ static void locomo_setup_irq(struct locomo *lchip)
          * Install handler for IRQ_LOCOMO_HW.
          */
         irq_set_irq_type(lchip->irq, IRQ_TYPE_EDGE_FALLING);
-        irq_set_chip_data(lchip->irq, lchip);
-        irq_set_chained_handler(lchip->irq, locomo_handler);
+        irq_set_chained_handler_and_data(lchip->irq, locomo_handler, lchip);
 
         /* Install handlers for IRQ_LOCOMO_* */
         for ( ; irq <= lchip->irq_base + 3; irq++) {
diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
index fb0a0a4dfea4..2e076c492005 100644
--- a/arch/arm/common/sa1111.c
+++ b/arch/arm/common/sa1111.c
@@ -472,8 +472,8 @@ static int sa1111_setup_irq(struct sa1111 *sachip, unsigned irq_base)
          * specifies that S0ReadyInt and S1ReadyInt should be '1'.
          */
         sa1111_writel(0, irqbase + SA1111_INTPOL0);
-        sa1111_writel(SA1111_IRQMASK_HI(IRQ_S0_READY_NINT) |
-                      SA1111_IRQMASK_HI(IRQ_S1_READY_NINT),
+        sa1111_writel(BIT(IRQ_S0_READY_NINT & 31) |
+                      BIT(IRQ_S1_READY_NINT & 31),
                       irqbase + SA1111_INTPOL1);
 
         /* clear all IRQs */
@@ -754,7 +754,7 @@ static int __sa1111_probe(struct device *me, struct resource *mem, int irq)
         if (sachip->irq != NO_IRQ) {
                 ret = sa1111_setup_irq(sachip, pd->irq_base);
                 if (ret)
-                        goto err_unmap;
+                        goto err_clk;
         }
 
 #ifdef CONFIG_ARCH_SA1100
@@ -799,6 +799,8 @@ static int __sa1111_probe(struct device *me, struct resource *mem, int irq)
 
         return 0;
 
+ err_clk:
+        clk_disable(sachip->clk);
  err_unmap:
         iounmap(sachip->base);
  err_clk_unprep:
@@ -869,9 +871,9 @@ struct sa1111_save_data {
 
 #ifdef CONFIG_PM
 
-static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
+static int sa1111_suspend_noirq(struct device *dev)
 {
-        struct sa1111 *sachip = platform_get_drvdata(dev);
+        struct sa1111 *sachip = dev_get_drvdata(dev);
         struct sa1111_save_data *save;
         unsigned long flags;
         unsigned int val;
@@ -934,9 +936,9 @@ static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
  *      restored by their respective drivers, and must be called
  *      via LDM after this function.
  */
-static int sa1111_resume(struct platform_device *dev)
+static int sa1111_resume_noirq(struct device *dev)
 {
-        struct sa1111 *sachip = platform_get_drvdata(dev);
+        struct sa1111 *sachip = dev_get_drvdata(dev);
         struct sa1111_save_data *save;
         unsigned long flags, id;
         void __iomem *base;
@@ -952,7 +954,7 @@ static int sa1111_resume(struct platform_device *dev)
         id = sa1111_readl(sachip->base + SA1111_SKID);
         if ((id & SKID_ID_MASK) != SKID_SA1111_ID) {
                 __sa1111_remove(sachip);
-                platform_set_drvdata(dev, NULL);
+                dev_set_drvdata(dev, NULL);
                 kfree(save);
                 return 0;
         }
@@ -1003,8 +1005,8 @@ static int sa1111_resume(struct platform_device *dev)
 }
 
 #else
-#define sa1111_suspend NULL
-#define sa1111_resume  NULL
+#define sa1111_suspend_noirq NULL
+#define sa1111_resume_noirq  NULL
 #endif
 
 static int sa1111_probe(struct platform_device *pdev)
@@ -1017,7 +1019,7 @@ static int sa1111_probe(struct platform_device *pdev)
                 return -EINVAL;
         irq = platform_get_irq(pdev, 0);
         if (irq < 0)
-                return -ENXIO;
+                return irq;
 
         return __sa1111_probe(&pdev->dev, mem, irq);
 }
@@ -1038,6 +1040,11 @@ static int sa1111_remove(struct platform_device *pdev)
         return 0;
 }
 
+static struct dev_pm_ops sa1111_pm_ops = {
+        .suspend_noirq = sa1111_suspend_noirq,
+        .resume_noirq = sa1111_resume_noirq,
+};
+
 /*
  *      Not sure if this should be on the system bus or not yet.
  *      We really want some way to register a system device at
@@ -1050,10 +1057,9 @@ static int sa1111_remove(struct platform_device *pdev)
 static struct platform_driver sa1111_device_driver = {
         .probe          = sa1111_probe,
         .remove         = sa1111_remove,
-        .suspend        = sa1111_suspend,
-        .resume         = sa1111_resume,
         .driver         = {
                 .name   = "sa1111",
+                .pm     = &sa1111_pm_ops,
         },
 };
 
diff --git a/arch/arm/configs/keystone_defconfig b/arch/arm/configs/keystone_defconfig
index 71b42e66488a..78cd2f197e01 100644
--- a/arch/arm/configs/keystone_defconfig
+++ b/arch/arm/configs/keystone_defconfig
@@ -161,6 +161,7 @@ CONFIG_USB_MON=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC3=y
+CONFIG_NOP_USB_XCEIV=y
 CONFIG_KEYSTONE_USB_PHY=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 2c8665cd9dc5..ea3566fb92e2 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -781,7 +781,7 @@ CONFIG_MXS_DMA=y
 CONFIG_DMA_BCM2835=y
 CONFIG_DMA_OMAP=y
 CONFIG_QCOM_BAM_DMA=y
-CONFIG_XILINX_VDMA=y
+CONFIG_XILINX_DMA=y
 CONFIG_DMA_SUN6I=y
 CONFIG_STAGING=y
 CONFIG_SENSORS_ISL29018=y
diff --git a/arch/arm/crypto/aes-ce-glue.c b/arch/arm/crypto/aes-ce-glue.c
index da3c0428507b..aef022a87c53 100644
--- a/arch/arm/crypto/aes-ce-glue.c
+++ b/arch/arm/crypto/aes-ce-glue.c
@@ -284,7 +284,7 @@ static int ctr_encrypt(struct blkcipher_desc *desc, struct scatterlist *dst,
                 err = blkcipher_walk_done(desc, &walk,
                                           walk.nbytes % AES_BLOCK_SIZE);
         }
-        if (nbytes) {
+        if (walk.nbytes % AES_BLOCK_SIZE) {
                 u8 *tdst = walk.dst.virt.addr + blocks * AES_BLOCK_SIZE;
                 u8 *tsrc = walk.src.virt.addr + blocks * AES_BLOCK_SIZE;
                 u8 __aligned(8) tail[AES_BLOCK_SIZE];
diff --git a/arch/arm/include/asm/pgtable-2level-hwdef.h b/arch/arm/include/asm/pgtable-2level-hwdef.h
index d0131ee6f6af..3f82e9da7cec 100644
--- a/arch/arm/include/asm/pgtable-2level-hwdef.h
+++ b/arch/arm/include/asm/pgtable-2level-hwdef.h
@@ -47,6 +47,7 @@
 #define PMD_SECT_WB             (PMD_SECT_CACHEABLE | PMD_SECT_BUFFERABLE)
 #define PMD_SECT_MINICACHE      (PMD_SECT_TEX(1) | PMD_SECT_CACHEABLE)
 #define PMD_SECT_WBWA           (PMD_SECT_TEX(1) | PMD_SECT_CACHEABLE | PMD_SECT_BUFFERABLE)
+#define PMD_SECT_CACHE_MASK     (PMD_SECT_TEX(1) | PMD_SECT_CACHEABLE | PMD_SECT_BUFFERABLE)
 #define PMD_SECT_NONSHARED_DEV  (PMD_SECT_TEX(2))
 
 /*
diff --git a/arch/arm/include/asm/pgtable-3level-hwdef.h b/arch/arm/include/asm/pgtable-3level-hwdef.h
index f8f1cff62065..4cd664abfcd3 100644
--- a/arch/arm/include/asm/pgtable-3level-hwdef.h
+++ b/arch/arm/include/asm/pgtable-3level-hwdef.h
@@ -62,6 +62,7 @@
 #define PMD_SECT_WT             (_AT(pmdval_t, 2) << 2) /* normal inner write-through */
 #define PMD_SECT_WB             (_AT(pmdval_t, 3) << 2) /* normal inner write-back */
 #define PMD_SECT_WBWA           (_AT(pmdval_t, 7) << 2) /* normal inner write-alloc */
+#define PMD_SECT_CACHE_MASK     (_AT(pmdval_t, 7) << 2)
 
 /*
  * + Level 3 descriptor (PTE)
diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
index 0b1e4a93d67e..15d073ae5da2 100644
--- a/arch/arm/kernel/hyp-stub.S
+++ b/arch/arm/kernel/hyp-stub.S
@@ -142,6 +142,19 @@ ARM_BE8(orr	r7, r7, #(1 << 25))     @ HSCTLR.EE
         and     r7, #0x1f               @ Preserve HPMN
         mcr     p15, 4, r7, c1, c1, 1   @ HDCR
 
+        @ Make sure NS-SVC is initialised appropriately
+        mrc     p15, 0, r7, c1, c0, 0   @ SCTLR
+        orr     r7, #(1 << 5)           @ CP15 barriers enabled
+        bic     r7, #(3 << 7)           @ Clear SED/ITD for v8 (RES0 for v7)
+        bic     r7, #(3 << 19)          @ WXN and UWXN disabled
+        mcr     p15, 0, r7, c1, c0, 0   @ SCTLR
+
+        mrc     p15, 0, r7, c0, c0, 0   @ MIDR
+        mcr     p15, 4, r7, c0, c0, 0   @ VPIDR
+
+        mrc     p15, 0, r7, c0, c0, 5   @ MPIDR
+        mcr     p15, 4, r7, c0, c0, 5   @ VMPIDR
+
 #if !defined(ZIMAGE) && defined(CONFIG_ARM_ARCH_TIMER)
         @ make CNTP_* and CNTPCT accessible from PL1
         mrc     p15, 0, r7, c0, c1, 1   @ ID_PFR1
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 75f130ef6504..c94b90d43772 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -158,8 +158,6 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
 {
         int i;
 
-        kvm_free_stage2_pgd(kvm);
-
         for (i = 0; i < KVM_MAX_VCPUS; ++i) {
                 if (kvm->vcpus[i]) {
                         kvm_arch_vcpu_free(kvm->vcpus[i]);
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 29d0b23af2a9..e9a5c0e0c115 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -1714,7 +1714,8 @@ int kvm_mmu_init(void)
                  kern_hyp_va(PAGE_OFFSET), kern_hyp_va(~0UL));
 
         if (hyp_idmap_start >= kern_hyp_va(PAGE_OFFSET) &&
-            hyp_idmap_start <  kern_hyp_va(~0UL)) {
+            hyp_idmap_start <  kern_hyp_va(~0UL) &&
+            hyp_idmap_start != (unsigned long)__hyp_idmap_text_start) {
                 /*
                  * The idmap page is intersecting with the VA space,
                  * it is not safe to continue further.
@@ -1893,6 +1894,7 @@ void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots)
 
 void kvm_arch_flush_shadow_all(struct kvm *kvm)
 {
+        kvm_free_stage2_pgd(kvm);
 }
 
 void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
index 3750575c73c5..06332f626565 100644
--- a/arch/arm/mach-exynos/suspend.c
+++ b/arch/arm/mach-exynos/suspend.c
@@ -255,6 +255,12 @@ static int __init exynos_pmu_irq_init(struct device_node *node,
                 return -ENOMEM;
         }
 
+        /*
+         * Clear the OF_POPULATED flag set in of_irq_init so that
+         * later the Exynos PMU platform device won't be skipped.
+         */
+        of_node_clear_flag(node, OF_POPULATED);
+
         return 0;
 }
 
diff --git a/arch/arm/mach-imx/mach-imx6ul.c b/arch/arm/mach-imx/mach-imx6ul.c
index 5d9bfab279dd..6bb7d9cf1e38 100644
--- a/arch/arm/mach-imx/mach-imx6ul.c
+++ b/arch/arm/mach-imx/mach-imx6ul.c
@@ -64,6 +64,7 @@ static void __init imx6ul_init_machine(void)
         if (parent == NULL)
                 pr_warn("failed to initialize soc device\n");
 
+        of_platform_default_populate(NULL, NULL, parent);
         imx6ul_enet_init();
         imx_anatop_init();
         imx6ul_pm_init();
diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
index 58924b3844df..fe708e26d021 100644
--- a/arch/arm/mach-imx/pm-imx6.c
+++ b/arch/arm/mach-imx/pm-imx6.c
@@ -295,7 +295,7 @@ int imx6_set_lpm(enum mxc_cpu_pwr_mode mode)
                 val &= ~BM_CLPCR_SBYOS;
                 if (cpu_is_imx6sl())
                         val |= BM_CLPCR_BYPASS_PMIC_READY;
-                if (cpu_is_imx6sl() || cpu_is_imx6sx())
+                if (cpu_is_imx6sl() || cpu_is_imx6sx() || cpu_is_imx6ul())
                         val |= BM_CLPCR_BYP_MMDC_CH0_LPM_HS;
                 else
                         val |= BM_CLPCR_BYP_MMDC_CH1_LPM_HS;
@@ -310,7 +310,7 @@ int imx6_set_lpm(enum mxc_cpu_pwr_mode mode)
                 val |= 0x3 << BP_CLPCR_STBY_COUNT;
                 val |= BM_CLPCR_VSTBY;
                 val |= BM_CLPCR_SBYOS;
-                if (cpu_is_imx6sl())
+                if (cpu_is_imx6sl() || cpu_is_imx6sx())
                         val |= BM_CLPCR_BYPASS_PMIC_READY;
                 if (cpu_is_imx6sl() || cpu_is_imx6sx() || cpu_is_imx6ul())
                         val |= BM_CLPCR_BYP_MMDC_CH0_LPM_HS;
diff --git a/arch/arm/mach-omap2/cm33xx.c b/arch/arm/mach-omap2/cm33xx.c
index c073fb57dd13..6f2d0aec0513 100644
--- a/arch/arm/mach-omap2/cm33xx.c
+++ b/arch/arm/mach-omap2/cm33xx.c
@@ -220,9 +220,6 @@ static int am33xx_cm_wait_module_ready(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout(_is_module_ready(inst, clkctrl_offs),
                           MAX_MODULE_READY_TIME, i);
 
@@ -246,9 +243,6 @@ static int am33xx_cm_wait_module_idle(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout((_clkctrl_idlest(inst, clkctrl_offs) ==
                                 CLKCTRL_IDLEST_DISABLED),
                                 MAX_MODULE_READY_TIME, i);
diff --git a/arch/arm/mach-omap2/cminst44xx.c b/arch/arm/mach-omap2/cminst44xx.c
index 2c0e07ed6b99..2ab27ade136a 100644
--- a/arch/arm/mach-omap2/cminst44xx.c
+++ b/arch/arm/mach-omap2/cminst44xx.c
@@ -278,9 +278,6 @@ static int omap4_cminst_wait_module_ready(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout(_is_module_ready(part, inst, clkctrl_offs),
                           MAX_MODULE_READY_TIME, i);
 
@@ -304,9 +301,6 @@ static int omap4_cminst_wait_module_idle(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout((_clkctrl_idlest(part, inst, clkctrl_offs) ==
                            CLKCTRL_IDLEST_DISABLED),
                           MAX_MODULE_DISABLE_TIME, i);
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 5b709383381c..1052b29697b8 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1053,6 +1053,10 @@ static int _omap4_wait_target_disable(struct omap_hwmod *oh)
         if (oh->flags & HWMOD_NO_IDLEST)
                 return 0;
 
+        if (!oh->prcm.omap4.clkctrl_offs &&
+            !(oh->prcm.omap4.flags & HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET))
+                return 0;
+
         return omap_cm_wait_module_idle(oh->clkdm->prcm_partition,
                                         oh->clkdm->cm_inst,
                                         oh->prcm.omap4.clkctrl_offs, 0);
@@ -2971,6 +2975,10 @@ static int _omap4_wait_target_ready(struct omap_hwmod *oh)
         if (!_find_mpu_rt_port(oh))
                 return 0;
 
+        if (!oh->prcm.omap4.clkctrl_offs &&
+            !(oh->prcm.omap4.flags & HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET))
+                return 0;
+
         /* XXX check module SIDLEMODE, hardreset status */
 
         return omap_cm_wait_module_ready(oh->clkdm->prcm_partition,
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index 4041bad79a9a..78904017f18c 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -443,8 +443,12 @@ struct omap_hwmod_omap2_prcm {
  * HWMOD_OMAP4_NO_CONTEXT_LOSS_BIT: Some IP blocks don't have a PRCM
  *     module-level context loss register associated with them; this
  *     flag bit should be set in those cases
+ * HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET: Some IP blocks have a valid CLKCTRL
+ *      offset of zero; this flag bit should be set in those cases to
+ *      distinguish from hwmods that have no clkctrl offset.
  */
 #define HWMOD_OMAP4_NO_CONTEXT_LOSS_BIT         (1 << 0)
+#define HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET         (1 << 1)
 
 /**
  * struct omap_hwmod_omap4_prcm - OMAP4-specific PRCM data
diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
index 55c5878577f4..e2d84aa7f595 100644
--- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
@@ -29,6 +29,7 @@
 #define CLKCTRL(oh, clkctrl) ((oh).prcm.omap4.clkctrl_offs = (clkctrl))
 #define RSTCTRL(oh, rstctrl) ((oh).prcm.omap4.rstctrl_offs = (rstctrl))
 #define RSTST(oh, rstst) ((oh).prcm.omap4.rstst_offs = (rstst))
+#define PRCM_FLAGS(oh, flag) ((oh).prcm.omap4.flags = (flag))
 
 /*
  * 'l3' class
@@ -1296,6 +1297,7 @@ static void omap_hwmod_am33xx_clkctrl(void)
         CLKCTRL(am33xx_i2c1_hwmod, AM33XX_CM_WKUP_I2C0_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_wd_timer1_hwmod, AM33XX_CM_WKUP_WDT1_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_rtc_hwmod, AM33XX_CM_RTC_RTC_CLKCTRL_OFFSET);
+        PRCM_FLAGS(am33xx_rtc_hwmod, HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_mmc2_hwmod, AM33XX_CM_PER_MMC2_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_gpmc_hwmod, AM33XX_CM_PER_GPMC_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_l4_ls_hwmod, AM33XX_CM_PER_L4LS_CLKCTRL_OFFSET);
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index d72ee6185d5e..1cc4a6f3954e 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -722,8 +722,20 @@ static struct omap_hwmod omap3xxx_dss_dispc_hwmod = {
  * display serial interface controller
  */
 
+static struct omap_hwmod_class_sysconfig omap3xxx_dsi_sysc = {
+        .rev_offs       = 0x0000,
+        .sysc_offs      = 0x0010,
+        .syss_offs      = 0x0014,
+        .sysc_flags     = (SYSC_HAS_AUTOIDLE | SYSC_HAS_CLOCKACTIVITY |
+                           SYSC_HAS_ENAWAKEUP | SYSC_HAS_SIDLEMODE |
+                           SYSC_HAS_SOFTRESET | SYSS_HAS_RESET_STATUS),
+        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
+        .sysc_fields    = &omap_hwmod_sysc_type1,
+};
+
 static struct omap_hwmod_class omap3xxx_dsi_hwmod_class = {
         .name = "dsi",
+        .sysc   = &omap3xxx_dsi_sysc,
 };
 
 static struct omap_hwmod_irq_info omap3xxx_dsi1_irqs[] = {
diff --git a/arch/arm/mach-pxa/lubbock.c b/arch/arm/mach-pxa/lubbock.c
index 7245f3359564..d6159f8ef0c2 100644
--- a/arch/arm/mach-pxa/lubbock.c
+++ b/arch/arm/mach-pxa/lubbock.c
@@ -137,6 +137,18 @@ static struct pxa2xx_udc_mach_info udc_info __initdata = {
         // no D+ pullup; lubbock can't connect/disconnect in software
 };
 
+static void lubbock_init_pcmcia(void)
+{
+        struct clk *clk;
+
+        /* Add an alias for the SA1111 PCMCIA clock */
+        clk = clk_get_sys("pxa2xx-pcmcia", NULL);
+        if (!IS_ERR(clk)) {
+                clkdev_create(clk, NULL, "1800");
+                clk_put(clk);
+        }
+}
+
 static struct resource sa1111_resources[] = {
         [0] = {
                 .start  = 0x10000000,
@@ -467,6 +479,8 @@ static void __init lubbock_init(void)
         pxa_set_btuart_info(NULL);
         pxa_set_stuart_info(NULL);
 
+        lubbock_init_pcmcia();
+
         clk_add_alias("SA1111_CLK", NULL, "GPIO11_CLK", NULL);
         pxa_set_udc_info(&udc_info);
         pxa_set_fb_info(NULL, &sharp_lm8v31);
diff --git a/arch/arm/mach-sa1100/clock.c b/arch/arm/mach-sa1100/clock.c
index cbf53bb9c814..0db46895c82a 100644
--- a/arch/arm/mach-sa1100/clock.c
+++ b/arch/arm/mach-sa1100/clock.c
@@ -125,6 +125,8 @@ static unsigned long clk_36864_get_rate(struct clk *clk)
 }
 
 static struct clkops clk_36864_ops = {
+        .enable         = clk_cpu_enable,
+        .disable        = clk_cpu_disable,
         .get_rate       = clk_36864_get_rate,
 };
 
@@ -140,9 +142,8 @@ static struct clk_lookup sa11xx_clkregs[] = {
         CLKDEV_INIT(NULL, "OSTIMER0", &clk_36864),
 };
 
-static int __init sa11xx_clk_init(void)
+int __init sa11xx_clk_init(void)
 {
         clkdev_add_table(sa11xx_clkregs, ARRAY_SIZE(sa11xx_clkregs));
         return 0;
 }
-core_initcall(sa11xx_clk_init);
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index 345e63f4eb71..3e09beddb6e8 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -34,6 +34,7 @@
 
 #include <mach/hardware.h>
 #include <mach/irqs.h>
+#include <mach/reset.h>
 
 #include "generic.h"
 #include <clocksource/pxa.h>
@@ -95,6 +96,8 @@ static void sa1100_power_off(void)
 
 void sa11x0_restart(enum reboot_mode mode, const char *cmd)
 {
+        clear_reset_status(RESET_STATUS_ALL);
+
         if (mode == REBOOT_SOFT) {
                 /* Jump into ROM at address 0 */
                 soft_restart(0);
@@ -388,6 +391,7 @@ void __init sa1100_init_irq(void)
         sa11x0_init_irq_nodt(IRQ_GPIO0_SC, irq_resource.start);
 
         sa1100_init_gpio();
+        sa11xx_clk_init();
 }
 
 /*
diff --git a/arch/arm/mach-sa1100/generic.h b/arch/arm/mach-sa1100/generic.h
index 0d92e119b36b..68199b603ff7 100644
--- a/arch/arm/mach-sa1100/generic.h
+++ b/arch/arm/mach-sa1100/generic.h
@@ -44,3 +44,5 @@ int sa11x0_pm_init(void);
 #else
 static inline int sa11x0_pm_init(void) { return 0; }
 #endif
+
+int sa11xx_clk_init(void);
diff --git a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
index 62437b57813e..73e3adbc1330 100644
--- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
+++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
@@ -41,39 +41,26 @@
 
 #define REGULATOR_IRQ_MASK      BIT(2)  /* IRQ2, active low */
 
-static void __iomem *irqc;
-
-static const u8 da9063_mask_regs[] = {
-        DA9063_REG_IRQ_MASK_A,
-        DA9063_REG_IRQ_MASK_B,
-        DA9063_REG_IRQ_MASK_C,
-        DA9063_REG_IRQ_MASK_D,
-};
-
-/* DA9210 System Control and Event Registers */
+/* start of DA9210 System Control and Event Registers */
 #define DA9210_REG_MASK_A               0x54
-#define DA9210_REG_MASK_B               0x55
-
-static const u8 da9210_mask_regs[] = {
-        DA9210_REG_MASK_A,
-        DA9210_REG_MASK_B,
-};
-
-static void da9xxx_mask_irqs(struct i2c_client *client, const u8 regs[],
-                             unsigned int nregs)
-{
-        unsigned int i;
 
-        dev_info(&client->dev, "Masking %s interrupt sources\n", client->name);
+static void __iomem *irqc;
 
-        for (i = 0; i < nregs; i++) {
-                int error = i2c_smbus_write_byte_data(client, regs[i], ~0);
-                if (error) {
-                        dev_err(&client->dev, "i2c error %d\n", error);
-                        return;
-                }
-        }
-}
+/* first byte sets the memory pointer, following are consecutive reg values */
+static u8 da9063_irq_clr[] = { DA9063_REG_IRQ_MASK_A, 0xff, 0xff, 0xff, 0xff };
+static u8 da9210_irq_clr[] = { DA9210_REG_MASK_A, 0xff, 0xff };
+
+static struct i2c_msg da9xxx_msgs[2] = {
+        {
+                .addr = 0x58,
+                .len = ARRAY_SIZE(da9063_irq_clr),
+                .buf = da9063_irq_clr,
+        }, {
+                .addr = 0x68,
+                .len = ARRAY_SIZE(da9210_irq_clr),
+                .buf = da9210_irq_clr,
+        },
+};
 
 static int regulator_quirk_notify(struct notifier_block *nb,
                                   unsigned long action, void *data)
@@ -93,12 +80,15 @@ static int regulator_quirk_notify(struct notifier_block *nb,
         client = to_i2c_client(dev);
         dev_dbg(dev, "Detected %s\n", client->name);
 
-        if ((client->addr == 0x58 && !strcmp(client->name, "da9063")))
-                da9xxx_mask_irqs(client, da9063_mask_regs,
-                                 ARRAY_SIZE(da9063_mask_regs));
-        else if (client->addr == 0x68 && !strcmp(client->name, "da9210"))
-                da9xxx_mask_irqs(client, da9210_mask_regs,
-                                 ARRAY_SIZE(da9210_mask_regs));
+        if ((client->addr == 0x58 && !strcmp(client->name, "da9063")) ||
+            (client->addr == 0x68 && !strcmp(client->name, "da9210"))) {
+                int ret;
+
+                dev_info(&client->dev, "clearing da9063/da9210 interrupts\n");
+                ret = i2c_transfer(client->adapter, da9xxx_msgs, ARRAY_SIZE(da9xxx_msgs));
+                if (ret != ARRAY_SIZE(da9xxx_msgs))
+                        dev_err(&client->dev, "i2c error %d\n", ret);
+        }
 
         mon = ioread32(irqc + IRQC_MONITOR);
         if (mon & REGULATOR_IRQ_MASK)
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 6344913f0804..30fe03f95c85 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -137,7 +137,7 @@ void __init init_default_cache_policy(unsigned long pmd)
 
         initial_pmd_value = pmd;
 
-        pmd &= PMD_SECT_TEX(1) | PMD_SECT_BUFFERABLE | PMD_SECT_CACHEABLE;
+        pmd &= PMD_SECT_CACHE_MASK;
 
         for (i = 0; i < ARRAY_SIZE(cache_policies); i++)
                 if (cache_policies[i].pmd == pmd) {
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index a7123b4e129d..d00d52c9de3e 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -16,6 +16,7 @@
 #include <asm/hwcap.h>
 #include <asm/pgtable-hwdef.h>
 #include <asm/pgtable.h>
+#include <asm/memory.h>
 
 #include "proc-macros.S"
 
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index 3d2cef6488ea..f193414d0f6f 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -170,9 +170,6 @@ static int xen_starting_cpu(unsigned int cpu)
         pr_info("Xen: initializing cpu%d\n", cpu);
         vcpup = per_cpu_ptr(xen_vcpu_info, cpu);
 
-        /* Direct vCPU id mapping for ARM guests. */
-        per_cpu(xen_vcpu_id, cpu) = cpu;
-
         info.mfn = virt_to_gfn(vcpup);
         info.offset = xen_offset_in_page(vcpup);
 
@@ -330,6 +327,7 @@ static int __init xen_guest_init(void)
 {
         struct xen_add_to_physmap xatp;
         struct shared_info *shared_info_page = NULL;
+        int cpu;
 
         if (!xen_domain())
                 return 0;
@@ -380,7 +378,8 @@ static int __init xen_guest_init(void)
                 return -ENOMEM;
 
         /* Direct vCPU id mapping for ARM guests. */
-        per_cpu(xen_vcpu_id, 0) = 0;
+        for_each_possible_cpu(cpu)
+                per_cpu(xen_vcpu_id, cpu) = cpu;
 
         xen_auto_xlat_grant_frames.count = gnttab_max_grant_frames();
         if (xen_xlate_map_ballooned_pages(&xen_auto_xlat_grant_frames.pfn,
diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
index 445aa678f914..c2b9bcb0ef61 100644
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
@@ -255,10 +255,10 @@
                 /* Local timer */
                 timer {
                         compatible = "arm,armv8-timer";
-                        interrupts = <1 13 0xf01>,
-                                     <1 14 0xf01>,
-                                     <1 11 0xf01>,
-                                     <1 10 0xf01>;
+                        interrupts = <1 13 0xf08>,
+                                     <1 14 0xf08>,
+                                     <1 11 0xf08>,
+                                     <1 10 0xf08>;
                 };
 
                 timer0: timer0@ffc03000 {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
index e502c24b0ac7..bf6c8d051002 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
@@ -102,13 +102,13 @@
         timer {
                 compatible = "arm,armv8-timer";
                 interrupts = <GIC_PPI 13
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>,
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 14
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>,
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 11
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>,
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 10
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>;
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>;
         };
 
         xtal: xtal-clk {
diff --git a/arch/arm64/boot/dts/apm/apm-storm.dtsi b/arch/arm64/boot/dts/apm/apm-storm.dtsi
index f1c2c713f9b0..c29dab9d1834 100644
--- a/arch/arm64/boot/dts/apm/apm-storm.dtsi
+++ b/arch/arm64/boot/dts/apm/apm-storm.dtsi
@@ -110,10 +110,10 @@
 
         timer {
                 compatible = "arm,armv8-timer";
-                interrupts = <1 0 0xff01>,      /* Secure Phys IRQ */
-                             <1 13 0xff01>,     /* Non-secure Phys IRQ */
-                             <1 14 0xff01>,     /* Virt IRQ */
-                             <1 15 0xff01>;     /* Hyp IRQ */
+                interrupts = <1 0 0xff08>,      /* Secure Phys IRQ */
+                             <1 13 0xff08>,     /* Non-secure Phys IRQ */
+                             <1 14 0xff08>,     /* Virt IRQ */
+                             <1 15 0xff08>;     /* Hyp IRQ */
                 clock-frequency = <50000000>;
         };
 
diff --git a/arch/arm64/boot/dts/broadcom/bcm2835-rpi.dtsi b/arch/arm64/boot/dts/broadcom/bcm2835-rpi.dtsi
new file mode 120000
index 000000000000..3937b77cb310
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm2835-rpi.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm2835-rpi.dtsi
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
index 6f47dd2bb1db..7841b724e340 100644
--- a/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
+++ b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
@@ -1,7 +1,7 @@
 /dts-v1/;
 #include "bcm2837.dtsi"
-#include "../../../../arm/boot/dts/bcm2835-rpi.dtsi"
-#include "../../../../arm/boot/dts/bcm283x-rpi-smsc9514.dtsi"
+#include "bcm2835-rpi.dtsi"
+#include "bcm283x-rpi-smsc9514.dtsi"
 
 / {
         compatible = "raspberrypi,3-model-b", "brcm,bcm2837";
diff --git a/arch/arm64/boot/dts/broadcom/bcm2837.dtsi b/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
index f2a31d06845d..8216bbb29fe0 100644
--- a/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
+++ b/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
@@ -1,4 +1,4 @@
-#include "../../../../arm/boot/dts/bcm283x.dtsi"
+#include "bcm283x.dtsi"
 
 / {
         compatible = "brcm,bcm2836";
diff --git a/arch/arm64/boot/dts/broadcom/bcm283x-rpi-smsc9514.dtsi b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-smsc9514.dtsi
new file mode 120000
index 000000000000..dca7c057d5a5
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-smsc9514.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm283x-rpi-smsc9514.dtsi
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/broadcom/bcm283x.dtsi b/arch/arm64/boot/dts/broadcom/bcm283x.dtsi
new file mode 120000
index 000000000000..5f54e4cab99b
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm283x.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm283x.dtsi
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/broadcom/ns2.dtsi b/arch/arm64/boot/dts/broadcom/ns2.dtsi
index f53b0955bfd3..d4a12fad8afd 100644
--- a/arch/arm64/boot/dts/broadcom/ns2.dtsi
+++ b/arch/arm64/boot/dts/broadcom/ns2.dtsi
@@ -88,13 +88,13 @@
         timer {
                 compatible = "arm,armv8-timer";
                 interrupts = <GIC_PPI 13 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>,
+                              IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 14 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>,
+                              IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 11 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>,
+                              IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 10 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>;
+                              IRQ_TYPE_LEVEL_LOW)>;
         };
 
         pmu {
diff --git a/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi b/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
index 2eb9b225f0bc..04dc8a8d1539 100644
--- a/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
+++ b/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
@@ -354,10 +354,10 @@
 
         timer {
                 compatible = "arm,armv8-timer";
-                interrupts = <1 13 0xff01>,
-                             <1 14 0xff01>,
-                             <1 11 0xff01>,
-                             <1 10 0xff01>;
+                interrupts = <1 13 4>,
+                             <1 14 4>,
+                             <1 11 4>,
+                             <1 10 4>;
         };
 
         pmu {
diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index ca663dfe5189..162831546e18 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -473,10 +473,10 @@
 
                 timer {
                         compatible = "arm,armv8-timer";
-                        interrupts = <1 13 0xff01>,
-                                     <1 14 0xff01>,
-                                     <1 11 0xff01>,
-                                     <1 10 0xff01>;
+                        interrupts = <1 13 0xff08>,
+                                     <1 14 0xff08>,
+                                     <1 11 0xff08>,
+                                     <1 10 0xff08>;
                 };
 
                 pmu_system_controller: system-controller@105c0000 {
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
index e669fbd7f9c3..a67e210e2019 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
@@ -119,10 +119,10 @@
 
         timer {
                 compatible = "arm,armv8-timer";
-                interrupts = <1 13 0x1>, /* Physical Secure PPI */
-                             <1 14 0x1>, /* Physical Non-Secure PPI */
-                             <1 11 0x1>, /* Virtual PPI */
-                             <1 10 0x1>; /* Hypervisor PPI */
+                interrupts = <1 13 0xf08>, /* Physical Secure PPI */
+                             <1 14 0xf08>, /* Physical Non-Secure PPI */
+                             <1 11 0xf08>, /* Virtual PPI */
+                             <1 10 0xf08>; /* Hypervisor PPI */
         };
 
         pmu {
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
index 21023a388c29..e3b6034ea5d9 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
@@ -191,10 +191,10 @@
 
         timer {
                 compatible = "arm,armv8-timer";
-                interrupts = <1 13 0x8>, /* Physical Secure PPI, active-low */
-                             <1 14 0x8>, /* Physical Non-Secure PPI, active-low */
-                             <1 11 0x8>, /* Virtual PPI, active-low */
-                             <1 10 0x8>; /* Hypervisor PPI, active-low */
+                interrupts = <1 13 4>, /* Physical Secure PPI, active-low */
+                             <1 14 4>, /* Physical Non-Secure PPI, active-low */
+                             <1 11 4>, /* Virtual PPI, active-low */
+                             <1 10 4>; /* Hypervisor PPI, active-low */
         };
 
         pmu {
diff --git a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
index eab1a42fb934..c2a6745f168c 100644
--- a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
@@ -122,10 +122,10 @@
 
                         timer {
                                 compatible = "arm,armv8-timer";
-                                interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>,
-                                             <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>,
-                                             <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>,
-                                             <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
+                                interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+                                             <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+                                             <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+                                             <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>;
                         };
 
                         odmi: odmi@300000 {
diff --git a/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi
index c223915f0907..d73bdc8c9115 100644
--- a/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi
+++ b/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi
@@ -129,10 +129,10 @@
 
         timer {
                 compatible = "arm,armv8-timer";
-                interrupts = <1 13 0xf01>,
-                             <1 14 0xf01>,
-                             <1 11 0xf01>,
-                             <1 10 0xf01>;
+                interrupts = <1 13 4>,
+                             <1 14 4>,
+                             <1 11 4>,
+                             <1 10 4>;
         };
 
         soc {
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
index e595f22e7e4b..3e2e51fbd2bc 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
@@ -65,10 +65,10 @@
         timer {
                 compatible = "arm,armv8-timer";
                 interrupt-parent = <&gic>;
-                interrupts = <1 13 0xf01>,
-                             <1 14 0xf01>,
-                             <1 11 0xf01>,
-                             <1 10 0xf01>;
+                interrupts = <1 13 0xf08>,
+                             <1 14 0xf08>,
+                             <1 11 0xf08>,
+                             <1 10 0xf08>;
         };
 
         amba_apu {
diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
index 5c888049d061..6b2aa0fd6cd0 100644
--- a/arch/arm64/crypto/aes-glue.c
+++ b/arch/arm64/crypto/aes-glue.c
@@ -216,7 +216,7 @@ static int ctr_encrypt(struct blkcipher_desc *desc, struct scatterlist *dst,
                 err = blkcipher_walk_done(desc, &walk,
                                           walk.nbytes % AES_BLOCK_SIZE);
         }
-        if (nbytes) {
+        if (walk.nbytes % AES_BLOCK_SIZE) {
                 u8 *tdst = walk.dst.virt.addr + blocks * AES_BLOCK_SIZE;
                 u8 *tsrc = walk.src.virt.addr + blocks * AES_BLOCK_SIZE;
                 u8 __aligned(8) tail[AES_BLOCK_SIZE];
diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
index 0a456bef8c79..2fee2f59288c 100644
--- a/arch/arm64/include/asm/percpu.h
+++ b/arch/arm64/include/asm/percpu.h
@@ -199,19 +199,19 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
 #define _percpu_read(pcp)                                               \
 ({                                                                      \
         typeof(pcp) __retval;                                           \
-        preempt_disable();                                              \
+        preempt_disable_notrace();                                      \
         __retval = (typeof(pcp))__percpu_read(raw_cpu_ptr(&(pcp)),      \
                                               sizeof(pcp));             \
-        preempt_enable();                                               \
+        preempt_enable_notrace();                                       \
         __retval;                                                       \
 })
 
 #define _percpu_write(pcp, val)                                         \
 do {                                                                    \
-        preempt_disable();                                              \
+        preempt_disable_notrace();                                      \
         __percpu_write(raw_cpu_ptr(&(pcp)), (unsigned long)(val),       \
                                 sizeof(pcp));                           \
-        preempt_enable();                                               \
+        preempt_enable_notrace();                                       \
 } while(0)                                                              \
 
 #define _pcp_protect(operation, pcp, val)                       \
diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h
index e875a5a551d7..89206b568cd4 100644
--- a/arch/arm64/include/asm/spinlock.h
+++ b/arch/arm64/include/asm/spinlock.h
@@ -363,4 +363,14 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
 #define arch_read_relax(lock)   cpu_relax()
 #define arch_write_relax(lock)  cpu_relax()
 
+/*
+ * Accesses appearing in program order before a spin_lock() operation
+ * can be reordered with accesses inside the critical section, by virtue
+ * of arch_spin_lock being constructed using acquire semantics.
+ *
+ * In cases where this is problematic (e.g. try_to_wake_up), an
+ * smp_mb__before_spinlock() can restore the required ordering.
+ */
+#define smp_mb__before_spinlock()       smp_mb()
+
 #endif /* __ASM_SPINLOCK_H */
diff --git a/arch/avr32/include/asm/uaccess.h b/arch/avr32/include/asm/uaccess.h
index 68cf638faf48..b1ec1fa06463 100644
--- a/arch/avr32/include/asm/uaccess.h
+++ b/arch/avr32/include/asm/uaccess.h
@@ -74,7 +74,7 @@ extern __kernel_size_t __copy_user(void *to, const void *from,
 
 extern __kernel_size_t copy_to_user(void __user *to, const void *from,
                                     __kernel_size_t n);
-extern __kernel_size_t copy_from_user(void *to, const void __user *from,
+extern __kernel_size_t ___copy_from_user(void *to, const void __user *from,
                                       __kernel_size_t n);
 
 static inline __kernel_size_t __copy_to_user(void __user *to, const void *from,
@@ -88,6 +88,15 @@ static inline __kernel_size_t __copy_from_user(void *to,
 {
         return __copy_user(to, (const void __force *)from, n);
 }
+static inline __kernel_size_t copy_from_user(void *to,
+                                               const void __user *from,
+                                               __kernel_size_t n)
+{
+        size_t res = ___copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
+}
 
 #define __copy_to_user_inatomic __copy_to_user
 #define __copy_from_user_inatomic __copy_from_user
diff --git a/arch/avr32/kernel/avr32_ksyms.c b/arch/avr32/kernel/avr32_ksyms.c
index d93ead02daed..7c6cf14f0985 100644
--- a/arch/avr32/kernel/avr32_ksyms.c
+++ b/arch/avr32/kernel/avr32_ksyms.c
@@ -36,7 +36,7 @@ EXPORT_SYMBOL(copy_page);
 /*
  * Userspace access stuff.
  */
-EXPORT_SYMBOL(copy_from_user);
+EXPORT_SYMBOL(___copy_from_user);
 EXPORT_SYMBOL(copy_to_user);
 EXPORT_SYMBOL(__copy_user);
 EXPORT_SYMBOL(strncpy_from_user);
diff --git a/arch/avr32/lib/copy_user.S b/arch/avr32/lib/copy_user.S
index ea59c04b07de..075373471da1 100644
--- a/arch/avr32/lib/copy_user.S
+++ b/arch/avr32/lib/copy_user.S
@@ -23,13 +23,13 @@
          */
         .text
         .align  1
-        .global copy_from_user
-        .type   copy_from_user, @function
-copy_from_user:
+        .global ___copy_from_user
+        .type   ___copy_from_user, @function
+___copy_from_user:
         branch_if_kernel r8, __copy_user
         ret_if_privileged r8, r11, r10, r10
         rjmp    __copy_user
-        .size   copy_from_user, . - copy_from_user
+        .size   ___copy_from_user, . - ___copy_from_user
 
         .global copy_to_user
         .type   copy_to_user, @function
diff --git a/arch/blackfin/include/asm/uaccess.h b/arch/blackfin/include/asm/uaccess.h
index 12f5d6851bbc..0a2a70096d8b 100644
--- a/arch/blackfin/include/asm/uaccess.h
+++ b/arch/blackfin/include/asm/uaccess.h
@@ -171,11 +171,12 @@ static inline int bad_user_access_length(void)
 static inline unsigned long __must_check
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        if (access_ok(VERIFY_READ, from, n))
+        if (likely(access_ok(VERIFY_READ, from, n))) {
                 memcpy(to, (const void __force *)from, n);
-        else
-                return n;
-        return 0;
+                return 0;
+        }
+        memset(to, 0, n);
+        return n;
 }
 
 static inline unsigned long __must_check
diff --git a/arch/cris/include/asm/uaccess.h b/arch/cris/include/asm/uaccess.h
index e3530d0f13ee..56c7d5750abd 100644
--- a/arch/cris/include/asm/uaccess.h
+++ b/arch/cris/include/asm/uaccess.h
@@ -194,30 +194,6 @@ extern unsigned long __copy_user(void __user *to, const void *from, unsigned lon
 extern unsigned long __copy_user_zeroing(void *to, const void __user *from, unsigned long n);
 extern unsigned long __do_clear_user(void __user *to, unsigned long n);
 
-static inline unsigned long
-__generic_copy_to_user(void __user *to, const void *from, unsigned long n)
-{
-        if (access_ok(VERIFY_WRITE, to, n))
-                return __copy_user(to, from, n);
-        return n;
-}
-
-static inline unsigned long
-__generic_copy_from_user(void *to, const void __user *from, unsigned long n)
-{
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_user_zeroing(to, from, n);
-        return n;
-}
-
-static inline unsigned long
-__generic_clear_user(void __user *to, unsigned long n)
-{
-        if (access_ok(VERIFY_WRITE, to, n))
-                return __do_clear_user(to, n);
-        return n;
-}
-
 static inline long
 __strncpy_from_user(char *dst, const char __user *src, long count)
 {
@@ -282,7 +258,7 @@ __constant_copy_from_user(void *to, const void __user *from, unsigned long n)
         else if (n == 24)
                 __asm_copy_from_user_24(to, from, ret);
         else
-                ret = __generic_copy_from_user(to, from, n);
+                ret = __copy_user_zeroing(to, from, n);
 
         return ret;
 }
@@ -333,7 +309,7 @@ __constant_copy_to_user(void __user *to, const void *from, unsigned long n)
         else if (n == 24)
                 __asm_copy_to_user_24(to, from, ret);
         else
-                ret = __generic_copy_to_user(to, from, n);
+                ret = __copy_user(to, from, n);
 
         return ret;
 }
@@ -366,26 +342,43 @@ __constant_clear_user(void __user *to, unsigned long n)
         else if (n == 24)
                 __asm_clear_24(to, ret);
         else
-                ret = __generic_clear_user(to, n);
+                ret = __do_clear_user(to, n);
 
         return ret;
 }
 
 
-#define clear_user(to, n)                               \
-        (__builtin_constant_p(n) ?                      \
-         __constant_clear_user(to, n) :                 \
-         __generic_clear_user(to, n))
+static inline size_t clear_user(void __user *to, size_t n)
+{
+        if (unlikely(!access_ok(VERIFY_WRITE, to, n)))
+                return n;
+        if (__builtin_constant_p(n))
+                return __constant_clear_user(to, n);
+        else
+                return __do_clear_user(to, n);
+}
 
-#define copy_from_user(to, from, n)                     \
-        (__builtin_constant_p(n) ?                      \
-         __constant_copy_from_user(to, from, n) :       \
-         __generic_copy_from_user(to, from, n))
+static inline size_t copy_from_user(void *to, const void __user *from, size_t n)
+{
+        if (unlikely(!access_ok(VERIFY_READ, from, n))) {
+                memset(to, 0, n);
+                return n;
+        }
+        if (__builtin_constant_p(n))
+                return __constant_copy_from_user(to, from, n);
+        else
+                return __copy_user_zeroing(to, from, n);
+}
 
-#define copy_to_user(to, from, n)                       \
-        (__builtin_constant_p(n) ?                      \
-         __constant_copy_to_user(to, from, n) :         \
-         __generic_copy_to_user(to, from, n))
+static inline size_t copy_to_user(void __user *to, const void *from, size_t n)
+{
+        if (unlikely(!access_ok(VERIFY_WRITE, to, n)))
+                return n;
+        if (__builtin_constant_p(n))
+                return __constant_copy_to_user(to, from, n);
+        else
+                return __copy_user(to, from, n);
+}
 
 /* We let the __ versions of copy_from/to_user inline, because they're often
  * used in fast paths and have only a small space overhead.
diff --git a/arch/frv/include/asm/uaccess.h b/arch/frv/include/asm/uaccess.h
index 3ac9a59d65d4..87d9e34c5df8 100644
--- a/arch/frv/include/asm/uaccess.h
+++ b/arch/frv/include/asm/uaccess.h
@@ -263,19 +263,25 @@ do {							\
 extern long __memset_user(void *dst, unsigned long count);
 extern long __memcpy_user(void *dst, const void *src, unsigned long count);
 
-#define clear_user(dst,count)                   __memset_user(____force(dst), (count))
+#define __clear_user(dst,count)                 __memset_user(____force(dst), (count))
 #define __copy_from_user_inatomic(to, from, n)  __memcpy_user((to), ____force(from), (n))
 #define __copy_to_user_inatomic(to, from, n)    __memcpy_user(____force(to), (from), (n))
 
 #else
 
-#define clear_user(dst,count)                   (memset(____force(dst), 0, (count)), 0)
+#define __clear_user(dst,count)                 (memset(____force(dst), 0, (count)), 0)
 #define __copy_from_user_inatomic(to, from, n)  (memcpy((to), ____force(from), (n)), 0)
 #define __copy_to_user_inatomic(to, from, n)    (memcpy(____force(to), (from), (n)), 0)
 
 #endif
 
-#define __clear_user clear_user
+static inline unsigned long __must_check
+clear_user(void __user *to, unsigned long n)
+{
+        if (likely(__access_ok(to, n)))
+                n = __clear_user(to, n);
+        return n;
+}
 
 static inline unsigned long __must_check
 __copy_to_user(void __user *to, const void *from, unsigned long n)
diff --git a/arch/hexagon/include/asm/uaccess.h b/arch/hexagon/include/asm/uaccess.h
index f000a382bc7f..f61cfb28e9f2 100644
--- a/arch/hexagon/include/asm/uaccess.h
+++ b/arch/hexagon/include/asm/uaccess.h
@@ -103,7 +103,8 @@ static inline long hexagon_strncpy_from_user(char *dst, const char __user *src,
 {
         long res = __strnlen_user(src, n);
 
-        /* return from strnlen can't be zero -- that would be rubbish. */
+        if (unlikely(!res))
+                return -EFAULT;
 
         if (res > n) {
                 copy_from_user(dst, src, n);
diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
index 465c70982f40..bfe13196f770 100644
--- a/arch/ia64/include/asm/uaccess.h
+++ b/arch/ia64/include/asm/uaccess.h
@@ -241,8 +241,7 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
 static inline unsigned long
 __copy_to_user (void __user *to, const void *from, unsigned long count)
 {
-        if (!__builtin_constant_p(count))
-                check_object_size(from, count, true);
+        check_object_size(from, count, true);
 
         return __copy_user(to, (__force void __user *) from, count);
 }
@@ -250,8 +249,7 @@ __copy_to_user (void __user *to, const void *from, unsigned long count)
 static inline unsigned long
 __copy_from_user (void *to, const void __user *from, unsigned long count)
 {
-        if (!__builtin_constant_p(count))
-                check_object_size(to, count, false);
+        check_object_size(to, count, false);
 
         return __copy_user((__force void __user *) to, from, count);
 }
@@ -265,27 +263,22 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
         long __cu_len = (n);                                                            \
                                                                                         \
         if (__access_ok(__cu_to, __cu_len, get_fs())) {                                 \
-                if (!__builtin_constant_p(n))                                           \
-                        check_object_size(__cu_from, __cu_len, true);                   \
+                check_object_size(__cu_from, __cu_len, true);                   \
                 __cu_len = __copy_user(__cu_to, (__force void __user *)  __cu_from, __cu_len);  \
         }                                                                               \
         __cu_len;                                                                       \
 })
 
-#define copy_from_user(to, from, n)                                                     \
-({                                                                                      \
-        void *__cu_to = (to);                                                           \
-        const void __user *__cu_from = (from);                                          \
-        long __cu_len = (n);                                                            \
-                                                                                        \
-        __chk_user_ptr(__cu_from);                                                      \
-        if (__access_ok(__cu_from, __cu_len, get_fs())) {                               \
-                if (!__builtin_constant_p(n))                                           \
-                        check_object_size(__cu_to, __cu_len, false);                    \
-                __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);   \
-        }                                                                               \
-        __cu_len;                                                                       \
-})
+static inline unsigned long
+copy_from_user(void *to, const void __user *from, unsigned long n)
+{
+        check_object_size(to, n, false);
+        if (likely(__access_ok(from, n, get_fs())))
+                n = __copy_user((__force void __user *) to, from, n);
+        else
+                memset(to, 0, n);
+        return n;
+}
 
 #define __copy_in_user(to, from, size)  __copy_user((to), (from), (size))
 
diff --git a/arch/m32r/include/asm/uaccess.h b/arch/m32r/include/asm/uaccess.h
index cac7014daef3..6f8982157a75 100644
--- a/arch/m32r/include/asm/uaccess.h
+++ b/arch/m32r/include/asm/uaccess.h
@@ -219,7 +219,7 @@ extern int fixup_exception(struct pt_regs *regs);
 #define __get_user_nocheck(x, ptr, size)                                \
 ({                                                                      \
         long __gu_err = 0;                                              \
-        unsigned long __gu_val;                                         \
+        unsigned long __gu_val = 0;                                     \
         might_fault();                                                  \
         __get_user_size(__gu_val, (ptr), (size), __gu_err);             \
         (x) = (__force __typeof__(*(ptr)))__gu_val;                     \
diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uaccess.h
index 8282cbce7e39..273e61225c27 100644
--- a/arch/metag/include/asm/uaccess.h
+++ b/arch/metag/include/asm/uaccess.h
@@ -204,8 +204,9 @@ extern unsigned long __must_check __copy_user_zeroing(void *to,
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        if (access_ok(VERIFY_READ, from, n))
+        if (likely(access_ok(VERIFY_READ, from, n)))
                 return __copy_user_zeroing(to, from, n);
+        memset(to, 0, n);
         return n;
 }
 
diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h
index 331b0d35f89c..826676778094 100644
--- a/arch/microblaze/include/asm/uaccess.h
+++ b/arch/microblaze/include/asm/uaccess.h
@@ -227,7 +227,7 @@ extern long __user_bad(void);
 
 #define __get_user(x, ptr)                                              \
 ({                                                                      \
-        unsigned long __gu_val;                                         \
+        unsigned long __gu_val = 0;                                     \
         /*unsigned long __gu_ptr = (unsigned long)(ptr);*/              \
         long __gu_err;                                                  \
         switch (sizeof(*(ptr))) {                                       \
@@ -373,10 +373,13 @@ extern long __user_bad(void);
 static inline long copy_from_user(void *to,
                 const void __user *from, unsigned long n)
 {
+        unsigned long res = n;
         might_fault();
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_from_user(to, from, n);
-        return n;
+        if (likely(access_ok(VERIFY_READ, from, n)))
+                res = __copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 #define __copy_to_user(to, from, n)     \
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index 11b965f98d95..21a2aaba20d5 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -14,6 +14,7 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/thread_info.h>
+#include <linux/string.h>
 #include <asm/asm-eva.h>
 
 /*
@@ -1170,6 +1171,8 @@ extern size_t __copy_in_user_eva(void *__to, const void *__from, size_t __n);
                         __cu_len = __invoke_copy_from_user(__cu_to,     \
                                                            __cu_from,   \
                                                            __cu_len);   \
+                } else {                                                \
+                        memset(__cu_to, 0, __cu_len);                   \
                 }                                                       \
         }                                                               \
         __cu_len;                                                       \
diff --git a/arch/mn10300/include/asm/uaccess.h b/arch/mn10300/include/asm/uaccess.h
index 20f7bf6de384..d012e877a95a 100644
--- a/arch/mn10300/include/asm/uaccess.h
+++ b/arch/mn10300/include/asm/uaccess.h
@@ -166,6 +166,7 @@ struct __large_struct { unsigned long buf[100]; };
                 "2:\n"                                          \
                 "       .section        .fixup,\"ax\"\n"        \
                 "3:\n\t"                                        \
+                "       mov             0,%1\n"                 \
                 "       mov             %3,%0\n"                \
                 "       jmp             2b\n"                   \
                 "       .previous\n"                            \
diff --git a/arch/mn10300/lib/usercopy.c b/arch/mn10300/lib/usercopy.c
index 7826e6c364e7..ce8899e5e171 100644
--- a/arch/mn10300/lib/usercopy.c
+++ b/arch/mn10300/lib/usercopy.c
@@ -9,7 +9,7 @@
  * as published by the Free Software Foundation; either version
  * 2 of the Licence, or (at your option) any later version.
  */
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 unsigned long
 __generic_copy_to_user(void *to, const void *from, unsigned long n)
@@ -24,6 +24,8 @@ __generic_copy_from_user(void *to, const void *from, unsigned long n)
 {
         if (access_ok(VERIFY_READ, from, n))
                 __copy_user_zeroing(to, from, n);
+        else
+                memset(to, 0, n);
         return n;
 }
 
diff --git a/arch/nios2/include/asm/uaccess.h b/arch/nios2/include/asm/uaccess.h
index caa51ff85a3c..0ab82324c817 100644
--- a/arch/nios2/include/asm/uaccess.h
+++ b/arch/nios2/include/asm/uaccess.h
@@ -102,9 +102,12 @@ extern long __copy_to_user(void __user *to, const void *from, unsigned long n);
 static inline long copy_from_user(void *to, const void __user *from,
                                 unsigned long n)
 {
-        if (!access_ok(VERIFY_READ, from, n))
-                return n;
-        return __copy_from_user(to, from, n);
+        unsigned long res = n;
+        if (access_ok(VERIFY_READ, from, n))
+                res = __copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 static inline long copy_to_user(void __user *to, const void *from,
@@ -139,7 +142,7 @@ extern long strnlen_user(const char __user *s, long n);
 
 #define __get_user_unknown(val, size, ptr, err) do {                    \
         err = 0;                                                        \
-        if (copy_from_user(&(val), ptr, size)) {                        \
+        if (__copy_from_user(&(val), ptr, size)) {                      \
                 err = -EFAULT;                                          \
         }                                                               \
         } while (0)
@@ -166,7 +169,7 @@ do {									\
         ({                                                              \
         long __gu_err = -EFAULT;                                        \
         const __typeof__(*(ptr)) __user *__gu_ptr = (ptr);              \
-        unsigned long __gu_val;                                         \
+        unsigned long __gu_val = 0;                                     \
         __get_user_common(__gu_val, sizeof(*(ptr)), __gu_ptr, __gu_err);\
         (x) = (__force __typeof__(x))__gu_val;                          \
         __gu_err;                                                       \
diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h
index a6bd07ca3d6c..5cc6b4f1b795 100644
--- a/arch/openrisc/include/asm/uaccess.h
+++ b/arch/openrisc/include/asm/uaccess.h
@@ -273,28 +273,20 @@ __copy_tofrom_user(void *to, const void *from, unsigned long size);
 static inline unsigned long
 copy_from_user(void *to, const void *from, unsigned long n)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_tofrom_user(to, from, n);
-        if ((unsigned long)from < TASK_SIZE) {
-                over = (unsigned long)from + n - TASK_SIZE;
-                return __copy_tofrom_user(to, from, n - over) + over;
-        }
-        return n;
+        unsigned long res = n;
+
+        if (likely(access_ok(VERIFY_READ, from, n)))
+                res = __copy_tofrom_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 static inline unsigned long
 copy_to_user(void *to, const void *from, unsigned long n)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_WRITE, to, n))
-                return __copy_tofrom_user(to, from, n);
-        if ((unsigned long)to < TASK_SIZE) {
-                over = (unsigned long)to + n - TASK_SIZE;
-                return __copy_tofrom_user(to, from, n - over) + over;
-        }
+        if (likely(access_ok(VERIFY_WRITE, to, n)))
+                n = __copy_tofrom_user(to, from, n);
         return n;
 }
 
@@ -303,13 +295,8 @@ extern unsigned long __clear_user(void *addr, unsigned long size);
 static inline __must_check unsigned long
 clear_user(void *addr, unsigned long size)
 {
-
-        if (access_ok(VERIFY_WRITE, addr, size))
-                return __clear_user(addr, size);
-        if ((unsigned long)addr < TASK_SIZE) {
-                unsigned long over = (unsigned long)addr + size - TASK_SIZE;
-                return __clear_user(addr, size - over) + over;
-        }
+        if (likely(access_ok(VERIFY_WRITE, addr, size)))
+                size = __clear_user(addr, size);
         return size;
 }
 
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index e9150487e20d..482847865dac 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -10,6 +10,7 @@
 #include <asm-generic/uaccess-unaligned.h>
 
 #include <linux/bug.h>
+#include <linux/string.h>
 
 #define VERIFY_READ 0
 #define VERIFY_WRITE 1
@@ -221,7 +222,7 @@ static inline unsigned long __must_check copy_from_user(void *to,
                                           unsigned long n)
 {
         int sz = __compiletime_object_size(to);
-        int ret = -EFAULT;
+        unsigned long ret = n;
 
         if (likely(sz == -1 || sz >= n))
                 ret = __copy_from_user(to, from, n);
@@ -230,6 +231,8 @@ static inline unsigned long __must_check copy_from_user(void *to,
         else
                 __bad_copy_user();
 
+        if (unlikely(ret))
+                memset(to + (n - ret), 0, ret);
         return ret;
 }
 
diff --git a/arch/powerpc/include/asm/cpu_has_feature.h b/arch/powerpc/include/asm/cpu_has_feature.h
index 2ef55f8968a2..b312b152461b 100644
--- a/arch/powerpc/include/asm/cpu_has_feature.h
+++ b/arch/powerpc/include/asm/cpu_has_feature.h
@@ -15,7 +15,7 @@ static inline bool early_cpu_has_feature(unsigned long feature)
 #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECKS
 #include <linux/jump_label.h>
 
-#define NUM_CPU_FTR_KEYS        64
+#define NUM_CPU_FTR_KEYS        BITS_PER_LONG
 
 extern struct static_key_true cpu_feature_keys[NUM_CPU_FTR_KEYS];
 
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
index c1dc6c14deb8..c266227fdd5b 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -308,40 +308,21 @@ extern unsigned long __copy_tofrom_user(void __user *to,
 static inline unsigned long copy_from_user(void *to,
                 const void __user *from, unsigned long n)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_READ, from, n)) {
-                if (!__builtin_constant_p(n))
-                        check_object_size(to, n, false);
+        if (likely(access_ok(VERIFY_READ, from, n))) {
+                check_object_size(to, n, false);
                 return __copy_tofrom_user((__force void __user *)to, from, n);
         }
-        if ((unsigned long)from < TASK_SIZE) {
-                over = (unsigned long)from + n - TASK_SIZE;
-                if (!__builtin_constant_p(n - over))
-                        check_object_size(to, n - over, false);
-                return __copy_tofrom_user((__force void __user *)to, from,
-                                n - over) + over;
-        }
+        memset(to, 0, n);
         return n;
 }
 
 static inline unsigned long copy_to_user(void __user *to,
                 const void *from, unsigned long n)
 {
-        unsigned long over;
-
         if (access_ok(VERIFY_WRITE, to, n)) {
-                if (!__builtin_constant_p(n))
-                        check_object_size(from, n, true);
+                check_object_size(from, n, true);
                 return __copy_tofrom_user(to, (__force void __user *)from, n);
         }
-        if ((unsigned long)to < TASK_SIZE) {
-                over = (unsigned long)to + n - TASK_SIZE;
-                if (!__builtin_constant_p(n))
-                        check_object_size(from, n - over, true);
-                return __copy_tofrom_user(to, (__force void __user *)from,
-                                n - over) + over;
-        }
         return n;
 }
 
@@ -383,8 +364,7 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
                         return 0;
         }
 
-        if (!__builtin_constant_p(n))
-                check_object_size(to, n, false);
+        check_object_size(to, n, false);
 
         return __copy_tofrom_user((__force void __user *)to, from, n);
 }
@@ -412,8 +392,8 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
                 if (ret == 0)
                         return 0;
         }
-        if (!__builtin_constant_p(n))
-                check_object_size(from, n, true);
+
+        check_object_size(from, n, true);
 
         return __copy_tofrom_user(to, (__force const void __user *)from, n);
 }
@@ -439,10 +419,6 @@ static inline unsigned long clear_user(void __user *addr, unsigned long size)
         might_fault();
         if (likely(access_ok(VERIFY_WRITE, addr, size)))
                 return __clear_user(addr, size);
-        if ((unsigned long)addr < TASK_SIZE) {
-                unsigned long over = (unsigned long)addr + size - TASK_SIZE;
-                return __clear_user(addr, size - over) + over;
-        }
         return size;
 }
 
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index 2265c6398a17..bd739fed26e3 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -411,7 +411,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
  *
  * r13 - PACA
  * cr3 - gt if waking up with partial/complete hypervisor state loss
- * cr4 - eq if waking up from complete hypervisor state loss.
+ * cr4 - gt or eq if waking up from complete hypervisor state loss.
  */
 _GLOBAL(pnv_wakeup_tb_loss)
         ld      r1,PACAR1(r13)
@@ -453,7 +453,7 @@ lwarx_loop2:
          * At this stage
          * cr2 - eq if first thread to wakeup in core
          * cr3-  gt if waking up with partial/complete hypervisor state loss
-         * cr4 - eq if waking up from complete hypervisor state loss.
+         * cr4 - gt or eq if waking up from complete hypervisor state loss.
          */
 
         ori     r15,r15,PNV_CORE_IDLE_LOCK_BIT
@@ -481,7 +481,7 @@ first_thread_in_subcore:
          * If waking up from sleep, subcore state is not lost. Hence
          * skip subcore state restore
          */
-        bne     cr4,subcore_state_restored
+        blt     cr4,subcore_state_restored
 
         /* Restore per-subcore state */
         ld      r4,_SDR1(r1)
@@ -526,7 +526,7 @@ timebase_resync:
          * If waking up from sleep, per core state is not lost, skip to
          * clear_lock.
          */
-        bne     cr4,clear_lock
+        blt     cr4,clear_lock
 
         /*
          * First thread in the core to wake up and its waking up with
@@ -557,7 +557,7 @@ common_exit:
          * If waking up from sleep, hypervisor state is not lost. Hence
          * skip hypervisor state restore.
          */
-        bne     cr4,hypervisor_state_restored
+        blt     cr4,hypervisor_state_restored
 
         /* Waking up from winkle */
 
diff --git a/arch/powerpc/lib/checksum_32.S b/arch/powerpc/lib/checksum_32.S
index 0a57fe6d49cc..aa8214f30c92 100644
--- a/arch/powerpc/lib/checksum_32.S
+++ b/arch/powerpc/lib/checksum_32.S
@@ -127,18 +127,19 @@ _GLOBAL(csum_partial_copy_generic)
         stw     r7,12(r1)
         stw     r8,8(r1)
 
-        rlwinm  r0,r4,3,0x8
-        rlwnm   r6,r6,r0,0,31   /* odd destination address: rotate one byte */
-        cmplwi  cr7,r0,0        /* is destination address even ? */
         addic   r12,r6,0
         addi    r6,r4,-4
         neg     r0,r4
         addi    r4,r3,-4
         andi.   r0,r0,CACHELINE_MASK    /* # bytes to start of cache line */
+        crset   4*cr7+eq
         beq     58f
 
         cmplw   0,r5,r0                 /* is this more than total to do? */
         blt     63f                     /* if not much to do */
+        rlwinm  r7,r6,3,0x8
+        rlwnm   r12,r12,r7,0,31 /* odd destination address: rotate one byte */
+        cmplwi  cr7,r7,0        /* is destination address even ? */
         andi.   r8,r0,3                 /* get it word-aligned first */
         mtctr   r8
         beq+    61f
diff --git a/arch/powerpc/mm/slb_low.S b/arch/powerpc/mm/slb_low.S
index dfdb90cb4403..9f1983404e1a 100644
--- a/arch/powerpc/mm/slb_low.S
+++ b/arch/powerpc/mm/slb_low.S
@@ -113,7 +113,12 @@ BEGIN_FTR_SECTION
 END_MMU_FTR_SECTION_IFCLR(MMU_FTR_1T_SEGMENT)
         b       slb_finish_load_1T
 
-0:
+0:      /*
+         * For userspace addresses, make sure this is region 0.
+         */
+        cmpdi   r9, 0
+        bne     8f
+
         /* when using slices, we extract the psize off the slice bitmaps
          * and then we need to get the sllp encoding off the mmu_psize_defs
          * array.
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 13218263e66e..bc0c91e84ca0 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -162,11 +162,12 @@ static struct pnv_ioda_pe *pnv_ioda_alloc_pe(struct pnv_phb *phb)
 static void pnv_ioda_free_pe(struct pnv_ioda_pe *pe)
 {
         struct pnv_phb *phb = pe->phb;
+        unsigned int pe_num = pe->pe_number;
 
         WARN_ON(pe->pdev);
 
         memset(pe, 0, sizeof(struct pnv_ioda_pe));
-        clear_bit(pe->pe_number, phb->ioda.pe_alloc);
+        clear_bit(pe_num, phb->ioda.pe_alloc);
 }
 
 /* The default M64 BAR is shared by all PEs */
@@ -2216,7 +2217,7 @@ static long pnv_pci_ioda2_set_window(struct iommu_table_group *table_group,
 
         pnv_pci_link_table_and_group(phb->hose->node, num,
                         tbl, &pe->table_group);
-        pnv_pci_phb3_tce_invalidate_pe(pe);
+        pnv_pci_ioda2_tce_invalidate_pe(pe);
 
         return 0;
 }
@@ -2354,7 +2355,7 @@ static long pnv_pci_ioda2_unset_window(struct iommu_table_group *table_group,
         if (ret)
                 pe_warn(pe, "Unmapping failed, ret = %ld\n", ret);
         else
-                pnv_pci_phb3_tce_invalidate_pe(pe);
+                pnv_pci_ioda2_tce_invalidate_pe(pe);
 
         pnv_pci_unlink_table_and_group(table_group->tables[num], table_group);
 
@@ -3402,12 +3403,6 @@ static void pnv_ioda_release_pe(struct pnv_ioda_pe *pe)
         struct pnv_phb *phb = pe->phb;
         struct pnv_ioda_pe *slave, *tmp;
 
-        /* Release slave PEs in compound PE */
-        if (pe->flags & PNV_IODA_PE_MASTER) {
-                list_for_each_entry_safe(slave, tmp, &pe->slaves, list)
-                        pnv_ioda_release_pe(slave);
-        }
-
         list_del(&pe->list);
         switch (phb->type) {
         case PNV_PHB_IODA1:
@@ -3422,7 +3417,26 @@ static void pnv_ioda_release_pe(struct pnv_ioda_pe *pe)
 
         pnv_ioda_release_pe_seg(pe);
         pnv_ioda_deconfigure_pe(pe->phb, pe);
-        pnv_ioda_free_pe(pe);
+
+        /* Release slave PEs in the compound PE */
+        if (pe->flags & PNV_IODA_PE_MASTER) {
+                list_for_each_entry_safe(slave, tmp, &pe->slaves, list) {
+                        list_del(&slave->list);
+                        pnv_ioda_free_pe(slave);
+                }
+        }
+
+        /*
+         * The PE for root bus can be removed because of hotplug in EEH
+         * recovery for fenced PHB error. We need to mark the PE dead so
+         * that it can be populated again in PCI hot add path. The PE
+         * shouldn't be destroyed as it's the global reserved resource.
+         */
+        if (phb->ioda.root_pe_populated &&
+            phb->ioda.root_pe_idx == pe->pe_number)
+                phb->ioda.root_pe_populated = false;
+        else
+                pnv_ioda_free_pe(pe);
 }
 
 static void pnv_pci_release_device(struct pci_dev *pdev)
@@ -3438,7 +3452,17 @@ static void pnv_pci_release_device(struct pci_dev *pdev)
         if (!pdn || pdn->pe_number == IODA_INVALID_PE)
                 return;
 
