228 files changed, 1705 insertions, 994 deletions
diff --git a/.mailmap b/.mailmap
index 4b31af54ccd5..b1e9a97653dc 100644
--- a/.mailmap
+++ b/.mailmap
@@ -59,6 +59,7 @@ James Bottomley <jejb@mulgrave.(none)>
 James Bottomley <jejb@titanic.il.steeleye.com>
 James E Wilson <wilson@specifix.com>
 James Ketrenos <jketreno@io.(none)>
+<javier@osg.samsung.com> <javier.martinez@collabora.co.uk>
 Jean Tourrilhes <jt@hpl.hp.com>
 Jeff Garzik <jgarzik@pretzel.yyz.us>
 Jens Axboe <axboe@suse.de>
diff --git a/Documentation/arm/OMAP/README b/Documentation/arm/OMAP/README
new file mode 100644
index 000000000000..75645c45d14a
--- /dev/null
+++ b/Documentation/arm/OMAP/README
@@ -0,0 +1,7 @@
+This file contains documentation for running mainline
+kernel on omaps.
+KERNEL          NEW DEPENDENCIES
+v4.3+           Update is needed for custom .config files to make sure
+                CONFIG_REGULATOR_PBIAS is enabled for MMC1 to work
+                properly.
diff --git a/MAINTAINERS b/MAINTAINERS
index b8577ad9b8a2..9de185da5f5b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -894,11 +894,12 @@ M:	Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-ARM/Allwinner A1X SoC support
+ARM/Allwinner sunXi SoC support
 M:      Maxime Ripard <maxime.ripard@free-electrons.com>
+M:      Chen-Yu Tsai <wens@csie.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-N:      sun[x4567]i
+N:      sun[x456789]i
 ARM/Allwinner SoC Clock Support
 M:      Emilio López <emilio@elopez.com.ar>
@@ -6793,7 +6794,6 @@ F:	drivers/scsi/megaraid/
 MELLANOX ETHERNET DRIVER (mlx4_en)
 M:      Amir Vadai <amirv@mellanox.com>
-M:      Ido Shamay <idos@mellanox.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 W:      http://www.mellanox.com
@@ -11675,6 +11675,7 @@ F:	drivers/tty/serial/zs.*
 ZSMALLOC COMPRESSED SLAB MEMORY ALLOCATOR
 M:      Minchan Kim <minchan@kernel.org>
 M:      Nitin Gupta <ngupta@vflare.org>
+R:      Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
 L:      linux-mm@kvack.org
 S:      Maintained
 F:      mm/zsmalloc.c
diff --git a/Makefile b/Makefile
index d33ab74bffce..431067a41fcf 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Blurry Fish Butt
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/am57xx-beagle-x15.dts b/arch/arm/boot/dts/am57xx-beagle-x15.dts
index 568adf5efde0..d55e3ea89fda 100644
--- a/arch/arm/boot/dts/am57xx-beagle-x15.dts
+++ b/arch/arm/boot/dts/am57xx-beagle-x15.dts
@@ -402,11 +402,12 @@
                                /* SMPS9 unused */
                                ldo1_reg: ldo1 {
-                                        /* VDD_SD  */
+                                        /* VDD_SD / VDDSHV8  */
                                        regulator-name = "ldo1";
                                        regulator-min-microvolt = <1800000>;
                                        regulator-max-microvolt = <3300000>;
                                        regulator-boot-on;
+                                        regulator-always-on;
                                };
                                ldo2_reg: ldo2 {
diff --git a/arch/arm/boot/dts/armada-385-db-ap.dts b/arch/arm/boot/dts/armada-385-db-ap.dts
index 89f5a95954ed..4047621b137e 100644
--- a/arch/arm/boot/dts/armada-385-db-ap.dts
+++ b/arch/arm/boot/dts/armada-385-db-ap.dts
@@ -46,7 +46,7 @@
 / {
        model = "Marvell Armada 385 Access Point Development Board";
-        compatible = "marvell,a385-db-ap", "marvell,armada385", "marvell,armada38x";
+        compatible = "marvell,a385-db-ap", "marvell,armada385", "marvell,armada380";
        chosen {
                stdout-path = "serial1:115200n8";
diff --git a/arch/arm/boot/dts/berlin2q.dtsi b/arch/arm/boot/dts/berlin2q.dtsi
index 63a48490e2f9..d4dbd28d348c 100644
--- a/arch/arm/boot/dts/berlin2q.dtsi
+++ b/arch/arm/boot/dts/berlin2q.dtsi
@@ -152,7 +152,7 @@
                };
                usb_phy2: phy@a2f400 {
-                        compatible = "marvell,berlin2-usb-phy";
+                        compatible = "marvell,berlin2cd-usb-phy";
                        reg = <0xa2f400 0x128>;
                        #phy-cells = <0>;
                        resets = <&chip_rst 0x104 14>;
@@ -170,7 +170,7 @@
                };
                usb_phy0: phy@b74000 {
-                        compatible = "marvell,berlin2-usb-phy";
+                        compatible = "marvell,berlin2cd-usb-phy";
                        reg = <0xb74000 0x128>;
                        #phy-cells = <0>;
                        resets = <&chip_rst 0x104 12>;
@@ -178,7 +178,7 @@
                };
                usb_phy1: phy@b78000 {
-                        compatible = "marvell,berlin2-usb-phy";
+                        compatible = "marvell,berlin2cd-usb-phy";
                        reg = <0xb78000 0x128>;
                        #phy-cells = <0>;
                        resets = <&chip_rst 0x104 13>;
diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts
index 8f4d76c5e11c..1b95da79293c 100644
--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
+++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
@@ -915,6 +915,11 @@
        };
 };
+&pmu_system_controller {
+        assigned-clocks = <&pmu_system_controller 0>;
+        assigned-clock-parents = <&clock CLK_FIN_PLL>;
+};
 &rtc {
        status = "okay";
        clocks = <&clock CLK_RTC>, <&max77802 MAX77802_CLK_32K_AP>;
diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts
index 7d5b386b5ae6..8f40c7e549bd 100644
--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts
+++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts
@@ -878,6 +878,11 @@
        };
 };
+&pmu_system_controller {
+        assigned-clocks = <&pmu_system_controller 0>;
+        assigned-clock-parents = <&clock CLK_FIN_PLL>;
+};
 &rtc {
        status = "okay";
        clocks = <&clock CLK_RTC>, <&max77802 MAX77802_CLK_32K_AP>;
diff --git a/arch/arm/boot/dts/imx7d.dtsi b/arch/arm/boot/dts/imx7d.dtsi
index b738ce0f9d9b..6e444bb873f9 100644
--- a/arch/arm/boot/dts/imx7d.dtsi
+++ b/arch/arm/boot/dts/imx7d.dtsi
@@ -588,10 +588,10 @@
                                status = "disabled";
                        };
-                        uart2: serial@30870000 {
+                        uart2: serial@30890000 {
                                compatible = "fsl,imx7d-uart",
                                             "fsl,imx6q-uart";
-                                reg = <0x30870000 0x10000>;
+                                reg = <0x30890000 0x10000>;
                                interrupts = <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>;
                                clocks = <&clks IMX7D_UART2_ROOT_CLK>,
                                        <&clks IMX7D_UART2_ROOT_CLK>;
diff --git a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
index 91146c318798..5b0430041ec6 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
+++ b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
@@ -12,7 +12,7 @@
 / {
        model = "LogicPD Zoom DM3730 Torpedo Development Kit";
-        compatible = "logicpd,dm3730-torpedo-devkit", "ti,omap36xx";
+        compatible = "logicpd,dm3730-torpedo-devkit", "ti,omap3630", "ti,omap3";
        gpio_keys {
                compatible = "gpio-keys";
diff --git a/arch/arm/boot/dts/meson.dtsi b/arch/arm/boot/dts/meson.dtsi
index 548441384d2a..8c77c87660cd 100644
--- a/arch/arm/boot/dts/meson.dtsi
+++ b/arch/arm/boot/dts/meson.dtsi
@@ -67,7 +67,7 @@
        timer@c1109940 {
                compatible = "amlogic,meson6-timer";
-                reg = <0xc1109940 0x14>;
+                reg = <0xc1109940 0x18>;
                interrupts = <0 10 1>;
        };
@@ -80,36 +80,37 @@
                wdt: watchdog@c1109900 {
                        compatible = "amlogic,meson6-wdt";
                        reg = <0xc1109900 0x8>;
+                        interrupts = <0 0 1>;
                };
                uart_AO: serial@c81004c0 {
                        compatible = "amlogic,meson-uart";
-                        reg = <0xc81004c0 0x14>;
+                        reg = <0xc81004c0 0x18>;
                        interrupts = <0 90 1>;
                        clocks = <&clk81>;
                        status = "disabled";
                };
-                uart_A: serial@c81084c0 {
+                uart_A: serial@c11084c0 {
                        compatible = "amlogic,meson-uart";
-                        reg = <0xc81084c0 0x14>;
+                        reg = <0xc11084c0 0x18>;
-                        interrupts = <0 90 1>;
+                        interrupts = <0 26 1>;
                        clocks = <&clk81>;
                        status = "disabled";
                };
-                uart_B: serial@c81084dc {
+                uart_B: serial@c11084dc {
                        compatible = "amlogic,meson-uart";
-                        reg = <0xc81084dc 0x14>;
+                        reg = <0xc11084dc 0x18>;
-                        interrupts = <0 90 1>;
+                        interrupts = <0 75 1>;
                        clocks = <&clk81>;
                        status = "disabled";
                };
-                uart_C: serial@c8108700 {
+                uart_C: serial@c1108700 {
                        compatible = "amlogic,meson-uart";
-                        reg = <0xc8108700 0x14>;
+                        reg = <0xc1108700 0x18>;
-                        interrupts = <0 90 1>;
+                        interrupts = <0 93 1>;
                        clocks = <&clk81>;
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/omap3-evm-37xx.dts b/arch/arm/boot/dts/omap3-evm-37xx.dts
index 16e8ce350dda..bb339d1648e0 100644
--- a/arch/arm/boot/dts/omap3-evm-37xx.dts
+++ b/arch/arm/boot/dts/omap3-evm-37xx.dts
@@ -13,7 +13,7 @@
 / {
        model = "TI OMAP37XX EVM (TMDSEVM3730)";
-        compatible = "ti,omap3-evm-37xx", "ti,omap36xx";
+        compatible = "ti,omap3-evm-37xx", "ti,omap3630", "ti,omap3";
        memory {
                device_type = "memory";
diff --git a/arch/arm/boot/dts/ste-hrefv60plus.dtsi b/arch/arm/boot/dts/ste-hrefv60plus.dtsi
index 810cda743b6d..9c2387b34d0c 100644
--- a/arch/arm/boot/dts/ste-hrefv60plus.dtsi
+++ b/arch/arm/boot/dts/ste-hrefv60plus.dtsi
@@ -56,7 +56,7 @@
                                        /* VMMCI level-shifter enable */
                                        default_hrefv60_cfg2 {
                                                pins = "GPIO169_D22";
-                                                ste,config = <&gpio_out_lo>;
+                                                ste,config = <&gpio_out_hi>;
                                        };
                                        /* VMMCI level-shifter voltage select */
                                        default_hrefv60_cfg3 {
diff --git a/arch/arm/boot/dts/tegra114.dtsi b/arch/arm/boot/dts/tegra114.dtsi
index 9d4f86e9c50a..d845bd1448b5 100644
--- a/arch/arm/boot/dts/tegra114.dtsi
+++ b/arch/arm/boot/dts/tegra114.dtsi
@@ -234,7 +234,9 @@
                gpio-controller;
                #interrupt-cells = <2>;
                interrupt-controller;
+                /*
                gpio-ranges = <&pinmux 0 0 246>;
+                */
        };
        apbmisc@70000800 {
diff --git a/arch/arm/boot/dts/tegra124.dtsi b/arch/arm/boot/dts/tegra124.dtsi
index 1e204a6de12c..819e2ae2cabe 100644
--- a/arch/arm/boot/dts/tegra124.dtsi
+++ b/arch/arm/boot/dts/tegra124.dtsi
@@ -258,7 +258,9 @@
                gpio-controller;
                #interrupt-cells = <2>;
                interrupt-controller;
+                /*
                gpio-ranges = <&pinmux 0 0 251>;
+                */
        };
        apbdma: dma@0,60020000 {
diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi
index e058709e6d98..969b828505ae 100644
--- a/arch/arm/boot/dts/tegra20.dtsi
+++ b/arch/arm/boot/dts/tegra20.dtsi
@@ -244,7 +244,9 @@
                gpio-controller;
                #interrupt-cells = <2>;
                interrupt-controller;
+                /*
                gpio-ranges = <&pinmux 0 0 224>;
+                */
        };
        apbmisc@70000800 {
diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
index fe04fb5e155f..c6938ad1b543 100644
--- a/arch/arm/boot/dts/tegra30.dtsi
+++ b/arch/arm/boot/dts/tegra30.dtsi
@@ -349,7 +349,9 @@
                gpio-controller;
                #interrupt-cells = <2>;
                interrupt-controller;
+                /*
                gpio-ranges = <&pinmux 0 0 248>;
+                */
        };
        apbmisc@70000800 {
diff --git a/arch/arm/boot/dts/uniphier-ph1-ld6b-ref.dts b/arch/arm/boot/dts/uniphier-ph1-ld6b-ref.dts
index 33963acd7e8f..f80f772d99fb 100644
--- a/arch/arm/boot/dts/uniphier-ph1-ld6b-ref.dts
+++ b/arch/arm/boot/dts/uniphier-ph1-ld6b-ref.dts
@@ -85,7 +85,7 @@
 };
 &ethsc {
-        interrupts = <0 50 4>;
+        interrupts = <0 52 4>;
 };
 &serial0 {
diff --git a/arch/arm/kvm/Kconfig b/arch/arm/kvm/Kconfig
index 210eccadb69a..356970f3b25e 100644
--- a/arch/arm/kvm/Kconfig
+++ b/arch/arm/kvm/Kconfig
@@ -21,6 +21,7 @@ config KVM
        depends on MMU && OF
        select PREEMPT_NOTIFIERS
        select ANON_INODES
+        select ARM_GIC
        select HAVE_KVM_CPU_RELAX_INTERCEPT
        select HAVE_KVM_ARCH_TLB_FLUSH_ALL
        select KVM_MMIO
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index dc017adfddc8..78b286994577 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -1080,7 +1080,7 @@ static int init_hyp_mode(void)
         */
        err = kvm_timer_hyp_init();
        if (err)
-                goto out_free_mappings;
+                goto out_free_context;
 #ifndef CONFIG_HOTPLUG_CPU
        free_boot_hyp_pgd();
diff --git a/arch/arm/mach-exynos/pm_domains.c b/arch/arm/mach-exynos/pm_domains.c
index 4a87e86dec45..7c21760f590f 100644
--- a/arch/arm/mach-exynos/pm_domains.c
+++ b/arch/arm/mach-exynos/pm_domains.c
@@ -200,15 +200,15 @@ no_clk:
                args.args_count = 0;
                child_domain = of_genpd_get_from_provider(&args);
                if (IS_ERR(child_domain))
-                        goto next_pd;
+                        continue;
                if (of_parse_phandle_with_args(np, "power-domains",
                                         "#power-domain-cells", 0, &args) != 0)
-                        goto next_pd;
+                        continue;
                parent_domain = of_genpd_get_from_provider(&args);
                if (IS_ERR(parent_domain))
-                        goto next_pd;
+                        continue;
                if (pm_genpd_add_subdomain(parent_domain, child_domain))
                        pr_warn("%s failed to add subdomain: %s\n",
@@ -216,8 +216,6 @@ no_clk:
                else
                        pr_info("%s has as child subdomain: %s.\n",
                                parent_domain->name, child_domain->name);
-next_pd:
-                of_node_put(np);
        }
        return 0;
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index b3a0dff67e3f..33d1460a5639 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -49,6 +49,7 @@ config SOC_OMAP5
        select OMAP_INTERCONNECT
        select OMAP_INTERCONNECT_BARRIER
        select PM_OPP if PM
+        select ZONE_DMA if ARM_LPAE
 config SOC_AM33XX
        bool "TI AM33XX"
@@ -78,6 +79,7 @@ config SOC_DRA7XX
        select OMAP_INTERCONNECT
        select OMAP_INTERCONNECT_BARRIER
        select PM_OPP if PM
+        select ZONE_DMA if ARM_LPAE
 config ARCH_OMAP2PLUS
        bool
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index 6133eaac685d..fb219a30c10c 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -106,6 +106,7 @@ DT_MACHINE_START(OMAP3_DT, "Generic OMAP3 (Flattened Device Tree)")
 MACHINE_END
 static const char *const omap36xx_boards_compat[] __initconst = {
+        "ti,omap3630",
        "ti,omap36xx",
        NULL,
 };
@@ -243,6 +244,9 @@ static const char *const omap5_boards_compat[] __initconst = {
 };
 DT_MACHINE_START(OMAP5_DT, "Generic OMAP5 (Flattened Device Tree)")
+#if defined(CONFIG_ZONE_DMA) && defined(CONFIG_ARM_LPAE)
+        .dma_zone_size  = SZ_2G,
+#endif
        .reserve        = omap_reserve,
        .smp            = smp_ops(omap4_smp_ops),
        .map_io         = omap5_map_io,
@@ -288,6 +292,9 @@ static const char *const dra74x_boards_compat[] __initconst = {
 };
 DT_MACHINE_START(DRA74X_DT, "Generic DRA74X (Flattened Device Tree)")
+#if defined(CONFIG_ZONE_DMA) && defined(CONFIG_ARM_LPAE)
+        .dma_zone_size  = SZ_2G,
+#endif
        .reserve        = omap_reserve,
        .smp            = smp_ops(omap4_smp_ops),
        .map_io         = dra7xx_map_io,
@@ -308,6 +315,9 @@ static const char *const dra72x_boards_compat[] __initconst = {
 };
 DT_MACHINE_START(DRA72X_DT, "Generic DRA72X (Flattened Device Tree)")
+#if defined(CONFIG_ZONE_DMA) && defined(CONFIG_ARM_LPAE)
+        .dma_zone_size  = SZ_2G,
+#endif
        .reserve        = omap_reserve,
        .map_io         = dra7xx_map_io,
        .init_early     = dra7xx_init_early,
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index ea56397599c2..1dfe34654c43 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -559,7 +559,14 @@ static void pdata_quirks_check(struct pdata_init *quirks)
 void __init pdata_quirks_init(const struct of_device_id *omap_dt_match_table)
 {
-        omap_sdrc_init(NULL, NULL);
+        /*
+         * We still need this for omap2420 and omap3 PM to work, others are
+         * using drivers/misc/sram.c already.
+         */
+        if (of_machine_is_compatible("ti,omap2420") ||
+            of_machine_is_compatible("ti,omap3"))
+                omap_sdrc_init(NULL, NULL);
        pdata_quirks_check(auxdata_quirks);
        of_platform_populate(NULL, omap_dt_match_table,
                             omap_auxdata_lookup, NULL);
diff --git a/arch/arm/mach-pxa/pxa3xx.c b/arch/arm/mach-pxa/pxa3xx.c
index 06005d3f2ba3..20ce2d386f17 100644
--- a/arch/arm/mach-pxa/pxa3xx.c
+++ b/arch/arm/mach-pxa/pxa3xx.c
@@ -42,10 +42,6 @@
 #define PECR_IS(n)      ((1 << ((n) * 2)) << 29)
 extern void __init pxa_dt_irq_init(int (*fn)(struct irq_data *, unsigned int));
-#ifdef CONFIG_PM
-#define ISRAM_START     0x5c000000
-#define ISRAM_SIZE      SZ_256K
 /*
 * NAND NFC: DFI bus arbitration subset
@@ -54,6 +50,11 @@ extern void __init pxa_dt_irq_init(int (*fn)(struct irq_data *, unsigned int));
 #define NDCR_ND_ARB_EN          (1 << 12)
 #define NDCR_ND_ARB_CNTL        (1 << 19)
+#ifdef CONFIG_PM
+#define ISRAM_START     0x5c000000
+#define ISRAM_SIZE      SZ_256K
 static void __iomem *sram;
 static unsigned long wakeup_src;
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index 876060bcceeb..b8efb8cd1f73 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -614,6 +614,7 @@ load_common:
                case BPF_LD | BPF_B | BPF_IND:
                        load_order = 0;
 load_ind:
+                        update_on_xread(ctx);
                        OP_IMM3(ARM_ADD, r_off, r_X, k, ctx);
                        goto load_common;
                case BPF_LDX | BPF_IMM:
diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c
index 2235081a04ee..8861c367d061 100644
--- a/arch/arm/plat-orion/common.c
+++ b/arch/arm/plat-orion/common.c
@@ -495,7 +495,7 @@ void __init orion_ge00_switch_init(struct dsa_platform_data *d, int irq)
        d->netdev = &orion_ge00.dev;
        for (i = 0; i < d->nr_chips; i++)
-                d->chip[i].host_dev = &orion_ge00_shared.dev;
+                d->chip[i].host_dev = &orion_ge_mvmdio.dev;
        orion_switch_device.dev.platform_data = d;
        platform_device_register(&orion_switch_device);
diff --git a/arch/powerpc/include/asm/cache.h b/arch/powerpc/include/asm/cache.h
index 0dc42c5082b7..5f8229e24fe6 100644
--- a/arch/powerpc/include/asm/cache.h
+++ b/arch/powerpc/include/asm/cache.h
@@ -3,7 +3,6 @@
 #ifdef __KERNEL__
-#include <asm/reg.h>
 /* bytes per L1 cache line */
 #if defined(CONFIG_8xx) || defined(CONFIG_403GCX)
@@ -40,12 +39,6 @@ struct ppc64_caches {
 };
 extern struct ppc64_caches ppc64_caches;
-static inline void logmpp(u64 x)
-{
-        asm volatile(PPC_LOGMPP(R1) : : "r" (x));
-}
 #endif /* __powerpc64__ && ! __ASSEMBLY__ */
 #if defined(__ASSEMBLY__)
diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
index 827a38d7a9db..887c259556df 100644
--- a/arch/powerpc/include/asm/kvm_host.h
+++ b/arch/powerpc/include/asm/kvm_host.h
@@ -297,8 +297,6 @@ struct kvmppc_vcore {
        u32 arch_compat;
        ulong pcr;
        ulong dpdes;            /* doorbell state (POWER8) */
-        void *mpp_buffer; /* Micro Partition Prefetch buffer */
-        bool mpp_buffer_is_valid;
        ulong conferring_threads;
 };
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index 790f5d1d9a46..7ab04fc59e24 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -141,7 +141,6 @@
 #define PPC_INST_ISEL                   0x7c00001e
 #define PPC_INST_ISEL_MASK              0xfc00003e
 #define PPC_INST_LDARX                  0x7c0000a8
-#define PPC_INST_LOGMPP                 0x7c0007e4
 #define PPC_INST_LSWI                   0x7c0004aa
 #define PPC_INST_LSWX                   0x7c00042a
 #define PPC_INST_LWARX                  0x7c000028
@@ -285,20 +284,6 @@
 #define __PPC_EH(eh)    0
 #endif
-/* POWER8 Micro Partition Prefetch (MPP) parameters */
-/* Address mask is common for LOGMPP instruction and MPPR SPR */
-#define PPC_MPPE_ADDRESS_MASK 0xffffffffc000ULL
-/* Bits 60 and 61 of MPP SPR should be set to one of the following */
-/* Aborting the fetch is indeed setting 00 in the table size bits */
-#define PPC_MPPR_FETCH_ABORT (0x0ULL << 60)
-#define PPC_MPPR_FETCH_WHOLE_TABLE (0x2ULL << 60)
-/* Bits 54 and 55 of register for LOGMPP instruction should be set to: */
-#define PPC_LOGMPP_LOG_L2 (0x02ULL << 54)
-#define PPC_LOGMPP_LOG_L2L3 (0x01ULL << 54)
-#define PPC_LOGMPP_LOG_ABORT (0x03ULL << 54)
 /* Deal with instructions that older assemblers aren't aware of */
 #define PPC_DCBAL(a, b)         stringify_in_c(.long PPC_INST_DCBAL | \
                                        __PPC_RA(a) | __PPC_RB(b))
@@ -307,8 +292,6 @@
 #define PPC_LDARX(t, a, b, eh)  stringify_in_c(.long PPC_INST_LDARX | \
                                        ___PPC_RT(t) | ___PPC_RA(a) | \
                                        ___PPC_RB(b) | __PPC_EH(eh))
-#define PPC_LOGMPP(b)           stringify_in_c(.long PPC_INST_LOGMPP | \
-                                        __PPC_RB(b))
 #define PPC_LWARX(t, a, b, eh)  stringify_in_c(.long PPC_INST_LWARX | \
                                        ___PPC_RT(t) | ___PPC_RA(a) | \
                                        ___PPC_RB(b) | __PPC_EH(eh))
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index aa1cc5f015ee..a908ada8e0a5 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -226,7 +226,6 @@
 #define   CTRL_TE       0x00c00000      /* thread enable */
 #define   CTRL_RUNLATCH 0x1
 #define SPRN_DAWR       0xB4
-#define SPRN_MPPR       0xB8    /* Micro Partition Prefetch Register */
 #define SPRN_RPR        0xBA    /* Relative Priority Register */
 #define SPRN_CIABR      0xBB
 #define   CIABR_PRIV            0x3
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 84bf934cf748..5a753fae8265 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -1043,6 +1043,9 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs)
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
+        if (!rtas.entry)
+                return -EINVAL;
        if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
                return -EFAULT;
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 228049786888..9c26c5a96ea2 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -36,7 +36,6 @@
 #include <asm/reg.h>
 #include <asm/cputable.h>
-#include <asm/cache.h>
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
 #include <asm/uaccess.h>
@@ -75,12 +74,6 @@
 static DECLARE_BITMAP(default_enabled_hcalls, MAX_HCALL_OPCODE/4 + 1);
-#if defined(CONFIG_PPC_64K_PAGES)
-#define MPP_BUFFER_ORDER        0
-#elif defined(CONFIG_PPC_4K_PAGES)
-#define MPP_BUFFER_ORDER        3
-#endif
 static int dynamic_mt_modes = 6;
 module_param(dynamic_mt_modes, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(dynamic_mt_modes, "Set of allowed dynamic micro-threading modes: 0 (= none), 2, 4, or 6 (= 2 or 4)");
@@ -1455,13 +1448,6 @@ static struct kvmppc_vcore *kvmppc_vcore_create(struct kvm *kvm, int core)
        vcore->kvm = kvm;
        INIT_LIST_HEAD(&vcore->preempt_list);
-        vcore->mpp_buffer_is_valid = false;
-        if (cpu_has_feature(CPU_FTR_ARCH_207S))
-                vcore->mpp_buffer = (void *)__get_free_pages(
-                        GFP_KERNEL|__GFP_ZERO,
-                        MPP_BUFFER_ORDER);
        return vcore;
 }
@@ -1894,33 +1880,6 @@ static int on_primary_thread(void)
        return 1;
 }
-static void kvmppc_start_saving_l2_cache(struct kvmppc_vcore *vc)
-{
-        phys_addr_t phy_addr, mpp_addr;
-        phy_addr = (phys_addr_t)virt_to_phys(vc->mpp_buffer);
-        mpp_addr = phy_addr & PPC_MPPE_ADDRESS_MASK;
-        mtspr(SPRN_MPPR, mpp_addr | PPC_MPPR_FETCH_ABORT);
-        logmpp(mpp_addr | PPC_LOGMPP_LOG_L2);
-        vc->mpp_buffer_is_valid = true;
-}
-static void kvmppc_start_restoring_l2_cache(const struct kvmppc_vcore *vc)
-{
-        phys_addr_t phy_addr, mpp_addr;
-        phy_addr = virt_to_phys(vc->mpp_buffer);
-        mpp_addr = phy_addr & PPC_MPPE_ADDRESS_MASK;
-        /* We must abort any in-progress save operations to ensure
-         * the table is valid so that prefetch engine knows when to
-         * stop prefetching. */
-        logmpp(mpp_addr | PPC_LOGMPP_LOG_ABORT);
-        mtspr(SPRN_MPPR, mpp_addr | PPC_MPPR_FETCH_WHOLE_TABLE);
-}
 /*
 * A list of virtual cores for each physical CPU.
 * These are vcores that could run but their runner VCPU tasks are
@@ -2471,14 +2430,8 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
        srcu_idx = srcu_read_lock(&vc->kvm->srcu);
-        if (vc->mpp_buffer_is_valid)
-                kvmppc_start_restoring_l2_cache(vc);
        __kvmppc_vcore_entry();
-        if (vc->mpp_buffer)
-                kvmppc_start_saving_l2_cache(vc);
        srcu_read_unlock(&vc->kvm->srcu, srcu_idx);
        spin_lock(&vc->lock);
@@ -3073,14 +3026,8 @@ static void kvmppc_free_vcores(struct kvm *kvm)
 {
        long int i;
-        for (i = 0; i < KVM_MAX_VCORES; ++i) {
+        for (i = 0; i < KVM_MAX_VCORES; ++i)
-                if (kvm->arch.vcores[i] && kvm->arch.vcores[i]->mpp_buffer) {
-                        struct kvmppc_vcore *vc = kvm->arch.vcores[i];
-                        free_pages((unsigned long)vc->mpp_buffer,
-                                   MPP_BUFFER_ORDER);
-                }
                kfree(kvm->arch.vcores[i]);
-        }
        kvm->arch.online_vcores = 0;
 }
diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index 8f70ba681a78..ca264833ee64 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -171,7 +171,26 @@ static void pnv_smp_cpu_kill_self(void)
         * so clear LPCR:PECE1. We keep PECE2 enabled.
         */
        mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1);
+        /*
+         * Hard-disable interrupts, and then clear irq_happened flags
+         * that we can safely ignore while off-line, since they
+         * are for things for which we do no processing when off-line
+         * (or in the case of HMI, all the processing we need to do
+         * is done in lower-level real-mode code).
+         */
+        hard_irq_disable();
+        local_paca->irq_happened &= ~(PACA_IRQ_DEC | PACA_IRQ_HMI);
        while (!generic_check_cpu_restart(cpu)) {
+                /*
+                 * Clear IPI flag, since we don't handle IPIs while
+                 * offline, except for those when changing micro-threading
+                 * mode, which are handled explicitly below, and those
+                 * for coming online, which are handled via
+                 * generic_check_cpu_restart() calls.
+                 */
+                kvmppc_set_host_ipi(cpu, 0);
                ppc64_runlatch_off();
@@ -196,20 +215,20 @@ static void pnv_smp_cpu_kill_self(void)
                 * having finished executing in a KVM guest, then srr1
                 * contains 0.
                 */
-                if ((srr1 & wmask) == SRR1_WAKEEE) {
+                if (((srr1 & wmask) == SRR1_WAKEEE) ||
+                    (local_paca->irq_happened & PACA_IRQ_EE)) {
                        icp_native_flush_interrupt();
-                        local_paca->irq_happened &= PACA_IRQ_HARD_DIS;
-                        smp_mb();
                } else if ((srr1 & wmask) == SRR1_WAKEHDBELL) {
                        unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER);
                        asm volatile(PPC_MSGCLR(%0) : : "r" (msg));
-                        kvmppc_set_host_ipi(cpu, 0);
                }
+                local_paca->irq_happened &= ~(PACA_IRQ_EE | PACA_IRQ_DBELL);
+                smp_mb();
                if (cpu_core_split_required())
                        continue;
-                if (!generic_check_cpu_restart(cpu))
+                if (srr1 && !generic_check_cpu_restart(cpu))
                        DBG("CPU%d Unexpected exit while offline !\n", cpu);
        }
        mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) | LPCR_PECE1);
diff --git a/arch/um/Makefile b/arch/um/Makefile
index 098ab3333e7c..e3abe6f3156d 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -70,8 +70,8 @@ KBUILD_AFLAGS += $(ARCH_INCLUDE)
 USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -I%,,$(KBUILD_CFLAGS))) \
                $(ARCH_INCLUDE) $(MODE_INCLUDE) $(filter -I%,$(CFLAGS)) \
-                -D_FILE_OFFSET_BITS=64 -idirafter include \
+                -D_FILE_OFFSET_BITS=64 -idirafter $(srctree)/include \
-                -D__KERNEL__ -D__UM_HOST__
+                -idirafter $(obj)/include -D__KERNEL__ -D__UM_HOST__
 #This will adjust *FLAGS accordingly to the platform.
 include $(ARCH_DIR)/Makefile-os-$(OS)
diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c
index d8a9fce6ee2e..98783dd0fa2e 100644
--- a/arch/um/kernel/trap.c
+++ b/arch/um/kernel/trap.c
@@ -220,7 +220,7 @@ unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user,
                show_regs(container_of(regs, struct pt_regs, regs));
                panic("Segfault with no mm");
        }
-        else if (!is_user && address < TASK_SIZE) {
+        else if (!is_user && address > PAGE_SIZE && address < TASK_SIZE) {
                show_regs(container_of(regs, struct pt_regs, regs));
                panic("Kernel tried to access user memory at addr 0x%lx, ip 0x%lx",
                       address, ip);
diff --git a/arch/um/os-Linux/helper.c b/arch/um/os-Linux/helper.c
index e3ee4a51ef63..3f02d4232812 100644
--- a/arch/um/os-Linux/helper.c
+++ b/arch/um/os-Linux/helper.c
@@ -96,7 +96,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv)
                               "ret = %d\n", -n);
                        ret = n;
                }
-                CATCH_EINTR(waitpid(pid, NULL, __WCLONE));
+                CATCH_EINTR(waitpid(pid, NULL, __WALL));
        }
 out_free2:
@@ -129,7 +129,7 @@ int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,
                return err;
        }
        if (stack_out == NULL) {
-                CATCH_EINTR(pid = waitpid(pid, &status, __WCLONE));
+                CATCH_EINTR(pid = waitpid(pid, &status, __WALL));
                if (pid < 0) {
                        err = -errno;
                        printk(UM_KERN_ERR "run_helper_thread - wait failed, "
@@ -148,7 +148,7 @@ int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,
 int helper_wait(int pid)
 {
        int ret, status;
-        int wflags = __WCLONE;
+        int wflags = __WALL;
        CATCH_EINTR(ret = waitpid(pid, &status, wflags));
        if (ret < 0) {
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index ee1b6d346b98..db51c1f27446 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -667,6 +667,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto,
                bool conout_found = false;
                void *dummy = NULL;
                u32 h = handles[i];
+                u32 current_fb_base;
                status = efi_call_early(handle_protocol, h,
                                        proto, (void **)&gop32);
@@ -678,7 +679,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto,
                if (status == EFI_SUCCESS)
                        conout_found = true;
-                status = __gop_query32(gop32, &info, &size, &fb_base);
+                status = __gop_query32(gop32, &info, &size, &current_fb_base);
                if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
                        /*
                         * Systems that use the UEFI Console Splitter may
@@ -692,6 +693,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto,
                        pixel_format = info->pixel_format;
                        pixel_info = info->pixel_information;
                        pixels_per_scan_line = info->pixels_per_scan_line;
+                        fb_base = current_fb_base;
                        /*
                         * Once we've found a GOP supporting ConOut,
@@ -770,6 +772,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto,
                bool conout_found = false;
                void *dummy = NULL;
                u64 h = handles[i];
+                u32 current_fb_base;
                status = efi_call_early(handle_protocol, h,
                                        proto, (void **)&gop64);
@@ -781,7 +784,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto,
                if (status == EFI_SUCCESS)
                        conout_found = true;
-                status = __gop_query64(gop64, &info, &size, &fb_base);
+                status = __gop_query64(gop64, &info, &size, &current_fb_base);
                if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
                        /*
                         * Systems that use the UEFI Console Splitter may
@@ -795,6 +798,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto,
                        pixel_format = info->pixel_format;
                        pixel_info = info->pixel_information;
                        pixels_per_scan_line = info->pixels_per_scan_line;
+                        fb_base = current_fb_base;
                        /*
                         * Once we've found a GOP supporting ConOut,
diff --git a/arch/x86/include/asm/string_64.h b/arch/x86/include/asm/string_64.h
index e4661196994e..ff8b9a17dc4b 100644
--- a/arch/x86/include/asm/string_64.h
+++ b/arch/x86/include/asm/string_64.h
@@ -27,12 +27,11 @@ static __always_inline void *__inline_memcpy(void *to, const void *from, size_t
   function. */
 #define __HAVE_ARCH_MEMCPY 1
+extern void *memcpy(void *to, const void *from, size_t len);
 extern void *__memcpy(void *to, const void *from, size_t len);
 #ifndef CONFIG_KMEMCHECK
-#if (__GNUC__ == 4 && __GNUC_MINOR__ >= 3) || __GNUC__ > 4
+#if (__GNUC__ == 4 && __GNUC_MINOR__ < 3) || __GNUC__ < 4
-extern void *memcpy(void *to, const void *from, size_t len);
-#else
 #define memcpy(dst, src, len)                                   \
 ({                                                              \
        size_t __len = (len);                                   \
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 5c60bb162622..bb6bfc01cb82 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2907,6 +2907,7 @@ int mp_irqdomain_alloc(struct irq_domain *domain, unsigned int virq,
        struct irq_data *irq_data;
        struct mp_chip_data *data;
        struct irq_alloc_info *info = arg;
+        unsigned long flags;
        if (!info || nr_irqs > 1)
                return -EINVAL;
@@ -2939,11 +2940,14 @@ int mp_irqdomain_alloc(struct irq_domain *domain, unsigned int virq,
        cfg = irqd_cfg(irq_data);
        add_pin_to_irq_node(data, ioapic_alloc_attr_node(info), ioapic, pin);
+        local_irq_save(flags);
        if (info->ioapic_entry)
                mp_setup_entry(cfg, data, info->ioapic_entry);
        mp_register_handler(virq, data->trigger);
        if (virq < nr_legacy_irqs())
                legacy_pic->mask(virq);
+        local_irq_restore(flags);
        apic_printk(APIC_VERBOSE, KERN_DEBUG
                    "IOAPIC[%d]: Set routing entry (%d-%d -> 0x%x -> IRQ %d Mode:%i Active:%i Dest:%d)\n",
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 39e585a554b7..e28db181e4fc 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -550,14 +550,14 @@ unsigned long get_wchan(struct task_struct *p)
        if (sp < bottom || sp > top)
                return 0;
-        fp = READ_ONCE(*(unsigned long *)sp);
+        fp = READ_ONCE_NOCHECK(*(unsigned long *)sp);
        do {
                if (fp < bottom || fp > top)
                        return 0;
-                ip = READ_ONCE(*(unsigned long *)(fp + sizeof(unsigned long)));
+                ip = READ_ONCE_NOCHECK(*(unsigned long *)(fp + sizeof(unsigned long)));
                if (!in_sched_functions(ip))
                        return ip;
-                fp = READ_ONCE(*(unsigned long *)fp);
+                fp = READ_ONCE_NOCHECK(*(unsigned long *)fp);
        } while (count++ < 16 && p->state != TASK_RUNNING);
        return 0;
 }
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index fdb7f2a2d328..a3cccbfc5f77 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1173,6 +1173,14 @@ void __init setup_arch(char **cmdline_p)
        clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
                        swapper_pg_dir     + KERNEL_PGD_BOUNDARY,
                        KERNEL_PGD_PTRS);
+        /*
+         * sync back low identity map too.  It is used for example
+         * in the 32-bit EFI stub.
+         */
+        clone_pgd_range(initial_page_table,
+                        swapper_pg_dir     + KERNEL_PGD_BOUNDARY,
+                        KERNEL_PGD_PTRS);
 #endif
        tboot_probe();
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index e0c198e5f920..892ee2e5ecbc 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -509,7 +509,7 @@ void __inquire_remote_apic(int apicid)
 */
 #define UDELAY_10MS_DEFAULT 10000
-static unsigned int init_udelay = UDELAY_10MS_DEFAULT;
+static unsigned int init_udelay = INT_MAX;
 static int __init cpu_init_udelay(char *str)
 {
@@ -522,13 +522,16 @@ early_param("cpu_init_udelay", cpu_init_udelay);
 static void __init smp_quirk_init_udelay(void)
 {
        /* if cmdline changed it from default, leave it alone */
-        if (init_udelay != UDELAY_10MS_DEFAULT)
+        if (init_udelay != INT_MAX)
                return;
        /* if modern processor, use no delay */
        if (((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) && (boot_cpu_data.x86 == 6)) ||
            ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && (boot_cpu_data.x86 >= 0xF)))
                init_udelay = 0;
+        /* else, use legacy delay */
+        init_udelay = UDELAY_10MS_DEFAULT;
 }
 /*
@@ -657,7 +660,9 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
                /*
                 * Give the other CPU some time to accept the IPI.
                 */
-                if (init_udelay)
+                if (init_udelay == 0)
+                        udelay(10);
+                else
                        udelay(300);
                pr_debug("Startup point 1\n");
@@ -668,7 +673,9 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
                /*
                 * Give the other CPU some time to accept the IPI.
                 */
-                if (init_udelay)
+                if (init_udelay == 0)
+                        udelay(10);
+                else
                        udelay(200);
                if (maxlvt > 3)         /* Due to the Pentium erratum 3AP.  */
diff --git a/arch/x86/um/ldt.c b/arch/x86/um/ldt.c
index 9701a4fd7bf2..836a1eb5df43 100644
--- a/arch/x86/um/ldt.c
+++ b/arch/x86/um/ldt.c
@@ -12,7 +12,10 @@
 #include <skas.h>
 #include <sysdep/tls.h>
-extern int modify_ldt(int func, void *ptr, unsigned long bytecount);
+static inline int modify_ldt (int func, void *ptr, unsigned long bytecount)
+{
+        return syscall(__NR_modify_ldt, func, ptr, bytecount);
+}
 static long write_ldt_entry(struct mm_id *mm_idp, int func,
                     struct user_desc *desc, void **addr, int done)
diff --git a/block/blk-core.c b/block/blk-core.c
index 2eb722d48773..18e92a6645e2 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -576,7 +576,7 @@ void blk_cleanup_queue(struct request_queue *q)
                q->queue_lock = &q->__queue_lock;
        spin_unlock_irq(lock);
-        bdi_destroy(&q->backing_dev_info);
+        bdi_unregister(&q->backing_dev_info);
        /* @q is and will stay empty, shutdown and put */
        blk_put_queue(q);
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index ed96474d75cb..ec2d11915142 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -641,6 +641,7 @@ void blk_mq_free_tags(struct blk_mq_tags *tags)
 {
        bt_free(&tags->bitmap_tags);
        bt_free(&tags->breserved_tags);
+        free_cpumask_var(tags->cpumask);
        kfree(tags);
 }
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 7785ae96267a..85f014327342 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2296,10 +2296,8 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set)
        int i;
        for (i = 0; i < set->nr_hw_queues; i++) {
-                if (set->tags[i]) {
+                if (set->tags[i])
                        blk_mq_free_rq_map(set, set->tags[i], i);
-                        free_cpumask_var(set->tags[i]->cpumask);
-                }
        }
        kfree(set->tags);
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 3e44a9da2a13..07b42f5ad797 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -540,6 +540,7 @@ static void blk_release_queue(struct kobject *kobj)
        struct request_queue *q =
                container_of(kobj, struct request_queue, kobj);
+        bdi_exit(&q->backing_dev_info);
        blkcg_exit_queue(q);
        if (q->elevator) {
diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c
index 950fff9ce453..a12ff9863d7e 100644
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -187,7 +187,7 @@ int __init dma_contiguous_reserve_area(phys_addr_t size, phys_addr_t base,
 * global one. Requires architecture specific dev_get_cma_area() helper
 * function.