+        /*
+         * PCI hotplug can happen as part of EEH error recovery. The @pdn
+         * isn't removed and added afterwards in this scenario. We should
+         * set the PE number in @pdn to an invalid one. Otherwise, the PE's
+         * device count is decreased on removing devices while failing to
+         * be increased on adding devices. It leads to unbalanced PE's device
+         * count and eventually make normal PCI hotplug path broken.
+         */
         pe = &phb->ioda.pe_array[pdn->pe_number];
+        pdn->pe_number = IODA_INVALID_PE;
+
         WARN_ON(--pe->device_count < 0);
         if (pe->device_count == 0)
                 pnv_ioda_release_pe(pe);
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 4ffcaa6f8670..a39d20e8623d 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -41,7 +41,6 @@
 #include <linux/root_dev.h>
 #include <linux/of.h>
 #include <linux/of_pci.h>
-#include <linux/kexec.h>
 
 #include <asm/mmu.h>
 #include <asm/processor.h>
@@ -66,6 +65,7 @@
 #include <asm/eeh.h>
 #include <asm/reg.h>
 #include <asm/plpar_wrappers.h>
+#include <asm/kexec.h>
 
 #include "pseries.h"
 
diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
index 57d72f10a97f..9114243fa1b5 100644
--- a/arch/powerpc/sysdev/xics/icp-opal.c
+++ b/arch/powerpc/sysdev/xics/icp-opal.c
@@ -23,10 +23,10 @@
 
 static void icp_opal_teardown_cpu(void)
 {
-        int cpu = smp_processor_id();
+        int hw_cpu = hard_smp_processor_id();
 
         /* Clear any pending IPI */
-        opal_int_set_mfrr(cpu, 0xff);
+        opal_int_set_mfrr(hw_cpu, 0xff);
 }
 
 static void icp_opal_flush_ipi(void)
@@ -101,14 +101,16 @@ static void icp_opal_eoi(struct irq_data *d)
 
 static void icp_opal_cause_ipi(int cpu, unsigned long data)
 {
-        opal_int_set_mfrr(cpu, IPI_PRIORITY);
+        int hw_cpu = get_hard_smp_processor_id(cpu);
+
+        opal_int_set_mfrr(hw_cpu, IPI_PRIORITY);
 }
 
 static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id)
 {
-        int cpu = smp_processor_id();
+        int hw_cpu = hard_smp_processor_id();
 
-        opal_int_set_mfrr(cpu, 0xff);
+        opal_int_set_mfrr(hw_cpu, 0xff);
 
         return smp_ipi_demux();
 }
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
index 95aefdba4be2..52d7c8709279 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -266,28 +266,28 @@ int __put_user_bad(void) __attribute__((noreturn));
         __chk_user_ptr(ptr);                                    \
         switch (sizeof(*(ptr))) {                               \
         case 1: {                                               \
-                unsigned char __x;                              \
+                unsigned char __x = 0;                          \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 2: {                                               \
-                unsigned short __x;                             \
+                unsigned short __x = 0;                         \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 4: {                                               \
-                unsigned int __x;                               \
+                unsigned int __x = 0;                           \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 8: {                                               \
-                unsigned long long __x;                         \
+                unsigned long long __x = 0;                     \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f142215ed30d..607ec91966c7 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -2231,9 +2231,10 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
                 return -EINVAL;
         current->thread.fpu.fpc = fpu->fpc;
         if (MACHINE_HAS_VX)
-                convert_fp_to_vx(current->thread.fpu.vxrs, (freg_t *)fpu->fprs);
+                convert_fp_to_vx((__vector128 *) vcpu->run->s.regs.vrs,
+                                 (freg_t *) fpu->fprs);
         else
-                memcpy(current->thread.fpu.fprs, &fpu->fprs, sizeof(fpu->fprs));
+                memcpy(vcpu->run->s.regs.fprs, &fpu->fprs, sizeof(fpu->fprs));
         return 0;
 }
 
@@ -2242,9 +2243,10 @@ int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
         /* make sure we have the latest values */
         save_fpu_regs();
         if (MACHINE_HAS_VX)
-                convert_vx_to_fp((freg_t *)fpu->fprs, current->thread.fpu.vxrs);
+                convert_vx_to_fp((freg_t *) fpu->fprs,
+                                 (__vector128 *) vcpu->run->s.regs.vrs);
         else
-                memcpy(fpu->fprs, current->thread.fpu.fprs, sizeof(fpu->fprs));
+                memcpy(fpu->fprs, vcpu->run->s.regs.fprs, sizeof(fpu->fprs));
         fpu->fpc = current->thread.fpu.fpc;
         return 0;
 }
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index c106488b4137..d8673e243f13 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -584,7 +584,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
                 /* Validity 0x0044 will be checked by SIE */
                 if (rc)
                         goto unpin;
-                scb_s->gvrd = hpa;
+                scb_s->riccbd = hpa;
         }
         return 0;
 unpin:
diff --git a/arch/score/include/asm/uaccess.h b/arch/score/include/asm/uaccess.h
index 20a3591225cc..01aec8ccde83 100644
--- a/arch/score/include/asm/uaccess.h
+++ b/arch/score/include/asm/uaccess.h
@@ -163,7 +163,7 @@ do {									\
                 __get_user_asm(val, "lw", ptr);                         \
                  break;                                                 \
         case 8:                                                         \
-                if ((copy_from_user((void *)&val, ptr, 8)) == 0)        \
+                if (__copy_from_user((void *)&val, ptr, 8) == 0)        \
                         __gu_err = 0;                                   \
                 else                                                    \
                         __gu_err = -EFAULT;                             \
@@ -188,6 +188,8 @@ do {									\
                                                                         \
         if (likely(access_ok(VERIFY_READ, __gu_ptr, size)))             \
                 __get_user_common((x), size, __gu_ptr);                 \
+        else                                                            \
+                (x) = 0;                                                \
                                                                         \
         __gu_err;                                                       \
 })
@@ -201,6 +203,7 @@ do {									\
                 "2:\n"                                                  \
                 ".section .fixup,\"ax\"\n"                              \
                 "3:li   %0, %4\n"                                       \
+                "li     %1, 0\n"                                        \
                 "j      2b\n"                                           \
                 ".previous\n"                                           \
                 ".section __ex_table,\"a\"\n"                           \
@@ -298,35 +301,34 @@ extern int __copy_tofrom_user(void *to, const void *from, unsigned long len);
 static inline unsigned long
 copy_from_user(void *to, const void *from, unsigned long len)
 {
-        unsigned long over;
+        unsigned long res = len;
 
-        if (access_ok(VERIFY_READ, from, len))
-                return __copy_tofrom_user(to, from, len);
+        if (likely(access_ok(VERIFY_READ, from, len)))
+                res = __copy_tofrom_user(to, from, len);
 
-        if ((unsigned long)from < TASK_SIZE) {
-                over = (unsigned long)from + len - TASK_SIZE;
-                return __copy_tofrom_user(to, from, len - over) + over;
-        }
-        return len;
+        if (unlikely(res))
+                memset(to + (len - res), 0, res);
+
+        return res;
 }
 
 static inline unsigned long
 copy_to_user(void *to, const void *from, unsigned long len)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_WRITE, to, len))
-                return __copy_tofrom_user(to, from, len);
+        if (likely(access_ok(VERIFY_WRITE, to, len)))
+                len = __copy_tofrom_user(to, from, len);
 
-        if ((unsigned long)to < TASK_SIZE) {
-                over = (unsigned long)to + len - TASK_SIZE;
-                return __copy_tofrom_user(to, from, len - over) + over;
-        }
         return len;
 }
 
-#define __copy_from_user(to, from, len) \
-                __copy_tofrom_user((to), (from), (len))
+static inline unsigned long
+__copy_from_user(void *to, const void *from, unsigned long len)
+{
+        unsigned long left = __copy_tofrom_user(to, from, len);
+        if (unlikely(left))
+                memset(to + (len - left), 0, left);
+        return left;
+}
 
 #define __copy_to_user(to, from, len)           \
                 __copy_tofrom_user((to), (from), (len))
@@ -340,17 +342,17 @@ __copy_to_user_inatomic(void *to, const void *from, unsigned long len)
 static inline unsigned long
 __copy_from_user_inatomic(void *to, const void *from, unsigned long len)
 {
-        return __copy_from_user(to, from, len);
+        return __copy_tofrom_user(to, from, len);
 }
 
-#define __copy_in_user(to, from, len)   __copy_from_user(to, from, len)
+#define __copy_in_user(to, from, len)   __copy_tofrom_user(to, from, len)
 
 static inline unsigned long
 copy_in_user(void *to, const void *from, unsigned long len)
 {
         if (access_ok(VERIFY_READ, from, len) &&
                       access_ok(VERFITY_WRITE, to, len))
-                return copy_from_user(to, from, len);
+                return __copy_tofrom_user(to, from, len);
 }
 
 /*
diff --git a/arch/sh/include/asm/uaccess.h b/arch/sh/include/asm/uaccess.h
index a49635c51266..92ade79ac427 100644
--- a/arch/sh/include/asm/uaccess.h
+++ b/arch/sh/include/asm/uaccess.h
@@ -151,7 +151,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
         __kernel_size_t __copy_size = (__kernel_size_t) n;
 
         if (__copy_size && __access_ok(__copy_from, __copy_size))
-                return __copy_user(to, from, __copy_size);
+                __copy_size = __copy_user(to, from, __copy_size);
+
+        if (unlikely(__copy_size))
+                memset(to + (n - __copy_size), 0, __copy_size);
 
         return __copy_size;
 }
diff --git a/arch/sh/include/asm/uaccess_64.h b/arch/sh/include/asm/uaccess_64.h
index c01376c76b86..ca5073dd4596 100644
--- a/arch/sh/include/asm/uaccess_64.h
+++ b/arch/sh/include/asm/uaccess_64.h
@@ -24,6 +24,7 @@
 #define __get_user_size(x,ptr,size,retval)                      \
 do {                                                            \
         retval = 0;                                             \
+        x = 0;                                                  \
         switch (size) {                                         \
         case 1:                                                 \
                 retval = __get_user_asm_b((void *)&x,           \
diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
index 341a5a133f48..ea55f86d7ccd 100644
--- a/arch/sparc/include/asm/uaccess_32.h
+++ b/arch/sparc/include/asm/uaccess_32.h
@@ -249,8 +249,7 @@ unsigned long __copy_user(void __user *to, const void __user *from, unsigned lon
 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
 {
         if (n && __access_ok((unsigned long) to, n)) {
-                if (!__builtin_constant_p(n))
-                        check_object_size(from, n, true);
+                check_object_size(from, n, true);
                 return __copy_user(to, (__force void __user *) from, n);
         } else
                 return n;
@@ -258,19 +257,19 @@ static inline unsigned long copy_to_user(void __user *to, const void *from, unsi
 
 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
-        if (!__builtin_constant_p(n))
-                check_object_size(from, n, true);
+        check_object_size(from, n, true);
         return __copy_user(to, (__force void __user *) from, n);
 }
 
 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
 {
         if (n && __access_ok((unsigned long) from, n)) {
-                if (!__builtin_constant_p(n))
-                        check_object_size(to, n, false);
+                check_object_size(to, n, false);
                 return __copy_user((__force void __user *) to, from, n);
-        } else
+        } else {
+                memset(to, 0, n);
                 return n;
+        }
 }
 
 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
index 8bda94fab8e8..37a315d0ddd4 100644
--- a/arch/sparc/include/asm/uaccess_64.h
+++ b/arch/sparc/include/asm/uaccess_64.h
@@ -212,8 +212,7 @@ copy_from_user(void *to, const void __user *from, unsigned long size)
 {
         unsigned long ret;
 
-        if (!__builtin_constant_p(size))
-                check_object_size(to, size, false);
+        check_object_size(to, size, false);
 
         ret = ___copy_from_user(to, from, size);
         if (unlikely(ret))
@@ -233,8 +232,8 @@ copy_to_user(void __user *to, const void *from, unsigned long size)
 {
         unsigned long ret;
 
-        if (!__builtin_constant_p(size))
-                check_object_size(from, size, true);
+        check_object_size(from, size, true);
+
         ret = ___copy_to_user(to, from, size);
         if (unlikely(ret))
                 ret = copy_to_user_fixup(to, from, size);
diff --git a/arch/um/kernel/skas/syscall.c b/arch/um/kernel/skas/syscall.c
index ef4b8f949b51..b783ac87d98a 100644
--- a/arch/um/kernel/skas/syscall.c
+++ b/arch/um/kernel/skas/syscall.c
@@ -21,21 +21,17 @@ void handle_syscall(struct uml_pt_regs *r)
         PT_REGS_SET_SYSCALL_RETURN(regs, -ENOSYS);
 
         if (syscall_trace_enter(regs))
-                return;
+                goto out;
 
         /* Do the seccomp check after ptrace; failures should be fast. */
         if (secure_computing(NULL) == -1)
-                return;
+                goto out;
 
-        /* Update the syscall number after orig_ax has potentially been updated
-         * with ptrace.
-         */
-        UPT_SYSCALL_NR(r) = PT_SYSCALL_NR(r->gp);
         syscall = UPT_SYSCALL_NR(r);
-
         if (syscall >= 0 && syscall <= __NR_syscall_max)
                 PT_REGS_SET_SYSCALL_RETURN(regs,
                                 EXECUTE_SYSCALL(syscall, regs));
 
+out:
         syscall_trace_leave(regs);
 }
diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
index e07a22bb9308..f5f4b3fbbbc2 100644
--- a/arch/x86/events/amd/core.c
+++ b/arch/x86/events/amd/core.c
@@ -119,8 +119,8 @@ static const u64 amd_perfmon_event_map[PERF_COUNT_HW_MAX] =
 {
   [PERF_COUNT_HW_CPU_CYCLES]                    = 0x0076,
   [PERF_COUNT_HW_INSTRUCTIONS]                  = 0x00c0,
-  [PERF_COUNT_HW_CACHE_REFERENCES]              = 0x0080,
-  [PERF_COUNT_HW_CACHE_MISSES]                  = 0x0081,
+  [PERF_COUNT_HW_CACHE_REFERENCES]              = 0x077d,
+  [PERF_COUNT_HW_CACHE_MISSES]                  = 0x077e,
   [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]           = 0x00c2,
   [PERF_COUNT_HW_BRANCH_MISSES]                 = 0x00c3,
   [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND]       = 0x00d0, /* "Decoder empty" event */
diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
index e6131d4454e6..65577f081d07 100644
--- a/arch/x86/events/amd/uncore.c
+++ b/arch/x86/events/amd/uncore.c
@@ -29,6 +29,8 @@
 
 #define COUNTER_SHIFT           16
 
+static HLIST_HEAD(uncore_unused_list);
+
 struct amd_uncore {
         int id;
         int refcnt;
@@ -39,7 +41,7 @@ struct amd_uncore {
         cpumask_t *active_mask;
         struct pmu *pmu;
         struct perf_event *events[MAX_COUNTERS];
-        struct amd_uncore *free_when_cpu_online;
+        struct hlist_node node;
 };
 
 static struct amd_uncore * __percpu *amd_uncore_nb;
@@ -306,6 +308,7 @@ static int amd_uncore_cpu_up_prepare(unsigned int cpu)
                 uncore_nb->msr_base = MSR_F15H_NB_PERF_CTL;
                 uncore_nb->active_mask = &amd_nb_active_mask;
                 uncore_nb->pmu = &amd_nb_pmu;
+                uncore_nb->id = -1;
                 *per_cpu_ptr(amd_uncore_nb, cpu) = uncore_nb;
         }
 
@@ -319,6 +322,7 @@ static int amd_uncore_cpu_up_prepare(unsigned int cpu)
                 uncore_l2->msr_base = MSR_F16H_L2I_PERF_CTL;
                 uncore_l2->active_mask = &amd_l2_active_mask;
                 uncore_l2->pmu = &amd_l2_pmu;
+                uncore_l2->id = -1;
                 *per_cpu_ptr(amd_uncore_l2, cpu) = uncore_l2;
         }
 
@@ -348,7 +352,7 @@ amd_uncore_find_online_sibling(struct amd_uncore *this,
                         continue;
 
                 if (this->id == that->id) {
-                        that->free_when_cpu_online = this;
+                        hlist_add_head(&this->node, &uncore_unused_list);
                         this = that;
                         break;
                 }
@@ -388,13 +392,23 @@ static int amd_uncore_cpu_starting(unsigned int cpu)
         return 0;
 }
 
+static void uncore_clean_online(void)
+{
+        struct amd_uncore *uncore;
+        struct hlist_node *n;
+
+        hlist_for_each_entry_safe(uncore, n, &uncore_unused_list, node) {
+                hlist_del(&uncore->node);
+                kfree(uncore);
+        }
+}
+
 static void uncore_online(unsigned int cpu,
                           struct amd_uncore * __percpu *uncores)
 {
         struct amd_uncore *uncore = *per_cpu_ptr(uncores, cpu);
 
-        kfree(uncore->free_when_cpu_online);
-        uncore->free_when_cpu_online = NULL;
+        uncore_clean_online();
 
         if (cpu == uncore->cpu)
                 cpumask_set_cpu(cpu, uncore->active_mask);
diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index 0a6e393a2e62..bdcd6510992c 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -31,7 +31,17 @@
 struct bts_ctx {
         struct perf_output_handle       handle;
         struct debug_store              ds_back;
-        int                             started;
+        int                             state;
+};
+
+/* BTS context states: */
+enum {
+        /* no ongoing AUX transactions */
+        BTS_STATE_STOPPED = 0,
+        /* AUX transaction is on, BTS tracing is disabled */
+        BTS_STATE_INACTIVE,
+        /* AUX transaction is on, BTS tracing is running */
+        BTS_STATE_ACTIVE,
 };
 
 static DEFINE_PER_CPU(struct bts_ctx, bts_ctx);
@@ -204,6 +214,15 @@ static void bts_update(struct bts_ctx *bts)
 static int
 bts_buffer_reset(struct bts_buffer *buf, struct perf_output_handle *handle);
 
+/*
+ * Ordering PMU callbacks wrt themselves and the PMI is done by means
+ * of bts::state, which:
+ *  - is set when bts::handle::event is valid, that is, between
+ *    perf_aux_output_begin() and perf_aux_output_end();
+ *  - is zero otherwise;
+ *  - is ordered against bts::handle::event with a compiler barrier.
+ */
+
 static void __bts_event_start(struct perf_event *event)
 {
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
@@ -221,10 +240,13 @@ static void __bts_event_start(struct perf_event *event)
 
         /*
          * local barrier to make sure that ds configuration made it
-         * before we enable BTS
+         * before we enable BTS and bts::state goes ACTIVE
          */
         wmb();
 
+        /* INACTIVE/STOPPED -> ACTIVE */
+        WRITE_ONCE(bts->state, BTS_STATE_ACTIVE);
+
         intel_pmu_enable_bts(config);
 
 }
@@ -251,9 +273,6 @@ static void bts_event_start(struct perf_event *event, int flags)
 
         __bts_event_start(event);
 
-        /* PMI handler: this counter is running and likely generating PMIs */
-        ACCESS_ONCE(bts->started) = 1;
-
         return;
 
 fail_end_stop:
@@ -263,30 +282,34 @@ fail_stop:
         event->hw.state = PERF_HES_STOPPED;
 }
 
-static void __bts_event_stop(struct perf_event *event)
+static void __bts_event_stop(struct perf_event *event, int state)
 {
+        struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
+
+        /* ACTIVE -> INACTIVE(PMI)/STOPPED(->stop()) */
+        WRITE_ONCE(bts->state, state);
+
         /*
          * No extra synchronization is mandated by the documentation to have
          * BTS data stores globally visible.
          */
         intel_pmu_disable_bts();
-
-        if (event->hw.state & PERF_HES_STOPPED)
-                return;
-
-        ACCESS_ONCE(event->hw.state) |= PERF_HES_STOPPED;
 }
 
 static void bts_event_stop(struct perf_event *event, int flags)
 {
         struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
-        struct bts_buffer *buf = perf_get_aux(&bts->handle);
+        struct bts_buffer *buf = NULL;
+        int state = READ_ONCE(bts->state);
 
-        /* PMI handler: don't restart this counter */
-        ACCESS_ONCE(bts->started) = 0;
+        if (state == BTS_STATE_ACTIVE)
+                __bts_event_stop(event, BTS_STATE_STOPPED);
 
-        __bts_event_stop(event);
+        if (state != BTS_STATE_STOPPED)
+                buf = perf_get_aux(&bts->handle);
+
+        event->hw.state |= PERF_HES_STOPPED;
 
         if (flags & PERF_EF_UPDATE) {
                 bts_update(bts);
@@ -296,6 +319,7 @@ static void bts_event_stop(struct perf_event *event, int flags)
                                 bts->handle.head =
                                         local_xchg(&buf->data_size,
                                                    buf->nr_pages << PAGE_SHIFT);
+
                         perf_aux_output_end(&bts->handle, local_xchg(&buf->data_size, 0),
                                             !!local_xchg(&buf->lost, 0));
                 }
@@ -310,8 +334,20 @@ static void bts_event_stop(struct perf_event *event, int flags)
 void intel_bts_enable_local(void)
 {
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
+        int state = READ_ONCE(bts->state);
+
+        /*
+         * Here we transition from INACTIVE to ACTIVE;
+         * if we instead are STOPPED from the interrupt handler,
+         * stay that way. Can't be ACTIVE here though.
+         */
+        if (WARN_ON_ONCE(state == BTS_STATE_ACTIVE))
+                return;
+
+        if (state == BTS_STATE_STOPPED)
+                return;
 
-        if (bts->handle.event && bts->started)
+        if (bts->handle.event)
                 __bts_event_start(bts->handle.event);
 }
 
@@ -319,8 +355,15 @@ void intel_bts_disable_local(void)
 {
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
 
+        /*
+         * Here we transition from ACTIVE to INACTIVE;
+         * do nothing for STOPPED or INACTIVE.
+         */
+        if (READ_ONCE(bts->state) != BTS_STATE_ACTIVE)
+                return;
+
         if (bts->handle.event)
-                __bts_event_stop(bts->handle.event);
+                __bts_event_stop(bts->handle.event, BTS_STATE_INACTIVE);
 }
 
 static int
@@ -335,8 +378,6 @@ bts_buffer_reset(struct bts_buffer *buf, struct perf_output_handle *handle)
                 return 0;
 
         head = handle->head & ((buf->nr_pages << PAGE_SHIFT) - 1);
-        if (WARN_ON_ONCE(head != local_read(&buf->head)))
-                return -EINVAL;
 
         phys = &buf->buf[buf->cur_buf];
         space = phys->offset + phys->displacement + phys->size - head;
@@ -403,22 +444,37 @@ bts_buffer_reset(struct bts_buffer *buf, struct perf_output_handle *handle)
 
 int intel_bts_interrupt(void)
 {
+        struct debug_store *ds = this_cpu_ptr(&cpu_hw_events)->ds;
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
         struct perf_event *event = bts->handle.event;
         struct bts_buffer *buf;
         s64 old_head;
-        int err;
+        int err = -ENOSPC, handled = 0;
 
-        if (!event || !bts->started)
-                return 0;
+        /*
+         * The only surefire way of knowing if this NMI is ours is by checking
+         * the write ptr against the PMI threshold.
+         */
+        if (ds->bts_index >= ds->bts_interrupt_threshold)
+                handled = 1;
+
+        /*
+         * this is wrapped in intel_bts_enable_local/intel_bts_disable_local,
+         * so we can only be INACTIVE or STOPPED
+         */
+        if (READ_ONCE(bts->state) == BTS_STATE_STOPPED)
+                return handled;
 
         buf = perf_get_aux(&bts->handle);
+        if (!buf)
+                return handled;
+
         /*
          * Skip snapshot counters: they don't use the interrupt, but
          * there's no other way of telling, because the pointer will
          * keep moving
          */
-        if (!buf || buf->snapshot)
+        if (buf->snapshot)
                 return 0;
 
         old_head = local_read(&buf->head);
@@ -426,18 +482,27 @@ int intel_bts_interrupt(void)
 
         /* no new data */
         if (old_head == local_read(&buf->head))
-                return 0;
+                return handled;
 
         perf_aux_output_end(&bts->handle, local_xchg(&buf->data_size, 0),
                             !!local_xchg(&buf->lost, 0));
 
         buf = perf_aux_output_begin(&bts->handle, event);
-        if (!buf)
-                return 1;
+        if (buf)
+                err = bts_buffer_reset(buf, &bts->handle);
+
+        if (err) {
+                WRITE_ONCE(bts->state, BTS_STATE_STOPPED);
 
-        err = bts_buffer_reset(buf, &bts->handle);
-        if (err)
-                perf_aux_output_end(&bts->handle, 0, false);
+                if (buf) {
+                        /*
+                         * BTS_STATE_STOPPED should be visible before
+                         * cleared handle::event
+                         */
+                        barrier();
+                        perf_aux_output_end(&bts->handle, 0, false);
+                }
+        }
 
         return 1;
 }
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 2cbde2f449aa..4c9a79b9cd69 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -1730,9 +1730,11 @@ static __initconst const u64 knl_hw_cache_extra_regs
  * disabled state if called consecutively.
  *
  * During consecutive calls, the same disable value will be written to related
- * registers, so the PMU state remains unchanged. hw.state in
- * intel_bts_disable_local will remain PERF_HES_STOPPED too in consecutive
- * calls.
+ * registers, so the PMU state remains unchanged.
+ *
+ * intel_bts events don't coexist with intel PMU's BTS events because of
+ * x86_add_exclusive(x86_lbr_exclusive_lbr); there's no need to keep them
+ * disabled around intel PMU's event batching etc, only inside the PMI handler.
  */
 static void __intel_pmu_disable_all(void)
 {
@@ -1742,8 +1744,6 @@ static void __intel_pmu_disable_all(void)
 
         if (test_bit(INTEL_PMC_IDX_FIXED_BTS, cpuc->active_mask))
                 intel_pmu_disable_bts();
-        else
-                intel_bts_disable_local();
 
         intel_pmu_pebs_disable_all();
 }
@@ -1771,8 +1771,7 @@ static void __intel_pmu_enable_all(int added, bool pmi)
                         return;
 
                 intel_pmu_enable_bts(event->hw.config);
-        } else
-                intel_bts_enable_local();
+        }
 }
 
 static void intel_pmu_enable_all(int added)
@@ -2073,6 +2072,7 @@ static int intel_pmu_handle_irq(struct pt_regs *regs)
          */
         if (!x86_pmu.late_ack)
                 apic_write(APIC_LVTPC, APIC_DM_NMI);
+        intel_bts_disable_local();
         __intel_pmu_disable_all();
         handled = intel_pmu_drain_bts_buffer();
         handled += intel_bts_interrupt();
@@ -2172,6 +2172,7 @@ done:
         /* Only restore PMU state when it's active. See x86_pmu_disable(). */
         if (cpuc->enabled)
                 __intel_pmu_enable_all(0, true);
+        intel_bts_enable_local();
 
         /*
          * Only unmask the NMI after the overflow counters
diff --git a/arch/x86/events/intel/cqm.c b/arch/x86/events/intel/cqm.c
index 783c49ddef29..8f82b02934fa 100644
--- a/arch/x86/events/intel/cqm.c
+++ b/arch/x86/events/intel/cqm.c
@@ -458,6 +458,11 @@ static void __intel_cqm_event_count(void *info);
 static void init_mbm_sample(u32 rmid, u32 evt_type);
 static void __intel_mbm_event_count(void *info);
 
+static bool is_cqm_event(int e)
+{
+        return (e == QOS_L3_OCCUP_EVENT_ID);
+}
+
 static bool is_mbm_event(int e)
 {
         return (e >= QOS_MBM_TOTAL_EVENT_ID && e <= QOS_MBM_LOCAL_EVENT_ID);
@@ -1366,6 +1371,10 @@ static int intel_cqm_event_init(struct perf_event *event)
              (event->attr.config > QOS_MBM_LOCAL_EVENT_ID))
                 return -EINVAL;
 
+        if ((is_cqm_event(event->attr.config) && !cqm_enabled) ||
+            (is_mbm_event(event->attr.config) && !mbm_enabled))
+                return -EINVAL;
+
         /* unsupported modes and filters */
         if (event->attr.exclude_user   ||
             event->attr.exclude_kernel ||
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 7ce9f3f669e6..9b983a474253 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -1274,18 +1274,18 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs)
                 struct pebs_record_nhm *p = at;
                 u64 pebs_status;
 
-                /* PEBS v3 has accurate status bits */
+                pebs_status = p->status & cpuc->pebs_enabled;
+                pebs_status &= (1ULL << x86_pmu.max_pebs_events) - 1;
+
+                /* PEBS v3 has more accurate status bits */
                 if (x86_pmu.intel_cap.pebs_format >= 3) {
-                        for_each_set_bit(bit, (unsigned long *)&p->status,
-                                         MAX_PEBS_EVENTS)
+                        for_each_set_bit(bit, (unsigned long *)&pebs_status,
+                                         x86_pmu.max_pebs_events)
                                 counts[bit]++;
 
                         continue;
                 }
 
-                pebs_status = p->status & cpuc->pebs_enabled;
-                pebs_status &= (1ULL << x86_pmu.max_pebs_events) - 1;
-
                 /*
                  * On some CPUs the PEBS status can be zero when PEBS is
                  * racing with clearing of GLOBAL_STATUS.
@@ -1333,8 +1333,11 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs)
                         continue;
 
                 event = cpuc->events[bit];
-                WARN_ON_ONCE(!event);
-                WARN_ON_ONCE(!event->attr.precise_ip);
+                if (WARN_ON_ONCE(!event))
+                        continue;
+
+                if (WARN_ON_ONCE(!event->attr.precise_ip))
+                        continue;
 
                 /* log dropped samples number */
                 if (error[bit])
diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index 04bb5fb5a8d7..861a7d9cb60f 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -1074,6 +1074,11 @@ static void pt_addr_filters_fini(struct perf_event *event)
         event->hw.addr_filters = NULL;
 }
 
+static inline bool valid_kernel_ip(unsigned long ip)
+{
+        return virt_addr_valid(ip) && kernel_ip(ip);
+}
+
 static int pt_event_addr_filters_validate(struct list_head *filters)
 {
         struct perf_addr_filter *filter;
@@ -1081,11 +1086,16 @@ static int pt_event_addr_filters_validate(struct list_head *filters)
 
         list_for_each_entry(filter, filters, entry) {
                 /* PT doesn't support single address triggers */
-                if (!filter->range)
+                if (!filter->range || !filter->size)
                         return -EOPNOTSUPP;
 
-                if (!filter->inode && !kernel_ip(filter->offset))
-                        return -EINVAL;
+                if (!filter->inode) {
+                        if (!valid_kernel_ip(filter->offset))
+                                return -EINVAL;
+
+                        if (!valid_kernel_ip(filter->offset + filter->size))
+                                return -EINVAL;
+                }
 
                 if (++range > pt_cap_get(PT_CAP_num_address_ranges))
                         return -EOPNOTSUPP;
@@ -1111,7 +1121,7 @@ static void pt_event_addr_filters_sync(struct perf_event *event)
                 } else {
                         /* apply the offset */
                         msr_a = filter->offset + offs[range];
-                        msr_b = filter->size + msr_a;
+                        msr_b = filter->size + msr_a - 1;
                 }
 
                 filters->filter[range].msr_a  = msr_a;
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index c3f291195294..2131c4ce7d8a 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -433,7 +433,11 @@ do {									\
 #define __get_user_asm_ex(x, addr, itype, rtype, ltype)                 \
         asm volatile("1:        mov"itype" %1,%"rtype"0\n"              \
                      "2:\n"                                             \
-                     _ASM_EXTABLE_EX(1b, 2b)                            \
+                     ".section .fixup,\"ax\"\n"                         \
+                     "3:xor"itype" %"rtype"0,%"rtype"0\n"               \
+                     "  jmp 2b\n"                                       \
+                     ".previous\n"                                      \
+                     _ASM_EXTABLE_EX(1b, 3b)                            \
                      : ltype(x) : "m" (__m(addr)))
 
 #define __put_user_nocheck(x, ptr, size)                        \
@@ -705,7 +709,7 @@ static inline void copy_user_overflow(int size, unsigned long count)
         WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
 }
 
-static inline unsigned long __must_check
+static __always_inline unsigned long __must_check
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
         int sz = __compiletime_object_size(to);
@@ -725,7 +729,7 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
         return n;
 }
 
-static inline unsigned long __must_check
+static __always_inline unsigned long __must_check
 copy_to_user(void __user *to, const void *from, unsigned long n)
 {
         int sz = __compiletime_object_size(from);
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 50c95af0f017..f3e9b2df4b16 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -2093,7 +2093,6 @@ int generic_processor_info(int apicid, int version)
                 return -EINVAL;
         }
 
-        num_processors++;
         if (apicid == boot_cpu_physical_apicid) {
                 /*
                  * x86_bios_cpu_apicid is required to have processors listed
@@ -2116,10 +2115,13 @@ int generic_processor_info(int apicid, int version)
 
                 pr_warning("APIC: Package limit reached. Processor %d/0x%x ignored.\n",
                            thiscpu, apicid);
+
                 disabled_cpus++;
                 return -ENOSPC;
         }
 
+        num_processors++;
+
         /*
          * Validate version
          */
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index b816971f5da4..620ab06bcf45 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -54,6 +54,7 @@ static LIST_HEAD(pcache);
  */
 static u8 *container;
 static size_t container_size;
+static bool ucode_builtin;
 
 static u32 ucode_new_rev;
 static u8 amd_ucode_patch[PATCH_MAX_SIZE];
@@ -281,18 +282,22 @@ static bool __init load_builtin_amd_microcode(struct cpio_data *cp,
 void __init load_ucode_amd_bsp(unsigned int family)
 {
         struct cpio_data cp;
+        bool *builtin;
         void **data;
         size_t *size;
 
 #ifdef CONFIG_X86_32
         data =  (void **)__pa_nodebug(&ucode_cpio.data);
         size = (size_t *)__pa_nodebug(&ucode_cpio.size);
+        builtin = (bool *)__pa_nodebug(&ucode_builtin);
 #else
         data = &ucode_cpio.data;
         size = &ucode_cpio.size;
+        builtin = &ucode_builtin;
 #endif
 
-        if (!load_builtin_amd_microcode(&cp, family))
+        *builtin = load_builtin_amd_microcode(&cp, family);
+        if (!*builtin)
                 cp = find_ucode_in_initrd();
 
         if (!(cp.data && cp.size))
@@ -373,7 +378,8 @@ void load_ucode_amd_ap(void)
                 return;
 
         /* Add CONFIG_RANDOMIZE_MEMORY offset. */
-        cont += PAGE_OFFSET - __PAGE_OFFSET_BASE;
+        if (!ucode_builtin)
+                cont += PAGE_OFFSET - __PAGE_OFFSET_BASE;
 
         eax = cpuid_eax(0x00000001);
         eq  = (struct equiv_cpu_entry *)(cont + CONTAINER_HDR_SZ);
@@ -439,7 +445,8 @@ int __init save_microcode_in_initrd_amd(void)
                 container = cont_va;
 
         /* Add CONFIG_RANDOMIZE_MEMORY offset. */
-        container += PAGE_OFFSET - __PAGE_OFFSET_BASE;
+        if (!ucode_builtin)
+                container += PAGE_OFFSET - __PAGE_OFFSET_BASE;
 
         eax   = cpuid_eax(0x00000001);
         eax   = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff);
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 1d39bfbd26bb..3692249a70f1 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -289,6 +289,7 @@ void __init kvmclock_init(void)
         put_cpu();
 
         x86_platform.calibrate_tsc = kvm_get_tsc_khz;
+        x86_platform.calibrate_cpu = kvm_get_tsc_khz;
         x86_platform.get_wallclock = kvm_get_wallclock;
         x86_platform.set_wallclock = kvm_set_wallclock;
 #ifdef CONFIG_X86_LOCAL_APIC
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 5f42d038fcb4..c7220ba94aa7 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -109,6 +109,7 @@ static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
 {
         bool new_val, old_val;
         struct kvm_ioapic *ioapic = vcpu->kvm->arch.vioapic;
+        struct dest_map *dest_map = &ioapic->rtc_status.dest_map;
         union kvm_ioapic_redirect_entry *e;
 
         e = &ioapic->redirtbl[RTC_GSI];
@@ -117,16 +118,17 @@ static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
                 return;
 
         new_val = kvm_apic_pending_eoi(vcpu, e->fields.vector);
-        old_val = test_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
+        old_val = test_bit(vcpu->vcpu_id, dest_map->map);
 
         if (new_val == old_val)
                 return;
 
         if (new_val) {
-                __set_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
+                __set_bit(vcpu->vcpu_id, dest_map->map);
+                dest_map->vectors[vcpu->vcpu_id] = e->fields.vector;
                 ioapic->rtc_status.pending_eoi++;
         } else {
-                __clear_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
+                __clear_bit(vcpu->vcpu_id, dest_map->map);
                 ioapic->rtc_status.pending_eoi--;
                 rtc_status_pending_eoi_check_valid(ioapic);
         }
diff --git a/arch/x86/kvm/pmu_amd.c b/arch/x86/kvm/pmu_amd.c
index 39b91127ef07..cd944435dfbd 100644
--- a/arch/x86/kvm/pmu_amd.c
+++ b/arch/x86/kvm/pmu_amd.c
@@ -23,8 +23,8 @@
 static struct kvm_event_hw_type_mapping amd_event_mapping[] = {
         [0] = { 0x76, 0x00, PERF_COUNT_HW_CPU_CYCLES },
         [1] = { 0xc0, 0x00, PERF_COUNT_HW_INSTRUCTIONS },
-        [2] = { 0x80, 0x00, PERF_COUNT_HW_CACHE_REFERENCES },
-        [3] = { 0x81, 0x00, PERF_COUNT_HW_CACHE_MISSES },
+        [2] = { 0x7d, 0x07, PERF_COUNT_HW_CACHE_REFERENCES },
+        [3] = { 0x7e, 0x07, PERF_COUNT_HW_CACHE_MISSES },
         [4] = { 0xc2, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS },
         [5] = { 0xc3, 0x00, PERF_COUNT_HW_BRANCH_MISSES },
         [6] = { 0xd0, 0x00, PERF_COUNT_HW_STALLED_CYCLES_FRONTEND },
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 19f9f9e05c2a..699f8726539a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2743,16 +2743,16 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
                 if (tsc_delta < 0)
                         mark_tsc_unstable("KVM discovered backwards TSC");
 
-                if (kvm_lapic_hv_timer_in_use(vcpu) &&
-                                kvm_x86_ops->set_hv_timer(vcpu,
-                                        kvm_get_lapic_tscdeadline_msr(vcpu)))
-                        kvm_lapic_switch_to_sw_timer(vcpu);
                 if (check_tsc_unstable()) {
                         u64 offset = kvm_compute_tsc_offset(vcpu,
                                                 vcpu->arch.last_guest_tsc);
                         kvm_x86_ops->write_tsc_offset(vcpu, offset);
                         vcpu->arch.tsc_catchup = 1;
                 }
+                if (kvm_lapic_hv_timer_in_use(vcpu) &&
+                                kvm_x86_ops->set_hv_timer(vcpu,
+                                        kvm_get_lapic_tscdeadline_msr(vcpu)))
+                        kvm_lapic_switch_to_sw_timer(vcpu);
                 /*
                  * On a host with synchronized TSC, there is no need to update
                  * kvmclock on vcpu->cpu migration
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 849dc09fa4f0..e3353c97d086 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -917,11 +917,11 @@ static void populate_pte(struct cpa_data *cpa,
         }
 }
 
-static int populate_pmd(struct cpa_data *cpa,
-                        unsigned long start, unsigned long end,
-                        unsigned num_pages, pud_t *pud, pgprot_t pgprot)
+static long populate_pmd(struct cpa_data *cpa,
+                         unsigned long start, unsigned long end,
+                         unsigned num_pages, pud_t *pud, pgprot_t pgprot)
 {
-        unsigned int cur_pages = 0;
+        long cur_pages = 0;
         pmd_t *pmd;
         pgprot_t pmd_pgprot;
 
@@ -991,12 +991,12 @@ static int populate_pmd(struct cpa_data *cpa,
         return num_pages;
 }
 
-static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd,
-                        pgprot_t pgprot)
+static long populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd,
+                         pgprot_t pgprot)
 {
         pud_t *pud;
         unsigned long end;
-        int cur_pages = 0;
+        long cur_pages = 0;
         pgprot_t pud_pgprot;
 
         end = start + (cpa->numpages << PAGE_SHIFT);
@@ -1052,7 +1052,7 @@ static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd,
 
         /* Map trailing leftover */
         if (start < end) {
-                int tmp;
+                long tmp;
 
                 pud = pud_offset(pgd, start);
                 if (pud_none(*pud))
@@ -1078,7 +1078,7 @@ static int populate_pgd(struct cpa_data *cpa, unsigned long addr)
         pgprot_t pgprot = __pgprot(_KERNPG_TABLE);
         pud_t *pud = NULL;      /* shut up gcc */
         pgd_t *pgd_entry;
-        int ret;
+        long ret;
 
         pgd_entry = cpa->pgd + pgd_index(addr);
 
@@ -1327,7 +1327,8 @@ static int cpa_process_alias(struct cpa_data *cpa)
 
 static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
 {
-        int ret, numpages = cpa->numpages;
+        unsigned long numpages = cpa->numpages;
+        int ret;
 
         while (numpages) {
                 /*
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index ecb1b69c1651..170cc4ff057b 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -927,9 +927,10 @@ int track_pfn_copy(struct vm_area_struct *vma)
 }
 
 /*
- * prot is passed in as a parameter for the new mapping. If the vma has a
- * linear pfn mapping for the entire range reserve the entire vma range with
- * single reserve_pfn_range call.
+ * prot is passed in as a parameter for the new mapping. If the vma has
+ * a linear pfn mapping for the entire range, or no vma is provided,
+ * reserve the entire pfn + size range with single reserve_pfn_range
+ * call.
  */
 int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot,
                     unsigned long pfn, unsigned long addr, unsigned long size)
@@ -938,11 +939,12 @@ int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot,
         enum page_cache_mode pcm;
 
         /* reserve the whole chunk starting from paddr */
-        if (addr == vma->vm_start && size == (vma->vm_end - vma->vm_start)) {
+        if (!vma || (addr == vma->vm_start
+                                && size == (vma->vm_end - vma->vm_start))) {
                 int ret;
 
                 ret = reserve_pfn_range(paddr, size, prot, 0);
-                if (!ret)
+                if (ret == 0 && vma)
                         vma->vm_flags |= VM_PAT;
                 return ret;
         }
@@ -997,7 +999,7 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
         resource_size_t paddr;
         unsigned long prot;
 
-        if (!(vma->vm_flags & VM_PAT))
+        if (vma && !(vma->vm_flags & VM_PAT))
                 return;
 
         /* free the chunk starting from pfn or the whole chunk */
@@ -1011,7 +1013,8 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
                 size = vma->vm_end - vma->vm_start;
         }
         free_pfn_range(paddr, size);
-        vma->vm_flags &= ~VM_PAT;
+        if (vma)
+                vma->vm_flags &= ~VM_PAT;
 }
 
 /*
diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
index 837ea36a837d..6d52b94f4bb9 100644
--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c
@@ -553,15 +553,21 @@ static void twinhead_reserve_killing_zone(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone);
 
 /*
- * Broadwell EP Home Agent BARs erroneously return non-zero values when read.
+ * Device [8086:2fc0]
+ * Erratum HSE43
+ * CONFIG_TDP_NOMINAL CSR Implemented at Incorrect Offset
+ * http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html
  *
- * See http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html
- * entry BDF2.
+ * Devices [8086:6f60,6fa0,6fc0]
+ * Erratum BDF2
+ * PCI BARs in the Home Agent Will Return Non-Zero Values During Enumeration
+ * http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html
  */
-static void pci_bdwep_bar(struct pci_dev *dev)
+static void pci_invalid_bar(struct pci_dev *dev)
 {
         dev->non_compliant_bars = 1;
 }
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_bdwep_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2fc0, pci_invalid_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_invalid_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_invalid_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_invalid_bar);
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index d65cdadaa6b6..58b0f801f66f 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -244,7 +244,7 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
          * text and allocate a new stack because we can't rely on the
          * stack pointer being < 4GB.
          */
-        if (!IS_ENABLED(CONFIG_EFI_MIXED))
+        if (!IS_ENABLED(CONFIG_EFI_MIXED) || efi_is_native())
                 return 0;
 
         page = alloc_page(GFP_KERNEL|__GFP_DMA32);
diff --git a/arch/x86/um/ptrace_32.c b/arch/x86/um/ptrace_32.c
index ebd4dd6ef73b..a7ef7b131e25 100644
--- a/arch/x86/um/ptrace_32.c
+++ b/arch/x86/um/ptrace_32.c
@@ -84,7 +84,10 @@ int putreg(struct task_struct *child, int regno, unsigned long value)
         case EAX:
         case EIP:
         case UESP:
+                break;
         case ORIG_EAX:
+                /* Update the syscall number. */
+                UPT_SYSCALL_NR(&child->thread.regs.regs) = value;
                 break;
         case FS:
                 if (value && (value & 3) != 3)
diff --git a/arch/x86/um/ptrace_64.c b/arch/x86/um/ptrace_64.c
index faab418876ce..0b5c184dd5b3 100644
--- a/arch/x86/um/ptrace_64.c
+++ b/arch/x86/um/ptrace_64.c
@@ -78,7 +78,11 @@ int putreg(struct task_struct *child, int regno, unsigned long value)
         case RSI:
         case RDI:
         case RBP:
+                break;
+
         case ORIG_RAX:
+                /* Update the syscall number. */
+                UPT_SYSCALL_NR(&child->thread.regs.regs) = value;
                 break;
 
         case FS:
diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
index 369999530108..a832426820e8 100644
--- a/crypto/blkcipher.c
+++ b/crypto/blkcipher.c
@@ -233,6 +233,8 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
                 return blkcipher_walk_done(desc, walk, -EINVAL);
         }
 
+        bsize = min(walk->walk_blocksize, n);
+
         walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY |
                          BLKCIPHER_WALK_DIFF);
         if (!scatterwalk_aligned(&walk->in, walk->alignmask) ||
@@ -245,7 +247,6 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
                 }
         }
 
-        bsize = min(walk->walk_blocksize, n);
         n = scatterwalk_clamp(&walk->in, n);
         n = scatterwalk_clamp(&walk->out, n);
 
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
index cf8037a87b2d..0c654e59f215 100644
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -631,9 +631,14 @@ static int cryptd_hash_export(struct ahash_request *req, void *out)
 
 static int cryptd_hash_import(struct ahash_request *req, const void *in)
 {
-        struct cryptd_hash_request_ctx *rctx = ahash_request_ctx(req);
+        struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+        struct cryptd_hash_ctx *ctx = crypto_ahash_ctx(tfm);
+        struct shash_desc *desc = cryptd_shash_desc(req);
+
+        desc->tfm = ctx->child;
+        desc->flags = req->base.flags;
 
-        return crypto_shash_import(&rctx->desc, in);
+        return crypto_shash_import(desc, in);
 }
 
 static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
@@ -733,13 +738,14 @@ static void cryptd_aead_crypt(struct aead_request *req,
         rctx = aead_request_ctx(req);
         compl = rctx->complete;
 
+        tfm = crypto_aead_reqtfm(req);
+
         if (unlikely(err == -EINPROGRESS))
                 goto out;
         aead_request_set_tfm(req, child);
         err = crypt( req );
 
 out:
-        tfm = crypto_aead_reqtfm(req);
         ctx = crypto_aead_ctx(tfm);
         refcnt = atomic_read(&ctx->refcnt);
 
diff --git a/crypto/echainiv.c b/crypto/echainiv.c
index 1b01fe98e91f..e3d889b122e0 100644
--- a/crypto/echainiv.c
+++ b/crypto/echainiv.c
@@ -1,8 +1,8 @@
 /*
  * echainiv: Encrypted Chain IV Generator
  *
- * This generator generates an IV based on a sequence number by xoring it
- * with a salt and then encrypting it with the same key as used to encrypt
+ * This generator generates an IV based on a sequence number by multiplying
+ * it with a salt and then encrypting it with the same key as used to encrypt
  * the plain text.  This algorithm requires that the block size be equal
  * to the IV size.  It is mainly useful for CBC.
  *
@@ -24,81 +24,17 @@
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/mm.h>
 #include <linux/module.h>
-#include <linux/percpu.h>
-#include <linux/spinlock.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 
-#define MAX_IV_SIZE 16
-
-static DEFINE_PER_CPU(u32 [MAX_IV_SIZE / sizeof(u32)], echainiv_iv);
-
-/* We don't care if we get preempted and read/write IVs from the next CPU. */
-static void echainiv_read_iv(u8 *dst, unsigned size)
-{
-        u32 *a = (u32 *)dst;
-        u32 __percpu *b = echainiv_iv;
-
-        for (; size >= 4; size -= 4) {
-                *a++ = this_cpu_read(*b);
-                b++;
-        }
-}
-
-static void echainiv_write_iv(const u8 *src, unsigned size)
-{
-        const u32 *a = (const u32 *)src;
-        u32 __percpu *b = echainiv_iv;
-
-        for (; size >= 4; size -= 4) {
-                this_cpu_write(*b, *a);
-                a++;
-                b++;
-        }
-}
-
-static void echainiv_encrypt_complete2(struct aead_request *req, int err)
-{
-        struct aead_request *subreq = aead_request_ctx(req);
-        struct crypto_aead *geniv;
-        unsigned int ivsize;
-
-        if (err == -EINPROGRESS)
-                return;
-
-        if (err)
-                goto out;
-
-        geniv = crypto_aead_reqtfm(req);
-        ivsize = crypto_aead_ivsize(geniv);
-
-        echainiv_write_iv(subreq->iv, ivsize);
-
-        if (req->iv != subreq->iv)
-                memcpy(req->iv, subreq->iv, ivsize);
-
-out:
-        if (req->iv != subreq->iv)
-                kzfree(subreq->iv);
-}
-
-static void echainiv_encrypt_complete(struct crypto_async_request *base,
-                                         int err)
-{
-        struct aead_request *req = base->data;
-
-        echainiv_encrypt_complete2(req, err);
-        aead_request_complete(req, err);
-}
-
 static int echainiv_encrypt(struct aead_request *req)
 {
         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
         struct aead_request *subreq = aead_request_ctx(req);
-        crypto_completion_t compl;
-        void *data;
+        __be64 nseqno;
+        u64 seqno;
         u8 *info;
         unsigned int ivsize = crypto_aead_ivsize(geniv);
         int err;
@@ -108,8 +44,6 @@ static int echainiv_encrypt(struct aead_request *req)
 
         aead_request_set_tfm(subreq, ctx->child);
 
-        compl = echainiv_encrypt_complete;
-        data = req;
         info = req->iv;
 
         if (req->src != req->dst) {
@@ -127,29 +61,30 @@ static int echainiv_encrypt(struct aead_request *req)
                         return err;
         }
 
-        if (unlikely(!IS_ALIGNED((unsigned long)info,
-                                 crypto_aead_alignmask(geniv) + 1))) {
-                info = kmalloc(ivsize, req->base.flags &
-                                       CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
-                                                                  GFP_ATOMIC);
-                if (!info)
-                        return -ENOMEM;
-
-                memcpy(info, req->iv, ivsize);
-        }
-
-        aead_request_set_callback(subreq, req->base.flags, compl, data);
+        aead_request_set_callback(subreq, req->base.flags,
+                                  req->base.complete, req->base.data);
         aead_request_set_crypt(subreq, req->dst, req->dst,
                                req->cryptlen, info);
         aead_request_set_ad(subreq, req->assoclen);
 
-        crypto_xor(info, ctx->salt, ivsize);
+        memcpy(&nseqno, info + ivsize - 8, 8);
+        seqno = be64_to_cpu(nseqno);
+        memset(info, 0, ivsize);
+
         scatterwalk_map_and_copy(info, req->dst, req->assoclen, ivsize, 1);
-        echainiv_read_iv(info, ivsize);
 
-        err = crypto_aead_encrypt(subreq);
-        echainiv_encrypt_complete2(req, err);
-        return err;
+        do {
+                u64 a;
+
+                memcpy(&a, ctx->salt + ivsize - 8, 8);
+
+                a |= 1;
+                a *= seqno;
+
+                memcpy(info + ivsize - 8, &a, 8);
+        } while ((ivsize -= 8));
+
+        return crypto_aead_encrypt(subreq);
 }
 
 static int echainiv_decrypt(struct aead_request *req)
@@ -196,8 +131,7 @@ static int echainiv_aead_create(struct crypto_template *tmpl,
         alg = crypto_spawn_aead_alg(spawn);
 
         err = -EINVAL;
-        if (inst->alg.ivsize & (sizeof(u32) - 1) ||
-            inst->alg.ivsize > MAX_IV_SIZE)
+        if (inst->alg.ivsize & (sizeof(u64) - 1) || !inst->alg.ivsize)
                 goto free_inst;
 
         inst->alg.encrypt = echainiv_encrypt;
@@ -206,7 +140,6 @@ static int echainiv_aead_create(struct crypto_template *tmpl,
         inst->alg.init = aead_init_geniv;
         inst->alg.exit = aead_exit_geniv;
 
-        inst->alg.base.cra_alignmask |= __alignof__(u32) - 1;
         inst->alg.base.cra_ctxsize = sizeof(struct aead_geniv_ctx);
         inst->alg.base.cra_ctxsize += inst->alg.ivsize;
 
diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
index 4c745bf389fe..161f91539ae6 100644
--- a/drivers/acpi/nfit/mce.c
+++ b/drivers/acpi/nfit/mce.c
@@ -42,7 +42,7 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
                 list_for_each_entry(nfit_spa, &acpi_desc->spas, list) {
                         struct acpi_nfit_system_address *spa = nfit_spa->spa;
 
-                        if (nfit_spa_type(spa) == NFIT_SPA_PM)
+                        if (nfit_spa_type(spa) != NFIT_SPA_PM)
                                 continue;
                         /* find the spa that covers the mce addr */
                         if (spa->address > mce->addr)
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 17995fadebd7..82a081ea4317 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -419,7 +419,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
         struct device *parent = NULL;
         int retval;
 
-        trace_rpm_suspend(dev, rpmflags);
+        trace_rpm_suspend_rcuidle(dev, rpmflags);
 
  repeat:
         retval = rpm_check_suspend_allowed(dev);
@@ -549,7 +549,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
         }
 
  out:
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
 
         return retval;
 
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index aa56af87d941..b11af3f2c1db 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -404,6 +404,7 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
                 unsigned int new_base_reg, new_top_reg;
                 unsigned int min, max;
                 unsigned int max_dist;
+                unsigned int dist, best_dist = UINT_MAX;
 
                 max_dist = map->reg_stride * sizeof(*rbnode_tmp) /
                         map->cache_word_size;
@@ -423,24 +424,41 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
                                 &base_reg, &top_reg);
 
                         if (base_reg <= max && top_reg >= min) {
-                                new_base_reg = min(reg, base_reg);
-                                new_top_reg = max(reg, top_reg);
-                        } else {
-                                if (max < base_reg)
-                                        node = node->rb_left;
+                                if (reg < base_reg)
+                                        dist = base_reg - reg;
+                                else if (reg > top_reg)
+                                        dist = reg - top_reg;
                                 else
-                                        node = node->rb_right;
-
-                                continue;
+                                        dist = 0;
+                                if (dist < best_dist) {
+                                        rbnode = rbnode_tmp;
+                                        best_dist = dist;
+                                        new_base_reg = min(reg, base_reg);
+                                        new_top_reg = max(reg, top_reg);
+                                }
                         }
 
-                        ret = regcache_rbtree_insert_to_block(map, rbnode_tmp,
+                        /*
+                         * Keep looking, we want to choose the closest block,
+                         * otherwise we might end up creating overlapping
+                         * blocks, which breaks the rbtree.
+                         */
+                        if (reg < base_reg)
+                                node = node->rb_left;
+                        else if (reg > top_reg)
+                                node = node->rb_right;
+                        else
+                                break;
+                }
+
+                if (rbnode) {
+                        ret = regcache_rbtree_insert_to_block(map, rbnode,
                                                               new_base_reg,
                                                               new_top_reg, reg,
                                                               value);
                         if (ret)
                                 return ret;
-                        rbtree_ctx->cached_rbnode = rbnode_tmp;
+                        rbtree_ctx->cached_rbnode = rbnode;
                         return 0;
                 }
 
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index df7ff7290821..4e582561e1e7 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -38,10 +38,11 @@ static int regcache_hw_init(struct regmap *map)
 
         /* calculate the size of reg_defaults */
         for (count = 0, i = 0; i < map->num_reg_defaults_raw; i++)
-                if (!regmap_volatile(map, i * map->reg_stride))
+                if (regmap_readable(map, i * map->reg_stride) &&
+                    !regmap_volatile(map, i * map->reg_stride))
                         count++;
 
-        /* all registers are volatile, so just bypass */
+        /* all registers are unreadable or volatile, so just bypass */
         if (!count) {
                 map->cache_bypass = true;
                 return 0;
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 51fa7d66a393..25d26bb18970 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1474,6 +1474,8 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                 ret = map->bus->write(map->bus_context, buf, len);
 
                 kfree(buf);
+        } else if (ret != 0 && !map->cache_bypass && map->format.parse_val) {
+                regcache_drop_region(map, reg, reg + 1);
         }
 
         trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c
index 5755907f836f..ffa7c9dcbd7a 100644
--- a/drivers/bus/arm-cci.c
+++ b/drivers/bus/arm-cci.c
@@ -551,7 +551,7 @@ static struct attribute *cci5xx_pmu_event_attrs[] = {
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_wrq, 0xB),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_cd_hs, 0xC),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_rq_stall_addr_hazard, 0xD),
-        CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snopp_rq_stall_tt_full, 0xE),
+        CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_rq_stall_tt_full, 0xE),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_rq_tzmp1_prot, 0xF),
         NULL
 };
diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
index 97a9185af433..884c0305e290 100644
--- a/drivers/bus/arm-ccn.c
+++ b/drivers/bus/arm-ccn.c
@@ -187,6 +187,7 @@ struct arm_ccn {
         struct arm_ccn_component *xp;
 
         struct arm_ccn_dt dt;
+        int mn_id;
 };
 
 static DEFINE_MUTEX(arm_ccn_mutex);
@@ -212,6 +213,7 @@ static int arm_ccn_node_to_xp_port(int node)
 #define CCN_CONFIG_TYPE(_config)        (((_config) >> 8) & 0xff)
 #define CCN_CONFIG_EVENT(_config)       (((_config) >> 16) & 0xff)
 #define CCN_CONFIG_PORT(_config)        (((_config) >> 24) & 0x3)
+#define CCN_CONFIG_BUS(_config)         (((_config) >> 24) & 0x3)
 #define CCN_CONFIG_VC(_config)          (((_config) >> 26) & 0x7)
 #define CCN_CONFIG_DIR(_config)         (((_config) >> 29) & 0x1)
 #define CCN_CONFIG_MASK(_config)        (((_config) >> 30) & 0xf)
@@ -241,6 +243,7 @@ static CCN_FORMAT_ATTR(xp, "config:0-7");
 static CCN_FORMAT_ATTR(type, "config:8-15");
 static CCN_FORMAT_ATTR(event, "config:16-23");
 static CCN_FORMAT_ATTR(port, "config:24-25");
+static CCN_FORMAT_ATTR(bus, "config:24-25");
 static CCN_FORMAT_ATTR(vc, "config:26-28");
 static CCN_FORMAT_ATTR(dir, "config:29-29");
 static CCN_FORMAT_ATTR(mask, "config:30-33");
@@ -253,6 +256,7 @@ static struct attribute *arm_ccn_pmu_format_attrs[] = {
         &arm_ccn_pmu_format_attr_type.attr.attr,
         &arm_ccn_pmu_format_attr_event.attr.attr,
         &arm_ccn_pmu_format_attr_port.attr.attr,
+        &arm_ccn_pmu_format_attr_bus.attr.attr,
         &arm_ccn_pmu_format_attr_vc.attr.attr,
         &arm_ccn_pmu_format_attr_dir.attr.attr,
         &arm_ccn_pmu_format_attr_mask.attr.attr,
@@ -328,6 +332,7 @@ struct arm_ccn_pmu_event {
 static ssize_t arm_ccn_pmu_event_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
+        struct arm_ccn *ccn = pmu_to_arm_ccn(dev_get_drvdata(dev));
         struct arm_ccn_pmu_event *event = container_of(attr,
                         struct arm_ccn_pmu_event, attr);
         ssize_t res;
@@ -349,10 +354,17 @@ static ssize_t arm_ccn_pmu_event_show(struct device *dev,
                 break;
         case CCN_TYPE_XP:
                 res += snprintf(buf + res, PAGE_SIZE - res,
-                                ",xp=?,port=?,vc=?,dir=?");
+                                ",xp=?,vc=?");
                 if (event->event == CCN_EVENT_WATCHPOINT)
                         res += snprintf(buf + res, PAGE_SIZE - res,
-                                        ",cmp_l=?,cmp_h=?,mask=?");
+                                        ",port=?,dir=?,cmp_l=?,cmp_h=?,mask=?");
+                else
+                        res += snprintf(buf + res, PAGE_SIZE - res,
+                                        ",bus=?");
+
+                break;
+        case CCN_TYPE_MN:
+                res += snprintf(buf + res, PAGE_SIZE - res, ",node=%d", ccn->mn_id);
                 break;
         default:
                 res += snprintf(buf + res, PAGE_SIZE - res, ",node=?");
@@ -383,9 +395,9 @@ static umode_t arm_ccn_pmu_events_is_visible(struct kobject *kobj,
 }
 
 static struct arm_ccn_pmu_event arm_ccn_pmu_events[] = {
-        CCN_EVENT_MN(eobarrier, "dir=0,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
-        CCN_EVENT_MN(ecbarrier, "dir=0,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
-        CCN_EVENT_MN(dvmop, "dir=0,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(eobarrier, "dir=1,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(ecbarrier, "dir=1,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(dvmop, "dir=1,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
         CCN_EVENT_HNI(txdatflits, "dir=1,vc=3", CCN_IDX_MASK_ANY),
         CCN_EVENT_HNI(rxdatflits, "dir=0,vc=3", CCN_IDX_MASK_ANY),
         CCN_EVENT_HNI(txreqflits, "dir=1,vc=0", CCN_IDX_MASK_ANY),
@@ -733,9 +745,10 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
 
         if (has_branch_stack(event) || event->attr.exclude_user ||
                         event->attr.exclude_kernel || event->attr.exclude_hv ||
-                        event->attr.exclude_idle) {
+                        event->attr.exclude_idle || event->attr.exclude_host ||
+                        event->attr.exclude_guest) {
                 dev_warn(ccn->dev, "Can't exclude execution levels!\n");
-                return -EOPNOTSUPP;
+                return -EINVAL;
         }
 
         if (event->cpu < 0) {
@@ -759,6 +772,12 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
 
         /* Validate node/xp vs topology */
         switch (type) {
+        case CCN_TYPE_MN:
+                if (node_xp != ccn->mn_id) {
+                        dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp);
+                        return -EINVAL;
+                }
+                break;
         case CCN_TYPE_XP:
                 if (node_xp >= ccn->num_xps) {
                         dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp);
@@ -886,6 +905,10 @@ static void arm_ccn_pmu_xp_dt_config(struct perf_event *event, int enable)
         struct arm_ccn_component *xp;
         u32 val, dt_cfg;
 
+        /* Nothing to do for cycle counter */
+        if (hw->idx == CCN_IDX_PMU_CYCLE_COUNTER)
+                return;
+
         if (CCN_CONFIG_TYPE(event->attr.config) == CCN_TYPE_XP)
                 xp = &ccn->xp[CCN_CONFIG_XP(event->attr.config)];
         else
@@ -917,38 +940,17 @@ static void arm_ccn_pmu_event_start(struct perf_event *event, int flags)
                         arm_ccn_pmu_read_counter(ccn, hw->idx));
         hw->state = 0;
 
-        /*
-         * Pin the timer, so that the overflows are handled by the chosen
-         * event->cpu (this is the same one as presented in "cpumask"
-         * attribute).
-         */
-        if (!ccn->irq)
-                hrtimer_start(&ccn->dt.hrtimer, arm_ccn_pmu_timer_period(),
-                                HRTIMER_MODE_REL_PINNED);
-
         /* Set the DT bus input, engaging the counter */
         arm_ccn_pmu_xp_dt_config(event, 1);
 }
 
 static void arm_ccn_pmu_event_stop(struct perf_event *event, int flags)
 {
-        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
         struct hw_perf_event *hw = &event->hw;
-        u64 timeout;
 
         /* Disable counting, setting the DT bus to pass-through mode */
         arm_ccn_pmu_xp_dt_config(event, 0);
 
-        if (!ccn->irq)
-                hrtimer_cancel(&ccn->dt.hrtimer);
-
-        /* Let the DT bus drain */
-        timeout = arm_ccn_pmu_read_counter(ccn, CCN_IDX_PMU_CYCLE_COUNTER) +
-                        ccn->num_xps;
-        while (arm_ccn_pmu_read_counter(ccn, CCN_IDX_PMU_CYCLE_COUNTER) <
-                        timeout)
-                cpu_relax();
-
         if (flags & PERF_EF_UPDATE)
                 arm_ccn_pmu_event_update(event);
 
@@ -988,7 +990,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
 
         /* Comparison values */
         writel(cmp_l & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_L(wp));
-        writel((cmp_l >> 32) & 0xefffffff,
+        writel((cmp_l >> 32) & 0x7fffffff,
                         source->base + CCN_XP_DT_CMP_VAL_L(wp) + 4);
         writel(cmp_h & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_H(wp));
         writel((cmp_h >> 32) & 0x0fffffff,
@@ -996,7 +998,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
 
         /* Mask */
         writel(mask_l & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_L(wp));
-        writel((mask_l >> 32) & 0xefffffff,
+        writel((mask_l >> 32) & 0x7fffffff,
                         source->base + CCN_XP_DT_CMP_MASK_L(wp) + 4);
         writel(mask_h & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_H(wp));
         writel((mask_h >> 32) & 0x0fffffff,
@@ -1014,7 +1016,7 @@ static void arm_ccn_pmu_xp_event_config(struct perf_event *event)
         hw->event_base = CCN_XP_DT_CONFIG__DT_CFG__XP_PMU_EVENT(hw->config_base);
 
         id = (CCN_CONFIG_VC(event->attr.config) << 4) |
-                        (CCN_CONFIG_PORT(event->attr.config) << 3) |
+                        (CCN_CONFIG_BUS(event->attr.config) << 3) |
                         (CCN_CONFIG_EVENT(event->attr.config) << 0);
 
         val = readl(source->base + CCN_XP_PMU_EVENT_SEL);
@@ -1099,15 +1101,31 @@ static void arm_ccn_pmu_event_config(struct perf_event *event)
         spin_unlock(&ccn->dt.config_lock);
 }
 
+static int arm_ccn_pmu_active_counters(struct arm_ccn *ccn)
+{
+        return bitmap_weight(ccn->dt.pmu_counters_mask,
+                             CCN_NUM_PMU_EVENT_COUNTERS + 1);
+}
+
 static int arm_ccn_pmu_event_add(struct perf_event *event, int flags)
 {
         int err;
         struct hw_perf_event *hw = &event->hw;
+        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
 
         err = arm_ccn_pmu_event_alloc(event);
         if (err)
                 return err;
 
+        /*
+         * Pin the timer, so that the overflows are handled by the chosen
+         * event->cpu (this is the same one as presented in "cpumask"
+         * attribute).
+         */
+        if (!ccn->irq && arm_ccn_pmu_active_counters(ccn) == 1)
+                hrtimer_start(&ccn->dt.hrtimer, arm_ccn_pmu_timer_period(),
+                              HRTIMER_MODE_REL_PINNED);
+
         arm_ccn_pmu_event_config(event);
 
         hw->state = PERF_HES_STOPPED;
@@ -1120,9 +1138,14 @@ static int arm_ccn_pmu_event_add(struct perf_event *event, int flags)
 
 static void arm_ccn_pmu_event_del(struct perf_event *event, int flags)
 {
+        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
+
         arm_ccn_pmu_event_stop(event, PERF_EF_UPDATE);
 
         arm_ccn_pmu_event_release(event);
+
+        if (!ccn->irq && arm_ccn_pmu_active_counters(ccn) == 0)
+                hrtimer_cancel(&ccn->dt.hrtimer);
 }
 
 static void arm_ccn_pmu_event_read(struct perf_event *event)
@@ -1130,6 +1153,24 @@ static void arm_ccn_pmu_event_read(struct perf_event *event)
         arm_ccn_pmu_event_update(event);
 }
 
+static void arm_ccn_pmu_enable(struct pmu *pmu)
+{
+        struct arm_ccn *ccn = pmu_to_arm_ccn(pmu);
+
+        u32 val = readl(ccn->dt.base + CCN_DT_PMCR);
+        val |= CCN_DT_PMCR__PMU_EN;
+        writel(val, ccn->dt.base + CCN_DT_PMCR);
+}
+
+static void arm_ccn_pmu_disable(struct pmu *pmu)
+{
+        struct arm_ccn *ccn = pmu_to_arm_ccn(pmu);
+
+        u32 val = readl(ccn->dt.base + CCN_DT_PMCR);
+        val &= ~CCN_DT_PMCR__PMU_EN;
+        writel(val, ccn->dt.base + CCN_DT_PMCR);
+}
+
 static irqreturn_t arm_ccn_pmu_overflow_handler(struct arm_ccn_dt *dt)
 {
         u32 pmovsr = readl(dt->base + CCN_DT_PMOVSR);
@@ -1252,6 +1293,8 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn)
                 .start = arm_ccn_pmu_event_start,
                 .stop = arm_ccn_pmu_event_stop,
                 .read = arm_ccn_pmu_event_read,
+                .pmu_enable = arm_ccn_pmu_enable,
+                .pmu_disable = arm_ccn_pmu_disable,
         };
 