 */
-struct page *dma_alloc_from_contiguous(struct device *dev, int count,
+struct page *dma_alloc_from_contiguous(struct device *dev, size_t count,
                                       unsigned int align)
 {
        if (align > CONFIG_CMA_ALIGNMENT)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 293495a75d3d..1b87623381e2 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -60,6 +60,7 @@ struct nbd_device {
        bool disconnect; /* a disconnect has been requested by user */
        struct timer_list timeout_timer;
+        spinlock_t tasks_lock;
        struct task_struct *task_recv;
        struct task_struct *task_send;
@@ -140,21 +141,23 @@ static void sock_shutdown(struct nbd_device *nbd)
 static void nbd_xmit_timeout(unsigned long arg)
 {
        struct nbd_device *nbd = (struct nbd_device *)arg;
-        struct task_struct *task;
+        unsigned long flags;
        if (list_empty(&nbd->queue_head))
                return;
        nbd->disconnect = true;
-        task = READ_ONCE(nbd->task_recv);
+        spin_lock_irqsave(&nbd->tasks_lock, flags);
-        if (task)
-                force_sig(SIGKILL, task);
+        if (nbd->task_recv)
+                force_sig(SIGKILL, nbd->task_recv);
-        task = READ_ONCE(nbd->task_send);
+        if (nbd->task_send)
-        if (task)
                force_sig(SIGKILL, nbd->task_send);
+        spin_unlock_irqrestore(&nbd->tasks_lock, flags);
        dev_err(nbd_to_dev(nbd), "Connection timed out, killed receiver and sender, shutting down connection\n");
 }
@@ -403,17 +406,24 @@ static int nbd_thread_recv(struct nbd_device *nbd)
 {
        struct request *req;
        int ret;
+        unsigned long flags;
        BUG_ON(nbd->magic != NBD_MAGIC);
        sk_set_memalloc(nbd->sock->sk);
+        spin_lock_irqsave(&nbd->tasks_lock, flags);
        nbd->task_recv = current;
+        spin_unlock_irqrestore(&nbd->tasks_lock, flags);
        ret = device_create_file(disk_to_dev(nbd->disk), &pid_attr);
        if (ret) {
                dev_err(disk_to_dev(nbd->disk), "device_create_file failed!\n");
+                spin_lock_irqsave(&nbd->tasks_lock, flags);
                nbd->task_recv = NULL;
+                spin_unlock_irqrestore(&nbd->tasks_lock, flags);
                return ret;
        }
@@ -429,7 +439,9 @@ static int nbd_thread_recv(struct nbd_device *nbd)
        device_remove_file(disk_to_dev(nbd->disk), &pid_attr);
+        spin_lock_irqsave(&nbd->tasks_lock, flags);
        nbd->task_recv = NULL;
+        spin_unlock_irqrestore(&nbd->tasks_lock, flags);
        if (signal_pending(current)) {
                siginfo_t info;
@@ -534,8 +546,11 @@ static int nbd_thread_send(void *data)
 {
        struct nbd_device *nbd = data;
        struct request *req;
+        unsigned long flags;
+        spin_lock_irqsave(&nbd->tasks_lock, flags);
        nbd->task_send = current;
+        spin_unlock_irqrestore(&nbd->tasks_lock, flags);
        set_user_nice(current, MIN_NICE);
        while (!kthread_should_stop() || !list_empty(&nbd->waiting_queue)) {
@@ -572,7 +587,15 @@ static int nbd_thread_send(void *data)
                nbd_handle_req(nbd, req);
        }
+        spin_lock_irqsave(&nbd->tasks_lock, flags);
        nbd->task_send = NULL;
+        spin_unlock_irqrestore(&nbd->tasks_lock, flags);
+        /* Clear maybe pending signals */
+        if (signal_pending(current)) {
+                siginfo_t info;
+                dequeue_signal_lock(current, &current->blocked, &info);
+        }
        return 0;
 }
@@ -1052,6 +1075,7 @@ static int __init nbd_init(void)
                nbd_dev[i].magic = NBD_MAGIC;
                INIT_LIST_HEAD(&nbd_dev[i].waiting_queue);
                spin_lock_init(&nbd_dev[i].queue_lock);
+                spin_lock_init(&nbd_dev[i].tasks_lock);
                INIT_LIST_HEAD(&nbd_dev[i].queue_head);
                mutex_init(&nbd_dev[i].tx_lock);
                init_timer(&nbd_dev[i].timeout_timer);
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c
index 6f04771f1019..ccc0c1f93daa 100644
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -603,27 +603,31 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx,
        struct nvme_iod *iod = ctx;
        struct request *req = iod_get_private(iod);
        struct nvme_cmd_info *cmd_rq = blk_mq_rq_to_pdu(req);
        u16 status = le16_to_cpup(&cqe->status) >> 1;
+        bool requeue = false;
+        int error = 0;
        if (unlikely(status)) {
                if (!(status & NVME_SC_DNR || blk_noretry_request(req))
                    && (jiffies - req->start_time) < req->timeout) {
                        unsigned long flags;
+                        requeue = true;
                        blk_mq_requeue_request(req);
                        spin_lock_irqsave(req->q->queue_lock, flags);
                        if (!blk_queue_stopped(req->q))
                                blk_mq_kick_requeue_list(req->q);
                        spin_unlock_irqrestore(req->q->queue_lock, flags);
-                        return;
+                        goto release_iod;
                }
                if (req->cmd_type == REQ_TYPE_DRV_PRIV) {
                        if (cmd_rq->ctx == CMD_CTX_CANCELLED)
-                                status = -EINTR;
+                                error = -EINTR;
+                        else
+                                error = status;
                } else {
-                        status = nvme_error_status(status);
+                        error = nvme_error_status(status);
                }
        }
@@ -635,8 +639,9 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx,
        if (cmd_rq->aborted)
                dev_warn(nvmeq->dev->dev,
                        "completing aborted command with status:%04x\n",
-                        status);
+                        error);
+release_iod:
        if (iod->nents) {
                dma_unmap_sg(nvmeq->dev->dev, iod->sg, iod->nents,
                        rq_data_dir(req) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
@@ -649,7 +654,8 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx,
        }
        nvme_free_iod(nvmeq->dev, iod);
-        blk_mq_complete_request(req, status);
+        if (likely(!requeue))
+                blk_mq_complete_request(req, error);
 }
 /* length is in bytes.  gfp flags indicates whether we may sleep. */
@@ -1804,7 +1810,7 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
        length = (io.nblocks + 1) << ns->lba_shift;
        meta_len = (io.nblocks + 1) * ns->ms;
-        metadata = (void __user *)(unsigned long)io.metadata;
+        metadata = (void __user *)(uintptr_t)io.metadata;
        write = io.opcode & 1;
        if (ns->ext) {
@@ -1844,7 +1850,7 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
        c.rw.metadata = cpu_to_le64(meta_dma);
        status = __nvme_submit_sync_cmd(ns->queue, &c, NULL,
-                        (void __user *)io.addr, length, NULL, 0);
+                        (void __user *)(uintptr_t)io.addr, length, NULL, 0);
 unmap:
        if (meta) {
                if (status == NVME_SC_SUCCESS && !write) {
@@ -1886,7 +1892,7 @@ static int nvme_user_cmd(struct nvme_dev *dev, struct nvme_ns *ns,
                timeout = msecs_to_jiffies(cmd.timeout_ms);
        status = __nvme_submit_sync_cmd(ns ? ns->queue : dev->admin_q, &c,
-                        NULL, (void __user *)cmd.addr, cmd.data_len,
+                        NULL, (void __user *)(uintptr_t)cmd.addr, cmd.data_len,
                        &cmd.result, timeout);
        if (status >= 0) {
                if (put_user(cmd.result, &ucmd->result))
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index f5e49b639818..6f26cf38c6f9 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -96,6 +96,8 @@ static int atomic_dec_return_safe(atomic_t *v)
 #define RBD_MINORS_PER_MAJOR            256
 #define RBD_SINGLE_MAJOR_PART_SHIFT     4
+#define RBD_MAX_PARENT_CHAIN_LEN        16
 #define RBD_SNAP_DEV_NAME_PREFIX        "snap_"
 #define RBD_MAX_SNAP_NAME_LEN   \
                        (NAME_MAX - (sizeof (RBD_SNAP_DEV_NAME_PREFIX) - 1))
@@ -426,7 +428,7 @@ static ssize_t rbd_add_single_major(struct bus_type *bus, const char *buf,
                                    size_t count);
 static ssize_t rbd_remove_single_major(struct bus_type *bus, const char *buf,
                                       size_t count);
-static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping);
+static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth);
 static void rbd_spec_put(struct rbd_spec *spec);
 static int rbd_dev_id_to_minor(int dev_id)
@@ -5131,44 +5133,51 @@ out_err:
        return ret;
 }
-static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
+/*
+ * @depth is rbd_dev_image_probe() -> rbd_dev_probe_parent() ->
+ * rbd_dev_image_probe() recursion depth, which means it's also the
+ * length of the already discovered part of the parent chain.
+ */
+static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth)
 {
        struct rbd_device *parent = NULL;
-        struct rbd_spec *parent_spec;
-        struct rbd_client *rbdc;
        int ret;
        if (!rbd_dev->parent_spec)
                return 0;
-        /*
-         * We need to pass a reference to the client and the parent
-         * spec when creating the parent rbd_dev.  Images related by
-         * parent/child relationships always share both.
-         */
-        parent_spec = rbd_spec_get(rbd_dev->parent_spec);
-        rbdc = __rbd_get_client(rbd_dev->rbd_client);
-        ret = -ENOMEM;
+        if (++depth > RBD_MAX_PARENT_CHAIN_LEN) {
-        parent = rbd_dev_create(rbdc, parent_spec, NULL);
+                pr_info("parent chain is too long (%d)\n", depth);
-        if (!parent)
+                ret = -EINVAL;
+                goto out_err;
+        }
+        parent = rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec,
+                                NULL);
+        if (!parent) {
+                ret = -ENOMEM;
                goto out_err;
+        }
+        /*
+         * Images related by parent/child relationships always share
+         * rbd_client and spec/parent_spec, so bump their refcounts.
+         */
+        __rbd_get_client(rbd_dev->rbd_client);
+        rbd_spec_get(rbd_dev->parent_spec);
-        ret = rbd_dev_image_probe(parent, false);
+        ret = rbd_dev_image_probe(parent, depth);
        if (ret < 0)
                goto out_err;
        rbd_dev->parent = parent;
        atomic_set(&rbd_dev->parent_ref, 1);
        return 0;
 out_err:
-        if (parent) {
+        rbd_dev_unparent(rbd_dev);
-                rbd_dev_unparent(rbd_dev);
+        if (parent)
                rbd_dev_destroy(parent);
-        } else {
-                rbd_put_client(rbdc);
-                rbd_spec_put(parent_spec);
-        }
        return ret;
 }
@@ -5286,7 +5295,7 @@ static void rbd_dev_image_release(struct rbd_device *rbd_dev)
 * parent), initiate a watch on its header object before using that
 * object to get detailed information about the rbd image.
 */
-static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
+static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)
 {
        int ret;
@@ -5304,7 +5313,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
        if (ret)
                goto err_out_format;
-        if (mapping) {
+        if (!depth) {
                ret = rbd_dev_header_watch_sync(rbd_dev);
                if (ret) {
                        if (ret == -ENOENT)
@@ -5325,7 +5334,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
         * Otherwise this is a parent image, identified by pool, image
         * and snap ids - need to fill in names for those ids.
         */
-        if (mapping)
+        if (!depth)
                ret = rbd_spec_fill_snap_id(rbd_dev);
        else
                ret = rbd_spec_fill_names(rbd_dev);
@@ -5347,12 +5356,12 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
                 * Need to warn users if this image is the one being
                 * mapped and has a parent.
                 */
-                if (mapping && rbd_dev->parent_spec)
+                if (!depth && rbd_dev->parent_spec)
                        rbd_warn(rbd_dev,
                                 "WARNING: kernel layering is EXPERIMENTAL!");
        }
-        ret = rbd_dev_probe_parent(rbd_dev);
+        ret = rbd_dev_probe_parent(rbd_dev, depth);
        if (ret)
                goto err_out_probe;
@@ -5363,7 +5372,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
 err_out_probe:
        rbd_dev_unprobe(rbd_dev);
 err_out_watch:
-        if (mapping)
+        if (!depth)
                rbd_dev_header_unwatch_sync(rbd_dev);
 out_header_name:
        kfree(rbd_dev->header_name);
@@ -5426,7 +5435,7 @@ static ssize_t do_rbd_add(struct bus_type *bus,
        spec = NULL;            /* rbd_dev now owns this */
        rbd_opts = NULL;        /* rbd_dev now owns this */
-        rc = rbd_dev_image_probe(rbd_dev, true);
+        rc = rbd_dev_image_probe(rbd_dev, 0);
        if (rc < 0)
                goto err_out_rbd_dev;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 611170896b8c..a69c02dadec0 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1956,7 +1956,8 @@ static void blkback_changed(struct xenbus_device *dev,
                        break;
                /* Missed the backend's Closing state -- fallthrough */
        case XenbusStateClosing:
-                blkfront_closing(info);
+                if (info)
+                        blkfront_closing(info);
                break;
        }
 }
diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
index 7d9879e166cf..7082c7268845 100644
--- a/drivers/bus/arm-ccn.c
+++ b/drivers/bus/arm-ccn.c
@@ -1184,11 +1184,12 @@ static int arm_ccn_pmu_cpu_notifier(struct notifier_block *nb,
                if (!cpumask_test_and_clear_cpu(cpu, &dt->cpu))
                        break;
                target = cpumask_any_but(cpu_online_mask, cpu);
-                if (target < 0)
+                if (target >= nr_cpu_ids)
                        break;
                perf_pmu_migrate_context(&dt->pmu, cpu, target);
                cpumask_set_cpu(target, &dt->cpu);
-                WARN_ON(irq_set_affinity(ccn->irq, &dt->cpu) != 0);
+                if (ccn->irq)
+                        WARN_ON(irq_set_affinity(ccn->irq, &dt->cpu) != 0);
        default:
                break;
        }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index efed11509f4a..ed2bbe5b10af 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -294,10 +294,14 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj,
        struct amdgpu_device *adev = dev_get_drvdata(dev);
        umode_t effective_mode = attr->mode;
-        /* Skip limit attributes if DPM is not enabled */
+        /* Skip attributes if DPM is not enabled */
        if (!adev->pm.dpm_enabled &&
            (attr == &sensor_dev_attr_temp1_crit.dev_attr.attr ||
-             attr == &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr))
+             attr == &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr ||
+             attr == &sensor_dev_attr_pwm1.dev_attr.attr ||
+             attr == &sensor_dev_attr_pwm1_enable.dev_attr.attr ||
+             attr == &sensor_dev_attr_pwm1_max.dev_attr.attr ||
+             attr == &sensor_dev_attr_pwm1_min.dev_attr.attr))
                return 0;
        /* Skip fan attributes if fan is not present */
diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index 9745ed3a9aef..7e9154c7f1db 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -2997,6 +2997,9 @@ static int kv_dpm_late_init(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        int ret;
+        if (!amdgpu_dpm)
+                return 0;
        /* init the sysfs and debugfs files late */
        ret = amdgpu_pm_sysfs_init(adev);
        if (ret)
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 5bca390d9ae2..809959d56d78 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1194,17 +1194,18 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
                list_for_each_entry(port, &mstb->ports, next) {
                        if (port->port_num == port_num) {
-                                if (!port->mstb) {
+                                mstb = port->mstb;
+                                if (!mstb) {
                                        DRM_ERROR("failed to lookup MSTB with lct %d, rad %02x\n", lct, rad[0]);
-                                        return NULL;
+                                        goto out;
                                }
-                                mstb = port->mstb;
                                break;
                        }
                }
        }
        kref_get(&mstb->kref);
+out:
        mutex_unlock(&mgr->lock);
        return mstb;
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index f6ecbda2c604..674341708033 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -143,7 +143,7 @@ i915_gem_shrink(struct drm_i915_private *dev_priv,
 }
 /**
- * i915_gem_shrink - Shrink buffer object caches completely
+ * i915_gem_shrink_all - Shrink buffer object caches completely
 * @dev_priv: i915 device
 *
 * This is a simple wraper around i915_gem_shrink() to aggressively shrink all
diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
index 8fd431bcdfd3..a96b9006a51e 100644
--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
@@ -804,7 +804,10 @@ static const struct drm_i915_gem_object_ops i915_gem_userptr_ops = {
 * Also note, that the object created here is not currently a "first class"
 * object, in that several ioctls are banned. These are the CPU access
 * ioctls: mmap(), pwrite and pread. In practice, you are expected to use
- * direct access via your pointer rather than use those ioctls.
+ * direct access via your pointer rather than use those ioctls. Another
+ * restriction is that we do not allow userptr surfaces to be pinned to the
+ * hardware and so we reject any attempt to create a framebuffer out of a
+ * userptr.
 *
 * If you think this is a good interface to use to pass GPU memory between
 * drivers, please use dma-buf instead. In fact, wherever possible use
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index cf418be7d30a..b2270d576979 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1724,6 +1724,15 @@ static void i9xx_enable_pll(struct intel_crtc *crtc)
                           I915_READ(DPLL(!crtc->pipe)) | DPLL_DVO_2X_MODE);
        }
+        /*
+         * Apparently we need to have VGA mode enabled prior to changing
+         * the P1/P2 dividers. Otherwise the DPLL will keep using the old
+         * dividers, even though the register value does change.
+         */
+        I915_WRITE(reg, 0);
+        I915_WRITE(reg, dpll);
        /* Wait for the clocks to stabilize. */
        POSTING_READ(reg);
        udelay(150);
@@ -14107,6 +14116,11 @@ static int intel_user_framebuffer_create_handle(struct drm_framebuffer *fb,
        struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
        struct drm_i915_gem_object *obj = intel_fb->obj;
+        if (obj->userptr.mm) {
+                DRM_DEBUG("attempting to use a userptr for a framebuffer, denied\n");
+                return -EINVAL;
+        }
        return drm_gem_handle_create(file, &obj->base, handle);
 }
@@ -14897,9 +14911,19 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
        /* restore vblank interrupts to correct state */
        drm_crtc_vblank_reset(&crtc->base);
        if (crtc->active) {
+                struct intel_plane *plane;
                drm_calc_timestamping_constants(&crtc->base, &crtc->base.hwmode);
                update_scanline_offset(crtc);
                drm_crtc_vblank_on(&crtc->base);
+                /* Disable everything but the primary plane */
+                for_each_intel_plane_on_crtc(dev, crtc, plane) {
+                        if (plane->base.type == DRM_PLANE_TYPE_PRIMARY)
+                                continue;
+                        plane->disable_plane(&plane->base, &crtc->base);
+                }
        }
        /* We need to sanitize the plane -> pipe mapping first because this will
@@ -15067,38 +15091,25 @@ void i915_redisable_vga(struct drm_device *dev)
        i915_redisable_vga_power_on(dev);
 }
-static bool primary_get_hw_state(struct intel_crtc *crtc)
+static bool primary_get_hw_state(struct intel_plane *plane)
 {
-        struct drm_i915_private *dev_priv = crtc->base.dev->dev_private;
+        struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
-        return !!(I915_READ(DSPCNTR(crtc->plane)) & DISPLAY_PLANE_ENABLE);
+        return I915_READ(DSPCNTR(plane->plane)) & DISPLAY_PLANE_ENABLE;
 }
-static void readout_plane_state(struct intel_crtc *crtc,
+/* FIXME read out full plane state for all planes */
-                                struct intel_crtc_state *crtc_state)
+static void readout_plane_state(struct intel_crtc *crtc)
 {
-        struct intel_plane *p;
+        struct drm_plane *primary = crtc->base.primary;
-        struct intel_plane_state *plane_state;
+        struct intel_plane_state *plane_state =
-        bool active = crtc_state->base.active;
+                to_intel_plane_state(primary->state);
-        for_each_intel_plane(crtc->base.dev, p) {
-                if (crtc->pipe != p->pipe)
-                        continue;
-                plane_state = to_intel_plane_state(p->base.state);
-                if (p->base.type == DRM_PLANE_TYPE_PRIMARY) {
+        plane_state->visible =
-                        plane_state->visible = primary_get_hw_state(crtc);
+                primary_get_hw_state(to_intel_plane(primary));
-                        if (plane_state->visible)
-                                crtc->base.state->plane_mask |=
-                                        1 << drm_plane_index(&p->base);
-                } else {
-                        if (active)
-                                p->disable_plane(&p->base, &crtc->base);
-                        plane_state->visible = false;
+        if (plane_state->visible)
-                }
+                crtc->base.state->plane_mask |= 1 << drm_plane_index(primary);
-        }
 }
 static void intel_modeset_readout_hw_state(struct drm_device *dev)
@@ -15121,34 +15132,7 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev)
                crtc->base.state->active = crtc->active;
                crtc->base.enabled = crtc->active;
-                memset(&crtc->base.mode, 0, sizeof(crtc->base.mode));
+                readout_plane_state(crtc);
-                if (crtc->base.state->active) {
-                        intel_mode_from_pipe_config(&crtc->base.mode, crtc->config);
-                        intel_mode_from_pipe_config(&crtc->base.state->adjusted_mode, crtc->config);
-                        WARN_ON(drm_atomic_set_mode_for_crtc(crtc->base.state, &crtc->base.mode));
-                        /*
-                         * The initial mode needs to be set in order to keep
-                         * the atomic core happy. It wants a valid mode if the
-                         * crtc's enabled, so we do the above call.
-                         *
-                         * At this point some state updated by the connectors
-                         * in their ->detect() callback has not run yet, so
-                         * no recalculation can be done yet.
-                         *
-                         * Even if we could do a recalculation and modeset
-                         * right now it would cause a double modeset if
-                         * fbdev or userspace chooses a different initial mode.
-                         *
-                         * If that happens, someone indicated they wanted a
-                         * mode change, which means it's safe to do a full
-                         * recalculation.
-                         */
-                        crtc->base.state->mode.private_flags = I915_MODE_FLAG_INHERITED;
-                }
-                crtc->base.hwmode = crtc->config->base.adjusted_mode;
-                readout_plane_state(crtc, to_intel_crtc_state(crtc->base.state));
                DRM_DEBUG_KMS("[CRTC:%d] hw state readout: %s\n",
                              crtc->base.base.id,
@@ -15207,6 +15191,36 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev)
                              connector->base.name,
                              connector->base.encoder ? "enabled" : "disabled");
        }
+        for_each_intel_crtc(dev, crtc) {
+                crtc->base.hwmode = crtc->config->base.adjusted_mode;
+                memset(&crtc->base.mode, 0, sizeof(crtc->base.mode));
+                if (crtc->base.state->active) {
+                        intel_mode_from_pipe_config(&crtc->base.mode, crtc->config);
+                        intel_mode_from_pipe_config(&crtc->base.state->adjusted_mode, crtc->config);
+                        WARN_ON(drm_atomic_set_mode_for_crtc(crtc->base.state, &crtc->base.mode));
+                        /*
+                         * The initial mode needs to be set in order to keep
+                         * the atomic core happy. It wants a valid mode if the
+                         * crtc's enabled, so we do the above call.
+                         *
+                         * At this point some state updated by the connectors
+                         * in their ->detect() callback has not run yet, so
+                         * no recalculation can be done yet.
+                         *
+                         * Even if we could do a recalculation and modeset
+                         * right now it would cause a double modeset if
+                         * fbdev or userspace chooses a different initial mode.
+                         *
+                         * If that happens, someone indicated they wanted a
+                         * mode change, which means it's safe to do a full
+                         * recalculation.
+                         */
+                        crtc->base.state->mode.private_flags = I915_MODE_FLAG_INHERITED;
+                }
+        }
 }
 /* Scan out the current hw modeset state,
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 7412caedcf7f..29dd4488dc49 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -1659,6 +1659,7 @@ static int gen8_emit_flush_render(struct drm_i915_gem_request *request,
        if (flush_domains) {
                flags |= PIPE_CONTROL_RENDER_TARGET_CACHE_FLUSH;
                flags |= PIPE_CONTROL_DEPTH_CACHE_FLUSH;
+                flags |= PIPE_CONTROL_FLUSH_ENABLE;
        }
        if (invalidate_domains) {
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 6e6b8db996ef..61b451fbd09e 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -347,6 +347,7 @@ gen7_render_ring_flush(struct drm_i915_gem_request *req,
        if (flush_domains) {
                flags |= PIPE_CONTROL_RENDER_TARGET_CACHE_FLUSH;
                flags |= PIPE_CONTROL_DEPTH_CACHE_FLUSH;
+                flags |= PIPE_CONTROL_FLUSH_ENABLE;
        }
        if (invalidate_domains) {
                flags |= PIPE_CONTROL_TLB_INVALIDATE;
@@ -418,6 +419,7 @@ gen8_render_ring_flush(struct drm_i915_gem_request *req,
        if (flush_domains) {
                flags |= PIPE_CONTROL_RENDER_TARGET_CACHE_FLUSH;
                flags |= PIPE_CONTROL_DEPTH_CACHE_FLUSH;
+                flags |= PIPE_CONTROL_FLUSH_ENABLE;
        }
        if (invalidate_domains) {
                flags |= PIPE_CONTROL_TLB_INVALIDATE;
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 2c9981512d27..41be584147b9 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -227,11 +227,12 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem,
        struct nouveau_bo *nvbo = nouveau_gem_object(gem);
        struct nvkm_vma *vma;
-        if (nvbo->bo.mem.mem_type == TTM_PL_TT)
+        if (is_power_of_2(nvbo->valid_domains))
+                rep->domain = nvbo->valid_domains;
+        else if (nvbo->bo.mem.mem_type == TTM_PL_TT)
                rep->domain = NOUVEAU_GEM_DOMAIN_GART;
        else
                rep->domain = NOUVEAU_GEM_DOMAIN_VRAM;
        rep->offset = nvbo->bo.offset;
        if (cli->vm) {
                vma = nouveau_bo_vma_find(nvbo, cli->vm);
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 44489cce7458..6a0a176e26ec 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -717,10 +717,14 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj,
        struct radeon_device *rdev = dev_get_drvdata(dev);
        umode_t effective_mode = attr->mode;
-        /* Skip limit attributes if DPM is not enabled */
+        /* Skip attributes if DPM is not enabled */
        if (rdev->pm.pm_method != PM_METHOD_DPM &&
            (attr == &sensor_dev_attr_temp1_crit.dev_attr.attr ||
-             attr == &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr))
+             attr == &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr ||
+             attr == &sensor_dev_attr_pwm1.dev_attr.attr ||
+             attr == &sensor_dev_attr_pwm1_enable.dev_attr.attr ||
+             attr == &sensor_dev_attr_pwm1_max.dev_attr.attr ||
+             attr == &sensor_dev_attr_pwm1_min.dev_attr.attr))
                return 0;
        /* Skip fan attributes if fan is not present */
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index ff30f8806880..fb9311110424 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -149,8 +149,6 @@
 #define ST_ACCEL_4_BDU_MASK                     0x40
 #define ST_ACCEL_4_DRDY_IRQ_ADDR                0x21
 #define ST_ACCEL_4_DRDY_IRQ_INT1_MASK           0x04
-#define ST_ACCEL_4_IG1_EN_ADDR                  0x21
-#define ST_ACCEL_4_IG1_EN_MASK                  0x08
 #define ST_ACCEL_4_MULTIREAD_BIT                true
 /* CUSTOM VALUES FOR SENSOR 5 */
@@ -489,10 +487,6 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                .drdy_irq = {
                        .addr = ST_ACCEL_4_DRDY_IRQ_ADDR,
                        .mask_int1 = ST_ACCEL_4_DRDY_IRQ_INT1_MASK,
-                        .ig1 = {
-                                .en_addr = ST_ACCEL_4_IG1_EN_ADDR,
-                                .en_mask = ST_ACCEL_4_IG1_EN_MASK,
-                        },
                },
                .multi_read_bit = ST_ACCEL_4_MULTIREAD_BIT,
                .bootime = 2, /* guess */
diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
index ebe415f10640..0c74869a540a 100644
--- a/drivers/iio/adc/twl4030-madc.c
+++ b/drivers/iio/adc/twl4030-madc.c
@@ -45,13 +45,18 @@
 #include <linux/types.h>
 #include <linux/gfp.h>
 #include <linux/err.h>
+#include <linux/regulator/consumer.h>
 #include <linux/iio/iio.h>
+#define TWL4030_USB_SEL_MADC_MCPC       (1<<3)
+#define TWL4030_USB_CARKIT_ANA_CTRL     0xBB
 /**
 * struct twl4030_madc_data - a container for madc info
 * @dev:                Pointer to device structure for madc
 * @lock:               Mutex protecting this data structure
+ * @regulator:          Pointer to bias regulator for madc
 * @requests:           Array of request struct corresponding to SW1, SW2 and RT
 * @use_second_irq:     IRQ selection (main or co-processor)
 * @imr:                Interrupt mask register of MADC
@@ -60,6 +65,7 @@
 struct twl4030_madc_data {
        struct device *dev;
        struct mutex lock;      /* mutex protecting this data structure */
+        struct regulator *usb3v1;
        struct twl4030_madc_request requests[TWL4030_MADC_NUM_METHODS];
        bool use_second_irq;
        u8 imr;
@@ -841,6 +847,32 @@ static int twl4030_madc_probe(struct platform_device *pdev)
        }
        twl4030_madc = madc;
+        /* Configure MADC[3:6] */
+        ret = twl_i2c_read_u8(TWL_MODULE_USB, &regval,
+                        TWL4030_USB_CARKIT_ANA_CTRL);
+        if (ret) {
+                dev_err(&pdev->dev, "unable to read reg CARKIT_ANA_CTRL  0x%X\n",
+                                TWL4030_USB_CARKIT_ANA_CTRL);
+                goto err_i2c;
+        }
+        regval |= TWL4030_USB_SEL_MADC_MCPC;
+        ret = twl_i2c_write_u8(TWL_MODULE_USB, regval,
+                                 TWL4030_USB_CARKIT_ANA_CTRL);
+        if (ret) {
+                dev_err(&pdev->dev, "unable to write reg CARKIT_ANA_CTRL 0x%X\n",
+                                TWL4030_USB_CARKIT_ANA_CTRL);
+                goto err_i2c;
+        }
+        /* Enable 3v1 bias regulator for MADC[3:6] */
+        madc->usb3v1 = devm_regulator_get(madc->dev, "vusb3v1");
+        if (IS_ERR(madc->usb3v1))
+                return -ENODEV;
+        ret = regulator_enable(madc->usb3v1);
+        if (ret)
+                dev_err(madc->dev, "could not enable 3v1 bias regulator\n");
        ret = iio_device_register(iio_dev);
        if (ret) {
                dev_err(&pdev->dev, "could not register iio device\n");
@@ -866,6 +898,8 @@ static int twl4030_madc_remove(struct platform_device *pdev)
        twl4030_madc_set_current_generator(madc, 0, 0);
        twl4030_madc_set_power(madc, 0);
+        regulator_disable(madc->usb3v1);
        return 0;
 }
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 8f66c67ff0df..87471ef37198 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -508,12 +508,12 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
        memset(&gid_attr, 0, sizeof(gid_attr));
        gid_attr.ndev = ndev;
+        mutex_lock(&table->lock);
        ix = find_gid(table, NULL, NULL, true, GID_ATTR_FIND_MASK_DEFAULT);
        /* Coudn't find default GID location */
        WARN_ON(ix < 0);
-        mutex_lock(&table->lock);
        if (!__ib_cache_gid_get(ib_dev, port, ix,
                                &current_gid, &current_gid_attr) &&
            mode == IB_CACHE_GID_DEFAULT_MODE_SET &&
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index ea4db9c1d44f..4f918b929eca 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -835,6 +835,11 @@ retest:
        case IB_CM_SIDR_REQ_RCVD:
                spin_unlock_irq(&cm_id_priv->lock);
                cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
+                spin_lock_irq(&cm.lock);
+                if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node))
+                        rb_erase(&cm_id_priv->sidr_id_node,
+                                 &cm.remote_sidr_table);
+                spin_unlock_irq(&cm.lock);
                break;
        case IB_CM_REQ_SENT:
        case IB_CM_MRA_REQ_RCVD:
@@ -3172,7 +3177,10 @@ int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
        spin_lock_irqsave(&cm.lock, flags);
-        rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+        if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) {
+                rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+                RB_CLEAR_NODE(&cm_id_priv->sidr_id_node);
+        }
        spin_unlock_irqrestore(&cm.lock, flags);
        return 0;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 59a2dafc8c57..36b12d560e17 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1067,14 +1067,14 @@ static int cma_save_req_info(const struct ib_cm_event *ib_event,
                       sizeof(req->local_gid));
                req->has_gid    = true;
                req->service_id = req_param->primary_path->service_id;
-                req->pkey       = req_param->bth_pkey;
+                req->pkey       = be16_to_cpu(req_param->primary_path->pkey);
                break;
        case IB_CM_SIDR_REQ_RECEIVED:
                req->device     = sidr_param->listen_id->device;
                req->port       = sidr_param->port;
                req->has_gid    = false;
                req->service_id = sidr_param->service_id;
-                req->pkey       = sidr_param->bth_pkey;
+                req->pkey       = sidr_param->pkey;
                break;
        default:
                return -EINVAL;
@@ -1324,7 +1324,7 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id,
        bind_list = cma_ps_find(rdma_ps_from_service_id(req.service_id),
                                cma_port_from_service_id(req.service_id));
        id_priv = cma_find_listener(bind_list, cm_id, ib_event, &req, *net_dev);
-        if (IS_ERR(id_priv)) {
+        if (IS_ERR(id_priv) && *net_dev) {
                dev_put(*net_dev);
                *net_dev = NULL;
        }
diff --git a/drivers/infiniband/core/roce_gid_mgmt.c b/drivers/infiniband/core/roce_gid_mgmt.c
index 6b24cba1e474..178f98482e13 100644
--- a/drivers/infiniband/core/roce_gid_mgmt.c
+++ b/drivers/infiniband/core/roce_gid_mgmt.c
@@ -250,25 +250,44 @@ static void enum_netdev_ipv4_ips(struct ib_device *ib_dev,
                                 u8 port, struct net_device *ndev)
 {
        struct in_device *in_dev;
+        struct sin_list {
+                struct list_head        list;
+                struct sockaddr_in      ip;
+        };
+        struct sin_list *sin_iter;
+        struct sin_list *sin_temp;
+        LIST_HEAD(sin_list);
        if (ndev->reg_state >= NETREG_UNREGISTERING)
                return;
-        in_dev = in_dev_get(ndev);
+        rcu_read_lock();
-        if (!in_dev)
+        in_dev = __in_dev_get_rcu(ndev);
+        if (!in_dev) {
+                rcu_read_unlock();
                return;
+        }
        for_ifa(in_dev) {
-                struct sockaddr_in ip;
+                struct sin_list *entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
-                ip.sin_family = AF_INET;
+                if (!entry) {
-                ip.sin_addr.s_addr = ifa->ifa_address;
+                        pr_warn("roce_gid_mgmt: couldn't allocate entry for IPv4 update\n");
-                update_gid_ip(GID_ADD, ib_dev, port, ndev,
+                        continue;
-                              (struct sockaddr *)&ip);
+                }
+                entry->ip.sin_family = AF_INET;
+                entry->ip.sin_addr.s_addr = ifa->ifa_address;
+                list_add_tail(&entry->list, &sin_list);
        }
        endfor_ifa(in_dev);
+        rcu_read_unlock();
-        in_dev_put(in_dev);
+        list_for_each_entry_safe(sin_iter, sin_temp, &sin_list, list) {
+                update_gid_ip(GID_ADD, ib_dev, port, ndev,
+                              (struct sockaddr *)&sin_iter->ip);
+                list_del(&sin_iter->list);
+                kfree(sin_iter);
+        }
 }
 static void enum_netdev_ipv6_ips(struct ib_device *ib_dev,
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index a53fc9b01c69..30467d10df91 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1624,11 +1624,16 @@ static int ucma_open(struct inode *inode, struct file *filp)
        if (!file)
                return -ENOMEM;
+        file->close_wq = create_singlethread_workqueue("ucma_close_id");
+        if (!file->close_wq) {
+                kfree(file);
+                return -ENOMEM;
+        }
        INIT_LIST_HEAD(&file->event_list);
        INIT_LIST_HEAD(&file->ctx_list);
        init_waitqueue_head(&file->poll_wait);
        mutex_init(&file->mut);
-        file->close_wq = create_singlethread_workqueue("ucma_close_id");
        filp->private_data = file;
        file->filp = filp;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 35365f046923..d65cf42399e8 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2115,15 +2115,19 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
                                return -ENOMEM;
                        /* It is large page*/
                        if (largepage_lvl > 1) {
+                                unsigned long nr_superpages, end_pfn;
                                pteval |= DMA_PTE_LARGE_PAGE;
                                lvl_pages = lvl_to_nr_pages(largepage_lvl);
+                                nr_superpages = sg_res / lvl_pages;
+                                end_pfn = iov_pfn + nr_superpages * lvl_pages - 1;
                                /*
                                 * Ensure that old small page tables are
-                                 * removed to make room for superpage,
+                                 * removed to make room for superpage(s).
-                                 * if they exist.
                                 */
-                                dma_pte_free_pagetable(domain, iov_pfn,
+                                dma_pte_free_pagetable(domain, iov_pfn, end_pfn);
-                                                       iov_pfn + lvl_pages - 1);
                        } else {
                                pteval &= ~(uint64_t)DMA_PTE_LARGE_PAGE;
                        }
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index 20cc36b01b77..0a17d1b91a81 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -634,10 +634,10 @@ static int __commit_transaction(struct dm_cache_metadata *cmd,
        disk_super = dm_block_data(sblock);
+        disk_super->flags = cpu_to_le32(cmd->flags);
        if (mutator)
                update_flags(disk_super, mutator);
-        disk_super->flags = cpu_to_le32(cmd->flags);
        disk_super->mapping_root = cpu_to_le64(cmd->root);
        disk_super->hint_root = cpu_to_le64(cmd->hint_root);
        disk_super->discard_root = cpu_to_le64(cmd->discard_root);
diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
index 421a36c593e3..2e4c4cb79e4d 100644
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -301,11 +301,16 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
 {
        int s;
        uint32_t max_entries = le32_to_cpu(left->header.max_entries);
-        unsigned target = (nr_left + nr_center + nr_right) / 3;
+        unsigned total = nr_left + nr_center + nr_right;
-        BUG_ON(target > max_entries);
+        unsigned target_right = total / 3;
+        unsigned remainder = (target_right * 3) != total;
+        unsigned target_left = target_right + remainder;
+        BUG_ON(target_left > max_entries);
+        BUG_ON(target_right > max_entries);
        if (nr_left < nr_right) {
-                s = nr_left - target;
+                s = nr_left - target_left;
                if (s < 0 && nr_center < -s) {
                        /* not enough in central node */
@@ -316,10 +321,10 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
                } else
                        shift(left, center, s);
-                shift(center, right, target - nr_right);
+                shift(center, right, target_right - nr_right);
        } else {
-                s = target - nr_right;
+                s = target_right - nr_right;
                if (s > 0 && nr_center < s) {
                        /* not enough in central node */
                        shift(center, right, nr_center);
@@ -329,7 +334,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
                } else
                        shift(center, right, s);
-                shift(left, center, nr_left - target);
+                shift(left, center, nr_left - target_left);
        }
        *key_ptr(parent, c->index) = center->keys[0];
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index b6cec258cc21..0e09aef43998 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -523,7 +523,7 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key)
        r = new_block(s->info, &right);
        if (r < 0) {
-                /* FIXME: put left */
+                unlock_block(s->info, left);
                return r;
        }
diff --git a/drivers/media/dvb-frontends/horus3a.h b/drivers/media/dvb-frontends/horus3a.h
index b055319d532e..c1e2d1834b78 100644
--- a/drivers/media/dvb-frontends/horus3a.h
+++ b/drivers/media/dvb-frontends/horus3a.h
@@ -46,8 +46,8 @@ extern struct dvb_frontend *horus3a_attach(struct dvb_frontend *fe,
                                        const struct horus3a_config *config,
                                        struct i2c_adapter *i2c);
 #else
-static inline struct dvb_frontend *horus3a_attach(
+static inline struct dvb_frontend *horus3a_attach(struct dvb_frontend *fe,
-                                        const struct cxd2820r_config *config,
+                                        const struct horus3a_config *config,
                                        struct i2c_adapter *i2c)
 {
        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
diff --git a/drivers/media/dvb-frontends/lnbh25.h b/drivers/media/dvb-frontends/lnbh25.h
index 69f30e21f6b3..1f329ef05acc 100644
--- a/drivers/media/dvb-frontends/lnbh25.h
+++ b/drivers/media/dvb-frontends/lnbh25.h
@@ -43,7 +43,7 @@ struct dvb_frontend *lnbh25_attach(
        struct lnbh25_config *cfg,
        struct i2c_adapter *i2c);
 #else
-static inline dvb_frontend *lnbh25_attach(
+static inline struct dvb_frontend *lnbh25_attach(
        struct dvb_frontend *fe,
        struct lnbh25_config *cfg,
        struct i2c_adapter *i2c)
diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c
index ff31e7a01ca9..feeeb70d841e 100644
--- a/drivers/media/dvb-frontends/m88ds3103.c
+++ b/drivers/media/dvb-frontends/m88ds3103.c
@@ -18,6 +18,27 @@
 static struct dvb_frontend_ops m88ds3103_ops;
+/* write single register with mask */
+static int m88ds3103_update_bits(struct m88ds3103_dev *dev,
+                                u8 reg, u8 mask, u8 val)
+{
+        int ret;
+        u8 tmp;
+        /* no need for read if whole reg is written */
+        if (mask != 0xff) {
+                ret = regmap_bulk_read(dev->regmap, reg, &tmp, 1);
+                if (ret)
+                        return ret;
+                val &= mask;
+                tmp &= ~mask;
+                val |= tmp;
+        }
+        return regmap_bulk_write(dev->regmap, reg, &val, 1);
+}
 /* write reg val table using reg addr auto increment */
 static int m88ds3103_wr_reg_val_tab(struct m88ds3103_dev *dev,
                const struct m88ds3103_reg_val *tab, int tab_len)
@@ -394,10 +415,10 @@ static int m88ds3103_set_frontend(struct dvb_frontend *fe)
                        u8tmp2 = 0x00; /* 0b00 */
                        break;
                }
-                ret = regmap_update_bits(dev->regmap, 0x22, 0xc0, u8tmp1 << 6);
+                ret = m88ds3103_update_bits(dev, 0x22, 0xc0, u8tmp1 << 6);
                if (ret)
                        goto err;
-                ret = regmap_update_bits(dev->regmap, 0x24, 0xc0, u8tmp2 << 6);
+                ret = m88ds3103_update_bits(dev, 0x24, 0xc0, u8tmp2 << 6);
                if (ret)
                        goto err;
        }
@@ -455,13 +476,13 @@ static int m88ds3103_set_frontend(struct dvb_frontend *fe)
                        if (ret)
                                goto err;
                }
-                ret = regmap_update_bits(dev->regmap, 0x9d, 0x08, 0x08);
+                ret = m88ds3103_update_bits(dev, 0x9d, 0x08, 0x08);
                if (ret)
                        goto err;
                ret = regmap_write(dev->regmap, 0xf1, 0x01);
                if (ret)
                        goto err;
-                ret = regmap_update_bits(dev->regmap, 0x30, 0x80, 0x80);
+                ret = m88ds3103_update_bits(dev, 0x30, 0x80, 0x80);
                if (ret)
                        goto err;
        }
@@ -498,7 +519,7 @@ static int m88ds3103_set_frontend(struct dvb_frontend *fe)
        switch (dev->cfg->ts_mode) {
        case M88DS3103_TS_SERIAL:
        case M88DS3103_TS_SERIAL_D7:
-                ret = regmap_update_bits(dev->regmap, 0x29, 0x20, u8tmp1);
+                ret = m88ds3103_update_bits(dev, 0x29, 0x20, u8tmp1);
                if (ret)
                        goto err;
                u8tmp1 = 0;
@@ -567,11 +588,11 @@ static int m88ds3103_set_frontend(struct dvb_frontend *fe)
        if (ret)
                goto err;
-        ret = regmap_update_bits(dev->regmap, 0x4d, 0x02, dev->cfg->spec_inv << 1);
+        ret = m88ds3103_update_bits(dev, 0x4d, 0x02, dev->cfg->spec_inv << 1);
        if (ret)
                goto err;
-        ret = regmap_update_bits(dev->regmap, 0x30, 0x10, dev->cfg->agc_inv << 4);
+        ret = m88ds3103_update_bits(dev, 0x30, 0x10, dev->cfg->agc_inv << 4);
        if (ret)
                goto err;
@@ -625,13 +646,13 @@ static int m88ds3103_init(struct dvb_frontend *fe)
        dev->warm = false;
        /* wake up device from sleep */
-        ret = regmap_update_bits(dev->regmap, 0x08, 0x01, 0x01);
+        ret = m88ds3103_update_bits(dev, 0x08, 0x01, 0x01);
        if (ret)
                goto err;
-        ret = regmap_update_bits(dev->regmap, 0x04, 0x01, 0x00);
+        ret = m88ds3103_update_bits(dev, 0x04, 0x01, 0x00);
        if (ret)
                goto err;
-        ret = regmap_update_bits(dev->regmap, 0x23, 0x10, 0x00);
+        ret = m88ds3103_update_bits(dev, 0x23, 0x10, 0x00);
        if (ret)
                goto err;
@@ -749,18 +770,18 @@ static int m88ds3103_sleep(struct dvb_frontend *fe)
                utmp = 0x29;
        else
                utmp = 0x27;
-        ret = regmap_update_bits(dev->regmap, utmp, 0x01, 0x00);
+        ret = m88ds3103_update_bits(dev, utmp, 0x01, 0x00);
        if (ret)
                goto err;
        /* sleep */
-        ret = regmap_update_bits(dev->regmap, 0x08, 0x01, 0x00);
+        ret = m88ds3103_update_bits(dev, 0x08, 0x01, 0x00);
        if (ret)
                goto err;
-        ret = regmap_update_bits(dev->regmap, 0x04, 0x01, 0x01);
+        ret = m88ds3103_update_bits(dev, 0x04, 0x01, 0x01);
        if (ret)
                goto err;
-        ret = regmap_update_bits(dev->regmap, 0x23, 0x10, 0x10);
+        ret = m88ds3103_update_bits(dev, 0x23, 0x10, 0x10);
        if (ret)
                goto err;
@@ -992,12 +1013,12 @@ static int m88ds3103_set_tone(struct dvb_frontend *fe,
        }
        utmp = tone << 7 | dev->cfg->envelope_mode << 5;
-        ret = regmap_update_bits(dev->regmap, 0xa2, 0xe0, utmp);
+        ret = m88ds3103_update_bits(dev, 0xa2, 0xe0, utmp);
        if (ret)
                goto err;
        utmp = 1 << 2;
-        ret = regmap_update_bits(dev->regmap, 0xa1, reg_a1_mask, utmp);
+        ret = m88ds3103_update_bits(dev, 0xa1, reg_a1_mask, utmp);
        if (ret)
                goto err;
@@ -1047,7 +1068,7 @@ static int m88ds3103_set_voltage(struct dvb_frontend *fe,
        voltage_dis ^= dev->cfg->lnb_en_pol;
        utmp = voltage_dis << 1 | voltage_sel << 0;
-        ret = regmap_update_bits(dev->regmap, 0xa2, 0x03, utmp);
+        ret = m88ds3103_update_bits(dev, 0xa2, 0x03, utmp);
        if (ret)
                goto err;
@@ -1080,7 +1101,7 @@ static int m88ds3103_diseqc_send_master_cmd(struct dvb_frontend *fe,
        }
        utmp = dev->cfg->envelope_mode << 5;
-        ret = regmap_update_bits(dev->regmap, 0xa2, 0xe0, utmp);
+        ret = m88ds3103_update_bits(dev, 0xa2, 0xe0, utmp);
        if (ret)
                goto err;
@@ -1115,12 +1136,12 @@ static int m88ds3103_diseqc_send_master_cmd(struct dvb_frontend *fe,
        } else {
                dev_dbg(&client->dev, "diseqc tx timeout\n");
-                ret = regmap_update_bits(dev->regmap, 0xa1, 0xc0, 0x40);
+                ret = m88ds3103_update_bits(dev, 0xa1, 0xc0, 0x40);
                if (ret)
                        goto err;
        }
-        ret = regmap_update_bits(dev->regmap, 0xa2, 0xc0, 0x80);
+        ret = m88ds3103_update_bits(dev, 0xa2, 0xc0, 0x80);
        if (ret)
                goto err;
@@ -1152,7 +1173,7 @@ static int m88ds3103_diseqc_send_burst(struct dvb_frontend *fe,
        }
        utmp = dev->cfg->envelope_mode << 5;
-        ret = regmap_update_bits(dev->regmap, 0xa2, 0xe0, utmp);
+        ret = m88ds3103_update_bits(dev, 0xa2, 0xe0, utmp);
        if (ret)
                goto err;
@@ -1194,12 +1215,12 @@ static int m88ds3103_diseqc_send_burst(struct dvb_frontend *fe,
        } else {
                dev_dbg(&client->dev, "diseqc tx timeout\n");
-                ret = regmap_update_bits(dev->regmap, 0xa1, 0xc0, 0x40);
+                ret = m88ds3103_update_bits(dev, 0xa1, 0xc0, 0x40);
                if (ret)
                        goto err;
        }
-        ret = regmap_update_bits(dev->regmap, 0xa2, 0xc0, 0x80);
+        ret = m88ds3103_update_bits(dev, 0xa2, 0xc0, 0x80);
        if (ret)
                goto err;
@@ -1435,13 +1456,13 @@ static int m88ds3103_probe(struct i2c_client *client,
                goto err_kfree;
        /* sleep */
-        ret = regmap_update_bits(dev->regmap, 0x08, 0x01, 0x00);
+        ret = m88ds3103_update_bits(dev, 0x08, 0x01, 0x00);
        if (ret)
                goto err_kfree;
-        ret = regmap_update_bits(dev->regmap, 0x04, 0x01, 0x01);
+        ret = m88ds3103_update_bits(dev, 0x04, 0x01, 0x01);
        if (ret)
                goto err_kfree;
-        ret = regmap_update_bits(dev->regmap, 0x23, 0x10, 0x10);
+        ret = m88ds3103_update_bits(dev, 0x23, 0x10, 0x10);
        if (ret)
                goto err_kfree;
diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c
index 81788c5a44d8..821a8f481507 100644
--- a/drivers/media/dvb-frontends/si2168.c
+++ b/drivers/media/dvb-frontends/si2168.c
@@ -502,6 +502,10 @@ static int si2168_init(struct dvb_frontend *fe)
                /* firmware is in the new format */
                for (remaining = fw->size; remaining > 0; remaining -= 17) {
                        len = fw->data[fw->size - remaining];
+                        if (len > SI2168_ARGLEN) {
+                                ret = -EINVAL;
+                                break;
+                        }
                        memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
                        cmd.wlen = len;
                        cmd.rlen = 1;
diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
index f55b3276f28d..56773f3893d4 100644
--- a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
@@ -80,11 +80,9 @@ irqreturn_t netup_spi_interrupt(struct netup_spi *spi)
        u16 reg;
        unsigned long flags;
-        if (!spi) {
+        if (!spi)
-                dev_dbg(&spi->master->dev,
-                        "%s(): SPI not initialized\n", __func__);
                return IRQ_NONE;
-        }
        spin_lock_irqsave(&spi->lock, flags);
        reg = readw(&spi->regs->control_stat);
        if (!(reg & NETUP_SPI_CTRL_IRQ)) {
@@ -234,11 +232,9 @@ void netup_spi_release(struct netup_unidvb_dev *ndev)
        unsigned long flags;
        struct netup_spi *spi = ndev->spi;
-        if (!spi) {
+        if (!spi)
-                dev_dbg(&spi->master->dev,
-                        "%s(): SPI not initialized\n", __func__);
                return;
-        }
        spin_lock_irqsave(&spi->lock, flags);
        reg = readw(&spi->regs->control_stat);
        writew(reg | NETUP_SPI_CTRL_IRQ, &spi->regs->control_stat);
diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
index 486aef50d99b..f922f2e827bc 100644
--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
+++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
@@ -1097,7 +1097,7 @@ static int load_slim_core_fw(const struct firmware *fw, void *context)
        Elf32_Ehdr *ehdr;
        Elf32_Phdr *phdr;
        u8 __iomem *dst;
-        int err, i;
+        int err = 0, i;
        if (!fw || !context)
                return -EINVAL;
@@ -1106,7 +1106,7 @@ static int load_slim_core_fw(const struct firmware *fw, void *context)
        phdr = (Elf32_Phdr *)(fw->data + ehdr->e_phoff);
        /* go through the available ELF segments */
-        for (i = 0; i < ehdr->e_phnum && !err; i++, phdr++) {
+        for (i = 0; i < ehdr->e_phnum; i++, phdr++) {
                /* Only consider LOAD segments */
                if (phdr->p_type != PT_LOAD)
@@ -1192,7 +1192,6 @@ err:
 static int load_c8sectpfe_fw_step1(struct c8sectpfei *fei)
 {
-        int ret;
        int err;
        dev_info(fei->dev, "Loading firmware: %s\n", FIRMWARE_MEMDMA);
@@ -1207,7 +1206,7 @@ static int load_c8sectpfe_fw_step1(struct c8sectpfei *fei)
        if (err) {
                dev_err(fei->dev, "request_firmware_nowait err: %d.\n", err);
                complete_all(&fei->fw_ack);
-                return ret;
+                return err;
        }
        return 0;
diff --git a/drivers/media/rc/ir-hix5hd2.c b/drivers/media/rc/ir-hix5hd2.c
index 1c087cb76815..d0549fba711c 100644
--- a/drivers/media/rc/ir-hix5hd2.c
+++ b/drivers/media/rc/ir-hix5hd2.c
@@ -257,7 +257,7 @@ static int hix5hd2_ir_probe(struct platform_device *pdev)
                goto clkerr;
        if (devm_request_irq(dev, priv->irq, hix5hd2_ir_rx_interrupt,
-                             IRQF_NO_SUSPEND, pdev->name, priv) < 0) {
+                             0, pdev->name, priv) < 0) {
                dev_err(dev, "IRQ %d register failed\n", priv->irq);
                ret = -EINVAL;
                goto regerr;
diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c
index 507382160e5e..ce157edd45fa 100644
--- a/drivers/media/tuners/si2157.c
+++ b/drivers/media/tuners/si2157.c
@@ -166,6 +166,10 @@ static int si2157_init(struct dvb_frontend *fe)
        for (remaining = fw->size; remaining > 0; remaining -= 17) {
                len = fw->data[fw->size - remaining];
+                if (len > SI2157_ARGLEN) {
+                        dev_err(&client->dev, "Bad firmware length\n");
+                        goto err_release_firmware;
+                }
                memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
                cmd.wlen = len;
                cmd.rlen = 1;
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index c3cac4c12fb3..197a4f2e54d2 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -34,6 +34,14 @@ static int rtl28xxu_ctrl_msg(struct dvb_usb_device *d, struct rtl28xxu_req *req)
        unsigned int pipe;
        u8 requesttype;
+        mutex_lock(&d->usb_mutex);
+        if (req->size > sizeof(dev->buf)) {
+                dev_err(&d->intf->dev, "too large message %u\n", req->size);
+                ret = -EINVAL;
+                goto err_mutex_unlock;
+        }
        if (req->index & CMD_WR_FLAG) {
                /* write */
                memcpy(dev->buf, req->data, req->size);
@@ -50,14 +58,17 @@ static int rtl28xxu_ctrl_msg(struct dvb_usb_device *d, struct rtl28xxu_req *req)
        dvb_usb_dbg_usb_control_msg(d->udev, 0, requesttype, req->value,
                        req->index, dev->buf, req->size);
        if (ret < 0)
-                goto err;
+                goto err_mutex_unlock;
        /* read request, copy returned data to return buf */
        if (requesttype == (USB_TYPE_VENDOR | USB_DIR_IN))
                memcpy(req->data, dev->buf, req->size);
+        mutex_unlock(&d->usb_mutex);
        return 0;
-err:
+err_mutex_unlock:
+        mutex_unlock(&d->usb_mutex);
        dev_dbg(&d->intf->dev, "failed=%d\n", ret);
        return ret;
 }
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.h b/drivers/media/usb/dvb-usb-v2/rtl28xxu.h
index 9f6115a2ee01..138062960a73 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.h
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.h
@@ -71,7 +71,7 @@
 struct rtl28xxu_dev {
-        u8 buf[28];
+        u8 buf[128];
        u8 chip_id;
        u8 tuner;
        char *tuner_name;
diff --git a/drivers/media/v4l2-core/Kconfig b/drivers/media/v4l2-core/Kconfig
index 82876a67f144..9beece00869b 100644
--- a/drivers/media/v4l2-core/Kconfig
+++ b/drivers/media/v4l2-core/Kconfig
@@ -47,7 +47,7 @@ config V4L2_MEM2MEM_DEV
 # Used by LED subsystem flash drivers
 config V4L2_FLASH_LED_CLASS
        tristate "V4L2 flash API for LED flash class devices"
-        depends on VIDEO_V4L2_SUBDEV_API
+        depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
        depends on LEDS_CLASS_FLASH
        ---help---
          Say Y here to enable V4L2 flash API support for LED flash
diff --git a/drivers/memory/Kconfig b/drivers/memory/Kconfig
index c6a644b22af4..6f3154613dc7 100644
--- a/drivers/memory/Kconfig
+++ b/drivers/memory/Kconfig
@@ -58,12 +58,18 @@ config OMAP_GPMC
          memory drives like NOR, NAND, OneNAND, SRAM.