         /* No overflow interrupt? Have to use a timer instead. */
@@ -1361,6 +1404,8 @@ static int arm_ccn_init_nodes(struct arm_ccn *ccn, int region,
 
         switch (type) {
         case CCN_TYPE_MN:
+                ccn->mn_id = id;
+                return 0;
         case CCN_TYPE_DT:
                 return 0;
         case CCN_TYPE_XP:
@@ -1471,8 +1516,9 @@ static int arm_ccn_probe(struct platform_device *pdev)
                 /* Can set 'disable' bits, so can acknowledge interrupts */
                 writel(CCN_MN_ERRINT_STATUS__PMU_EVENTS__ENABLE,
                                 ccn->base + CCN_MN_ERRINT_STATUS);
-                err = devm_request_irq(ccn->dev, irq, arm_ccn_irq_handler, 0,
-                                dev_name(ccn->dev), ccn);
+                err = devm_request_irq(ccn->dev, irq, arm_ccn_irq_handler,
+                                       IRQF_NOBALANCING | IRQF_NO_THREAD,
+                                       dev_name(ccn->dev), ccn);
                 if (err)
                         return err;
 
diff --git a/drivers/bus/vexpress-config.c b/drivers/bus/vexpress-config.c
index c3cb76b363c6..9efdf1de4035 100644
--- a/drivers/bus/vexpress-config.c
+++ b/drivers/bus/vexpress-config.c
@@ -178,6 +178,7 @@ static int vexpress_config_populate(struct device_node *node)
 
         parent = class_find_device(vexpress_config_class, NULL, bridge,
                         vexpress_config_node_match);
+        of_node_put(bridge);
         if (WARN_ON(!parent))
                 return -ENODEV;
 
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index d2406fe25533..5da47e26a012 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -165,6 +165,12 @@ struct ports_device {
          */
         struct virtqueue *c_ivq, *c_ovq;
 
+        /*
+         * A control packet buffer for guest->host requests, protected
+         * by c_ovq_lock.
+         */
+        struct virtio_console_control cpkt;
+
         /* Array of per-port IO virtqueues */
         struct virtqueue **in_vqs, **out_vqs;
 
@@ -560,28 +566,29 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
                                   unsigned int event, unsigned int value)
 {
         struct scatterlist sg[1];
-        struct virtio_console_control cpkt;
         struct virtqueue *vq;
         unsigned int len;
 
         if (!use_multiport(portdev))
                 return 0;
 
-        cpkt.id = cpu_to_virtio32(portdev->vdev, port_id);
-        cpkt.event = cpu_to_virtio16(portdev->vdev, event);
-        cpkt.value = cpu_to_virtio16(portdev->vdev, value);
-
         vq = portdev->c_ovq;
 
-        sg_init_one(sg, &cpkt, sizeof(cpkt));
-
         spin_lock(&portdev->c_ovq_lock);
-        if (virtqueue_add_outbuf(vq, sg, 1, &cpkt, GFP_ATOMIC) == 0) {
+
+        portdev->cpkt.id = cpu_to_virtio32(portdev->vdev, port_id);
+        portdev->cpkt.event = cpu_to_virtio16(portdev->vdev, event);
+        portdev->cpkt.value = cpu_to_virtio16(portdev->vdev, value);
+
+        sg_init_one(sg, &portdev->cpkt, sizeof(struct virtio_console_control));
+
+        if (virtqueue_add_outbuf(vq, sg, 1, &portdev->cpkt, GFP_ATOMIC) == 0) {
                 virtqueue_kick(vq);
                 while (!virtqueue_get_buf(vq, &len)
                         && !virtqueue_is_broken(vq))
                         cpu_relax();
         }
+
         spin_unlock(&portdev->c_ovq_lock);
         return 0;
 }
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
index 9af359544110..267f99523fbe 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
@@ -783,14 +783,14 @@ static struct ccu_reset_map sun8i_h3_ccu_resets[] = {
         [RST_BUS_I2S1]          =  { 0x2d0, BIT(13) },
         [RST_BUS_I2S2]          =  { 0x2d0, BIT(14) },
 
-        [RST_BUS_I2C0]          =  { 0x2d4, BIT(0) },
-        [RST_BUS_I2C1]          =  { 0x2d4, BIT(1) },
-        [RST_BUS_I2C2]          =  { 0x2d4, BIT(2) },
-        [RST_BUS_UART0]         =  { 0x2d4, BIT(16) },
-        [RST_BUS_UART1]         =  { 0x2d4, BIT(17) },
-        [RST_BUS_UART2]         =  { 0x2d4, BIT(18) },
-        [RST_BUS_UART3]         =  { 0x2d4, BIT(19) },
-        [RST_BUS_SCR]           =  { 0x2d4, BIT(20) },
+        [RST_BUS_I2C0]          =  { 0x2d8, BIT(0) },
+        [RST_BUS_I2C1]          =  { 0x2d8, BIT(1) },
+        [RST_BUS_I2C2]          =  { 0x2d8, BIT(2) },
+        [RST_BUS_UART0]         =  { 0x2d8, BIT(16) },
+        [RST_BUS_UART1]         =  { 0x2d8, BIT(17) },
+        [RST_BUS_UART2]         =  { 0x2d8, BIT(18) },
+        [RST_BUS_UART3]         =  { 0x2d8, BIT(19) },
+        [RST_BUS_SCR]           =  { 0x2d8, BIT(20) },
 };
 
 static const struct sunxi_ccu_desc sun8i_h3_ccu_desc = {
diff --git a/drivers/clk/sunxi-ng/ccu_nk.c b/drivers/clk/sunxi-ng/ccu_nk.c
index 4470ffc8cf0d..d6fafb397489 100644
--- a/drivers/clk/sunxi-ng/ccu_nk.c
+++ b/drivers/clk/sunxi-ng/ccu_nk.c
@@ -14,9 +14,9 @@
 #include "ccu_gate.h"
 #include "ccu_nk.h"
 
-void ccu_nk_find_best(unsigned long parent, unsigned long rate,
-                      unsigned int max_n, unsigned int max_k,
-                      unsigned int *n, unsigned int *k)
+static void ccu_nk_find_best(unsigned long parent, unsigned long rate,
+                             unsigned int max_n, unsigned int max_k,
+                             unsigned int *n, unsigned int *k)
 {
         unsigned long best_rate = 0;
         unsigned int best_k = 0, best_n = 0;
diff --git a/drivers/clk/sunxi/clk-a10-pll2.c b/drivers/clk/sunxi/clk-a10-pll2.c
index 0ee1f363e4be..d8eab90ae661 100644
--- a/drivers/clk/sunxi/clk-a10-pll2.c
+++ b/drivers/clk/sunxi/clk-a10-pll2.c
@@ -73,7 +73,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
                                           SUN4I_PLL2_PRE_DIV_WIDTH,
                                           CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
                                           &sun4i_a10_pll2_lock);
-        if (!prediv_clk) {
+        if (IS_ERR(prediv_clk)) {
                 pr_err("Couldn't register the prediv clock\n");
                 goto err_free_array;
         }
@@ -106,7 +106,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
                                           &mult->hw, &clk_multiplier_ops,
                                           &gate->hw, &clk_gate_ops,
                                           CLK_SET_RATE_PARENT);
-        if (!base_clk) {
+        if (IS_ERR(base_clk)) {
                 pr_err("Couldn't register the base multiplier clock\n");
                 goto err_free_multiplier;
         }
diff --git a/drivers/clk/sunxi/clk-sun8i-mbus.c b/drivers/clk/sunxi/clk-sun8i-mbus.c
index 411d3033a96e..b200ebf159ee 100644
--- a/drivers/clk/sunxi/clk-sun8i-mbus.c
+++ b/drivers/clk/sunxi/clk-sun8i-mbus.c
@@ -48,7 +48,7 @@ static void __init sun8i_a23_mbus_setup(struct device_node *node)
                 return;
 
         reg = of_io_request_and_map(node, 0, of_node_full_name(node));
-        if (!reg) {
+        if (IS_ERR(reg)) {
                 pr_err("Could not get registers for sun8i-mbus-clk\n");
                 goto err_free_parents;
         }
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 6dc597126b79..b3044219772c 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -556,7 +556,10 @@ skip_enc:
 
         /* Read and write assoclen bytes */
         append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
-        append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
+        if (alg->caam.geniv)
+                append_math_add_imm_u32(desc, VARSEQOUTLEN, REG3, IMM, ivsize);
+        else
+                append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
 
         /* Skip assoc data */
         append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
@@ -565,6 +568,14 @@ skip_enc:
         append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS2 | FIFOLD_TYPE_MSG |
                              KEY_VLF);
 
+        if (alg->caam.geniv) {
+                append_seq_load(desc, ivsize, LDST_CLASS_1_CCB |
+                                LDST_SRCDST_BYTE_CONTEXT |
+                                (ctx1_iv_off << LDST_OFFSET_SHIFT));
+                append_move(desc, MOVE_SRC_CLASS1CTX | MOVE_DEST_CLASS2INFIFO |
+                            (ctx1_iv_off << MOVE_OFFSET_SHIFT) | ivsize);
+        }
+
         /* Load Counter into CONTEXT1 reg */
         if (is_rfc3686)
                 append_load_imm_u32(desc, be32_to_cpu(1), LDST_IMM |
@@ -2150,7 +2161,7 @@ static void init_authenc_job(struct aead_request *req,
 
         init_aead_job(req, edesc, all_contig, encrypt);
 
-        if (ivsize && (is_rfc3686 || !(alg->caam.geniv && encrypt)))
+        if (ivsize && ((is_rfc3686 && encrypt) || !alg->caam.geniv))
                 append_load_as_imm(desc, req->iv, ivsize,
                                    LDST_CLASS_1_CCB |
                                    LDST_SRCDST_BYTE_CONTEXT |
@@ -2537,20 +2548,6 @@ static int aead_decrypt(struct aead_request *req)
         return ret;
 }
 
-static int aead_givdecrypt(struct aead_request *req)
-{
-        struct crypto_aead *aead = crypto_aead_reqtfm(req);
-        unsigned int ivsize = crypto_aead_ivsize(aead);
-
-        if (req->cryptlen < ivsize)
-                return -EINVAL;
-
-        req->cryptlen -= ivsize;
-        req->assoclen += ivsize;
-
-        return aead_decrypt(req);
-}
-
 /*
  * allocate and map the ablkcipher extended descriptor for ablkcipher
  */
@@ -3210,7 +3207,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3256,7 +3253,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3302,7 +3299,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3348,7 +3345,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3394,7 +3391,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -3440,7 +3437,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -3486,7 +3483,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3534,7 +3531,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3582,7 +3579,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3630,7 +3627,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3678,7 +3675,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -3726,7 +3723,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -3772,7 +3769,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3818,7 +3815,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3864,7 +3861,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3910,7 +3907,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3956,7 +3953,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -4002,7 +3999,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -4051,7 +4048,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -4102,7 +4099,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -4153,7 +4150,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -4204,7 +4201,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -4255,7 +4252,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -4306,7 +4303,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
index 803f3953b341..29f600f2c447 100644
--- a/drivers/dax/dax.c
+++ b/drivers/dax/dax.c
@@ -459,7 +459,7 @@ static int __dax_dev_pmd_fault(struct dax_dev *dax_dev,
         }
 
         pgoff = linear_page_index(vma, pmd_addr);
-        phys = pgoff_to_phys(dax_dev, pgoff, PAGE_SIZE);
+        phys = pgoff_to_phys(dax_dev, pgoff, PMD_SIZE);
         if (phys == -1) {
                 dev_dbg(dev, "%s: phys_to_pgoff(%#lx) failed\n", __func__,
                                 pgoff);
diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
index 438893762076..ce2bc2a38101 100644
--- a/drivers/firmware/arm_scpi.c
+++ b/drivers/firmware/arm_scpi.c
@@ -709,9 +709,10 @@ static int scpi_probe(struct platform_device *pdev)
                 struct mbox_client *cl = &pchan->cl;
                 struct device_node *shmem = of_parse_phandle(np, "shmem", idx);
 
-                if (of_address_to_resource(shmem, 0, &res)) {
+                ret = of_address_to_resource(shmem, 0, &res);
+                of_node_put(shmem);
+                if (ret) {
                         dev_err(dev, "failed to get SCPI payload mem resource\n");
-                        ret = -EINVAL;
                         goto err;
                 }
 
diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
index 94a58a082b99..44c01390d035 100644
--- a/drivers/firmware/dmi-id.c
+++ b/drivers/firmware/dmi-id.c
@@ -229,14 +229,14 @@ static int __init dmi_id_init(void)
 
         ret = device_register(dmi_dev);
         if (ret)
-                goto fail_free_dmi_dev;
+                goto fail_put_dmi_dev;
 
         return 0;
 
-fail_free_dmi_dev:
-        kfree(dmi_dev);
-fail_class_unregister:
+fail_put_dmi_dev:
+        put_device(dmi_dev);
 
+fail_class_unregister:
         class_unregister(&dmi_class);
 
         return ret;
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 66a94103798b..24caedb00a7a 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -1131,6 +1131,7 @@ menu "SPI or I2C GPIO expanders"
 
 config GPIO_MCP23S08
         tristate "Microchip MCP23xxx I/O expander"
+        depends on OF_GPIO
         select GPIOLIB_IRQCHIP
         help
           SPI/I2C driver for Microchip MCP23S08/MCP23S17/MCP23008/MCP23017
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index ac22efc1840e..99d37b56c258 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -564,7 +564,7 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
         mcp->chip.direction_output = mcp23s08_direction_output;
         mcp->chip.set = mcp23s08_set;
         mcp->chip.dbg_show = mcp23s08_dbg_show;
-#ifdef CONFIG_OF
+#ifdef CONFIG_OF_GPIO
         mcp->chip.of_gpio_n_cells = 2;
         mcp->chip.of_node = dev->of_node;
 #endif
diff --git a/drivers/gpio/gpio-sa1100.c b/drivers/gpio/gpio-sa1100.c
index 0c99e8fb9af3..8d8ee0ebf14c 100644
--- a/drivers/gpio/gpio-sa1100.c
+++ b/drivers/gpio/gpio-sa1100.c
@@ -155,7 +155,7 @@ static int sa1100_gpio_irqdomain_map(struct irq_domain *d,
 {
         irq_set_chip_and_handler(irq, &sa1100_gpio_irq_chip,
                                  handle_edge_irq);
-        irq_set_noprobe(irq);
+        irq_set_probe(irq);
 
         return 0;
 }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 75e7b3919ea7..a28feb3edf33 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -16,7 +16,6 @@
 #include <linux/errno.h>
 #include <linux/module.h>
 #include <linux/io.h>
-#include <linux/io-mapping.h>
 #include <linux/gpio/consumer.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
index a978381ef95b..9b17a66cf0e1 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
@@ -387,7 +387,7 @@ void atmel_hlcdc_crtc_irq(struct drm_crtc *c)
         atmel_hlcdc_crtc_finish_page_flip(drm_crtc_to_atmel_hlcdc_crtc(c));
 }
 
-void atmel_hlcdc_crtc_reset(struct drm_crtc *crtc)
+static void atmel_hlcdc_crtc_reset(struct drm_crtc *crtc)
 {
         struct atmel_hlcdc_crtc_state *state;
 
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
index 016c191221f3..52c527f6642a 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -320,19 +320,19 @@ atmel_hlcdc_plane_update_pos_and_size(struct atmel_hlcdc_plane *plane,
                         u32 *coeff_tab = heo_upscaling_ycoef;
                         u32 max_memsize;
 
-                        if (state->crtc_w < state->src_w)
+                        if (state->crtc_h < state->src_h)
                                 coeff_tab = heo_downscaling_ycoef;
                         for (i = 0; i < ARRAY_SIZE(heo_upscaling_ycoef); i++)
                                 atmel_hlcdc_layer_update_cfg(&plane->layer,
                                                              33 + i,
                                                              0xffffffff,
                                                              coeff_tab[i]);
-                        factor = ((8 * 256 * state->src_w) - (256 * 4)) /
-                                 state->crtc_w;
+                        factor = ((8 * 256 * state->src_h) - (256 * 4)) /
+                                 state->crtc_h;
                         factor++;
-                        max_memsize = ((factor * state->crtc_w) + (256 * 4)) /
+                        max_memsize = ((factor * state->crtc_h) + (256 * 4)) /
                                       2048;
-                        if (max_memsize > state->src_w)
+                        if (max_memsize > state->src_h)
                                 factor--;
                         factor_reg |= (factor << 16) | 0x80000000;
                 }
diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 57676f8d7ecf..a6289752be16 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -1015,6 +1015,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
         return 0;
 }
 
+#if defined(CONFIG_X86) || defined(CONFIG_IA64)
 typedef struct drm_mode_fb_cmd232 {
         u32 fb_id;
         u32 width;
@@ -1071,6 +1072,7 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
 
         return 0;
 }
+#endif
 
 static drm_ioctl_compat_t *drm_compat_ioctls[] = {
         [DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
@@ -1104,7 +1106,9 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
         [DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw,
 #endif
         [DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank,
+#if defined(CONFIG_X86) || defined(CONFIG_IA64)
         [DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)] = compat_drm_mode_addfb2,
+#endif
 };
 
 /**
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index e0166403b4bd..40ce841eb952 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -55,11 +55,11 @@ static int check_fb_gem_memory_type(struct drm_device *drm_dev,
         flags = exynos_gem->flags;
 
         /*
-         * without iommu support, not support physically non-continuous memory
-         * for framebuffer.
+         * Physically non-contiguous memory type for framebuffer is not
+         * supported without IOMMU.
          */
         if (IS_NONCONTIG_BUFFER(flags)) {
-                DRM_ERROR("cannot use this gem memory type for fb.\n");
+                DRM_ERROR("Non-contiguous GEM memory is not supported.\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index 0525c56145db..147ef0d298cb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -1753,32 +1753,6 @@ static int fimc_clk_ctrl(struct fimc_context *ctx, bool enable)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int fimc_suspend(struct device *dev)
-{
-        struct fimc_context *ctx = get_fimc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        return fimc_clk_ctrl(ctx, false);
-}
-
-static int fimc_resume(struct device *dev)
-{
-        struct fimc_context *ctx = get_fimc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (!pm_runtime_suspended(dev))
-                return fimc_clk_ctrl(ctx, true);
-
-        return 0;
-}
-#endif
-
 static int fimc_runtime_suspend(struct device *dev)
 {
         struct fimc_context *ctx = get_fimc_context(dev);
@@ -1799,7 +1773,8 @@ static int fimc_runtime_resume(struct device *dev)
 #endif
 
 static const struct dev_pm_ops fimc_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(fimc_suspend, fimc_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(fimc_runtime_suspend, fimc_runtime_resume, NULL)
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 4bf00f57ffe8..6eca8bb88648 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -1475,8 +1475,8 @@ static int g2d_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int g2d_suspend(struct device *dev)
+#ifdef CONFIG_PM
+static int g2d_runtime_suspend(struct device *dev)
 {
         struct g2d_data *g2d = dev_get_drvdata(dev);
 
@@ -1490,25 +1490,6 @@ static int g2d_suspend(struct device *dev)
 
         flush_work(&g2d->runqueue_work);
 
-        return 0;
-}
-
-static int g2d_resume(struct device *dev)
-{
-        struct g2d_data *g2d = dev_get_drvdata(dev);
-
-        g2d->suspended = false;
-        g2d_exec_runqueue(g2d);
-
-        return 0;
-}
-#endif
-
-#ifdef CONFIG_PM
-static int g2d_runtime_suspend(struct device *dev)
-{
-        struct g2d_data *g2d = dev_get_drvdata(dev);
-
         clk_disable_unprepare(g2d->gate_clk);
 
         return 0;
@@ -1523,12 +1504,16 @@ static int g2d_runtime_resume(struct device *dev)
         if (ret < 0)
                 dev_warn(dev, "failed to enable clock.\n");
 
+        g2d->suspended = false;
+        g2d_exec_runqueue(g2d);
+
         return ret;
 }
 #endif
 
 static const struct dev_pm_ops g2d_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(g2d_suspend, g2d_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(g2d_runtime_suspend, g2d_runtime_resume, NULL)
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index 5d20da8f957e..52a9d269484e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -1760,34 +1760,7 @@ static int gsc_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int gsc_suspend(struct device *dev)
-{
-        struct gsc_context *ctx = get_gsc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        return gsc_clk_ctrl(ctx, false);
-}
-
-static int gsc_resume(struct device *dev)
-{
-        struct gsc_context *ctx = get_gsc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (!pm_runtime_suspended(dev))
-                return gsc_clk_ctrl(ctx, true);
-
-        return 0;
-}
-#endif
-
-#ifdef CONFIG_PM
-static int gsc_runtime_suspend(struct device *dev)
+static int __maybe_unused gsc_runtime_suspend(struct device *dev)
 {
         struct gsc_context *ctx = get_gsc_context(dev);
 
@@ -1796,7 +1769,7 @@ static int gsc_runtime_suspend(struct device *dev)
         return  gsc_clk_ctrl(ctx, false);
 }
 
-static int gsc_runtime_resume(struct device *dev)
+static int __maybe_unused gsc_runtime_resume(struct device *dev)
 {
         struct gsc_context *ctx = get_gsc_context(dev);
 
@@ -1804,10 +1777,10 @@ static int gsc_runtime_resume(struct device *dev)
 
         return  gsc_clk_ctrl(ctx, true);
 }
-#endif
 
 static const struct dev_pm_ops gsc_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(gsc_suspend, gsc_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(gsc_runtime_suspend, gsc_runtime_resume, NULL)
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index 404367a430b5..6591e406084c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -794,29 +794,6 @@ static int rotator_clk_crtl(struct rot_context *rot, bool enable)
         return 0;
 }
 
-
-#ifdef CONFIG_PM_SLEEP
-static int rotator_suspend(struct device *dev)
-{
-        struct rot_context *rot = dev_get_drvdata(dev);
-
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        return rotator_clk_crtl(rot, false);
-}
-
-static int rotator_resume(struct device *dev)
-{
-        struct rot_context *rot = dev_get_drvdata(dev);
-
-        if (!pm_runtime_suspended(dev))
-                return rotator_clk_crtl(rot, true);
-
-        return 0;
-}
-#endif
-
 static int rotator_runtime_suspend(struct device *dev)
 {
         struct rot_context *rot = dev_get_drvdata(dev);
@@ -833,7 +810,8 @@ static int rotator_runtime_resume(struct device *dev)
 #endif
 
 static const struct dev_pm_ops rotator_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(rotator_suspend, rotator_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(rotator_runtime_suspend, rotator_runtime_resume,
                                                                         NULL)
 };
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 95ddd56b89f0..5de36d8dcc68 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1281,6 +1281,11 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         intel_runtime_pm_enable(dev_priv);
 
+        /* Everything is in place, we can now relax! */
+        DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n",
+                 driver.name, driver.major, driver.minor, driver.patchlevel,
+                 driver.date, pci_name(pdev), dev_priv->drm.primary->index);
+
         intel_runtime_pm_put(dev_priv);
 
         return 0;
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 7a30af79d799..f38ceffd82c3 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -122,8 +122,11 @@ int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
         has_full_48bit_ppgtt =
                 IS_BROADWELL(dev_priv) || INTEL_GEN(dev_priv) >= 9;
 
-        if (intel_vgpu_active(dev_priv))
-                has_full_ppgtt = false; /* emulation is too hard */
+        if (intel_vgpu_active(dev_priv)) {
+                /* emulation is too hard */
+                has_full_ppgtt = false;
+                has_full_48bit_ppgtt = false;
+        }
 
         if (!has_aliasing_ppgtt)
                 return 0;
@@ -158,7 +161,7 @@ int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
                 return 0;
         }
 
-        if (INTEL_GEN(dev_priv) >= 8 && i915.enable_execlists)
+        if (INTEL_GEN(dev_priv) >= 8 && i915.enable_execlists && has_full_ppgtt)
                 return has_full_48bit_ppgtt ? 3 : 2;
         else
                 return has_aliasing_ppgtt ? 1 : 0;
diff --git a/drivers/gpu/drm/i915/i915_vgpu.c b/drivers/gpu/drm/i915/i915_vgpu.c
index f6acb5a0e701..b81cfb3b22ec 100644
--- a/drivers/gpu/drm/i915/i915_vgpu.c
+++ b/drivers/gpu/drm/i915/i915_vgpu.c
@@ -65,9 +65,6 @@ void i915_check_vgpu(struct drm_i915_private *dev_priv)
 
         BUILD_BUG_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE);
 
-        if (!IS_HASWELL(dev_priv))
-                return;
-
         magic = __raw_i915_read64(dev_priv, vgtif_reg(magic));
         if (magic != VGT_MAGIC)
                 return;
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index 47bdf9dad0d3..b9e5a63a7c9e 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -554,7 +554,6 @@ void intel_dvo_init(struct drm_device *dev)
                 return;
         }
 
-        drm_encoder_cleanup(&intel_encoder->base);
         kfree(intel_dvo);
         kfree(intel_connector);
 }
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index adca262d591a..7acbbbf97833 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -1047,6 +1047,23 @@ err_out:
         return err;
 }
 
+static int intel_use_opregion_panel_type_callback(const struct dmi_system_id *id)
+{
+        DRM_INFO("Using panel type from OpRegion on %s\n", id->ident);
+        return 1;
+}
+
+static const struct dmi_system_id intel_use_opregion_panel_type[] = {
+        {
+                .callback = intel_use_opregion_panel_type_callback,
+                .ident = "Conrac GmbH IX45GM2",
+                .matches = {DMI_MATCH(DMI_SYS_VENDOR, "Conrac GmbH"),
+                            DMI_MATCH(DMI_PRODUCT_NAME, "IX45GM2"),
+                },
+        },
+        { }
+};
+
 int
 intel_opregion_get_panel_type(struct drm_i915_private *dev_priv)
 {
@@ -1073,6 +1090,16 @@ intel_opregion_get_panel_type(struct drm_i915_private *dev_priv)
         }
 
         /*
+         * So far we know that some machined must use it, others must not use it.
+         * There doesn't seem to be any way to determine which way to go, except
+         * via a quirk list :(
+         */
+        if (!dmi_check_system(intel_use_opregion_panel_type)) {
+                DRM_DEBUG_KMS("Ignoring OpRegion panel type (%d)\n", ret - 1);
+                return -ENODEV;
+        }
+
+        /*
          * FIXME On Dell XPS 13 9350 the OpRegion panel type (0) gives us
          * low vswing for eDP, whereas the VBT panel type (2) gives us normal
          * vswing instead. Low vswing results in some display flickers, so
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 53e13c10e4ea..2d2481392824 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -7859,6 +7859,7 @@ static inline int gen6_check_mailbox_status(struct drm_i915_private *dev_priv)
         case GEN6_PCODE_ILLEGAL_CMD:
                 return -ENXIO;
         case GEN6_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE:
+        case GEN7_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE:
                 return -EOVERFLOW;
         case GEN6_PCODE_TIMEOUT:
                 return -ETIMEDOUT;
diff --git a/drivers/gpu/drm/i915/intel_psr.c b/drivers/gpu/drm/i915/intel_psr.c
index 2b0d1baf15b3..cf171b4b8c67 100644
--- a/drivers/gpu/drm/i915/intel_psr.c
+++ b/drivers/gpu/drm/i915/intel_psr.c
@@ -255,14 +255,14 @@ static void hsw_psr_enable_source(struct intel_dp *intel_dp)
         struct drm_i915_private *dev_priv = to_i915(dev);
 
         uint32_t max_sleep_time = 0x1f;
-        /* Lately it was identified that depending on panel idle frame count
-         * calculated at HW can be off by 1. So let's use what came
-         * from VBT + 1.
-         * There are also other cases where panel demands at least 4
-         * but VBT is not being set. To cover these 2 cases lets use
-         * at least 5 when VBT isn't set to be on the safest side.
+        /*
+         * Let's respect VBT in case VBT asks a higher idle_frame value.
+         * Let's use 6 as the minimum to cover all known cases including
+         * the off-by-one issue that HW has in some cases. Also there are
+         * cases where sink should be able to train
+         * with the 5 or 6 idle patterns.
          */
-        uint32_t idle_frames = dev_priv->vbt.psr.idle_frames + 1;
+        uint32_t idle_frames = max(6, dev_priv->vbt.psr.idle_frames);
         uint32_t val = EDP_PSR_ENABLE;
 
         val |= max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT;
diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
index 59adcf8532dd..3f6704cf6608 100644
--- a/drivers/gpu/drm/vc4/vc4_bo.c
+++ b/drivers/gpu/drm/vc4/vc4_bo.c
@@ -144,7 +144,7 @@ static struct list_head *vc4_get_cache_list_for_size(struct drm_device *dev,
         return &vc4->bo_cache.size_list[page_index];
 }
 
-void vc4_bo_cache_purge(struct drm_device *dev)
+static void vc4_bo_cache_purge(struct drm_device *dev)
 {
         struct vc4_dev *vc4 = to_vc4_dev(dev);
 
diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
index 46527e989ce3..2543cf5b8b51 100644
--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -309,8 +309,14 @@ validate_uniform_address_write(struct vc4_validated_shader_info *validated_shade
          * of uniforms on each side.  However, this scheme is easy to
          * validate so it's all we allow for now.
          */
-
-        if (QPU_GET_FIELD(inst, QPU_SIG) != QPU_SIG_NONE) {
+        switch (QPU_GET_FIELD(inst, QPU_SIG)) {
+        case QPU_SIG_NONE:
+        case QPU_SIG_SCOREBOARD_UNLOCK:
+        case QPU_SIG_COLOR_LOAD:
+        case QPU_SIG_LOAD_TMU0:
+        case QPU_SIG_LOAD_TMU1:
+                break;
+        default:
                 DRM_ERROR("uniforms address change must be "
                           "normal math\n");
                 return false;
diff --git a/drivers/i2c/busses/i2c-bcm-kona.c b/drivers/i2c/busses/i2c-bcm-kona.c
index f98743277e3c..258cb9a40ab3 100644
--- a/drivers/i2c/busses/i2c-bcm-kona.c
+++ b/drivers/i2c/busses/i2c-bcm-kona.c
@@ -643,7 +643,7 @@ static int bcm_kona_i2c_xfer(struct i2c_adapter *adapter,
                         if (rc < 0) {
                                 dev_err(dev->device,
                                         "restart cmd failed rc = %d\n", rc);
-                                        goto xfer_send_stop;
+                                goto xfer_send_stop;
                         }
                 }
 
diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 90bbd9f9dd8f..3c16a2f7c673 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -767,7 +767,7 @@ static int cdns_i2c_setclk(unsigned long clk_in, struct cdns_i2c *id)
  * depending on the scaling direction.
  *
  * Return:      NOTIFY_STOP if the rate change should be aborted, NOTIFY_OK
- *              to acknowedge the change, NOTIFY_DONE if the notification is
+ *              to acknowledge the change, NOTIFY_DONE if the notification is
  *              considered irrelevant.
  */
 static int cdns_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index c6922b806fb7..fcd973d5131e 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -367,13 +367,17 @@ int i2c_dw_init(struct dw_i2c_dev *dev)
         dev_dbg(dev->dev, "Fast-mode HCNT:LCNT = %d:%d\n", hcnt, lcnt);
 
         /* Configure SDA Hold Time if required */
-        if (dev->sda_hold_time) {
-                reg = dw_readl(dev, DW_IC_COMP_VERSION);
-                if (reg >= DW_IC_SDA_HOLD_MIN_VERS)
+        reg = dw_readl(dev, DW_IC_COMP_VERSION);
+        if (reg >= DW_IC_SDA_HOLD_MIN_VERS) {
+                if (dev->sda_hold_time) {
                         dw_writel(dev, dev->sda_hold_time, DW_IC_SDA_HOLD);
-                else
-                        dev_warn(dev->dev,
-                                "Hardware too old to adjust SDA hold time.");
+                } else {
+                        /* Keep previous hold time setting if no one set it */
+                        dev->sda_hold_time = dw_readl(dev, DW_IC_SDA_HOLD);
+                }
+        } else {
+                dev_warn(dev->dev,
+                        "Hardware too old to adjust SDA hold time.\n");
         }
 
         /* Configure Tx/Rx FIFO threshold levels */
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 52407f3c9e1c..9bd849dacee8 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -378,7 +378,7 @@ static void rcar_i2c_dma(struct rcar_i2c_priv *priv)
         }
 
         dma_addr = dma_map_single(chan->device->dev, buf, len, dir);
-        if (dma_mapping_error(dev, dma_addr)) {
+        if (dma_mapping_error(chan->device->dev, dma_addr)) {
                 dev_dbg(dev, "dma map failed, using PIO\n");
                 return;
         }
diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
index 2bc8b01153d6..5c5b7cada8be 100644
--- a/drivers/i2c/busses/i2c-rk3x.c
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -918,7 +918,7 @@ static void rk3x_i2c_adapt_div(struct rk3x_i2c *i2c, unsigned long clk_rate)
  * Code adapted from i2c-cadence.c.
  *
  * Return:      NOTIFY_STOP if the rate change should be aborted, NOTIFY_OK
- *              to acknowedge the change, NOTIFY_DONE if the notification is
+ *              to acknowledge the change, NOTIFY_DONE if the notification is
  *              considered irrelevant.
  */
 static int rk3x_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long
@@ -1111,6 +1111,15 @@ static int rk3x_i2c_xfer(struct i2c_adapter *adap,
         return ret < 0 ? ret : num;
 }
 
+static __maybe_unused int rk3x_i2c_resume(struct device *dev)
+{
+        struct rk3x_i2c *i2c = dev_get_drvdata(dev);
+
+        rk3x_i2c_adapt_div(i2c, clk_get_rate(i2c->clk));
+
+        return 0;
+}
+
 static u32 rk3x_i2c_func(struct i2c_adapter *adap)
 {
         return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_PROTOCOL_MANGLING;
@@ -1334,12 +1343,15 @@ static int rk3x_i2c_remove(struct platform_device *pdev)
         return 0;
 }
 
+static SIMPLE_DEV_PM_OPS(rk3x_i2c_pm_ops, NULL, rk3x_i2c_resume);
+
 static struct platform_driver rk3x_i2c_driver = {
         .probe   = rk3x_i2c_probe,
         .remove  = rk3x_i2c_remove,
         .driver  = {
                 .name  = "rk3x-i2c",
                 .of_match_table = rk3x_i2c_match,
+                .pm = &rk3x_i2c_pm_ops,
         },
 };
 
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 6fb3e2645992..05b1eeab9cf5 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -610,7 +610,7 @@ static void sh_mobile_i2c_xfer_dma(struct sh_mobile_i2c_data *pd)
                 return;
 
         dma_addr = dma_map_single(chan->device->dev, pd->msg->buf, pd->msg->len, dir);
-        if (dma_mapping_error(pd->dev, dma_addr)) {
+        if (dma_mapping_error(chan->device->dev, dma_addr)) {
                 dev_dbg(pd->dev, "dma map failed, using PIO\n");
                 return;
         }
diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
index 215ac87f606d..b3893f6282ba 100644
--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
@@ -37,8 +37,6 @@ struct i2c_demux_pinctrl_priv {
         struct i2c_demux_pinctrl_chan chan[];
 };
 
-static struct property status_okay = { .name = "status", .length = 3, .value = "ok" };
-
 static int i2c_demux_master_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
 {
         struct i2c_demux_pinctrl_priv *priv = adap->algo_data;
@@ -107,6 +105,7 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
         of_changeset_revert(&priv->chan[new_chan].chgset);
  err:
         dev_err(priv->dev, "failed to setup demux-adapter %d (%d)\n", new_chan, ret);
+        priv->cur_chan = -EINVAL;
         return ret;
 }
 
@@ -192,6 +191,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
 {
         struct device_node *np = pdev->dev.of_node;
         struct i2c_demux_pinctrl_priv *priv;
+        struct property *props;
         int num_chan, i, j, err;
 
         num_chan = of_count_phandle_with_args(np, "i2c-parent", NULL);
@@ -202,7 +202,10 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
 
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv)
                            + num_chan * sizeof(struct i2c_demux_pinctrl_chan), GFP_KERNEL);
-        if (!priv)
+
+        props = devm_kcalloc(&pdev->dev, num_chan, sizeof(*props), GFP_KERNEL);
+
+        if (!priv || !props)
                 return -ENOMEM;
 
         err = of_property_read_string(np, "i2c-bus-name", &priv->bus_name);
@@ -220,8 +223,12 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
                 }
                 priv->chan[i].parent_np = adap_np;
 
+                props[i].name = devm_kstrdup(&pdev->dev, "status", GFP_KERNEL);
+                props[i].value = devm_kstrdup(&pdev->dev, "ok", GFP_KERNEL);
+                props[i].length = 3;
+
                 of_changeset_init(&priv->chan[i].chgset);
-                of_changeset_update_property(&priv->chan[i].chgset, adap_np, &status_okay);
+                of_changeset_update_property(&priv->chan[i].chgset, adap_np, &props[i]);
         }
 
         priv->num_chan = num_chan;
diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index bf17aae66145..59b380dbf27f 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -67,6 +67,9 @@
 #define BMC150_ACCEL_REG_PMU_BW         0x10
 #define BMC150_ACCEL_DEF_BW                     125
 
+#define BMC150_ACCEL_REG_RESET                  0x14
+#define BMC150_ACCEL_RESET_VAL                  0xB6
+
 #define BMC150_ACCEL_REG_INT_MAP_0              0x19
 #define BMC150_ACCEL_INT_MAP_0_BIT_SLOPE        BIT(2)
 
@@ -1497,6 +1500,14 @@ static int bmc150_accel_chip_init(struct bmc150_accel_data *data)
         int ret, i;
         unsigned int val;
 
+        /*
+         * Reset chip to get it in a known good state. A delay of 1.8ms after
+         * reset is required according to the data sheets of supported chips.
+         */
+        regmap_write(data->regmap, BMC150_ACCEL_REG_RESET,
+                     BMC150_ACCEL_RESET_VAL);
+        usleep_range(1800, 2500);
+
         ret = regmap_read(data->regmap, BMC150_ACCEL_REG_CHIP_ID, &val);
         if (ret < 0) {
                 dev_err(dev, "Error: Reading chip id\n");
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index da5fb67ecb34..9d72d4bcf5e9 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -166,6 +166,7 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
                 ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
                 if (ret < 0)
                         goto error_ret;
+                *val = 0;
                 *val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK];
                 ret = IIO_VAL_INT_PLUS_MICRO;
                 break;
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
index e81f434760f4..dc33c1dd5191 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
@@ -56,8 +56,8 @@ static struct {
         {HID_USAGE_SENSOR_ALS, 0, 1, 0},
         {HID_USAGE_SENSOR_ALS, HID_USAGE_SENSOR_UNITS_LUX, 1, 0},
 
-        {HID_USAGE_SENSOR_PRESSURE, 0, 100000, 0},
-        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 1, 0},
+        {HID_USAGE_SENSOR_PRESSURE, 0, 100, 0},
+        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000},
 };
 
 static int pow_10(unsigned power)
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 49bf9c59f117..158aaf44dd95 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -110,7 +110,7 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
         size_t datum_size;
         size_t to_wait;
-        int ret;
+        int ret = 0;
 
         if (!indio_dev->info)
                 return -ENODEV;
@@ -153,7 +153,7 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
                 ret = rb->access->read_first_n(rb, n, buf);
                 if (ret == 0 && (filp->f_flags & O_NONBLOCK))
                         ret = -EAGAIN;
-         } while (ret == 0);
+        } while (ret == 0);
         remove_wait_queue(&rb->pollq, &wait);
 
         return ret;
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index f914d5d140e4..d2b889918c3e 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -613,9 +613,8 @@ ssize_t iio_format_value(char *buf, unsigned int type, int size, int *vals)
                         return sprintf(buf, "%d.%09u\n", vals[0], vals[1]);
         case IIO_VAL_FRACTIONAL:
                 tmp = div_s64((s64)vals[0] * 1000000000LL, vals[1]);
-                vals[1] = do_div(tmp, 1000000000LL);
-                vals[0] = tmp;
-                return sprintf(buf, "%d.%09u\n", vals[0], vals[1]);
+                vals[0] = (int)div_s64_rem(tmp, 1000000000, &vals[1]);
+                return sprintf(buf, "%d.%09u\n", vals[0], abs(vals[1]));
         case IIO_VAL_FRACTIONAL_LOG2:
                 tmp = (s64)vals[0] * 1000000000LL >> vals[1];
                 vals[1] = do_div(tmp, 1000000000LL);
diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
index 3a3c5d73bbfc..51c79b2fb0b8 100644
--- a/drivers/infiniband/core/multicast.c
+++ b/drivers/infiniband/core/multicast.c
@@ -106,7 +106,6 @@ struct mcast_group {
         atomic_t                refcount;
         enum mcast_group_state  state;
         struct ib_sa_query      *query;
-        int                     query_id;
         u16                     pkey_index;
         u8                      leave_state;
         int                     retries;
@@ -340,11 +339,7 @@ static int send_join(struct mcast_group *group, struct mcast_member *member)
                                        member->multicast.comp_mask,
                                        3000, GFP_KERNEL, join_handler, group,
                                        &group->query);
-        if (ret >= 0) {
-                group->query_id = ret;
-                ret = 0;
-        }
-        return ret;
+        return (ret > 0) ? 0 : ret;
 }
 
 static int send_leave(struct mcast_group *group, u8 leave_state)
@@ -364,11 +359,7 @@ static int send_leave(struct mcast_group *group, u8 leave_state)
                                        IB_SA_MCMEMBER_REC_JOIN_STATE,
                                        3000, GFP_KERNEL, leave_handler,
                                        group, &group->query);
-        if (ret >= 0) {
-                group->query_id = ret;
-                ret = 0;
-        }
-        return ret;
+        return (ret > 0) ? 0 : ret;
 }
 
 static void join_group(struct mcast_group *group, struct mcast_member *member,
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index b6a953aed7e8..80f988984f44 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -333,6 +333,8 @@ static void remove_ep_tid(struct c4iw_ep *ep)
 
         spin_lock_irqsave(&ep->com.dev->lock, flags);
         _remove_handle(ep->com.dev, &ep->com.dev->hwtid_idr, ep->hwtid, 0);
+        if (idr_is_empty(&ep->com.dev->hwtid_idr))
+                wake_up(&ep->com.dev->wait);
         spin_unlock_irqrestore(&ep->com.dev->lock, flags);
 }
 
@@ -2117,8 +2119,10 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
                 }
                 ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
                                         n, pdev, rt_tos2priority(tos));
-                if (!ep->l2t)
+                if (!ep->l2t) {
+                        dev_put(pdev);
                         goto out;
+                }
                 ep->mtu = pdev->mtu;
                 ep->tx_chan = cxgb4_port_chan(pdev);
                 ep->smac_idx = cxgb4_tp_smt_idx(adapter_type,
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 071d7332ec06..3c4b2126e0d1 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -872,9 +872,13 @@ static void c4iw_rdev_close(struct c4iw_rdev *rdev)
 static void c4iw_dealloc(struct uld_ctx *ctx)
 {
         c4iw_rdev_close(&ctx->dev->rdev);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->cqidr));
         idr_destroy(&ctx->dev->cqidr);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->qpidr));
         idr_destroy(&ctx->dev->qpidr);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->mmidr));
         idr_destroy(&ctx->dev->mmidr);
+        wait_event(ctx->dev->wait, idr_is_empty(&ctx->dev->hwtid_idr));
         idr_destroy(&ctx->dev->hwtid_idr);
         idr_destroy(&ctx->dev->stid_idr);
         idr_destroy(&ctx->dev->atid_idr);
@@ -992,6 +996,7 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
         mutex_init(&devp->rdev.stats.lock);
         mutex_init(&devp->db_mutex);
         INIT_LIST_HEAD(&devp->db_fc_list);
+        init_waitqueue_head(&devp->wait);
         devp->avail_ird = devp->rdev.lldi.max_ird_adapter;
 
         if (c4iw_debugfs_root) {
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index aa47e0ae80bc..4b83b84f7ddf 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -263,6 +263,7 @@ struct c4iw_dev {
         struct idr stid_idr;
         struct list_head db_fc_list;
         u32 avail_ird;
+        wait_queue_head_t wait;
 };
 
 static inline struct c4iw_dev *to_c4iw_dev(struct ib_device *ibdev)
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index edb1172b6f54..690435229be7 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -683,7 +683,7 @@ static int build_inv_stag(union t4_wr *wqe, struct ib_send_wr *wr,
         return 0;
 }
 
-void _free_qp(struct kref *kref)
+static void _free_qp(struct kref *kref)
 {
         struct c4iw_qp *qhp;
 
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index b32638d58ae8..cc38004cea42 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -9490,6 +9490,78 @@ static void init_lcb(struct hfi1_devdata *dd)
         write_csr(dd, DC_LCB_CFG_TX_FIFOS_RESET, 0x00);
 }
 
+/*
+ * Perform a test read on the QSFP.  Return 0 on success, -ERRNO
+ * on error.
+ */
+static int test_qsfp_read(struct hfi1_pportdata *ppd)
+{
+        int ret;
+        u8 status;
+
+        /* report success if not a QSFP */
+        if (ppd->port_type != PORT_TYPE_QSFP)
+                return 0;
+
+        /* read byte 2, the status byte */
+        ret = one_qsfp_read(ppd, ppd->dd->hfi1_id, 2, &status, 1);
+        if (ret < 0)
+                return ret;
+        if (ret != 1)
+                return -EIO;
+
+        return 0; /* success */
+}
+
+/*
+ * Values for QSFP retry.
+ *
+ * Give up after 10s (20 x 500ms).  The overall timeout was empirically
+ * arrived at from experience on a large cluster.
+ */
+#define MAX_QSFP_RETRIES 20
+#define QSFP_RETRY_WAIT 500 /* msec */
+
+/*
+ * Try a QSFP read.  If it fails, schedule a retry for later.
+ * Called on first link activation after driver load.
+ */
+static void try_start_link(struct hfi1_pportdata *ppd)
+{
+        if (test_qsfp_read(ppd)) {
+                /* read failed */
+                if (ppd->qsfp_retry_count >= MAX_QSFP_RETRIES) {
+                        dd_dev_err(ppd->dd, "QSFP not responding, giving up\n");
+                        return;
+                }
+                dd_dev_info(ppd->dd,
+                            "QSFP not responding, waiting and retrying %d\n",
+                            (int)ppd->qsfp_retry_count);
+                ppd->qsfp_retry_count++;
+                queue_delayed_work(ppd->hfi1_wq, &ppd->start_link_work,
+                                   msecs_to_jiffies(QSFP_RETRY_WAIT));
+                return;
+        }
+        ppd->qsfp_retry_count = 0;
+
+        /*
+         * Tune the SerDes to a ballpark setting for optimal signal and bit
+         * error rate.  Needs to be done before starting the link.
+         */
+        tune_serdes(ppd);
+        start_link(ppd);
+}
+
+/*
+ * Workqueue function to start the link after a delay.
+ */
+void handle_start_link(struct work_struct *work)
+{
+        struct hfi1_pportdata *ppd = container_of(work, struct hfi1_pportdata,
+                                                  start_link_work.work);
+        try_start_link(ppd);
+}
+
 int bringup_serdes(struct hfi1_pportdata *ppd)
 {
         struct hfi1_devdata *dd = ppd->dd;
@@ -9525,14 +9597,8 @@ int bringup_serdes(struct hfi1_pportdata *ppd)
                 set_qsfp_int_n(ppd, 1);
         }
 
-        /*
-         * Tune the SerDes to a ballpark setting for
-         * optimal signal and bit error rate
-         * Needs to be done before starting the link
-         */
-        tune_serdes(ppd);
-
-        return start_link(ppd);
+        try_start_link(ppd);
+        return 0;
 }
 
 void hfi1_quiet_serdes(struct hfi1_pportdata *ppd)
@@ -9549,6 +9615,10 @@ void hfi1_quiet_serdes(struct hfi1_pportdata *ppd)
         ppd->driver_link_ready = 0;
         ppd->link_enabled = 0;
 
+        ppd->qsfp_retry_count = MAX_QSFP_RETRIES; /* prevent more retries */
+        flush_delayed_work(&ppd->start_link_work);
+        cancel_delayed_work_sync(&ppd->start_link_work);
+
         ppd->offline_disabled_reason =
                         HFI1_ODR_MASK(OPA_LINKDOWN_REASON_SMA_DISABLED);
         set_link_down_reason(ppd, OPA_LINKDOWN_REASON_SMA_DISABLED, 0,
@@ -12865,7 +12935,7 @@ fail:
  */
 static int set_up_context_variables(struct hfi1_devdata *dd)
 {
-        int num_kernel_contexts;
+        unsigned long num_kernel_contexts;
         int total_contexts;
         int ret;
         unsigned ngroups;
@@ -12894,9 +12964,9 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
          */
         if (num_kernel_contexts > (dd->chip_send_contexts - num_vls - 1)) {
                 dd_dev_err(dd,
-                           "Reducing # kernel rcv contexts to: %d, from %d\n",
+                           "Reducing # kernel rcv contexts to: %d, from %lu\n",
                            (int)(dd->chip_send_contexts - num_vls - 1),
-                           (int)num_kernel_contexts);
+                           num_kernel_contexts);
                 num_kernel_contexts = dd->chip_send_contexts - num_vls - 1;
         }
         /*
diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
index ed11107c50fe..e29573769efc 100644
--- a/drivers/infiniband/hw/hfi1/chip.h
+++ b/drivers/infiniband/hw/hfi1/chip.h
@@ -706,6 +706,7 @@ void handle_link_up(struct work_struct *work);
 void handle_link_down(struct work_struct *work);
 void handle_link_downgrade(struct work_struct *work);
 void handle_link_bounce(struct work_struct *work);
+void handle_start_link(struct work_struct *work);
 void handle_sma_message(struct work_struct *work);
 void reset_qsfp(struct hfi1_pportdata *ppd);
 void qsfp_event(struct work_struct *work);
diff --git a/drivers/infiniband/hw/hfi1/debugfs.c b/drivers/infiniband/hw/hfi1/debugfs.c
index a49cc88f08a2..5e9be16f6cd3 100644
--- a/drivers/infiniband/hw/hfi1/debugfs.c
+++ b/drivers/infiniband/hw/hfi1/debugfs.c
@@ -59,6 +59,40 @@
 
 static struct dentry *hfi1_dbg_root;
 
+/* wrappers to enforce srcu in seq file */
+static ssize_t hfi1_seq_read(
+        struct file *file,
+        char __user *buf,
+        size_t size,
+        loff_t *ppos)
+{
+        struct dentry *d = file->f_path.dentry;
+        int srcu_idx;
+        ssize_t r;
+
+        r = debugfs_use_file_start(d, &srcu_idx);
+        if (likely(!r))
+                r = seq_read(file, buf, size, ppos);
+        debugfs_use_file_finish(srcu_idx);
+        return r;
+}
+
+static loff_t hfi1_seq_lseek(
+        struct file *file,
+        loff_t offset,
+        int whence)
+{
+        struct dentry *d = file->f_path.dentry;
+        int srcu_idx;
+        loff_t r;
+
+        r = debugfs_use_file_start(d, &srcu_idx);
+        if (likely(!r))
+                r = seq_lseek(file, offset, whence);
+        debugfs_use_file_finish(srcu_idx);
+        return r;
+}
+
 #define private2dd(file) (file_inode(file)->i_private)
 #define private2ppd(file) (file_inode(file)->i_private)
 
@@ -87,8 +121,8 @@ static int _##name##_open(struct inode *inode, struct file *s) \
 static const struct file_operations _##name##_file_ops = { \
         .owner   = THIS_MODULE, \
         .open    = _##name##_open, \
-        .read    = seq_read, \
-        .llseek  = seq_lseek, \
+        .read    = hfi1_seq_read, \
+        .llseek  = hfi1_seq_lseek, \
         .release = seq_release \
 }
 
@@ -105,11 +139,9 @@ do { \
         DEBUGFS_FILE_CREATE(#name, parent, data, &_##name##_file_ops, S_IRUGO)
 
 static void *_opcode_stats_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
         struct hfi1_opcode_stats_perctx *opstats;
 
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(opstats->stats))
                 return NULL;
         return pos;
@@ -126,9 +158,7 @@ static void *_opcode_stats_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _opcode_stats_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _opcode_stats_seq_show(struct seq_file *s, void *v)
@@ -285,12 +315,10 @@ DEBUGFS_SEQ_FILE_OPEN(qp_stats)
 DEBUGFS_FILE_OPS(qp_stats);
 
 static void *_sdes_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
         struct hfi1_ibdev *ibd;
         struct hfi1_devdata *dd;
 
-        rcu_read_lock();
         ibd = (struct hfi1_ibdev *)s->private;
         dd = dd_from_dev(ibd);
         if (!dd->per_sdma || *pos >= dd->num_sdma)
@@ -310,9 +338,7 @@ static void *_sdes_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _sdes_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _sdes_seq_show(struct seq_file *s, void *v)
@@ -339,11 +365,9 @@ static ssize_t dev_counters_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_cntrs(dd, NULL, &counters);
         rval =  simple_read_from_buffer(buf, count, ppos, counters, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -356,11 +380,9 @@ static ssize_t dev_names_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_cntrs(dd, &names, NULL);
         rval =  simple_read_from_buffer(buf, count, ppos, names, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -383,11 +405,9 @@ static ssize_t portnames_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_portcntrs(dd->pport, &names, NULL);
         rval = simple_read_from_buffer(buf, count, ppos, names, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -400,11 +420,9 @@ static ssize_t portcntrs_debugfs_read(struct file *file, char __user *buf,
         struct hfi1_pportdata *ppd;
         ssize_t rval;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         avail = hfi1_read_portcntrs(ppd, NULL, &counters);
         rval = simple_read_from_buffer(buf, count, ppos, counters, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -434,16 +452,13 @@ static ssize_t asic_flags_read(struct file *file, char __user *buf,
         int used;
         int i;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         dd = ppd->dd;
         size = PAGE_SIZE;
         used = 0;
         tmp = kmalloc(size, GFP_KERNEL);
-        if (!tmp) {
-                rcu_read_unlock();
+        if (!tmp)
                 return -ENOMEM;
-        }
 
         scratch0 = read_csr(dd, ASIC_CFG_SCRATCH);
         used += scnprintf(tmp + used, size - used,
@@ -470,7 +485,6 @@ static ssize_t asic_flags_read(struct file *file, char __user *buf,
         used += scnprintf(tmp + used, size - used, "Write bits to clear\n");
 
         ret = simple_read_from_buffer(buf, count, ppos, tmp, used);
-        rcu_read_unlock();
         kfree(tmp);
         return ret;
 }
@@ -486,15 +500,12 @@ static ssize_t asic_flags_write(struct file *file, const char __user *buf,
         u64 scratch0;
         u64 clear;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         dd = ppd->dd;
 
         buff = kmalloc(count + 1, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto do_return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
@@ -527,8 +538,6 @@ static ssize_t asic_flags_write(struct file *file, const char __user *buf,
 
  do_free:
         kfree(buff);
- do_return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -542,18 +551,14 @@ static ssize_t qsfp_debugfs_dump(struct file *file, char __user *buf,
         char *tmp;
         int ret;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         tmp = kmalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!tmp) {
-                rcu_read_unlock();
+        if (!tmp)
                 return -ENOMEM;
-        }
 
         ret = qsfp_dump(ppd, tmp, PAGE_SIZE);
         if (ret > 0)
                 ret = simple_read_from_buffer(buf, count, ppos, tmp, ret);
-        rcu_read_unlock();
         kfree(tmp);
         return ret;
 }
@@ -569,7 +574,6 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
         int offset;
         int total_written;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
 
         /* byte offset format: [offsetSize][i2cAddr][offsetHigh][offsetLow] */
@@ -577,16 +581,12 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
         offset = *ppos & 0xffff;
 
         /* explicitly reject invalid address 0 to catch cp and cat */
-        if (i2c_addr == 0) {
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (i2c_addr == 0)
+                return -EINVAL;
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
@@ -606,8 +606,6 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -636,7 +634,6 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
         int offset;
         int total_read;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
 
         /* byte offset format: [offsetSize][i2cAddr][offsetHigh][offsetLow] */
@@ -644,16 +641,12 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
         offset = *ppos & 0xffff;
 
         /* explicitly reject invalid address 0 to catch cp and cat */
-        if (i2c_addr == 0) {
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (i2c_addr == 0)
+                return -EINVAL;
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         total_read = i2c_read(ppd, target, i2c_addr, offset, buff, count);
         if (total_read < 0) {
@@ -673,8 +666,6 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -701,26 +692,20 @@ static ssize_t __qsfp_debugfs_write(struct file *file, const char __user *buf,
         int ret;
         int total_written;
 
-        rcu_read_lock();
-        if (*ppos + count > QSFP_PAGESIZE * 4) { /* base page + page00-page03 */
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (*ppos + count > QSFP_PAGESIZE * 4) /* base page + page00-page03 */
+                return -EINVAL;
 
         ppd = private2ppd(file);
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
                 ret = -EFAULT;
                 goto _free;
         }
-
         total_written = qsfp_write(ppd, target, *ppos, buff, count);
         if (total_written < 0) {
                 ret = total_written;
@@ -733,8 +718,6 @@ static ssize_t __qsfp_debugfs_write(struct file *file, const char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -761,7 +744,6 @@ static ssize_t __qsfp_debugfs_read(struct file *file, char __user *buf,
         int ret;
         int total_read;
 
-        rcu_read_lock();
         if (*ppos + count > QSFP_PAGESIZE * 4) { /* base page + page00-page03 */
                 ret = -EINVAL;
                 goto _return;
@@ -794,7 +776,6 @@ static ssize_t __qsfp_debugfs_read(struct file *file, char __user *buf,
  _free:
         kfree(buff);
  _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -1010,7 +991,6 @@ void hfi1_dbg_ibdev_exit(struct hfi1_ibdev *ibd)
         debugfs_remove_recursive(ibd->hfi1_ibdev_dbg);
 out:
         ibd->hfi1_ibdev_dbg = NULL;
-        synchronize_rcu();
 }
 
 /*
@@ -1035,9 +1015,7 @@ static const char * const hfi1_statnames[] = {
 };
 
 static void *_driver_stats_names_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(hfi1_statnames))
                 return NULL;
         return pos;
@@ -1055,9 +1033,7 @@ static void *_driver_stats_names_seq_next(
 }
 
 static void _driver_stats_names_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _driver_stats_names_seq_show(struct seq_file *s, void *v)
@@ -1073,9 +1049,7 @@ DEBUGFS_SEQ_FILE_OPEN(driver_stats_names)
 DEBUGFS_FILE_OPS(driver_stats_names);
 
 static void *_driver_stats_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(hfi1_statnames))
                 return NULL;
         return pos;
@@ -1090,9 +1064,7 @@ static void *_driver_stats_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _driver_stats_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static u64 hfi1_sps_ints(void)
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index a021e660d482..325ec211370f 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -605,6 +605,7 @@ struct hfi1_pportdata {
         struct work_struct freeze_work;
         struct work_struct link_downgrade_work;
         struct work_struct link_bounce_work;
+        struct delayed_work start_link_work;
         /* host link state variables */
         struct mutex hls_lock;
         u32 host_link_state;
@@ -659,6 +660,7 @@ struct hfi1_pportdata {
         u8 linkinit_reason;
         u8 local_tx_rate;       /* rate given to 8051 firmware */
         u8 last_pstate;         /* info only */
+        u8 qsfp_retry_count;
 
         /* placeholders for IB MAD packet settings */
         u8 overrun_threshold;
@@ -1804,7 +1806,7 @@ extern unsigned int hfi1_max_mtu;
 extern unsigned int hfi1_cu;
 extern unsigned int user_credit_return_threshold;
 extern int num_user_contexts;
-extern unsigned n_krcvqs;
+extern unsigned long n_krcvqs;
 extern uint krcvqs[];
 extern int krcvqsset;
 extern uint kdeth_qp;
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index b7935451093c..384b43d2fd49 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -94,7 +94,7 @@ module_param_array(krcvqs, uint, &krcvqsset, S_IRUGO);
 MODULE_PARM_DESC(krcvqs, "Array of the number of non-control kernel receive queues by VL");
 
 /* computed based on above array */
-unsigned n_krcvqs;
+unsigned long n_krcvqs;
 
 static unsigned hfi1_rcvarr_split = 25;
 module_param_named(rcvarr_split, hfi1_rcvarr_split, uint, S_IRUGO);
@@ -500,6 +500,7 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd,
         INIT_WORK(&ppd->link_downgrade_work, handle_link_downgrade);
         INIT_WORK(&ppd->sma_message_work, handle_sma_message);
         INIT_WORK(&ppd->link_bounce_work, handle_link_bounce);
+        INIT_DELAYED_WORK(&ppd->start_link_work, handle_start_link);
         INIT_WORK(&ppd->linkstate_active_work, receive_interrupt_work);
         INIT_WORK(&ppd->qsfp_info.qsfp_work, qsfp_event);
 
diff --git a/drivers/infiniband/hw/hfi1/mad.c b/drivers/infiniband/hw/hfi1/mad.c
index 39e42c373a01..7ffc14f21523 100644
--- a/drivers/infiniband/hw/hfi1/mad.c
+++ b/drivers/infiniband/hw/hfi1/mad.c
@@ -2604,7 +2604,7 @@ static int pma_get_opa_datacounters(struct opa_pma_mad *pmp,
         u8 lq, num_vls;
         u8 res_lli, res_ler;
         u64 port_mask;
-        unsigned long port_num;
+        u8 port_num;
         unsigned long vl;
         u32 vl_select_mask;
         int vfi;
@@ -2638,9 +2638,9 @@ static int pma_get_opa_datacounters(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
-        if ((u8)port_num != port) {
+        if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
                 return reply((struct ib_mad_hdr *)pmp);
         }
@@ -2842,7 +2842,7 @@ static int pma_get_opa_porterrors(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
@@ -3015,7 +3015,7 @@ static int pma_get_opa_errorinfo(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
@@ -3252,7 +3252,7 @@ static int pma_set_opa_errorinfo(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
diff --git a/drivers/infiniband/hw/hfi1/pio_copy.c b/drivers/infiniband/hw/hfi1/pio_copy.c
index 8c25e1b58849..3a1ef3056282 100644
--- a/drivers/infiniband/hw/hfi1/pio_copy.c
+++ b/drivers/infiniband/hw/hfi1/pio_copy.c
@@ -771,6 +771,9 @@ void seg_pio_copy_mid(struct pio_buf *pbuf, const void *from, size_t nbytes)
                         read_extra_bytes(pbuf, from, to_fill);
                         from += to_fill;
                         nbytes -= to_fill;
+                        /* may not be enough valid bytes left to align */
+                        if (extra > nbytes)
+                                extra = nbytes;
 
                         /* ...now write carry */
                         dest = pbuf->start + (pbuf->qw_written * sizeof(u64));
@@ -798,6 +801,15 @@ void seg_pio_copy_mid(struct pio_buf *pbuf, const void *from, size_t nbytes)
                         read_low_bytes(pbuf, from, extra);
                         from += extra;
                         nbytes -= extra;
+                        /*
+                         * If no bytes are left, return early - we are done.
+                         * NOTE: This short-circuit is *required* because
+                         * "extra" may have been reduced in size and "from"
+                         * is not aligned, as required when leaving this
+                         * if block.
+                         */
+                        if (nbytes == 0)
+                                return;
                 }
 
                 /* at this point, from is QW aligned */
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
index 0ecf27903dc2..1694037d1eee 100644
--- a/drivers/infiniband/hw/hfi1/user_sdma.c
+++ b/drivers/infiniband/hw/hfi1/user_sdma.c
@@ -114,6 +114,8 @@ MODULE_PARM_DESC(sdma_comp_size, "Size of User SDMA completion ring. Default: 12
 #define KDETH_HCRC_LOWER_SHIFT    24
 #define KDETH_HCRC_LOWER_MASK     0xff
 
+#define AHG_KDETH_INTR_SHIFT 12
+
 #define PBC2LRH(x) ((((x) & 0xfff) << 2) - 4)
 #define LRH2PBC(x) ((((x) >> 2) + 1) & 0xfff)
 
@@ -1480,7 +1482,8 @@ static int set_txreq_header_ahg(struct user_sdma_request *req,
                 /* Clear KDETH.SH on last packet */
                 if (unlikely(tx->flags & TXREQ_FLAGS_REQ_LAST_PKT)) {
                         val |= cpu_to_le16(KDETH_GET(hdr->kdeth.ver_tid_offset,
-                                                                INTR) >> 16);
+                                                     INTR) <<
+                                           AHG_KDETH_INTR_SHIFT);
                         val &= cpu_to_le16(~(1U << 13));
                         AHG_HEADER_SET(req->ahg, diff, 7, 16, 14, val);
                 } else {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c
index 3ee0cad96bc6..0c92a40b3e86 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c
@@ -265,6 +265,7 @@ void i40iw_next_iw_state(struct i40iw_qp *iwqp,
                 info.dont_send_fin = false;
         if (iwqp->sc_qp.term_flags && (state == I40IW_QP_STATE_ERROR))
                 info.reset_tcp_conn = true;
+        iwqp->hw_iwarp_state = state;
         i40iw_hw_modify_qp(iwqp->iwdev, iwqp, &info, 0);
 }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index 0cbbe4038298..445e230d5ff8 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -100,7 +100,7 @@ static struct notifier_block i40iw_net_notifier = {
         .notifier_call = i40iw_net_event
 };
 
-static int i40iw_notifiers_registered;
+static atomic_t i40iw_notifiers_registered;
 
 /**
  * i40iw_find_i40e_handler - find a handler given a client info
@@ -1342,12 +1342,11 @@ exit:
  */
 static void i40iw_register_notifiers(void)
 {
-        if (!i40iw_notifiers_registered) {
+        if (atomic_inc_return(&i40iw_notifiers_registered) == 1) {
                 register_inetaddr_notifier(&i40iw_inetaddr_notifier);
                 register_inet6addr_notifier(&i40iw_inetaddr6_notifier);
                 register_netevent_notifier(&i40iw_net_notifier);
         }
-        i40iw_notifiers_registered++;
 }
 
 /**
@@ -1429,8 +1428,7 @@ static void i40iw_deinit_device(struct i40iw_device *iwdev, bool reset, bool del
                         i40iw_del_macip_entry(iwdev, (u8)iwdev->mac_ip_table_idx);
                 /* fallthrough */
         case INET_NOTIFIER:
-                if (i40iw_notifiers_registered > 0) {
-                        i40iw_notifiers_registered--;
+                if (!atomic_dec_return(&i40iw_notifiers_registered)) {
                         unregister_netevent_notifier(&i40iw_net_notifier);
                         unregister_inetaddr_notifier(&i40iw_inetaddr_notifier);
                         unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 006db6436e3b..5df63dacaaa3 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -687,12 +687,6 @@ repoll:
         is_error = (cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) ==
                 MLX4_CQE_OPCODE_ERROR;
 
-        if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) == MLX4_OPCODE_NOP &&
-                     is_send)) {
-                pr_warn("Completion for NOP opcode detected!\n");
-                return -EAGAIN;
-        }
-
         /* Resize CQ in progress */
         if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) == MLX4_CQE_OPCODE_RESIZE)) {
                 if (cq->resize_buf) {
@@ -718,12 +712,6 @@ repoll:
                  */
                 mqp = __mlx4_qp_lookup(to_mdev(cq->ibcq.device)->dev,
                                        be32_to_cpu(cqe->vlan_my_qpn));
-                if (unlikely(!mqp)) {
-                        pr_warn("CQ %06x with entry for unknown QPN %06x\n",
-                               cq->mcq.cqn, be32_to_cpu(cqe->vlan_my_qpn) & MLX4_CQE_QPN_MASK);
-                        return -EAGAIN;
-                }
-
                 *cur_qp = to_mibqp(mqp);
         }
 
@@ -736,11 +724,6 @@ repoll:
                 /* SRQ is also in the radix tree */
                 msrq = mlx4_srq_lookup(to_mdev(cq->ibcq.device)->dev,
                                        srq_num);
-                if (unlikely(!msrq)) {
-                        pr_warn("CQ %06x with entry for unknown SRQN %06x\n",
-                                cq->mcq.cqn, srq_num);
-                        return -EAGAIN;
-                }
         }
 
         if (is_send) {
@@ -891,7 +874,6 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         struct mlx4_ib_qp *cur_qp = NULL;
         unsigned long flags;
         int npolled;
-        int err = 0;
         struct mlx4_ib_dev *mdev = to_mdev(cq->ibcq.device);
 
         spin_lock_irqsave(&cq->lock, flags);
@@ -901,8 +883,7 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         }
 
         for (npolled = 0; npolled < num_entries; ++npolled) {
-                err = mlx4_ib_poll_one(cq, &cur_qp, wc + npolled);
-                if (err)
+                if (mlx4_ib_poll_one(cq, &cur_qp, wc + npolled))
                         break;
         }
 
@@ -911,10 +892,7 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
 out:
         spin_unlock_irqrestore(&cq->lock, flags);
 
-        if (err == 0 || err == -EAGAIN)
-                return npolled;
-        else
-                return err;
+        return npolled;
 }
 
 int mlx4_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 9c2e53d28f98..0f21c3a25552 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1128,6 +1128,27 @@ void handle_port_mgmt_change_event(struct work_struct *work)
 