 config OMAP_GPMC_DEBUG
-        bool
+        bool "Enable GPMC debug output and skip reset of GPMC during init"
        depends on OMAP_GPMC
        help
          Enables verbose debugging mostly to decode the bootloader provided
-          timings. Enable this during development to configure devices
+          timings. To preserve the bootloader provided timings, the reset
-          connected to the GPMC bus.
+          of GPMC is skipped during init. Enable this during development to
+          configure devices connected to the GPMC bus.
+          NOTE: In addition to matching the register setup with the bootloader
+          you also need to match the GPMC FCLK frequency used by the
+          bootloader or else the GPMC timings won't be identical with the
+          bootloader timings.
 config MVEBU_DEVBUS
        bool "Marvell EBU Device Bus Controller"
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index 32ac049f2bc4..6515dfc2b805 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -696,7 +696,6 @@ int gpmc_cs_set_timings(int cs, const struct gpmc_timings *t,
        int div;
        u32 l;
-        gpmc_cs_show_timings(cs, "before gpmc_cs_set_timings");
        div = gpmc_calc_divider(t->sync_clk);
        if (div < 0)
                return div;
@@ -1988,6 +1987,7 @@ static int gpmc_probe_generic_child(struct platform_device *pdev,
        if (ret < 0)
                goto err;
+        gpmc_cs_show_timings(cs, "before gpmc_cs_program_settings");
        ret = gpmc_cs_program_settings(cs, &gpmc_s);
        if (ret < 0)
                goto err;
diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
index b78cf5d403a3..7fc9174d4619 100644
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -2263,15 +2263,12 @@ static int mmc_test_profile_sglen_r_nonblock_perf(struct mmc_test_card *test)
 /*
 * eMMC hardware reset.
 */
-static int mmc_test_hw_reset(struct mmc_test_card *test)
+static int mmc_test_reset(struct mmc_test_card *test)
 {
        struct mmc_card *card = test->card;
        struct mmc_host *host = card->host;
        int err;
-        if (!mmc_card_mmc(card) || !mmc_can_reset(card))
-                return RESULT_UNSUP_CARD;
        err = mmc_hw_reset(host);
        if (!err)
                return RESULT_OK;
@@ -2605,8 +2602,8 @@ static const struct mmc_test_case mmc_test_cases[] = {
        },
        {
-                .name = "eMMC hardware reset",
+                .name = "Reset test",
-                .run = mmc_test_hw_reset,
+                .run = mmc_test_reset,
        },
 };
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index e726903170a8..f6cd995dbe92 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1924,7 +1924,6 @@ EXPORT_SYMBOL(mmc_can_reset);
 static int mmc_reset(struct mmc_host *host)
 {
        struct mmc_card *card = host->card;
-        u32 status;
        if (!(host->caps & MMC_CAP_HW_RESET) || !host->ops->hw_reset)
                return -EOPNOTSUPP;
@@ -1937,12 +1936,6 @@ static int mmc_reset(struct mmc_host *host)
        host->ops->hw_reset(host);
-        /* If the reset has happened, then a status command will fail */
-        if (!mmc_send_status(card, &status)) {
-                mmc_host_clk_release(host);
-                return -ENOSYS;
-        }
        /* Set initial state and call mmc_set_ios */
        mmc_set_initial_state(host);
        mmc_host_clk_release(host);
diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
index e5fac368068a..131026fbc2d7 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -87,6 +87,7 @@ static const struct pci_device_id peak_pci_tbl[] = {
        {PEAK_PCI_VENDOR_ID, PEAK_PC_104P_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
        {PEAK_PCI_VENDOR_ID, PEAK_PCI_104E_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
        {PEAK_PCI_VENDOR_ID, PEAK_CPCI_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
+        {PEAK_PCI_VENDOR_ID, PEAK_PCIE_OEM_ID, PCI_ANY_ID, PCI_ANY_ID,},
 #ifdef CONFIG_CAN_PEAK_PCIEC
        {PEAK_PCI_VENDOR_ID, PEAK_PCIEC_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
        {PEAK_PCI_VENDOR_ID, PEAK_PCIEC34_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
index 2c063b60db4b..96f485ab612e 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
@@ -327,9 +327,13 @@ void xgbe_debugfs_init(struct xgbe_prv_data *pdata)
        pdata->debugfs_xpcs_reg = 0;
        buf = kasprintf(GFP_KERNEL, "amd-xgbe-%s", pdata->netdev->name);
+        if (!buf)
+                return;
        pdata->xgbe_debugfs = debugfs_create_dir(buf, NULL);
        if (!pdata->xgbe_debugfs) {
                netdev_err(pdata->netdev, "debugfs_create_dir failed\n");
+                kfree(buf);
                return;
        }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index aeb7ce64452e..be628bd9fb18 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -3351,6 +3351,13 @@ static int bnx2x_set_rss_flags(struct bnx2x *bp, struct ethtool_rxnfc *info)
                        udp_rss_requested = 0;
                else
                        return -EINVAL;
+                if (CHIP_IS_E1x(bp) && udp_rss_requested) {
+                        DP(BNX2X_MSG_ETHTOOL,
+                           "57710, 57711 boards don't support RSS according to UDP 4-tuple\n");
+                        return -EINVAL;
+                }
                if ((info->flow_type == UDP_V4_FLOW) &&
                    (bp->rss_conf_obj.udp_rss_v4 != udp_rss_requested)) {
                        bp->rss_conf_obj.udp_rss_v4 = udp_rss_requested;
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 3bc701e4c59e..1805541b4240 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1683,6 +1683,24 @@ static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
        bcmgenet_intrl2_1_writel(priv, 0, INTRL2_CPU_MASK_CLEAR);
 }
+static void bcmgenet_link_intr_enable(struct bcmgenet_priv *priv)
+{
+        u32 int0_enable = 0;
+        /* Monitor cable plug/unplugged event for internal PHY, external PHY
+         * and MoCA PHY
+         */
+        if (priv->internal_phy) {
+                int0_enable |= UMAC_IRQ_LINK_EVENT;
+        } else if (priv->ext_phy) {
+                int0_enable |= UMAC_IRQ_LINK_EVENT;
+        } else if (priv->phy_interface == PHY_INTERFACE_MODE_MOCA) {
+                if (priv->hw_params->flags & GENET_HAS_MOCA_LINK_DET)
+                        int0_enable |= UMAC_IRQ_LINK_EVENT;
+        }
+        bcmgenet_intrl2_0_writel(priv, int0_enable, INTRL2_CPU_MASK_CLEAR);
+}
 static int init_umac(struct bcmgenet_priv *priv)
 {
        struct device *kdev = &priv->pdev->dev;
@@ -1723,15 +1741,8 @@ static int init_umac(struct bcmgenet_priv *priv)
        /* Enable Tx default queue 16 interrupts */
        int0_enable |= UMAC_IRQ_TXDMA_DONE;
-        /* Monitor cable plug/unplugged event for internal PHY */
+        /* Configure backpressure vectors for MoCA */
-        if (priv->internal_phy) {
+        if (priv->phy_interface == PHY_INTERFACE_MODE_MOCA) {
-                int0_enable |= UMAC_IRQ_LINK_EVENT;
-        } else if (priv->ext_phy) {
-                int0_enable |= UMAC_IRQ_LINK_EVENT;
-        } else if (priv->phy_interface == PHY_INTERFACE_MODE_MOCA) {
-                if (priv->hw_params->flags & GENET_HAS_MOCA_LINK_DET)
-                        int0_enable |= UMAC_IRQ_LINK_EVENT;
                reg = bcmgenet_bp_mc_get(priv);
                reg |= BIT(priv->hw_params->bp_in_en_shift);
@@ -2645,6 +2656,9 @@ static void bcmgenet_netif_start(struct net_device *dev)
        netif_tx_start_all_queues(dev);
+        /* Monitor link interrupts now */
+        bcmgenet_link_intr_enable(priv);
        phy_start(priv->phydev);
 }
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 821540913343..d463563e1f70 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -592,6 +592,7 @@ struct be_adapter {
        int be_get_temp_freq;
        struct be_hwmon hwmon_info;
        u8 pf_number;
+        u8 pci_func_num;
        struct rss_info rss_info;
        /* Filters for packets that need to be sent to BMC */
        u32 bmc_filt_mask;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index eb323913cd39..1795c935ff02 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -851,8 +851,10 @@ static int be_cmd_notify_wait(struct be_adapter *adapter,
                return status;
        dest_wrb = be_cmd_copy(adapter, wrb);
-        if (!dest_wrb)
+        if (!dest_wrb) {
-                return -EBUSY;
+                status = -EBUSY;
+                goto unlock;
+        }
        if (use_mcc(adapter))
                status = be_mcc_notify_wait(adapter);
@@ -862,6 +864,7 @@ static int be_cmd_notify_wait(struct be_adapter *adapter,
        if (!status)
                memcpy(wrb, dest_wrb, sizeof(*wrb));
+unlock:
        be_cmd_unlock(adapter);
        return status;
 }
@@ -1984,6 +1987,8 @@ int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 value)
                         be_if_cap_flags(adapter));
        }
        flags &= be_if_cap_flags(adapter);
+        if (!flags)
+                return -ENOTSUPP;
        return __be_cmd_rx_filter(adapter, flags, value);
 }
@@ -2887,6 +2892,7 @@ int be_cmd_get_cntl_attributes(struct be_adapter *adapter)
        if (!status) {
                attribs = attribs_cmd.va + sizeof(struct be_cmd_resp_hdr);
                adapter->hba_port_num = attribs->hba_attribs.phy_port;
+                adapter->pci_func_num = attribs->pci_func_num;
                serial_num = attribs->hba_attribs.controller_serial_number;
                for (i = 0; i < CNTL_SERIAL_NUM_WORDS; i++)
                        adapter->serial_num[i] = le32_to_cpu(serial_num[i]) &
@@ -3709,7 +3715,6 @@ int be_cmd_get_func_config(struct be_adapter *adapter, struct be_resources *res)
                        status = -EINVAL;
                        goto err;
                }
                adapter->pf_number = desc->pf_num;
                be_copy_nic_desc(res, desc);
        }
@@ -3721,7 +3726,10 @@ err:
        return status;
 }
-/* Will use MBOX only if MCCQ has not been created */
+/* Will use MBOX only if MCCQ has not been created
+ * non-zero domain => a PF is querying this on behalf of a VF
+ * zero domain => a PF or a VF is querying this for itself
+ */
 int be_cmd_get_profile_config(struct be_adapter *adapter,
                              struct be_resources *res, u8 query, u8 domain)
 {
@@ -3748,10 +3756,15 @@ int be_cmd_get_profile_config(struct be_adapter *adapter,
                               OPCODE_COMMON_GET_PROFILE_CONFIG,
                               cmd.size, &wrb, &cmd);
-        req->hdr.domain = domain;
        if (!lancer_chip(adapter))
                req->hdr.version = 1;
        req->type = ACTIVE_PROFILE_TYPE;
+        /* When a function is querying profile information relating to
+         * itself hdr.pf_number must be set to it's pci_func_num + 1
+         */
+        req->hdr.domain = domain;
+        if (domain == 0)
+                req->hdr.pf_num = adapter->pci_func_num + 1;
        /* When QUERY_MODIFIABLE_FIELDS_TYPE bit is set, cmd returns the
         * descriptors with all bits set to "1" for the fields which can be
@@ -3921,12 +3934,16 @@ static void be_fill_vf_res_template(struct be_adapter *adapter,
                        vf_if_cap_flags &= ~(BE_IF_FLAGS_RSS |
                                             BE_IF_FLAGS_DEFQ_RSS);
                }
-                nic_vft->cap_flags = cpu_to_le32(vf_if_cap_flags);
        } else {
                num_vf_qs = 1;
        }
+        if (res_mod.vf_if_cap_flags & BE_IF_FLAGS_VLAN_PROMISCUOUS) {
+                nic_vft->flags |= BIT(IF_CAPS_FLAGS_VALID_SHIFT);
+                vf_if_cap_flags &= ~BE_IF_FLAGS_VLAN_PROMISCUOUS;
+        }
+        nic_vft->cap_flags = cpu_to_le32(vf_if_cap_flags);
        nic_vft->rq_count = cpu_to_le16(num_vf_qs);
        nic_vft->txq_count = cpu_to_le16(num_vf_qs);
        nic_vft->rssq_count = cpu_to_le16(num_vf_qs);
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 7d178bdb112e..91155ea74f34 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -289,7 +289,9 @@ struct be_cmd_req_hdr {
        u32 timeout;            /* dword 1 */
        u32 request_length;     /* dword 2 */
        u8 version;             /* dword 3 */
-        u8 rsvd[3];             /* dword 3 */
+        u8 rsvd1;               /* dword 3 */
+        u8 pf_num;              /* dword 3 */
+        u8 rsvd2;               /* dword 3 */
 };
 #define RESP_HDR_INFO_OPCODE_SHIFT      0       /* bits 0 - 7 */
@@ -1652,7 +1654,11 @@ struct mgmt_hba_attribs {
 struct mgmt_controller_attrib {
        struct mgmt_hba_attribs hba_attribs;
-        u32 rsvd0[10];
+        u32 rsvd0[2];
+        u16 rsvd1;
+        u8 pci_func_num;
+        u8 rsvd2;
+        u32 rsvd3[7];
 } __packed;
 struct be_cmd_req_cntl_attribs {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 7bf51a1a0a77..eb48a977f8da 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1123,11 +1123,12 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
                                           struct sk_buff *skb,
                                           struct be_wrb_params *wrb_params)
 {
-        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or
+        /* Lancer, SH and BE3 in SRIOV mode have a bug wherein
-         * less may cause a transmit stall on that port. So the work-around is
+         * packets that are 32b or less may cause a transmit stall
-         * to pad short packets (<= 32 bytes) to a 36-byte length.
+         * on that port. The workaround is to pad such packets
+         * (len <= 32 bytes) to a minimum length of 36b.
         */
-        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
+        if (skb->len <= 32) {
                if (skb_put_padto(skb, 36))
                        return NULL;
        }
@@ -4205,10 +4206,6 @@ static int be_get_config(struct be_adapter *adapter)
        int status, level;
        u16 profile_id;
-        status = be_cmd_get_cntl_attributes(adapter);
-        if (status)
-                return status;
        status = be_cmd_query_fw_cfg(adapter);
        if (status)
                return status;
@@ -4407,6 +4404,11 @@ static int be_setup(struct be_adapter *adapter)
        if (!lancer_chip(adapter))
                be_cmd_req_native_mode(adapter);
+        /* Need to invoke this cmd first to get the PCI Function Number */
+        status = be_cmd_get_cntl_attributes(adapter);
+        if (status)
+                return status;
        if (!BE2_chip(adapter) && be_physfn(adapter))
                be_alloc_sriov_res(adapter);
@@ -4999,7 +5001,15 @@ static bool be_check_ufi_compatibility(struct be_adapter *adapter,
                return false;
        }
-        return (fhdr->asic_type_rev >= adapter->asic_rev);
+        /* In BE3 FW images the "asic_type_rev" field doesn't track the
+         * asic_rev of the chips it is compatible with.
+         * When asic_type_rev is 0 the image is compatible only with
+         * pre-BE3-R chips (asic_rev < 0x10)
+         */
+        if (BEx_chip(adapter) && fhdr->asic_type_rev == 0)
+                return adapter->asic_rev < 0x10;
+        else
+                return (fhdr->asic_type_rev >= adapter->asic_rev);
 }
 static int be_fw_download(struct be_adapter *adapter, const struct firmware* fw)
diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
index 3c40f6b99224..55c36230e176 100644
--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
@@ -198,11 +198,13 @@ static int fsl_pq_mdio_reset(struct mii_bus *bus)
 #if defined(CONFIG_GIANFAR) || defined(CONFIG_GIANFAR_MODULE)
 /*
+ * Return the TBIPA address, starting from the address
+ * of the mapped GFAR MDIO registers (struct gfar)
 * This is mildly evil, but so is our hardware for doing this.
 * Also, we have to cast back to struct gfar because of
 * definition weirdness done in gianfar.h.
 */
-static uint32_t __iomem *get_gfar_tbipa(void __iomem *p)
+static uint32_t __iomem *get_gfar_tbipa_from_mdio(void __iomem *p)
 {
        struct gfar __iomem *enet_regs = p;
@@ -210,6 +212,15 @@ static uint32_t __iomem *get_gfar_tbipa(void __iomem *p)
 }
 /*
+ * Return the TBIPA address, starting from the address
+ * of the mapped GFAR MII registers (gfar_mii_regs[] within struct gfar)
+ */
+static uint32_t __iomem *get_gfar_tbipa_from_mii(void __iomem *p)
+{
+        return get_gfar_tbipa_from_mdio(container_of(p, struct gfar, gfar_mii_regs));
+}
+/*
 * Return the TBIPAR address for an eTSEC2 node
 */
 static uint32_t __iomem *get_etsec_tbipa(void __iomem *p)
@@ -220,11 +231,12 @@ static uint32_t __iomem *get_etsec_tbipa(void __iomem *p)
 #if defined(CONFIG_UCC_GETH) || defined(CONFIG_UCC_GETH_MODULE)
 /*
- * Return the TBIPAR address for a QE MDIO node
+ * Return the TBIPAR address for a QE MDIO node, starting from the address
+ * of the mapped MII registers (struct fsl_pq_mii)
 */
 static uint32_t __iomem *get_ucc_tbipa(void __iomem *p)
 {
-        struct fsl_pq_mdio __iomem *mdio = p;
+        struct fsl_pq_mdio __iomem *mdio = container_of(p, struct fsl_pq_mdio, mii);
        return &mdio->utbipar;
 }
@@ -300,14 +312,14 @@ static const struct of_device_id fsl_pq_mdio_match[] = {
                .compatible = "fsl,gianfar-tbi",
                .data = &(struct fsl_pq_mdio_data) {
                        .mii_offset = 0,
-                        .get_tbipa = get_gfar_tbipa,
+                        .get_tbipa = get_gfar_tbipa_from_mii,
                },
        },
        {
                .compatible = "fsl,gianfar-mdio",
                .data = &(struct fsl_pq_mdio_data) {
                        .mii_offset = 0,
-                        .get_tbipa = get_gfar_tbipa,
+                        .get_tbipa = get_gfar_tbipa_from_mii,
                },
        },
        {
@@ -315,7 +327,7 @@ static const struct of_device_id fsl_pq_mdio_match[] = {
                .compatible = "gianfar",
                .data = &(struct fsl_pq_mdio_data) {
                        .mii_offset = offsetof(struct fsl_pq_mdio, mii),
-                        .get_tbipa = get_gfar_tbipa,
+                        .get_tbipa = get_gfar_tbipa_from_mdio,
                },
        },
        {
@@ -445,6 +457,16 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
                        tbipa = data->get_tbipa(priv->map);
+                        /*
+                         * Add consistency check to make sure TBI is contained
+                         * within the mapped range (not because we would get a
+                         * segfault, rather to catch bugs in computing TBI
+                         * address). Print error message but continue anyway.
+                         */
+                        if ((void *)tbipa > priv->map + resource_size(&res) - 4)
+                                dev_err(&pdev->dev, "invalid register map (should be at least 0x%04x to contain TBI address)\n",
+                                        ((void *)tbipa - priv->map) + 4);
                        iowrite32be(be32_to_cpup(prop), tbipa);
                }
        }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq.c b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
index 62488a67149d..c0e943aecd13 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
@@ -386,7 +386,6 @@ static i40e_status i40e_init_asq(struct i40e_hw *hw)
        hw->aq.asq.next_to_use = 0;
        hw->aq.asq.next_to_clean = 0;
-        hw->aq.asq.count = hw->aq.num_asq_entries;
        /* allocate the ring memory */
        ret_code = i40e_alloc_adminq_asq_ring(hw);
@@ -404,6 +403,7 @@ static i40e_status i40e_init_asq(struct i40e_hw *hw)
                goto init_adminq_free_rings;
        /* success! */
+        hw->aq.asq.count = hw->aq.num_asq_entries;
        goto init_adminq_exit;
 init_adminq_free_rings:
@@ -445,7 +445,6 @@ static i40e_status i40e_init_arq(struct i40e_hw *hw)
        hw->aq.arq.next_to_use = 0;
        hw->aq.arq.next_to_clean = 0;
-        hw->aq.arq.count = hw->aq.num_arq_entries;
        /* allocate the ring memory */
        ret_code = i40e_alloc_adminq_arq_ring(hw);
@@ -463,6 +462,7 @@ static i40e_status i40e_init_arq(struct i40e_hw *hw)
                goto init_adminq_free_rings;
        /* success! */
+        hw->aq.arq.count = hw->aq.num_arq_entries;
        goto init_adminq_exit;
 init_adminq_free_rings:
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 2fdf978ae6a5..dd44fafd8798 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -8389,6 +8389,7 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
        netdev->hw_enc_features |= NETIF_F_IP_CSUM       |
                                  NETIF_F_GSO_UDP_TUNNEL |
+                                  NETIF_F_GSO_GRE        |
                                  NETIF_F_TSO;
        netdev->features = NETIF_F_SG                  |
@@ -8396,6 +8397,7 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
                           NETIF_F_SCTP_CSUM           |
                           NETIF_F_HIGHDMA             |
                           NETIF_F_GSO_UDP_TUNNEL      |
+                           NETIF_F_GSO_GRE             |
                           NETIF_F_HW_VLAN_CTAG_TX     |
                           NETIF_F_HW_VLAN_CTAG_RX     |
                           NETIF_F_HW_VLAN_CTAG_FILTER |
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_adminq.c b/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
index 929d47152bf2..a23ebfd5cd25 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
@@ -373,7 +373,6 @@ static i40e_status i40e_init_asq(struct i40e_hw *hw)
        hw->aq.asq.next_to_use = 0;
        hw->aq.asq.next_to_clean = 0;
-        hw->aq.asq.count = hw->aq.num_asq_entries;
        /* allocate the ring memory */
        ret_code = i40e_alloc_adminq_asq_ring(hw);
@@ -391,6 +390,7 @@ static i40e_status i40e_init_asq(struct i40e_hw *hw)
                goto init_adminq_free_rings;
        /* success! */
+        hw->aq.asq.count = hw->aq.num_asq_entries;
        goto init_adminq_exit;
 init_adminq_free_rings:
@@ -432,7 +432,6 @@ static i40e_status i40e_init_arq(struct i40e_hw *hw)
        hw->aq.arq.next_to_use = 0;
        hw->aq.arq.next_to_clean = 0;
-        hw->aq.arq.count = hw->aq.num_arq_entries;
        /* allocate the ring memory */
        ret_code = i40e_alloc_adminq_arq_ring(hw);
@@ -450,6 +449,7 @@ static i40e_status i40e_init_arq(struct i40e_hw *hw)
                goto init_adminq_free_rings;
        /* success! */
+        hw->aq.arq.count = hw->aq.num_arq_entries;
        goto init_adminq_exit;
 init_adminq_free_rings:
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 8e81e53c370e..c34488479365 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1364,6 +1364,10 @@ int mlx4_test_interrupts(struct mlx4_dev *dev)
         * and performing a NOP command
         */
        for(i = 0; !err && (i < dev->caps.num_comp_vectors); ++i) {
+                /* Make sure request_irq was called */
+                if (!priv->eq_table.eq[i].have_irq)
+                        continue;
                /* Temporary use polling for command completions */
                mlx4_cmd_use_polling(dev);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 006757f80988..cc3a9897574c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2669,14 +2669,11 @@ static void mlx4_enable_msi_x(struct mlx4_dev *dev)
        if (msi_x) {
                int nreq = dev->caps.num_ports * num_online_cpus() + 1;
-                bool shared_ports = false;
                nreq = min_t(int, dev->caps.num_eqs - dev->caps.reserved_eqs,
                             nreq);
-                if (nreq > MAX_MSIX) {
+                if (nreq > MAX_MSIX)
                        nreq = MAX_MSIX;
-                        shared_ports = true;
-                }
                entries = kcalloc(nreq, sizeof *entries, GFP_KERNEL);
                if (!entries)
@@ -2699,9 +2696,6 @@ static void mlx4_enable_msi_x(struct mlx4_dev *dev)
                bitmap_zero(priv->eq_table.eq[MLX4_EQ_ASYNC].actv_ports.ports,
                            dev->caps.num_ports);
-                if (MLX4_IS_LEGACY_EQ_MODE(dev->caps))
-                        shared_ports = true;
                for (i = 0; i < dev->caps.num_comp_vectors + 1; i++) {
                        if (i == MLX4_EQ_ASYNC)
                                continue;
@@ -2709,7 +2703,7 @@ static void mlx4_enable_msi_x(struct mlx4_dev *dev)
                        priv->eq_table.eq[i].irq =
                                entries[i + 1 - !!(i > MLX4_EQ_ASYNC)].vector;
-                        if (shared_ports) {
+                        if (MLX4_IS_LEGACY_EQ_MODE(dev->caps)) {
                                bitmap_fill(priv->eq_table.eq[i].actv_ports.ports,
                                            dev->caps.num_ports);
                                /* We don't set affinity hint when there
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_flow_table.c b/drivers/net/ethernet/mellanox/mlx5/core/en_flow_table.c
index e71563ce05d1..22d603f78273 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_flow_table.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_flow_table.c
@@ -598,6 +598,8 @@ void mlx5e_enable_vlan_filter(struct mlx5e_priv *priv)
                return;
        priv->vlan.filter_disabled = false;
+        if (priv->netdev->flags & IFF_PROMISC)
+                return;
        mlx5e_del_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_VID, 0);
 }
@@ -607,6 +609,8 @@ void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv)
                return;
        priv->vlan.filter_disabled = true;
+        if (priv->netdev->flags & IFF_PROMISC)
+                return;
        mlx5e_add_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_VID, 0);
 }
@@ -717,8 +721,12 @@ void mlx5e_set_rx_mode_work(struct work_struct *work)
        bool enable_broadcast  = !ea->broadcast_enabled &&  broadcast_enabled;
        bool disable_broadcast =  ea->broadcast_enabled && !broadcast_enabled;
-        if (enable_promisc)
+        if (enable_promisc) {
                mlx5e_add_eth_addr_rule(priv, &ea->promisc, MLX5E_PROMISC);
+                if (!priv->vlan.filter_disabled)
+                        mlx5e_add_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_VID,
+                                            0);
+        }
        if (enable_allmulti)
                mlx5e_add_eth_addr_rule(priv, &ea->allmulti, MLX5E_ALLMULTI);
        if (enable_broadcast)
@@ -730,8 +738,12 @@ void mlx5e_set_rx_mode_work(struct work_struct *work)
                mlx5e_del_eth_addr_from_flow_table(priv, &ea->broadcast);
        if (disable_allmulti)
                mlx5e_del_eth_addr_from_flow_table(priv, &ea->allmulti);
-        if (disable_promisc)
+        if (disable_promisc) {
+                if (!priv->vlan.filter_disabled)
+                        mlx5e_del_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_VID,
+                                            0);
                mlx5e_del_eth_addr_from_flow_table(priv, &ea->promisc);
+        }
        ea->promisc_enabled   = promisc_enabled;
        ea->allmulti_enabled  = allmulti_enabled;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
index 821caaab9bfb..3b9480fa3403 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
@@ -311,7 +311,7 @@ static int mlx5_query_port_pvlc(struct mlx5_core_dev *dev, u32 *pvlc,
        int err;
        memset(in, 0, sizeof(in));
-        MLX5_SET(ptys_reg, in, local_port, local_port);
+        MLX5_SET(pvlc_reg, in, local_port, local_port);
        err = mlx5_core_access_reg(dev, in, sizeof(in), pvlc,
                                   pvlc_size, MLX5_REG_PVLC, 0, 0);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index dbcaf5df8967..28c19cc1a17c 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -374,26 +374,31 @@ static int __mlxsw_emad_transmit(struct mlxsw_core *mlxsw_core,
        int err;
        int ret;
+        mlxsw_core->emad.trans_active = true;
        err = mlxsw_core_skb_transmit(mlxsw_core->driver_priv, skb, tx_info);
        if (err) {
                dev_err(mlxsw_core->bus_info->dev, "Failed to transmit EMAD (tid=%llx)\n",
                        mlxsw_core->emad.tid);
                dev_kfree_skb(skb);
-                return err;
+                goto trans_inactive_out;
        }
-        mlxsw_core->emad.trans_active = true;
        ret = wait_event_timeout(mlxsw_core->emad.wait,
                                 !(mlxsw_core->emad.trans_active),
                                 msecs_to_jiffies(MLXSW_EMAD_TIMEOUT_MS));
        if (!ret) {
                dev_warn(mlxsw_core->bus_info->dev, "EMAD timed-out (tid=%llx)\n",
                         mlxsw_core->emad.tid);
-                mlxsw_core->emad.trans_active = false;
+                err = -EIO;
-                return -EIO;
+                goto trans_inactive_out;
        }
        return 0;
+trans_inactive_out:
+        mlxsw_core->emad.trans_active = false;
+        return err;
 }
 static int mlxsw_emad_process_status(struct mlxsw_core *mlxsw_core,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/item.h b/drivers/net/ethernet/mellanox/mlxsw/item.h
index ffd55d030ce2..36fb1cec53c9 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/item.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/item.h
@@ -187,6 +187,7 @@ __mlxsw_item_bit_array_offset(struct mlxsw_item *item, u16 index, u8 *shift)
 {
        u16 max_index, be_index;
        u16 offset;             /* byte offset inside the array */
+        u8 in_byte_index;
        BUG_ON(index && !item->element_size);
        if (item->offset % sizeof(u32) != 0 ||
@@ -199,7 +200,8 @@ __mlxsw_item_bit_array_offset(struct mlxsw_item *item, u16 index, u8 *shift)
        max_index = (item->size.bytes << 3) / item->element_size - 1;
        be_index = max_index - index;
        offset = be_index * item->element_size >> 3;
-        *shift = index % (BITS_PER_BYTE / item->element_size) << 1;
+        in_byte_index  = index % (BITS_PER_BYTE / item->element_size);
+        *shift = in_byte_index * item->element_size;
        return item->offset + offset;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
index 462cea31ecbb..cef866c37648 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
@@ -1582,11 +1582,11 @@ static int mlxsw_pci_cmd_exec(void *bus_priv, u16 opcode, u8 opcode_mod,
        if (in_mbox)
                memcpy(mlxsw_pci->cmd.in_mbox.buf, in_mbox, in_mbox_size);
-        mlxsw_pci_write32(mlxsw_pci, CIR_IN_PARAM_HI, in_mapaddr >> 32);
+        mlxsw_pci_write32(mlxsw_pci, CIR_IN_PARAM_HI, upper_32_bits(in_mapaddr));
-        mlxsw_pci_write32(mlxsw_pci, CIR_IN_PARAM_LO, in_mapaddr);
+        mlxsw_pci_write32(mlxsw_pci, CIR_IN_PARAM_LO, lower_32_bits(in_mapaddr));
-        mlxsw_pci_write32(mlxsw_pci, CIR_OUT_PARAM_HI, out_mapaddr >> 32);
+        mlxsw_pci_write32(mlxsw_pci, CIR_OUT_PARAM_HI, upper_32_bits(out_mapaddr));
-        mlxsw_pci_write32(mlxsw_pci, CIR_OUT_PARAM_LO, out_mapaddr);
+        mlxsw_pci_write32(mlxsw_pci, CIR_OUT_PARAM_LO, lower_32_bits(out_mapaddr));
        mlxsw_pci_write32(mlxsw_pci, CIR_IN_MODIFIER, in_mod);
        mlxsw_pci_write32(mlxsw_pci, CIR_TOKEN, 0);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
index 3e52ee93438c..62cbbd1ada8d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
@@ -1069,9 +1069,9 @@ static int mlxsw_sx_port_create(struct mlxsw_sx *mlxsw_sx, u8 local_port)
        return 0;
 err_register_netdev:
-err_port_admin_status_set:
 err_port_mac_learning_mode_set:
 err_port_stp_state_set:
+err_port_admin_status_set:
 err_port_mtu_set:
 err_port_speed_set:
 err_port_swid_set:
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index 66fd868152e5..b159ef8303cc 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -476,13 +476,12 @@ static void __lpc_get_mac(struct netdata_local *pldat, u8 *mac)
        mac[5] = tmp >> 8;
 }
-static void __lpc_eth_clock_enable(struct netdata_local *pldat,
+static void __lpc_eth_clock_enable(struct netdata_local *pldat, bool enable)
-                                   bool enable)
 {
        if (enable)
-                clk_enable(pldat->clk);
+                clk_prepare_enable(pldat->clk);
        else
-                clk_disable(pldat->clk);
+                clk_disable_unprepare(pldat->clk);
 }
 static void __lpc_params_setup(struct netdata_local *pldat)
@@ -1494,7 +1493,7 @@ err_out_free_irq:
 err_out_iounmap:
        iounmap(pldat->net_base);
 err_out_disable_clocks:
-        clk_disable(pldat->clk);
+        clk_disable_unprepare(pldat->clk);
        clk_put(pldat->clk);
 err_out_free_dev:
        free_netdev(ndev);
@@ -1519,7 +1518,7 @@ static int lpc_eth_drv_remove(struct platform_device *pdev)
        iounmap(pldat->net_base);
        mdiobus_unregister(pldat->mii_bus);
        mdiobus_free(pldat->mii_bus);
-        clk_disable(pldat->clk);
+        clk_disable_unprepare(pldat->clk);
        clk_put(pldat->clk);
        free_netdev(ndev);
@@ -1540,7 +1539,7 @@ static int lpc_eth_drv_suspend(struct platform_device *pdev,
                if (netif_running(ndev)) {
                        netif_device_detach(ndev);
                        __lpc_eth_shutdown(pldat);
-                        clk_disable(pldat->clk);
+                        clk_disable_unprepare(pldat->clk);
                        /*
                         * Reset again now clock is disable to be sure
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index a83263743665..2b7550c43f78 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -2134,10 +2134,11 @@ static int rhine_rx(struct net_device *dev, int limit)
                        }
                        skb_put(skb, pkt_len);
-                        skb->protocol = eth_type_trans(skb, dev);
                        rhine_rx_vlan_tag(skb, desc, data_size);
+                        skb->protocol = eth_type_trans(skb, dev);
                        netif_receive_skb(skb);
                        u64_stats_update_begin(&rp->rx_stats.syncp);
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 8f5c02eed47d..cde29f8a37bf 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -870,14 +870,14 @@ static int geneve_newlink(struct net *net, struct net_device *dev,
        __be16 dst_port = htons(GENEVE_UDP_PORT);
        __u8 ttl = 0, tos = 0;
        bool metadata = false;
-        __be32 rem_addr;
+        __be32 rem_addr = 0;
-        __u32 vni;
+        __u32 vni = 0;
-        if (!data[IFLA_GENEVE_ID] || !data[IFLA_GENEVE_REMOTE])
+        if (data[IFLA_GENEVE_ID])
-                return -EINVAL;
+                vni = nla_get_u32(data[IFLA_GENEVE_ID]);
-        vni = nla_get_u32(data[IFLA_GENEVE_ID]);
+        if (data[IFLA_GENEVE_REMOTE])
-        rem_addr = nla_get_in_addr(data[IFLA_GENEVE_REMOTE]);
+                rem_addr = nla_get_in_addr(data[IFLA_GENEVE_REMOTE]);
        if (data[IFLA_GENEVE_TTL])
                ttl = nla_get_u8(data[IFLA_GENEVE_TTL]);
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index c5ad98ace5d0..11e3975485c1 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -168,8 +168,6 @@ config MDIO_OCTEON
          busses. It is required by the Octeon and ThunderX ethernet device
          drivers.
-          If in doubt, say Y.
 config MDIO_SUN4I
        tristate "Allwinner sun4i MDIO interface support"
        depends on ARCH_SUNXI
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 3837ae344f63..2ed75060da50 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -313,7 +313,6 @@ static void pppoe_flush_dev(struct net_device *dev)
                        if (po->pppoe_dev == dev &&
                            sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
                                pppox_unbind_sock(sk);
-                                sk->sk_state = PPPOX_ZOMBIE;
                                sk->sk_state_change(sk);
                                po->pppoe_dev = NULL;
                                dev_put(dev);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index fbb9325d1f6e..e66805eeffb4 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -164,6 +164,7 @@ config USB_NET_AX8817X
            * Aten UC210T
            * ASIX AX88172
            * Billionton Systems, USB2AR
+            * Billionton Systems, GUSB2AM-1G-B
            * Buffalo LUA-U2-KTX
            * Corega FEther USB2-TX
            * D-Link DUB-E100
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index 75d6f26729a3..079069a060a6 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -91,8 +91,10 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
                        }
                        rx->ax_skb = netdev_alloc_skb_ip_align(dev->net,
                                                               rx->size);
-                        if (!rx->ax_skb)
+                        if (!rx->ax_skb) {
+                                rx->size = 0;
                                return 0;
+                        }
                }
                if (rx->size > dev->net->mtu + ETH_HLEN + VLAN_HLEN) {
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 1173a24feda3..5cabefc23494 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -959,6 +959,10 @@ static const struct usb_device_id	products [] = {
        USB_DEVICE (0x08dd, 0x90ff),
        .driver_info =  (unsigned long) &ax8817x_info,
 }, {
+        // Billionton Systems, GUSB2AM-1G-B
+        USB_DEVICE(0x08dd, 0x0114),
+        .driver_info =  (unsigned long) &ax88178_info,
+}, {
        // ATEN UC210T
        USB_DEVICE (0x0557, 0x2009),
        .driver_info =  (unsigned long) &ax8817x_info,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index bbac1d35ed4e..afdc65fd5bc5 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2745,11 +2745,10 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
        struct vxlan_config conf;
        int err;
-        if (!data[IFLA_VXLAN_ID])
-                return -EINVAL;
        memset(&conf, 0, sizeof(conf));
-        conf.vni = nla_get_u32(data[IFLA_VXLAN_ID]);
+        if (data[IFLA_VXLAN_ID])
+                conf.vni = nla_get_u32(data[IFLA_VXLAN_ID]);
        if (data[IFLA_VXLAN_GROUP]) {
                conf.remote_ip.sin.sin_addr.s_addr = nla_get_in_addr(data[IFLA_VXLAN_GROUP]);
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 23afcda2de96..678d72af4a9d 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -337,7 +337,7 @@ enum ath10k_hw_rate_cck {
 #define TARGET_10X_MAX_FRAG_ENTRIES             0
 /* 10.2 parameters */
-#define TARGET_10_2_DMA_BURST_SIZE              1
+#define TARGET_10_2_DMA_BURST_SIZE              0
 /* Target specific defines for WMI-TLV firmware */
 #define TARGET_TLV_NUM_VDEVS                    4
@@ -391,7 +391,7 @@ enum ath10k_hw_rate_cck {
 #define TARGET_10_4_TX_DBG_LOG_SIZE             1024
 #define TARGET_10_4_NUM_WDS_ENTRIES             32
-#define TARGET_10_4_DMA_BURST_SIZE              1
+#define TARGET_10_4_DMA_BURST_SIZE              0
 #define TARGET_10_4_MAC_AGGR_DELIM              0
 #define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1
 #define TARGET_10_4_VOW_CONFIG                  0
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 57f95f2dca5b..90eb75012e4f 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -880,6 +880,7 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
        hw->max_rate_tries = 10;
        hw->sta_data_size = sizeof(struct ath_node);
        hw->vif_data_size = sizeof(struct ath_vif);
+        hw->extra_tx_headroom = 4;
        hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1;
        hw->wiphy->available_antennas_tx = BIT(ah->caps.max_txchains) - 1;
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 28490702124a..71d3e9adbf3c 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -120,6 +120,7 @@ MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if over
 #ifdef CONFIG_B43_BCMA
 static const struct bcma_device_id b43_bcma_tbl[] = {
        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
+        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x15, BCMA_ANY_CLASS),
        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1C, BCMA_ANY_CLASS),
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index ab45819c1fbb..e18629a16fb0 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -1020,7 +1020,7 @@ static void iwlagn_wowlan_program_keys(struct ieee80211_hw *hw,
                        u8 *pn = seq.ccmp.pn;
                        ieee80211_get_key_rx_seq(key, i, &seq);
-                        aes_sc->pn = cpu_to_le64(
+                        aes_sc[i].pn = cpu_to_le64(
                                        (u64)pn[5] |
                                        ((u64)pn[4] << 8) |
                                        ((u64)pn[3] << 16) |
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 6951aba620eb..3fb327d5a911 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -348,6 +348,6 @@ const struct iwl_cfg iwl7265d_n_cfg = {
 };
 MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
-MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
+MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
 MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
 MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 04264e417c1c..576187611e61 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -274,18 +274,13 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                break;
        case WLAN_CIPHER_SUITE_CCMP:
                if (sta) {
-                        u8 *pn = seq.ccmp.pn;
+                        u64 pn64;
                        aes_sc = data->rsc_tsc->all_tsc_rsc.aes.unicast_rsc;
                        aes_tx_sc = &data->rsc_tsc->all_tsc_rsc.aes.tsc;
-                        ieee80211_get_key_tx_seq(key, &seq);
+                        pn64 = atomic64_read(&key->tx_pn);
-                        aes_tx_sc->pn = cpu_to_le64((u64)pn[5] |
+                        aes_tx_sc->pn = cpu_to_le64(pn64);
-                                                    ((u64)pn[4] << 8) |
-                                                    ((u64)pn[3] << 16) |
-                                                    ((u64)pn[2] << 24) |
-                                                    ((u64)pn[1] << 32) |
-                                                    ((u64)pn[0] << 40));
                } else {
                        aes_sc = data->rsc_tsc->all_tsc_rsc.aes.multicast_rsc;
                }
@@ -298,12 +293,12 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                        u8 *pn = seq.ccmp.pn;
                        ieee80211_get_key_rx_seq(key, i, &seq);
-                        aes_sc->pn = cpu_to_le64((u64)pn[5] |
+                        aes_sc[i].pn = cpu_to_le64((u64)pn[5] |
-                                                 ((u64)pn[4] << 8) |
+                                                   ((u64)pn[4] << 8) |
-                                                 ((u64)pn[3] << 16) |
+                                                   ((u64)pn[3] << 16) |
-                                                 ((u64)pn[2] << 24) |
+                                                   ((u64)pn[2] << 24) |
-                                                 ((u64)pn[1] << 32) |
+                                                   ((u64)pn[1] << 32) |
-                                                 ((u64)pn[0] << 40));
+                                                   ((u64)pn[0] << 40));
                }
                data->use_rsc_tsc = true;
                break;
@@ -1453,15 +1448,15 @@ static void iwl_mvm_d3_update_gtks(struct ieee80211_hw *hw,
                switch (key->cipher) {
                case WLAN_CIPHER_SUITE_CCMP:
-                        iwl_mvm_aes_sc_to_seq(&sc->aes.tsc, &seq);
                        iwl_mvm_set_aes_rx_seq(sc->aes.unicast_rsc, key);
+                        atomic64_set(&key->tx_pn, le64_to_cpu(sc->aes.tsc.pn));
                        break;
                case WLAN_CIPHER_SUITE_TKIP:
                        iwl_mvm_tkip_sc_to_seq(&sc->tkip.tsc, &seq);
                        iwl_mvm_set_tkip_rx_seq(sc->tkip.unicast_rsc, key);
+                        ieee80211_set_key_tx_seq(key, &seq);
                        break;
                }
-                ieee80211_set_key_tx_seq(key, &seq);
                /* that's it for this key */
                return;
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index 4a0ce83315bd..5c7f7cc9ffcc 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -703,7 +703,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
         * abort after reading the nvm in case RF Kill is on, we will complete
         * the init seq later when RF kill will switch to off
         */
-        if (iwl_mvm_is_radio_killed(mvm)) {
+        if (iwl_mvm_is_radio_hw_killed(mvm)) {
                IWL_DEBUG_RF_KILL(mvm,
                                  "jump over all phy activities due to RF kill\n");
                iwl_remove_notification(&mvm->notif_wait, &calib_wait);
@@ -736,7 +736,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
        ret = iwl_wait_notification(&mvm->notif_wait, &calib_wait,
                        MVM_UCODE_CALIB_TIMEOUT);
-        if (ret && iwl_mvm_is_radio_killed(mvm)) {
+        if (ret && iwl_mvm_is_radio_hw_killed(mvm)) {
                IWL_DEBUG_RF_KILL(mvm, "RFKILL while calibrating.\n");
                ret = 1;
        }
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index aa8c2b7f23c7..7c2944a72470 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -2388,6 +2388,7 @@ static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
                iwl_mvm_remove_time_event(mvm, mvmvif,
                                          &mvmvif->time_event_data);
                RCU_INIT_POINTER(mvm->csa_vif, NULL);
+                mvmvif->csa_countdown = false;
        }
        if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index b95a07ec9e36..c754051a4cea 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -860,6 +860,11 @@ static inline bool iwl_mvm_is_radio_killed(struct iwl_mvm *mvm)
               test_bit(IWL_MVM_STATUS_HW_CTKILL, &mvm->status);
 }
+static inline bool iwl_mvm_is_radio_hw_killed(struct iwl_mvm *mvm)
+{
+        return test_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
+}
 /* Must be called with rcu_read_lock() held and it can only be
 * released when mvmsta is not needed anymore.