                 /* Generate GUID changed event */
                 if (changed_attr & MLX4_EQ_PORT_INFO_GID_PFX_CHANGE_MASK) {
+                        if (mlx4_is_master(dev->dev)) {
+                                union ib_gid gid;
+                                int err = 0;
+
+                                if (!eqe->event.port_mgmt_change.params.port_info.gid_prefix)
+                                        err = __mlx4_ib_query_gid(&dev->ib_dev, port, 0, &gid, 1);
+                                else
+                                        gid.global.subnet_prefix =
+                                                eqe->event.port_mgmt_change.params.port_info.gid_prefix;
+                                if (err) {
+                                        pr_warn("Could not change QP1 subnet prefix for port %d: query_gid error (%d)\n",
+                                                port, err);
+                                } else {
+                                        pr_debug("Changing QP1 subnet prefix for port %d. old=0x%llx. new=0x%llx\n",
+                                                 port,
+                                                 (u64)atomic64_read(&dev->sriov.demux[port - 1].subnet_prefix),
+                                                 be64_to_cpu(gid.global.subnet_prefix));
+                                        atomic64_set(&dev->sriov.demux[port - 1].subnet_prefix,
+                                                     be64_to_cpu(gid.global.subnet_prefix));
+                                }
+                        }
                         mlx4_ib_dispatch_event(dev, port, IB_EVENT_GID_CHANGE);
                         /*if master, notify all slaves*/
                         if (mlx4_is_master(dev->dev))
@@ -2202,6 +2223,8 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev)
                 if (err)
                         goto demux_err;
                 dev->sriov.demux[i].guid_cache[0] = gid.global.interface_id;
+                atomic64_set(&dev->sriov.demux[i].subnet_prefix,
+                             be64_to_cpu(gid.global.subnet_prefix));
                 err = alloc_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1,
                                       &dev->sriov.sqps[i]);
                 if (err)
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 2af44c2de262..87ba9bca4181 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -2202,6 +2202,9 @@ static int mlx4_ib_alloc_diag_counters(struct mlx4_ib_dev *ibdev)
         bool per_port = !!(ibdev->dev->caps.flags2 &
                 MLX4_DEV_CAP_FLAG2_DIAG_PER_PORT);
 
+        if (mlx4_is_slave(ibdev->dev))
+                return 0;
+
         for (i = 0; i < MLX4_DIAG_COUNTERS_TYPES; i++) {
                 /* i == 1 means we are building port counters */
                 if (i && !per_port)
diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
index 8f7ad07915b0..097bfcc4ee99 100644
--- a/drivers/infiniband/hw/mlx4/mcg.c
+++ b/drivers/infiniband/hw/mlx4/mcg.c
@@ -489,7 +489,7 @@ static u8 get_leave_state(struct mcast_group *group)
                 if (!group->members[i])
                         leave_state |= (1 << i);
 
-        return leave_state & (group->rec.scope_join_state & 7);
+        return leave_state & (group->rec.scope_join_state & 0xf);
 }
 
 static int join_group(struct mcast_group *group, int slave, u8 join_mask)
@@ -564,8 +564,8 @@ static void mlx4_ib_mcg_timeout_handler(struct work_struct *work)
                 } else
                         mcg_warn_group(group, "DRIVER BUG\n");
         } else if (group->state == MCAST_LEAVE_SENT) {
-                if (group->rec.scope_join_state & 7)
-                        group->rec.scope_join_state &= 0xf8;
+                if (group->rec.scope_join_state & 0xf)
+                        group->rec.scope_join_state &= 0xf0;
                 group->state = MCAST_IDLE;
                 mutex_unlock(&group->lock);
                 if (release_group(group, 1))
@@ -605,7 +605,7 @@ static int handle_leave_req(struct mcast_group *group, u8 leave_mask,
 static int handle_join_req(struct mcast_group *group, u8 join_mask,
                            struct mcast_req *req)
 {
-        u8 group_join_state = group->rec.scope_join_state & 7;
+        u8 group_join_state = group->rec.scope_join_state & 0xf;
         int ref = 0;
         u16 status;
         struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
@@ -690,8 +690,8 @@ static void mlx4_ib_mcg_work_handler(struct work_struct *work)
                         u8 cur_join_state;
 
                         resp_join_state = ((struct ib_sa_mcmember_data *)
-                                                group->response_sa_mad.data)->scope_join_state & 7;
-                        cur_join_state = group->rec.scope_join_state & 7;
+                                                group->response_sa_mad.data)->scope_join_state & 0xf;
+                        cur_join_state = group->rec.scope_join_state & 0xf;
 
                         if (method == IB_MGMT_METHOD_GET_RESP) {
                                 /* successfull join */
@@ -710,7 +710,7 @@ process_requests:
                 req = list_first_entry(&group->pending_list, struct mcast_req,
                                        group_list);
                 sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
-                req_join_state = sa_data->scope_join_state & 0x7;
+                req_join_state = sa_data->scope_join_state & 0xf;
 
                 /* For a leave request, we will immediately answer the VF, and
                  * update our internal counters. The actual leave will be sent
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 7c5832ede4bd..686ab48ff644 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -448,7 +448,7 @@ struct mlx4_ib_demux_ctx {
         struct workqueue_struct *wq;
         struct workqueue_struct *ud_wq;
         spinlock_t ud_lock;
-        __be64 subnet_prefix;
+        atomic64_t subnet_prefix;
         __be64 guid_cache[128];
         struct mlx4_ib_dev *dev;
         /* the following lock protects both mcg_table and mcg_mgid0_list */
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 768085f59566..7fb9629bd12b 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -2493,24 +2493,27 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_ud_wr *wr,
                 sqp->ud_header.grh.flow_label    =
                         ah->av.ib.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
                 sqp->ud_header.grh.hop_limit     = ah->av.ib.hop_limit;
-                if (is_eth)
+                if (is_eth) {
                         memcpy(sqp->ud_header.grh.source_gid.raw, sgid.raw, 16);
-                else {
-                if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
-                        /* When multi-function is enabled, the ib_core gid
-                         * indexes don't necessarily match the hw ones, so
-                         * we must use our own cache */
-                        sqp->ud_header.grh.source_gid.global.subnet_prefix =
-                                to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-                                                       subnet_prefix;
-                        sqp->ud_header.grh.source_gid.global.interface_id =
-                                to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-                                               guid_cache[ah->av.ib.gid_index];
-                } else
-                        ib_get_cached_gid(ib_dev,
-                                          be32_to_cpu(ah->av.ib.port_pd) >> 24,
-                                          ah->av.ib.gid_index,
-                                          &sqp->ud_header.grh.source_gid, NULL);
+                } else {
+                        if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
+                                /* When multi-function is enabled, the ib_core gid
+                                 * indexes don't necessarily match the hw ones, so
+                                 * we must use our own cache
+                                 */
+                                sqp->ud_header.grh.source_gid.global.subnet_prefix =
+                                        cpu_to_be64(atomic64_read(&(to_mdev(ib_dev)->sriov.
+                                                                    demux[sqp->qp.port - 1].
+                                                                    subnet_prefix)));
+                                sqp->ud_header.grh.source_gid.global.interface_id =
+                                        to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+                                                       guid_cache[ah->av.ib.gid_index];
+                        } else {
+                                ib_get_cached_gid(ib_dev,
+                                                  be32_to_cpu(ah->av.ib.port_pd) >> 24,
+                                                  ah->av.ib.gid_index,
+                                                  &sqp->ud_header.grh.source_gid, NULL);
+                        }
                 }
                 memcpy(sqp->ud_header.grh.destination_gid.raw,
                        ah->av.ib.dgid, 16);
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 308a358e5b46..e4fac9292e4a 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -553,12 +553,6 @@ repoll:
                  * from the table.
                  */
                 mqp = __mlx5_qp_lookup(dev->mdev, qpn);
-                if (unlikely(!mqp)) {
-                        mlx5_ib_warn(dev, "CQE@CQ %06x for unknown QPN %6x\n",
-                                     cq->mcq.cqn, qpn);
-                        return -EINVAL;
-                }
-
                 *cur_qp = to_mibqp(mqp);
         }
 
@@ -619,13 +613,6 @@ repoll:
                 read_lock(&dev->mdev->priv.mkey_table.lock);
                 mmkey = __mlx5_mr_lookup(dev->mdev,
                                          mlx5_base_mkey(be32_to_cpu(sig_err_cqe->mkey)));
-                if (unlikely(!mmkey)) {
-                        read_unlock(&dev->mdev->priv.mkey_table.lock);
-                        mlx5_ib_warn(dev, "CQE@CQ %06x for unknown MR %6x\n",
-                                     cq->mcq.cqn, be32_to_cpu(sig_err_cqe->mkey));
-                        return -EINVAL;
-                }
-
                 mr = to_mibmr(mmkey);
                 get_sig_err_item(sig_err_cqe, &mr->sig->err_item);
                 mr->sig->sig_err_exists = true;
@@ -676,7 +663,6 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         unsigned long flags;
         int soft_polled = 0;
         int npolled;
-        int err = 0;
 
         spin_lock_irqsave(&cq->lock, flags);
         if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
@@ -688,8 +674,7 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
                 soft_polled = poll_soft_wc(cq, num_entries, wc);
 
         for (npolled = 0; npolled < num_entries - soft_polled; npolled++) {
-                err = mlx5_poll_one(cq, &cur_qp, wc + soft_polled + npolled);
-                if (err)
+                if (mlx5_poll_one(cq, &cur_qp, wc + soft_polled + npolled))
                         break;
         }
 
@@ -698,10 +683,7 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
 out:
         spin_unlock_irqrestore(&cq->lock, flags);
 
-        if (err == 0 || err == -EAGAIN)
-                return soft_polled + npolled;
-        else
-                return err;
+        return soft_polled + npolled;
 }
 
 int mlx5_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 1b4094baa2de..e19537cf44ab 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -288,7 +288,9 @@ __be16 mlx5_get_roce_udp_sport(struct mlx5_ib_dev *dev, u8 port_num,
 
 static int mlx5_use_mad_ifc(struct mlx5_ib_dev *dev)
 {
-        return !MLX5_CAP_GEN(dev->mdev, ib_virt);
+        if (MLX5_CAP_GEN(dev->mdev, port_type) == MLX5_CAP_PORT_TYPE_IB)
+                return !MLX5_CAP_GEN(dev->mdev, ib_virt);
+        return 0;
 }
 
 enum {
@@ -1428,6 +1430,13 @@ static int parse_flow_attr(u32 *match_c, u32 *match_v,
                                              dmac_47_16),
                                 ib_spec->eth.val.dst_mac);
 
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+                                             smac_47_16),
+                                ib_spec->eth.mask.src_mac);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+                                             smac_47_16),
+                                ib_spec->eth.val.src_mac);
+
                 if (ib_spec->eth.mask.vlan_tag) {
                         MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
                                  vlan_tag, 1);
@@ -1849,6 +1858,7 @@ static struct ib_flow *mlx5_ib_create_flow(struct ib_qp *qp,
                                            int domain)
 {
         struct mlx5_ib_dev *dev = to_mdev(qp->device);
+        struct mlx5_ib_qp *mqp = to_mqp(qp);
         struct mlx5_ib_flow_handler *handler = NULL;
         struct mlx5_flow_destination *dst = NULL;
         struct mlx5_ib_flow_prio *ft_prio;
@@ -1875,7 +1885,10 @@ static struct ib_flow *mlx5_ib_create_flow(struct ib_qp *qp,
         }
 
         dst->type = MLX5_FLOW_DESTINATION_TYPE_TIR;
-        dst->tir_num = to_mqp(qp)->raw_packet_qp.rq.tirn;
+        if (mqp->flags & MLX5_IB_QP_RSS)
+                dst->tir_num = mqp->rss_qp.tirn;
+        else
+                dst->tir_num = mqp->raw_packet_qp.rq.tirn;
 
         if (flow_attr->type == IB_FLOW_ATTR_NORMAL) {
                 if (flow_attr->flags & IB_FLOW_ATTR_FLAGS_DONT_TRAP)  {
diff --git a/drivers/infiniband/hw/mlx5/mem.c b/drivers/infiniband/hw/mlx5/mem.c
index 40df2cca0609..996b54e366b0 100644
--- a/drivers/infiniband/hw/mlx5/mem.c
+++ b/drivers/infiniband/hw/mlx5/mem.c
@@ -71,7 +71,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
 
         addr = addr >> page_shift;
         tmp = (unsigned long)addr;
-        m = find_first_bit(&tmp, sizeof(tmp));
+        m = find_first_bit(&tmp, BITS_PER_LONG);
         skip = 1 << m;
         mask = skip - 1;
         i = 0;
@@ -81,7 +81,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
                 for (k = 0; k < len; k++) {
                         if (!(i & mask)) {
                                 tmp = (unsigned long)pfn;
-                                m = min_t(unsigned long, m, find_first_bit(&tmp, sizeof(tmp)));
+                                m = min_t(unsigned long, m, find_first_bit(&tmp, BITS_PER_LONG));
                                 skip = 1 << m;
                                 mask = skip - 1;
                                 base = pfn;
@@ -89,7 +89,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
                         } else {
                                 if (base + p != pfn) {
                                         tmp = (unsigned long)p;
-                                        m = find_first_bit(&tmp, sizeof(tmp));
+                                        m = find_first_bit(&tmp, BITS_PER_LONG);
                                         skip = 1 << m;
                                         mask = skip - 1;
                                         base = pfn;
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 372385d0f993..95146f4aa3e3 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -402,6 +402,7 @@ enum mlx5_ib_qp_flags {
         /* QP uses 1 as its source QP number */
         MLX5_IB_QP_SQPN_QP1                     = 1 << 6,
         MLX5_IB_QP_CAP_SCATTER_FCS              = 1 << 7,
+        MLX5_IB_QP_RSS                          = 1 << 8,
 };
 
 struct mlx5_umr_wr {
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 0dd7d93cac95..affc3f6598ca 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1449,6 +1449,7 @@ create_tir:
         kvfree(in);
         /* qpn is reserved for that QP */
         qp->trans_qp.base.mqp.qpn = 0;
+        qp->flags |= MLX5_IB_QP_RSS;
         return 0;
 
 err:
@@ -3658,12 +3659,8 @@ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
                      struct ib_send_wr *wr, unsigned *idx,
                      int *size, int nreq)
 {
-        int err = 0;
-
-        if (unlikely(mlx5_wq_overflow(&qp->sq, nreq, qp->ibqp.send_cq))) {
-                err = -ENOMEM;
-                return err;
-        }
+        if (unlikely(mlx5_wq_overflow(&qp->sq, nreq, qp->ibqp.send_cq)))
+                return -ENOMEM;
 
         *idx = qp->sq.cur_post & (qp->sq.wqe_cnt - 1);
         *seg = mlx5_get_send_wqe(qp, *idx);
@@ -3679,7 +3676,7 @@ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
         *seg += sizeof(**ctrl);
         *size = sizeof(**ctrl) / 16;
 
-        return err;
+        return 0;
 }
 
 static void finish_wqe(struct mlx5_ib_qp *qp,
@@ -3758,7 +3755,7 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 num_sge = wr->num_sge;
                 if (unlikely(num_sge > qp->sq.max_gs)) {
                         mlx5_ib_warn(dev, "\n");
-                        err = -ENOMEM;
+                        err = -EINVAL;
                         *bad_wr = wr;
                         goto out;
                 }
diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
index 80c4b6b401b8..46b64970058e 100644
--- a/drivers/infiniband/sw/rdmavt/mr.c
+++ b/drivers/infiniband/sw/rdmavt/mr.c
@@ -294,7 +294,7 @@ static void __rvt_free_mr(struct rvt_mr *mr)
 {
         rvt_deinit_mregion(&mr->mr);
         rvt_free_lkey(&mr->mr);
-        vfree(mr);
+        kfree(mr);
 }
 
 /**
diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
index 55f0e8f0ca79..ddd59270ff6d 100644
--- a/drivers/infiniband/sw/rxe/rxe.c
+++ b/drivers/infiniband/sw/rxe/rxe.c
@@ -362,15 +362,34 @@ static int __init rxe_module_init(void)
                 return err;
         }
 
-        err = rxe_net_init();
+        err = rxe_net_ipv4_init();
         if (err) {
-                pr_err("rxe: unable to init\n");
+                pr_err("rxe: unable to init ipv4 tunnel\n");
                 rxe_cache_exit();
-                return err;
+                goto exit;
+        }
+
+        err = rxe_net_ipv6_init();
+        if (err) {
+                pr_err("rxe: unable to init ipv6 tunnel\n");
+                rxe_cache_exit();
+                goto exit;
         }
+
+        err = register_netdevice_notifier(&rxe_net_notifier);
+        if (err) {
+                pr_err("rxe: Failed to rigister netdev notifier\n");
+                goto exit;
+        }
+
         pr_info("rxe: loaded\n");
 
         return 0;
+
+exit:
+        rxe_release_udp_tunnel(recv_sockets.sk4);
+        rxe_release_udp_tunnel(recv_sockets.sk6);
+        return err;
 }
 
 static void __exit rxe_module_exit(void)
diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
index 36f67de44095..1c59ef2c67aa 100644
--- a/drivers/infiniband/sw/rxe/rxe_comp.c
+++ b/drivers/infiniband/sw/rxe/rxe_comp.c
@@ -689,7 +689,14 @@ int rxe_completer(void *arg)
                                         qp->req.need_retry = 1;
                                         rxe_run_task(&qp->req.task, 1);
                                 }
+
+                                if (pkt) {
+                                        rxe_drop_ref(pkt->qp);
+                                        kfree_skb(skb);
+                                }
+
                                 goto exit;
+
                         } else {
                                 wqe->status = IB_WC_RETRY_EXC_ERR;
                                 state = COMPST_ERROR;
@@ -716,6 +723,12 @@ int rxe_completer(void *arg)
                 case COMPST_ERROR:
                         do_complete(qp, wqe);
                         rxe_qp_error(qp);
+
+                        if (pkt) {
+                                rxe_drop_ref(pkt->qp);
+                                kfree_skb(skb);
+                        }
+
                         goto exit;
                 }
         }
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index 0b8d2ea8b41d..eedf2f1cafdf 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -275,9 +275,10 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port,
         return sock;
 }
 
-static void rxe_release_udp_tunnel(struct socket *sk)
+void rxe_release_udp_tunnel(struct socket *sk)
 {
-        udp_tunnel_sock_release(sk);
+        if (sk)
+                udp_tunnel_sock_release(sk);
 }
 
 static void prepare_udp_hdr(struct sk_buff *skb, __be16 src_port,
@@ -658,51 +659,45 @@ out:
         return NOTIFY_OK;
 }
 
-static struct notifier_block rxe_net_notifier = {
+struct notifier_block rxe_net_notifier = {
         .notifier_call = rxe_notify,
 };
 
-int rxe_net_init(void)
+int rxe_net_ipv4_init(void)
 {
-        int err;
-
         spin_lock_init(&dev_list_lock);
 
-        recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net,
-                        htons(ROCE_V2_UDP_DPORT), true);
-        if (IS_ERR(recv_sockets.sk6)) {
-                recv_sockets.sk6 = NULL;
-                pr_err("rxe: Failed to create IPv6 UDP tunnel\n");
-                return -1;
-        }
-
         recv_sockets.sk4 = rxe_setup_udp_tunnel(&init_net,
-                        htons(ROCE_V2_UDP_DPORT), false);
+                                htons(ROCE_V2_UDP_DPORT), false);
         if (IS_ERR(recv_sockets.sk4)) {
-                rxe_release_udp_tunnel(recv_sockets.sk6);
                 recv_sockets.sk4 = NULL;
-                recv_sockets.sk6 = NULL;
                 pr_err("rxe: Failed to create IPv4 UDP tunnel\n");
                 return -1;
         }
 
-        err = register_netdevice_notifier(&rxe_net_notifier);
-        if (err) {
-                rxe_release_udp_tunnel(recv_sockets.sk6);
-                rxe_release_udp_tunnel(recv_sockets.sk4);
-                pr_err("rxe: Failed to rigister netdev notifier\n");
-        }
-
-        return err;
+        return 0;
 }
 
-void rxe_net_exit(void)
+int rxe_net_ipv6_init(void)
 {
-        if (recv_sockets.sk6)
-                rxe_release_udp_tunnel(recv_sockets.sk6);
+#if IS_ENABLED(CONFIG_IPV6)
 
-        if (recv_sockets.sk4)
-                rxe_release_udp_tunnel(recv_sockets.sk4);
+        spin_lock_init(&dev_list_lock);
 
+        recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net,
+                                                htons(ROCE_V2_UDP_DPORT), true);
+        if (IS_ERR(recv_sockets.sk6)) {
+                recv_sockets.sk6 = NULL;
+                pr_err("rxe: Failed to create IPv6 UDP tunnel\n");
+                return -1;
+        }
+#endif
+        return 0;
+}
+
+void rxe_net_exit(void)
+{
+        rxe_release_udp_tunnel(recv_sockets.sk6);
+        rxe_release_udp_tunnel(recv_sockets.sk4);
         unregister_netdevice_notifier(&rxe_net_notifier);
 }
diff --git a/drivers/infiniband/sw/rxe/rxe_net.h b/drivers/infiniband/sw/rxe/rxe_net.h
index 7b06f76d16cc..0daf7f09e5b5 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.h
+++ b/drivers/infiniband/sw/rxe/rxe_net.h
@@ -44,10 +44,13 @@ struct rxe_recv_sockets {
 };
 
 extern struct rxe_recv_sockets recv_sockets;
+extern struct notifier_block rxe_net_notifier;
+void rxe_release_udp_tunnel(struct socket *sk);
 
 struct rxe_dev *rxe_net_add(struct net_device *ndev);
 
-int rxe_net_init(void);
+int rxe_net_ipv4_init(void);
+int rxe_net_ipv6_init(void);
 void rxe_net_exit(void);
 
 #endif /* RXE_NET_H */
diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
index 3d464c23e08b..144d2f129fcd 100644
--- a/drivers/infiniband/sw/rxe/rxe_recv.c
+++ b/drivers/infiniband/sw/rxe/rxe_recv.c
@@ -312,7 +312,7 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
                  * make a copy of the skb to post to the next qp
                  */
                 skb_copy = (mce->qp_list.next != &mcg->qp_list) ?
-                                skb_clone(skb, GFP_KERNEL) : NULL;
+                                skb_clone(skb, GFP_ATOMIC) : NULL;
 
                 pkt->qp = qp;
                 rxe_add_ref(qp);
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 33b2d9d77021..13a848a518e8 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -511,24 +511,21 @@ static int fill_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
 }
 
 static void update_wqe_state(struct rxe_qp *qp,
-                             struct rxe_send_wqe *wqe,
-                             struct rxe_pkt_info *pkt,
-                             enum wqe_state *prev_state)
+                struct rxe_send_wqe *wqe,
+                struct rxe_pkt_info *pkt)
 {
-        enum wqe_state prev_state_ = wqe->state;
-
         if (pkt->mask & RXE_END_MASK) {
                 if (qp_type(qp) == IB_QPT_RC)
                         wqe->state = wqe_state_pending;
         } else {
                 wqe->state = wqe_state_processing;
         }
-
-        *prev_state = prev_state_;
 }
 
-static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
-                         struct rxe_pkt_info *pkt, int payload)
+static void update_wqe_psn(struct rxe_qp *qp,
+                           struct rxe_send_wqe *wqe,
+                           struct rxe_pkt_info *pkt,
+                           int payload)
 {
         /* number of packets left to send including current one */
         int num_pkt = (wqe->dma.resid + payload + qp->mtu - 1) / qp->mtu;
@@ -546,9 +543,34 @@ static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
                 qp->req.psn = (wqe->first_psn + num_pkt) & BTH_PSN_MASK;
         else
                 qp->req.psn = (qp->req.psn + 1) & BTH_PSN_MASK;
+}
 
-        qp->req.opcode = pkt->opcode;
+static void save_state(struct rxe_send_wqe *wqe,
+                       struct rxe_qp *qp,
+                       struct rxe_send_wqe *rollback_wqe,
+                       struct rxe_qp *rollback_qp)
+{
+        rollback_wqe->state     = wqe->state;
+        rollback_wqe->first_psn = wqe->first_psn;
+        rollback_wqe->last_psn  = wqe->last_psn;
+        rollback_qp->req.psn    = qp->req.psn;
+}
 
+static void rollback_state(struct rxe_send_wqe *wqe,
+                           struct rxe_qp *qp,
+                           struct rxe_send_wqe *rollback_wqe,
+                           struct rxe_qp *rollback_qp)
+{
+        wqe->state     = rollback_wqe->state;
+        wqe->first_psn = rollback_wqe->first_psn;
+        wqe->last_psn  = rollback_wqe->last_psn;
+        qp->req.psn    = rollback_qp->req.psn;
+}
+
+static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+                         struct rxe_pkt_info *pkt, int payload)
+{
+        qp->req.opcode = pkt->opcode;
 
         if (pkt->mask & RXE_END_MASK)
                 qp->req.wqe_index = next_index(qp->sq.queue, qp->req.wqe_index);
@@ -571,7 +593,8 @@ int rxe_requester(void *arg)
         int mtu;
         int opcode;
         int ret;
-        enum wqe_state prev_state;
+        struct rxe_qp rollback_qp;
+        struct rxe_send_wqe rollback_wqe;
 
 next_wqe:
         if (unlikely(!qp->valid || qp->req.state == QP_STATE_ERROR))
@@ -688,13 +711,21 @@ next_wqe:
                 goto err;
         }
 
-        update_wqe_state(qp, wqe, &pkt, &prev_state);
+        /*
+         * To prevent a race on wqe access between requester and completer,
+         * wqe members state and psn need to be set before calling
+         * rxe_xmit_packet().
+         * Otherwise, completer might initiate an unjustified retry flow.
+         */
+        save_state(wqe, qp, &rollback_wqe, &rollback_qp);
+        update_wqe_state(qp, wqe, &pkt);
+        update_wqe_psn(qp, wqe, &pkt, payload);
         ret = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp, &pkt, skb);
         if (ret) {
                 qp->need_req_skb = 1;
                 kfree_skb(skb);
 
-                wqe->state = prev_state;
+                rollback_state(wqe, qp, &rollback_wqe, &rollback_qp);
 
                 if (ret == -EAGAIN) {
                         rxe_run_task(&qp->req.task, 1);
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index ebb03b46e2ad..3e0f0f2baace 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -972,11 +972,13 @@ static int send_atomic_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
         free_rd_atomic_resource(qp, res);
         rxe_advance_resp_resource(qp);
 
+        memcpy(SKB_TO_PKT(skb), &ack_pkt, sizeof(skb->cb));
+
         res->type = RXE_ATOMIC_MASK;
         res->atomic.skb = skb;
-        res->first_psn = qp->resp.psn;
-        res->last_psn = qp->resp.psn;
-        res->cur_psn = qp->resp.psn;
+        res->first_psn = ack_pkt.psn;
+        res->last_psn  = ack_pkt.psn;
+        res->cur_psn   = ack_pkt.psn;
 
         rc = rxe_xmit_packet(rxe, qp, &ack_pkt, skb_copy);
         if (rc) {
@@ -1116,8 +1118,7 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
                                 rc = RESPST_CLEANUP;
                                 goto out;
                         }
-                        bth_set_psn(SKB_TO_PKT(skb_copy),
-                                    qp->resp.psn - 1);
+
                         /* Resend the result. */
                         rc = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp,
                                              pkt, skb_copy);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 4f7d9b48df64..9dbfcc0ab577 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -478,6 +478,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                 struct ipoib_ah *address, u32 qpn);
 void ipoib_reap_ah(struct work_struct *work);
 
+struct ipoib_path *__path_find(struct net_device *dev, void *gid);
 void ipoib_mark_paths_invalid(struct net_device *dev);
 void ipoib_flush_paths(struct net_device *dev);
 int ipoib_check_sm_sendonly_fullmember_support(struct ipoib_dev_priv *priv);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 951d9abcca8b..4ad297d3de89 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1318,6 +1318,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
         }
 }
 
+#define QPN_AND_OPTIONS_OFFSET  4
+
 static void ipoib_cm_tx_start(struct work_struct *work)
 {
         struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
@@ -1326,6 +1328,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
         struct ipoib_neigh *neigh;
         struct ipoib_cm_tx *p;
         unsigned long flags;
+        struct ipoib_path *path;
         int ret;
 
         struct ib_sa_path_rec pathrec;
@@ -1338,7 +1341,19 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                 p = list_entry(priv->cm.start_list.next, typeof(*p), list);
                 list_del_init(&p->list);
                 neigh = p->neigh;
+
                 qpn = IPOIB_QPN(neigh->daddr);
+                /*
+                 * As long as the search is with these 2 locks,
+                 * path existence indicates its validity.
+                 */
+                path = __path_find(dev, neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+                if (!path) {
+                        pr_info("%s ignore not valid path %pI6\n",
+                                __func__,
+                                neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+                        goto free_neigh;
+                }
                 memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
 
                 spin_unlock_irqrestore(&priv->lock, flags);
@@ -1350,6 +1365,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                 spin_lock_irqsave(&priv->lock, flags);
 
                 if (ret) {
+free_neigh:
                         neigh = p->neigh;
                         if (neigh) {
                                 neigh->cm = NULL;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index dc6d241b9406..be11d5d5b8c1 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1161,8 +1161,17 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
         }
 
         if (level == IPOIB_FLUSH_LIGHT) {
+                int oper_up;
                 ipoib_mark_paths_invalid(dev);
+                /* Set IPoIB operation as down to prevent races between:
+                 * the flush flow which leaves MCG and on the fly joins
+                 * which can happen during that time. mcast restart task
+                 * should deal with join requests we missed.
+                 */
+                oper_up = test_and_clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
                 ipoib_mcast_dev_flush(dev);
+                if (oper_up)
+                        set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
                 ipoib_flush_ah(dev);
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 74bcaa064226..cc1c1b062ea5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -485,7 +485,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
         return -EINVAL;
 }
 
-static struct ipoib_path *__path_find(struct net_device *dev, void *gid)
+struct ipoib_path *__path_find(struct net_device *dev, void *gid)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct rb_node *n = priv->path_tree.rb_node;
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 7914c14478cd..cae9bbcc27e7 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -403,6 +403,7 @@ isert_init_conn(struct isert_conn *isert_conn)
         INIT_LIST_HEAD(&isert_conn->node);
         init_completion(&isert_conn->login_comp);
         init_completion(&isert_conn->login_req_comp);
+        init_waitqueue_head(&isert_conn->rem_wait);
         kref_init(&isert_conn->kref);
         mutex_init(&isert_conn->mutex);
         INIT_WORK(&isert_conn->release_work, isert_release_work);
@@ -578,7 +579,8 @@ isert_connect_release(struct isert_conn *isert_conn)
         BUG_ON(!device);
 
         isert_free_rx_descriptors(isert_conn);
-        if (isert_conn->cm_id)
+        if (isert_conn->cm_id &&
+            !isert_conn->dev_removed)
                 rdma_destroy_id(isert_conn->cm_id);
 
         if (isert_conn->qp) {
@@ -593,7 +595,10 @@ isert_connect_release(struct isert_conn *isert_conn)
 
         isert_device_put(device);
 
-        kfree(isert_conn);
+        if (isert_conn->dev_removed)
+                wake_up_interruptible(&isert_conn->rem_wait);
+        else
+                kfree(isert_conn);
 }
 
 static void
@@ -753,6 +758,7 @@ static int
 isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 {
         struct isert_np *isert_np = cma_id->context;
+        struct isert_conn *isert_conn;
         int ret = 0;
 
         isert_info("%s (%d): status %d id %p np %p\n",
@@ -773,10 +779,21 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                 break;
         case RDMA_CM_EVENT_ADDR_CHANGE:    /* FALLTHRU */
         case RDMA_CM_EVENT_DISCONNECTED:   /* FALLTHRU */
-        case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
         case RDMA_CM_EVENT_TIMEWAIT_EXIT:  /* FALLTHRU */
                 ret = isert_disconnected_handler(cma_id, event->event);
                 break;
+        case RDMA_CM_EVENT_DEVICE_REMOVAL:
+                isert_conn = cma_id->qp->qp_context;
+                isert_conn->dev_removed = true;
+                isert_disconnected_handler(cma_id, event->event);
+                wait_event_interruptible(isert_conn->rem_wait,
+                                         isert_conn->state == ISER_CONN_DOWN);
+                kfree(isert_conn);
+                /*
+                 * return non-zero from the callback to destroy
+                 * the rdma cm id
+                 */
+                return 1;
         case RDMA_CM_EVENT_REJECTED:       /* FALLTHRU */
         case RDMA_CM_EVENT_UNREACHABLE:    /* FALLTHRU */
         case RDMA_CM_EVENT_CONNECT_ERROR:
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index fc791efe3a10..c02ada57d7f5 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -158,6 +158,8 @@ struct isert_conn {
         struct work_struct      release_work;
         bool                    logout_posted;
         bool                    snd_w_inv;
+        wait_queue_head_t       rem_wait;
+        bool                    dev_removed;
 };
 
 #define ISERT_MAX_CQ 64
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 112e17c2768b..37f952dd9fc9 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -176,6 +176,7 @@ static int aic_irq_domain_xlate(struct irq_domain *d,
 {
         struct irq_domain_chip_generic *dgc = d->gc;
         struct irq_chip_generic *gc;
+        unsigned long flags;
         unsigned smr;
         int idx;
         int ret;
@@ -194,11 +195,11 @@ static int aic_irq_domain_xlate(struct irq_domain *d,
 
         gc = dgc->gc[idx];
 
-        irq_gc_lock(gc);
+        irq_gc_lock_irqsave(gc, flags);
         smr = irq_reg_readl(gc, AT91_AIC_SMR(*out_hwirq));
         aic_common_set_priority(intspec[2], &smr);
         irq_reg_writel(gc, smr, AT91_AIC_SMR(*out_hwirq));
-        irq_gc_unlock(gc);
+        irq_gc_unlock_irqrestore(gc, flags);
 
         return ret;
 }
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index 4f0d068e1abe..2a624d87a035 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -258,6 +258,7 @@ static int aic5_irq_domain_xlate(struct irq_domain *d,
                                  unsigned int *out_type)
 {
         struct irq_chip_generic *bgc = irq_get_domain_generic_chip(d, 0);
+        unsigned long flags;
         unsigned smr;
         int ret;
 
@@ -269,12 +270,12 @@ static int aic5_irq_domain_xlate(struct irq_domain *d,
         if (ret)
                 return ret;
 
-        irq_gc_lock(bgc);
+        irq_gc_lock_irqsave(bgc, flags);
         irq_reg_writel(bgc, *out_hwirq, AT91_AIC5_SSR);
         smr = irq_reg_readl(bgc, AT91_AIC5_SMR);
         aic_common_set_priority(intspec[2], &smr);
         irq_reg_writel(bgc, smr, AT91_AIC5_SMR);
-        irq_gc_unlock(bgc);
+        irq_gc_unlock_irqrestore(bgc, flags);
 
         return ret;
 }
diff --git a/drivers/mailbox/Kconfig b/drivers/mailbox/Kconfig
index 97c372908e78..7817d40d81e7 100644
--- a/drivers/mailbox/Kconfig
+++ b/drivers/mailbox/Kconfig
@@ -127,6 +127,7 @@ config XGENE_SLIMPRO_MBOX
 config BCM_PDC_MBOX
         tristate "Broadcom PDC Mailbox"
         depends on ARM64 || COMPILE_TEST
+        depends on HAS_DMA
         default ARCH_BCM_IPROC
         help
           Mailbox implementation for the Broadcom PDC ring manager,
diff --git a/drivers/mailbox/bcm-pdc-mailbox.c b/drivers/mailbox/bcm-pdc-mailbox.c
index cbe0c1ee4ba9..c19dd820ea9b 100644
--- a/drivers/mailbox/bcm-pdc-mailbox.c
+++ b/drivers/mailbox/bcm-pdc-mailbox.c
@@ -469,7 +469,7 @@ static const struct file_operations pdc_debugfs_stats = {
  * this directory for a SPU.
  * @pdcs: PDC state structure
  */
-void pdc_setup_debugfs(struct pdc_state *pdcs)
+static void pdc_setup_debugfs(struct pdc_state *pdcs)
 {
         char spu_stats_name[16];
 
@@ -485,7 +485,7 @@ void pdc_setup_debugfs(struct pdc_state *pdcs)
                                                   &pdc_debugfs_stats);
 }
 
-void pdc_free_debugfs(void)
+static void pdc_free_debugfs(void)
 {
         if (debugfs_dir && simple_empty(debugfs_dir)) {
                 debugfs_remove_recursive(debugfs_dir);
@@ -1191,10 +1191,11 @@ static void pdc_shutdown(struct mbox_chan *chan)
 {
         struct pdc_state *pdcs = chan->con_priv;
 
-        if (pdcs)
-                dev_dbg(&pdcs->pdev->dev,
-                        "Shutdown mailbox channel for PDC %u", pdcs->pdc_idx);
+        if (!pdcs)
+                return;
 
+        dev_dbg(&pdcs->pdev->dev,
+                "Shutdown mailbox channel for PDC %u", pdcs->pdc_idx);
         pdc_ring_free(pdcs);
 }
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 67642bacd597..915e84d631a2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7610,16 +7610,12 @@ EXPORT_SYMBOL(unregister_md_cluster_operations);
 
 int md_setup_cluster(struct mddev *mddev, int nodes)
 {
-        int err;
-
-        err = request_module("md-cluster");
-        if (err) {
-                pr_err("md-cluster module not found.\n");
-                return -ENOENT;
-        }
-
+        if (!md_cluster_ops)
+                request_module("md-cluster");
         spin_lock(&pers_lock);
+        /* ensure module won't be unloaded */
         if (!md_cluster_ops || !try_module_get(md_cluster_mod)) {
+                pr_err("can't find md-cluster module or get it's reference.\n");
                 spin_unlock(&pers_lock);
                 return -ENOENT;
         }
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 51f76ddbe265..1b1ab4a1d132 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -96,7 +96,6 @@ struct r5l_log {
         spinlock_t no_space_stripes_lock;
 
         bool need_cache_flush;
-        bool in_teardown;
 };
 
 /*
@@ -704,31 +703,22 @@ static void r5l_write_super_and_discard_space(struct r5l_log *log,
 
         mddev = log->rdev->mddev;
         /*
-         * This is to avoid a deadlock. r5l_quiesce holds reconfig_mutex and
-         * wait for this thread to finish. This thread waits for
-         * MD_CHANGE_PENDING clear, which is supposed to be done in
-         * md_check_recovery(). md_check_recovery() tries to get
-         * reconfig_mutex. Since r5l_quiesce already holds the mutex,
-         * md_check_recovery() fails, so the PENDING never get cleared. The
-         * in_teardown check workaround this issue.
+         * Discard could zero data, so before discard we must make sure
+         * superblock is updated to new log tail. Updating superblock (either
+         * directly call md_update_sb() or depend on md thread) must hold
+         * reconfig mutex. On the other hand, raid5_quiesce is called with
+         * reconfig_mutex hold. The first step of raid5_quiesce() is waitting
+         * for all IO finish, hence waitting for reclaim thread, while reclaim
+         * thread is calling this function and waitting for reconfig mutex. So
+         * there is a deadlock. We workaround this issue with a trylock.
+         * FIXME: we could miss discard if we can't take reconfig mutex
          */
-        if (!log->in_teardown) {
-                set_mask_bits(&mddev->flags, 0,
-                              BIT(MD_CHANGE_DEVS) | BIT(MD_CHANGE_PENDING));
-                md_wakeup_thread(mddev->thread);
-                wait_event(mddev->sb_wait,
-                        !test_bit(MD_CHANGE_PENDING, &mddev->flags) ||
-                        log->in_teardown);
-                /*
-                 * r5l_quiesce could run after in_teardown check and hold
-                 * mutex first. Superblock might get updated twice.
-                 */
-                if (log->in_teardown)
-                        md_update_sb(mddev, 1);
-        } else {
-                WARN_ON(!mddev_is_locked(mddev));
-                md_update_sb(mddev, 1);
-        }
+        set_mask_bits(&mddev->flags, 0,
+                BIT(MD_CHANGE_DEVS) | BIT(MD_CHANGE_PENDING));
+        if (!mddev_trylock(mddev))
+                return;
+        md_update_sb(mddev, 1);
+        mddev_unlock(mddev);
 
         /* discard IO error really doesn't matter, ignore it */
         if (log->last_checkpoint < end) {
@@ -827,7 +817,6 @@ void r5l_quiesce(struct r5l_log *log, int state)
         if (!log || state == 2)
                 return;
         if (state == 0) {
-                log->in_teardown = 0;
                 /*
                  * This is a special case for hotadd. In suspend, the array has
                  * no journal. In resume, journal is initialized as well as the
@@ -838,11 +827,6 @@ void r5l_quiesce(struct r5l_log *log, int state)
                 log->reclaim_thread = md_register_thread(r5l_reclaim_thread,
                                         log->rdev->mddev, "reclaim");
         } else if (state == 1) {
-                /*
-                 * at this point all stripes are finished, so io_unit is at
-                 * least in STRIPE_END state
-                 */
-                log->in_teardown = 1;
                 /* make sure r5l_write_super_and_discard_space exits */
                 mddev = log->rdev->mddev;
                 wake_up(&mddev->sb_wait);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index da583bb43c84..ee7fc3701700 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2423,10 +2423,10 @@ static void raid5_end_read_request(struct bio * bi)
                 }
         }
         rdev_dec_pending(rdev, conf->mddev);
+        bio_reset(bi);
         clear_bit(R5_LOCKED, &sh->dev[i].flags);
         set_bit(STRIPE_HANDLE, &sh->state);
         raid5_release_stripe(sh);
-        bio_reset(bi);
 }
 
 static void raid5_end_write_request(struct bio *bi)
@@ -2498,6 +2498,7 @@ static void raid5_end_write_request(struct bio *bi)
         if (sh->batch_head && bi->bi_error && !replacement)
                 set_bit(STRIPE_BATCH_ERR, &sh->batch_head->state);
 
+        bio_reset(bi);
         if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags))
                 clear_bit(R5_LOCKED, &sh->dev[i].flags);
         set_bit(STRIPE_HANDLE, &sh->state);
@@ -2505,7 +2506,6 @@ static void raid5_end_write_request(struct bio *bi)
 
         if (sh->batch_head && sh != sh->batch_head)
                 raid5_release_stripe(sh->batch_head);
-        bio_reset(bi);
 }
 
 static void raid5_build_block(struct stripe_head *sh, int i, int previous)
@@ -6639,6 +6639,16 @@ static struct r5conf *setup_conf(struct mddev *mddev)
         }
 
         conf->min_nr_stripes = NR_STRIPES;
+        if (mddev->reshape_position != MaxSector) {
+                int stripes = max_t(int,
+                        ((mddev->chunk_sectors << 9) / STRIPE_SIZE) * 4,
+                        ((mddev->new_chunk_sectors << 9) / STRIPE_SIZE) * 4);
+                conf->min_nr_stripes = max(NR_STRIPES, stripes);
+                if (conf->min_nr_stripes != NR_STRIPES)
+                        printk(KERN_INFO
+                                "md/raid:%s: force stripe size %d for reshape\n",
+                                mdname(mddev), conf->min_nr_stripes);
+        }
         memory = conf->min_nr_stripes * (sizeof(struct stripe_head) +
                  max_disks * ((sizeof(struct bio) + PAGE_SIZE))) / 1024;
         atomic_set(&conf->empty_inactive_list_nr, NR_STRIPE_HASH_LOCKS);
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index 869c83fb3c5d..f00f3e742265 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -2185,7 +2185,7 @@ static int gpmc_probe_dt(struct platform_device *pdev)
         return 0;
 }
 
-static int gpmc_probe_dt_children(struct platform_device *pdev)
+static void gpmc_probe_dt_children(struct platform_device *pdev)
 {
         int ret;
         struct device_node *child;
@@ -2200,11 +2200,11 @@ static int gpmc_probe_dt_children(struct platform_device *pdev)
                 else
                         ret = gpmc_probe_generic_child(pdev, child);
 
-                if (ret)
-                        return ret;
+                if (ret) {
+                        dev_err(&pdev->dev, "failed to probe DT child '%s': %d\n",
+                                child->name, ret);
+                }
         }
-
-        return 0;
 }
 #else
 static int gpmc_probe_dt(struct platform_device *pdev)
@@ -2212,9 +2212,8 @@ static int gpmc_probe_dt(struct platform_device *pdev)
         return 0;
 }
 
-static int gpmc_probe_dt_children(struct platform_device *pdev)
+static void gpmc_probe_dt_children(struct platform_device *pdev)
 {
-        return 0;
 }
 #endif /* CONFIG_OF */
 
@@ -2369,16 +2368,10 @@ static int gpmc_probe(struct platform_device *pdev)
                 goto setup_irq_failed;
         }
 
-        rc = gpmc_probe_dt_children(pdev);
-        if (rc < 0) {
-                dev_err(gpmc->dev, "failed to probe DT children\n");
-                goto dt_children_failed;
-        }
+        gpmc_probe_dt_children(pdev);
 
         return 0;
 
-dt_children_failed:
-        gpmc_free_irq(gpmc);
 setup_irq_failed:
         gpmc_gpio_exit(gpmc);
 gpio_init_failed:
diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c
index 5525a204db93..1dd611423d8b 100644
--- a/drivers/misc/lkdtm_usercopy.c
+++ b/drivers/misc/lkdtm_usercopy.c
@@ -9,7 +9,15 @@
 #include <linux/uaccess.h>
 #include <asm/cacheflush.h>
 
-static size_t cache_size = 1024;
+/*
+ * Many of the tests here end up using const sizes, but those would
+ * normally be ignored by hardened usercopy, so force the compiler
+ * into choosing the non-const path to make sure we trigger the
+ * hardened usercopy checks by added "unconst" to all the const copies,
+ * and making sure "cache_size" isn't optimized into a const.
+ */
+static volatile size_t unconst = 0;
+static volatile size_t cache_size = 1024;
 static struct kmem_cache *bad_cache;
 
 static const unsigned char test_text[] = "This is a test.\n";
@@ -67,14 +75,14 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
         if (to_user) {
                 pr_info("attempting good copy_to_user of local stack\n");
                 if (copy_to_user((void __user *)user_addr, good_stack,
-                                 sizeof(good_stack))) {
+                                 unconst + sizeof(good_stack))) {
                         pr_warn("copy_to_user failed unexpectedly?!\n");
                         goto free_user;
                 }
 
                 pr_info("attempting bad copy_to_user of distant stack\n");
                 if (copy_to_user((void __user *)user_addr, bad_stack,
-                                 sizeof(good_stack))) {
+                                 unconst + sizeof(good_stack))) {
                         pr_warn("copy_to_user failed, but lacked Oops\n");
                         goto free_user;
                 }
@@ -88,14 +96,14 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
 
                 pr_info("attempting good copy_from_user of local stack\n");
                 if (copy_from_user(good_stack, (void __user *)user_addr,
-                                   sizeof(good_stack))) {
+                                   unconst + sizeof(good_stack))) {
                         pr_warn("copy_from_user failed unexpectedly?!\n");
                         goto free_user;
                 }
 
                 pr_info("attempting bad copy_from_user of distant stack\n");
                 if (copy_from_user(bad_stack, (void __user *)user_addr,
-                                   sizeof(good_stack))) {
+                                   unconst + sizeof(good_stack))) {
                         pr_warn("copy_from_user failed, but lacked Oops\n");
                         goto free_user;
                 }
@@ -109,7 +117,7 @@ static void do_usercopy_heap_size(bool to_user)
 {
         unsigned long user_addr;
         unsigned char *one, *two;
-        const size_t size = 1024;
+        size_t size = unconst + 1024;
 
         one = kmalloc(size, GFP_KERNEL);
         two = kmalloc(size, GFP_KERNEL);
@@ -285,13 +293,14 @@ void lkdtm_USERCOPY_KERNEL(void)
 
         pr_info("attempting good copy_to_user from kernel rodata\n");
         if (copy_to_user((void __user *)user_addr, test_text,
-                         sizeof(test_text))) {
+                         unconst + sizeof(test_text))) {
                 pr_warn("copy_to_user failed unexpectedly?!\n");
                 goto free_user;
         }
 
         pr_info("attempting bad copy_to_user from kernel text\n");
-        if (copy_to_user((void __user *)user_addr, vm_mmap, PAGE_SIZE)) {
+        if (copy_to_user((void __user *)user_addr, vm_mmap,
+                         unconst + PAGE_SIZE)) {
                 pr_warn("copy_to_user failed, but lacked Oops\n");
                 goto free_user;
         }
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index f23d65eb070d..be3c49fa7382 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -1016,14 +1016,16 @@ mmc_omap_prepare_data(struct mmc_omap_host *host, struct mmc_request *req)
 
                 /* Only reconfigure if we have a different burst size */
                 if (*bp != burst) {
-                        struct dma_slave_config cfg;
-
-                        cfg.src_addr = host->phys_base + OMAP_MMC_REG(host, DATA);
-                        cfg.dst_addr = host->phys_base + OMAP_MMC_REG(host, DATA);
-                        cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
-                        cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
-                        cfg.src_maxburst = burst;
-                        cfg.dst_maxburst = burst;
+                        struct dma_slave_config cfg = {
+                                .src_addr = host->phys_base +
+                                            OMAP_MMC_REG(host, DATA),
+                                .dst_addr = host->phys_base +
+                                            OMAP_MMC_REG(host, DATA),
+                                .src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES,
+                                .dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES,
+                                .src_maxburst = burst,
+                                .dst_maxburst = burst,
+                        };
 
                         if (dmaengine_slave_config(c, &cfg))
                                 goto use_pio;
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 24ebc9a8de89..5f2f24a7360d 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1409,11 +1409,18 @@ static int omap_hsmmc_pre_dma_transfer(struct omap_hsmmc_host *host,
 static int omap_hsmmc_setup_dma_transfer(struct omap_hsmmc_host *host,
                                         struct mmc_request *req)
 {
-        struct dma_slave_config cfg;
         struct dma_async_tx_descriptor *tx;
         int ret = 0, i;
         struct mmc_data *data = req->data;
         struct dma_chan *chan;
+        struct dma_slave_config cfg = {
+                .src_addr = host->mapbase + OMAP_HSMMC_DATA,
+                .dst_addr = host->mapbase + OMAP_HSMMC_DATA,
+                .src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
+                .dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
+                .src_maxburst = data->blksz / 4,
+                .dst_maxburst = data->blksz / 4,
+        };
 
         /* Sanity check: all the SG entries must be aligned by block size. */
         for (i = 0; i < data->sg_len; i++) {
@@ -1433,13 +1440,6 @@ static int omap_hsmmc_setup_dma_transfer(struct omap_hsmmc_host *host,
 
         chan = omap_hsmmc_get_dma_chan(host, data);
 
-        cfg.src_addr = host->mapbase + OMAP_HSMMC_DATA;
-        cfg.dst_addr = host->mapbase + OMAP_HSMMC_DATA;
-        cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        cfg.src_maxburst = data->blksz / 4;
-        cfg.dst_maxburst = data->blksz / 4;
-
         ret = dmaengine_slave_config(chan, &cfg);
         if (ret)
                 return ret;
diff --git a/drivers/mmc/host/sdhci-st.c b/drivers/mmc/host/sdhci-st.c
index c95ba83366a0..ed92ce729dde 100644
--- a/drivers/mmc/host/sdhci-st.c
+++ b/drivers/mmc/host/sdhci-st.c
@@ -28,6 +28,7 @@
 
 struct st_mmc_platform_data {
         struct  reset_control *rstc;
+        struct  clk *icnclk;
         void __iomem *top_ioaddr;
 };
 
@@ -353,7 +354,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         struct sdhci_host *host;
         struct st_mmc_platform_data *pdata;
         struct sdhci_pltfm_host *pltfm_host;
-        struct clk *clk;
+        struct clk *clk, *icnclk;
         int ret = 0;
         u16 host_version;
         struct resource *res;
@@ -365,6 +366,11 @@ static int sdhci_st_probe(struct platform_device *pdev)
                 return PTR_ERR(clk);
         }
 
+        /* ICN clock isn't compulsory, but use it if it's provided. */
+        icnclk = devm_clk_get(&pdev->dev, "icn");
+        if (IS_ERR(icnclk))
+                icnclk = NULL;
+
         rstc = devm_reset_control_get(&pdev->dev, NULL);
         if (IS_ERR(rstc))
                 rstc = NULL;
@@ -389,6 +395,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         }
 
         clk_prepare_enable(clk);
+        clk_prepare_enable(icnclk);
 
         /* Configure the FlashSS Top registers for setting eMMC TX/RX delay */
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -400,6 +407,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         }
 
         pltfm_host->clk = clk;
+        pdata->icnclk = icnclk;
 
         /* Configure the Arasan HC inside the flashSS */
         st_mmcss_cconfig(np, host);
@@ -422,6 +430,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         return 0;
 
 err_out:
+        clk_disable_unprepare(icnclk);
         clk_disable_unprepare(clk);
 err_of:
         sdhci_pltfm_free(pdev);
@@ -442,6 +451,8 @@ static int sdhci_st_remove(struct platform_device *pdev)
 
         ret = sdhci_pltfm_unregister(pdev);
 
+        clk_disable_unprepare(pdata->icnclk);
+
         if (rstc)
                 reset_control_assert(rstc);
 
@@ -462,6 +473,7 @@ static int sdhci_st_suspend(struct device *dev)
         if (pdata->rstc)
                 reset_control_assert(pdata->rstc);
 
+        clk_disable_unprepare(pdata->icnclk);
         clk_disable_unprepare(pltfm_host->clk);
 out:
         return ret;
@@ -475,6 +487,7 @@ static int sdhci_st_resume(struct device *dev)
         struct device_node *np = dev->of_node;
 
         clk_prepare_enable(pltfm_host->clk);
+        clk_prepare_enable(pdata->icnclk);
 
         if (pdata->rstc)
                 reset_control_deassert(pdata->rstc);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 217e8da0628c..9599ed6f1213 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1341,9 +1341,10 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                             slave_dev->name);
         }
 
-        /* already enslaved */
-        if (slave_dev->flags & IFF_SLAVE) {
-                netdev_dbg(bond_dev, "Error: Device was already enslaved\n");
+        /* already in-use? */
+        if (netdev_is_rx_handler_busy(slave_dev)) {
+                netdev_err(bond_dev,
+                           "Error: Device is in use and cannot be enslaved\n");
                 return -EBUSY;
         }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 97e892511666..fa3386bb14f7 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -772,6 +772,11 @@ void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
                 (bp->common.bc_ver & 0xff00) >> 8,
                 (bp->common.bc_ver & 0xff));
 
+        if (pci_channel_offline(bp->pdev)) {
+                BNX2X_ERR("Cannot dump MCP info while in PCI error\n");
+                return;
+        }
+
         val = REG_RD(bp, MCP_REG_MCPR_CPU_PROGRAM_COUNTER);
         if (val == REG_RD(bp, MCP_REG_MCPR_CPU_PROGRAM_COUNTER))
                 BNX2X_ERR("%s" "MCP PC at 0x%x\n", lvl, val);
@@ -9415,10 +9420,16 @@ unload_error:
         /* Release IRQs */
         bnx2x_free_irq(bp);
 
-        /* Reset the chip */
-        rc = bnx2x_reset_hw(bp, reset_code);
-        if (rc)
-                BNX2X_ERR("HW_RESET failed\n");
+        /* Reset the chip, unless PCI function is offline. If we reach this
+         * point following a PCI error handling, it means device is really
+         * in a bad state and we're about to remove it, so reset the chip
+         * is not a good idea.
+         */
+        if (!pci_channel_offline(bp->pdev)) {
+                rc = bnx2x_reset_hw(bp, reset_code);
+                if (rc)
+                        BNX2X_ERR("HW_RESET failed\n");
+        }
 
         /* Report UNLOAD_DONE to MCP */
         bnx2x_send_unload_done(bp, keep_link);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 2cf79100c9cb..228c964e709a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -353,8 +353,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 push_len = (length + sizeof(*tx_push) + 7) / 8;
                 if (push_len > 16) {
                         __iowrite64_copy(txr->tx_doorbell, tx_push_buf, 16);
-                        __iowrite64_copy(txr->tx_doorbell + 4, tx_push_buf + 1,
-                                         push_len - 16);
+                        __iowrite32_copy(txr->tx_doorbell + 4, tx_push_buf + 1,
+                                         (push_len - 16) << 1);
                 } else {
                         __iowrite64_copy(txr->tx_doorbell, tx_push_buf,
                                          push_len);
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 659261218d9f..a2551bcd1027 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -14012,6 +14012,7 @@ static int tg3_set_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
         if ((ec->rx_coalesce_usecs > MAX_RXCOL_TICKS) ||
             (!ec->rx_coalesce_usecs) ||
             (ec->tx_coalesce_usecs > MAX_TXCOL_TICKS) ||
+            (!ec->tx_coalesce_usecs) ||
             (ec->rx_max_coalesced_frames > MAX_RXMAX_FRAMES) ||
             (ec->tx_max_coalesced_frames > MAX_TXMAX_FRAMES) ||
             (ec->rx_coalesce_usecs_irq > max_rxcoal_tick_int) ||
@@ -14022,16 +14023,6 @@ static int tg3_set_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
             (ec->stats_block_coalesce_usecs < min_stat_coal_ticks))
                 return -EINVAL;
 
-        /* No rx interrupts will be generated if both are zero */
-        if ((ec->rx_coalesce_usecs == 0) &&
-            (ec->rx_max_coalesced_frames == 0))
-                return -EINVAL;
-
-        /* No tx interrupts will be generated if both are zero */
-        if ((ec->tx_coalesce_usecs == 0) &&
-            (ec->tx_max_coalesced_frames == 0))
-                return -EINVAL;
-
         /* Only copy relevant parameters, ignore all others. */
         tp->coal.rx_coalesce_usecs = ec->rx_coalesce_usecs;
         tp->coal.tx_coalesce_usecs = ec->tx_coalesce_usecs;
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 89c0cfa9719f..d954a97b0b0b 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -1323,6 +1323,24 @@ dma_error:
         return 0;
 }
 
+static inline int macb_clear_csum(struct sk_buff *skb)
+{
+        /* no change for packets without checksum offloading */
+        if (skb->ip_summed != CHECKSUM_PARTIAL)
+                return 0;
+
+        /* make sure we can modify the header */
+        if (unlikely(skb_cow_head(skb, 0)))
+                return -1;
+
+        /* initialize checksum field
+         * This is required - at least for Zynq, which otherwise calculates
+         * wrong UDP header checksums for UDP packets with UDP data len <=2
+         */
+        *(__sum16 *)(skb_checksum_start(skb) + skb->csum_offset) = 0;
+        return 0;
+}
+
 static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         u16 queue_index = skb_get_queue_mapping(skb);
@@ -1362,6 +1380,11 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
+        if (macb_clear_csum(skb)) {
+                dev_kfree_skb_any(skb);
+                return NETDEV_TX_OK;
+        }
+
         /* Map socket buffer for DMA transfer */
         if (!macb_tx_map(bp, queue, skb)) {
                 dev_kfree_skb_any(skb);
diff --git a/drivers/net/ethernet/cavium/thunder/nic.h b/drivers/net/ethernet/cavium/thunder/nic.h
index 83025bb4737c..e29815d9e6f4 100644
--- a/drivers/net/ethernet/cavium/thunder/nic.h
+++ b/drivers/net/ethernet/cavium/thunder/nic.h
@@ -279,6 +279,7 @@ struct nicvf {
         u8                      sqs_id;
         bool                    sqs_mode;
         bool                    hw_tso;
+        bool                    t88;
 
         /* Receive buffer alloc */
         u32                     rb_page_offset;
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 16ed20357c5c..85cc782b9060 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -251,9 +251,14 @@ static void nic_set_tx_pkt_pad(struct nicpf *nic, int size)
         int lmac;
         u64 lmac_cfg;
 
-        /* Max value that can be set is 60 */
-        if (size > 60)
-                size = 60;
+        /* There is a issue in HW where-in while sending GSO sized
+         * pkts as part of TSO, if pkt len falls below this size
+         * NIC will zero PAD packet and also updates IP total length.
+         * Hence set this value to lessthan min pkt size of MAC+IP+TCP
+         * headers, BGX will do the padding to transmit 64 byte pkt.
+         */
+        if (size > 52)
+                size = 52;
 
         for (lmac = 0; lmac < (MAX_BGX_PER_CN88XX * MAX_LMAC_PER_BGX); lmac++) {
                 lmac_cfg = nic_reg_read(nic, NIC_PF_LMAC_0_7_CFG | (lmac << 3));
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index a19e73f11d73..3240349615bd 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -513,6 +513,7 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
         struct nicvf *nic = netdev_priv(netdev);
         struct snd_queue *sq;
         struct sq_hdr_subdesc *hdr;
+        struct sq_hdr_subdesc *tso_sqe;
 
         sq = &nic->qs->sq[cqe_tx->sq_idx];
 
@@ -527,17 +528,21 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
 
         nicvf_check_cqe_tx_errs(nic, cq, cqe_tx);
         skb = (struct sk_buff *)sq->skbuff[cqe_tx->sqe_ptr];
-        /* For TSO offloaded packets only one SQE will have a valid SKB */
         if (skb) {
+                /* Check for dummy descriptor used for HW TSO offload on 88xx */
+                if (hdr->dont_send) {
+                        /* Get actual TSO descriptors and free them */
+                        tso_sqe =
+                         (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, hdr->rsvd2);
+                        nicvf_put_sq_desc(sq, tso_sqe->subdesc_cnt + 1);
+                }
                 nicvf_put_sq_desc(sq, hdr->subdesc_cnt + 1);
                 prefetch(skb);
                 dev_consume_skb_any(skb);
                 sq->skbuff[cqe_tx->sqe_ptr] = (u64)NULL;
         } else {
-                /* In case of HW TSO, HW sends a CQE for each segment of a TSO
-                 * packet instead of a single CQE for the whole TSO packet
-                 * transmitted. Each of this CQE points to the same SQE, so
-                 * avoid freeing same SQE multiple times.
+                /* In case of SW TSO on 88xx, only last segment will have
+                 * a SKB attached, so just free SQEs here.
                  */
                 if (!nic->hw_tso)
                         nicvf_put_sq_desc(sq, hdr->subdesc_cnt + 1);
@@ -1502,6 +1507,7 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct net_device *netdev;
         struct nicvf *nic;
         int    err, qcount;
+        u16    sdevid;
 
         err = pci_enable_device(pdev);
         if (err) {
@@ -1575,6 +1581,10 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!pass1_silicon(nic->pdev))
                 nic->hw_tso = true;
 
+        pci_read_config_word(nic->pdev, PCI_SUBSYSTEM_ID, &sdevid);
+        if (sdevid == 0xA134)
+                nic->t88 = true;
+
         /* Check if this VF is in QS only mode */
         if (nic->sqs_mode)
                 return 0;
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 0ff8e60deccb..dda3ea3f3bb6 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -938,6 +938,8 @@ static int nicvf_tso_count_subdescs(struct sk_buff *skb)
         return num_edescs + sh->gso_segs;
 }
 
+#define POST_CQE_DESC_COUNT 2
+
 /* Get the number of SQ descriptors needed to xmit this skb */
 static int nicvf_sq_subdesc_required(struct nicvf *nic, struct sk_buff *skb)
 {
@@ -948,6 +950,10 @@ static int nicvf_sq_subdesc_required(struct nicvf *nic, struct sk_buff *skb)
                 return subdesc_cnt;
         }
 
+        /* Dummy descriptors to get TSO pkt completion notification */
+        if (nic->t88 && nic->hw_tso && skb_shinfo(skb)->gso_size)
+                subdesc_cnt += POST_CQE_DESC_COUNT;
+
         if (skb_shinfo(skb)->nr_frags)
                 subdesc_cnt += skb_shinfo(skb)->nr_frags;
 
@@ -965,14 +971,21 @@ nicvf_sq_add_hdr_subdesc(struct nicvf *nic, struct snd_queue *sq, int qentry,
         struct sq_hdr_subdesc *hdr;
 
         hdr = (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, qentry);
-        sq->skbuff[qentry] = (u64)skb;
-
         memset(hdr, 0, SND_QUEUE_DESC_SIZE);
         hdr->subdesc_type = SQ_DESC_TYPE_HEADER;
-        /* Enable notification via CQE after processing SQE */
-        hdr->post_cqe = 1;
-        /* No of subdescriptors following this */
-        hdr->subdesc_cnt = subdesc_cnt;
+
+        if (nic->t88 && nic->hw_tso && skb_shinfo(skb)->gso_size) {
+                /* post_cqe = 0, to avoid HW posting a CQE for every TSO
+                 * segment transmitted on 88xx.
+                 */
+                hdr->subdesc_cnt = subdesc_cnt - POST_CQE_DESC_COUNT;
+        } else {
+                sq->skbuff[qentry] = (u64)skb;
+                /* Enable notification via CQE after processing SQE */
+                hdr->post_cqe = 1;
+                /* No of subdescriptors following this */
+                hdr->subdesc_cnt = subdesc_cnt;
+        }
         hdr->tot_len = len;
 
         /* Offload checksum calculation to HW */
@@ -1023,6 +1036,37 @@ static inline void nicvf_sq_add_gather_subdesc(struct snd_queue *sq, int qentry,
         gather->addr = data;
 }
 
+/* Add HDR + IMMEDIATE subdescriptors right after descriptors of a TSO
+ * packet so that a CQE is posted as a notifation for transmission of
+ * TSO packet.
+ */
+static inline void nicvf_sq_add_cqe_subdesc(struct snd_queue *sq, int qentry,
+                                            int tso_sqe, struct sk_buff *skb)
+{
+        struct sq_imm_subdesc *imm;
+        struct sq_hdr_subdesc *hdr;
+
+        sq->skbuff[qentry] = (u64)skb;
+
+        hdr = (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, qentry);
+        memset(hdr, 0, SND_QUEUE_DESC_SIZE);
+        hdr->subdesc_type = SQ_DESC_TYPE_HEADER;
+        /* Enable notification via CQE after processing SQE */
+        hdr->post_cqe = 1;
+        /* There is no packet to transmit here */
+        hdr->dont_send = 1;
+        hdr->subdesc_cnt = POST_CQE_DESC_COUNT - 1;
+        hdr->tot_len = 1;
+        /* Actual TSO header SQE index, needed for cleanup */
+        hdr->rsvd2 = tso_sqe;
+
+        qentry = nicvf_get_nxt_sqentry(sq, qentry);
+        imm = (struct sq_imm_subdesc *)GET_SQ_DESC(sq, qentry);
+        memset(imm, 0, SND_QUEUE_DESC_SIZE);
+        imm->subdesc_type = SQ_DESC_TYPE_IMMEDIATE;
+        imm->len = 1;
+}
+
 /* Segment a TSO packet into 'gso_size' segments and append
  * them to SQ for transfer
  */
@@ -1096,7 +1140,7 @@ static int nicvf_sq_append_tso(struct nicvf *nic, struct snd_queue *sq,
 int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
 {
         int i, size;
-        int subdesc_cnt;
+        int subdesc_cnt, tso_sqe = 0;
         int sq_num, qentry;
         struct queue_set *qs;
         struct snd_queue *sq;
@@ -1131,6 +1175,7 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
         /* Add SQ header subdesc */
         nicvf_sq_add_hdr_subdesc(nic, sq, qentry, subdesc_cnt - 1,
                                  skb, skb->len);
+        tso_sqe = qentry;
 
         /* Add SQ gather subdescs */
         qentry = nicvf_get_nxt_sqentry(sq, qentry);
@@ -1154,6 +1199,11 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
         }
 
 doorbell:
+        if (nic->t88 && skb_shinfo(skb)->gso_size) {
+                qentry = nicvf_get_nxt_sqentry(sq, qentry);
+                nicvf_sq_add_cqe_subdesc(sq, qentry, tso_sqe, skb);
+        }
+
         /* make sure all memory stores are done before ringing doorbell */
         smp_wmb();
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 828ed28c3c14..d0b3a1bb82ca 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -5113,9 +5113,13 @@ static int i40e_init_pf_dcb(struct i40e_pf *pf)
                                        DCB_CAP_DCBX_VER_IEEE;
 
                         pf->flags |= I40E_FLAG_DCB_CAPABLE;
-                        /* Enable DCB tagging only when more than one TC */
+                        /* Enable DCB tagging only when more than one TC
+                         * or explicitly disable if only one TC
+                         */
                         if (i40e_dcb_get_num_tc(&hw->local_dcbx_config) > 1)
                                 pf->flags |= I40E_FLAG_DCB_ENABLED;
+                        else
+                                pf->flags &= ~I40E_FLAG_DCB_ENABLED;
                         dev_dbg(&pf->pdev->dev,
                                 "DCBX offload is supported for this PF.\n");
                 }
@@ -5716,7 +5720,7 @@ static int i40e_handle_lldp_event(struct i40e_pf *pf,
         u8 type;
 
         /* Not DCB capable or capability disabled */
-        if (!(pf->flags & I40E_FLAG_DCB_CAPABLE))
+        if (!(pf->flags & I40E_FLAG_DCB_ENABLED))
                 return ret;
 
         /* Ignore if event is not for Nearest Bridge */
@@ -7896,6 +7900,7 @@ static int i40e_init_interrupt_scheme(struct i40e_pf *pf)
 #endif
                                        I40E_FLAG_RSS_ENABLED    |
                                        I40E_FLAG_DCB_CAPABLE    |
+                                       I40E_FLAG_DCB_ENABLED    |
                                        I40E_FLAG_SRIOV_ENABLED  |
                                        I40E_FLAG_FD_SB_ENABLED  |
                                        I40E_FLAG_FD_ATR_ENABLED |
@@ -10502,6 +10507,7 @@ static void i40e_determine_queue_usage(struct i40e_pf *pf)
                                I40E_FLAG_FD_SB_ENABLED  |
                                I40E_FLAG_FD_ATR_ENABLED |
                                I40E_FLAG_DCB_CAPABLE    |
+                               I40E_FLAG_DCB_ENABLED    |
                                I40E_FLAG_SRIOV_ENABLED  |
                                I40E_FLAG_VMDQ_ENABLED);
         } else if (!(pf->flags & (I40E_FLAG_RSS_ENABLED |
@@ -10525,7 +10531,8 @@ static void i40e_determine_queue_usage(struct i40e_pf *pf)
                 /* Not enough queues for all TCs */
                 if ((pf->flags & I40E_FLAG_DCB_CAPABLE) &&
                     (queues_left < I40E_MAX_TRAFFIC_CLASS)) {
-                        pf->flags &= ~I40E_FLAG_DCB_CAPABLE;
+                        pf->flags &= ~(I40E_FLAG_DCB_CAPABLE |
+                                        I40E_FLAG_DCB_ENABLED);
                         dev_info(&pf->pdev->dev, "not enough queues for DCB. DCB is disabled.\n");
                 }
                 pf->num_lan_qps = max_t(int, pf->rss_size_max,
@@ -10922,7 +10929,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         err = i40e_init_pf_dcb(pf);
         if (err) {
                 dev_info(&pdev->dev, "DCB init failed %d, disabled\n", err);
-                pf->flags &= ~I40E_FLAG_DCB_CAPABLE;
+                pf->flags &= ~(I40E_FLAG_DCB_CAPABLE & I40E_FLAG_DCB_ENABLED);
                 /* Continue without DCB enabled */
         }
 #endif /* CONFIG_I40E_DCB */
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index f1609542adf1..d9199151a83e 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -50,6 +50,10 @@ static const struct mtk_ethtool_stats {
         MTK_ETHTOOL_STAT(rx_flow_control_packets),
 };
 
+static const char * const mtk_clks_source_name[] = {
+        "ethif", "esw", "gp1", "gp2"
+};
+
 void mtk_w32(struct mtk_eth *eth, u32 val, unsigned reg)
 {
         __raw_writel(val, eth->base + reg);
@@ -291,7 +295,7 @@ err_phy:
 static int mtk_mdio_init(struct mtk_eth *eth)
 {
         struct device_node *mii_np;
-        int err;
+        int ret;
 
         mii_np = of_get_child_by_name(eth->dev->of_node, "mdio-bus");
         if (!mii_np) {
@@ -300,13 +304,13 @@ static int mtk_mdio_init(struct mtk_eth *eth)
         }
 
         if (!of_device_is_available(mii_np)) {
-                err = 0;
+                ret = -ENODEV;
                 goto err_put_node;
         }
 
-        eth->mii_bus = mdiobus_alloc();
+        eth->mii_bus = devm_mdiobus_alloc(eth->dev);
         if (!eth->mii_bus) {
-                err = -ENOMEM;
+                ret = -ENOMEM;
                 goto err_put_node;
         }
 
@@ -317,19 +321,11 @@ static int mtk_mdio_init(struct mtk_eth *eth)
         eth->mii_bus->parent = eth->dev;
 
         snprintf(eth->mii_bus->id, MII_BUS_ID_SIZE, "%s", mii_np->name);
-        err = of_mdiobus_register(eth->mii_bus, mii_np);
-        if (err)
-                goto err_free_bus;
-
-        return 0;
-
-err_free_bus:
-        mdiobus_free(eth->mii_bus);
+        ret = of_mdiobus_register(eth->mii_bus, mii_np);
 
 err_put_node:
         of_node_put(mii_np);
-        eth->mii_bus = NULL;
-        return err;
+        return ret;
 }
 
 static void mtk_mdio_cleanup(struct mtk_eth *eth)
@@ -338,8 +334,6 @@ static void mtk_mdio_cleanup(struct mtk_eth *eth)
                 return;
 
         mdiobus_unregister(eth->mii_bus);
-        of_node_put(eth->mii_bus->dev.of_node);
-        mdiobus_free(eth->mii_bus);
 }
 
 static inline void mtk_irq_disable(struct mtk_eth *eth, u32 mask)
@@ -588,14 +582,15 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         dma_addr_t mapped_addr;
         unsigned int nr_frags;
         int i, n_desc = 1;
-        u32 txd4 = 0;
+        u32 txd4 = 0, fport;
 
         itxd = ring->next_free;
         if (itxd == ring->last_free)
                 return -ENOMEM;
 
         /* set the forward port */
-        txd4 |= (mac->id + 1) << TX_DMA_FPORT_SHIFT;
+        fport = (mac->id + 1) << TX_DMA_FPORT_SHIFT;
+        txd4 |= fport;
 
         tx_buf = mtk_desc_to_tx_buf(ring, itxd);
         memset(tx_buf, 0, sizeof(*tx_buf));
@@ -653,7 +648,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
                         WRITE_ONCE(txd->txd3, (TX_DMA_SWC |
                                                TX_DMA_PLEN0(frag_map_size) |
                                                last_frag * TX_DMA_LS0));
-                        WRITE_ONCE(txd->txd4, 0);
+                        WRITE_ONCE(txd->txd4, fport);
 
                         tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
                         tx_buf = mtk_desc_to_tx_buf(ring, txd);
@@ -865,7 +860,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                 /* receive data */
                 skb = build_skb(data, ring->frag_size);
                 if (unlikely(!skb)) {
-                        put_page(virt_to_head_page(new_data));
+                        skb_free_frag(new_data);
                         netdev->stats.rx_dropped++;
                         goto release_desc;
                 }
@@ -1506,10 +1501,7 @@ static void mtk_uninit(struct net_device *dev)
         struct mtk_eth *eth = mac->hw;
 
         phy_disconnect(mac->phy_dev);
-        mtk_mdio_cleanup(eth);
         mtk_irq_disable(eth, ~0);
-        free_irq(eth->irq[1], dev);
-        free_irq(eth->irq[2], dev);
 }
 
 static int mtk_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -1813,6 +1805,7 @@ static int mtk_probe(struct platform_device *pdev)
         if (!eth)
                 return -ENOMEM;
 
+        eth->dev = &pdev->dev;
         eth->base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(eth->base))
                 return PTR_ERR(eth->base);
@@ -1847,21 +1840,21 @@ static int mtk_probe(struct platform_device *pdev)
                         return -ENXIO;
                 }
         }
+        for (i = 0; i < ARRAY_SIZE(eth->clks); i++) {
+                eth->clks[i] = devm_clk_get(eth->dev,
+                                            mtk_clks_source_name[i]);
+                if (IS_ERR(eth->clks[i])) {
+                        if (PTR_ERR(eth->clks[i]) == -EPROBE_DEFER)
+                                return -EPROBE_DEFER;
+                        return -ENODEV;
+                }
+        }
 
-        eth->clk_ethif = devm_clk_get(&pdev->dev, "ethif");
-        eth->clk_esw = devm_clk_get(&pdev->dev, "esw");
-        eth->clk_gp1 = devm_clk_get(&pdev->dev, "gp1");
-        eth->clk_gp2 = devm_clk_get(&pdev->dev, "gp2");
-        if (IS_ERR(eth->clk_esw) || IS_ERR(eth->clk_gp1) ||
-            IS_ERR(eth->clk_gp2) || IS_ERR(eth->clk_ethif))
-                return -ENODEV;
-
-        clk_prepare_enable(eth->clk_ethif);
-        clk_prepare_enable(eth->clk_esw);
-        clk_prepare_enable(eth->clk_gp1);
-        clk_prepare_enable(eth->clk_gp2);
+        clk_prepare_enable(eth->clks[MTK_CLK_ETHIF]);
+        clk_prepare_enable(eth->clks[MTK_CLK_ESW]);
+        clk_prepare_enable(eth->clks[MTK_CLK_GP1]);
+        clk_prepare_enable(eth->clks[MTK_CLK_GP2]);
 
-        eth->dev = &pdev->dev;
         eth->msg_enable = netif_msg_init(mtk_msg_level, MTK_DEFAULT_MSG_ENABLE);
         INIT_WORK(&eth->pending_work, mtk_pending_work);
 
@@ -1903,15 +1896,24 @@ err_free_dev:
 static int mtk_remove(struct platform_device *pdev)
 {
         struct mtk_eth *eth = platform_get_drvdata(pdev);
+        int i;
 
-        clk_disable_unprepare(eth->clk_ethif);
-        clk_disable_unprepare(eth->clk_esw);
-        clk_disable_unprepare(eth->clk_gp1);
-        clk_disable_unprepare(eth->clk_gp2);
+        /* stop all devices to make sure that dma is properly shut down */
+        for (i = 0; i < MTK_MAC_COUNT; i++) {
+                if (!eth->netdev[i])
+                        continue;
+                mtk_stop(eth->netdev[i]);
+        }
+
+        clk_disable_unprepare(eth->clks[MTK_CLK_ETHIF]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_ESW]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_GP1]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_GP2]);
 
         netif_napi_del(&eth->tx_napi);
         netif_napi_del(&eth->rx_napi);
         mtk_cleanup(eth);
+        mtk_mdio_cleanup(eth);
         platform_set_drvdata(pdev, NULL);
 
         return 0;
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
index f82e3acb947b..6e1ade7a25c5 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -290,6 +290,17 @@ enum mtk_tx_flags {
         MTK_TX_FLAGS_PAGE0      = 0x02,
 };
 
+/* This enum allows us to identify how the clock is defined on the array of the
+ * clock in the order
+ */
+enum mtk_clks_map {
+        MTK_CLK_ETHIF,
+        MTK_CLK_ESW,
+        MTK_CLK_GP1,
+        MTK_CLK_GP2,
+        MTK_CLK_MAX
+};
+
 /* struct mtk_tx_buf -  This struct holds the pointers to the memory pointed at
  *                      by the TX descriptor    s
  * @skb:                The SKB pointer of the packet being sent
@@ -370,10 +381,7 @@ struct mtk_rx_ring {
  * @scratch_ring:       Newer SoCs need memory for a second HW managed TX ring
  * @phy_scratch_ring:   physical address of scratch_ring
  * @scratch_head:       The scratch memory that scratch_ring points to.
- * @clk_ethif:          The ethif clock
- * @clk_esw:            The switch clock
- * @clk_gp1:            The gmac1 clock
- * @clk_gp2:            The gmac2 clock
+ * @clks:               clock array for all clocks required
  * @mii_bus:            If there is a bus we need to create an instance for it
  * @pending_work:       The workqueue used to reset the dma ring
  */
@@ -400,10 +408,8 @@ struct mtk_eth {
         struct mtk_tx_dma               *scratch_ring;
         dma_addr_t                      phy_scratch_ring;
         void                            *scratch_head;
-        struct clk                      *clk_ethif;
-        struct clk                      *clk_esw;
-        struct clk                      *clk_gp1;
-        struct clk                      *clk_gp2;
+        struct clk                      *clks[MTK_CLK_MAX];
+
         struct mii_bus                  *mii_bus;
         struct work_struct              pending_work;
 };
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
index 99c6bbdff501..b04760a5034b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
@@ -94,7 +94,7 @@ static u8 mlx4_en_dcbnl_getcap(struct net_device *dev, int capid, u8 *cap)
                 *cap = true;
                 break;
         case DCB_CAP_ATTR_DCBX:
-                *cap = priv->cee_params.dcbx_cap;
+                *cap = priv->dcbx_cap;
                 break;
         case DCB_CAP_ATTR_PFC_TCS:
                 *cap = 1 <<  mlx4_max_tc(priv->mdev->dev);
@@ -111,14 +111,14 @@ static u8 mlx4_en_dcbnl_getpfcstate(struct net_device *netdev)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        return priv->cee_params.dcb_cfg.pfc_state;
+        return priv->cee_config.pfc_state;
 }
 
 static void mlx4_en_dcbnl_setpfcstate(struct net_device *netdev, u8 state)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        priv->cee_params.dcb_cfg.pfc_state = state;
+        priv->cee_config.pfc_state = state;
 }
 
 static void mlx4_en_dcbnl_get_pfc_cfg(struct net_device *netdev, int priority,
@@ -126,7 +126,7 @@ static void mlx4_en_dcbnl_get_pfc_cfg(struct net_device *netdev, int priority,
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        *setting = priv->cee_params.dcb_cfg.tc_config[priority].dcb_pfc;
+        *setting = priv->cee_config.dcb_pfc[priority];
 }
 
 static void mlx4_en_dcbnl_set_pfc_cfg(struct net_device *netdev, int priority,
@@ -134,8 +134,8 @@ static void mlx4_en_dcbnl_set_pfc_cfg(struct net_device *netdev, int priority,
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        priv->cee_params.dcb_cfg.tc_config[priority].dcb_pfc = setting;
-        priv->cee_params.dcb_cfg.pfc_state = true;
+        priv->cee_config.dcb_pfc[priority] = setting;
+        priv->cee_config.pfc_state = true;
 }
 
 static int mlx4_en_dcbnl_getnumtcs(struct net_device *netdev, int tcid, u8 *num)
@@ -157,13 +157,11 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        struct mlx4_en_cee_config *dcb_cfg = &priv->cee_params.dcb_cfg;
-        int err = 0;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
-                return -EINVAL;
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+                return 1;
 
-        if (dcb_cfg->pfc_state) {
+        if (priv->cee_config.pfc_state) {
                 int tc;
 
                 priv->prof->rx_pause = 0;
@@ -171,7 +169,7 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
                 for (tc = 0; tc < CEE_DCBX_MAX_PRIO; tc++) {
                         u8 tc_mask = 1 << tc;
 
-                        switch (dcb_cfg->tc_config[tc].dcb_pfc) {
+                        switch (priv->cee_config.dcb_pfc[tc]) {
                         case pfc_disabled:
                                 priv->prof->tx_ppp &= ~tc_mask;
                                 priv->prof->rx_ppp &= ~tc_mask;
@@ -199,15 +197,17 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
                 en_dbg(DRV, priv, "Set pfc off\n");
         }
 
-        err = mlx4_SET_PORT_general(mdev->dev, priv->port,
-                                    priv->rx_skb_size + ETH_FCS_LEN,
-                                    priv->prof->tx_pause,
-                                    priv->prof->tx_ppp,
-                                    priv->prof->rx_pause,
-                                    priv->prof->rx_ppp);
-        if (err)
+        if (mlx4_SET_PORT_general(mdev->dev, priv->port,
+                                  priv->rx_skb_size + ETH_FCS_LEN,
+                                  priv->prof->tx_pause,
+                                  priv->prof->tx_ppp,
+                                  priv->prof->rx_pause,
+                                  priv->prof->rx_ppp)) {
                 en_err(priv, "Failed setting pause params\n");
-        return err;
+                return 1;
+        }
+
+        return 0;
 }
 
 static u8 mlx4_en_dcbnl_get_state(struct net_device *dev)
@@ -225,7 +225,7 @@ static u8 mlx4_en_dcbnl_set_state(struct net_device *dev, u8 state)
         struct mlx4_en_priv *priv = netdev_priv(dev);
         int num_tcs = 0;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return 1;
 
         if (!!(state) == !!(priv->flags & MLX4_EN_FLAG_DCB_ENABLED))
@@ -238,7 +238,10 @@ static u8 mlx4_en_dcbnl_set_state(struct net_device *dev, u8 state)
                 priv->flags &= ~MLX4_EN_FLAG_DCB_ENABLED;
         }
 
-        return mlx4_en_setup_tc(dev, num_tcs);
+        if (mlx4_en_setup_tc(dev, num_tcs))
+                return 1;
+
+        return 0;
 }
 
 /* On success returns a non-zero 802.1p user priority bitmap
@@ -252,7 +255,7 @@ static int mlx4_en_dcbnl_getapp(struct net_device *netdev, u8 idtype, u16 id)
                                 .selector = idtype,
                                 .protocol = id,
                              };
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return 0;
 
         return dcb_getapp(netdev, &app);
@@ -264,7 +267,7 @@ static int mlx4_en_dcbnl_setapp(struct net_device *netdev, u8 idtype,
         struct mlx4_en_priv *priv = netdev_priv(netdev);
         struct dcb_app app;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return -EINVAL;
 
         memset(&app, 0, sizeof(struct dcb_app));
@@ -433,7 +436,7 @@ static u8 mlx4_en_dcbnl_getdcbx(struct net_device *dev)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
 
-        return priv->cee_params.dcbx_cap;
+        return priv->dcbx_cap;
 }
 
 static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
@@ -442,7 +445,7 @@ static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
         struct ieee_ets ets = {0};
         struct ieee_pfc pfc = {0};
 
-        if (mode == priv->cee_params.dcbx_cap)
+        if (mode == priv->dcbx_cap)
                 return 0;
 
         if ((mode & DCB_CAP_DCBX_LLD_MANAGED) ||
@@ -451,7 +454,7 @@ static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
             !(mode & DCB_CAP_DCBX_HOST))
                 goto err;
 
-        priv->cee_params.dcbx_cap = mode;
+        priv->dcbx_cap = mode;
 
         ets.ets_cap = IEEE_8021QAZ_MAX_TCS;
         pfc.pfc_cap = IEEE_8021QAZ_MAX_TCS;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 4198e9bf89d0..fedb829276f4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -71,10 +71,11 @@ int mlx4_en_setup_tc(struct net_device *dev, u8 up)
 #ifdef CONFIG_MLX4_EN_DCB
         if (!mlx4_is_slave(priv->mdev->dev)) {
                 if (up) {
-                        priv->flags |= MLX4_EN_FLAG_DCB_ENABLED;
+                        if (priv->dcbx_cap)
+                                priv->flags |= MLX4_EN_FLAG_DCB_ENABLED;
                 } else {
                         priv->flags &= ~MLX4_EN_FLAG_DCB_ENABLED;
-                        priv->cee_params.dcb_cfg.pfc_state = false;
+                        priv->cee_config.pfc_state = false;
                 }
         }
 #endif /* CONFIG_MLX4_EN_DCB */
@@ -3048,9 +3049,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         struct mlx4_en_priv *priv;
         int i;
         int err;
-#ifdef CONFIG_MLX4_EN_DCB
-        struct tc_configuration *tc;
-#endif
 
         dev = alloc_etherdev_mqs(sizeof(struct mlx4_en_priv),
                                  MAX_TX_RINGS, MAX_RX_RINGS);
@@ -3117,16 +3115,13 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         priv->msg_enable = MLX4_EN_MSG_LEVEL;
 #ifdef CONFIG_MLX4_EN_DCB
         if (!mlx4_is_slave(priv->mdev->dev)) {
-                priv->cee_params.dcbx_cap = DCB_CAP_DCBX_VER_CEE |
-                                            DCB_CAP_DCBX_HOST |
-                                            DCB_CAP_DCBX_VER_IEEE;
+                priv->dcbx_cap = DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_HOST |
+                        DCB_CAP_DCBX_VER_IEEE;
                 priv->flags |= MLX4_EN_DCB_ENABLED;
-                priv->cee_params.dcb_cfg.pfc_state = false;
+                priv->cee_config.pfc_state = false;
 
-                for (i = 0; i < MLX4_EN_NUM_UP; i++) {
-                        tc = &priv->cee_params.dcb_cfg.tc_config[i];
-                        tc->dcb_pfc = pfc_disabled;
-                }
+                for (i = 0; i < MLX4_EN_NUM_UP; i++)
+                        priv->cee_config.dcb_pfc[i] = pfc_disabled;
 
                 if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_ETS_CFG) {
                         dev->dcbnl_ops = &mlx4_en_dcbnl_ops;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 9df87ca0515a..e2509bba3e7c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -818,7 +818,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         real_size = get_real_size(skb, shinfo, dev, &lso_header_size,
                                   &inline_ok, &fragptr);
         if (unlikely(!real_size))
-                goto tx_drop;
+                goto tx_drop_count;
 
         /* Align descriptor to TXBB size */
         desc_size = ALIGN(real_size, TXBB_SIZE);
@@ -826,7 +826,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         if (unlikely(nr_txbb > MAX_DESC_TXBBS)) {
                 if (netif_msg_tx_err(priv))
                         en_warn(priv, "Oversized header or SG list\n");
-                goto tx_drop;
+                goto tx_drop_count;
         }
 
         bf_ok = ring->bf_enabled;
@@ -1071,9 +1071,10 @@ tx_drop_unmap:
                                PCI_DMA_TODEVICE);
         }
 
+tx_drop_count:
+        ring->tx_dropped++;
 tx_drop:
         dev_kfree_skb_any(skb);
-        ring->tx_dropped++;
         return NETDEV_TX_OK;
 }
 
@@ -1106,7 +1107,7 @@ netdev_tx_t mlx4_en_xmit_frame(struct mlx4_en_rx_alloc *frame,
                 goto tx_drop;
 
         if (mlx4_en_is_tx_ring_full(ring))
-                goto tx_drop;
+                goto tx_drop_count;
 
         /* fetch ring->cons far ahead before needing it to avoid stall */
         ring_cons = READ_ONCE(ring->cons);
@@ -1176,7 +1177,8 @@ netdev_tx_t mlx4_en_xmit_frame(struct mlx4_en_rx_alloc *frame,
 
         return NETDEV_TX_OK;
 
-tx_drop:
+tx_drop_count:
         ring->tx_dropped++;
+tx_drop:
         return NETDEV_TX_BUSY;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 2c2913dcae98..9099dbd04951 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -482,20 +482,10 @@ enum dcb_pfc_type {
         pfc_enabled_rx
 };
 
-struct tc_configuration {
-        enum dcb_pfc_type  dcb_pfc;
-};
-
 struct mlx4_en_cee_config {
         bool    pfc_state;
-        struct  tc_configuration tc_config[MLX4_EN_NUM_UP];
+        enum    dcb_pfc_type dcb_pfc[MLX4_EN_NUM_UP];
 };
-
-struct mlx4_en_cee_params {
-        u8 dcbx_cap;
-        struct mlx4_en_cee_config dcb_cfg;
-};
-
 #endif
 
 struct ethtool_flow_id {
@@ -624,7 +614,8 @@ struct mlx4_en_priv {
         struct ieee_ets ets;
         u16 maxrate[IEEE_8021QAZ_MAX_TCS];
         enum dcbnl_cndd_states cndd_state[IEEE_8021QAZ_MAX_TCS];
-        struct mlx4_en_cee_params cee_params;
+        struct mlx4_en_cee_config cee_config;
+        u8 dcbx_cap;
 #endif
 #ifdef CONFIG_RFS_ACCEL
         spinlock_t filters_lock;
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index 3d2095e5c61c..c5b2064297a1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -52,7 +52,7 @@
 
 #define MLX4_FLAG_V_IGNORE_FCS_MASK             0x2
 #define MLX4_IGNORE_FCS_MASK                    0x1
-#define MLNX4_TX_MAX_NUMBER                     8
+#define MLX4_TC_MAX_NUMBER                      8
 
 void mlx4_init_mac_table(struct mlx4_dev *dev, struct mlx4_mac_table *table)
 {
@@ -2022,7 +2022,7 @@ int mlx4_max_tc(struct mlx4_dev *dev)
         u8 num_tc = dev->caps.max_tc_eth;
 
         if (!num_tc)
-                num_tc = MLNX4_TX_MAX_NUMBER;
+                num_tc = MLX4_TC_MAX_NUMBER;
 
         return num_tc;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index d0cf8fa22659..7a346bb2ed00 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -331,7 +331,7 @@ static void mlx5e_get_ethtool_stats(struct net_device *dev,
         if (mlx5e_query_global_pause_combined(priv)) {
                 for (i = 0; i < NUM_PPORT_PER_PRIO_PFC_COUNTERS; i++) {
                         data[idx++] = MLX5E_READ_CTR64_BE(&priv->stats.pport.per_prio_counters[0],
-                                                          pport_per_prio_pfc_stats_desc, 0);
+                                                          pport_per_prio_pfc_stats_desc, i);
                 }
         }
 
@@ -659,9 +659,10 @@ out:
 static void ptys2ethtool_supported_link(unsigned long *supported_modes,
                                         u32 eth_proto_cap)
 {
+        unsigned long proto_cap = eth_proto_cap;
         int proto;
 
-        for_each_set_bit(proto, (unsigned long *)&eth_proto_cap, MLX5E_LINK_MODES_NUMBER)
+        for_each_set_bit(proto, &proto_cap, MLX5E_LINK_MODES_NUMBER)
                 bitmap_or(supported_modes, supported_modes,
                           ptys2ethtool_table[proto].supported,
                           __ETHTOOL_LINK_MODE_MASK_NBITS);
@@ -670,9 +671,10 @@ static void ptys2ethtool_supported_link(unsigned long *supported_modes,
 static void ptys2ethtool_adver_link(unsigned long *advertising_modes,
                                     u32 eth_proto_cap)
 {
+        unsigned long proto_cap = eth_proto_cap;
         int proto;
 
-        for_each_set_bit(proto, (unsigned long *)&eth_proto_cap, MLX5E_LINK_MODES_NUMBER)
+        for_each_set_bit(proto, &proto_cap, MLX5E_LINK_MODES_NUMBER)
                 bitmap_or(advertising_modes, advertising_modes,
                           ptys2ethtool_table[proto].advertised,
                           __ETHTOOL_LINK_MODE_MASK_NBITS);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index b6f8ebbdb487..e7c969df3dad 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -637,24 +637,32 @@ bool mlx5e_post_rx_wqes(struct mlx5e_rq *rq)
 static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe,
                                  u32 cqe_bcnt)
 {
-        struct ethhdr   *eth    = (struct ethhdr *)(skb->data);
-        struct iphdr    *ipv4   = (struct iphdr *)(skb->data + ETH_HLEN);
-        struct ipv6hdr  *ipv6   = (struct ipv6hdr *)(skb->data + ETH_HLEN);
+        struct ethhdr   *eth = (struct ethhdr *)(skb->data);
+        struct iphdr    *ipv4;
+        struct ipv6hdr  *ipv6;
         struct tcphdr   *tcp;
+        int network_depth = 0;
+        __be16 proto;
+        u16 tot_len;
 
         u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe);
         int tcp_ack = ((CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA  == l4_hdr_type) ||
                        (CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA == l4_hdr_type));
 
-        u16 tot_len = cqe_bcnt - ETH_HLEN;
+        skb->mac_len = ETH_HLEN;
+        proto = __vlan_get_protocol(skb, eth->h_proto, &network_depth);
 
-        if (eth->h_proto == htons(ETH_P_IP)) {
-                tcp = (struct tcphdr *)(skb->data + ETH_HLEN +
+        ipv4 = (struct iphdr *)(skb->data + network_depth);
+        ipv6 = (struct ipv6hdr *)(skb->data + network_depth);
+        tot_len = cqe_bcnt - network_depth;
+
+        if (proto == htons(ETH_P_IP)) {
+                tcp = (struct tcphdr *)(skb->data + network_depth +
                                         sizeof(struct iphdr));
                 ipv6 = NULL;
                 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
         } else {
-                tcp = (struct tcphdr *)(skb->data + ETH_HLEN +
+                tcp = (struct tcphdr *)(skb->data + network_depth +
                                         sizeof(struct ipv6hdr));
                 ipv4 = NULL;
                 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 988eca99ee0f..eb0e72537f10 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -356,6 +356,7 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                 sq->stats.stopped++;
         }
 
+        sq->stats.xmit_more += skb->xmit_more;
         if (!skb->xmit_more || netif_xmit_stopped(sq->txq)) {
                 int bf_sz = 0;
 
@@ -375,7 +376,6 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
 
         sq->stats.packets++;
         sq->stats.bytes += num_bytes;
-        sq->stats.xmit_more += skb->xmit_more;
         return NETDEV_TX_OK;
 
 dma_unmap_wqe_err:
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 7291f2c4b0c7..d48873bcbddf 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -56,6 +56,7 @@
 #include <generated/utsrelease.h>
 #include <net/pkt_cls.h>
 #include <net/tc_act/tc_mirred.h>
+#include <net/netevent.h>
 
 #include "spectrum.h"
 #include "core.h"
@@ -2105,6 +2106,13 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
         dev->netdev_ops = &mlxsw_sp_port_netdev_ops;
         dev->ethtool_ops = &mlxsw_sp_port_ethtool_ops;
 
+        err = mlxsw_sp_port_swid_set(mlxsw_sp_port, 0);
+        if (err) {
+                dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to set SWID\n",
+                        mlxsw_sp_port->local_port);
+                goto err_port_swid_set;
+        }
+
         err = mlxsw_sp_port_dev_addr_init(mlxsw_sp_port);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Port %d: Unable to init port mac address\n",
@@ -2130,13 +2138,6 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                 goto err_port_system_port_mapping_set;
         }
 
-        err = mlxsw_sp_port_swid_set(mlxsw_sp_port, 0);
-        if (err) {
-                dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to set SWID\n",
-                        mlxsw_sp_port->local_port);
-                goto err_port_swid_set;
-        }
-
         err = mlxsw_sp_port_speed_by_width_set(mlxsw_sp_port, width);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to enable speeds\n",
@@ -2218,10 +2219,10 @@ err_port_buffers_init:
 err_port_admin_status_set:
 err_port_mtu_set:
 err_port_speed_by_width_set:
-        mlxsw_sp_port_swid_set(mlxsw_sp_port, MLXSW_PORT_SWID_DISABLED_PORT);
-err_port_swid_set:
 err_port_system_port_mapping_set:
 err_dev_addr_init:
+        mlxsw_sp_port_swid_set(mlxsw_sp_port, MLXSW_PORT_SWID_DISABLED_PORT);
+err_port_swid_set:
         free_percpu(mlxsw_sp_port->pcpu_stats);
 err_alloc_stats:
         kfree(mlxsw_sp_port->untagged_vlans);
@@ -4541,18 +4542,26 @@ static struct notifier_block mlxsw_sp_inetaddr_nb __read_mostly = {
         .priority = 10, /* Must be called before FIB notifier block */
 };
 
+static struct notifier_block mlxsw_sp_router_netevent_nb __read_mostly = {
+        .notifier_call = mlxsw_sp_router_netevent_event,
+};
+
 static int __init mlxsw_sp_module_init(void)
 {
         int err;
 
         register_netdevice_notifier(&mlxsw_sp_netdevice_nb);
         register_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
+        register_netevent_notifier(&mlxsw_sp_router_netevent_nb);
+
         err = mlxsw_core_driver_register(&mlxsw_sp_driver);
         if (err)
                 goto err_core_driver_register;
         return 0;
 
 err_core_driver_register:
+        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
+        unregister_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
         unregister_netdevice_notifier(&mlxsw_sp_netdevice_nb);
         return err;
 }
@@ -4560,6 +4569,7 @@ err_core_driver_register:
 static void __exit mlxsw_sp_module_exit(void)
 {
         mlxsw_core_driver_unregister(&mlxsw_sp_driver);
+        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
         unregister_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
         unregister_netdevice_notifier(&mlxsw_sp_netdevice_nb);
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index ab3feb81bd43..ac48abebe904 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -587,6 +587,8 @@ int mlxsw_sp_router_neigh_construct(struct net_device *dev,
                                     struct neighbour *n);
 void mlxsw_sp_router_neigh_destroy(struct net_device *dev,
                                    struct neighbour *n);
+int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
+                                   unsigned long event, void *ptr);
 
 int mlxsw_sp_kvdl_alloc(struct mlxsw_sp *mlxsw_sp, unsigned int entry_count);
 void mlxsw_sp_kvdl_free(struct mlxsw_sp *mlxsw_sp, int entry_index);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 917ddd1e422f..3f5c51da6d3e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -107,6 +107,7 @@ mlxsw_sp_prefix_usage_clear(struct mlxsw_sp_prefix_usage *prefix_usage,
 }
 
 struct mlxsw_sp_fib_key {
+        struct net_device *dev;
         unsigned char addr[sizeof(struct in6_addr)];
         unsigned char prefix_len;
 };
@@ -123,7 +124,7 @@ struct mlxsw_sp_fib_entry {
         struct rhash_head ht_node;
         struct mlxsw_sp_fib_key key;
         enum mlxsw_sp_fib_entry_type type;
-        u8 added:1;
+        unsigned int ref_count;
         u16 rif; /* used for action local */
         struct mlxsw_sp_vr *vr;
         struct list_head nexthop_group_node;
@@ -171,13 +172,15 @@ static void mlxsw_sp_fib_entry_remove(struct mlxsw_sp_fib *fib,
 
 static struct mlxsw_sp_fib_entry *
 mlxsw_sp_fib_entry_create(struct mlxsw_sp_fib *fib, const void *addr,
-                          size_t addr_len, unsigned char prefix_len)
+                          size_t addr_len, unsigned char prefix_len,
+                          struct net_device *dev)
 {
         struct mlxsw_sp_fib_entry *fib_entry;
 
         fib_entry = kzalloc(sizeof(*fib_entry), GFP_KERNEL);
         if (!fib_entry)
                 return NULL;
+        fib_entry->key.dev = dev;
         memcpy(fib_entry->key.addr, addr, addr_len);
         fib_entry->key.prefix_len = prefix_len;
         return fib_entry;
@@ -190,10 +193,13 @@ static void mlxsw_sp_fib_entry_destroy(struct mlxsw_sp_fib_entry *fib_entry)
 
 static struct mlxsw_sp_fib_entry *
 mlxsw_sp_fib_entry_lookup(struct mlxsw_sp_fib *fib, const void *addr,
-                          size_t addr_len, unsigned char prefix_len)
+                          size_t addr_len, unsigned char prefix_len,
+                          struct net_device *dev)
 {
-        struct mlxsw_sp_fib_key key = {{ 0 } };
+        struct mlxsw_sp_fib_key key;
 
+        memset(&key, 0, sizeof(key));
+        key.dev = dev;
         memcpy(key.addr, addr, addr_len);
         key.prefix_len = prefix_len;
         return rhashtable_lookup_fast(&fib->ht, &key, mlxsw_sp_fib_ht_params);
@@ -938,8 +944,8 @@ static void mlxsw_sp_router_neigh_update_hw(struct work_struct *work)
         mlxsw_sp_port_dev_put(mlxsw_sp_port);
 }
 
-static int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
-                                          unsigned long event, void *ptr)
+int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
+                                   unsigned long event, void *ptr)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry;
         struct mlxsw_sp_port *mlxsw_sp_port;
@@ -1009,10 +1015,6 @@ static int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
         return NOTIFY_DONE;
 }
 
-static struct notifier_block mlxsw_sp_router_netevent_nb __read_mostly = {
-        .notifier_call = mlxsw_sp_router_netevent_event,
-};
-
 static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
 {
         int err;
@@ -1027,10 +1029,6 @@ static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
          */
         mlxsw_sp_router_neighs_update_interval_init(mlxsw_sp);
 
-        err = register_netevent_notifier(&mlxsw_sp_router_netevent_nb);
-        if (err)
-                goto err_register_netevent_notifier;
-
         /* Create the delayed works for the activity_update */
         INIT_DELAYED_WORK(&mlxsw_sp->router.neighs_update.dw,
                           mlxsw_sp_router_neighs_update_work);
@@ -1039,17 +1037,12 @@ static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
         mlxsw_core_schedule_dw(&mlxsw_sp->router.neighs_update.dw, 0);
         mlxsw_core_schedule_dw(&mlxsw_sp->router.nexthop_probe_dw, 0);
         return 0;
-
-err_register_netevent_notifier:
-        rhashtable_destroy(&mlxsw_sp->router.neigh_ht);
-        return err;
 }
 
 static void mlxsw_sp_neigh_fini(struct mlxsw_sp *mlxsw_sp)
 {
         cancel_delayed_work_sync(&mlxsw_sp->router.neighs_update.dw);
         cancel_delayed_work_sync(&mlxsw_sp->router.nexthop_probe_dw);
-        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
         rhashtable_destroy(&mlxsw_sp->router.neigh_ht);
 }
 
@@ -1524,7 +1517,14 @@ int mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp)
                 return err;
         mlxsw_sp_lpm_init(mlxsw_sp);
         mlxsw_sp_vrs_init(mlxsw_sp);
-        return mlxsw_sp_neigh_init(mlxsw_sp);
+        err = mlxsw_sp_neigh_init(mlxsw_sp);
+        if (err)
+                goto err_neigh_init;
+        return 0;
+
+err_neigh_init:
+        __mlxsw_sp_router_fini(mlxsw_sp);
+        return err;
 }
 
 void mlxsw_sp_router_fini(struct mlxsw_sp *mlxsw_sp)
@@ -1626,11 +1626,8 @@ static int mlxsw_sp_fib_entry_op(struct mlxsw_sp *mlxsw_sp,
 static int mlxsw_sp_fib_entry_update(struct mlxsw_sp *mlxsw_sp,
                                      struct mlxsw_sp_fib_entry *fib_entry)
 {
-        enum mlxsw_reg_ralue_op op;
-
-        op = !fib_entry->added ? MLXSW_REG_RALUE_OP_WRITE_WRITE :
-                                 MLXSW_REG_RALUE_OP_WRITE_UPDATE;
-        return mlxsw_sp_fib_entry_op(mlxsw_sp, fib_entry, op);
+        return mlxsw_sp_fib_entry_op(mlxsw_sp, fib_entry,
+                                     MLXSW_REG_RALUE_OP_WRITE_WRITE);
 }
 
 static int mlxsw_sp_fib_entry_del(struct mlxsw_sp *mlxsw_sp,
@@ -1695,34 +1692,93 @@ mlxsw_sp_router_fib4_entry_fini(struct mlxsw_sp *mlxsw_sp,
         mlxsw_sp_nexthop_group_put(mlxsw_sp, fib_entry);
 }
 
-static int
-mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
-                                 const struct switchdev_obj_ipv4_fib *fib4,
-                                 struct switchdev_trans *trans)
+static struct mlxsw_sp_fib_entry *
+mlxsw_sp_fib_entry_get(struct mlxsw_sp *mlxsw_sp,
+                       const struct switchdev_obj_ipv4_fib *fib4)
 {
-        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
-        struct mlxsw_sp_router_fib4_add_info *info;
         struct mlxsw_sp_fib_entry *fib_entry;
+        struct fib_info *fi = fib4->fi;
         struct mlxsw_sp_vr *vr;
         int err;
 
         vr = mlxsw_sp_vr_get(mlxsw_sp, fib4->dst_len, fib4->tb_id,
                              MLXSW_SP_L3_PROTO_IPV4);
         if (IS_ERR(vr))
-                return PTR_ERR(vr);
+                return ERR_CAST(vr);
 
+        fib_entry = mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
+                                              sizeof(fib4->dst),
+                                              fib4->dst_len, fi->fib_dev);
+        if (fib_entry) {
+                /* Already exists, just take a reference */
+                fib_entry->ref_count++;
+                return fib_entry;
+        }
         fib_entry = mlxsw_sp_fib_entry_create(vr->fib, &fib4->dst,
-                                              sizeof(fib4->dst), fib4->dst_len);
+                                              sizeof(fib4->dst),
+                                              fib4->dst_len, fi->fib_dev);
         if (!fib_entry) {
                 err = -ENOMEM;
                 goto err_fib_entry_create;
         }
         fib_entry->vr = vr;
+        fib_entry->ref_count = 1;
 
         err = mlxsw_sp_router_fib4_entry_init(mlxsw_sp, fib4, fib_entry);
         if (err)
                 goto err_fib4_entry_init;
 
+        return fib_entry;
+
+err_fib4_entry_init:
+        mlxsw_sp_fib_entry_destroy(fib_entry);
+err_fib_entry_create:
+        mlxsw_sp_vr_put(mlxsw_sp, vr);
+
+        return ERR_PTR(err);
+}
+
+static struct mlxsw_sp_fib_entry *
+mlxsw_sp_fib_entry_find(struct mlxsw_sp *mlxsw_sp,
+                        const struct switchdev_obj_ipv4_fib *fib4)
+{
+        struct mlxsw_sp_vr *vr;
+
+        vr = mlxsw_sp_vr_find(mlxsw_sp, fib4->tb_id, MLXSW_SP_L3_PROTO_IPV4);
+        if (!vr)
+                return NULL;
+
+        return mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
+                                         sizeof(fib4->dst), fib4->dst_len,
+                                         fib4->fi->fib_dev);
+}
+
+void mlxsw_sp_fib_entry_put(struct mlxsw_sp *mlxsw_sp,
+                            struct mlxsw_sp_fib_entry *fib_entry)
+{
+        struct mlxsw_sp_vr *vr = fib_entry->vr;
+
+        if (--fib_entry->ref_count == 0) {
+                mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
+                mlxsw_sp_fib_entry_destroy(fib_entry);
+        }
+        mlxsw_sp_vr_put(mlxsw_sp, vr);
+}
+
+static int
+mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
+                                 const struct switchdev_obj_ipv4_fib *fib4,
+                                 struct switchdev_trans *trans)
+{
+        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+        struct mlxsw_sp_router_fib4_add_info *info;
+        struct mlxsw_sp_fib_entry *fib_entry;
+        int err;
+
+        fib_entry = mlxsw_sp_fib_entry_get(mlxsw_sp, fib4);
+        if (IS_ERR(fib_entry))
+                return PTR_ERR(fib_entry);
+
         info = kmalloc(sizeof(*info), GFP_KERNEL);
         if (!info) {
                 err = -ENOMEM;
@@ -1736,11 +1792,7 @@ mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
         return 0;
 
 err_alloc_info:
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-err_fib4_entry_init:
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-err_fib_entry_create:
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return err;
 }
 
@@ -1759,11 +1811,14 @@ mlxsw_sp_router_fib4_add_commit(struct mlxsw_sp_port *mlxsw_sp_port,
         fib_entry = info->fib_entry;
         kfree(info);
 
+        if (fib_entry->ref_count != 1)
+                return 0;
+
         vr = fib_entry->vr;
-        err = mlxsw_sp_fib_entry_insert(fib_entry->vr->fib, fib_entry);
+        err = mlxsw_sp_fib_entry_insert(vr->fib, fib_entry);
         if (err)
                 goto err_fib_entry_insert;
-        err = mlxsw_sp_fib_entry_update(mlxsw_sp, fib_entry);
+        err = mlxsw_sp_fib_entry_update(mlxsw_sp_port->mlxsw_sp, fib_entry);
         if (err)
                 goto err_fib_entry_add;
         return 0;
@@ -1771,9 +1826,7 @@ mlxsw_sp_router_fib4_add_commit(struct mlxsw_sp_port *mlxsw_sp_port,
 err_fib_entry_add:
         mlxsw_sp_fib_entry_remove(vr->fib, fib_entry);
 err_fib_entry_insert:
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return err;
 }
 
@@ -1793,23 +1846,18 @@ int mlxsw_sp_router_fib4_del(struct mlxsw_sp_port *mlxsw_sp_port,
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         struct mlxsw_sp_fib_entry *fib_entry;
-        struct mlxsw_sp_vr *vr;
 
-        vr = mlxsw_sp_vr_find(mlxsw_sp, fib4->tb_id, MLXSW_SP_L3_PROTO_IPV4);
-        if (!vr) {
-                dev_warn(mlxsw_sp->bus_info->dev, "Failed to find virtual router for FIB4 entry being removed.\n");
-                return -ENOENT;
-        }
-        fib_entry = mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
-                                              sizeof(fib4->dst), fib4->dst_len);
+        fib_entry = mlxsw_sp_fib_entry_find(mlxsw_sp, fib4);
         if (!fib_entry) {
                 dev_warn(mlxsw_sp->bus_info->dev, "Failed to find FIB4 entry being removed.\n");
                 return -ENOENT;
         }
-        mlxsw_sp_fib_entry_del(mlxsw_sp_port->mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_remove(vr->fib, fib_entry);
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+
+        if (fib_entry->ref_count == 1) {
+                mlxsw_sp_fib_entry_del(mlxsw_sp, fib_entry);
+                mlxsw_sp_fib_entry_remove(fib_entry->vr->fib, fib_entry);
+        }
+
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index d1b59cdfacc1..7b654c517b91 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -167,8 +167,8 @@ static int mlxsw_sp_port_attr_stp_state_set(struct mlxsw_sp_port *mlxsw_sp_port,
 }
 
 static int __mlxsw_sp_port_flood_set(struct mlxsw_sp_port *mlxsw_sp_port,
-                                     u16 idx_begin, u16 idx_end, bool set,
-                                     bool only_uc)
+                                     u16 idx_begin, u16 idx_end, bool uc_set,
+                                     bool bm_set)
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         u16 local_port = mlxsw_sp_port->local_port;
@@ -187,28 +187,22 @@ static int __mlxsw_sp_port_flood_set(struct mlxsw_sp_port *mlxsw_sp_port,
                 return -ENOMEM;
 
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_UC, idx_begin,
-                            table_type, range, local_port, set);
+                            table_type, range, local_port, uc_set);
         err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
         if (err)
                 goto buffer_out;
 
-        /* Flooding control allows one to decide whether a given port will
-         * flood unicast traffic for which there is no FDB entry.
-         */
-        if (only_uc)
-                goto buffer_out;
-
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_BM, idx_begin,
-                            table_type, range, local_port, set);
+                            table_type, range, local_port, bm_set);
         err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
         if (err)
                 goto err_flood_bm_set;
-        else
-                goto buffer_out;
+
+        goto buffer_out;
 
 err_flood_bm_set:
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_UC, idx_begin,
-                            table_type, range, local_port, !set);
+                            table_type, range, local_port, !uc_set);
         mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
 buffer_out:
         kfree(sftr_pl);
@@ -257,8 +251,7 @@ int mlxsw_sp_vport_flood_set(struct mlxsw_sp_port *mlxsw_sp_vport, u16 fid,
          * the start of the vFIDs range.
          */
         vfid = mlxsw_sp_fid_to_vfid(fid);
-        return __mlxsw_sp_port_flood_set(mlxsw_sp_vport, vfid, vfid, set,
-                                         false);
+        return __mlxsw_sp_port_flood_set(mlxsw_sp_vport, vfid, vfid, set, set);
 }
 
 static int mlxsw_sp_port_attr_br_flags_set(struct mlxsw_sp_port *mlxsw_sp_port,
@@ -460,6 +453,9 @@ static int __mlxsw_sp_port_fid_join(struct mlxsw_sp_port *mlxsw_sp_port,
 {
         struct mlxsw_sp_fid *f;
 
+        if (test_bit(fid, mlxsw_sp_port->active_vlans))
+                return 0;
+
         f = mlxsw_sp_fid_find(mlxsw_sp_port->mlxsw_sp, fid);
         if (!f) {
                 f = mlxsw_sp_fid_create(mlxsw_sp_port->mlxsw_sp, fid);
@@ -517,7 +513,7 @@ static int mlxsw_sp_port_fid_join(struct mlxsw_sp_port *mlxsw_sp_port,
         }
 
         err = __mlxsw_sp_port_flood_set(mlxsw_sp_port, fid_begin, fid_end,
-                                        true, false);
+                                        mlxsw_sp_port->uc_flood, true);
         if (err)
                 goto err_port_flood_set;
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 88678c172b19..252e4924de0f 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -41,7 +41,6 @@
  *          Chris Telfer <chris.telfer@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -1441,10 +1440,6 @@ static int nfp_net_rx(struct nfp_net_rx_ring *rx_ring, int budget)
 
                 nfp_net_set_hash(nn->netdev, skb, rxd);
 
-                /* Pad small frames to minimum */
-                if (skb_put_padto(skb, 60))
-                        break;
-
                 /* Stats update */
                 u64_stats_update_begin(&r_vec->rx_sync);
                 r_vec->rx_pkts++;
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
index 7d7933d00b8f..4c9897220969 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
@@ -40,7 +40,6 @@
  *          Brad Petrus <brad.petrus@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c b/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
index 37abef016a0a..f7062cb648e1 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
@@ -38,7 +38,6 @@
  *         Rolf Neugebauer <rolf.neugebauer@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -134,7 +133,7 @@ static int nfp_netvf_pci_probe(struct pci_dev *pdev,
         }
 
         nfp_net_get_fw_version(&fw_ver, ctrl_bar);
-        if (fw_ver.class != NFP_NET_CFG_VERSION_CLASS_GENERIC) {
+        if (fw_ver.resv || fw_ver.class != NFP_NET_CFG_VERSION_CLASS_GENERIC) {
                 dev_err(&pdev->dev, "Unknown Firmware ABI %d.%d.%d.%d\n",
                         fw_ver.resv, fw_ver.class, fw_ver.major, fw_ver.minor);
                 err = -EINVAL;
@@ -142,9 +141,7 @@ static int nfp_netvf_pci_probe(struct pci_dev *pdev,
         }
 
         /* Determine stride */
-        if (nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 0) ||
-            nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 1) ||
-            nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0x12, 0x48)) {
+        if (nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 1)) {
                 stride = 2;
                 tx_bar_no = NFP_NET_Q0_BAR;
                 rx_bar_no = NFP_NET_Q1_BAR;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 226cb08cc055..3656d2fd673d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -19,6 +19,7 @@
 #include "qed_dcbx.h"
 #include "qed_hsi.h"
 #include "qed_sp.h"
+#include "qed_sriov.h"
 #ifdef CONFIG_DCB
 #include <linux/qed/qed_eth_if.h>
 #endif
@@ -945,6 +946,9 @@ static int qed_dcbx_query_params(struct qed_hwfn *p_hwfn,
         struct qed_ptt *p_ptt;
         int rc;
 
+        if (IS_VF(p_hwfn->cdev))
+                return -EINVAL;
+
         p_ptt = qed_ptt_acquire(p_hwfn);
         if (!p_ptt)
                 return -EBUSY;
@@ -984,6 +988,7 @@ qed_dcbx_set_pfc_data(struct qed_hwfn *p_hwfn,
                 if (p_params->pfc.prio[i])
                         pfc_map |= BIT(i);
 
+        *pfc &= ~DCBX_PFC_PRI_EN_BITMAP_MASK;
         *pfc |= (pfc_map << DCBX_PFC_PRI_EN_BITMAP_SHIFT);
 
         DP_VERBOSE(p_hwfn, QED_MSG_DCB, "pfc = 0x%x\n", *pfc);
@@ -1058,24 +1063,33 @@ qed_dcbx_set_app_data(struct qed_hwfn *p_hwfn,
 
         for (i = 0; i < DCBX_MAX_APP_PROTOCOL; i++) {
                 entry = &p_app->app_pri_tbl[i].entry;
+                *entry = 0;
                 if (ieee) {
-                        *entry &= ~DCBX_APP_SF_IEEE_MASK;
+                        *entry &= ~(DCBX_APP_SF_IEEE_MASK | DCBX_APP_SF_MASK);
                         switch (p_params->app_entry[i].sf_ieee) {
                         case QED_DCBX_SF_IEEE_ETHTYPE:
                                 *entry |= ((u32)DCBX_APP_SF_IEEE_ETHTYPE <<
                                            DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_ETHTYPE <<
+                                           DCBX_APP_SF_SHIFT);
                                 break;
                         case QED_DCBX_SF_IEEE_TCP_PORT:
                                 *entry |= ((u32)DCBX_APP_SF_IEEE_TCP_PORT <<
                                            DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
                                 break;
                         case QED_DCBX_SF_IEEE_UDP_PORT:
                                 *entry |= ((u32)DCBX_APP_SF_IEEE_UDP_PORT <<
                                            DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
                                 break;
                         case QED_DCBX_SF_IEEE_TCP_UDP_PORT:
                                 *entry |= ((u32)DCBX_APP_SF_IEEE_TCP_UDP_PORT <<
                                            DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
                                 break;
                         }
                 } else {
@@ -1175,7 +1189,7 @@ int qed_dcbx_get_config_params(struct qed_hwfn *p_hwfn,
                 return 0;
         }
 
-        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
         if (!dcbx_info) {
                 DP_ERR(p_hwfn, "Failed to allocate struct qed_dcbx_info\n");
                 return -ENOMEM;
@@ -1212,7 +1226,7 @@ static struct qed_dcbx_get *qed_dcbnl_get_dcbx(struct qed_hwfn *hwfn,
 {
         struct qed_dcbx_get *dcbx_info;
 
-        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
         if (!dcbx_info) {
                 DP_ERR(hwfn->cdev, "Failed to allocate memory for dcbx_info\n");
                 return NULL;
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index a6eb6af8cbe8..9544e4c41359 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -2520,7 +2520,8 @@ static int __qede_probe(struct pci_dev *pdev, u32 dp_module, u8 dp_level,
         edev->ops->register_ops(cdev, &qede_ll_ops, edev);
 
 #ifdef CONFIG_DCB
-        qede_set_dcbnl_ops(edev->ndev);
+        if (!IS_VF(edev))
+                qede_set_dcbnl_ops(edev->ndev);
 #endif
 
         INIT_DELAYED_WORK(&edev->sp_task, qede_sp_task);
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 799d58d86e6d..054e795df90f 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -201,9 +201,14 @@ static const u16 sh_eth_offset_fast_rz[SH_ETH_MAX_REGISTER_OFFSET] = {
 
         [ARSTR]         = 0x0000,
         [TSU_CTRST]     = 0x0004,
+        [TSU_FWSLC]     = 0x0038,
         [TSU_VTAG0]     = 0x0058,
         [TSU_ADSBSY]    = 0x0060,
         [TSU_TEN]       = 0x0064,
+        [TSU_POST1]     = 0x0070,
+        [TSU_POST2]     = 0x0074,
+        [TSU_POST3]     = 0x0078,
+        [TSU_POST4]     = 0x007c,
         [TSU_ADRH0]     = 0x0100,
 
         [TXNLCR0]       = 0x0080,
@@ -2786,6 +2791,8 @@ static void sh_eth_tsu_init(struct sh_eth_private *mdp)
 {
         if (sh_eth_is_rz_fast_ether(mdp)) {
                 sh_eth_tsu_write(mdp, 0, TSU_TEN); /* Disable all CAM entry */
+                sh_eth_tsu_write(mdp, TSU_FWSLC_POSTENU | TSU_FWSLC_POSTENL,
+                                 TSU_FWSLC);    /* Enable POST registers */
                 return;
         }
 
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index e17671c9d1b0..ea8465467469 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -470,7 +470,9 @@ smc_pxa_dma_insw(void __iomem *ioaddr, struct smc_local *lp, int reg, int dma,
 #endif
 
 #if ! SMC_CAN_USE_8BIT
+#undef SMC_inb
 #define SMC_inb(ioaddr, reg)            ({ BUG(); 0; })
+#undef SMC_outb
 #define SMC_outb(x, ioaddr, reg)        BUG()
 #define SMC_insb(a, r, p, l)            BUG()
 #define SMC_outsb(a, r, p, l)           BUG()
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index ca3134540d2d..4f8910b7db2e 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -1099,15 +1099,8 @@ static int smsc911x_mii_init(struct platform_device *pdev,
                 goto err_out_free_bus_2;
         }
 
-        if (smsc911x_mii_probe(dev) < 0) {
-                SMSC_WARN(pdata, probe, "Error registering mii bus");
-                goto err_out_unregister_bus_3;
-        }
-
         return 0;
 
-err_out_unregister_bus_3:
-        mdiobus_unregister(pdata->mii_bus);
 err_out_free_bus_2:
         mdiobus_free(pdata->mii_bus);
 err_out_1:
@@ -1514,23 +1507,90 @@ static void smsc911x_disable_irq_chip(struct net_device *dev)
         smsc911x_reg_write(pdata, INT_STS, 0xFFFFFFFF);
 }
 
+static irqreturn_t smsc911x_irqhandler(int irq, void *dev_id)
+{
+        struct net_device *dev = dev_id;
+        struct smsc911x_data *pdata = netdev_priv(dev);
+        u32 intsts = smsc911x_reg_read(pdata, INT_STS);
+        u32 inten = smsc911x_reg_read(pdata, INT_EN);
+        int serviced = IRQ_NONE;
+        u32 temp;
+
+        if (unlikely(intsts & inten & INT_STS_SW_INT_)) {
+                temp = smsc911x_reg_read(pdata, INT_EN);
+                temp &= (~INT_EN_SW_INT_EN_);
+                smsc911x_reg_write(pdata, INT_EN, temp);
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_SW_INT_);
+                pdata->software_irq_signal = 1;
+                smp_wmb();
+                serviced = IRQ_HANDLED;
+        }
+
+        if (unlikely(intsts & inten & INT_STS_RXSTOP_INT_)) {
+                /* Called when there is a multicast update scheduled and
+                 * it is now safe to complete the update */
+                SMSC_TRACE(pdata, intr, "RX Stop interrupt");
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXSTOP_INT_);
+                if (pdata->multicast_update_pending)
+                        smsc911x_rx_multicast_update_workaround(pdata);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (intsts & inten & INT_STS_TDFA_) {
+                temp = smsc911x_reg_read(pdata, FIFO_INT);
+                temp |= FIFO_INT_TX_AVAIL_LEVEL_;
+                smsc911x_reg_write(pdata, FIFO_INT, temp);
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_TDFA_);
+                netif_wake_queue(dev);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (unlikely(intsts & inten & INT_STS_RXE_)) {
+                SMSC_TRACE(pdata, intr, "RX Error interrupt");
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXE_);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (likely(intsts & inten & INT_STS_RSFL_)) {
+                if (likely(napi_schedule_prep(&pdata->napi))) {
+                        /* Disable Rx interrupts */
+                        temp = smsc911x_reg_read(pdata, INT_EN);
+                        temp &= (~INT_EN_RSFL_EN_);
+                        smsc911x_reg_write(pdata, INT_EN, temp);
+                        /* Schedule a NAPI poll */
+                        __napi_schedule(&pdata->napi);
+                } else {
+                        SMSC_WARN(pdata, rx_err, "napi_schedule_prep failed");
+                }
+                serviced = IRQ_HANDLED;
+        }
+
+        return serviced;
+}
+
 static int smsc911x_open(struct net_device *dev)
 {
         struct smsc911x_data *pdata = netdev_priv(dev);
         unsigned int timeout;
         unsigned int temp;
         unsigned int intcfg;
+        int retval;
+        int irq_flags;
 
-        /* if the phy is not yet registered, retry later*/
+        /* find and start the given phy */
         if (!dev->phydev) {
-                SMSC_WARN(pdata, hw, "phy_dev is NULL");
-                return -EAGAIN;
+                retval = smsc911x_mii_probe(dev);
+                if (retval < 0) {
+                        SMSC_WARN(pdata, probe, "Error starting phy");
+                        goto out;
+                }
         }
 
         /* Reset the LAN911x */
-        if (smsc911x_soft_reset(pdata)) {
+        retval = smsc911x_soft_reset(pdata);
+        if (retval) {
                 SMSC_WARN(pdata, hw, "soft reset failed");
-                return -EIO;
+                goto mii_free_out;
         }
 
         smsc911x_reg_write(pdata, HW_CFG, 0x00050000);
@@ -1586,6 +1646,15 @@ static int smsc911x_open(struct net_device *dev)
         pdata->software_irq_signal = 0;
         smp_wmb();
 
+        irq_flags = irq_get_trigger_type(dev->irq);
+        retval = request_irq(dev->irq, smsc911x_irqhandler,
+                             irq_flags | IRQF_SHARED, dev->name, dev);
+        if (retval) {
+                SMSC_WARN(pdata, probe,
+                          "Unable to claim requested irq: %d", dev->irq);
+                goto mii_free_out;
+        }
+
         temp = smsc911x_reg_read(pdata, INT_EN);
         temp |= INT_EN_SW_INT_EN_;
         smsc911x_reg_write(pdata, INT_EN, temp);
@@ -1600,7 +1669,8 @@ static int smsc911x_open(struct net_device *dev)
         if (!pdata->software_irq_signal) {
                 netdev_warn(dev, "ISR failed signaling test (IRQ %d)\n",
                             dev->irq);
-                return -ENODEV;
+                retval = -ENODEV;
+                goto irq_stop_out;
         }
         SMSC_TRACE(pdata, ifup, "IRQ handler passed test using IRQ %d",
                    dev->irq);
@@ -1646,6 +1716,14 @@ static int smsc911x_open(struct net_device *dev)
 
         netif_start_queue(dev);
         return 0;
+
+irq_stop_out:
+        free_irq(dev->irq, dev);
+mii_free_out:
+        phy_disconnect(dev->phydev);
+        dev->phydev = NULL;
+out:
+        return retval;
 }
 
 /* Entry point for stopping the interface */
@@ -1667,9 +1745,15 @@ static int smsc911x_stop(struct net_device *dev)
         dev->stats.rx_dropped += smsc911x_reg_read(pdata, RX_DROP);
         smsc911x_tx_update_txcounters(dev);
 
+        free_irq(dev->irq, dev);
+
         /* Bring the PHY down */
-        if (dev->phydev)
+        if (dev->phydev) {
                 phy_stop(dev->phydev);
+                phy_disconnect(dev->phydev);
+                dev->phydev = NULL;
+        }
+        netif_carrier_off(dev);
 
         SMSC_TRACE(pdata, ifdown, "Interface stopped");
         return 0;
@@ -1811,67 +1895,6 @@ static void smsc911x_set_multicast_list(struct net_device *dev)
         spin_unlock_irqrestore(&pdata->mac_lock, flags);
 }
 
-static irqreturn_t smsc911x_irqhandler(int irq, void *dev_id)
-{
-        struct net_device *dev = dev_id;
-        struct smsc911x_data *pdata = netdev_priv(dev);
-        u32 intsts = smsc911x_reg_read(pdata, INT_STS);
-        u32 inten = smsc911x_reg_read(pdata, INT_EN);
-        int serviced = IRQ_NONE;
-        u32 temp;
-
-        if (unlikely(intsts & inten & INT_STS_SW_INT_)) {
-                temp = smsc911x_reg_read(pdata, INT_EN);
-                temp &= (~INT_EN_SW_INT_EN_);
-                smsc911x_reg_write(pdata, INT_EN, temp);
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_SW_INT_);
-                pdata->software_irq_signal = 1;
-                smp_wmb();
-                serviced = IRQ_HANDLED;
-        }
-
-        if (unlikely(intsts & inten & INT_STS_RXSTOP_INT_)) {
-                /* Called when there is a multicast update scheduled and
-                 * it is now safe to complete the update */
-                SMSC_TRACE(pdata, intr, "RX Stop interrupt");
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXSTOP_INT_);
-                if (pdata->multicast_update_pending)
-                        smsc911x_rx_multicast_update_workaround(pdata);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (intsts & inten & INT_STS_TDFA_) {
-                temp = smsc911x_reg_read(pdata, FIFO_INT);
-                temp |= FIFO_INT_TX_AVAIL_LEVEL_;
-                smsc911x_reg_write(pdata, FIFO_INT, temp);
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_TDFA_);
-                netif_wake_queue(dev);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (unlikely(intsts & inten & INT_STS_RXE_)) {
-                SMSC_TRACE(pdata, intr, "RX Error interrupt");
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXE_);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (likely(intsts & inten & INT_STS_RSFL_)) {
-                if (likely(napi_schedule_prep(&pdata->napi))) {
-                        /* Disable Rx interrupts */
-                        temp = smsc911x_reg_read(pdata, INT_EN);
-                        temp &= (~INT_EN_RSFL_EN_);
-                        smsc911x_reg_write(pdata, INT_EN, temp);
-                        /* Schedule a NAPI poll */
-                        __napi_schedule(&pdata->napi);
-                } else {
-                        SMSC_WARN(pdata, rx_err, "napi_schedule_prep failed");
-                }
-                serviced = IRQ_HANDLED;
-        }
-
-        return serviced;
-}
-
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void smsc911x_poll_controller(struct net_device *dev)
 {
@@ -2291,16 +2314,14 @@ static int smsc911x_drv_remove(struct platform_device *pdev)
         pdata = netdev_priv(dev);
         BUG_ON(!pdata);
         BUG_ON(!pdata->ioaddr);
-        BUG_ON(!dev->phydev);
+        WARN_ON(dev->phydev);
 
         SMSC_TRACE(pdata, ifdown, "Stopping driver");
 
-        phy_disconnect(dev->phydev);
         mdiobus_unregister(pdata->mii_bus);
         mdiobus_free(pdata->mii_bus);
 
         unregister_netdev(dev);
-        free_irq(dev->irq, dev);
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                                            "smsc911x-memory");
         if (!res)
@@ -2385,8 +2406,7 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
         struct smsc911x_data *pdata;
         struct smsc911x_platform_config *config = dev_get_platdata(&pdev->dev);
         struct resource *res;
-        unsigned int intcfg = 0;
-        int res_size, irq, irq_flags;
+        int res_size, irq;
         int retval;
 
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -2425,7 +2445,6 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
 
         pdata = netdev_priv(dev);
         dev->irq = irq;
-        irq_flags = irq_get_trigger_type(irq);
         pdata->ioaddr = ioremap_nocache(res->start, res_size);
 
         pdata->dev = dev;
@@ -2472,43 +2491,23 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
         if (retval < 0)
                 goto out_disable_resources;
 
-        /* configure irq polarity and type before connecting isr */
-        if (pdata->config.irq_polarity == SMSC911X_IRQ_POLARITY_ACTIVE_HIGH)
-                intcfg |= INT_CFG_IRQ_POL_;
-
-        if (pdata->config.irq_type == SMSC911X_IRQ_TYPE_PUSH_PULL)
-                intcfg |= INT_CFG_IRQ_TYPE_;
-
-        smsc911x_reg_write(pdata, INT_CFG, intcfg);
-
-        /* Ensure interrupts are globally disabled before connecting ISR */
-        smsc911x_disable_irq_chip(dev);
+        netif_carrier_off(dev);
 
-        retval = request_irq(dev->irq, smsc911x_irqhandler,
-                             irq_flags | IRQF_SHARED, dev->name, dev);
+        retval = smsc911x_mii_init(pdev, dev);
         if (retval) {
-                SMSC_WARN(pdata, probe,
-                          "Unable to claim requested irq: %d", dev->irq);
+                SMSC_WARN(pdata, probe, "Error %i initialising mii", retval);
                 goto out_disable_resources;
         }
 
-        netif_carrier_off(dev);
-
         retval = register_netdev(dev);
         if (retval) {
                 SMSC_WARN(pdata, probe, "Error %i registering device", retval);
-                goto out_free_irq;
+                goto out_disable_resources;
         } else {
                 SMSC_TRACE(pdata, probe,
                            "Network interface: \"%s\"", dev->name);
         }
 
-        retval = smsc911x_mii_init(pdev, dev);
-        if (retval) {
-                SMSC_WARN(pdata, probe, "Error %i initialising mii", retval);
-                goto out_unregister_netdev_5;
-        }
-
         spin_lock_irq(&pdata->mac_lock);
 
         /* Check if mac address has been specified when bringing interface up */
@@ -2544,10 +2543,6 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
 
         return 0;
 
-out_unregister_netdev_5:
-        unregister_netdev(dev);
-out_free_irq:
-        free_irq(dev->irq, dev);
 out_disable_resources:
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index 5a3941bf250f..4490ebaed127 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
+++ b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -1246,7 +1246,7 @@ static int dwceqos_mii_init(struct net_local *lp)
         lp->mii_bus->read  = &dwceqos_mdio_read;
         lp->mii_bus->write = &dwceqos_mdio_write;
         lp->mii_bus->priv = lp;
-        lp->mii_bus->parent = &lp->ndev->dev;
+        lp->mii_bus->parent = &lp->pdev->dev;
 
         of_address_to_resource(lp->pdev->dev.of_node, 0, &res);
         snprintf(lp->mii_bus->id, MII_BUS_ID_SIZE, "%.8llx",
@@ -2853,25 +2853,17 @@ static int dwceqos_probe(struct platform_device *pdev)
 
         ndev->features = ndev->hw_features;
 
-        netif_napi_add(ndev, &lp->napi, dwceqos_rx_poll, NAPI_POLL_WEIGHT);
-
-        ret = register_netdev(ndev);
-        if (ret) {
-                dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
-                goto err_out_clk_dis_aper;
-        }
-
         lp->phy_ref_clk = devm_clk_get(&pdev->dev, "phy_ref_clk");
         if (IS_ERR(lp->phy_ref_clk)) {
                 dev_err(&pdev->dev, "phy_ref_clk clock not found.\n");
                 ret = PTR_ERR(lp->phy_ref_clk);
-                goto err_out_unregister_netdev;
+                goto err_out_clk_dis_aper;
         }
 
         ret = clk_prepare_enable(lp->phy_ref_clk);
         if (ret) {
                 dev_err(&pdev->dev, "Unable to enable device clock.\n");
-                goto err_out_unregister_netdev;
+                goto err_out_clk_dis_aper;
         }
 
         lp->phy_node = of_parse_phandle(lp->pdev->dev.of_node,
@@ -2880,7 +2872,7 @@ static int dwceqos_probe(struct platform_device *pdev)
                 ret = of_phy_register_fixed_link(lp->pdev->dev.of_node);
                 if (ret < 0) {
                         dev_err(&pdev->dev, "invalid fixed-link");
-                        goto err_out_unregister_clk_notifier;
+                        goto err_out_clk_dis_phy;
                 }
 
                 lp->phy_node = of_node_get(lp->pdev->dev.of_node);
@@ -2889,7 +2881,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = of_get_phy_mode(lp->pdev->dev.of_node);
         if (ret < 0) {
                 dev_err(&lp->pdev->dev, "error in getting phy i/f\n");
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         lp->phy_interface = ret;
@@ -2897,14 +2889,14 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = dwceqos_mii_init(lp);
         if (ret) {
                 dev_err(&lp->pdev->dev, "error in dwceqos_mii_init\n");
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         ret = dwceqos_mii_probe(ndev);
         if (ret != 0) {
                 netdev_err(ndev, "mii_probe fail.\n");
                 ret = -ENXIO;
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         dwceqos_set_umac_addr(lp, lp->ndev->dev_addr, 0);
@@ -2922,7 +2914,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to retrieve DT, error %d\n",
                         ret);
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
         dev_info(&lp->pdev->dev, "pdev->id %d, baseaddr 0x%08lx, irq %d\n",
                  pdev->id, ndev->base_addr, ndev->irq);
@@ -2932,18 +2924,24 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to request IRQ %d, error %d\n",
                         ndev->irq, ret);
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         if (netif_msg_probe(lp))
                 netdev_dbg(ndev, "net_local@%p\n", lp);
 
+        netif_napi_add(ndev, &lp->napi, dwceqos_rx_poll, NAPI_POLL_WEIGHT);
+
+        ret = register_netdev(ndev);
+        if (ret) {
+                dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
+                        goto err_out_clk_dis_phy;
+        }
+
         return 0;
 