 */
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index a37de3f410a0..f0cb092f980e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -590,6 +590,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
        ieee80211_unregister_hw(mvm->hw);
        iwl_mvm_leds_exit(mvm);
 out_free:
+        flush_delayed_work(&mvm->fw_dump_wk);
        iwl_phy_db_free(mvm->phy_db);
        kfree(mvm->scan_cmd);
        if (!cfg->no_power_up_nic_in_init || !mvm->nvm_file_name)
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index b0825c402c73..644b58bc5226 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -414,6 +414,11 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x095A, 0x5590, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5290, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5490, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5F10, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5212, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x520A, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9000, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9400, iwl7265_2ac_cfg)},
 /* 8000 Series */
        {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 5932306084fd..bf9afbf46c1b 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1114,6 +1114,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
        { USB_DEVICE(0x0db0, 0x871c) },
        { USB_DEVICE(0x0db0, 0x899a) },
        /* Ovislink */
+        { USB_DEVICE(0x1b75, 0x3070) },
        { USB_DEVICE(0x1b75, 0x3071) },
        { USB_DEVICE(0x1b75, 0x3072) },
        { USB_DEVICE(0x1b75, 0xa200) },
diff --git a/drivers/net/wireless/rtlwifi/pci.h b/drivers/net/wireless/rtlwifi/pci.h
index d4567d12e07e..5da6703942d9 100644
--- a/drivers/net/wireless/rtlwifi/pci.h
+++ b/drivers/net/wireless/rtlwifi/pci.h
@@ -247,6 +247,8 @@ struct rtl_pci {
        /* MSI support */
        bool msi_support;
        bool using_msi;
+        /* interrupt clear before set */
+        bool int_clear;
 };
 struct mp_adapter {
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
index b7f18e2155eb..6e9418ed90c2 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
@@ -2253,11 +2253,28 @@ void rtl8821ae_set_qos(struct ieee80211_hw *hw, int aci)
        }
 }
+static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 tmp = rtl_read_dword(rtlpriv, REG_HISR);
+        rtl_write_dword(rtlpriv, REG_HISR, tmp);
+        tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+        rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+        tmp = rtl_read_dword(rtlpriv, REG_HSISR);
+        rtl_write_dword(rtlpriv, REG_HSISR, tmp);
+}
 void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw)
 {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        if (!rtlpci->int_clear)
+                rtl8821ae_clear_interrupt(hw);/*clear it here first*/
        rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
        rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
        rtlpci->irq_enabled = true;
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
index a4988121e1ab..8ee141a55bc5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
@@ -96,6 +96,7 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
        rtl8821ae_bt_reg_init(hw);
        rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
+        rtlpci->int_clear = rtlpriv->cfg->mod_params->int_clear;
        rtlpriv->btcoexist.btc_ops = rtl_btc_get_ops_pointer();
        rtlpriv->dm.dm_initialgain_enable = 1;
@@ -167,6 +168,7 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
        rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps;
        rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps;
        rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
+        rtlpci->msi_support = rtlpriv->cfg->mod_params->int_clear;
        if (rtlpriv->cfg->mod_params->disable_watchdog)
                pr_info("watchdog disabled\n");
        rtlpriv->psc.reg_fwctrl_lps = 3;
@@ -308,6 +310,7 @@ static struct rtl_mod_params rtl8821ae_mod_params = {
        .swctrl_lps = false,
        .fwctrl_lps = true,
        .msi_support = true,
+        .int_clear = true,
        .debug = DBG_EMERG,
        .disable_watchdog = 0,
 };
@@ -437,6 +440,7 @@ module_param_named(fwlps, rtl8821ae_mod_params.fwctrl_lps, bool, 0444);
 module_param_named(msi, rtl8821ae_mod_params.msi_support, bool, 0444);
 module_param_named(disable_watchdog, rtl8821ae_mod_params.disable_watchdog,
                   bool, 0444);
+module_param_named(int_clear, rtl8821ae_mod_params.int_clear, bool, 0444);
 MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
 MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
 MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
@@ -444,6 +448,7 @@ MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
 MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 1)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
 MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n");
+MODULE_PARM_DESC(int_clear, "Set to 1 to disable interrupt clear before set (default 0)\n");
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index b90ca618b123..4544752a2ba8 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -2249,6 +2249,9 @@ struct rtl_mod_params {
        /* default 0: 1 means disable */
        bool disable_watchdog;
+        /* default 0: 1 means do not disable interrupts */
+        bool int_clear;
 };
 struct rtl_hal_usbint_cfg {
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 929a6e7e5ecf..56ebd8267386 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -788,6 +788,12 @@ static void connect(struct backend_info *be)
        /* Use the number of queues requested by the frontend */
        be->vif->queues = vzalloc(requested_num_queues *
                                  sizeof(struct xenvif_queue));
+        if (!be->vif->queues) {
+                xenbus_dev_fatal(dev, -ENOMEM,
+                                 "allocating queues");
+                return;
+        }
        be->vif->num_queues = requested_num_queues;
        be->vif->stalled_queues = requested_num_queues;
diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index 2365a32a595e..be3755c973e9 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -823,9 +823,15 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
                }
                /* Now look up the logical CPU number */
-                for_each_possible_cpu(cpu)
+                for_each_possible_cpu(cpu) {
-                        if (dn == of_cpu_device_node_get(cpu))
+                        struct device_node *cpu_dn;
+                        cpu_dn = of_cpu_device_node_get(cpu);
+                        of_node_put(cpu_dn);
+                        if (dn == cpu_dn)
                                break;
+                }
                if (cpu >= nr_cpu_ids) {
                        pr_warn("Failed to find logical CPU for %s\n",
diff --git a/drivers/staging/iio/accel/sca3000_ring.c b/drivers/staging/iio/accel/sca3000_ring.c
index 23685e74917e..bd2c69f85949 100644
--- a/drivers/staging/iio/accel/sca3000_ring.c
+++ b/drivers/staging/iio/accel/sca3000_ring.c
@@ -116,7 +116,7 @@ static int sca3000_read_first_n_hw_rb(struct iio_buffer *r,
        if (ret)
                goto error_ret;
-        for (i = 0; i < num_read; i++)
+        for (i = 0; i < num_read / sizeof(u16); i++)
                *(((u16 *)rx) + i) = be16_to_cpup((__be16 *)rx + i);
        if (copy_to_user(buf, rx, num_read))
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index 3f7715c9968b..47fc00a3f63b 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -915,11 +915,12 @@ static int mxs_lradc_read_raw(struct iio_dev *iio_dev,
        case IIO_CHAN_INFO_OFFSET:
                if (chan->type == IIO_TEMP) {
                        /* The calculated value from the ADC is in Kelvin, we
-                         * want Celsius for hwmon so the offset is
+                         * want Celsius for hwmon so the offset is -273.15
-                         * -272.15 * scale
+                         * The offset is applied before scaling so it is
+                         * actually -213.15 * 4 / 1.012 = -1079.644268
                         */
-                        *val = -1075;
+                        *val = -1079;
-                        *val2 = 691699;
+                        *val2 = 644268;
                        return IIO_VAL_INT_PLUS_MICRO;
                }
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index 0bae8cc6c23a..ca920b0ecf8f 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -932,7 +932,7 @@ static void exynos4412_tmu_set_emulation(struct exynos_tmu_data *data,
        if (data->soc == SOC_ARCH_EXYNOS5260)
                emul_con = EXYNOS5260_EMUL_CON;
-        if (data->soc == SOC_ARCH_EXYNOS5433)
+        else if (data->soc == SOC_ARCH_EXYNOS5433)
                emul_con = EXYNOS5433_TMU_EMUL_CON;
        else if (data->soc == SOC_ARCH_EXYNOS7)
                emul_con = EXYNOS7_TMU_REG_EMUL_CON;
diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c
index 21d01a491405..e508939daea3 100644
--- a/drivers/tty/serial/8250/8250_dma.c
+++ b/drivers/tty/serial/8250/8250_dma.c
@@ -80,10 +80,6 @@ int serial8250_tx_dma(struct uart_8250_port *p)
                return 0;
        dma->tx_size = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE);
-        if (dma->tx_size < p->port.fifosize) {
-                ret = -EINVAL;
-                goto err;
-        }
        desc = dmaengine_prep_slave_single(dma->txchan,
                                           dma->tx_addr + xmit->tail,
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index c79d33676672..c47d3e480586 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -147,6 +147,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
                pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
                xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+                xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
        }
        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
                (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 43291f93afeb..97ffe3997273 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2191,6 +2191,10 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
                }
        /* Fast path - was this the last TRB in the TD for this URB? */
        } else if (event_trb == td->last_trb) {
+                if (td->urb_length_set && trb_comp_code == COMP_SHORT_TX)
+                        return finish_td(xhci, td, event_trb, event, ep,
+                                         status, false);
                if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
                        td->urb->actual_length =
                                td->urb->transfer_buffer_length -
@@ -2242,6 +2246,12 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
                        td->urb->actual_length +=
                                TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
                                EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+                if (trb_comp_code == COMP_SHORT_TX) {
+                        xhci_dbg(xhci, "mid bulk/intr SP, wait for last TRB event\n");
+                        td->urb_length_set = true;
+                        return 0;
+                }
        }
        return finish_td(xhci, td, event_trb, event, ep, status, false);
@@ -2274,6 +2284,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
        u32 trb_comp_code;
        int ret = 0;
        int td_num = 0;
+        bool handling_skipped_tds = false;
        slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));
        xdev = xhci->devs[slot_id];
@@ -2410,6 +2421,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                ep->skip = true;
                xhci_dbg(xhci, "Miss service interval error, set skip flag\n");
                goto cleanup;
+        case COMP_PING_ERR:
+                ep->skip = true;
+                xhci_dbg(xhci, "No Ping response error, Skip one Isoc TD\n");
+                goto cleanup;
        default:
                if (xhci_is_vendor_info_code(xhci, trb_comp_code)) {
                        status = 0;
@@ -2546,13 +2561,18 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                                                 ep, &status);
 cleanup:
+                handling_skipped_tds = ep->skip &&
+                        trb_comp_code != COMP_MISSED_INT &&
+                        trb_comp_code != COMP_PING_ERR;
                /*
-                 * Do not update event ring dequeue pointer if ep->skip is set.
+                 * Do not update event ring dequeue pointer if we're in a loop
-                 * Will roll back to continue process missed tds.
+                 * processing missed tds.
                 */
-                if (trb_comp_code == COMP_MISSED_INT || !ep->skip) {
+                if (!handling_skipped_tds)
                        inc_deq(xhci, xhci->event_ring);
-                }
                if (ret) {
                        urb = td->urb;
@@ -2587,7 +2607,7 @@ cleanup:
         * Process them as short transfer until reach the td pointed by
         * the event.
         */
-        } while (ep->skip && trb_comp_code != COMP_MISSED_INT);
+        } while (handling_skipped_tds);
        return 0;
 }
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 1aaf89300621..92f394927f24 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -1093,6 +1093,7 @@ static void fbcon_init(struct vc_data *vc, int init)
                con_copy_unimap(vc, svc);
        ops = info->fbcon_par;
+        ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
        p->con_rotate = initial_rotation;
        set_blitting_type(vc, info);
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index b823fac91c92..8c6f247ba81d 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -2584,7 +2584,7 @@ static long btrfs_fallocate(struct file *file, int mode,
                                        alloc_start);
                if (ret)
                        goto out;
-        } else {
+        } else if (offset + len > inode->i_size) {
                /*
                 * If we are fallocating from the end of the file onward we
                 * need to zero out the end of the page if i_size lands in the
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 3e3e6130637f..8d20f3b1cab0 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4641,7 +4641,7 @@ locked:
        if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) {
                ret = -EINVAL;
-                goto out_bargs;
+                goto out_bctl;
        }
 do_balance:
@@ -4655,12 +4655,15 @@ do_balance:
        need_unlock = false;
        ret = btrfs_balance(bctl, bargs);
+        bctl = NULL;
        if (arg) {
                if (copy_to_user(arg, bargs, sizeof(*bargs)))
                        ret = -EFAULT;
        }
+out_bctl:
+        kfree(bctl);
 out_bargs:
        kfree(bargs);
 out_unlock:
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 091a36444972..29e4599f6fc1 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -778,19 +778,24 @@ static void bdi_split_work_to_wbs(struct backing_dev_info *bdi,
                                  struct wb_writeback_work *base_work,
                                  bool skip_if_busy)
 {
-        int next_memcg_id = 0;
+        struct bdi_writeback *last_wb = NULL;
-        struct bdi_writeback *wb;
+        struct bdi_writeback *wb = list_entry_rcu(&bdi->wb_list,
-        struct wb_iter iter;
+                                                struct bdi_writeback, bdi_node);
        might_sleep();
 restart:
        rcu_read_lock();
-        bdi_for_each_wb(wb, bdi, &iter, next_memcg_id) {
+        list_for_each_entry_continue_rcu(wb, &bdi->wb_list, bdi_node) {
                DEFINE_WB_COMPLETION_ONSTACK(fallback_work_done);
                struct wb_writeback_work fallback_work;
                struct wb_writeback_work *work;
                long nr_pages;
+                if (last_wb) {
+                        wb_put(last_wb);
+                        last_wb = NULL;
+                }
                /* SYNC_ALL writes out I_DIRTY_TIME too */
                if (!wb_has_dirty_io(wb) &&
                    (base_work->sync_mode == WB_SYNC_NONE ||
@@ -819,12 +824,22 @@ restart:
                wb_queue_work(wb, work);
-                next_memcg_id = wb->memcg_css->id + 1;
+                /*
+                 * Pin @wb so that it stays on @bdi->wb_list.  This allows
+                 * continuing iteration from @wb after dropping and
+                 * regrabbing rcu read lock.
+                 */
+                wb_get(wb);
+                last_wb = wb;
                rcu_read_unlock();
                wb_wait_for_completion(bdi, &fallback_work_done);
                goto restart;
        }
        rcu_read_unlock();
+        if (last_wb)
+                wb_put(last_wb);
 }
 #else   /* CONFIG_CGROUP_WRITEBACK */
@@ -1857,12 +1872,11 @@ void wakeup_flusher_threads(long nr_pages, enum wb_reason reason)
        rcu_read_lock();
        list_for_each_entry_rcu(bdi, &bdi_list, bdi_list) {
                struct bdi_writeback *wb;
-                struct wb_iter iter;
                if (!bdi_has_dirty_io(bdi))
                        continue;
-                bdi_for_each_wb(wb, bdi, &iter, 0)
+                list_for_each_entry_rcu(wb, &bdi->wb_list, bdi_node)
                        wb_start_writeback(wb, wb_split_bdi_pages(wb, nr_pages),
                                           false, reason);
        }
@@ -1894,11 +1908,10 @@ static void wakeup_dirtytime_writeback(struct work_struct *w)
        rcu_read_lock();
        list_for_each_entry_rcu(bdi, &bdi_list, bdi_list) {
                struct bdi_writeback *wb;
-                struct wb_iter iter;
-                bdi_for_each_wb(wb, bdi, &iter, 0)
+                list_for_each_entry_rcu(wb, &bdi->wb_list, bdi_node)
-                        if (!list_empty(&bdi->wb.b_dirty_time))
+                        if (!list_empty(&wb->b_dirty_time))
-                                wb_wakeup(&bdi->wb);
+                                wb_wakeup(wb);
        }
        rcu_read_unlock();
        schedule_delayed_work(&dirtytime_work, dirtytime_expire_interval * HZ);
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index ee5aa4daaea0..ce38b4ccc9ab 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -1658,12 +1658,13 @@ send_response:
                if (ret < 0) {
                        mlog(ML_ERROR, "failed to dispatch assert master work\n");
                        response = DLM_MASTER_RESP_ERROR;
+                        spin_unlock(&res->spinlock);
                        dlm_lockres_put(res);
                } else {
                        dispatched = 1;
                        __dlm_lockres_grab_inflight_worker(dlm, res);
+                        spin_unlock(&res->spinlock);
                }
-                spin_unlock(&res->spinlock);
        } else {
                if (res)
                        dlm_lockres_put(res);
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 3d90ad7ff91f..58eaa5c0d387 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1723,8 +1723,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
                        } else {
                                dispatched = 1;
                                __dlm_lockres_grab_inflight_worker(dlm, res);
+                                spin_unlock(&res->spinlock);
                        }
-                        spin_unlock(&res->spinlock);
                } else {
                        /* put.. incase we are not the master */
                        spin_unlock(&res->spinlock);
diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
index a23209b43842..1b4d69f68c33 100644
--- a/include/linux/backing-dev-defs.h
+++ b/include/linux/backing-dev-defs.h
@@ -116,6 +116,8 @@ struct bdi_writeback {
        struct list_head work_list;
        struct delayed_work dwork;      /* work item used for writeback */
+        struct list_head bdi_node;      /* anchored at bdi->wb_list */
 #ifdef CONFIG_CGROUP_WRITEBACK
        struct percpu_ref refcnt;       /* used only for !root wb's */
        struct fprop_local_percpu memcg_completions;
@@ -150,6 +152,7 @@ struct backing_dev_info {
        atomic_long_t tot_write_bandwidth;
        struct bdi_writeback wb;  /* the root writeback info for this bdi */
+        struct list_head wb_list; /* list of all wbs */
 #ifdef CONFIG_CGROUP_WRITEBACK
        struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */
        struct rb_root cgwb_congested_tree; /* their congested states */
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index d5eb4ad1c534..c85f74946a8b 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -19,13 +19,17 @@
 #include <linux/slab.h>
 int __must_check bdi_init(struct backing_dev_info *bdi);
-void bdi_destroy(struct backing_dev_info *bdi);
+void bdi_exit(struct backing_dev_info *bdi);
 __printf(3, 4)
 int bdi_register(struct backing_dev_info *bdi, struct device *parent,
                const char *fmt, ...);
 int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev);
+void bdi_unregister(struct backing_dev_info *bdi);
 int __must_check bdi_setup_and_register(struct backing_dev_info *, char *);
+void bdi_destroy(struct backing_dev_info *bdi);
 void wb_start_writeback(struct bdi_writeback *wb, long nr_pages,
                        bool range_cyclic, enum wb_reason reason);
 void wb_start_background_writeback(struct bdi_writeback *wb);
@@ -408,61 +412,6 @@ static inline void unlocked_inode_to_wb_end(struct inode *inode, bool locked)
        rcu_read_unlock();
 }
-struct wb_iter {
-        int                     start_memcg_id;
-        struct radix_tree_iter  tree_iter;
-        void                    **slot;
-};
-static inline struct bdi_writeback *__wb_iter_next(struct wb_iter *iter,
-                                                   struct backing_dev_info *bdi)
-{
-        struct radix_tree_iter *titer = &iter->tree_iter;
-        WARN_ON_ONCE(!rcu_read_lock_held());
-        if (iter->start_memcg_id >= 0) {
-                iter->slot = radix_tree_iter_init(titer, iter->start_memcg_id);
-                iter->start_memcg_id = -1;
-        } else {
-                iter->slot = radix_tree_next_slot(iter->slot, titer, 0);
-        }
-        if (!iter->slot)
-                iter->slot = radix_tree_next_chunk(&bdi->cgwb_tree, titer, 0);
-        if (iter->slot)
-                return *iter->slot;
-        return NULL;
-}
-static inline struct bdi_writeback *__wb_iter_init(struct wb_iter *iter,
-                                                   struct backing_dev_info *bdi,
-                                                   int start_memcg_id)
-{
-        iter->start_memcg_id = start_memcg_id;
-        if (start_memcg_id)
-                return __wb_iter_next(iter, bdi);
-        else
-                return &bdi->wb;
-}
-/**
- * bdi_for_each_wb - walk all wb's of a bdi in ascending memcg ID order
- * @wb_cur: cursor struct bdi_writeback pointer
- * @bdi: bdi to walk wb's of
- * @iter: pointer to struct wb_iter to be used as iteration buffer
- * @start_memcg_id: memcg ID to start iteration from
- *
- * Iterate @wb_cur through the wb's (bdi_writeback's) of @bdi in ascending
- * memcg ID order starting from @start_memcg_id.  @iter is struct wb_iter
- * to be used as temp storage during iteration.  rcu_read_lock() must be
- * held throughout iteration.
- */
-#define bdi_for_each_wb(wb_cur, bdi, iter, start_memcg_id)              \
-        for ((wb_cur) = __wb_iter_init(iter, bdi, start_memcg_id);      \
-             (wb_cur); (wb_cur) = __wb_iter_next(iter, bdi))
 #else   /* CONFIG_CGROUP_WRITEBACK */
 static inline bool inode_cgwb_enabled(struct inode *inode)
@@ -522,14 +471,6 @@ static inline void wb_blkcg_offline(struct blkcg *blkcg)
 {
 }
-struct wb_iter {
-        int             next_id;
-};
-#define bdi_for_each_wb(wb_cur, bdi, iter, start_blkcg_id)              \
-        for ((iter)->next_id = (start_blkcg_id);                        \
-             ({ (wb_cur) = !(iter)->next_id++ ? &(bdi)->wb : NULL; }); )
 static inline int inode_congested(struct inode *inode, int cong_bits)
 {
        return wb_congested(&inode_to_bdi(inode)->wb, cong_bits);
diff --git a/include/linux/cma.h b/include/linux/cma.h
index f7ef093ec49a..29f9e774ab76 100644
--- a/include/linux/cma.h
+++ b/include/linux/cma.h
@@ -26,6 +26,6 @@ extern int __init cma_declare_contiguous(phys_addr_t base,
 extern int cma_init_reserved_mem(phys_addr_t base, phys_addr_t size,
                                        unsigned int order_per_bit,
                                        struct cma **res_cma);
-extern struct page *cma_alloc(struct cma *cma, unsigned int count, unsigned int align);
+extern struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align);
 extern bool cma_release(struct cma *cma, const struct page *pages, unsigned int count);
 #endif
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index dfaa7b3e9ae9..8efb40e61d6e 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -237,12 +237,25 @@
 #define KASAN_ABI_VERSION 3
 #endif
+#if GCC_VERSION >= 40902
+/*
+ * Tell the compiler that address safety instrumentation (KASAN)
+ * should not be applied to that function.