-err_out_unregister_clk_notifier:
+err_out_clk_dis_phy:
         clk_disable_unprepare(lp->phy_ref_clk);
-err_out_unregister_netdev:
-        unregister_netdev(ndev);
 err_out_clk_dis_aper:
         clk_disable_unprepare(lp->apb_pclk);
 err_out_free_netdev:
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 47a64342cc16..b4863e4e522b 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -303,6 +303,7 @@ config MDIO_HISI_FEMAC
 
 config MDIO_XGENE
         tristate "APM X-Gene SoC MDIO bus controller"
+        depends on ARCH_XGENE || COMPILE_TEST
         help
           This module provides a driver for the MDIO busses found in the
           APM X-Gene SoC's.
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index c0dda6fc0921..6e65832051d6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2782,14 +2782,15 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         struct net_device *lowerdev = NULL;
 
         if (conf->flags & VXLAN_F_GPE) {
-                if (conf->flags & ~VXLAN_F_ALLOWED_GPE)
-                        return -EINVAL;
                 /* For now, allow GPE only together with COLLECT_METADATA.
                  * This can be relaxed later; in such case, the other side
                  * of the PtP link will have to be provided.
                  */
-                if (!(conf->flags & VXLAN_F_COLLECT_METADATA))
+                if ((conf->flags & ~VXLAN_F_ALLOWED_GPE) ||
+                    !(conf->flags & VXLAN_F_COLLECT_METADATA)) {
+                        pr_info("unsupported combination of extensions\n");
                         return -EINVAL;
+                }
 
                 vxlan_raw_setup(dev);
         } else {
@@ -2842,6 +2843,9 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                         dev->mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
 
                 needed_headroom = lowerdev->hard_header_len;
+        } else if (vxlan_addr_multicast(&dst->remote_ip)) {
+                pr_info("multicast destination requires interface to be specified\n");
+                return -EINVAL;
         }
 
         if (conf->mtu) {
@@ -2874,8 +2878,10 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                      tmp->cfg.saddr.sa.sa_family == AF_INET6) == use_ipv6 &&
                     tmp->cfg.dst_port == vxlan->cfg.dst_port &&
                     (tmp->flags & VXLAN_F_RCV_FLAGS) ==
-                    (vxlan->flags & VXLAN_F_RCV_FLAGS))
-                return -EEXIST;
+                    (vxlan->flags & VXLAN_F_RCV_FLAGS)) {
+                        pr_info("duplicate VNI %u\n", be32_to_cpu(conf->vni));
+                        return -EEXIST;
+                }
         }
 
         dev->ethtool_ops = &vxlan_ethtool_ops;
@@ -2909,7 +2915,6 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
                          struct nlattr *tb[], struct nlattr *data[])
 {
         struct vxlan_config conf;
-        int err;
 
         memset(&conf, 0, sizeof(conf));
 
@@ -3018,26 +3023,7 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
         if (tb[IFLA_MTU])
                 conf.mtu = nla_get_u32(tb[IFLA_MTU]);
 
-        err = vxlan_dev_configure(src_net, dev, &conf);
-        switch (err) {
-        case -ENODEV:
-                pr_info("ifindex %d does not exist\n", conf.remote_ifindex);
-                break;
-
-        case -EPERM:
-                pr_info("IPv6 is disabled via sysctl\n");
-                break;
-
-        case -EEXIST:
-                pr_info("duplicate VNI %u\n", be32_to_cpu(conf.vni));
-                break;
-
-        case -EINVAL:
-                pr_info("unsupported combination of extensions\n");
-                break;
-        }
-
-        return err;
+        return vxlan_dev_configure(src_net, dev, &conf);
 }
 
 static void vxlan_dellink(struct net_device *dev, struct list_head *head)
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 78db5d679f19..24c8d65bcf34 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -1525,7 +1525,7 @@ static void ath10k_htt_rx_h_filter(struct ath10k *ar,
 static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
 {
         struct ath10k *ar = htt->ar;
-        static struct ieee80211_rx_status rx_status;
+        struct ieee80211_rx_status *rx_status = &htt->rx_status;
         struct sk_buff_head amsdu;
         int ret;
 
@@ -1549,11 +1549,11 @@ static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
                 return ret;
         }
 
-        ath10k_htt_rx_h_ppdu(ar, &amsdu, &rx_status, 0xffff);
+        ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
         ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
-        ath10k_htt_rx_h_filter(ar, &amsdu, &rx_status);
-        ath10k_htt_rx_h_mpdu(ar, &amsdu, &rx_status);
-        ath10k_htt_rx_h_deliver(ar, &amsdu, &rx_status);
+        ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
+        ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
+        ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 9a22c478dd1b..07933c51a850 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -3162,7 +3162,6 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 pci_hard_reset = ath10k_pci_qca988x_chip_reset;
                 break;
         case QCA9887_1_0_DEVICE_ID:
-                dev_warn(&pdev->dev, "QCA9887 support is still experimental, there are likely bugs. You have been warned.\n");
                 hw_rev = ATH10K_HW_QCA9887;
                 pci_ps = false;
                 pci_soft_reset = ath10k_pci_warm_reset;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index d1d0c06d627c..14b13f07cd1f 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2482,6 +2482,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 return -EINVAL;
         }
 
+        ath9k_gpio_cap_init(ah);
+
         if (AR_SREV_9485(ah) ||
             AR_SREV_9285(ah) ||
             AR_SREV_9330(ah) ||
@@ -2531,8 +2533,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         else
                 pCap->hw_caps &= ~ATH9K_HW_CAP_HT;
 
-        ath9k_gpio_cap_init(ah);
-
         if (AR_SREV_9160_10_OR_LATER(ah) || AR_SREV_9100(ah))
                 pCap->rts_aggr_limit = ATH_AMPDU_LIMIT_MAX;
         else
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index a394622c9022..7cb65c303f8d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -718,9 +718,12 @@ static int ath9k_start(struct ieee80211_hw *hw)
         if (!ath_complete_reset(sc, false))
                 ah->reset_power_on = false;
 
-        if (ah->led_pin >= 0)
+        if (ah->led_pin >= 0) {
                 ath9k_hw_set_gpio(ah, ah->led_pin,
                                   (ah->config.led_active_high) ? 1 : 0);
+                ath9k_hw_gpio_request_out(ah, ah->led_pin, NULL,
+                                          AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+        }
 
         /*
          * Reset key cache to sane defaults (all entries cleared) instead of
@@ -864,9 +867,11 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         spin_lock_bh(&sc->sc_pcu_lock);
 
-        if (ah->led_pin >= 0)
+        if (ah->led_pin >= 0) {
                 ath9k_hw_set_gpio(ah, ah->led_pin,
                                   (ah->config.led_active_high) ? 0 : 1);
+                ath9k_hw_gpio_request_in(ah, ah->led_pin, NULL);
+        }
 
         ath_prepare_reset(sc);
 
@@ -1154,6 +1159,7 @@ void ath9k_calculate_summary_state(struct ath_softc *sc,
                 bool changed = (iter_data.primary_sta != ctx->primary_sta);
 
                 if (iter_data.primary_sta) {
+                        iter_data.primary_beacon_vif = iter_data.primary_sta;
                         iter_data.beacons = true;
                         ath9k_set_assoc_state(sc, iter_data.primary_sta,
                                               changed);
@@ -1563,13 +1569,13 @@ static int ath9k_sta_state(struct ieee80211_hw *hw,
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         int ret = 0;
 
-        if (old_state == IEEE80211_STA_AUTH &&
-            new_state == IEEE80211_STA_ASSOC) {
+        if (old_state == IEEE80211_STA_NOTEXIST &&
+            new_state == IEEE80211_STA_NONE) {
                 ret = ath9k_sta_add(hw, vif, sta);
                 ath_dbg(common, CONFIG,
                         "Add station: %pM\n", sta->addr);
-        } else if (old_state == IEEE80211_STA_ASSOC &&
-                   new_state == IEEE80211_STA_AUTH) {
+        } else if (old_state == IEEE80211_STA_NONE &&
+                   new_state == IEEE80211_STA_NOTEXIST) {
                 ret = ath9k_sta_remove(hw, vif, sta);
                 ath_dbg(common, CONFIG,
                         "Remove station: %pM\n", sta->addr);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 2628d5e12c64..b8aec5e5ef93 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -4527,7 +4527,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                                 (u8 *)&settings->beacon.head[ie_offset],
                                 settings->beacon.head_len - ie_offset,
                                 WLAN_EID_SSID);
-                if (!ssid_ie)
+                if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
                         return -EINVAL;
 
                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
@@ -5635,7 +5635,7 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
                   ifevent->action, ifevent->flags, ifevent->ifidx,
                   ifevent->bsscfgidx);
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         event->action = ifevent->action;
         vif = event->vif;
 
@@ -5643,7 +5643,7 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
         case BRCMF_E_IF_ADD:
                 /* waiting process may have timed out */
                 if (!cfg->vif_event.vif) {
-                        mutex_unlock(&event->vif_event_lock);
+                        spin_unlock(&event->vif_event_lock);
                         return -EBADF;
                 }
 
@@ -5654,24 +5654,24 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
                         ifp->ndev->ieee80211_ptr = &vif->wdev;
                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
                 }
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 wake_up(&event->vif_wq);
                 return 0;
 
         case BRCMF_E_IF_DEL:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 /* event may not be upon user request */
                 if (brcmf_cfg80211_vif_event_armed(cfg))
                         wake_up(&event->vif_wq);
                 return 0;
 
         case BRCMF_E_IF_CHANGE:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 wake_up(&event->vif_wq);
                 return 0;
 
         default:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 break;
         }
         return -EINVAL;
@@ -5792,7 +5792,7 @@ static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
 {
         init_waitqueue_head(&event->vif_wq);
-        mutex_init(&event->vif_event_lock);
+        spin_lock_init(&event->vif_event_lock);
 }
 
 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
@@ -6691,9 +6691,9 @@ static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
 {
         u8 evt_action;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         evt_action = event->action;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
         return evt_action == action;
 }
 
@@ -6702,10 +6702,10 @@ void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
 {
         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         event->vif = vif;
         event->action = 0;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
 }
 
 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
@@ -6713,9 +6713,9 @@ bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
         bool armed;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         armed = event->vif != NULL;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
 
         return armed;
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
index 7d77f869b7f1..8889832c17e0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
@@ -227,7 +227,7 @@ struct escan_info {
  */
 struct brcmf_cfg80211_vif_event {
         wait_queue_head_t vif_wq;
-        struct mutex vif_event_lock;
+        spinlock_t vif_event_lock;
         u8 action;
         struct brcmf_cfg80211_vif *vif;
 };
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 8d16f0204985..65e8c8766441 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -743,7 +743,7 @@ static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx,
                  * serious troublesome side effects. The p2p module will clean
                  * up the ifp if needed.
                  */
-                brcmf_p2p_ifp_removed(ifp);
+                brcmf_p2p_ifp_removed(ifp, rtnl_locked);
                 kfree(ifp);
         }
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 66f942f7448e..de19c7c92bc6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -2297,7 +2297,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
         return err;
 }
 
-void brcmf_p2p_ifp_removed(struct brcmf_if *ifp)
+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked)
 {
         struct brcmf_cfg80211_info *cfg;
         struct brcmf_cfg80211_vif *vif;
@@ -2306,9 +2306,11 @@ void brcmf_p2p_ifp_removed(struct brcmf_if *ifp)
         vif = ifp->vif;
         cfg = wdev_to_cfg(&vif->wdev);
         cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
-        rtnl_lock();
+        if (!rtnl_locked)
+                rtnl_lock();
         cfg80211_unregister_wdev(&vif->wdev);
-        rtnl_unlock();
+        if (!rtnl_locked)
+                rtnl_unlock();
         brcmf_free_vif(vif);
 }
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
index a3bd18c2360b..8ce9447533ef 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
@@ -155,7 +155,7 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
 int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev);
 int brcmf_p2p_ifchange(struct brcmf_cfg80211_info *cfg,
                        enum brcmf_fil_p2p_if_types if_type);
-void brcmf_p2p_ifp_removed(struct brcmf_if *ifp);
+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked);
 int brcmf_p2p_start_device(struct wiphy *wiphy, struct wireless_dev *wdev);
 void brcmf_p2p_stop_device(struct wiphy *wiphy, struct wireless_dev *wdev);
 int brcmf_p2p_scan_prep(struct wiphy *wiphy,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
index 1abcabb9b6cd..46b52bf705fb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
@@ -960,5 +960,6 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
         }
 
         mvm->fw_dbg_conf = conf_id;
-        return ret;
+
+        return 0;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
index f7dff7612c9c..e9f1be9da7d4 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
@@ -105,7 +105,8 @@ iwl_fw_dbg_trigger_vif_match(struct iwl_fw_dbg_trigger_tlv *trig,
 {
         u32 trig_vif = le32_to_cpu(trig->vif_type);
 
-        return trig_vif == IWL_FW_DBG_CONF_VIF_ANY || vif->type == trig_vif;
+        return trig_vif == IWL_FW_DBG_CONF_VIF_ANY ||
+               ieee80211_vif_type_p2p(vif) == trig_vif;
 }
 
 static inline bool
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 6d6064534d59..5dd77e336617 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -624,6 +624,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
                                NL80211_FEATURE_LOW_PRIORITY_SCAN |
                                NL80211_FEATURE_P2P_GO_OPPPS |
+                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
                                NL80211_FEATURE_DYNAMIC_SMPS |
                                NL80211_FEATURE_STATIC_SMPS |
                                NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index b4fc86d5d7ef..6a615bb73042 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -467,6 +467,8 @@ struct iwl_mvm_vif {
 static inline struct iwl_mvm_vif *
 iwl_mvm_vif_from_mac80211(struct ieee80211_vif *vif)
 {
+        if (!vif)
+                return NULL;
         return (void *)vif->drv_priv;
 }
 
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_aggr.c b/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
index dc49c3de1f25..c47d6366875d 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
@@ -205,7 +205,8 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
 
         do {
                 /* Check if AMSDU can accommodate this MSDU */
-                if (skb_tailroom(skb_aggr) < (skb_src->len + LLC_SNAP_LEN))
+                if ((skb_aggr->len + skb_src->len + LLC_SNAP_LEN) >
+                    adapter->tx_buf_size)
                         break;
 
                 skb_src = skb_dequeue(&pra_list->skb_head);
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 458daf927336..935866fe5ec2 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -185,8 +185,12 @@ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
                 return -ENXIO;
 
         nd_desc = nvdimm_bus->nd_desc;
+        /*
+         * if ndctl does not exist, it's PMEM_LEGACY and
+         * we want to just pretend everything is handled.
+         */
         if (!nd_desc->ndctl)
-                return -ENXIO;
+                return len;
 
         memset(&ars_cap, 0, sizeof(ars_cap));
         ars_cap.address = phys;
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index 0c644f7bdf80..f7d37a62f874 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -30,7 +30,7 @@ config NVME_FABRICS
 
 config NVME_RDMA
         tristate "NVM Express over Fabrics RDMA host driver"
-        depends on INFINIBAND
+        depends on INFINIBAND && BLOCK
         select NVME_CORE
         select NVME_FABRICS
         select SG_POOL
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 8dcf5a960951..60f7eab11865 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1693,7 +1693,12 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
                 nvme_suspend_queue(dev->queues[i]);
 
         if (csts & NVME_CSTS_CFS || !(csts & NVME_CSTS_RDY)) {
-                nvme_suspend_queue(dev->queues[0]);
+                /* A device might become IO incapable very soon during
+                 * probe, before the admin queue is configured. Thus,
+                 * queue_count can be 0 here.
+                 */
+                if (dev->queue_count)
+                        nvme_suspend_queue(dev->queues[0]);
         } else {
                 nvme_disable_io_queues(dev);
                 nvme_disable_admin_queue(dev, shutdown);
@@ -2112,6 +2117,8 @@ static const struct pci_device_id nvme_id_table[] = {
                 .driver_data = NVME_QUIRK_IDENTIFY_CNS, },
         { PCI_DEVICE(0x1c58, 0x0003),   /* HGST adapter */
                 .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
+        { PCI_DEVICE(0x1c5f, 0x0540),   /* Memblaze Pblaze4 adapter */
+                .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
         { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
         { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
         { 0, }
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index ab545fb347a0..c2c2c28e6eb5 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -82,6 +82,8 @@ struct nvme_rdma_request {
 
 enum nvme_rdma_queue_flags {
         NVME_RDMA_Q_CONNECTED = (1 << 0),
+        NVME_RDMA_IB_QUEUE_ALLOCATED = (1 << 1),
+        NVME_RDMA_Q_DELETING = (1 << 2),
 };
 
 struct nvme_rdma_queue {
@@ -291,6 +293,7 @@ static int nvme_rdma_reinit_request(void *data, struct request *rq)
         if (IS_ERR(req->mr)) {
                 ret = PTR_ERR(req->mr);
                 req->mr = NULL;
+                goto out;
         }
 
         req->mr->need_inval = false;
@@ -480,9 +483,14 @@ out_err:
 
 static void nvme_rdma_destroy_queue_ib(struct nvme_rdma_queue *queue)
 {
-        struct nvme_rdma_device *dev = queue->device;
-        struct ib_device *ibdev = dev->dev;
+        struct nvme_rdma_device *dev;
+        struct ib_device *ibdev;
+
+        if (!test_and_clear_bit(NVME_RDMA_IB_QUEUE_ALLOCATED, &queue->flags))
+                return;
 
+        dev = queue->device;
+        ibdev = dev->dev;
         rdma_destroy_qp(queue->cm_id);
         ib_free_cq(queue->ib_cq);
 
@@ -533,6 +541,7 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue,
                 ret = -ENOMEM;
                 goto out_destroy_qp;
         }
+        set_bit(NVME_RDMA_IB_QUEUE_ALLOCATED, &queue->flags);
 
         return 0;
 
@@ -552,6 +561,7 @@ static int nvme_rdma_init_queue(struct nvme_rdma_ctrl *ctrl,
 
         queue = &ctrl->queues[idx];
         queue->ctrl = ctrl;
+        queue->flags = 0;
         init_completion(&queue->cm_done);
 
         if (idx > 0)
@@ -590,6 +600,7 @@ static int nvme_rdma_init_queue(struct nvme_rdma_ctrl *ctrl,
         return 0;
 
 out_destroy_cm_id:
+        nvme_rdma_destroy_queue_ib(queue);
         rdma_destroy_id(queue->cm_id);
         return ret;
 }
@@ -608,7 +619,7 @@ static void nvme_rdma_free_queue(struct nvme_rdma_queue *queue)
 
 static void nvme_rdma_stop_and_free_queue(struct nvme_rdma_queue *queue)
 {
-        if (!test_and_clear_bit(NVME_RDMA_Q_CONNECTED, &queue->flags))
+        if (test_and_set_bit(NVME_RDMA_Q_DELETING, &queue->flags))
                 return;
         nvme_rdma_stop_queue(queue);
         nvme_rdma_free_queue(queue);
@@ -652,7 +663,7 @@ static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl)
         return 0;
 
 out_free_queues:
-        for (; i >= 1; i--)
+        for (i--; i >= 1; i--)
                 nvme_rdma_stop_and_free_queue(&ctrl->queues[i]);
 
         return ret;
@@ -761,8 +772,13 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
 {
         struct nvme_rdma_ctrl *ctrl = container_of(work,
                         struct nvme_rdma_ctrl, err_work);
+        int i;
 
         nvme_stop_keep_alive(&ctrl->ctrl);
+
+        for (i = 0; i < ctrl->queue_count; i++)
+                clear_bit(NVME_RDMA_Q_CONNECTED, &ctrl->queues[i].flags);
+
         if (ctrl->queue_count > 1)
                 nvme_stop_queues(&ctrl->ctrl);
         blk_mq_stop_hw_queues(ctrl->ctrl.admin_q);
@@ -1305,58 +1321,6 @@ out_destroy_queue_ib:
         return ret;
 }
 
-/**
- * nvme_rdma_device_unplug() - Handle RDMA device unplug
- * @queue:      Queue that owns the cm_id that caught the event
- *
- * DEVICE_REMOVAL event notifies us that the RDMA device is about
- * to unplug so we should take care of destroying our RDMA resources.
- * This event will be generated for each allocated cm_id.
- *
- * In our case, the RDMA resources are managed per controller and not
- * only per queue. So the way we handle this is we trigger an implicit
- * controller deletion upon the first DEVICE_REMOVAL event we see, and
- * hold the event inflight until the controller deletion is completed.
- *
- * One exception that we need to handle is the destruction of the cm_id
- * that caught the event. Since we hold the callout until the controller
- * deletion is completed, we'll deadlock if the controller deletion will
- * call rdma_destroy_id on this queue's cm_id. Thus, we claim ownership
- * of destroying this queue before-hand, destroy the queue resources,
- * then queue the controller deletion which won't destroy this queue and
- * we destroy the cm_id implicitely by returning a non-zero rc to the callout.
- */
-static int nvme_rdma_device_unplug(struct nvme_rdma_queue *queue)
-{
-        struct nvme_rdma_ctrl *ctrl = queue->ctrl;
-        int ret = 0;
-
-        /* Own the controller deletion */
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING))
-                return 0;
-
-        dev_warn(ctrl->ctrl.device,
-                "Got rdma device removal event, deleting ctrl\n");
-
-        /* Get rid of reconnect work if its running */
-        cancel_delayed_work_sync(&ctrl->reconnect_work);
-
-        /* Disable the queue so ctrl delete won't free it */
-        if (test_and_clear_bit(NVME_RDMA_Q_CONNECTED, &queue->flags)) {
-                /* Free this queue ourselves */
-                nvme_rdma_stop_queue(queue);
-                nvme_rdma_destroy_queue_ib(queue);
-
-                /* Return non-zero so the cm_id will destroy implicitly */
-                ret = 1;
-        }
-
-        /* Queue controller deletion */
-        queue_work(nvme_rdma_wq, &ctrl->delete_work);
-        flush_work(&ctrl->delete_work);
-        return ret;
-}
-
 static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
                 struct rdma_cm_event *ev)
 {
@@ -1398,8 +1362,8 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
                 nvme_rdma_error_recovery(queue->ctrl);
                 break;
         case RDMA_CM_EVENT_DEVICE_REMOVAL:
-                /* return 1 means impliciy CM ID destroy */
-                return nvme_rdma_device_unplug(queue);
+                /* device removal is handled via the ib_client API */
+                break;
         default:
                 dev_err(queue->ctrl->ctrl.device,
                         "Unexpected RDMA CM event (%d)\n", ev->event);
@@ -1700,15 +1664,19 @@ static int __nvme_rdma_del_ctrl(struct nvme_rdma_ctrl *ctrl)
 static int nvme_rdma_del_ctrl(struct nvme_ctrl *nctrl)
 {
         struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(nctrl);
-        int ret;
+        int ret = 0;
 
+        /*
+         * Keep a reference until all work is flushed since
+         * __nvme_rdma_del_ctrl can free the ctrl mem
+         */
+        if (!kref_get_unless_zero(&ctrl->ctrl.kref))
+                return -EBUSY;
         ret = __nvme_rdma_del_ctrl(ctrl);
-        if (ret)
-                return ret;
-
-        flush_work(&ctrl->delete_work);
-
-        return 0;
+        if (!ret)
+                flush_work(&ctrl->delete_work);
+        nvme_put_ctrl(&ctrl->ctrl);
+        return ret;
 }
 
 static void nvme_rdma_remove_ctrl_work(struct work_struct *work)
@@ -2005,27 +1973,57 @@ static struct nvmf_transport_ops nvme_rdma_transport = {
         .create_ctrl    = nvme_rdma_create_ctrl,
 };
 
+static void nvme_rdma_add_one(struct ib_device *ib_device)
+{
+}
+
+static void nvme_rdma_remove_one(struct ib_device *ib_device, void *client_data)
+{
+        struct nvme_rdma_ctrl *ctrl;
+
+        /* Delete all controllers using this device */
+        mutex_lock(&nvme_rdma_ctrl_mutex);
+        list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list) {
+                if (ctrl->device->dev != ib_device)
+                        continue;
+                dev_info(ctrl->ctrl.device,
+                        "Removing ctrl: NQN \"%s\", addr %pISp\n",
+                        ctrl->ctrl.opts->subsysnqn, &ctrl->addr);
+                __nvme_rdma_del_ctrl(ctrl);
+        }
+        mutex_unlock(&nvme_rdma_ctrl_mutex);
+
+        flush_workqueue(nvme_rdma_wq);
+}
+
+static struct ib_client nvme_rdma_ib_client = {
+        .name   = "nvme_rdma",
+        .add = nvme_rdma_add_one,
+        .remove = nvme_rdma_remove_one
+};
+
 static int __init nvme_rdma_init_module(void)
 {
+        int ret;
+
         nvme_rdma_wq = create_workqueue("nvme_rdma_wq");
         if (!nvme_rdma_wq)
                 return -ENOMEM;
 
+        ret = ib_register_client(&nvme_rdma_ib_client);
+        if (ret) {
+                destroy_workqueue(nvme_rdma_wq);
+                return ret;
+        }
+
         nvmf_register_transport(&nvme_rdma_transport);
         return 0;
 }
 
 static void __exit nvme_rdma_cleanup_module(void)
 {
-        struct nvme_rdma_ctrl *ctrl;
-
         nvmf_unregister_transport(&nvme_rdma_transport);
-
-        mutex_lock(&nvme_rdma_ctrl_mutex);
-        list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list)
-                __nvme_rdma_del_ctrl(ctrl);
-        mutex_unlock(&nvme_rdma_ctrl_mutex);
-
+        ib_unregister_client(&nvme_rdma_ib_client);
         destroy_workqueue(nvme_rdma_wq);
 }
 
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index d1ef7acf6930..f9357e09e9b3 100644
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -40,6 +40,7 @@ static void pci_destroy_dev(struct pci_dev *dev)
         list_del(&dev->bus_list);
         up_write(&pci_bus_sem);
 
+        pci_bridge_d3_device_removed(dev);
         pci_free_resources(dev);
         put_device(&dev->dev);
 }
@@ -96,8 +97,6 @@ static void pci_remove_bus_device(struct pci_dev *dev)
                 dev->subordinate = NULL;
         }
 
-        pci_bridge_d3_device_removed(dev);
-
         pci_destroy_dev(dev);
 }
 
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 489ea1098c96..69b5e811ea2b 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -977,7 +977,7 @@ static int pcmcia_bus_uevent(struct device *dev, struct kobj_uevent_env *env)
 
 /************************ runtime PM support ***************************/
 
-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state);
+static int pcmcia_dev_suspend(struct device *dev);
 static int pcmcia_dev_resume(struct device *dev);
 
 static int runtime_suspend(struct device *dev)
@@ -985,7 +985,7 @@ static int runtime_suspend(struct device *dev)
         int rc;
 
         device_lock(dev);
-        rc = pcmcia_dev_suspend(dev, PMSG_SUSPEND);
+        rc = pcmcia_dev_suspend(dev);
         device_unlock(dev);
         return rc;
 }
@@ -1135,7 +1135,7 @@ ATTRIBUTE_GROUPS(pcmcia_dev);
 
 /* PM support, also needed for reset */
 
-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state)
+static int pcmcia_dev_suspend(struct device *dev)
 {
         struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
         struct pcmcia_driver *p_drv = NULL;
@@ -1410,6 +1410,9 @@ static struct class_interface pcmcia_bus_interface __refdata = {
         .remove_dev = &pcmcia_bus_remove_socket,
 };
 
+static const struct dev_pm_ops pcmcia_bus_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(pcmcia_dev_suspend, pcmcia_dev_resume)
+};
 
 struct bus_type pcmcia_bus_type = {
         .name = "pcmcia",
@@ -1418,8 +1421,7 @@ struct bus_type pcmcia_bus_type = {
         .dev_groups = pcmcia_dev_groups,
         .probe = pcmcia_device_probe,
         .remove = pcmcia_device_remove,
-        .suspend = pcmcia_dev_suspend,
-        .resume = pcmcia_dev_resume,
+        .pm = &pcmcia_bus_pm_ops,
 };
 
 
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index 483f919e0d2e..91b5f5724cba 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -214,9 +214,8 @@ pxa2xx_pcmcia_frequency_change(struct soc_pcmcia_socket *skt,
 }
 #endif
 
-void pxa2xx_configure_sockets(struct device *dev)
+void pxa2xx_configure_sockets(struct device *dev, struct pcmcia_low_level *ops)
 {
-        struct pcmcia_low_level *ops = dev->platform_data;
         /*
          * We have at least one socket, so set MECR:CIT
          * (Card Is There)
@@ -322,7 +321,7 @@ static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
                         goto err1;
         }
 
-        pxa2xx_configure_sockets(&dev->dev);
+        pxa2xx_configure_sockets(&dev->dev, ops);
         dev_set_drvdata(&dev->dev, sinfo);
 
         return 0;
@@ -348,7 +347,9 @@ static int pxa2xx_drv_pcmcia_remove(struct platform_device *dev)
 
 static int pxa2xx_drv_pcmcia_resume(struct device *dev)
 {
-        pxa2xx_configure_sockets(dev);
+        struct pcmcia_low_level *ops = (struct pcmcia_low_level *)dev->platform_data;
+
+        pxa2xx_configure_sockets(dev, ops);
         return 0;
 }
 
diff --git a/drivers/pcmcia/pxa2xx_base.h b/drivers/pcmcia/pxa2xx_base.h
index b609b45469ed..e58c7a415418 100644
--- a/drivers/pcmcia/pxa2xx_base.h
+++ b/drivers/pcmcia/pxa2xx_base.h
@@ -1,4 +1,4 @@
 int pxa2xx_drv_pcmcia_add_one(struct soc_pcmcia_socket *skt);
 void pxa2xx_drv_pcmcia_ops(struct pcmcia_low_level *ops);
-void pxa2xx_configure_sockets(struct device *dev);
+void pxa2xx_configure_sockets(struct device *dev, struct pcmcia_low_level *ops);
 
diff --git a/drivers/pcmcia/sa1111_badge4.c b/drivers/pcmcia/sa1111_badge4.c
index 12f0dd091477..2f490930430d 100644
--- a/drivers/pcmcia/sa1111_badge4.c
+++ b/drivers/pcmcia/sa1111_badge4.c
@@ -134,20 +134,14 @@ static struct pcmcia_low_level badge4_pcmcia_ops = {
 
 int pcmcia_badge4_init(struct sa1111_dev *dev)
 {
-        int ret = -ENODEV;
-
-        if (machine_is_badge4()) {
-                printk(KERN_INFO
-                       "%s: badge4_pcmvcc=%d, badge4_pcmvpp=%d, badge4_cfvcc=%d\n",
-                       __func__,
-                       badge4_pcmvcc, badge4_pcmvpp, badge4_cfvcc);
-
-                sa11xx_drv_pcmcia_ops(&badge4_pcmcia_ops);
-                ret = sa1111_pcmcia_add(dev, &badge4_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-
-        return ret;
+        printk(KERN_INFO
+               "%s: badge4_pcmvcc=%d, badge4_pcmvpp=%d, badge4_cfvcc=%d\n",
+               __func__,
+               badge4_pcmvcc, badge4_pcmvpp, badge4_cfvcc);
+
+        sa11xx_drv_pcmcia_ops(&badge4_pcmcia_ops);
+        return sa1111_pcmcia_add(dev, &badge4_pcmcia_ops,
+                                 sa11xx_drv_pcmcia_add_one);
 }
 
 static int __init pcmv_setup(char *s)
diff --git a/drivers/pcmcia/sa1111_generic.c b/drivers/pcmcia/sa1111_generic.c
index a1531feb8460..3d95dffcff7a 100644
--- a/drivers/pcmcia/sa1111_generic.c
+++ b/drivers/pcmcia/sa1111_generic.c
@@ -18,6 +18,7 @@
 
 #include <mach/hardware.h>
 #include <asm/hardware/sa1111.h>
+#include <asm/mach-types.h>
 #include <asm/irq.h>
 
 #include "sa1111_generic.h"
@@ -203,19 +204,30 @@ static int pcmcia_probe(struct sa1111_dev *dev)
         sa1111_writel(PCSSR_S0_SLEEP | PCSSR_S1_SLEEP, base + PCSSR);
         sa1111_writel(PCCR_S0_FLT | PCCR_S1_FLT, base + PCCR);
 
+        ret = -ENODEV;
 #ifdef CONFIG_SA1100_BADGE4
-        pcmcia_badge4_init(dev);
+        if (machine_is_badge4())
+                ret = pcmcia_badge4_init(dev);
 #endif
 #ifdef CONFIG_SA1100_JORNADA720
-        pcmcia_jornada720_init(dev);
+        if (machine_is_jornada720())
+                ret = pcmcia_jornada720_init(dev);
 #endif
 #ifdef CONFIG_ARCH_LUBBOCK
-        pcmcia_lubbock_init(dev);
+        if (machine_is_lubbock())
+                ret = pcmcia_lubbock_init(dev);
 #endif
 #ifdef CONFIG_ASSABET_NEPONSET
-        pcmcia_neponset_init(dev);
+        if (machine_is_assabet())
+                ret = pcmcia_neponset_init(dev);
 #endif
-        return 0;
+
+        if (ret) {
+                release_mem_region(dev->res.start, 512);
+                sa1111_disable_device(dev);
+        }
+
+        return ret;
 }
 
 static int pcmcia_remove(struct sa1111_dev *dev)
diff --git a/drivers/pcmcia/sa1111_jornada720.c b/drivers/pcmcia/sa1111_jornada720.c
index c2c30580c83f..480a3ede27c8 100644
--- a/drivers/pcmcia/sa1111_jornada720.c
+++ b/drivers/pcmcia/sa1111_jornada720.c
@@ -94,22 +94,17 @@ static struct pcmcia_low_level jornada720_pcmcia_ops = {
 
 int pcmcia_jornada720_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
+        unsigned int pin = GPIO_A0 | GPIO_A1 | GPIO_A2 | GPIO_A3;
 
-        if (machine_is_jornada720()) {
-                unsigned int pin = GPIO_A0 | GPIO_A1 | GPIO_A2 | GPIO_A3;
+        /* Fixme: why messing around with SA11x0's GPIO1? */
+        GRER |= 0x00000002;
 
-                GRER |= 0x00000002;
+        /* Set GPIO_A<3:1> to be outputs for PCMCIA/CF power controller: */
+        sa1111_set_io_dir(sadev, pin, 0, 0);
+        sa1111_set_io(sadev, pin, 0);
+        sa1111_set_sleep_io(sadev, pin, 0);
 
-                /* Set GPIO_A<3:1> to be outputs for PCMCIA/CF power controller: */
-                sa1111_set_io_dir(sadev, pin, 0, 0);
-                sa1111_set_io(sadev, pin, 0);
-                sa1111_set_sleep_io(sadev, pin, 0);
-
-                sa11xx_drv_pcmcia_ops(&jornada720_pcmcia_ops);
-                ret = sa1111_pcmcia_add(sadev, &jornada720_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-
-        return ret;
+        sa11xx_drv_pcmcia_ops(&jornada720_pcmcia_ops);
+        return sa1111_pcmcia_add(sadev, &jornada720_pcmcia_ops,
+                                 sa11xx_drv_pcmcia_add_one);
 }
diff --git a/drivers/pcmcia/sa1111_lubbock.c b/drivers/pcmcia/sa1111_lubbock.c
index c5caf5790451..e741f499c875 100644
--- a/drivers/pcmcia/sa1111_lubbock.c
+++ b/drivers/pcmcia/sa1111_lubbock.c
@@ -210,27 +210,21 @@ static struct pcmcia_low_level lubbock_pcmcia_ops = {
 
 int pcmcia_lubbock_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
-
-        if (machine_is_lubbock()) {
-                /*
-                 * Set GPIO_A<3:0> to be outputs for the MAX1600,
-                 * and switch to standby mode.
-                 */
-                sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
-                sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-
-                /* Set CF Socket 1 power to standby mode. */
-                lubbock_set_misc_wr((1 << 15) | (1 << 14), 0);
+        /*
+         * Set GPIO_A<3:0> to be outputs for the MAX1600,
+         * and switch to standby mode.
+         */
+        sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
+        sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
+        sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
 
-                pxa2xx_drv_pcmcia_ops(&lubbock_pcmcia_ops);
-                pxa2xx_configure_sockets(&sadev->dev);
-                ret = sa1111_pcmcia_add(sadev, &lubbock_pcmcia_ops,
-                                pxa2xx_drv_pcmcia_add_one);
-        }
+        /* Set CF Socket 1 power to standby mode. */
+        lubbock_set_misc_wr((1 << 15) | (1 << 14), 0);
 
-        return ret;
+        pxa2xx_drv_pcmcia_ops(&lubbock_pcmcia_ops);
+        pxa2xx_configure_sockets(&sadev->dev, &lubbock_pcmcia_ops);
+        return sa1111_pcmcia_add(sadev, &lubbock_pcmcia_ops,
+                                 pxa2xx_drv_pcmcia_add_one);
 }
 
 MODULE_LICENSE("GPL");
diff --git a/drivers/pcmcia/sa1111_neponset.c b/drivers/pcmcia/sa1111_neponset.c
index 1d78739c4c07..019c395eb4bf 100644
--- a/drivers/pcmcia/sa1111_neponset.c
+++ b/drivers/pcmcia/sa1111_neponset.c
@@ -110,20 +110,14 @@ static struct pcmcia_low_level neponset_pcmcia_ops = {
 
 int pcmcia_neponset_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
-
-        if (machine_is_assabet()) {
-                /*
-                 * Set GPIO_A<3:0> to be outputs for the MAX1600,
-                 * and switch to standby mode.
-                 */
-                sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
-                sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa11xx_drv_pcmcia_ops(&neponset_pcmcia_ops);
-                ret = sa1111_pcmcia_add(sadev, &neponset_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-
-        return ret;
+        /*
+         * Set GPIO_A<3:0> to be outputs for the MAX1600,
+         * and switch to standby mode.
+         */
+        sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
+        sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
+        sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
+        sa11xx_drv_pcmcia_ops(&neponset_pcmcia_ops);
+        return sa1111_pcmcia_add(sadev, &neponset_pcmcia_ops,
+                                 sa11xx_drv_pcmcia_add_one);
 }
diff --git a/drivers/pcmcia/sa11xx_base.c b/drivers/pcmcia/sa11xx_base.c
index 9f6ec87b9f9e..48140ac73ed6 100644
--- a/drivers/pcmcia/sa11xx_base.c
+++ b/drivers/pcmcia/sa11xx_base.c
@@ -144,19 +144,19 @@ static int
 sa1100_pcmcia_show_timing(struct soc_pcmcia_socket *skt, char *buf)
 {
         struct soc_pcmcia_timing timing;
-        unsigned int clock = clk_get_rate(skt->clk);
+        unsigned int clock = clk_get_rate(skt->clk) / 1000;
         unsigned long mecr = MECR;
         char *p = buf;
 
         soc_common_pcmcia_get_timing(skt, &timing);
 
-        p+=sprintf(p, "I/O      : %u (%u)\n", timing.io,
+        p+=sprintf(p, "I/O      : %uns (%uns)\n", timing.io,
                    sa1100_pcmcia_cmd_time(clock, MECR_BSIO_GET(mecr, skt->nr)));
 
-        p+=sprintf(p, "attribute: %u (%u)\n", timing.attr,
+        p+=sprintf(p, "attribute: %uns (%uns)\n", timing.attr,
                    sa1100_pcmcia_cmd_time(clock, MECR_BSA_GET(mecr, skt->nr)));
 
-        p+=sprintf(p, "common   : %u (%u)\n", timing.mem,
+        p+=sprintf(p, "common   : %uns (%uns)\n", timing.mem,
                    sa1100_pcmcia_cmd_time(clock, MECR_BSM_GET(mecr, skt->nr)));
 
         return p - buf;
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index eed5e9c05353..d5ca760c4eb2 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -235,7 +235,7 @@ static unsigned int soc_common_pcmcia_skt_state(struct soc_pcmcia_socket *skt)
         stat |= skt->cs_state.Vcc ? SS_POWERON : 0;
 
         if (skt->cs_state.flags & SS_IOCARD)
-                stat |= state.bvd1 ? SS_STSCHG : 0;
+                stat |= state.bvd1 ? 0 : SS_STSCHG;
         else {
                 if (state.bvd1 == 0)
                         stat |= SS_BATDEAD;
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 5749a4eee746..0fe8fad25e4d 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1539,12 +1539,11 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                 offset += range->npins;
         }
 
-        /* Mask and clear all interrupts */
-        chv_writel(0, pctrl->regs + CHV_INTMASK);
+        /* Clear all interrupts */
         chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
 
         ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
-                                   handle_simple_irq, IRQ_TYPE_NONE);
+                                   handle_bad_irq, IRQ_TYPE_NONE);
         if (ret) {
                 dev_err(pctrl->dev, "failed to add IRQ chip\n");
                 goto fail;
diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
index 7bad200bd67c..55375b1b3cc8 100644
--- a/drivers/pinctrl/pinctrl-pistachio.c
+++ b/drivers/pinctrl/pinctrl-pistachio.c
@@ -809,17 +809,17 @@ static const struct pistachio_pin_group pistachio_groups[] = {
                            PADS_FUNCTION_SELECT2, 12, 0x3),
         MFIO_MUX_PIN_GROUP(83, MIPS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
                            PADS_FUNCTION_SELECT2, 14, 0x3),
-        MFIO_MUX_PIN_GROUP(84, SYS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
+        MFIO_MUX_PIN_GROUP(84, AUDIO_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
                            PADS_FUNCTION_SELECT2, 16, 0x3),
-        MFIO_MUX_PIN_GROUP(85, WIFI_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+        MFIO_MUX_PIN_GROUP(85, RPU_V_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
                            PADS_FUNCTION_SELECT2, 18, 0x3),
-        MFIO_MUX_PIN_GROUP(86, BT_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+        MFIO_MUX_PIN_GROUP(86, RPU_L_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
                            PADS_FUNCTION_SELECT2, 20, 0x3),
-        MFIO_MUX_PIN_GROUP(87, RPU_V_PLL_LOCK, DREQ2, SOCIF_DEBUG,
+        MFIO_MUX_PIN_GROUP(87, SYS_PLL_LOCK, DREQ2, SOCIF_DEBUG,
                            PADS_FUNCTION_SELECT2, 22, 0x3),
-        MFIO_MUX_PIN_GROUP(88, RPU_L_PLL_LOCK, DREQ3, SOCIF_DEBUG,
+        MFIO_MUX_PIN_GROUP(88, WIFI_PLL_LOCK, DREQ3, SOCIF_DEBUG,
                            PADS_FUNCTION_SELECT2, 24, 0x3),
-        MFIO_MUX_PIN_GROUP(89, AUDIO_PLL_LOCK, DREQ4, DREQ5,
+        MFIO_MUX_PIN_GROUP(89, BT_PLL_LOCK, DREQ4, DREQ5,
                            PADS_FUNCTION_SELECT2, 26, 0x3),
         PIN_GROUP(TCK, "tck"),
         PIN_GROUP(TRSTN, "trstn"),
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
index ce483b03a263..f9d661e5c14a 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
@@ -485,12 +485,12 @@ static const struct sunxi_desc_pin sun8i_a23_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* RTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* RTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 8)),  /* PG_EINT8 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* CTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* CTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 9)),  /* PG_EINT9 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
index 3040abe6f73a..3131cac2b76f 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
@@ -407,12 +407,12 @@ static const struct sunxi_desc_pin sun8i_a33_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* RTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* RTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 8)),  /* PG_EINT8 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* CTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* CTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 9)),  /* PG_EINT9 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
index 3fa17ac8df54..cebc296463ad 100644
--- a/drivers/rapidio/rio_cm.c
+++ b/drivers/rapidio/rio_cm.c
@@ -2247,17 +2247,30 @@ static int rio_cm_shutdown(struct notifier_block *nb, unsigned long code,
 {
         struct rio_channel *ch;
         unsigned int i;
+        LIST_HEAD(list);
 
         riocm_debug(EXIT, ".");
 
+        /*
+         * If there are any channels left in connected state send
+         * close notification to the connection partner.
+         * First build a list of channels that require a closing
+         * notification because function riocm_send_close() should
+         * be called outside of spinlock protected code.
+         */
         spin_lock_bh(&idr_lock);
         idr_for_each_entry(&ch_idr, ch, i) {
-                riocm_debug(EXIT, "close ch %d", ch->id);
-                if (ch->state == RIO_CM_CONNECTED)
-                        riocm_send_close(ch);
+                if (ch->state == RIO_CM_CONNECTED) {
+                        riocm_debug(EXIT, "close ch %d", ch->id);
+                        idr_remove(&ch_idr, ch->id);
+                        list_add(&ch->ch_node, &list);
+                }
         }
         spin_unlock_bh(&idr_lock);
 
+        list_for_each_entry(ch, &list, ch_node)
+                riocm_send_close(ch);
+
         return NOTIFY_DONE;
 }
 
diff --git a/drivers/regulator/max14577-regulator.c b/drivers/regulator/max14577-regulator.c
index b2daa6641417..c9ff26199711 100644
--- a/drivers/regulator/max14577-regulator.c
+++ b/drivers/regulator/max14577-regulator.c
@@ -2,7 +2,7 @@
  * max14577.c - Regulator driver for the Maxim 14577/77836
  *
  * Copyright (C) 2013,2014 Samsung Electronics
- * Krzysztof Kozlowski <k.kozlowski@samsung.com>
+ * Krzysztof Kozlowski <krzk@kernel.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -331,7 +331,7 @@ static void __exit max14577_regulator_exit(void)
 }
 module_exit(max14577_regulator_exit);
 
-MODULE_AUTHOR("Krzysztof Kozlowski <k.kozlowski@samsung.com>");
+MODULE_AUTHOR("Krzysztof Kozlowski <krzk@kernel.org>");
 MODULE_DESCRIPTION("Maxim 14577/77836 regulator driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:max14577-regulator");
diff --git a/drivers/regulator/max77693-regulator.c b/drivers/regulator/max77693-regulator.c
index de730fd3f8a5..cfbb9512e486 100644
--- a/drivers/regulator/max77693-regulator.c
+++ b/drivers/regulator/max77693-regulator.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2013-2015 Samsung Electronics
  * Jonghwa Lee <jonghwa3.lee@samsung.com>
- * Krzysztof Kozlowski <k.kozlowski.k@gmail.com>
+ * Krzysztof Kozlowski <krzk@kernel.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -314,5 +314,5 @@ module_exit(max77693_pmic_cleanup);
 
 MODULE_DESCRIPTION("MAXIM 77693/77843 regulator driver");
 MODULE_AUTHOR("Jonghwa Lee <jonghwa3.lee@samsung.com>");
-MODULE_AUTHOR("Krzysztof Kozlowski <k.kozlowski.k@gmail.com>");
+MODULE_AUTHOR("Krzysztof Kozlowski <krzk@kernel.org>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
index 5022fa8d10c6..8ed46a9a55c8 100644
--- a/drivers/regulator/qcom_smd-regulator.c
+++ b/drivers/regulator/qcom_smd-regulator.c
@@ -178,20 +178,21 @@ static const struct regulator_desc pma8084_hfsmps = {
 static const struct regulator_desc pma8084_ftsmps = {
         .linear_ranges = (struct regulator_linear_range[]) {
                 REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-                REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+                REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
         },
         .n_linear_ranges = 2,
-        .n_voltages = 340,
+        .n_voltages = 262,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pma8084_pldo = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE(750000,  0,  30, 25000),
-                REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+                REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
+                REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+                REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
         },
-        .n_linear_ranges = 2,
-        .n_voltages = 100,
+        .n_linear_ranges = 3,
+        .n_voltages = 164,
         .ops = &rpm_smps_ldo_ops,
 };
 
@@ -221,29 +222,30 @@ static const struct regulator_desc pm8x41_hfsmps = {
 static const struct regulator_desc pm8841_ftsmps = {
         .linear_ranges = (struct regulator_linear_range[]) {
                 REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-                REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+                REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
         },
         .n_linear_ranges = 2,
-        .n_voltages = 340,
+        .n_voltages = 262,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_boost = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000),
+                REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000),
         },
         .n_linear_ranges = 1,
-        .n_voltages = 16,
+        .n_voltages = 31,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_pldo = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE( 750000,  0,  30, 25000),
-                REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+                REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
+                REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+                REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
         },
-        .n_linear_ranges = 2,
-        .n_voltages = 100,
+        .n_linear_ranges = 3,
+        .n_voltages = 164,
         .ops = &rpm_smps_ldo_ops,
 };
 
diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
index 83458f7a2824..6dc96c8dfe75 100644
--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -361,8 +361,9 @@ static const char * const snstext[] = {
 
 /* Get sense key string or NULL if not available */
 const char *
-scsi_sense_key_string(unsigned char key) {
-        if (key <= 0xE)
+scsi_sense_key_string(unsigned char key)
+{
+        if (key < ARRAY_SIZE(snstext))
                 return snstext[key];
         return NULL;
 }
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index eaccd651ccda..246456925335 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -246,6 +246,10 @@ static struct {
         {"IBM", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"SUN", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"DELL", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"STK", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"NETAPP", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"LSI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"ENGENIO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"SMSC", "USB 2 HS-CF", NULL, BLIST_SPARSELUN | BLIST_INQUIRY_36},
         {"SONY", "CD-ROM CDU-8001", NULL, BLIST_BORKEN},
         {"SONY", "TSL", NULL, BLIST_FORCELUN},          /* DDS3 & DDS4 autoloaders */
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 3f0ff072184b..60b651bfaa01 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -341,22 +341,6 @@ static int do_sas_phy_delete(struct device *dev, void *data)
 }
 
 /**
- * is_sas_attached - check if device is SAS attached
- * @sdev: scsi device to check
- *
- * returns true if the device is SAS attached
- */
-int is_sas_attached(struct scsi_device *sdev)
-{
-        struct Scsi_Host *shost = sdev->host;
-
-        return shost->transportt->host_attrs.ac.class ==
-                &sas_host_class.class;
-}
-EXPORT_SYMBOL(is_sas_attached);
-
-
-/**
  * sas_remove_children  -  tear down a devices SAS data structures
  * @dev:        device belonging to the sas object
  *
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 0e8601aa877a..8c9a35c91705 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -587,7 +587,7 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
 
         ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0);
 
-        if (is_sas_attached(sdev))
+        if (scsi_is_sas_rphy(&sdev->sdev_gendev))
                 efd.addr = sas_get_address(sdev);
 
         if (efd.addr) {
diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index 823cbc92d1e7..7a37090dabbe 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -720,8 +720,6 @@ static int img_spfi_remove(struct platform_device *pdev)
                 clk_disable_unprepare(spfi->sys_clk);
         }
 
-        spi_master_put(master);
-
         return 0;
 }
 
diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
index 0be89e052428..899d7a8f0889 100644
--- a/drivers/spi/spi-mt65xx.c
+++ b/drivers/spi/spi-mt65xx.c
@@ -685,7 +685,6 @@ static int mtk_spi_remove(struct platform_device *pdev)
         pm_runtime_disable(&pdev->dev);
 
         mtk_spi_reset(mdata);
-        spi_master_put(master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
index f3df522db93b..58d2d48e16a5 100644
--- a/drivers/spi/spi-pxa2xx-pci.c
+++ b/drivers/spi/spi-pxa2xx-pci.c
@@ -214,6 +214,7 @@ static int pxa2xx_spi_pci_probe(struct pci_dev *dev,
                 return PTR_ERR(ssp->clk);
 
         memset(&pi, 0, sizeof(pi));
+        pi.fwnode = dev->dev.fwnode;
         pi.parent = &dev->dev;
         pi.name = "pxa2xx-spi";
         pi.id = ssp->port_id;
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index c338ef1136f6..7f1555621f8e 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -1030,7 +1030,6 @@ static int spi_qup_remove(struct platform_device *pdev)
 
         pm_runtime_put_noidle(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
-        spi_master_put(master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 0f83ad1d5a58..1de3a772eb7d 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -262,6 +262,9 @@ static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p,
 
         for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) {
                 brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div);
+                /* SCR_BRDV_DIV_1 is valid only if BRPS is x 1/1 or x 1/2 */
+                if (sh_msiof_spi_div_table[k].div == 1 && brps > 2)
+                        continue;
                 if (brps <= 32) /* max of brdv is 32 */
                         break;
         }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 51ad42fad567..200ca228d885 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -960,7 +960,7 @@ static int spi_transfer_one_message(struct spi_master *master,
         struct spi_transfer *xfer;
         bool keep_cs = false;
         int ret = 0;
-        unsigned long ms = 1;
+        unsigned long long ms = 1;
         struct spi_statistics *statm = &master->statistics;
         struct spi_statistics *stats = &msg->spi->statistics;
 
@@ -991,9 +991,13 @@ static int spi_transfer_one_message(struct spi_master *master,
 
                         if (ret > 0) {
                                 ret = 0;
-                                ms = xfer->len * 8 * 1000 / xfer->speed_hz;
+                                ms = 8LL * 1000LL * xfer->len;
+                                do_div(ms, xfer->speed_hz);
                                 ms += ms + 100; /* some tolerance */
 
+                                if (ms > UINT_MAX)
+                                        ms = UINT_MAX;
+
                                 ms = wait_for_completion_timeout(&master->xfer_completion,
                                                                  msecs_to_jiffies(ms));
                         }
@@ -1159,6 +1163,7 @@ static void __spi_pump_messages(struct spi_master *master, bool in_kthread)
                 if (ret < 0) {
                         dev_err(&master->dev, "Failed to power device: %d\n",
                                 ret);
+                        mutex_unlock(&master->io_mutex);
                         return;
                 }
         }
@@ -1174,6 +1179,7 @@ static void __spi_pump_messages(struct spi_master *master, bool in_kthread)
 
                         if (master->auto_runtime_pm)
                                 pm_runtime_put(master->dev.parent);
+                        mutex_unlock(&master->io_mutex);
                         return;
                 }
         }
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 71a339271fa5..5f817923f374 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -504,6 +504,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                 if (IS_ERR(priv->zone)) {
                         dev_err(dev, "can't register thermal zone\n");
                         ret = PTR_ERR(priv->zone);
+                        priv->zone = NULL;
                         goto error_unregister;
                 }
 
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index dfec5a176315..b93356834bb5 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -949,6 +949,15 @@ static int isr_setup_status_phase(struct ci_hdrc *ci)
         int retval;
         struct ci_hw_ep *hwep;
 
+        /*
+         * Unexpected USB controller behavior, caused by bad signal integrity
+         * or ground reference problems, can lead to isr_setup_status_phase
+         * being called with ci->status equal to NULL.
+         * If this situation occurs, you should review your USB hardware design.
+         */
+        if (WARN_ON_ONCE(!ci->status))
+                return -EPIPE;
+
         hwep = (ci->ep0_dir == TX) ? ci->ep0out : ci->ep0in;
         ci->status->context = ci;
         ci->status->complete = isr_setup_status_complete;
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 15ce4ab11688..a2d90aca779f 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -240,8 +240,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
         memcpy(&endpoint->desc, d, n);
         INIT_LIST_HEAD(&endpoint->urb_list);
 
-        /* Fix up bInterval values outside the legal range. Use 32 ms if no
-         * proper value can be guessed. */
+        /*
+         * Fix up bInterval values outside the legal range.
+         * Use 10 or 8 ms if no proper value can be guessed.
+         */
         i = 0;          /* i = min, j = max, n = default */
         j = 255;
         if (usb_endpoint_xfer_int(d)) {
@@ -250,13 +252,15 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                 case USB_SPEED_SUPER_PLUS:
                 case USB_SPEED_SUPER:
                 case USB_SPEED_HIGH:
-                        /* Many device manufacturers are using full-speed
+                        /*
+                         * Many device manufacturers are using full-speed
                          * bInterval values in high-speed interrupt endpoint
-                         * descriptors. Try to fix those and fall back to a
-                         * 32 ms default value otherwise. */
+                         * descriptors. Try to fix those and fall back to an
+                         * 8-ms default value otherwise.
+                         */
                         n = fls(d->bInterval*8);
                         if (n == 0)
-                                n = 9;  /* 32 ms = 2^(9-1) uframes */
+                                n = 7;  /* 8 ms = 2^(7-1) uframes */
                         j = 16;
 
                         /*
@@ -271,10 +275,12 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                         }
                         break;
                 default:                /* USB_SPEED_FULL or _LOW */
-                        /* For low-speed, 10 ms is the official minimum.
+                        /*
+                         * For low-speed, 10 ms is the official minimum.
                          * But some "overclocked" devices might want faster
-                         * polling so we'll allow it. */
-                        n = 32;
+                         * polling so we'll allow it.
+                         */
+                        n = 10;
                         break;
                 }
         } else if (usb_endpoint_xfer_isoc(d)) {
@@ -282,10 +288,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                 j = 16;
                 switch (to_usb_device(ddev)->speed) {
                 case USB_SPEED_HIGH:
-                        n = 9;          /* 32 ms = 2^(9-1) uframes */
+                        n = 7;          /* 8 ms = 2^(7-1) uframes */
                         break;
                 default:                /* USB_SPEED_FULL */
-                        n = 6;          /* 32 ms = 2^(6-1) frames */
+                        n = 4;          /* 8 ms = 2^(4-1) frames */
                         break;
                 }
         }
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 0a32430f4c41..6df0f5dad9a4 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -249,7 +249,9 @@ static int dwc3_pci_runtime_resume(struct device *dev)
 
         return pm_runtime_get(&dwc3->dev);
 }
+#endif /* CONFIG_PM */
 
+#ifdef CONFIG_PM_SLEEP
 static int dwc3_pci_pm_dummy(struct device *dev)
 {
         /*
@@ -262,7 +264,7 @@ static int dwc3_pci_pm_dummy(struct device *dev)
          */
         return 0;
 }
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 
 static struct dev_pm_ops dwc3_pci_dev_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(dwc3_pci_pm_dummy, dwc3_pci_pm_dummy)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 7a8d3d822b54..122e64df2f4d 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -884,9 +884,12 @@ static u32 dwc3_calc_trbs_left(struct dwc3_ep *dep)
                 return DWC3_TRB_NUM - 1;
         }
 
-        trbs_left = dep->trb_dequeue - dep->trb_enqueue - 1;
+        trbs_left = dep->trb_dequeue - dep->trb_enqueue;
         trbs_left &= (DWC3_TRB_NUM - 1);
 
+        if (dep->trb_dequeue < dep->trb_enqueue)
+                trbs_left--;
+
         return trbs_left;
 }
 
diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index 8741fd740174..007ec6e4a5d4 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -342,7 +342,7 @@ static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb)
         struct sk_buff  *skb2 = NULL;
         struct usb_ep   *in = port->in_ep;
         int             headroom, tailroom, padlen = 0;
-        u16             len = skb->len;
+        u16             len;
 
         if (!skb)
                 return NULL;
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 93a3bec81df7..fb8fc34827ab 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -106,6 +106,7 @@
 
 /* DRD_CON */
 #define DRD_CON_PERI_CON        BIT(24)
+#define DRD_CON_VBOUT           BIT(0)
 
 /* USB_INT_ENA_1 and USB_INT_STA_1 */
 #define USB_INT_1_B3_PLLWKUP    BIT(31)
@@ -363,6 +364,7 @@ static void usb3_init_epc_registers(struct renesas_usb3 *usb3)
 {
         /* FIXME: How to change host / peripheral mode as well? */
         usb3_set_bit(usb3, DRD_CON_PERI_CON, USB3_DRD_CON);
+        usb3_clear_bit(usb3, DRD_CON_VBOUT, USB3_DRD_CON);
 
         usb3_write(usb3, ~0, USB3_USB_INT_STA_1);
         usb3_enable_irq_1(usb3, USB_INT_1_VBUS_CNG);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index fd9fd12e4861..797137e26549 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -850,6 +850,10 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
         spin_lock_irqsave(&xhci->lock, flags);
 
         ep->stop_cmds_pending--;
+        if (xhci->xhc_state & XHCI_STATE_REMOVING) {
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                return;
+        }
         if (xhci->xhc_state & XHCI_STATE_DYING) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                                 "Stop EP timer ran, but another timer marked "
@@ -903,7 +907,7 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
         spin_unlock_irqrestore(&xhci->lock, flags);
         xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                         "Calling usb_hc_died()");
-        usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);
+        usb_hc_died(xhci_to_hcd(xhci));
         xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                         "xHCI host controller is dead.");
 }
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 886526b5fcdd..73cfa13fc0dc 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -87,7 +87,7 @@ config USB_MUSB_DA8XX
 config USB_MUSB_TUSB6010
         tristate "TUSB6010"
         depends on HAS_IOMEM
-        depends on ARCH_OMAP2PLUS || COMPILE_TEST
+        depends on (ARCH_OMAP2PLUS || COMPILE_TEST) && !BLACKFIN
         depends on NOP_USB_XCEIV = USB_MUSB_HDRC # both built-in or both modules
 
 config USB_MUSB_OMAP2PLUS
diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c
index 980c9dee09eb..427efb5eebae 100644
--- a/drivers/usb/phy/phy-generic.c
+++ b/drivers/usb/phy/phy-generic.c
@@ -144,14 +144,18 @@ static irqreturn_t nop_gpio_vbus_thread(int irq, void *data)
 int usb_gen_phy_init(struct usb_phy *phy)
 {
         struct usb_phy_generic *nop = dev_get_drvdata(phy->dev);
+        int ret;
 
         if (!IS_ERR(nop->vcc)) {
                 if (regulator_enable(nop->vcc))
                         dev_err(phy->dev, "Failed to enable power\n");
         }
 
-        if (!IS_ERR(nop->clk))
-                clk_prepare_enable(nop->clk);
+        if (!IS_ERR(nop->clk)) {
+                ret = clk_prepare_enable(nop->clk);
+                if (ret)
+                        return ret;
+        }
 
         nop_reset(nop);
 
diff --git a/drivers/usb/renesas_usbhs/mod.c b/drivers/usb/renesas_usbhs/mod.c
index d4be5d594896..28965ef4f824 100644
--- a/drivers/usb/renesas_usbhs/mod.c
+++ b/drivers/usb/renesas_usbhs/mod.c
@@ -282,9 +282,16 @@ static irqreturn_t usbhs_interrupt(int irq, void *data)
         if (usbhs_mod_is_host(priv))
                 usbhs_write(priv, INTSTS1, ~irq_state.intsts1 & INTSTS1_MAGIC);
 
-        usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
+        /*
+         * The driver should not clear the xxxSTS after the line of
+         * "call irq callback functions" because each "if" statement is
+         * possible to call the callback function for avoiding any side effects.
+         */
+        if (irq_state.intsts0 & BRDY)
+                usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
         usbhs_write(priv, NRDYSTS, ~irq_state.nrdysts);
-        usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
+        if (irq_state.intsts0 & BEMP)
+                usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
 
         /*
          * call irq callback functions
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index a204782ae530..e98b6e57b703 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -54,7 +54,8 @@ DEVICE(funsoft, FUNSOFT_IDS);
 /* Infineon Flashloader driver */
 #define FLASHLOADER_IDS()               \
         { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
-        { USB_DEVICE(0x8087, 0x0716) }
+        { USB_DEVICE(0x8087, 0x0716) }, \
+        { USB_DEVICE(0x8087, 0x0801) }
 DEVICE(flashloader, FLASHLOADER_IDS);
 
 /* Google Serial USB SubClass */
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index e383ecdaca59..ed9c9eeedfe5 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -167,7 +167,7 @@ static bool vring_use_dma_api(struct virtio_device *vdev)
  * making all of the arch DMA ops work on the vring device itself
  * is a mess.  For now, we use the parent device for DMA ops.
  */
-struct device *vring_dma_dev(const struct vring_virtqueue *vq)
+static struct device *vring_dma_dev(const struct vring_virtqueue *vq)
 {
         return vq->vq.vdev->dev.parent;
 }
diff --git a/fs/aio.c b/fs/aio.c
index fb8e45b88cd4..4fe81d1c60f9 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct file_system_type *fs_type,
         static const struct dentry_operations ops = {
                 .d_dname        = simple_dname,
         };
-        return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
+        struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
+                                           AIO_RING_MAGIC);
+
+        if (!IS_ERR(root))
+                root->d_sb->s_iflags |= SB_I_NOEXEC;
+        return root;
 }
 
 /* aio_setup
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index b493909e7492..d8e6d421c27f 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -417,6 +417,7 @@ static struct dentry *should_expire(struct dentry *dentry,
         }
         return NULL;
 }
+
 /*
  * Find an eligible tree to time-out
  * A tree is eligible if :-
@@ -432,6 +433,7 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
         struct dentry *root = sb->s_root;
         struct dentry *dentry;
         struct dentry *expired;
+        struct dentry *found;
         struct autofs_info *ino;
 
         if (!root)
@@ -442,31 +444,46 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
 
         dentry = NULL;
         while ((dentry = get_next_positive_subdir(dentry, root))) {
+                int flags = how;
+
                 spin_lock(&sbi->fs_lock);
                 ino = autofs4_dentry_ino(dentry);
-                if (ino->flags & AUTOFS_INF_WANT_EXPIRE)
-                        expired = NULL;
-                else
-                        expired = should_expire(dentry, mnt, timeout, how);
-                if (!expired) {
+                if (ino->flags & AUTOFS_INF_WANT_EXPIRE) {
                         spin_unlock(&sbi->fs_lock);
                         continue;
                 }
+                spin_unlock(&sbi->fs_lock);
+
+                expired = should_expire(dentry, mnt, timeout, flags);
+                if (!expired)
+                        continue;
+
+                spin_lock(&sbi->fs_lock);
                 ino = autofs4_dentry_ino(expired);
                 ino->flags |= AUTOFS_INF_WANT_EXPIRE;
                 spin_unlock(&sbi->fs_lock);
                 synchronize_rcu();
-                spin_lock(&sbi->fs_lock);
-                if (should_expire(expired, mnt, timeout, how)) {
-                        if (expired != dentry)
-                                dput(dentry);
-                        goto found;
-                }
 
+                /* Make sure a reference is not taken on found if
+                 * things have changed.
+                 */
+                flags &= ~AUTOFS_EXP_LEAVES;
+                found = should_expire(expired, mnt, timeout, how);
+                if (!found || found != expired)
+                        /* Something has changed, continue */
+                        goto next;
+
+                if (expired != dentry)
+                        dput(dentry);
+
+                spin_lock(&sbi->fs_lock);
+                goto found;
+next:
+                spin_lock(&sbi->fs_lock);
                 ino->flags &= ~AUTOFS_INF_WANT_EXPIRE;
+                spin_unlock(&sbi->fs_lock);
                 if (expired != dentry)
                         dput(expired);
-                spin_unlock(&sbi->fs_lock);
         }
         return NULL;
 
@@ -483,6 +500,7 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
         struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
         struct autofs_info *ino = autofs4_dentry_ino(dentry);
         int status;
+        int state;
 
         /* Block on any pending expire */
         if (!(ino->flags & AUTOFS_INF_WANT_EXPIRE))
@@ -490,8 +508,19 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
         if (rcu_walk)
                 return -ECHILD;
 
+retry:
         spin_lock(&sbi->fs_lock);
-        if (ino->flags & AUTOFS_INF_EXPIRING) {
+        state = ino->flags & (AUTOFS_INF_WANT_EXPIRE | AUTOFS_INF_EXPIRING);
+        if (state == AUTOFS_INF_WANT_EXPIRE) {
+                spin_unlock(&sbi->fs_lock);
+                /*
+                 * Possibly being selected for expire, wait until
+                 * it's selected or not.
+                 */
+                schedule_timeout_uninterruptible(HZ/10);
+                goto retry;
+        }
+        if (state & AUTOFS_INF_EXPIRING) {
                 spin_unlock(&sbi->fs_lock);
 
                 pr_debug("waiting for expire %p name=%pd\n", dentry, dentry);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index eff3993c77b3..33fe03551105 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -427,6 +427,7 @@ struct btrfs_space_info {
         struct list_head ro_bgs;
         struct list_head priority_tickets;
         struct list_head tickets;
+        u64 tickets_id;
 
         struct rw_semaphore groups_sem;
         /* for block groups in our same type */
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 8c8a4d1e02b9..38c2df84cabd 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4966,12 +4966,12 @@ static void wake_all_tickets(struct list_head *head)
  */
 static void btrfs_async_reclaim_metadata_space(struct work_struct *work)
 {
-        struct reserve_ticket *last_ticket = NULL;
         struct btrfs_fs_info *fs_info;
         struct btrfs_space_info *space_info;
         u64 to_reclaim;
         int flush_state;
         int commit_cycles = 0;
+        u64 last_tickets_id;
 
         fs_info = container_of(work, struct btrfs_fs_info, async_reclaim_work);
         space_info = __find_space_info(fs_info, BTRFS_BLOCK_GROUP_METADATA);
@@ -4984,8 +4984,7 @@ static void btrfs_async_reclaim_metadata_space(struct work_struct *work)
                 spin_unlock(&space_info->lock);
                 return;
         }
-        last_ticket = list_first_entry(&space_info->tickets,
-                                       struct reserve_ticket, list);
+        last_tickets_id = space_info->tickets_id;
         spin_unlock(&space_info->lock);
 
         flush_state = FLUSH_DELAYED_ITEMS_NR;
@@ -5005,10 +5004,10 @@ static void btrfs_async_reclaim_metadata_space(struct work_struct *work)
                                                               space_info);
                 ticket = list_first_entry(&space_info->tickets,
                                           struct reserve_ticket, list);
-                if (last_ticket == ticket) {
+                if (last_tickets_id == space_info->tickets_id) {
                         flush_state++;
                 } else {
-                        last_ticket = ticket;
+                        last_tickets_id = space_info->tickets_id;
                         flush_state = FLUSH_DELAYED_ITEMS_NR;
                         if (commit_cycles)
                                 commit_cycles--;
@@ -5384,6 +5383,7 @@ again:
                         list_del_init(&ticket->list);
                         num_bytes -= ticket->bytes;
                         ticket->bytes = 0;
+                        space_info->tickets_id++;
                         wake_up(&ticket->wait);
                 } else {
                         ticket->bytes -= num_bytes;
@@ -5426,6 +5426,7 @@ again:
                         num_bytes -= ticket->bytes;
                         space_info->bytes_may_use += ticket->bytes;
                         ticket->bytes = 0;
+                        space_info->tickets_id++;
                         wake_up(&ticket->wait);
                 } else {
                         trace_btrfs_space_reservation(fs_info, "space_info",
@@ -8216,6 +8217,7 @@ int btrfs_alloc_logged_file_extent(struct btrfs_trans_handle *trans,
 {
         int ret;
         struct btrfs_block_group_cache *block_group;
+        struct btrfs_space_info *space_info;
 
         /*
          * Mixed block groups will exclude before processing the log so we only
@@ -8231,9 +8233,14 @@ int btrfs_alloc_logged_file_extent(struct btrfs_trans_handle *trans,
         if (!block_group)
                 return -EINVAL;
 
-        ret = btrfs_add_reserved_bytes(block_group, ins->offset,
-                                       ins->offset, 0);
-        BUG_ON(ret); /* logic error */
+        space_info = block_group->space_info;
+        spin_lock(&space_info->lock);
+        spin_lock(&block_group->lock);
+        space_info->bytes_reserved += ins->offset;
+        block_group->reserved += ins->offset;
+        spin_unlock(&block_group->lock);
+        spin_unlock(&space_info->lock);
+
         ret = alloc_reserved_file_extent(trans, root, 0, root_objectid,
                                          0, owner, offset, ins, 1);
         btrfs_put_block_group(block_group);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index e935035ac034..ef9c55bc7907 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2867,6 +2867,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
 
         if (log_root_tree->log_transid_committed >= root_log_ctx.log_transid) {
                 blk_finish_plug(&plug);
+                list_del_init(&root_log_ctx.list);
                 mutex_unlock(&log_root_tree->log_mutex);
                 ret = root_log_ctx.log_ret;
                 goto out;
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index c64a0b794d49..df4b3e6fa563 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -597,7 +597,7 @@ static bool need_reset_readdir(struct ceph_file_info *fi, loff_t new_pos)
         if (is_hash_order(new_pos)) {
                 /* no need to reset last_name for a forward seek when
                  * dentries are sotred in hash order */
-        } else if (fi->frag |= fpos_frag(new_pos)) {
+        } else if (fi->frag != fpos_frag(new_pos)) {
                 return true;
         }
         rinfo = fi->last_readdir ? &fi->last_readdir->r_reply_info : NULL;
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 6bbec5e784cd..14ae4b8e1a3c 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -609,6 +609,9 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
         char *s, *p;
         char sep;
 
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
+                return dget(sb->s_root);
+
         full_path = cifs_build_path_to_root(vol, cifs_sb,
                                             cifs_sb_master_tcon(cifs_sb));
         if (full_path == NULL)
@@ -686,26 +689,22 @@ cifs_do_mount(struct file_system_type *fs_type,
         cifs_sb->mountdata = kstrndup(data, PAGE_SIZE, GFP_KERNEL);
         if (cifs_sb->mountdata == NULL) {
                 root = ERR_PTR(-ENOMEM);
-                goto out_cifs_sb;
+                goto out_free;
         }
 
-        if (volume_info->prepath) {
-                cifs_sb->prepath = kstrdup(volume_info->prepath, GFP_KERNEL);
-                if (cifs_sb->prepath == NULL) {
-                        root = ERR_PTR(-ENOMEM);
-                        goto out_cifs_sb;
-                }
+        rc = cifs_setup_cifs_sb(volume_info, cifs_sb);
+        if (rc) {
+                root = ERR_PTR(rc);
+                goto out_free;
         }
 
-        cifs_setup_cifs_sb(volume_info, cifs_sb);
-
         rc = cifs_mount(cifs_sb, volume_info);
         if (rc) {
                 if (!(flags & MS_SILENT))
                         cifs_dbg(VFS, "cifs_mount failed w/return code = %d\n",
                                  rc);
                 root = ERR_PTR(rc);
-                goto out_mountdata;
+                goto out_free;
         }
 
         mnt_data.vol = volume_info;
@@ -735,11 +734,7 @@ cifs_do_mount(struct file_system_type *fs_type,
                 sb->s_flags |= MS_ACTIVE;
         }
 
-        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
-                root = dget(sb->s_root);
-        else
-                root = cifs_get_root(volume_info, sb);
-
+        root = cifs_get_root(volume_info, sb);
         if (IS_ERR(root))
                 goto out_super;
 
@@ -752,9 +747,9 @@ out:
         cifs_cleanup_volume_info(volume_info);
         return root;
 
-out_mountdata:
+out_free:
+        kfree(cifs_sb->prepath);
         kfree(cifs_sb->mountdata);
-out_cifs_sb:
         kfree(cifs_sb);
 out_nls:
         unload_nls(volume_info->local_nls);
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 1243bd326591..95dab43646f0 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -184,7 +184,7 @@ extern int cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
                                  unsigned int to_read);
 extern int cifs_read_page_from_socket(struct TCP_Server_Info *server,
                                       struct page *page, unsigned int to_read);
-extern void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
+extern int cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                                struct cifs_sb_info *cifs_sb);
 extern int cifs_match_super(struct super_block *, void *);
 extern void cifs_cleanup_volume_info(struct smb_vol *pvolume_info);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 7ae03283bd61..2e4f4bad8b1e 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2781,6 +2781,24 @@ compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
         return 1;
 }
 
+static int
+match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data)
+{
+        struct cifs_sb_info *old = CIFS_SB(sb);
+        struct cifs_sb_info *new = mnt_data->cifs_sb;
+
+        if (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) {
+                if (!(new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH))
+                        return 0;
+                /* The prepath should be null terminated strings */
+                if (strcmp(new->prepath, old->prepath))
+                        return 0;
+
+                return 1;
+        }
+        return 0;
+}
+
 int
 cifs_match_super(struct super_block *sb, void *data)
 {
@@ -2808,7 +2826,8 @@ cifs_match_super(struct super_block *sb, void *data)
 
         if (!match_server(tcp_srv, volume_info) ||
             !match_session(ses, volume_info) ||
-            !match_tcon(tcon, volume_info->UNC)) {
+            !match_tcon(tcon, volume_info->UNC) ||
+            !match_prepath(sb, mnt_data)) {
                 rc = 0;
                 goto out;
         }
@@ -3222,7 +3241,7 @@ void reset_cifs_unix_caps(unsigned int xid, struct cifs_tcon *tcon,
         }
 }
 
-void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
+int cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                         struct cifs_sb_info *cifs_sb)
 {
         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
@@ -3316,6 +3335,14 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 
         if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
                 cifs_dbg(VFS, "mount option dynperm ignored if cifsacl mount option supported\n");
+
+        if (pvolume_info->prepath) {
+                cifs_sb->prepath = kstrdup(pvolume_info->prepath, GFP_KERNEL);
+                if (cifs_sb->prepath == NULL)
+                        return -ENOMEM;
+        }
+
+        return 0;
 }
 
 static void
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index 0f9961eede1e..ed115acb5dee 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -11,6 +11,7 @@
 #include <linux/random.h>
 #include <linux/string.h>
 #include <linux/fscrypto.h>
+#include <linux/mount.h>
 
 static int inode_has_encryption_context(struct inode *inode)
 {
@@ -92,26 +93,42 @@ static int create_encryption_context_from_policy(struct inode *inode,
         return inode->i_sb->s_cop->set_context(inode, &ctx, sizeof(ctx), NULL);
 }
 
-int fscrypt_process_policy(struct inode *inode,
+int fscrypt_process_policy(struct file *filp,
                                 const struct fscrypt_policy *policy)
 {
+        struct inode *inode = file_inode(filp);
+        int ret;
+
+        if (!inode_owner_or_capable(inode))
+                return -EACCES;
+
         if (policy->version != 0)
                 return -EINVAL;
 
+        ret = mnt_want_write_file(filp);
+        if (ret)
+                return ret;
+
         if (!inode_has_encryption_context(inode)) {
-                if (!inode->i_sb->s_cop->empty_dir)
-                        return -EOPNOTSUPP;
-                if (!inode->i_sb->s_cop->empty_dir(inode))
-                        return -ENOTEMPTY;
-                return create_encryption_context_from_policy(inode, policy);
+                if (!S_ISDIR(inode->i_mode))
+                        ret = -EINVAL;
+                else if (!inode->i_sb->s_cop->empty_dir)
+                        ret = -EOPNOTSUPP;
+                else if (!inode->i_sb->s_cop->empty_dir(inode))
+                        ret = -ENOTEMPTY;
+                else
+                        ret = create_encryption_context_from_policy(inode,
+                                                                    policy);
+        } else if (!is_encryption_context_consistent_with_policy(inode,
+                                                                 policy)) {
+                printk(KERN_WARNING
+                       "%s: Policy inconsistent with encryption context\n",
+                       __func__);
+                ret = -EINVAL;
         }
 
-        if (is_encryption_context_consistent_with_policy(inode, policy))
-                return 0;
-
-        printk(KERN_WARNING "%s: Policy inconsistent with encryption context\n",
-               __func__);
-        return -EINVAL;
+        mnt_drop_write_file(filp);
+        return ret;
 }
 EXPORT_SYMBOL(fscrypt_process_policy);
 
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 10686fd67fb4..1bb7df5e4536 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -776,7 +776,7 @@ resizefs_out:
                                    (struct fscrypt_policy __user *)arg,
                                    sizeof(policy)))
                         return -EFAULT;
-                return fscrypt_process_policy(inode, &policy);
+                return fscrypt_process_policy(filp, &policy);
 #else
                 return -EOPNOTSUPP;
 #endif
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 47abb96098e4..28f4f4cbb8d8 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1757,21 +1757,14 @@ static int f2fs_ioc_set_encryption_policy(struct file *filp, unsigned long arg)
 {
         struct fscrypt_policy policy;
         struct inode *inode = file_inode(filp);
-        int ret;
 
         if (copy_from_user(&policy, (struct fscrypt_policy __user *)arg,
                                                         sizeof(policy)))
                 return -EFAULT;
 
-        ret = mnt_want_write_file(filp);
-        if (ret)
-                return ret;
-
         f2fs_update_time(F2FS_I_SB(inode), REQ_TIME);
-        ret = fscrypt_process_policy(inode, &policy);
 
-        mnt_drop_write_file(filp);
-        return ret;
+        return fscrypt_process_policy(filp, &policy);
 }
 
 static int f2fs_ioc_get_encryption_policy(struct file *filp, unsigned long arg)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index f394aff59c36..3988b43c2f5a 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -530,13 +530,13 @@ void fuse_read_fill(struct fuse_req *req, struct file *file, loff_t pos,
         req->out.args[0].size = count;
 }
 
-static void fuse_release_user_pages(struct fuse_req *req, int write)
+static void fuse_release_user_pages(struct fuse_req *req, bool should_dirty)
 {
         unsigned i;
 
         for (i = 0; i < req->num_pages; i++) {
                 struct page *page = req->pages[i];
-                if (write)
+                if (should_dirty)
                         set_page_dirty_lock(page);
                 put_page(page);
         }
@@ -1320,6 +1320,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                        loff_t *ppos, int flags)
 {
         int write = flags & FUSE_DIO_WRITE;
+        bool should_dirty = !write && iter_is_iovec(iter);
         int cuse = flags & FUSE_DIO_CUSE;
         struct file *file = io->file;
         struct inode *inode = file->f_mapping->host;
@@ -1363,7 +1364,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                         nres = fuse_send_read(req, io, pos, nbytes, owner);
 
                 if (!io->async)
-                        fuse_release_user_pages(req, !write);
+                        fuse_release_user_pages(req, should_dirty);
                 if (req->out.h.error) {
                         err = req->out.h.error;
                         break;
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 0f56deb24ce6..c415668c86d4 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -568,7 +568,7 @@ static int ioctl_fsthaw(struct file *filp)
         return thaw_super(sb);
 }
 
-static long ioctl_file_dedupe_range(struct file *file, void __user *arg)
+static int ioctl_file_dedupe_range(struct file *file, void __user *arg)
 {
         struct file_dedupe_range __user *argp = arg;
         struct file_dedupe_range *same = NULL;
@@ -582,6 +582,10 @@ static long ioctl_file_dedupe_range(struct file *file, void __user *arg)
         }
 
         size = offsetof(struct file_dedupe_range __user, info[count]);
+        if (size > PAGE_SIZE) {
+                ret = -ENOMEM;
+                goto out;
+        }
 
         same = memdup_user(argp, size);
         if (IS_ERR(same)) {
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 7d620970f2e1..ca699ddc11c1 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -657,7 +657,10 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)
         if (result <= 0)
                 goto out;
 
-        written = generic_write_sync(iocb, result);
+        result = generic_write_sync(iocb, result);
+        if (result < 0)
+                goto out;
+        written = result;
         iocb->ki_pos += written;
 
         /* Return error values */
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f5aecaabcb7c..a9dec32ba9ba 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -7570,12 +7570,20 @@ static int _nfs4_proc_create_session(struct nfs_client *clp,
         status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         trace_nfs4_create_session(clp, status);
 
+        switch (status) {
+        case -NFS4ERR_STALE_CLIENTID:
+        case -NFS4ERR_DELAY:
+        case -ETIMEDOUT:
+        case -EACCES:
+        case -EAGAIN:
+                goto out;
+        };
+
+        clp->cl_seqid++;
         if (!status) {
                 /* Verify the session's negotiated channel_attrs values */
                 status = nfs4_verify_channel_attrs(&args, &res);
                 /* Increment the clientid slot sequence id */
-                if (clp->cl_seqid == res.seqid)
-                        clp->cl_seqid++;
                 if (status)
                         goto out;
                 nfs4_update_session(session, &res);
@@ -8190,10 +8198,13 @@ static void nfs4_layoutreturn_release(void *calldata)
 
         dprintk("--> %s\n", __func__);
         spin_lock(&lo->plh_inode->i_lock);
-        pnfs_mark_matching_lsegs_invalid(lo, &freeme, &lrp->args.range,
-                        be32_to_cpu(lrp->args.stateid.seqid));
-        if (lrp->res.lrs_present && pnfs_layout_is_valid(lo))
+        if (lrp->res.lrs_present) {
+                pnfs_mark_matching_lsegs_invalid(lo, &freeme,
+                                &lrp->args.range,
+                                be32_to_cpu(lrp->args.stateid.seqid));
                 pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
+        } else
+                pnfs_mark_layout_stateid_invalid(lo, &freeme);
         pnfs_clear_layoutreturn_waitbit(lo);
         spin_unlock(&lo->plh_inode->i_lock);
         nfs4_sequence_free_slot(&lrp->res.seq_res);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 6daf034645c8..2c93a85eda51 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -365,7 +365,8 @@ pnfs_layout_remove_lseg(struct pnfs_layout_hdr *lo,
         /* Matched by pnfs_get_layout_hdr in pnfs_layout_insert_lseg */
         atomic_dec(&lo->plh_refcount);
         if (list_empty(&lo->plh_segs)) {
-                set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
+                if (atomic_read(&lo->plh_outstanding) == 0)
+                        set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
                 clear_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags);
         }
         rpc_wake_up(&NFS_SERVER(inode)->roc_rpcwaitq);
@@ -768,17 +769,32 @@ pnfs_destroy_all_layouts(struct nfs_client *clp)
         pnfs_destroy_layouts_byclid(clp, false);
 }
 
+static void
+pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo)
+{
+        lo->plh_return_iomode = 0;
+        lo->plh_return_seq = 0;
+        clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
+}
+
 /* update lo->plh_stateid with new if is more recent */
 void
 pnfs_set_layout_stateid(struct pnfs_layout_hdr *lo, const nfs4_stateid *new,
                         bool update_barrier)
 {
         u32 oldseq, newseq, new_barrier = 0;
-        bool invalid = !pnfs_layout_is_valid(lo);
 
         oldseq = be32_to_cpu(lo->plh_stateid.seqid);
         newseq = be32_to_cpu(new->seqid);
-        if (invalid || pnfs_seqid_is_newer(newseq, oldseq)) {
+
+        if (!pnfs_layout_is_valid(lo)) {
+                nfs4_stateid_copy(&lo->plh_stateid, new);
+                lo->plh_barrier = newseq;
+                pnfs_clear_layoutreturn_info(lo);
+                clear_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
+                return;
+        }
+        if (pnfs_seqid_is_newer(newseq, oldseq)) {
                 nfs4_stateid_copy(&lo->plh_stateid, new);
                 /*
                  * Because of wraparound, we want to keep the barrier
@@ -790,7 +806,7 @@ pnfs_set_layout_stateid(struct pnfs_layout_hdr *lo, const nfs4_stateid *new,
                 new_barrier = be32_to_cpu(new->seqid);
         else if (new_barrier == 0)
                 return;
-        if (invalid || pnfs_seqid_is_newer(new_barrier, lo->plh_barrier))
+        if (pnfs_seqid_is_newer(new_barrier, lo->plh_barrier))
                 lo->plh_barrier = new_barrier;
 }
 
@@ -886,19 +902,14 @@ void pnfs_clear_layoutreturn_waitbit(struct pnfs_layout_hdr *lo)
         rpc_wake_up(&NFS_SERVER(lo->plh_inode)->roc_rpcwaitq);
 }
 
-static void
-pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo)
-{
-        lo->plh_return_iomode = 0;
-        lo->plh_return_seq = 0;
-        clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
-}
-
 static bool
 pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo,
                 nfs4_stateid *stateid,
                 enum pnfs_iomode *iomode)
 {
+        /* Serialise LAYOUTGET/LAYOUTRETURN */
+        if (atomic_read(&lo->plh_outstanding) != 0)
+                return false;
         if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
                 return false;
         pnfs_get_layout_hdr(lo);
@@ -1798,16 +1809,11 @@ pnfs_layout_process(struct nfs4_layoutget *lgp)
                  */
                 pnfs_mark_layout_stateid_invalid(lo, &free_me);
 
-                nfs4_stateid_copy(&lo->plh_stateid, &res->stateid);
-                lo->plh_barrier = be32_to_cpu(res->stateid.seqid);
+                pnfs_set_layout_stateid(lo, &res->stateid, true);
         }
 
         pnfs_get_lseg(lseg);
         pnfs_layout_insert_lseg(lo, lseg, &free_me);
-        if (!pnfs_layout_is_valid(lo)) {
-                pnfs_clear_layoutreturn_info(lo);
-                clear_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
-        }
 
 
         if (res->return_on_close)
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index d2f97ecca6a5..e0e5f7c3c99f 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -67,18 +67,7 @@ static int fanotify_get_response(struct fsnotify_group *group,
 
         pr_debug("%s: group=%p event=%p\n", __func__, group, event);
 
-        wait_event(group->fanotify_data.access_waitq, event->response ||
-                                atomic_read(&group->fanotify_data.bypass_perm));
-
-        if (!event->response) { /* bypass_perm set */
-                /*
-                 * Event was canceled because group is being destroyed. Remove
-                 * it from group's event list because we are responsible for
-                 * freeing the permission event.
-                 */
-                fsnotify_remove_event(group, &event->fae.fse);
-                return 0;
-        }
+        wait_event(group->fanotify_data.access_waitq, event->response);
 
         /* userspace responded, convert to something usable */
         switch (event->response) {
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 8e8e6bcd1d43..a64313868d3a 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -358,16 +358,20 @@ static int fanotify_release(struct inode *ignored, struct file *file)
 
 #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
         struct fanotify_perm_event_info *event, *next;
+        struct fsnotify_event *fsn_event;
 
         /*
-         * There may be still new events arriving in the notification queue
-         * but since userspace cannot use fanotify fd anymore, no event can
-         * enter or leave access_list by now.
+         * Stop new events from arriving in the notification queue. since
+         * userspace cannot use fanotify fd anymore, no event can enter or
+         * leave access_list by now either.
          */
-        spin_lock(&group->fanotify_data.access_lock);
-
-        atomic_inc(&group->fanotify_data.bypass_perm);
+        fsnotify_group_stop_queueing(group);
 
+        /*
+         * Process all permission events on access_list and notification queue
+         * and simulate reply from userspace.
+         */
+        spin_lock(&group->fanotify_data.access_lock);
         list_for_each_entry_safe(event, next, &group->fanotify_data.access_list,
                                  fae.fse.list) {
                 pr_debug("%s: found group=%p event=%p\n", __func__, group,
@@ -379,12 +383,21 @@ static int fanotify_release(struct inode *ignored, struct file *file)
         spin_unlock(&group->fanotify_data.access_lock);
 
         /*
-         * Since bypass_perm is set, newly queued events will not wait for
-         * access response. Wake up the already sleeping ones now.
-         * synchronize_srcu() in fsnotify_destroy_group() will wait for all
-         * processes sleeping in fanotify_handle_event() waiting for access
-         * response and thus also for all permission events to be freed.
+         * Destroy all non-permission events. For permission events just
+         * dequeue them and set the response. They will be freed once the
+         * response is consumed and fanotify_get_response() returns.
          */
+        mutex_lock(&group->notification_mutex);
+        while (!fsnotify_notify_queue_is_empty(group)) {
+                fsn_event = fsnotify_remove_first_event(group);
+                if (!(fsn_event->mask & FAN_ALL_PERM_EVENTS))
+                        fsnotify_destroy_event(group, fsn_event);
+                else
+                        FANOTIFY_PE(fsn_event)->response = FAN_ALLOW;
+        }
+        mutex_unlock(&group->notification_mutex);
+
+        /* Response for all permission events it set, wakeup waiters */
         wake_up(&group->fanotify_data.access_waitq);
 #endif
 
@@ -755,7 +768,6 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
         spin_lock_init(&group->fanotify_data.access_lock);
         init_waitqueue_head(&group->fanotify_data.access_waitq);
         INIT_LIST_HEAD(&group->fanotify_data.access_list);
-        atomic_set(&group->fanotify_data.bypass_perm, 0);
 #endif
         switch (flags & FAN_ALL_CLASS_BITS) {
         case FAN_CLASS_NOTIF:
diff --git a/fs/notify/group.c b/fs/notify/group.c
index 3e2dd85be5dd..b47f7cfdcaa4 100644
--- a/fs/notify/group.c
+++ b/fs/notify/group.c
@@ -40,6 +40,17 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group)
 }
 
 /*
+ * Stop queueing new events for this group. Once this function returns
+ * fsnotify_add_event() will not add any new events to the group's queue.
+ */
+void fsnotify_group_stop_queueing(struct fsnotify_group *group)
+{
+        mutex_lock(&group->notification_mutex);
+        group->shutdown = true;
+        mutex_unlock(&group->notification_mutex);
+}
+
+/*
  * Trying to get rid of a group. Remove all marks, flush all events and release
  * the group reference.
  * Note that another thread calling fsnotify_clear_marks_by_group() may still
@@ -47,6 +58,14 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group)
  */
 void fsnotify_destroy_group(struct fsnotify_group *group)
 {
+        /*
+         * Stop queueing new events. The code below is careful enough to not
+         * require this but fanotify needs to stop queuing events even before
+         * fsnotify_destroy_group() is called and this makes the other callers
+         * of fsnotify_destroy_group() to see the same behavior.
+         */
+        fsnotify_group_stop_queueing(group);
+
         /* clear all inode marks for this group, attach them to destroy_list */
         fsnotify_detach_group_marks(group);
 
diff --git a/fs/notify/notification.c b/fs/notify/notification.c
index a95d8e037aeb..e455e83ceeeb 100644
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -82,7 +82,8 @@ void fsnotify_destroy_event(struct fsnotify_group *group,
  * Add an event to the group notification queue.  The group can later pull this
  * event off the queue to deal with.  The function returns 0 if the event was
  * added to the queue, 1 if the event was merged with some other queued event,
- * 2 if the queue of events has overflown.
+ * 2 if the event was not queued - either the queue of events has overflown
+ * or the group is shutting down.
  */
 int fsnotify_add_event(struct fsnotify_group *group,
                        struct fsnotify_event *event,
@@ -96,6 +97,11 @@ int fsnotify_add_event(struct fsnotify_group *group,
 
         mutex_lock(&group->notification_mutex);
 
+        if (group->shutdown) {
+                mutex_unlock(&group->notification_mutex);
+                return 2;
+        }
+
         if (group->q_len >= group->max_events) {
                 ret = 2;
                 /* Queue overflow event only if it isn't already queued */
@@ -126,21 +132,6 @@ queue:
 }
 
 /*
- * Remove @event from group's notification queue. It is the responsibility of
- * the caller to destroy the event.
- */
-void fsnotify_remove_event(struct fsnotify_group *group,
-                           struct fsnotify_event *event)
-{
-        mutex_lock(&group->notification_mutex);
-        if (!list_empty(&event->list)) {
-                list_del_init(&event->list);
-                group->q_len--;
-        }
-        mutex_unlock(&group->notification_mutex);
-}
-
-/*
  * Remove and return the first event from the notification list.  It is the
  * responsibility of the caller to destroy the obtained event
  */
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 7dabbc31060e..f165f867f332 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -5922,7 +5922,6 @@ bail:
 }
 
 static int ocfs2_replay_truncate_records(struct ocfs2_super *osb,
-                                         handle_t *handle,
                                          struct inode *data_alloc_inode,
                                          struct buffer_head *data_alloc_bh)
 {
@@ -5935,11 +5934,19 @@ static int ocfs2_replay_truncate_records(struct ocfs2_super *osb,
         struct ocfs2_truncate_log *tl;
         struct inode *tl_inode = osb->osb_tl_inode;
         struct buffer_head *tl_bh = osb->osb_tl_bh;
+        handle_t *handle;
 
         di = (struct ocfs2_dinode *) tl_bh->b_data;
         tl = &di->id2.i_dealloc;
         i = le16_to_cpu(tl->tl_used) - 1;
         while (i >= 0) {
+                handle = ocfs2_start_trans(osb, OCFS2_TRUNCATE_LOG_FLUSH_ONE_REC);
+                if (IS_ERR(handle)) {
+                        status = PTR_ERR(handle);
+                        mlog_errno(status);
+                        goto bail;
+                }
+
                 /* Caller has given us at least enough credits to
                  * update the truncate log dinode */
                 status = ocfs2_journal_access_di(handle, INODE_CACHE(tl_inode), tl_bh,
@@ -5974,12 +5981,7 @@ static int ocfs2_replay_truncate_records(struct ocfs2_super *osb,
                         }
                 }
 
-                status = ocfs2_extend_trans(handle,
-                                OCFS2_TRUNCATE_LOG_FLUSH_ONE_REC);
-                if (status < 0) {
-                        mlog_errno(status);
-                        goto bail;
-                }
+                ocfs2_commit_trans(osb, handle);
                 i--;
         }
 
@@ -5994,7 +5996,6 @@ int __ocfs2_flush_truncate_log(struct ocfs2_super *osb)
 {
         int status;
         unsigned int num_to_flush;
-        handle_t *handle;
         struct inode *tl_inode = osb->osb_tl_inode;
         struct inode *data_alloc_inode = NULL;
         struct buffer_head *tl_bh = osb->osb_tl_bh;
@@ -6038,21 +6039,11 @@ int __ocfs2_flush_truncate_log(struct ocfs2_super *osb)
                 goto out_mutex;
         }
 
-        handle = ocfs2_start_trans(osb, OCFS2_TRUNCATE_LOG_FLUSH_ONE_REC);
-        if (IS_ERR(handle)) {
-                status = PTR_ERR(handle);
-                mlog_errno(status);
-                goto out_unlock;
-        }
-
-        status = ocfs2_replay_truncate_records(osb, handle, data_alloc_inode,
+        status = ocfs2_replay_truncate_records(osb, data_alloc_inode,
                                                data_alloc_bh);
         if (status < 0)
                 mlog_errno(status);
 
-        ocfs2_commit_trans(osb, handle);
-
-out_unlock:
         brelse(data_alloc_bh);
         ocfs2_inode_unlock(data_alloc_inode, 1);
 
@@ -6413,43 +6404,34 @@ static int ocfs2_free_cached_blocks(struct ocfs2_super *osb,
                 goto out_mutex;
         }
 
-        handle = ocfs2_start_trans(osb, OCFS2_SUBALLOC_FREE);
-        if (IS_ERR(handle)) {
-                ret = PTR_ERR(handle);
-                mlog_errno(ret);
-                goto out_unlock;
-        }
-
         while (head) {
                 if (head->free_bg)
                         bg_blkno = head->free_bg;
                 else
                         bg_blkno = ocfs2_which_suballoc_group(head->free_blk,
                                                               head->free_bit);
+                handle = ocfs2_start_trans(osb, OCFS2_SUBALLOC_FREE);
+                if (IS_ERR(handle)) {
+                        ret = PTR_ERR(handle);
+                        mlog_errno(ret);
+                        goto out_unlock;
+                }
+
                 trace_ocfs2_free_cached_blocks(
                      (unsigned long long)head->free_blk, head->free_bit);
 
                 ret = ocfs2_free_suballoc_bits(handle, inode, di_bh,
                                                head->free_bit, bg_blkno, 1);
-                if (ret) {
+                if (ret)
                         mlog_errno(ret);
-                        goto out_journal;
-                }
 
-                ret = ocfs2_extend_trans(handle, OCFS2_SUBALLOC_FREE);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out_journal;
-                }
+                ocfs2_commit_trans(osb, handle);
 
                 tmp = head;
                 head = head->free_next;
                 kfree(tmp);
         }
 
-out_journal:
-        ocfs2_commit_trans(osb, handle);
-
 out_unlock:
         ocfs2_inode_unlock(inode, 1);
         brelse(di_bh);
diff --git a/fs/ocfs2/cluster/tcp_internal.h b/fs/ocfs2/cluster/tcp_internal.h
index 94b18369b1cc..b95e7df5b76a 100644
--- a/fs/ocfs2/cluster/tcp_internal.h
+++ b/fs/ocfs2/cluster/tcp_internal.h
@@ -44,9 +44,6 @@
  * version here in tcp_internal.h should not need to be bumped for
  * filesystem locking changes.
  *
- * New in version 12
- *      - Negotiate hb timeout when storage is down.
- *
  * New in version 11
  *      - Negotiation of filesystem locking in the dlm join.
  *
@@ -78,7 +75,7 @@
  *      - full 64 bit i_size in the metadata lock lvbs
  *      - introduction of "rw" lock and pushing meta/data locking down
  */
-#define O2NET_PROTOCOL_VERSION 12ULL
+#define O2NET_PROTOCOL_VERSION 11ULL
 struct o2net_handshake {
         __be64  protocol_version;
         __be64  connector_id;
diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
index cdeafb4e7ed6..0bb128659d4b 100644
--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -268,7 +268,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
                                   struct dlm_lock *lock, int flags, int type)
 {
         enum dlm_status status;
-        u8 old_owner = res->owner;
 
         mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type,
              lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS);
@@ -335,7 +334,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
 
         spin_lock(&res->spinlock);
         res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
-        lock->convert_pending = 0;
         /* if it failed, move it back to granted queue.
          * if master returns DLM_NORMAL and then down before sending ast,
          * it may have already been moved to granted queue, reset to
@@ -344,12 +342,14 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
                 if (status != DLM_NOTQUEUED)
                         dlm_error(status);
                 dlm_revert_pending_convert(res, lock);
-        } else if ((res->state & DLM_LOCK_RES_RECOVERING) ||
-                        (old_owner != res->owner)) {
-                mlog(0, "res %.*s is in recovering or has been recovered.\n",
-                                res->lockname.len, res->lockname.name);
+        } else if (!lock->convert_pending) {
+                mlog(0, "%s: res %.*s, owner died and lock has been moved back "
+                                "to granted list, retry convert.\n",
+                                dlm->name, res->lockname.len, res->lockname.name);
                 status = DLM_RECOVERING;
         }
+
+        lock->convert_pending = 0;
 bail:
         spin_unlock(&res->spinlock);
 
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 4e7b0dc22450..0b055bfb8e86 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1506,7 +1506,8 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
                                        u64 start, u64 len)
 {
         int ret = 0;
-        u64 tmpend, end = start + len;
+        u64 tmpend = 0;
+        u64 end = start + len;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         unsigned int csize = osb->s_clustersize;
         handle_t *handle;
@@ -1538,18 +1539,31 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
         }
 
         /*
-         * We want to get the byte offset of the end of the 1st cluster.
+         * If start is on a cluster boundary and end is somewhere in another
+         * cluster, we have not COWed the cluster starting at start, unless
+         * end is also within the same cluster. So, in this case, we skip this
+         * first call to ocfs2_zero_range_for_truncate() truncate and move on
+         * to the next one.
          */
-        tmpend = (u64)osb->s_clustersize + (start & ~(osb->s_clustersize - 1));
-        if (tmpend > end)
-                tmpend = end;
+        if ((start & (csize - 1)) != 0) {
+                /*
+                 * We want to get the byte offset of the end of the 1st
+                 * cluster.
+                 */
+                tmpend = (u64)osb->s_clustersize +
+                        (start & ~(osb->s_clustersize - 1));
+                if (tmpend > end)
+                        tmpend = end;
 
-        trace_ocfs2_zero_partial_clusters_range1((unsigned long long)start,
-                                                 (unsigned long long)tmpend);
+                trace_ocfs2_zero_partial_clusters_range1(
+                        (unsigned long long)start,
+                        (unsigned long long)tmpend);
 
-        ret = ocfs2_zero_range_for_truncate(inode, handle, start, tmpend);
-        if (ret)
-                mlog_errno(ret);
+                ret = ocfs2_zero_range_for_truncate(inode, handle, start,
+                                                    tmpend);
+                if (ret)
+                        mlog_errno(ret);
+        }
 
         if (tmpend < end) {
                 /*
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index ea47120a85ff..6ad3533940ba 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -1199,14 +1199,24 @@ retry:
                         inode_unlock((*ac)->ac_inode);
 
                         ret = ocfs2_try_to_free_truncate_log(osb, bits_wanted);
-                        if (ret == 1)
+                        if (ret == 1) {
+                                iput((*ac)->ac_inode);
+                                (*ac)->ac_inode = NULL;
                                 goto retry;
+                        }
 
                         if (ret < 0)
                                 mlog_errno(ret);
 
                         inode_lock((*ac)->ac_inode);
-                        ocfs2_inode_lock((*ac)->ac_inode, NULL, 1);
+                        ret = ocfs2_inode_lock((*ac)->ac_inode, NULL, 1);
+                        if (ret < 0) {
+                                mlog_errno(ret);
+                                inode_unlock((*ac)->ac_inode);
+                                iput((*ac)->ac_inode);
+                                (*ac)->ac_inode = NULL;
+                                goto bail;
+                        }
                 }
                 if (status < 0) {
                         if (status != -ENOSPC)
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index a4585f961bf9..e2a94a26767b 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -835,11 +835,11 @@ retry:
                         goto out_dput;
 
                 err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
-                if (err && err != -ENODATA)
+                if (err && err != -ENODATA && err != -EOPNOTSUPP)
                         goto out_dput;
 
                 err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
-                if (err && err != -ENODATA)
+                if (err && err != -ENODATA && err != -EOPNOTSUPP)
                         goto out_dput;
 
                 /* Clear any inherited mode bits */
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 187d84ef9de9..f6fa99eca515 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -581,6 +581,8 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
                 mss->anonymous_thp += HPAGE_PMD_SIZE;
         else if (PageSwapBacked(page))
                 mss->shmem_thp += HPAGE_PMD_SIZE;
+        else if (is_zone_device_page(page))
+                /* pass */;
         else
                 VM_BUG_ON_PAGE(1, page);
         smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd));
diff --git a/fs/ramfs/file-mmu.c b/fs/ramfs/file-mmu.c
index 183a212694bf..12af0490322f 100644
--- a/fs/ramfs/file-mmu.c
+++ b/fs/ramfs/file-mmu.c
@@ -27,9 +27,17 @@
 #include <linux/fs.h>
 #include <linux/mm.h>
 #include <linux/ramfs.h>
+#include <linux/sched.h>
 
 #include "internal.h"
 
+static unsigned long ramfs_mmu_get_unmapped_area(struct file *file,
+                unsigned long addr, unsigned long len, unsigned long pgoff,
+                unsigned long flags)
+{
+        return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
+}
+
 const struct file_operations ramfs_file_operations = {
         .read_iter      = generic_file_read_iter,
         .write_iter     = generic_file_write_iter,
@@ -38,6 +46,7 @@ const struct file_operations ramfs_file_operations = {
         .splice_read    = generic_file_splice_read,
         .splice_write   = iter_file_splice_write,
         .llseek         = generic_file_llseek,
+        .get_unmapped_area      = ramfs_mmu_get_unmapped_area,
 };
 
 const struct inode_operations ramfs_file_inode_operations = {
diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
index 5dea1fb6979c..6df9b0749671 100644
--- a/include/asm-generic/uaccess.h
+++ b/include/asm-generic/uaccess.h
@@ -231,14 +231,18 @@ extern int __put_user_bad(void) __attribute__((noreturn));
         might_fault();                                          \
         access_ok(VERIFY_READ, __p, sizeof(*ptr)) ?             \
                 __get_user((x), (__typeof__(*(ptr)) *)__p) :    \
-                -EFAULT;                                        \
+                ((x) = (__typeof__(*(ptr)))0,-EFAULT);          \
 })
 
 #ifndef __get_user_fn
 static inline int __get_user_fn(size_t size, const void __user *ptr, void *x)
 {
-        size = __copy_from_user(x, ptr, size);
-        return size ? -EFAULT : size;
+        size_t n = __copy_from_user(x, ptr, size);
+        if (unlikely(n)) {
+                memset(x + (size - n), 0, n);
+                return -EFAULT;
+        }
+        return 0;
 }
 
 #define __get_user_fn(sz, u, k) __get_user_fn(sz, u, k)
@@ -258,11 +262,13 @@ extern int __get_user_bad(void) __attribute__((noreturn));
 static inline long copy_from_user(void *to,
                 const void __user * from, unsigned long n)
 {
+        unsigned long res = n;
         might_fault();
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_from_user(to, from, n);
-        else
-                return n;
+        if (likely(access_ok(VERIFY_READ, from, n)))
+                res = __copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 static inline long copy_to_user(void __user *to,
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 436aa4e42221..668569844d37 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -527,13 +527,14 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
  * object's lifetime is managed by something other than RCU.  That
  * "something other" might be reference counting or simple immortality.
  *
- * The seemingly unused size_t variable is to validate @p is indeed a pointer
- * type by making sure it can be dereferenced.
+ * The seemingly unused variable ___typecheck_p validates that @p is
+ * indeed a pointer type by using a pointer to typeof(*p) as the type.
+ * Taking a pointer to typeof(*p) again is needed in case p is void *.
  */
 #define lockless_dereference(p) \
 ({ \
         typeof(p) _________p1 = READ_ONCE(p); \
-        size_t __maybe_unused __size_of_ptr = sizeof(*(p)); \
+        typeof(*(p)) *___typecheck_p __maybe_unused; \
         smp_read_barrier_depends(); /* Dependency order vs. p above. */ \
         (_________p1); \
 })
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index 242bf530edfc..34bd80512a0c 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -1,6 +1,8 @@
 #ifndef __CPUHOTPLUG_H
 #define __CPUHOTPLUG_H
 
+#include <linux/types.h>
+
 enum cpuhp_state {
         CPUHP_OFFLINE,
         CPUHP_CREATE_THREADS,
diff --git a/include/linux/fscrypto.h b/include/linux/fscrypto.h
index cfa6cde25f8e..76cff18bb032 100644
--- a/include/linux/fscrypto.h
+++ b/include/linux/fscrypto.h
@@ -274,8 +274,7 @@ extern void fscrypt_restore_control_page(struct page *);
 extern int fscrypt_zeroout_range(struct inode *, pgoff_t, sector_t,
                                                 unsigned int);
 /* policy.c */
-extern int fscrypt_process_policy(struct inode *,
-                                        const struct fscrypt_policy *);
+extern int fscrypt_process_policy(struct file *, const struct fscrypt_policy *);
 extern int fscrypt_get_policy(struct inode *, struct fscrypt_policy *);
 extern int fscrypt_has_permitted_context(struct inode *, struct inode *);
 extern int fscrypt_inherit_context(struct inode *, struct inode *,
@@ -345,7 +344,7 @@ static inline int fscrypt_notsupp_zeroout_range(struct inode *i, pgoff_t p,
 }
 
 /* policy.c */
-static inline int fscrypt_notsupp_process_policy(struct inode *i,
+static inline int fscrypt_notsupp_process_policy(struct file *f,
                                 const struct fscrypt_policy *p)
 {
         return -EOPNOTSUPP;
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 58205f33af02..7268ed076be8 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -148,6 +148,7 @@ struct fsnotify_group {
         #define FS_PRIO_1       1 /* fanotify content based access control */
         #define FS_PRIO_2       2 /* fanotify pre-content access */
         unsigned int priority;
+        bool shutdown;          /* group is being shut down, don't queue more events */
 
         /* stores all fastpath marks assoc with this group so they can be cleaned on unregister */
         struct mutex mark_mutex;        /* protect marks_list */
@@ -179,7 +180,6 @@ struct fsnotify_group {
                         spinlock_t access_lock;
                         struct list_head access_list;
                         wait_queue_head_t access_waitq;
-                        atomic_t bypass_perm;
 #endif /* CONFIG_FANOTIFY_ACCESS_PERMISSIONS */
                         int f_flags;
                         unsigned int max_marks;
@@ -292,6 +292,8 @@ extern struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *op
 extern void fsnotify_get_group(struct fsnotify_group *group);
 /* drop reference on a group from fsnotify_alloc_group */
 extern void fsnotify_put_group(struct fsnotify_group *group);
+/* group destruction begins, stop queuing new events */
+extern void fsnotify_group_stop_queueing(struct fsnotify_group *group);
 /* destroy group */
 extern void fsnotify_destroy_group(struct fsnotify_group *group);
 /* fasync handler function */
@@ -304,8 +306,6 @@ extern int fsnotify_add_event(struct fsnotify_group *group,
                               struct fsnotify_event *event,
                               int (*merge)(struct list_head *,
                                            struct fsnotify_event *));
-/* Remove passed event from groups notification queue */
-extern void fsnotify_remove_event(struct fsnotify_group *group, struct fsnotify_event *event);
 /* true if the group notification queue is empty */
 extern bool fsnotify_notify_queue_is_empty(struct fsnotify_group *group);
 /* return, but do not dequeue the first event on the notification queue */
diff --git a/include/linux/irq.h b/include/linux/irq.h
index b52424eaa0ed..0ac26c892fe2 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -945,6 +945,16 @@ static inline void irq_gc_lock(struct irq_chip_generic *gc) { }
 static inline void irq_gc_unlock(struct irq_chip_generic *gc) { }
 #endif
 
+/*
+ * The irqsave variants are for usage in non interrupt code. Do not use
+ * them in irq_chip callbacks. Use irq_gc_lock() instead.
+ */
+#define irq_gc_lock_irqsave(gc, flags)  \
+        raw_spin_lock_irqsave(&(gc)->lock, flags)
+
+#define irq_gc_unlock_irqrestore(gc, flags)     \
+        raw_spin_unlock_irqrestore(&(gc)->lock, flags)
+
 static inline void irq_reg_writel(struct irq_chip_generic *gc,
                                   u32 val, int reg_offset)
 {
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 21bc4557b67a..d1f9a581aca8 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -6710,9 +6710,10 @@ struct mlx5_ifc_pude_reg_bits {
 };
 
 struct mlx5_ifc_ptys_reg_bits {
-        u8         an_disable_cap[0x1];
+        u8         reserved_at_0[0x1];
         u8         an_disable_admin[0x1];
-        u8         reserved_at_2[0x6];
+        u8         an_disable_cap[0x1];
+        u8         reserved_at_3[0x5];
         u8         local_port[0x8];
         u8         reserved_at_10[0xd];
         u8         proto_mask[0x3];
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3a788bf0affd..e8d79d4ebcfe 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3267,6 +3267,7 @@ static inline void napi_free_frags(struct napi_struct *napi)
         napi->skb = NULL;
 }
 
+bool netdev_is_rx_handler_busy(struct net_device *dev);
 int netdev_rx_handler_register(struct net_device *dev,
                                rx_handler_func_t *rx_handler,
                                void *rx_handler_data);
diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index cbd8990e2e77..2b5b10eed74f 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -118,10 +118,11 @@ static inline int arch_within_stack_frames(const void * const stack,
 extern void __check_object_size(const void *ptr, unsigned long n,
                                         bool to_user);
 
-static inline void check_object_size(const void *ptr, unsigned long n,
-                                     bool to_user)
+static __always_inline void check_object_size(const void *ptr, unsigned long n,
+                                              bool to_user)
 {
-        __check_object_size(ptr, n, to_user);
+        if (!__builtin_constant_p(n))
+                __check_object_size(ptr, n, to_user);
 }
 #else
 static inline void check_object_size(const void *ptr, unsigned long n,
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 1b5d1cd796e2..75b4aaf31a9d 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -76,7 +76,7 @@ size_t iov_iter_copy_from_user_atomic(struct page *page,
                 struct iov_iter *i, unsigned long offset, size_t bytes);
 void iov_iter_advance(struct iov_iter *i, size_t bytes);
 int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes);
-int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes);
+#define iov_iter_fault_in_multipages_readable iov_iter_fault_in_readable
 size_t iov_iter_single_seg_count(const struct iov_iter *i);
 size_t copy_page_to_iter(struct page *page, size_t offset, size_t bytes,
                          struct iov_iter *i);
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 9b4c418bebd8..fd60eccb59a6 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -52,7 +52,7 @@ struct unix_sock {
         struct sock             sk;
         struct unix_address     *addr;
         struct path             path;
-        struct mutex            readlock;
+        struct mutex            iolock, bindlock;
         struct sock             *peer;
         struct list_head        link;
         atomic_long_t           inflight;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 9c23f4d33e06..beb7610d64e9 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1102,6 +1102,7 @@ struct station_info {
         struct cfg80211_tid_stats pertid[IEEE80211_NUM_TIDS + 1];
 };
 
+#if IS_ENABLED(CONFIG_CFG80211)
 /**
  * cfg80211_get_station - retrieve information about a given station
  * @dev: the device where the station is supposed to be connected to
@@ -1114,6 +1115,14 @@ struct station_info {
  */
 int cfg80211_get_station(struct net_device *dev, const u8 *mac_addr,
                          struct station_info *sinfo);
+#else
+static inline int cfg80211_get_station(struct net_device *dev,
+                                       const u8 *mac_addr,
+                                       struct station_info *sinfo)
+{
+        return -ENOENT;
+}
+#endif
 
 /**
  * enum monitor_flags - monitor flags
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 4079fc18ffe4..7d4a72e75f33 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -111,6 +111,7 @@ struct fib_info {
         unsigned char           fib_scope;
         unsigned char           fib_type;
         __be32                  fib_prefsrc;
+        u32                     fib_tb_id;
         u32                     fib_priority;
         u32                     *fib_metrics;
 #define fib_mtu fib_metrics[RTAX_MTU-1]
@@ -319,7 +320,7 @@ void fib_flush_external(struct net *net);
 /* Exported by fib_semantics.c */
 int ip_fib_check_default(__be32 gw, struct net_device *dev);
 int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force);
-int fib_sync_down_addr(struct net *net, __be32 local);
+int fib_sync_down_addr(struct net_device *dev, __be32 local);
 int fib_sync_up(struct net_device *dev, unsigned int nh_flags);
 
 extern u32 fib_multipath_secret __read_mostly;
diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h
index d27588c8dbd9..1139cde0fdc5 100644
--- a/include/net/netfilter/nft_meta.h
+++ b/include/net/netfilter/nft_meta.h
@@ -36,4 +36,8 @@ void nft_meta_set_eval(const struct nft_expr *expr,
 void nft_meta_set_destroy(const struct nft_ctx *ctx,
                           const struct nft_expr *expr);
 
+int nft_meta_set_validate(const struct nft_ctx *ctx,
+                          const struct nft_expr *expr,
+                          const struct nft_data **data);
+
 #endif
diff --git a/include/net/netfilter/nft_reject.h b/include/net/netfilter/nft_reject.h
index 60fa1530006b..02e28c529b29 100644
--- a/include/net/netfilter/nft_reject.h
+++ b/include/net/netfilter/nft_reject.h
@@ -8,6 +8,10 @@ struct nft_reject {
 
 extern const struct nla_policy nft_reject_policy[];
 
+int nft_reject_validate(const struct nft_ctx *ctx,
+                        const struct nft_expr *expr,
+                        const struct nft_data **data);
+
 int nft_reject_init(const struct nft_ctx *ctx,
                     const struct nft_expr *expr,
                     const struct nlattr * const tb[]);
diff --git a/include/scsi/scsi_transport_sas.h b/include/scsi/scsi_transport_sas.h
index 13c0b2ba1b6c..73d870918939 100644
--- a/include/scsi/scsi_transport_sas.h
+++ b/include/scsi/scsi_transport_sas.h
@@ -11,12 +11,12 @@ struct sas_rphy;
 struct request;
 
 #if !IS_ENABLED(CONFIG_SCSI_SAS_ATTRS)
-static inline int is_sas_attached(struct scsi_device *sdev)
+static inline int scsi_is_sas_rphy(const struct device *sdev)
 {
         return 0;
 }
 #else
-extern int is_sas_attached(struct scsi_device *sdev);
+extern int scsi_is_sas_rphy(const struct device *);
 #endif
 
 static inline int sas_protocol_ata(enum sas_protocol proto)
@@ -202,7 +202,6 @@ extern int sas_rphy_add(struct sas_rphy *);
 extern void sas_rphy_remove(struct sas_rphy *);
 extern void sas_rphy_delete(struct sas_rphy *);
 extern void sas_rphy_unlink(struct sas_rphy *);
-extern int scsi_is_sas_rphy(const struct device *);
 
 struct sas_port *sas_port_alloc(struct device *, int);
 struct sas_port *sas_port_alloc_num(struct device *);
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index d1c51b7f5221..5e8dab5bf9ad 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -6270,6 +6270,12 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
         if (cgroup_sk_alloc_disabled)
                 return;
 
+        /* Socket clone path */
+        if (skcd->val) {
+                cgroup_get(sock_cgroup_ptr(skcd));
+                return;
+        }
+
         rcu_read_lock();
 
         while (true) {
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 3cfabdf7b942..a54f2c2cdb20 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2496,11 +2496,11 @@ static int __perf_event_stop(void *info)
         return 0;
 }
 
-static int perf_event_restart(struct perf_event *event)
+static int perf_event_stop(struct perf_event *event, int restart)
 {
         struct stop_event_data sd = {
                 .event          = event,
-                .restart        = 1,
+                .restart        = restart,
         };
         int ret = 0;
 
@@ -3549,10 +3549,18 @@ static int perf_event_read(struct perf_event *event, bool group)
                         .group = group,
                         .ret = 0,
                 };
-                ret = smp_call_function_single(event->oncpu, __perf_event_read, &data, 1);
-                /* The event must have been read from an online CPU: */
-                WARN_ON_ONCE(ret);
-                ret = ret ? : data.ret;
+                /*
+                 * Purposely ignore the smp_call_function_single() return
+                 * value.
+                 *
+                 * If event->oncpu isn't a valid CPU it means the event got
+                 * scheduled out and that will have updated the event count.
+                 *
+                 * Therefore, either way, we'll have an up-to-date event count
+                 * after this.
+                 */
+                (void)smp_call_function_single(event->oncpu, __perf_event_read, &data, 1);
+                ret = data.ret;
         } else if (event->state == PERF_EVENT_STATE_INACTIVE) {
                 struct perf_event_context *ctx = event->ctx;
                 unsigned long flags;
@@ -4837,6 +4845,19 @@ static void ring_buffer_attach(struct perf_event *event,
                 spin_unlock_irqrestore(&rb->event_lock, flags);
         }
 
+        /*
+         * Avoid racing with perf_mmap_close(AUX): stop the event
+         * before swizzling the event::rb pointer; if it's getting
+         * unmapped, its aux_mmap_count will be 0 and it won't
+         * restart. See the comment in __perf_pmu_output_stop().
+         *
+         * Data will inevitably be lost when set_output is done in
+         * mid-air, but then again, whoever does it like this is
+         * not in for the data anyway.
+         */
+        if (has_aux(event))
+                perf_event_stop(event, 0);
+
         rcu_assign_pointer(event->rb, rb);
 
         if (old_rb) {
@@ -6112,7 +6133,7 @@ static void perf_event_addr_filters_exec(struct perf_event *event, void *data)
         raw_spin_unlock_irqrestore(&ifh->lock, flags);
 
         if (restart)
-                perf_event_restart(event);
+                perf_event_stop(event, 1);
 }
 
 void perf_event_exec(void)
@@ -6156,7 +6177,13 @@ static void __perf_event_output_stop(struct perf_event *event, void *data)
 
         /*
          * In case of inheritance, it will be the parent that links to the
-         * ring-buffer, but it will be the child that's actually using it:
+         * ring-buffer, but it will be the child that's actually using it.
+         *
+         * We are using event::rb to determine if the event should be stopped,
+         * however this may race with ring_buffer_attach() (through set_output),
+         * which will make us skip the event that actually needs to be stopped.
+         * So ring_buffer_attach() has to stop an aux event before re-assigning
+         * its rb pointer.
          */
         if (rcu_dereference(parent->rb) == rb)
                 ro->err = __perf_event_stop(&sd);
@@ -6670,7 +6697,7 @@ static void __perf_addr_filters_adjust(struct perf_event *event, void *data)
         raw_spin_unlock_irqrestore(&ifh->lock, flags);
 
         if (restart)
-                perf_event_restart(event);
+                perf_event_stop(event, 1);
 }
 
 /*
@@ -7859,7 +7886,7 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
         mmput(mm);
 
 restart:
-        perf_event_restart(event);
+        perf_event_stop(event, 1);
 }
 
 /*
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index ae9b90dc9a5a..257fa460b846 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -330,15 +330,22 @@ void *perf_aux_output_begin(struct perf_output_handle *handle,
         if (!rb)
                 return NULL;
 
-        if (!rb_has_aux(rb) || !atomic_inc_not_zero(&rb->aux_refcount))
+        if (!rb_has_aux(rb))
                 goto err;
 
         /*
-         * If rb::aux_mmap_count is zero (and rb_has_aux() above went through),
-         * the aux buffer is in perf_mmap_close(), about to get freed.
+         * If aux_mmap_count is zero, the aux buffer is in perf_mmap_close(),
+         * about to get freed, so we leave immediately.
+         *
+         * Checking rb::aux_mmap_count and rb::refcount has to be done in
+         * the same order, see perf_mmap_close. Otherwise we end up freeing
+         * aux pages in this path, which is a bug, because in_atomic().
          */
         if (!atomic_read(&rb->aux_mmap_count))
-                goto err_put;
+                goto err;
+
+        if (!atomic_inc_not_zero(&rb->aux_refcount))
+                goto err;
 
         /*
          * Nesting is not supported for AUX area, make sure nested
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 251d16b4cb41..b501e390bb34 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -247,6 +247,7 @@ static void devm_memremap_pages_release(struct device *dev, void *data)
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(resource_size(res), SECTION_SIZE);
         arch_remove_memory(align_start, align_size);
+        untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
         pgmap_radix_release(res);
         dev_WARN_ONCE(dev, pgmap->altmap && pgmap->altmap->alloc,
                         "%s: failed to free all reserved pages\n", __func__);
@@ -282,6 +283,7 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
                 struct percpu_ref *ref, struct vmem_altmap *altmap)
 {
         resource_size_t key, align_start, align_size, align_end;
+        pgprot_t pgprot = PAGE_KERNEL;
         struct dev_pagemap *pgmap;
         struct page_map *page_map;
         int error, nid, is_ram;
@@ -351,6 +353,11 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
         if (nid < 0)
                 nid = numa_mem_id();
 
+        error = track_pfn_remap(NULL, &pgprot, PHYS_PFN(align_start), 0,
+                        align_size);
+        if (error)
+                goto err_pfn_remap;
+
         error = arch_add_memory(nid, align_start, align_size, true);
         if (error)
                 goto err_add_memory;
@@ -371,6 +378,8 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
         return __va(res->start);
 
  err_add_memory:
+        untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
+ err_pfn_remap:
  err_radix:
         pgmap_radix_release(res);
         devres_free(page_map);
diff --git a/kernel/power/qos.c b/kernel/power/qos.c
index 97b0df71303e..168ff442ebde 100644
--- a/kernel/power/qos.c
+++ b/kernel/power/qos.c
@@ -482,7 +482,16 @@ void pm_qos_update_request(struct pm_qos_request *req,
                 return;
         }
 
-        cancel_delayed_work_sync(&req->work);
+        /*
+         * This function may be called very early during boot, for example,
+         * from of_clk_init(), where irq needs to stay disabled.
+         * cancel_delayed_work_sync() assumes that irq is enabled on
+         * invocation and re-enables it on return.  Avoid calling it until
+         * workqueue is initialized.
+         */
+        if (keventd_up())
+                cancel_delayed_work_sync(&req->work);
+
         __pm_qos_update_request(req, new_value);
 }
 EXPORT_SYMBOL_GPL(pm_qos_update_request);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 2a906f20fba7..44817c640e99 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2016,6 +2016,28 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
         success = 1; /* we're going to change ->state */
         cpu = task_cpu(p);
 
+        /*
+         * Ensure we load p->on_rq _after_ p->state, otherwise it would
+         * be possible to, falsely, observe p->on_rq == 0 and get stuck
+         * in smp_cond_load_acquire() below.
+         *
+         * sched_ttwu_pending()                 try_to_wake_up()
+         *   [S] p->on_rq = 1;                  [L] P->state
+         *       UNLOCK rq->lock  -----.
+         *                              \
+         *                               +---   RMB
+         * schedule()                   /
+         *       LOCK rq->lock    -----'
+         *       UNLOCK rq->lock
+         *
+         * [task p]
+         *   [S] p->state = UNINTERRUPTIBLE     [L] p->on_rq
+         *
+         * Pairs with the UNLOCK+LOCK on rq->lock from the
+         * last wakeup of our task and the schedule that got our task
+         * current.
+         */
+        smp_rmb();
         if (p->on_rq && ttwu_remote(p, wake_flags))
                 goto stat;
 
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 9e8c7386b3a0..7e3138cfc8c9 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -291,33 +291,13 @@ done:
 }
 
 /*
- * Fault in the first iovec of the given iov_iter, to a maximum length
- * of bytes. Returns 0 on success, or non-zero if the memory could not be
- * accessed (ie. because it is an invalid address).
- *
- * writev-intensive code may want this to prefault several iovecs -- that
- * would be possible (callers must not rely on the fact that _only_ the
- * first iovec will be faulted with the current implementation).
- */
-int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
-{
-        if (!(i->type & (ITER_BVEC|ITER_KVEC))) {
-                char __user *buf = i->iov->iov_base + i->iov_offset;
-                bytes = min(bytes, i->iov->iov_len - i->iov_offset);
-                return fault_in_pages_readable(buf, bytes);
-        }
-        return 0;
-}
-EXPORT_SYMBOL(iov_iter_fault_in_readable);
-
-/*
  * Fault in one or more iovecs of the given iov_iter, to a maximum length of
  * bytes.  For each iovec, fault in each page that constitutes the iovec.
  *
  * Return 0 on success, or non-zero if the memory could not be accessed (i.e.
  * because it is an invalid address).
  */
-int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes)
+int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
 {
         size_t skip = i->iov_offset;
         const struct iovec *iov;
@@ -334,7 +314,7 @@ int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes)
         }
         return 0;
 }
-EXPORT_SYMBOL(iov_iter_fault_in_multipages_readable);
+EXPORT_SYMBOL(iov_iter_fault_in_readable);
 
 void iov_iter_init(struct iov_iter *i, int direction,
                         const struct iovec *iov, unsigned long nr_segs,
diff --git a/mm/debug.c b/mm/debug.c
index 8865bfb41b0b..74c7cae4f683 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -42,9 +42,11 @@ const struct trace_print_flags vmaflag_names[] = {
 
 void __dump_page(struct page *page, const char *reason)
 {
+        int mapcount = PageSlab(page) ? 0 : page_mapcount(page);
+
         pr_emerg("page:%p count:%d mapcount:%d mapping:%p index:%#lx",
-                  page, page_ref_count(page), page_mapcount(page),
-                  page->mapping, page->index);
+                  page, page_ref_count(page), mapcount,
+                  page->mapping, page_to_pgoff(page));
         if (PageCompound(page))
                 pr_cont(" compound_mapcount: %d", compound_mapcount(page));
         pr_cont("\n");
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 2db2112aa31e..a6abd76baa72 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1078,7 +1078,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
                 goto out;
 
         page = pmd_page(*pmd);
-        VM_BUG_ON_PAGE(!PageHead(page), page);
+        VM_BUG_ON_PAGE(!PageHead(page) && !is_zone_device_page(page), page);
         if (flags & FOLL_TOUCH)
                 touch_pmd(vma, addr, pmd);
         if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
@@ -1116,7 +1116,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
         }
 skip_mlock:
         page += (addr & ~HPAGE_PMD_MASK) >> PAGE_SHIFT;
-        VM_BUG_ON_PAGE(!PageCompound(page), page);
+        VM_BUG_ON_PAGE(!PageCompound(page) && !is_zone_device_page(page), page);
         if (flags & FOLL_GET)
                 get_page(page);
 
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 79c52d0061af..728d7790dc2d 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -838,7 +838,8 @@ static bool hugepage_vma_check(struct vm_area_struct *vma)
  * value (scan code).
  */
 
-static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address)
+static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address,
+                struct vm_area_struct **vmap)
 {
         struct vm_area_struct *vma;
         unsigned long hstart, hend;
@@ -846,7 +847,7 @@ static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address)
         if (unlikely(khugepaged_test_exit(mm)))
                 return SCAN_ANY_PROCESS;
 
-        vma = find_vma(mm, address);
+        *vmap = vma = find_vma(mm, address);
         if (!vma)
                 return SCAN_VMA_NULL;
 
@@ -881,6 +882,11 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
                 .pmd = pmd,
         };
 
+        /* we only decide to swapin, if there is enough young ptes */
+        if (referenced < HPAGE_PMD_NR/2) {
+                trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
+                return false;
+        }
         fe.pte = pte_offset_map(pmd, address);
         for (; fe.address < address + HPAGE_PMD_NR*PAGE_SIZE;
                         fe.pte++, fe.address += PAGE_SIZE) {
@@ -888,17 +894,12 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
                 if (!is_swap_pte(pteval))
                         continue;
                 swapped_in++;
-                /* we only decide to swapin, if there is enough young ptes */
-                if (referenced < HPAGE_PMD_NR/2) {
-                        trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
-                        return false;
-                }
                 ret = do_swap_page(&fe, pteval);
 
                 /* do_swap_page returns VM_FAULT_RETRY with released mmap_sem */
                 if (ret & VM_FAULT_RETRY) {
                         down_read(&mm->mmap_sem);
-                        if (hugepage_vma_revalidate(mm, address)) {
+                        if (hugepage_vma_revalidate(mm, address, &fe.vma)) {
                                 /* vma is no longer available, don't continue to swapin */
                                 trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
                                 return false;
@@ -923,7 +924,6 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
 static void collapse_huge_page(struct mm_struct *mm,
                                    unsigned long address,
                                    struct page **hpage,
-                                   struct vm_area_struct *vma,
                                    int node, int referenced)
 {
         pmd_t *pmd, _pmd;
@@ -933,6 +933,7 @@ static void collapse_huge_page(struct mm_struct *mm,
         spinlock_t *pmd_ptl, *pte_ptl;
         int isolated = 0, result = 0;
         struct mem_cgroup *memcg;
+        struct vm_area_struct *vma;
         unsigned long mmun_start;       /* For mmu_notifiers */
         unsigned long mmun_end;         /* For mmu_notifiers */
         gfp_t gfp;
@@ -961,7 +962,7 @@ static void collapse_huge_page(struct mm_struct *mm,
         }
 
         down_read(&mm->mmap_sem);
-        result = hugepage_vma_revalidate(mm, address);
+        result = hugepage_vma_revalidate(mm, address, &vma);
         if (result) {
                 mem_cgroup_cancel_charge(new_page, memcg, true);
                 up_read(&mm->mmap_sem);
@@ -994,7 +995,7 @@ static void collapse_huge_page(struct mm_struct *mm,
          * handled by the anon_vma lock + PG_lock.
          */
         down_write(&mm->mmap_sem);
-        result = hugepage_vma_revalidate(mm, address);
+        result = hugepage_vma_revalidate(mm, address, &vma);
         if (result)
                 goto out;
         /* check if the pmd is still valid */
@@ -1202,7 +1203,7 @@ out_unmap:
         if (ret) {
                 node = khugepaged_find_target_node();
                 /* collapse_huge_page will return with the mmap_sem released */
-                collapse_huge_page(mm, address, hpage, vma, node, referenced);
+                collapse_huge_page(mm, address, hpage, node, referenced);
         }
 out:
         trace_mm_khugepaged_scan_pmd(mm, page, writable, referenced,
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 9a6a51a7c416..4be518d4e68a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1740,17 +1740,22 @@ static DEFINE_MUTEX(percpu_charge_mutex);
 static bool consume_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
 {
         struct memcg_stock_pcp *stock;
+        unsigned long flags;
         bool ret = false;
 
         if (nr_pages > CHARGE_BATCH)
                 return ret;
 
-        stock = &get_cpu_var(memcg_stock);
+        local_irq_save(flags);
+
+        stock = this_cpu_ptr(&memcg_stock);
         if (memcg == stock->cached && stock->nr_pages >= nr_pages) {
                 stock->nr_pages -= nr_pages;
                 ret = true;
         }
-        put_cpu_var(memcg_stock);
+
+        local_irq_restore(flags);
+
         return ret;
 }
 
@@ -1771,15 +1776,18 @@ static void drain_stock(struct memcg_stock_pcp *stock)
         stock->cached = NULL;
 }
 
-/*
- * This must be called under preempt disabled or must be called by
- * a thread which is pinned to local cpu.
- */
 static void drain_local_stock(struct work_struct *dummy)
 {
-        struct memcg_stock_pcp *stock = this_cpu_ptr(&memcg_stock);
+        struct memcg_stock_pcp *stock;
+        unsigned long flags;
+
+        local_irq_save(flags);
+
+        stock = this_cpu_ptr(&memcg_stock);
         drain_stock(stock);
         clear_bit(FLUSHING_CACHED_CHARGE, &stock->flags);
+
+        local_irq_restore(flags);
 }
 
 /*
@@ -1788,14 +1796,19 @@ static void drain_local_stock(struct work_struct *dummy)
  */
 static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
 {
-        struct memcg_stock_pcp *stock = &get_cpu_var(memcg_stock);
+        struct memcg_stock_pcp *stock;
+        unsigned long flags;
+
+        local_irq_save(flags);
 
+        stock = this_cpu_ptr(&memcg_stock);
         if (stock->cached != memcg) { /* reset if necessary */
                 drain_stock(stock);
                 stock->cached = memcg;
         }
         stock->nr_pages += nr_pages;
-        put_cpu_var(memcg_stock);
+
+        local_irq_restore(flags);
 }
 
 /*
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 41266dc29f33..b58906b6215c 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1567,7 +1567,9 @@ static struct page *new_node_page(struct page *page, unsigned long private,
                 return alloc_huge_page_node(page_hstate(compound_head(page)),
                                         next_node_in(nid, nmask));
 
-        node_clear(nid, nmask);
+        if (nid != next_node_in(nid, nmask))
+                node_clear(nid, nmask);
+
         if (PageHighMem(page)
             || (zone_idx(page_zone(page)) == ZONE_MOVABLE))
                 gfp_mask |= __GFP_HIGHMEM;
diff --git a/mm/page_io.c b/mm/page_io.c
index 16bd82fad38c..eafe5ddc2b54 100644
--- a/mm/page_io.c
+++ b/mm/page_io.c
@@ -264,6 +264,7 @@ int __swap_writepage(struct page *page, struct writeback_control *wbc,
         int ret;
         struct swap_info_struct *sis = page_swap_info(page);
 
+        BUG_ON(!PageSwapCache(page));
         if (sis->flags & SWP_FILE) {
                 struct kiocb kiocb;
                 struct file *swap_file = sis->swap_file;
@@ -337,6 +338,7 @@ int swap_readpage(struct page *page)
         int ret = 0;
         struct swap_info_struct *sis = page_swap_info(page);
 
+        BUG_ON(!PageSwapCache(page));
         VM_BUG_ON_PAGE(!PageLocked(page), page);
         VM_BUG_ON_PAGE(PageUptodate(page), page);
         if (frontswap_load(page) == 0) {
@@ -386,6 +388,7 @@ int swap_set_page_dirty(struct page *page)
 
         if (sis->flags & SWP_FILE) {
                 struct address_space *mapping = sis->swap_file->f_mapping;
+                BUG_ON(!PageSwapCache(page));
                 return mapping->a_ops->set_page_dirty(page);
         } else {
                 return __set_page_dirty_no_writeback(page);
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 78cfa292a29a..2657accc6e2b 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2724,7 +2724,6 @@ int swapcache_prepare(swp_entry_t entry)
 struct swap_info_struct *page_swap_info(struct page *page)
 {
         swp_entry_t swap = { .val = page_private(page) };
-        BUG_ON(!PageSwapCache(page));
         return swap_info[swp_type(swap)];
 }
 
diff --git a/mm/usercopy.c b/mm/usercopy.c
index a3cc3052f830..089328f2b920 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -134,31 +134,16 @@ static inline const char *check_bogus_address(const void *ptr, unsigned long n)
         return NULL;
 }
 
-static inline const char *check_heap_object(const void *ptr, unsigned long n,
-                                            bool to_user)
+/* Checks for allocs that are marked in some way as spanning multiple pages. */
+static inline const char *check_page_span(const void *ptr, unsigned long n,
+                                          struct page *page, bool to_user)
 {
-        struct page *page, *endpage;
+#ifdef CONFIG_HARDENED_USERCOPY_PAGESPAN
         const void *end = ptr + n - 1;
+        struct page *endpage;
         bool is_reserved, is_cma;
 
         /*
-         * Some architectures (arm64) return true for virt_addr_valid() on
-         * vmalloced addresses. Work around this by checking for vmalloc
-         * first.
-         */
-        if (is_vmalloc_addr(ptr))
-                return NULL;
-
-        if (!virt_addr_valid(ptr))
-                return NULL;
-
-        page = virt_to_head_page(ptr);
-
-        /* Check slab allocator for flags and size. */
-        if (PageSlab(page))
-                return __check_heap_object(ptr, n, page);
-
-        /*
          * Sometimes the kernel data regions are not marked Reserved (see
          * check below). And sometimes [_sdata,_edata) does not cover
          * rodata and/or bss, so check each range explicitly.
@@ -186,7 +171,7 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n,
                    ((unsigned long)end & (unsigned long)PAGE_MASK)))
                 return NULL;
 
-        /* Allow if start and end are inside the same compound page. */
+        /* Allow if fully inside the same compound (__GFP_COMP) page. */
         endpage = virt_to_head_page(end);
         if (likely(endpage == page))
                 return NULL;
@@ -199,20 +184,44 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n,
         is_reserved = PageReserved(page);
         is_cma = is_migrate_cma_page(page);
         if (!is_reserved && !is_cma)
-                goto reject;
+                return "<spans multiple pages>";
 
         for (ptr += PAGE_SIZE; ptr <= end; ptr += PAGE_SIZE) {
                 page = virt_to_head_page(ptr);
                 if (is_reserved && !PageReserved(page))
-                        goto reject;
+                        return "<spans Reserved and non-Reserved pages>";
                 if (is_cma && !is_migrate_cma_page(page))
-                        goto reject;
+                        return "<spans CMA and non-CMA pages>";
         }
+#endif
 
         return NULL;
+}
+
+static inline const char *check_heap_object(const void *ptr, unsigned long n,
+                                            bool to_user)
+{
+        struct page *page;
+
+        /*
+         * Some architectures (arm64) return true for virt_addr_valid() on
+         * vmalloced addresses. Work around this by checking for vmalloc
+         * first.
+         */
+        if (is_vmalloc_addr(ptr))
+                return NULL;
+
+        if (!virt_addr_valid(ptr))
+                return NULL;
+
+        page = virt_to_head_page(ptr);
+
+        /* Check slab allocator for flags and size. */
+        if (PageSlab(page))
+                return __check_heap_object(ptr, n, page);
 
-reject:
-        return "<spans multiple pages>";
+        /* Verify object does not incorrectly span multiple pages. */
+        return check_page_span(ptr, n, page, to_user);
 }
 
 /*
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 8e486203d133..abe11f085479 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -80,13 +80,10 @@ static void br_do_proxy_arp(struct sk_buff *skb, struct net_bridge *br,
 
         BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
 
-        if (dev->flags & IFF_NOARP)
+        if ((dev->flags & IFF_NOARP) ||
+            !pskb_may_pull(skb, arp_hdr_len(dev)))
                 return;
 
-        if (!pskb_may_pull(skb, arp_hdr_len(dev))) {
-                dev->stats.tx_dropped++;
-                return;
-        }
         parp = arp_hdr(skb);
 
         if (parp->ar_pro != htons(ETH_P_IP) ||
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index a5423a1eec05..c5fea9393946 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1138,7 +1138,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
                 } else {
                         err = br_ip6_multicast_add_group(br, port,
                                                          &grec->grec_mca, vid);
-                        if (!err)
+                        if (err)
                                 break;
                 }
         }
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index cceac5bb658f..0833c251aef7 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -368,6 +368,8 @@ ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 
         match = xt_find_match(NFPROTO_BRIDGE, m->u.name, 0);
         if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) {
+                if (!IS_ERR(match))
+                        module_put(match->me);
                 request_module("ebt_%s", m->u.name);
                 match = xt_find_match(NFPROTO_BRIDGE, m->u.name, 0);
         }
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index 4b901d9f2e7c..ad47a921b701 100644
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -86,6 +86,7 @@ static const struct nft_expr_ops nft_meta_bridge_set_ops = {
         .init           = nft_meta_set_init,
         .destroy        = nft_meta_set_destroy,
         .dump           = nft_meta_set_dump,
+        .validate       = nft_meta_set_validate,
 };
 
 static const struct nft_expr_ops *
diff --git a/net/core/dev.c b/net/core/dev.c
index dd6ce598de89..ea6312057a71 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3975,6 +3975,22 @@ sch_handle_ingress(struct sk_buff *skb, struct packet_type **pt_prev, int *ret,
 }
 
 /**
+ *      netdev_is_rx_handler_busy - check if receive handler is registered
+ *      @dev: device to check
+ *
+ *      Check if a receive handler is already registered for a given device.
+ *      Return true if there one.
+ *
+ *      The caller must hold the rtnl_mutex.
+ */
+bool netdev_is_rx_handler_busy(struct net_device *dev)
+{
+        ASSERT_RTNL();
+        return dev && rtnl_dereference(dev->rx_handler);
+}
+EXPORT_SYMBOL_GPL(netdev_is_rx_handler_busy);
+
+/**
  *      netdev_rx_handler_register - register receive handler
  *      @dev: device to register a handler for
  *      @rx_handler: receive handler to register
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 61ad43f61c5e..52742a02814f 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -680,11 +680,13 @@ EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric);
 void __skb_get_hash(struct sk_buff *skb)
 {
         struct flow_keys keys;
+        u32 hash;
 
         __flow_hash_secret_init();
 
-        __skb_set_sw_hash(skb, ___skb_get_hash(skb, &keys, hashrnd),
-                          flow_keys_have_l4(&keys));
+        hash = ___skb_get_hash(skb, &keys, hashrnd);
+
+        __skb_set_sw_hash(skb, hash, flow_keys_have_l4(&keys));
 }
 EXPORT_SYMBOL(__skb_get_hash);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 25dab8b60223..fd7b41edf1ce 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1362,7 +1362,6 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
                 if (!try_module_get(prot->owner))
                         goto out_free_sec;
                 sk_tx_queue_clear(sk);
-                cgroup_sk_alloc(&sk->sk_cgrp_data);
         }
 
         return sk;
@@ -1422,6 +1421,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
                 sock_net_set(sk, net);
                 atomic_set(&sk->sk_wmem_alloc, 1);
 
+                cgroup_sk_alloc(&sk->sk_cgrp_data);
                 sock_update_classid(&sk->sk_cgrp_data);
                 sock_update_netprioidx(&sk->sk_cgrp_data);
         }
@@ -1566,6 +1566,9 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                 newsk->sk_priority = 0;
                 newsk->sk_incoming_cpu = raw_smp_processor_id();
                 atomic64_set(&newsk->sk_cookie, 0);
+
+                cgroup_sk_alloc(&newsk->sk_cgrp_data);
+
                 /*
                  * Before updating sk_refcnt, we must commit prior changes to memory
                  * (Documentation/RCU/rculist_nulls.txt for details)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 415e117967c7..062a67ca9a21 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -2232,7 +2232,7 @@ static struct devinet_sysctl_table {
 };
 
 static int __devinet_sysctl_register(struct net *net, char *dev_name,
-                                        struct ipv4_devconf *p)
+                                     int ifindex, struct ipv4_devconf *p)
 {
         int i;
         struct devinet_sysctl_table *t;
@@ -2255,6 +2255,8 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name,
                 goto free;
 
         p->sysctl = t;
+
+        inet_netconf_notify_devconf(net, NETCONFA_ALL, ifindex, p);
         return 0;
 
 free:
@@ -2286,7 +2288,7 @@ static int devinet_sysctl_register(struct in_device *idev)
         if (err)
                 return err;
         err = __devinet_sysctl_register(dev_net(idev->dev), idev->dev->name,
-                                        &idev->cnf);
+                                        idev->dev->ifindex, &idev->cnf);
         if (err)
                 neigh_sysctl_unregister(idev->arp_parms);
         return err;
@@ -2347,11 +2349,12 @@ static __net_init int devinet_init_net(struct net *net)
         }
 
 #ifdef CONFIG_SYSCTL
-        err = __devinet_sysctl_register(net, "all", all);
+        err = __devinet_sysctl_register(net, "all", NETCONFA_IFINDEX_ALL, all);
         if (err < 0)
                 goto err_reg_all;
 
-        err = __devinet_sysctl_register(net, "default", dflt);
+        err = __devinet_sysctl_register(net, "default",
+                                        NETCONFA_IFINDEX_DEFAULT, dflt);
         if (err < 0)
                 goto err_reg_dflt;
 
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index ef2ebeb89d0f..1b25daf8c7f1 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -509,6 +509,7 @@ static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt,
                 if (!dev)
                         return -ENODEV;
                 cfg->fc_oif = dev->ifindex;
+                cfg->fc_table = l3mdev_fib_table(dev);
                 if (colon) {
                         struct in_ifaddr *ifa;
                         struct in_device *in_dev = __in_dev_get_rtnl(dev);
@@ -1027,7 +1028,7 @@ no_promotions:
                          * First of all, we scan fib_info list searching
                          * for stray nexthop entries, then ignite fib_flush.
                          */
-                        if (fib_sync_down_addr(dev_net(dev), ifa->ifa_local))
+                        if (fib_sync_down_addr(dev, ifa->ifa_local))
                                 fib_flush(dev_net(dev));
                 }
         }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 539fa264e67d..e9f56225e53f 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1057,6 +1057,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
         fi->fib_priority = cfg->fc_priority;
         fi->fib_prefsrc = cfg->fc_prefsrc;
         fi->fib_type = cfg->fc_type;
+        fi->fib_tb_id = cfg->fc_table;
 
         fi->fib_nhs = nhs;
         change_nexthops(fi) {
@@ -1337,18 +1338,21 @@ nla_put_failure:
  *   referring to it.
  * - device went down -> we must shutdown all nexthops going via it.
  */
-int fib_sync_down_addr(struct net *net, __be32 local)
+int fib_sync_down_addr(struct net_device *dev, __be32 local)
 {
         int ret = 0;
         unsigned int hash = fib_laddr_hashfn(local);
         struct hlist_head *head = &fib_info_laddrhash[hash];
+        struct net *net = dev_net(dev);
+        int tb_id = l3mdev_fib_table(dev);
         struct fib_info *fi;
 
         if (!fib_info_laddrhash || local == 0)
                 return 0;
 
         hlist_for_each_entry(fi, head, fib_lhash) {
-                if (!net_eq(fi->fib_net, net))
+                if (!net_eq(fi->fib_net, net) ||
+                    fi->fib_tb_id != tb_id)
                         continue;
                 if (fi->fib_prefsrc == local) {
                         fi->fib_flags |= RTNH_F_DEAD;
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
index c24f41c816b3..2c2553b9026c 100644
--- a/net/ipv4/netfilter/nft_reject_ipv4.c
+++ b/net/ipv4/netfilter/nft_reject_ipv4.c
@@ -46,6 +46,7 @@ static const struct nft_expr_ops nft_reject_ipv4_ops = {
         .eval           = nft_reject_ipv4_eval,
         .init           = nft_reject_init,
         .dump           = nft_reject_dump,
+        .validate       = nft_reject_validate,
 };
 
 static struct nft_expr_type nft_reject_ipv4_type __read_mostly = {
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 54d9f9b0120f..4e777a3243f9 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -150,6 +150,7 @@ void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb)
         tp->segs_in = 0;
         tcp_segs_in(tp, skb);
         __skb_pull(skb, tcp_hdrlen(skb));
+        sk_forced_mem_schedule(sk, skb->truesize);
         skb_set_owner_r(skb, sk);
 
         TCP_SKB_CB(skb)->seq++;
@@ -226,6 +227,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
         tcp_fastopen_add_skb(child, skb);
 
         tcp_rsk(req)->rcv_nxt = tp->rcv_nxt;
+        tp->rcv_wup = tp->rcv_nxt;
         /* tcp_conn_request() is sending the SYNACK,
          * and queues the child into listener accept queue.
          */
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index 028eb046ea40..9c5fc973267f 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -76,7 +76,7 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)
         if (!tcp_is_cwnd_limited(sk))
                 return;
 
-        if (tp->snd_cwnd <= tp->snd_ssthresh)
+        if (tcp_in_slow_start(tp))
                 tcp_slow_start(tp, acked);
 
         else if (!yeah->doing_reno_now) {
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index b644a23c3db0..41f5b504a782 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -29,7 +29,7 @@ static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,
         memset(fl4, 0, sizeof(*fl4));
         fl4->daddr = daddr->a4;
         fl4->flowi4_tos = tos;
-        fl4->flowi4_oif = oif;
+        fl4->flowi4_oif = l3mdev_master_ifindex_by_index(net, oif);
         if (saddr)
                 fl4->saddr = saddr->a4;
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f418d2eaeddd..2f1f5d439788 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -778,7 +778,14 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
         }
 
         if (p == &net->ipv6.devconf_all->forwarding) {
+                int old_dflt = net->ipv6.devconf_dflt->forwarding;
+
                 net->ipv6.devconf_dflt->forwarding = newf;
+                if ((!newf) ^ (!old_dflt))
+                        inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
+                                                     NETCONFA_IFINDEX_DEFAULT,
+                                                     net->ipv6.devconf_dflt);
+
                 addrconf_forward_change(net, newf);
                 if ((!newf) ^ (!old))
                         inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
@@ -1941,6 +1948,7 @@ errdad:
         spin_unlock_bh(&ifp->lock);
 
         addrconf_mod_dad_work(ifp, 0);
+        in6_ifa_put(ifp);
 }
 
 /* Join to solicited addr multicast group.
@@ -3850,6 +3858,7 @@ static void addrconf_dad_work(struct work_struct *w)
                 addrconf_dad_begin(ifp);
                 goto out;
         } else if (action == DAD_ABORT) {
+                in6_ifa_hold(ifp);
                 addrconf_dad_stop(ifp, 1);
                 if (disable_ipv6)
                         addrconf_ifdown(idev->dev, 0);
@@ -6025,7 +6034,7 @@ static const struct ctl_table addrconf_sysctl[] = {
 static int __addrconf_sysctl_register(struct net *net, char *dev_name,
                 struct inet6_dev *idev, struct ipv6_devconf *p)
 {
-        int i;
+        int i, ifindex;
         struct ctl_table *table;
         char path[sizeof("net/ipv6/conf/") + IFNAMSIZ];
 
@@ -6045,6 +6054,13 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
         if (!p->sysctl_header)
                 goto free;
 
+        if (!strcmp(dev_name, "all"))
+                ifindex = NETCONFA_IFINDEX_ALL;
+        else if (!strcmp(dev_name, "default"))
+                ifindex = NETCONFA_IFINDEX_DEFAULT;
+        else
+                ifindex = idev->dev->ifindex;
+        inet6_netconf_notify_devconf(net, NETCONFA_ALL, ifindex, p);
         return 0;
 
 free:
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 7b0481e3738f..888543debe4e 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1174,6 +1174,7 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 encap_limit = t->parms.encap_limit;
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_IPIP;
 
         dsfield = ipv4_get_dsfield(iph);
 
@@ -1233,6 +1234,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 encap_limit = t->parms.encap_limit;
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_IPV6;
 
         dsfield = ipv6_get_dsfield(ipv6h);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
diff --git a/net/ipv6/netfilter/nft_reject_ipv6.c b/net/ipv6/netfilter/nft_reject_ipv6.c
index 533cd5719c59..92bda9908bb9 100644
--- a/net/ipv6/netfilter/nft_reject_ipv6.c
+++ b/net/ipv6/netfilter/nft_reject_ipv6.c
@@ -47,6 +47,7 @@ static const struct nft_expr_ops nft_reject_ipv6_ops = {
         .eval           = nft_reject_ipv6_eval,
         .init           = nft_reject_init,
         .dump           = nft_reject_dump,
+        .validate       = nft_reject_validate,
 };
 
 static struct nft_expr_type nft_reject_ipv6_type __read_mostly = {
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 0900352c924c..0e983b694ee8 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -126,8 +126,10 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         rt = (struct rt6_info *) dst;
 
         np = inet6_sk(sk);
-        if (!np)
-                return -EBADF;
+        if (!np) {
+                err = -EBADF;
+                goto dst_err_out;
+        }
 
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
                 fl6.flowi6_oif = np->mcast_oif;
@@ -163,6 +165,9 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         }
         release_sock(sk);
 
+dst_err_out:
+        dst_release(dst);
+
         if (err)
                 return err;
 
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 0eaab1fa6be5..00a2d40677d6 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -23,6 +23,7 @@ int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb)
 
 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
 {
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
         XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
         XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
         return xfrm_input(skb, nexthdr, spi, 0);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 6cc97003e4a9..70a86adad875 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -36,7 +36,7 @@ static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,
         int err;
 
         memset(&fl6, 0, sizeof(fl6));
-        fl6.flowi6_oif = oif;
+        fl6.flowi6_oif = l3mdev_master_ifindex_by_index(net, oif);
         fl6.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF;
         memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
         if (saddr)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index cb39e05b166c..411693288648 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -13,6 +13,7 @@
 #include <linux/socket.h>
 #include <linux/uaccess.h>
 #include <linux/workqueue.h>
+#include <linux/syscalls.h>
 #include <net/kcm.h>
 #include <net/netns/generic.h>
 #include <net/sock.h>
@@ -2029,7 +2030,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         if (copy_to_user((void __user *)arg, &info,
                                          sizeof(info))) {
                                 err = -EFAULT;
-                                sock_release(newsock);
+                                sys_close(info.fd);
                         }
                 }
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 1e40dacaa137..a2ed3bda4ddc 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1855,6 +1855,9 @@ static __net_exit void l2tp_exit_net(struct net *net)
                 (void)l2tp_tunnel_delete(tunnel);
         }
         rcu_read_unlock_bh();
+
+        flush_workqueue(l2tp_wq);
+        rcu_barrier();
 }
 
 static struct pernet_operations l2tp_net_ops = {
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index b5d28f14b9cf..afca7d103684 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -333,10 +333,11 @@ ieee80211_tdls_chandef_vht_upgrade(struct ieee80211_sub_if_data *sdata,
         if (!uc.center_freq1)
                 return;
 
-        /* proceed to downgrade the chandef until usable or the same */
+        /* proceed to downgrade the chandef until usable or the same as AP BW */
         while (uc.width > max_width ||
-               !cfg80211_reg_can_beacon_relax(sdata->local->hw.wiphy, &uc,
-                                              sdata->wdev.iftype))
+               (uc.width > sta->tdls_chandef.width &&
+                !cfg80211_reg_can_beacon_relax(sdata->local->hw.wiphy, &uc,
+                                               sdata->wdev.iftype)))
                 ieee80211_chandef_downgrade(&uc);
 
         if (!cfg80211_chandef_identical(&uc, &sta->tdls_chandef)) {
diff --git a/net/netfilter/nf_tables_netdev.c b/net/netfilter/nf_tables_netdev.c
index 5eefe4a355c6..75d696f11045 100644
--- a/net/netfilter/nf_tables_netdev.c
+++ b/net/netfilter/nf_tables_netdev.c
@@ -30,7 +30,6 @@ nft_netdev_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
         if (!iph)
                 return;
 
-        iph = ip_hdr(skb);
         if (iph->ihl < 5 || iph->version != 4)
                 return;
 
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 70eb2f6a3b01..d44d89b56127 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -343,12 +343,12 @@ static int nfnl_acct_del(struct net *net, struct sock *nfnl,
                          struct sk_buff *skb, const struct nlmsghdr *nlh,
                          const struct nlattr * const tb[])
 {
-        char *acct_name;
-        struct nf_acct *cur;
+        struct nf_acct *cur, *tmp;
         int ret = -ENOENT;
+        char *acct_name;
 
         if (!tb[NFACCT_NAME]) {
-                list_for_each_entry(cur, &net->nfnl_acct_list, head)
+                list_for_each_entry_safe(cur, tmp, &net->nfnl_acct_list, head)
                         nfnl_acct_try_del(cur);
 
                 return 0;
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 68216cdc7083..139e0867e56e 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -98,31 +98,28 @@ static int cttimeout_new_timeout(struct net *net, struct sock *ctnl,
                 break;
         }
 
-        l4proto = nf_ct_l4proto_find_get(l3num, l4num);
-
-        /* This protocol is not supportted, skip. */
-        if (l4proto->l4proto != l4num) {
-                ret = -EOPNOTSUPP;
-                goto err_proto_put;
-        }
-
         if (matching) {
                 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
                         /* You cannot replace one timeout policy by another of
                          * different kind, sorry.
                          */
                         if (matching->l3num != l3num ||
-                            matching->l4proto->l4proto != l4num) {
-                                ret = -EINVAL;
-                                goto err_proto_put;
-                        }
-
-                        ret = ctnl_timeout_parse_policy(&matching->data,
-                                                        l4proto, net,
-                                                        cda[CTA_TIMEOUT_DATA]);
-                        return ret;
+                            matching->l4proto->l4proto != l4num)
+                                return -EINVAL;
+
+                        return ctnl_timeout_parse_policy(&matching->data,
+                                                         matching->l4proto, net,
+                                                         cda[CTA_TIMEOUT_DATA]);
                 }
-                ret = -EBUSY;
+
+                return -EBUSY;
+        }
+
+        l4proto = nf_ct_l4proto_find_get(l3num, l4num);
+
+        /* This protocol is not supportted, skip. */
+        if (l4proto->l4proto != l4num) {
+                ret = -EOPNOTSUPP;
                 goto err_proto_put;
         }
 
@@ -305,7 +302,16 @@ static void ctnl_untimeout(struct net *net, struct ctnl_timeout *timeout)
         const struct hlist_nulls_node *nn;
         unsigned int last_hsize;
         spinlock_t *lock;
-        int i;
+        int i, cpu;
+
+        for_each_possible_cpu(cpu) {
+                struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
+
+                spin_lock_bh(&pcpu->lock);
+                hlist_nulls_for_each_entry(h, nn, &pcpu->unconfirmed, hnnode)
+                        untimeout(h, timeout);
+                spin_unlock_bh(&pcpu->lock);
+        }
 
         local_bh_disable();
 restart:
@@ -350,12 +356,13 @@ static int cttimeout_del_timeout(struct net *net, struct sock *ctnl,
                                  const struct nlmsghdr *nlh,
                                  const struct nlattr * const cda[])
 {
-        struct ctnl_timeout *cur;
+        struct ctnl_timeout *cur, *tmp;
         int ret = -ENOENT;
         char *name;
 
         if (!cda[CTA_TIMEOUT_NAME]) {
-                list_for_each_entry(cur, &net->nfct_timeout_list, head)
+                list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list,
+                                         head)
                         ctnl_timeout_try_del(net, cur);
 
                 return 0;
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 2863f3493038..8a6bc7630912 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -291,10 +291,16 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
 }
 EXPORT_SYMBOL_GPL(nft_meta_get_init);
 
-static int nft_meta_set_init_pkttype(const struct nft_ctx *ctx)
+int nft_meta_set_validate(const struct nft_ctx *ctx,
+                          const struct nft_expr *expr,
+                          const struct nft_data **data)
 {
+        struct nft_meta *priv = nft_expr_priv(expr);
         unsigned int hooks;
 
+        if (priv->key != NFT_META_PKTTYPE)
+                return 0;
+
         switch (ctx->afi->family) {
         case NFPROTO_BRIDGE:
                 hooks = 1 << NF_BR_PRE_ROUTING;
@@ -308,6 +314,7 @@ static int nft_meta_set_init_pkttype(const struct nft_ctx *ctx)
 
         return nft_chain_validate_hooks(ctx->chain, hooks);
 }
+EXPORT_SYMBOL_GPL(nft_meta_set_validate);
 
 int nft_meta_set_init(const struct nft_ctx *ctx,
                       const struct nft_expr *expr,
@@ -327,15 +334,16 @@ int nft_meta_set_init(const struct nft_ctx *ctx,
                 len = sizeof(u8);
                 break;
         case NFT_META_PKTTYPE:
-                err = nft_meta_set_init_pkttype(ctx);
-                if (err)
-                        return err;
                 len = sizeof(u8);
                 break;
         default:
                 return -EOPNOTSUPP;
         }
 
+        err = nft_meta_set_validate(ctx, expr, NULL);
+        if (err < 0)
+                return err;
+
         priv->sreg = nft_parse_register(tb[NFTA_META_SREG]);
         err = nft_validate_register_load(priv->sreg, len);
         if (err < 0)
@@ -407,6 +415,7 @@ static const struct nft_expr_ops nft_meta_set_ops = {
         .init           = nft_meta_set_init,
         .destroy        = nft_meta_set_destroy,
         .dump           = nft_meta_set_dump,
+        .validate       = nft_meta_set_validate,
 };
 
 static const struct nft_expr_ops *
diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
index 0522fc9bfb0a..c64de3f7379d 100644
--- a/net/netfilter/nft_reject.c
+++ b/net/netfilter/nft_reject.c
@@ -26,11 +26,27 @@ const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
 };
 EXPORT_SYMBOL_GPL(nft_reject_policy);
 
+int nft_reject_validate(const struct nft_ctx *ctx,
+                        const struct nft_expr *expr,
+                        const struct nft_data **data)
+{
+        return nft_chain_validate_hooks(ctx->chain,
+                                        (1 << NF_INET_LOCAL_IN) |
+                                        (1 << NF_INET_FORWARD) |
+                                        (1 << NF_INET_LOCAL_OUT));
+}
+EXPORT_SYMBOL_GPL(nft_reject_validate);
+
 int nft_reject_init(const struct nft_ctx *ctx,
                     const struct nft_expr *expr,
                     const struct nlattr * const tb[])
 {
         struct nft_reject *priv = nft_expr_priv(expr);
+        int err;
+
+        err = nft_reject_validate(ctx, expr, NULL);
+        if (err < 0)
+                return err;
 
         if (tb[NFTA_REJECT_TYPE] == NULL)
                 return -EINVAL;
diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
index 759ca5248a3d..e79d9ca2ffee 100644
--- a/net/netfilter/nft_reject_inet.c
+++ b/net/netfilter/nft_reject_inet.c
@@ -66,7 +66,11 @@ static int nft_reject_inet_init(const struct nft_ctx *ctx,
                                 const struct nlattr * const tb[])
 {
         struct nft_reject *priv = nft_expr_priv(expr);
-        int icmp_code;
+        int icmp_code, err;
+
+        err = nft_reject_validate(ctx, expr, NULL);
+        if (err < 0)
+                return err;
 
         if (tb[NFTA_REJECT_TYPE] == NULL)
                 return -EINVAL;
@@ -124,6 +128,7 @@ static const struct nft_expr_ops nft_reject_inet_ops = {
         .eval           = nft_reject_inet_eval,
         .init           = nft_reject_inet_init,
         .dump           = nft_reject_inet_dump,
+        .validate       = nft_reject_validate,
 };
 
 static struct nft_expr_type nft_reject_inet_type __read_mostly = {
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 1f1682b9a6a8..31b7bc35895d 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -878,7 +878,7 @@ static sctp_xmit_t sctp_packet_will_fit(struct sctp_packet *packet,
                                         struct sctp_chunk *chunk,
                                         u16 chunk_len)
 {
-        size_t psize, pmtu;
+        size_t psize, pmtu, maxsize;
         sctp_xmit_t retval = SCTP_XMIT_OK;
 
         psize = packet->size;
@@ -906,6 +906,17 @@ static sctp_xmit_t sctp_packet_will_fit(struct sctp_packet *packet,
                         goto out;
                 }
 
+                /* Similarly, if this chunk was built before a PMTU
+                 * reduction, we have to fragment it at IP level now. So
+                 * if the packet already contains something, we need to
+                 * flush.
+                 */
+                maxsize = pmtu - packet->overhead;
+                if (packet->auth)
+                        maxsize -= WORD_ROUND(packet->auth->skb->len);
+                if (chunk_len > maxsize)
+                        retval = SCTP_XMIT_PMTU_FULL;
+
                 /* It is also okay to fragment if the chunk we are
                  * adding is a control chunk, but only if current packet
                  * is not a GSO one otherwise it causes fragmentation of
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 1d281816f2bf..d8582028b346 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -569,9 +569,10 @@ gss_svc_searchbyctx(struct cache_detail *cd, struct xdr_netobj *handle)
         struct rsc *found;
 
         memset(&rsci, 0, sizeof(rsci));
-        rsci.handle.data = handle->data;
-        rsci.handle.len = handle->len;
+        if (dup_to_netobj(&rsci.handle, handle->data, handle->len))
+                return NULL;
         found = rsc_lookup(cd, &rsci);
+        rsc_free(&rsci);
         if (!found)
                 return NULL;
         if (cache_check(cd, &found->h, NULL))
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 536d0be3f61b..799cce6cbe45 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -51,6 +51,7 @@
 #include <linux/slab.h>
 #include <linux/prefetch.h>
 #include <linux/sunrpc/addr.h>
+#include <linux/sunrpc/svc_rdma.h>
 #include <asm/bitops.h>
 #include <linux/module.h> /* try_module_get()/module_put() */
 
@@ -923,7 +924,7 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
         }
 
         INIT_LIST_HEAD(&buf->rb_recv_bufs);
-        for (i = 0; i < buf->rb_max_requests; i++) {
+        for (i = 0; i < buf->rb_max_requests + RPCRDMA_MAX_BC_REQUESTS; i++) {
                 struct rpcrdma_rep *rep;
 
                 rep = rpcrdma_create_rep(r_xprt);
@@ -1018,6 +1019,7 @@ rpcrdma_buffer_destroy(struct rpcrdma_buffer *buf)
                 rep = rpcrdma_buffer_get_rep_locked(buf);
                 rpcrdma_destroy_rep(ia, rep);
         }
+        buf->rb_send_count = 0;
 
         spin_lock(&buf->rb_reqslock);
         while (!list_empty(&buf->rb_allreqs)) {
@@ -1032,6 +1034,7 @@ rpcrdma_buffer_destroy(struct rpcrdma_buffer *buf)
                 spin_lock(&buf->rb_reqslock);
         }
         spin_unlock(&buf->rb_reqslock);
+        buf->rb_recv_count = 0;
 
         rpcrdma_destroy_mrs(buf);
 }
@@ -1074,8 +1077,27 @@ rpcrdma_put_mw(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mw *mw)
         spin_unlock(&buf->rb_mwlock);
 }
 
+static struct rpcrdma_rep *
+rpcrdma_buffer_get_rep(struct rpcrdma_buffer *buffers)
+{
+        /* If an RPC previously completed without a reply (say, a
+         * credential problem or a soft timeout occurs) then hold off
+         * on supplying more Receive buffers until the number of new
+         * pending RPCs catches up to the number of posted Receives.
+         */
+        if (unlikely(buffers->rb_send_count < buffers->rb_recv_count))
+                return NULL;
+
+        if (unlikely(list_empty(&buffers->rb_recv_bufs)))
+                return NULL;
+        buffers->rb_recv_count++;
+        return rpcrdma_buffer_get_rep_locked(buffers);
+}
+
 /*
  * Get a set of request/reply buffers.
+ *
+ * Reply buffer (if available) is attached to send buffer upon return.
  */
 struct rpcrdma_req *
 rpcrdma_buffer_get(struct rpcrdma_buffer *buffers)
@@ -1085,21 +1107,15 @@ rpcrdma_buffer_get(struct rpcrdma_buffer *buffers)
         spin_lock(&buffers->rb_lock);
         if (list_empty(&buffers->rb_send_bufs))
                 goto out_reqbuf;
+        buffers->rb_send_count++;
         req = rpcrdma_buffer_get_req_locked(buffers);
-        if (list_empty(&buffers->rb_recv_bufs))
-                goto out_repbuf;
-        req->rl_reply = rpcrdma_buffer_get_rep_locked(buffers);
+        req->rl_reply = rpcrdma_buffer_get_rep(buffers);
         spin_unlock(&buffers->rb_lock);
         return req;
 
 out_reqbuf:
         spin_unlock(&buffers->rb_lock);
-        pr_warn("rpcrdma: out of request buffers (%p)\n", buffers);
-        return NULL;
-out_repbuf:
-        list_add(&req->rl_free, &buffers->rb_send_bufs);
-        spin_unlock(&buffers->rb_lock);
-        pr_warn("rpcrdma: out of reply buffers (%p)\n", buffers);
+        pr_warn("RPC:       %s: out of request buffers\n", __func__);
         return NULL;
 }
 
@@ -1117,9 +1133,12 @@ rpcrdma_buffer_put(struct rpcrdma_req *req)
         req->rl_reply = NULL;
 
         spin_lock(&buffers->rb_lock);
+        buffers->rb_send_count--;
         list_add_tail(&req->rl_free, &buffers->rb_send_bufs);
-        if (rep)
+        if (rep) {
+                buffers->rb_recv_count--;
                 list_add_tail(&rep->rr_list, &buffers->rb_recv_bufs);
+        }
         spin_unlock(&buffers->rb_lock);
 }
 
@@ -1133,8 +1152,7 @@ rpcrdma_recv_buffer_get(struct rpcrdma_req *req)
         struct rpcrdma_buffer *buffers = req->rl_buffer;
 
         spin_lock(&buffers->rb_lock);
-        if (!list_empty(&buffers->rb_recv_bufs))
-                req->rl_reply = rpcrdma_buffer_get_rep_locked(buffers);
+        req->rl_reply = rpcrdma_buffer_get_rep(buffers);
         spin_unlock(&buffers->rb_lock);
 }
 
@@ -1148,6 +1166,7 @@ rpcrdma_recv_buffer_put(struct rpcrdma_rep *rep)
         struct rpcrdma_buffer *buffers = &rep->rr_rxprt->rx_buf;
 
         spin_lock(&buffers->rb_lock);
+        buffers->rb_recv_count--;
         list_add_tail(&rep->rr_list, &buffers->rb_recv_bufs);
         spin_unlock(&buffers->rb_lock);
 }
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index 670fad57153a..a71b0f5897d8 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -321,6 +321,7 @@ struct rpcrdma_buffer {
         char                    *rb_pool;
 
         spinlock_t              rb_lock;        /* protect buf lists */
+        int                     rb_send_count, rb_recv_count;
         struct list_head        rb_send_bufs;
         struct list_head        rb_recv_bufs;
         u32                     rb_max_requests;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 8ede3bc52481..bf168838a029 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1074,7 +1074,7 @@ static void xs_udp_data_receive(struct sock_xprt *transport)
                 skb = skb_recv_datagram(sk, 0, 1, &err);
                 if (skb != NULL) {
                         xs_udp_data_read_skb(&transport->xprt, sk, skb);
-                        skb_free_datagram(sk, skb);
+                        skb_free_datagram_locked(sk, skb);
                         continue;
                 }
                 if (!test_and_clear_bit(XPRT_SOCK_DATA_READY, &transport->sock_state))
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 6b626a64b517..a04fe9be1c60 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -62,6 +62,8 @@ static void publ_to_item(struct distr_item *i, struct publication *p)
 
 /**
  * named_prepare_buf - allocate & initialize a publication message
+ *
+ * The buffer returned is of size INT_H_SIZE + payload size
  */
 static struct sk_buff *named_prepare_buf(struct net *net, u32 type, u32 size,
                                          u32 dest)
@@ -141,9 +143,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
         struct publication *publ;
         struct sk_buff *skb = NULL;
         struct distr_item *item = NULL;
-        uint msg_dsz = (tipc_node_get_mtu(net, dnode, 0) / ITEM_SIZE) *
-                        ITEM_SIZE;
-        uint msg_rem = msg_dsz;
+        u32 msg_dsz = ((tipc_node_get_mtu(net, dnode, 0) - INT_H_SIZE) /
+                        ITEM_SIZE) * ITEM_SIZE;
+        u32 msg_rem = msg_dsz;
 
         list_for_each_entry(publ, pls, local_list) {
                 /* Prepare next buffer: */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index f1dffe84f0d5..8309687a56b0 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -661,11 +661,11 @@ static int unix_set_peek_off(struct sock *sk, int val)
 {
         struct unix_sock *u = unix_sk(sk);
 
-        if (mutex_lock_interruptible(&u->readlock))
+        if (mutex_lock_interruptible(&u->iolock))
                 return -EINTR;
 
         sk->sk_peek_off = val;
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
 
         return 0;
 }
@@ -779,7 +779,8 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern)
         spin_lock_init(&u->lock);
         atomic_long_set(&u->inflight, 0);
         INIT_LIST_HEAD(&u->link);
-        mutex_init(&u->readlock); /* single task reading lock */
+        mutex_init(&u->iolock); /* single task reading lock */
+        mutex_init(&u->bindlock); /* single task binding lock */
         init_waitqueue_head(&u->peer_wait);
         init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay);
         unix_insert_socket(unix_sockets_unbound(sk), sk);
@@ -848,7 +849,7 @@ static int unix_autobind(struct socket *sock)
         int err;
         unsigned int retries = 0;
 
-        err = mutex_lock_interruptible(&u->readlock);
+        err = mutex_lock_interruptible(&u->bindlock);
         if (err)
                 return err;
 
@@ -895,7 +896,7 @@ retry:
         spin_unlock(&unix_table_lock);
         err = 0;
 
-out:    mutex_unlock(&u->readlock);
+out:    mutex_unlock(&u->bindlock);
         return err;
 }
 
@@ -954,20 +955,32 @@ fail:
         return NULL;
 }
 
-static int unix_mknod(struct dentry *dentry, const struct path *path, umode_t mode,
-                      struct path *res)
+static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
 {
-        int err;
+        struct dentry *dentry;
+        struct path path;
+        int err = 0;
+        /*
+         * Get the parent directory, calculate the hash for last
+         * component.
+         */
+        dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
+        err = PTR_ERR(dentry);
+        if (IS_ERR(dentry))
+                return err;
 
-        err = security_path_mknod(path, dentry, mode, 0);
+        /*
+         * All right, let's create it.
+         */
+        err = security_path_mknod(&path, dentry, mode, 0);
         if (!err) {
-                err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0);
+                err = vfs_mknod(d_inode(path.dentry), dentry, mode, 0);
                 if (!err) {
-                        res->mnt = mntget(path->mnt);
+                        res->mnt = mntget(path.mnt);
                         res->dentry = dget(dentry);
                 }
         }
-
+        done_path_create(&path, dentry);
         return err;
 }
 
@@ -978,12 +991,10 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct unix_sock *u = unix_sk(sk);
         struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
         char *sun_path = sunaddr->sun_path;
-        int err, name_err;
+        int err;
         unsigned int hash;
         struct unix_address *addr;
         struct hlist_head *list;
-        struct path path;
-        struct dentry *dentry;
 
         err = -EINVAL;
         if (sunaddr->sun_family != AF_UNIX)
@@ -999,34 +1010,14 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         addr_len = err;
 
-        name_err = 0;
-        dentry = NULL;
-        if (sun_path[0]) {
-                /* Get the parent directory, calculate the hash for last
-                 * component.
-                 */
-                dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
-
-                if (IS_ERR(dentry)) {
-                        /* delay report until after 'already bound' check */
-                        name_err = PTR_ERR(dentry);
-                        dentry = NULL;
-                }
-        }
-
-        err = mutex_lock_interruptible(&u->readlock);
+        err = mutex_lock_interruptible(&u->bindlock);
         if (err)
-                goto out_path;
+                goto out;
 
         err = -EINVAL;
         if (u->addr)
                 goto out_up;
 
-        if (name_err) {
-                err = name_err == -EEXIST ? -EADDRINUSE : name_err;
-                goto out_up;
-        }
-
         err = -ENOMEM;
         addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL);
         if (!addr)
@@ -1037,11 +1028,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         addr->hash = hash ^ sk->sk_type;
         atomic_set(&addr->refcnt, 1);
 
-        if (dentry) {
-                struct path u_path;
+        if (sun_path[0]) {
+                struct path path;
                 umode_t mode = S_IFSOCK |
                        (SOCK_INODE(sock)->i_mode & ~current_umask());
-                err = unix_mknod(dentry, &path, mode, &u_path);
+                err = unix_mknod(sun_path, mode, &path);
                 if (err) {
                         if (err == -EEXIST)
                                 err = -EADDRINUSE;
@@ -1049,9 +1040,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                         goto out_up;
                 }
                 addr->hash = UNIX_HASH_SIZE;
-                hash = d_real_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1);
+                hash = d_real_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE - 1);
                 spin_lock(&unix_table_lock);
-                u->path = u_path;
+                u->path = path;
                 list = &unix_socket_table[hash];
         } else {
                 spin_lock(&unix_table_lock);
@@ -1073,11 +1064,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 out_unlock:
         spin_unlock(&unix_table_lock);
 out_up:
-        mutex_unlock(&u->readlock);
-out_path:
-        if (dentry)
-                done_path_create(&path, dentry);
-
+        mutex_unlock(&u->bindlock);
 out:
         return err;
 }
@@ -1969,17 +1956,17 @@ static ssize_t unix_stream_sendpage(struct socket *socket, struct page *page,
         if (false) {
 alloc_skb:
                 unix_state_unlock(other);
-                mutex_unlock(&unix_sk(other)->readlock);
+                mutex_unlock(&unix_sk(other)->iolock);
                 newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
                                               &err, 0);
                 if (!newskb)
                         goto err;
         }
 
-        /* we must acquire readlock as we modify already present
+        /* we must acquire iolock as we modify already present
          * skbs in the sk_receive_queue and mess with skb->len
          */
-        err = mutex_lock_interruptible(&unix_sk(other)->readlock);
+        err = mutex_lock_interruptible(&unix_sk(other)->iolock);
         if (err) {
                 err = flags & MSG_DONTWAIT ? -EAGAIN : -ERESTARTSYS;
                 goto err;
@@ -2046,7 +2033,7 @@ alloc_skb:
         }
 
         unix_state_unlock(other);
-        mutex_unlock(&unix_sk(other)->readlock);
+        mutex_unlock(&unix_sk(other)->iolock);
 
         other->sk_data_ready(other);
         scm_destroy(&scm);
@@ -2055,7 +2042,7 @@ alloc_skb:
 err_state_unlock:
         unix_state_unlock(other);
 err_unlock:
-        mutex_unlock(&unix_sk(other)->readlock);
+        mutex_unlock(&unix_sk(other)->iolock);
 err:
         kfree_skb(newskb);
         if (send_sigpipe && !(flags & MSG_NOSIGNAL))
@@ -2123,7 +2110,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
         timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 
         do {
-                mutex_lock(&u->readlock);
+                mutex_lock(&u->iolock);
 
                 skip = sk_peek_offset(sk, flags);
                 skb = __skb_try_recv_datagram(sk, flags, &peeked, &skip, &err,
@@ -2131,14 +2118,14 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
                 if (skb)
                         break;
 
-                mutex_unlock(&u->readlock);
+                mutex_unlock(&u->iolock);
 
                 if (err != -EAGAIN)
                         break;
         } while (timeo &&
                  !__skb_wait_for_more_packets(sk, &err, &timeo, last));
 
-        if (!skb) { /* implies readlock unlocked */
+        if (!skb) { /* implies iolock unlocked */
                 unix_state_lock(sk);
                 /* Signal EOF on disconnected non-blocking SEQPACKET socket. */
                 if (sk->sk_type == SOCK_SEQPACKET && err == -EAGAIN &&
@@ -2203,7 +2190,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
 
 out_free:
         skb_free_datagram(sk, skb);
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
 out:
         return err;
 }
@@ -2298,7 +2285,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state)
         /* Lock the socket to prevent queue disordering
          * while sleeps in memcpy_tomsg
          */
-        mutex_lock(&u->readlock);
+        mutex_lock(&u->iolock);
 
         if (flags & MSG_PEEK)
                 skip = sk_peek_offset(sk, flags);
@@ -2340,7 +2327,7 @@ again:
                                 break;
                         }
 
-                        mutex_unlock(&u->readlock);
+                        mutex_unlock(&u->iolock);
 
                         timeo = unix_stream_data_wait(sk, timeo, last,
                                                       last_len);
@@ -2351,7 +2338,7 @@ again:
                                 goto out;
                         }
 
-                        mutex_lock(&u->readlock);
+                        mutex_lock(&u->iolock);
                         goto redo;
 unlock:
                         unix_state_unlock(sk);
@@ -2454,7 +2441,7 @@ unlock:
                 }
         } while (size);
 
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
         if (state->msg)
                 scm_recv(sock, state->msg, &scm, flags);
         else
@@ -2495,9 +2482,9 @@ static ssize_t skb_unix_socket_splice(struct sock *sk,
         int ret;
         struct unix_sock *u = unix_sk(sk);
 
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
         ret = splice_to_pipe(pipe, spd);
-        mutex_lock(&u->readlock);
+        mutex_lock(&u->iolock);
 
         return ret;
 }
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index dbb2738e356a..6250b1cfcde5 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -958,29 +958,8 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                         return private(dev, iwr, cmd, info, handler);
         }
         /* Old driver API : call driver ioctl handler */
-        if (dev->netdev_ops->ndo_do_ioctl) {
-#ifdef CONFIG_COMPAT
-                if (info->flags & IW_REQUEST_FLAG_COMPAT) {
-                        int ret = 0;
-                        struct iwreq iwr_lcl;
-                        struct compat_iw_point *iwp_compat = (void *) &iwr->u.data;
-
-                        memcpy(&iwr_lcl, iwr, sizeof(struct iwreq));
-                        iwr_lcl.u.data.pointer = compat_ptr(iwp_compat->pointer);
-                        iwr_lcl.u.data.length = iwp_compat->length;
-                        iwr_lcl.u.data.flags = iwp_compat->flags;
-
-                        ret = dev->netdev_ops->ndo_do_ioctl(dev, (void *) &iwr_lcl, cmd);
-
-                        iwp_compat->pointer = ptr_to_compat(iwr_lcl.u.data.pointer);
-                        iwp_compat->length = iwr_lcl.u.data.length;
-                        iwp_compat->flags = iwr_lcl.u.data.flags;
-
-                        return ret;
-                } else
-#endif
-                        return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
-        }
+        if (dev->netdev_ops->ndo_do_ioctl)
+                return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
         return -EOPNOTSUPP;
 }
 
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 1c4ad477ce93..6e3f0254d8a1 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -207,15 +207,15 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
         family = XFRM_SPI_SKB_CB(skb)->family;
 
         /* if tunnel is present override skb->mark value with tunnel i_key */
-        if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) {
-                switch (family) {
-                case AF_INET:
+        switch (family) {
+        case AF_INET:
+                if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
                         mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4->parms.i_key);
-                        break;
-                case AF_INET6:
+                break;
+        case AF_INET6:
+                if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
                         mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6->parms.i_key);
-                        break;
-                }
+                break;
         }
 
         /* Allocate new secpath or COW existing one. */
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b5e665b3cfb0..45f9cf97ea25 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -626,6 +626,10 @@ static void xfrm_hash_rebuild(struct work_struct *work)
 
         /* re-insert all policies by order of creation */
         list_for_each_entry_reverse(policy, &net->xfrm.policy_all, walk.all) {
+                if (xfrm_policy_id2dir(policy->index) >= XFRM_POLICY_MAX) {
+                        /* skip socket policies */
+                        continue;
+                }
                 newpos = NULL;
                 chain = policy_hash_bysel(net, &policy->selector,
                                           policy->family,
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d516845e16e3..cb65d916a345 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -896,7 +896,8 @@ static int xfrm_dump_sa_done(struct netlink_callback *cb)
         struct sock *sk = cb->skb->sk;
         struct net *net = sock_net(sk);
 
-        xfrm_state_walk_done(walk, net);
+        if (cb->args[0])
+                xfrm_state_walk_done(walk, net);
         return 0;
 }
 
@@ -921,8 +922,6 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
                 u8 proto = 0;
                 int err;
 
-                cb->args[0] = 1;
-
                 err = nlmsg_parse(cb->nlh, 0, attrs, XFRMA_MAX,
                                   xfrma_policy);
                 if (err < 0)
@@ -939,6 +938,7 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
                         proto = nla_get_u8(attrs[XFRMA_PROTO]);
 
                 xfrm_state_walk_init(walk, proto, filter);
+                cb->args[0] = 1;
         }
 
         (void) xfrm_state_walk(net, walk, dump_one_state, &info);
@@ -2051,9 +2051,6 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (up->hard) {
                 xfrm_policy_delete(xp, p->dir);
                 xfrm_audit_policy_delete(xp, 1, true);
-        } else {
-                // reset the timers here?
-                WARN(1, "Don't know what to do with soft policy expire\n");
         }
         km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid);
 
@@ -2117,7 +2114,7 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         err = verify_newpolicy_info(&ua->policy);
         if (err)
-                goto bad_policy;
+                goto free_state;
 
         /*   build an XP */
         xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
@@ -2149,8 +2146,6 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         return 0;
 
-bad_policy:
-        WARN(1, "BAD policy passed\n");
 free_state:
         kfree(x);
 nomem:
diff --git a/scripts/faddr2line b/scripts/faddr2line
new file mode 100755
index 000000000000..450b33257339
--- /dev/null
+++ b/scripts/faddr2line
@@ -0,0 +1,177 @@
+#!/bin/bash
+#
+# Translate stack dump function offsets.
+#
+# addr2line doesn't work with KASLR addresses.  This works similarly to
+# addr2line, but instead takes the 'func+0x123' format as input:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux meminfo_proc_show+0x5/0x568
+#   meminfo_proc_show+0x5/0x568:
+#   meminfo_proc_show at fs/proc/meminfo.c:27
+#
+# If the address is part of an inlined function, the full inline call chain is
+# printed:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux native_write_msr+0x6/0x27
+#   native_write_msr+0x6/0x27:
+#   arch_static_branch at arch/x86/include/asm/msr.h:121
+#    (inlined by) static_key_false at include/linux/jump_label.h:125
+#    (inlined by) native_write_msr at arch/x86/include/asm/msr.h:125
+#
+# The function size after the '/' in the input is optional, but recommended.
+# It's used to help disambiguate any duplicate symbol names, which can occur
+# rarely.  If the size is omitted for a duplicate symbol then it's possible for
+# multiple code sites to be printed:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux raw_ioctl+0x5
+#   raw_ioctl+0x5/0x20:
+#   raw_ioctl at drivers/char/raw.c:122
+#
+#   raw_ioctl+0x5/0xb1:
+#   raw_ioctl at net/ipv4/raw.c:876
+#
+# Multiple addresses can be specified on a single command line:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux type_show+0x10/45 free_reserved_area+0x90
+#   type_show+0x10/0x2d:
+#   type_show at drivers/video/backlight/backlight.c:213
+#
+#   free_reserved_area+0x90/0x123:
+#   free_reserved_area at mm/page_alloc.c:6429 (discriminator 2)
+
+
+set -o errexit
+set -o nounset
+
+command -v awk >/dev/null 2>&1 || die "awk isn't installed"
+command -v readelf >/dev/null 2>&1 || die "readelf isn't installed"
+command -v addr2line >/dev/null 2>&1 || die "addr2line isn't installed"
+
+usage() {
+        echo "usage: faddr2line <object file> <func+offset> <func+offset>..." >&2
+        exit 1
+}
+
+warn() {
+        echo "$1" >&2
+}
+
+die() {
+        echo "ERROR: $1" >&2
+        exit 1
+}
+
+# Try to figure out the source directory prefix so we can remove it from the
+# addr2line output.  HACK ALERT: This assumes that start_kernel() is in
+# kernel/init.c!  This only works for vmlinux.  Otherwise it falls back to
+# printing the absolute path.
+find_dir_prefix() {
+        local objfile=$1
+
+        local start_kernel_addr=$(readelf -sW $objfile | awk '$8 == "start_kernel" {printf "0x%s", $2}')
+        [[ -z $start_kernel_addr ]] && return
+
+        local file_line=$(addr2line -e $objfile $start_kernel_addr)
+        [[ -z $file_line ]] && return
+
+        local prefix=${file_line%init/main.c:*}
+        if [[ -z $prefix ]] || [[ $prefix = $file_line ]]; then
+                return
+        fi
+
+        DIR_PREFIX=$prefix
+        return 0
+}
+
+__faddr2line() {
+        local objfile=$1
+        local func_addr=$2
+        local dir_prefix=$3
+        local print_warnings=$4
+
+        local func=${func_addr%+*}
+        local offset=${func_addr#*+}
+        offset=${offset%/*}
+        local size=
+        [[ $func_addr =~ "/" ]] && size=${func_addr#*/}
+
+        if [[ -z $func ]] || [[ -z $offset ]] || [[ $func = $func_addr ]]; then
+                warn "bad func+offset $func_addr"
+                DONE=1
+                return
+        fi
+
+        # Go through each of the object's symbols which match the func name.
+        # In rare cases there might be duplicates.
+        while read symbol; do
+                local fields=($symbol)
+                local sym_base=0x${fields[1]}
+                local sym_size=${fields[2]}
+                local sym_type=${fields[3]}
+
+                # calculate the address
+                local addr=$(($sym_base + $offset))
+                if [[ -z $addr ]] || [[ $addr = 0 ]]; then
+                        warn "bad address: $sym_base + $offset"
+                        DONE=1
+                        return
+                fi
+                local hexaddr=0x$(printf %x $addr)
+
+                # weed out non-function symbols
+                if [[ $sym_type != "FUNC" ]]; then
+                        [[ $print_warnings = 1 ]] &&
+                                echo "skipping $func address at $hexaddr due to non-function symbol"
+                        continue
+                fi
+
+                # if the user provided a size, make sure it matches the symbol's size
+                if [[ -n $size ]] && [[ $size -ne $sym_size ]]; then
+                        [[ $print_warnings = 1 ]] &&
+                                echo "skipping $func address at $hexaddr due to size mismatch ($size != $sym_size)"
+                        continue;
+                fi
+
+                # make sure the provided offset is within the symbol's range
+                if [[ $offset -gt $sym_size ]]; then
+                        [[ $print_warnings = 1 ]] &&
+                                echo "skipping $func address at $hexaddr due to size mismatch ($offset > $sym_size)"
+                        continue
+                fi
+
+                # separate multiple entries with a blank line
+                [[ $FIRST = 0 ]] && echo
+                FIRST=0
+
+                local hexsize=0x$(printf %x $sym_size)
+                echo "$func+$offset/$hexsize:"
+                addr2line -fpie $objfile $hexaddr | sed "s; $dir_prefix\(\./\)*; ;"
+                DONE=1
+
+        done < <(readelf -sW $objfile | awk -v f=$func '$8 == f {print}')
+}
+
+[[ $# -lt 2 ]] && usage
+
+objfile=$1
+[[ ! -f $objfile ]] && die "can't find objfile $objfile"
+shift
+
+DIR_PREFIX=supercalifragilisticexpialidocious
+find_dir_prefix $objfile
+
+FIRST=1
+while [[ $# -gt 0 ]]; do
+        func_addr=$1
+        shift
+
+        # print any matches found
+        DONE=0
+        __faddr2line $objfile $func_addr $DIR_PREFIX 0
+
+        # if no match was found, print warnings
+        if [[ $DONE = 0 ]]; then
+                __faddr2line $objfile $func_addr $DIR_PREFIX 1
+                warn "no match for $func_addr"
+        fi
+done
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index e1c09e2f9be7..8ea9fd2b6573 100755
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -332,7 +332,9 @@ if grep -q '^CONFIG_STACK_VALIDATION=y' $KCONFIG_CONFIG ; then
         (cd $objtree; find tools/objtool -type f -executable) >> "$objtree/debian/hdrobjfiles"
 fi
 (cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f) >> "$objtree/debian/hdrobjfiles"
-(cd $objtree; find scripts/gcc-plugins -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
+if grep -q '^CONFIG_GCC_PLUGINS=y' $KCONFIG_CONFIG ; then
+        (cd $objtree; find scripts/gcc-plugins -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
+fi
 destdir=$kernel_headers_dir/usr/src/linux-headers-$version
 mkdir -p "$destdir"
 (cd $srctree; tar -c -f - -T -) < "$objtree/debian/hdrsrcfiles" | (cd $destdir; tar -xf -)
diff --git a/security/Kconfig b/security/Kconfig
index da10d9b573a4..118f4549404e 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -147,6 +147,17 @@ config HARDENED_USERCOPY
           or are part of the kernel text. This kills entire classes
           of heap overflow exploits and similar kernel memory exposures.
 
+config HARDENED_USERCOPY_PAGESPAN
+        bool "Refuse to copy allocations that span multiple pages"
+        depends on HARDENED_USERCOPY
+        depends on EXPERT
+        help
+          When a multi-page allocation is done without __GFP_COMP,
+          hardened usercopy will reject attempts to copy it. There are,
+          however, several cases of this in the kernel that have not all
+          been removed. This config is intended to be used only while
+          trying to find such users.
+
 source security/selinux/Kconfig
 source security/smack/Kconfig
 source security/tomoyo/Kconfig
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 795437b10082..b450a27588c8 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -1633,11 +1633,13 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
                 return -EBUSY;
         }
         list_add_tail(&rmidi->list, &snd_rawmidi_devices);
+        mutex_unlock(&register_mutex);
         err = snd_register_device(SNDRV_DEVICE_TYPE_RAWMIDI,
                                   rmidi->card, rmidi->device,
                                   &snd_rawmidi_f_ops, rmidi, &rmidi->dev);
         if (err < 0) {
                 rmidi_err(rmidi, "unable to register\n");
+                mutex_lock(&register_mutex);
                 list_del(&rmidi->list);
                 mutex_unlock(&register_mutex);
                 return err;
@@ -1645,6 +1647,7 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
         if (rmidi->ops && rmidi->ops->dev_register &&
             (err = rmidi->ops->dev_register(rmidi)) < 0) {
                 snd_unregister_device(&rmidi->dev);
+                mutex_lock(&register_mutex);
                 list_del(&rmidi->list);
                 mutex_unlock(&register_mutex);
                 return err;
@@ -1677,7 +1680,6 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
                 }
         }
 #endif /* CONFIG_SND_OSSEMUL */
-        mutex_unlock(&register_mutex);
         sprintf(name, "midi%d", rmidi->device);
         entry = snd_info_create_card_entry(rmidi->card, name, rmidi->card->proc_root);
         if (entry) {
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 9a6157ea6881..fc144f43faa6 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -35,6 +35,9 @@
 #include <sound/initval.h>
 #include <linux/kmod.h>
 
+/* internal flags */
+#define SNDRV_TIMER_IFLG_PAUSED         0x00010000
+
 #if IS_ENABLED(CONFIG_SND_HRTIMER)
 #define DEFAULT_TIMER_LIMIT 4
 #else
@@ -294,8 +297,21 @@ int snd_timer_open(struct snd_timer_instance **ti,
                 get_device(&timer->card->card_dev);
         timeri->slave_class = tid->dev_sclass;
         timeri->slave_id = slave_id;
-        if (list_empty(&timer->open_list_head) && timer->hw.open)
-                timer->hw.open(timer);
+
+        if (list_empty(&timer->open_list_head) && timer->hw.open) {
+                int err = timer->hw.open(timer);
+                if (err) {
+                        kfree(timeri->owner);
+                        kfree(timeri);
+
+                        if (timer->card)
+                                put_device(&timer->card->card_dev);
+                        module_put(timer->module);
+                        mutex_unlock(&register_mutex);
+                        return err;
+                }
+        }
+
         list_add_tail(&timeri->open_list, &timer->open_list_head);
         snd_timer_check_master(timeri);
         mutex_unlock(&register_mutex);
@@ -526,6 +542,10 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
                 }
         }
         timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
+        if (stop)
+                timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED;
+        else
+                timeri->flags |= SNDRV_TIMER_IFLG_PAUSED;
         snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
                           SNDRV_TIMER_EVENT_CONTINUE);
  unlock:
@@ -587,6 +607,10 @@ int snd_timer_stop(struct snd_timer_instance *timeri)
  */
 int snd_timer_continue(struct snd_timer_instance *timeri)
 {
+        /* timer can continue only after pause */
+        if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
+                return -EINVAL;
+
         if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
                 return snd_timer_start_slave(timeri, false);
         else
@@ -813,6 +837,7 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
         timer->tmr_subdevice = tid->subdevice;
         if (id)
                 strlcpy(timer->id, id, sizeof(timer->id));
+        timer->sticks = 1;
         INIT_LIST_HEAD(&timer->device_list);
         INIT_LIST_HEAD(&timer->open_list_head);
         INIT_LIST_HEAD(&timer->active_list_head);
@@ -1817,6 +1842,9 @@ static int snd_timer_user_continue(struct file *file)
         tu = file->private_data;
         if (!tu->timeri)
                 return -EBADFD;
+        /* start timer instead of continue if it's not used before */
+        if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
+                return snd_timer_user_start(file);
         tu->timeri->lost = 0;
         return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0;
 }
@@ -1958,6 +1986,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                 tu->qused--;
                 spin_unlock_irq(&tu->qlock);
 
+                mutex_lock(&tu->ioctl_lock);
                 if (tu->tread) {
                         if (copy_to_user(buffer, &tu->tqueue[qhead],
                                          sizeof(struct snd_timer_tread)))
@@ -1967,6 +1996,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                                          sizeof(struct snd_timer_read)))
                                 err = -EFAULT;
                 }
+                mutex_unlock(&tu->ioctl_lock);
 
                 spin_lock_irq(&tu->qlock);
                 if (err < 0)
diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h
index 03ed35237e2b..d73c12b8753d 100644
--- a/sound/firewire/fireworks/fireworks.h
+++ b/sound/firewire/fireworks/fireworks.h
@@ -108,7 +108,6 @@ struct snd_efw {
         u8 *resp_buf;
         u8 *pull_ptr;
         u8 *push_ptr;
-        unsigned int resp_queues;
 };
 
 int snd_efw_transaction_cmd(struct fw_unit *unit,
diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c
index 33df8655fe81..2e1d9a23920c 100644
--- a/sound/firewire/fireworks/fireworks_hwdep.c
+++ b/sound/firewire/fireworks/fireworks_hwdep.c
@@ -25,6 +25,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
 {
         unsigned int length, till_end, type;
         struct snd_efw_transaction *t;
+        u8 *pull_ptr;
         long count = 0;
 
         if (remained < sizeof(type) + sizeof(struct snd_efw_transaction))
@@ -38,8 +39,17 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
         buf += sizeof(type);
 
         /* write into buffer as many responses as possible */
-        while (efw->resp_queues > 0) {
-                t = (struct snd_efw_transaction *)(efw->pull_ptr);
+        spin_lock_irq(&efw->lock);
+
+        /*
+         * When another task reaches here during this task's access to user
+         * space, it picks up current position in buffer and can read the same
+         * series of responses.
+         */
+        pull_ptr = efw->pull_ptr;
+
+        while (efw->push_ptr != pull_ptr) {
+                t = (struct snd_efw_transaction *)(pull_ptr);
                 length = be32_to_cpu(t->length) * sizeof(__be32);
 
                 /* confirm enough space for this response */
@@ -49,26 +59,39 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
                 /* copy from ring buffer to user buffer */
                 while (length > 0) {
                         till_end = snd_efw_resp_buf_size -
-                                (unsigned int)(efw->pull_ptr - efw->resp_buf);
+                                (unsigned int)(pull_ptr - efw->resp_buf);
                         till_end = min_t(unsigned int, length, till_end);
 
-                        if (copy_to_user(buf, efw->pull_ptr, till_end))
+                        spin_unlock_irq(&efw->lock);
+
+                        if (copy_to_user(buf, pull_ptr, till_end))
                                 return -EFAULT;
 
-                        efw->pull_ptr += till_end;
-                        if (efw->pull_ptr >= efw->resp_buf +
-                                             snd_efw_resp_buf_size)
-                                efw->pull_ptr -= snd_efw_resp_buf_size;
+                        spin_lock_irq(&efw->lock);
+
+                        pull_ptr += till_end;
+                        if (pull_ptr >= efw->resp_buf + snd_efw_resp_buf_size)
+                                pull_ptr -= snd_efw_resp_buf_size;
 
                         length -= till_end;
                         buf += till_end;
                         count += till_end;
                         remained -= till_end;
                 }
-
-                efw->resp_queues--;
         }
 
+        /*
+         * All of tasks can read from the buffer nearly simultaneously, but the
+         * last position for each task is different depending on the length of
+         * given buffer. Here, for simplicity, a position of buffer is set by
+         * the latest task. It's better for a listening application to allow one
+         * thread to read from the buffer. Unless, each task can read different
+         * sequence of responses depending on variation of buffer length.
+         */
+        efw->pull_ptr = pull_ptr;
+
+        spin_unlock_irq(&efw->lock);
+
         return count;
 }
 
@@ -76,14 +99,17 @@ static long
 hwdep_read_locked(struct snd_efw *efw, char __user *buf, long count,
                   loff_t *offset)
 {
-        union snd_firewire_event event;
+        union snd_firewire_event event = {
+                .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
+        };
 
-        memset(&event, 0, sizeof(event));
+        spin_lock_irq(&efw->lock);
 
-        event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
         event.lock_status.status = (efw->dev_lock_count > 0);
         efw->dev_lock_changed = false;
 
+        spin_unlock_irq(&efw->lock);
+
         count = min_t(long, count, sizeof(event.lock_status));
 
         if (copy_to_user(buf, &event, count))
@@ -98,10 +124,15 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
 {
         struct snd_efw *efw = hwdep->private_data;
         DEFINE_WAIT(wait);
+        bool dev_lock_changed;
+        bool queued;
 
         spin_lock_irq(&efw->lock);
 
-        while ((!efw->dev_lock_changed) && (efw->resp_queues == 0)) {
+        dev_lock_changed = efw->dev_lock_changed;
+        queued = efw->push_ptr != efw->pull_ptr;
+
+        while (!dev_lock_changed && !queued) {
                 prepare_to_wait(&efw->hwdep_wait, &wait, TASK_INTERRUPTIBLE);
                 spin_unlock_irq(&efw->lock);
                 schedule();
@@ -109,15 +140,17 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
                 if (signal_pending(current))
                         return -ERESTARTSYS;
                 spin_lock_irq(&efw->lock);
+                dev_lock_changed = efw->dev_lock_changed;
+                queued = efw->push_ptr != efw->pull_ptr;
         }
 
-        if (efw->dev_lock_changed)
+        spin_unlock_irq(&efw->lock);
+
+        if (dev_lock_changed)
                 count = hwdep_read_locked(efw, buf, count, offset);
-        else if (efw->resp_queues > 0)
+        else if (queued)
                 count = hwdep_read_resp_buf(efw, buf, count, offset);
 
-        spin_unlock_irq(&efw->lock);
-
         return count;
 }
 
@@ -160,7 +193,7 @@ hwdep_poll(struct snd_hwdep *hwdep, struct file *file, poll_table *wait)
         poll_wait(file, &efw->hwdep_wait, wait);
 
         spin_lock_irq(&efw->lock);
-        if (efw->dev_lock_changed || (efw->resp_queues > 0))
+        if (efw->dev_lock_changed || efw->pull_ptr != efw->push_ptr)
                 events = POLLIN | POLLRDNORM;
         else
                 events = 0;
diff --git a/sound/firewire/fireworks/fireworks_proc.c b/sound/firewire/fireworks/fireworks_proc.c
index 0639dcb13f7d..beb0a0ffee57 100644
--- a/sound/firewire/fireworks/fireworks_proc.c
+++ b/sound/firewire/fireworks/fireworks_proc.c
@@ -188,8 +188,8 @@ proc_read_queues_state(struct snd_info_entry *entry,
         else
                 consumed = (unsigned int)(efw->push_ptr - efw->pull_ptr);
 
-        snd_iprintf(buffer, "%d %d/%d\n",
-                    efw->resp_queues, consumed, snd_efw_resp_buf_size);
+        snd_iprintf(buffer, "%d/%d\n",
+                    consumed, snd_efw_resp_buf_size);
 }
 
 static void
diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c
index f550808d1784..36a08ba51ec7 100644
--- a/sound/firewire/fireworks/fireworks_transaction.c
+++ b/sound/firewire/fireworks/fireworks_transaction.c
@@ -121,11 +121,11 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
         size_t capacity, till_end;
         struct snd_efw_transaction *t;
 
-        spin_lock_irq(&efw->lock);
-
         t = (struct snd_efw_transaction *)data;
         length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
 
+        spin_lock_irq(&efw->lock);
+
         if (efw->push_ptr < efw->pull_ptr)
                 capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
         else
@@ -155,7 +155,6 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
         }
 
         /* for hwdep */
-        efw->resp_queues++;
         wake_up(&efw->hwdep_wait);
 
         *rcode = RCODE_COMPLETE;
diff --git a/sound/firewire/tascam/tascam-hwdep.c b/sound/firewire/tascam/tascam-hwdep.c
index 131267c3a042..106406cbfaa3 100644
--- a/sound/firewire/tascam/tascam-hwdep.c
+++ b/sound/firewire/tascam/tascam-hwdep.c
@@ -16,31 +16,14 @@
 
 #include "tascam.h"
 
-static long hwdep_read_locked(struct snd_tscm *tscm, char __user *buf,
-                              long count)
-{
-        union snd_firewire_event event;
-
-        memset(&event, 0, sizeof(event));
-
-        event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
-        event.lock_status.status = (tscm->dev_lock_count > 0);
-        tscm->dev_lock_changed = false;
-
-        count = min_t(long, count, sizeof(event.lock_status));
-
-        if (copy_to_user(buf, &event, count))
-                return -EFAULT;
-
-        return count;
-}
-
 static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
                        loff_t *offset)
 {
         struct snd_tscm *tscm = hwdep->private_data;
         DEFINE_WAIT(wait);
-        union snd_firewire_event event;
+        union snd_firewire_event event = {
+                .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
+        };
 
         spin_lock_irq(&tscm->lock);
 
@@ -54,10 +37,16 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
                 spin_lock_irq(&tscm->lock);
         }
 
-        memset(&event, 0, sizeof(event));
-        count = hwdep_read_locked(tscm, buf, count);
+        event.lock_status.status = (tscm->dev_lock_count > 0);
+        tscm->dev_lock_changed = false;
+
         spin_unlock_irq(&tscm->lock);
 
+        count = min_t(long, count, sizeof(event.lock_status));
+
+        if (copy_to_user(buf, &event, count))
+                return -EFAULT;
+
         return count;
 }
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7100f05e651a..575cefd8cc4a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4855,6 +4855,7 @@ enum {
         ALC221_FIXUP_HP_FRONT_MIC,
         ALC292_FIXUP_TPT460,
         ALC298_FIXUP_SPK_VOLUME,
+        ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -5516,6 +5517,15 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
         },
+        [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1b, 0x90170151 },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -5560,6 +5570,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
         SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
         SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+        SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
         SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
         SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
         SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
@@ -5895,6 +5906,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60170},
                 {0x14, 0x90170120},
                 {0x21, 0x02211030}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell Inspiron 5468", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60180},
+                {0x14, 0x90170120},
+                {0x21, 0x02211030}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC256_STANDARD_PINS),
         SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 6cf1f3597455..152292e5ee2b 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1141,6 +1141,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
         case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
         case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
         case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
+        case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
         case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
         case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
         case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */
diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index ae68bf0e2d51..f39c0e9c0d5c 100644
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -456,7 +456,7 @@ int main(int argc, char **argv)
 
         if (notrigger) {
                 printf("trigger-less mode selected\n");
-        } if (trig_num >= 0) {
+        } else if (trig_num >= 0) {
                 char *trig_dev_name;
                 ret = asprintf(&trig_dev_name, "%strigger%d", iio_dir, trig_num);
                 if (ret < 0) {
diff --git a/tools/lguest/lguest.c b/tools/lguest/lguest.c
index d9836c5eb694..11c8d9bc762e 100644
--- a/tools/lguest/lguest.c
+++ b/tools/lguest/lguest.c
@@ -3266,6 +3266,9 @@ int main(int argc, char *argv[])
                 }
         }
 
+        /* If we exit via err(), this kills all the threads, restores tty. */
+        atexit(cleanup_devices);
+
         /* We always have a console device, and it's always device 1. */
         setup_console();
 
@@ -3369,9 +3372,6 @@ int main(int argc, char *argv[])
         /* Ensure that we terminate if a device-servicing child dies. */
         signal(SIGCHLD, kill_launcher);
 
-        /* If we exit via err(), this kills all the threads, restores tty. */
-        atexit(cleanup_devices);
-
         /* If requested, chroot to a directory */
         if (chroot_path) {
                 if (chroot(chroot_path) != 0)