+ * Conflicts with inlining: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67368
+ */
+#define __no_sanitize_address __attribute__((no_sanitize_address))
+#endif
 #endif  /* gcc version >= 40000 specific checks */
 #if !defined(__noclone)
 #define __noclone       /* not needed */
 #endif
+#if !defined(__no_sanitize_address)
+#define __no_sanitize_address
+#endif
 /*
 * A trick to suppress uninitialized variable warning without generating any
 * code
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index c836eb2dc44d..3d7810341b57 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -198,19 +198,45 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
 #include <uapi/linux/types.h>
-static __always_inline void __read_once_size(const volatile void *p, void *res, int size)
+#define __READ_ONCE_SIZE                                                \
+({                                                                      \
+        switch (size) {                                                 \
+        case 1: *(__u8 *)res = *(volatile __u8 *)p; break;              \
+        case 2: *(__u16 *)res = *(volatile __u16 *)p; break;            \
+        case 4: *(__u32 *)res = *(volatile __u32 *)p; break;            \
+        case 8: *(__u64 *)res = *(volatile __u64 *)p; break;            \
+        default:                                                        \
+                barrier();                                              \
+                __builtin_memcpy((void *)res, (const void *)p, size);   \
+                barrier();                                              \
+        }                                                               \
+})
+static __always_inline
+void __read_once_size(const volatile void *p, void *res, int size)
 {
-        switch (size) {
+        __READ_ONCE_SIZE;
-        case 1: *(__u8 *)res = *(volatile __u8 *)p; break;
+}
-        case 2: *(__u16 *)res = *(volatile __u16 *)p; break;
-        case 4: *(__u32 *)res = *(volatile __u32 *)p; break;
+#ifdef CONFIG_KASAN
-        case 8: *(__u64 *)res = *(volatile __u64 *)p; break;
+/*
-        default:
+ * This function is not 'inline' because __no_sanitize_address confilcts
-                barrier();
+ * with inlining. Attempt to inline it may cause a build failure.
-                __builtin_memcpy((void *)res, (const void *)p, size);
+ *      https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67368
-                barrier();
+ * '__maybe_unused' allows us to avoid defined-but-not-used warnings.
-        }
+ */
+static __no_sanitize_address __maybe_unused
+void __read_once_size_nocheck(const volatile void *p, void *res, int size)
+{
+        __READ_ONCE_SIZE;
+}
+#else
+static __always_inline
+void __read_once_size_nocheck(const volatile void *p, void *res, int size)
+{
+        __READ_ONCE_SIZE;
 }
+#endif
 static __always_inline void __write_once_size(volatile void *p, void *res, int size)
 {
@@ -248,8 +274,22 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
 * required ordering.
 */
-#define READ_ONCE(x) \
+#define __READ_ONCE(x, check)                                           \
-        ({ union { typeof(x) __val; char __c[1]; } __u; __read_once_size(&(x), __u.__c, sizeof(x)); __u.__val; })
+({                                                                      \
+        union { typeof(x) __val; char __c[1]; } __u;                    \
+        if (check)                                                      \
+                __read_once_size(&(x), __u.__c, sizeof(x));             \
+        else                                                            \
+                __read_once_size_nocheck(&(x), __u.__c, sizeof(x));     \
+        __u.__val;                                                      \
+})
+#define READ_ONCE(x) __READ_ONCE(x, 1)
+/*
+ * Use READ_ONCE_NOCHECK() instead of READ_ONCE() if you need
+ * to hide memory access from KASAN.
+ */
+#define READ_ONCE_NOCHECK(x) __READ_ONCE(x, 0)
 #define WRITE_ONCE(x, val) \
 ({                                                      \
diff --git a/include/linux/dma-contiguous.h b/include/linux/dma-contiguous.h
index 569bbd039896..fec734df1524 100644
--- a/include/linux/dma-contiguous.h
+++ b/include/linux/dma-contiguous.h
@@ -111,7 +111,7 @@ static inline int dma_declare_contiguous(struct device *dev, phys_addr_t size,
        return ret;
 }
-struct page *dma_alloc_from_contiguous(struct device *dev, int count,
+struct page *dma_alloc_from_contiguous(struct device *dev, size_t count,
                                       unsigned int order);
 bool dma_release_from_contiguous(struct device *dev, struct page *pages,
                                 int count);
@@ -144,7 +144,7 @@ int dma_declare_contiguous(struct device *dev, phys_addr_t size,
 }
 static inline
-struct page *dma_alloc_from_contiguous(struct device *dev, int count,
+struct page *dma_alloc_from_contiguous(struct device *dev, size_t count,
                                       unsigned int order)
 {
        return NULL;
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 6452ff4c463f..3e3318ddfc0e 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -676,8 +676,9 @@ enum {
 struct list_head *mem_cgroup_cgwb_list(struct mem_cgroup *memcg);
 struct wb_domain *mem_cgroup_wb_domain(struct bdi_writeback *wb);
-void mem_cgroup_wb_stats(struct bdi_writeback *wb, unsigned long *pavail,
+void mem_cgroup_wb_stats(struct bdi_writeback *wb, unsigned long *pfilepages,
-                         unsigned long *pdirty, unsigned long *pwriteback);
+                         unsigned long *pheadroom, unsigned long *pdirty,
+                         unsigned long *pwriteback);
 #else   /* CONFIG_CGROUP_WRITEBACK */
@@ -687,7 +688,8 @@ static inline struct wb_domain *mem_cgroup_wb_domain(struct bdi_writeback *wb)
 }
 static inline void mem_cgroup_wb_stats(struct bdi_writeback *wb,
-                                       unsigned long *pavail,
+                                       unsigned long *pfilepages,
+                                       unsigned long *pheadroom,
                                       unsigned long *pdirty,
                                       unsigned long *pwriteback)
 {
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index cb1b9bbda332..b36d837c701e 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -64,7 +64,7 @@ struct unix_sock {
        struct socket_wq        peer_wq;
 };
-static inline struct unix_sock *unix_sk(struct sock *sk)
+static inline struct unix_sock *unix_sk(const struct sock *sk)
 {
        return (struct unix_sock *)sk;
 }
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 186f3a1e1b1f..fc1937698625 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -113,12 +113,12 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
 void __inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo,
                          bool rearm);
-static void inline inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo)
+static inline void inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo)
 {
        __inet_twsk_schedule(tw, timeo, false);
 }
-static void inline inet_twsk_reschedule(struct inet_timewait_sock *tw, int timeo)
+static inline void inet_twsk_reschedule(struct inet_timewait_sock *tw, int timeo)
 {
        __inet_twsk_schedule(tw, timeo, true);
 }
diff --git a/include/net/sock.h b/include/net/sock.h
index 7aa78440559a..e23717013a4e 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -828,6 +828,14 @@ static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *s
        if (sk_rcvqueues_full(sk, limit))
                return -ENOBUFS;
+        /*
+         * If the skb was allocated from pfmemalloc reserves, only
+         * allow SOCK_MEMALLOC sockets to use it as this socket is
+         * helping free memory
+         */
+        if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC))
+                return -ENOMEM;
        __sk_add_backlog(sk, skb);
        sk->sk_backlog.len += skb->truesize;
        return 0;
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 884e728b09d9..26ede14597da 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -86,7 +86,7 @@
        .access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | \
        SNDRV_CTL_ELEM_ACCESS_READWRITE, \
        .tlv.p  = (tlv_array),\
-        .info = snd_soc_info_volsw, \
+        .info = snd_soc_info_volsw_sx, \
        .get = snd_soc_get_volsw_sx,\
        .put = snd_soc_put_volsw_sx, \
        .private_value = (unsigned long)&(struct soc_mixer_control) \
@@ -156,7 +156,7 @@
        .access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | \
        SNDRV_CTL_ELEM_ACCESS_READWRITE, \
        .tlv.p  = (tlv_array), \
-        .info = snd_soc_info_volsw, \
+        .info = snd_soc_info_volsw_sx, \
        .get = snd_soc_get_volsw_sx, \
        .put = snd_soc_put_volsw_sx, \
        .private_value = (unsigned long)&(struct soc_mixer_control) \
@@ -574,6 +574,8 @@ int snd_soc_put_enum_double(struct snd_kcontrol *kcontrol,
        struct snd_ctl_elem_value *ucontrol);
 int snd_soc_info_volsw(struct snd_kcontrol *kcontrol,
        struct snd_ctl_elem_info *uinfo);
+int snd_soc_info_volsw_sx(struct snd_kcontrol *kcontrol,
+                          struct snd_ctl_elem_info *uinfo);
 #define snd_soc_info_bool_ext           snd_ctl_boolean_mono_info
 int snd_soc_get_volsw(struct snd_kcontrol *kcontrol,
        struct snd_ctl_elem_value *ucontrol);
diff --git a/include/sound/wm8904.h b/include/sound/wm8904.h
index 898be3a8db9a..6d8f8fba3341 100644
--- a/include/sound/wm8904.h
+++ b/include/sound/wm8904.h
@@ -119,7 +119,7 @@
 #define WM8904_MIC_REGS  2
 #define WM8904_GPIO_REGS 4
 #define WM8904_DRC_REGS  4
-#define WM8904_EQ_REGS   25
+#define WM8904_EQ_REGS   24
 /**
 * DRC configurations are specified with a label and a set of register
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index 32e07d8cbaf4..036f73bc54cd 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -323,10 +323,10 @@ enum ovs_key_attr {
        OVS_KEY_ATTR_MPLS,      /* array of struct ovs_key_mpls.
                                 * The implementation may restrict
                                 * the accepted length of the array. */
-        OVS_KEY_ATTR_CT_STATE,  /* u8 bitmask of OVS_CS_F_* */
+        OVS_KEY_ATTR_CT_STATE,  /* u32 bitmask of OVS_CS_F_* */
        OVS_KEY_ATTR_CT_ZONE,   /* u16 connection tracking zone. */
        OVS_KEY_ATTR_CT_MARK,   /* u32 connection tracking mark */
-        OVS_KEY_ATTR_CT_LABEL,  /* 16-octet connection tracking label */
+        OVS_KEY_ATTR_CT_LABELS, /* 16-octet connection tracking label */
 #ifdef __KERNEL__
        OVS_KEY_ATTR_TUNNEL_INFO,  /* struct ip_tunnel_info */
@@ -439,9 +439,9 @@ struct ovs_key_nd {
        __u8    nd_tll[ETH_ALEN];
 };
-#define OVS_CT_LABEL_LEN        16
+#define OVS_CT_LABELS_LEN       16
-struct ovs_key_ct_label {
+struct ovs_key_ct_labels {
-        __u8    ct_label[OVS_CT_LABEL_LEN];
+        __u8    ct_labels[OVS_CT_LABELS_LEN];
 };
 /* OVS_KEY_ATTR_CT_STATE flags */
@@ -449,9 +449,9 @@ struct ovs_key_ct_label {
 #define OVS_CS_F_ESTABLISHED       0x02 /* Part of an existing connection. */
 #define OVS_CS_F_RELATED           0x04 /* Related to an established
                                         * connection. */
-#define OVS_CS_F_INVALID           0x20 /* Could not track connection. */
+#define OVS_CS_F_REPLY_DIR         0x08 /* Flow is in the reply direction. */
-#define OVS_CS_F_REPLY_DIR         0x40 /* Flow is in the reply direction. */
+#define OVS_CS_F_INVALID           0x10 /* Could not track connection. */
-#define OVS_CS_F_TRACKED           0x80 /* Conntrack has occurred. */
+#define OVS_CS_F_TRACKED           0x20 /* Conntrack has occurred. */
 /**
 * enum ovs_flow_attr - attributes for %OVS_FLOW_* commands.
@@ -618,22 +618,24 @@ struct ovs_action_hash {
 /**
 * enum ovs_ct_attr - Attributes for %OVS_ACTION_ATTR_CT action.
- * @OVS_CT_ATTR_FLAGS: u32 connection tracking flags.
+ * @OVS_CT_ATTR_COMMIT: If present, commits the connection to the conntrack
+ * table. This allows future packets for the same connection to be identified
+ * as 'established' or 'related'.
 * @OVS_CT_ATTR_ZONE: u16 connection tracking zone.
 * @OVS_CT_ATTR_MARK: u32 value followed by u32 mask. For each bit set in the
 * mask, the corresponding bit in the value is copied to the connection
 * tracking mark field in the connection.
- * @OVS_CT_ATTR_LABEL: %OVS_CT_LABEL_LEN value followed by %OVS_CT_LABEL_LEN
+ * @OVS_CT_ATTR_LABEL: %OVS_CT_LABELS_LEN value followed by %OVS_CT_LABELS_LEN
 * mask. For each bit set in the mask, the corresponding bit in the value is
 * copied to the connection tracking label field in the connection.
 * @OVS_CT_ATTR_HELPER: variable length string defining conntrack ALG.
 */
 enum ovs_ct_attr {
        OVS_CT_ATTR_UNSPEC,
-        OVS_CT_ATTR_FLAGS,      /* u8 bitmask of OVS_CT_F_*. */
+        OVS_CT_ATTR_COMMIT,     /* No argument, commits connection. */
        OVS_CT_ATTR_ZONE,       /* u16 zone id. */
        OVS_CT_ATTR_MARK,       /* mark to associate with this connection. */
-        OVS_CT_ATTR_LABEL,      /* label to associate with this connection. */
+        OVS_CT_ATTR_LABELS,     /* labels to associate with this connection. */
        OVS_CT_ATTR_HELPER,     /* netlink helper to assist detection of
                                   related connections. */
        __OVS_CT_ATTR_MAX
@@ -641,14 +643,6 @@ enum ovs_ct_attr {
 #define OVS_CT_ATTR_MAX (__OVS_CT_ATTR_MAX - 1)
-/*
- * OVS_CT_ATTR_FLAGS flags - bitmask of %OVS_CT_F_*
- * @OVS_CT_F_COMMIT: Commits the flow to the conntrack table. This allows
- * future packets for the same connection to be identified as 'established'
- * or 'related'.
- */
-#define OVS_CT_F_COMMIT         0x01
 /**
 * enum ovs_action_attr - Action types.
 *
@@ -705,7 +699,7 @@ enum ovs_action_attr {
                                       * data immediately followed by a mask.
                                       * The data must be zero for the unmasked
                                       * bits. */
-        OVS_ACTION_ATTR_CT,           /* One nested OVS_CT_ATTR_* . */
+        OVS_ACTION_ATTR_CT,           /* Nested OVS_CT_ATTR_* . */
        __OVS_ACTION_ATTR_MAX,        /* Nothing past this will be accepted
                                       * from userspace. */
diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index 702024769c74..9d8f5d10c1e5 100644
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -160,7 +160,7 @@ struct rtattr {
 /* Macros to handle rtattributes */
-#define RTA_ALIGNTO     4
+#define RTA_ALIGNTO     4U
 #define RTA_ALIGN(len) ( ((len)+RTA_ALIGNTO-1) & ~(RTA_ALIGNTO-1) )
 #define RTA_OK(rta,len) ((len) >= (int)sizeof(struct rtattr) && \
                         (rta)->rta_len >= sizeof(struct rtattr) && \
diff --git a/kernel/kmod.c b/kernel/kmod.c
index da98d0593de2..0277d1216f80 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -327,9 +327,13 @@ static void call_usermodehelper_exec_work(struct work_struct *work)
                call_usermodehelper_exec_sync(sub_info);
        } else {
                pid_t pid;
+                /*
+                 * Use CLONE_PARENT to reparent it to kthreadd; we do not
+                 * want to pollute current->children, and we need a parent
+                 * that always ignores SIGCHLD to ensure auto-reaping.
+                 */
                pid = kernel_thread(call_usermodehelper_exec_async, sub_info,
-                                    SIGCHLD);
+                                    CLONE_PARENT | SIGCHLD);
                if (pid < 0) {
                        sub_info->retval = pid;
                        umh_complete(sub_info);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 10a8faa1b0d4..bcd214e4b4d6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2366,8 +2366,15 @@ void wake_up_new_task(struct task_struct *p)
        trace_sched_wakeup_new(p);
        check_preempt_curr(rq, p, WF_FORK);
 #ifdef CONFIG_SMP
-        if (p->sched_class->task_woken)
+        if (p->sched_class->task_woken) {
+                /*
+                 * Nothing relies on rq->lock after this, so its fine to
+                 * drop it.
+                 */
+                lockdep_unpin_lock(&rq->lock);
                p->sched_class->task_woken(rq, p);
+                lockdep_pin_lock(&rq->lock);
+        }
 #endif
        task_rq_unlock(rq, p, &flags);
 }
@@ -7238,9 +7245,6 @@ void __init sched_init_smp(void)
        alloc_cpumask_var(&non_isolated_cpus, GFP_KERNEL);
        alloc_cpumask_var(&fallback_doms, GFP_KERNEL);
-        /* nohz_full won't take effect without isolating the cpus. */
-        tick_nohz_full_add_cpus_to(cpu_isolated_map);
        sched_init_numa();
        /*
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index fc8f01083527..8b0a15e285f9 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -668,8 +668,15 @@ static enum hrtimer_restart dl_task_timer(struct hrtimer *timer)
         * Queueing this task back might have overloaded rq, check if we need
         * to kick someone away.
         */
-        if (has_pushable_dl_tasks(rq))
+        if (has_pushable_dl_tasks(rq)) {
+                /*
+                 * Nothing relies on rq->lock after this, so its safe to drop
+                 * rq->lock.
+                 */
+                lockdep_unpin_lock(&rq->lock);
                push_dl_task(rq);
+                lockdep_pin_lock(&rq->lock);
+        }
 #endif
 unlock:
@@ -1066,8 +1073,9 @@ select_task_rq_dl(struct task_struct *p, int cpu, int sd_flag, int flags)
                int target = find_later_rq(p);
                if (target != -1 &&
-                                dl_time_before(p->dl.deadline,
+                                (dl_time_before(p->dl.deadline,
-                                        cpu_rq(target)->dl.earliest_dl.curr))
+                                        cpu_rq(target)->dl.earliest_dl.curr) ||
+                                (cpu_rq(target)->dl.dl_nr_running == 0)))
                        cpu = target;
        }
        rcu_read_unlock();
@@ -1417,7 +1425,8 @@ static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq)
                later_rq = cpu_rq(cpu);
-                if (!dl_time_before(task->dl.deadline,
+                if (later_rq->dl.dl_nr_running &&
+                    !dl_time_before(task->dl.deadline,
                                        later_rq->dl.earliest_dl.curr)) {
                        /*
                         * Target rq has tasks of equal or earlier deadline,
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 6e2e3483b1ec..9a5e60fe721a 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2363,7 +2363,7 @@ static inline long calc_tg_weight(struct task_group *tg, struct cfs_rq *cfs_rq)
         */
        tg_weight = atomic_long_read(&tg->load_avg);
        tg_weight -= cfs_rq->tg_load_avg_contrib;
-        tg_weight += cfs_rq_load_avg(cfs_rq);
+        tg_weight += cfs_rq->load.weight;
        return tg_weight;
 }
@@ -2373,7 +2373,7 @@ static long calc_cfs_shares(struct cfs_rq *cfs_rq, struct task_group *tg)
        long tg_weight, load, shares;
        tg_weight = calc_tg_weight(tg, cfs_rq);
-        load = cfs_rq_load_avg(cfs_rq);
+        load = cfs_rq->load.weight;
        shares = (tg->shares * load);
        if (tg_weight)
@@ -2664,13 +2664,14 @@ static inline u64 cfs_rq_clock_task(struct cfs_rq *cfs_rq);
 /* Group cfs_rq's load_avg is used for task_h_load and update_cfs_share */
 static inline int update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq)
 {
-        int decayed;
        struct sched_avg *sa = &cfs_rq->avg;
+        int decayed, removed = 0;
        if (atomic_long_read(&cfs_rq->removed_load_avg)) {
                long r = atomic_long_xchg(&cfs_rq->removed_load_avg, 0);
                sa->load_avg = max_t(long, sa->load_avg - r, 0);
                sa->load_sum = max_t(s64, sa->load_sum - r * LOAD_AVG_MAX, 0);
+                removed = 1;
        }
        if (atomic_long_read(&cfs_rq->removed_util_avg)) {
@@ -2688,7 +2689,7 @@ static inline int update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq)
        cfs_rq->load_last_update_time_copy = sa->last_update_time;
 #endif
-        return decayed;
+        return decayed || removed;
 }
 /* Update task and its cfs_rq load average */
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index 8f177c73ae19..4a2ef5a02fd3 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -57,9 +57,11 @@ static inline int cpu_idle_poll(void)
        rcu_idle_enter();
        trace_cpu_idle_rcuidle(0, smp_processor_id());
        local_irq_enable();
+        stop_critical_timings();
        while (!tif_need_resched() &&
                (cpu_idle_force_poll || tick_check_broadcast_expired()))
                cpu_relax();
+        start_critical_timings();
        trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id());
        rcu_idle_exit();
        return 1;
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index b746399ab59c..8abf1ba18085 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -85,9 +85,19 @@ check_stack(unsigned long ip, unsigned long *stack)
        if (!object_is_on_stack(stack))
                return;
+        /* Can't do this from NMI context (can cause deadlocks) */
+        if (in_nmi())
+                return;
        local_irq_save(flags);
        arch_spin_lock(&max_stack_lock);
+        /*
+         * RCU may not be watching, make it see us.
+         * The stack trace code uses rcu_sched.
+         */
+        rcu_irq_enter();
        /* In case another CPU set the tracer_frame on us */
        if (unlikely(!frame_size))
                this_size -= tracer_frame;
@@ -169,6 +179,7 @@ check_stack(unsigned long ip, unsigned long *stack)
        }
 out:
+        rcu_irq_exit();
        arch_spin_unlock(&max_stack_lock);
        local_irq_restore(flags);
 }
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index ab76b99adc85..1d1521c26302 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -197,6 +197,7 @@ config ENABLE_MUST_CHECK
 config FRAME_WARN
        int "Warn for stack frames larger than (needs gcc 4.4)"
        range 0 8192
+        default 0 if KASAN
        default 1024 if !64BIT
        default 2048 if 64BIT
        help
diff --git a/lib/fault-inject.c b/lib/fault-inject.c
index f1cdeb024d17..6a823a53e357 100644
--- a/lib/fault-inject.c
+++ b/lib/fault-inject.c
@@ -44,7 +44,7 @@ static void fail_dump(struct fault_attr *attr)
                printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n"
                       "name %pd, interval %lu, probability %lu, "
                       "space %d, times %d\n", attr->dname,
-                       attr->probability, attr->interval,
+                       attr->interval, attr->probability,
                       atomic_read(&attr->space),
                       atomic_read(&attr->times));
                if (attr->verbose > 1)
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 2df8ddcb0ca0..619984fc07ec 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -480,6 +480,10 @@ static void cgwb_release_workfn(struct work_struct *work)
                                                release_work);
        struct backing_dev_info *bdi = wb->bdi;
+        spin_lock_irq(&cgwb_lock);
+        list_del_rcu(&wb->bdi_node);
+        spin_unlock_irq(&cgwb_lock);
        wb_shutdown(wb);
        css_put(wb->memcg_css);
@@ -575,6 +579,7 @@ static int cgwb_create(struct backing_dev_info *bdi,
                ret = radix_tree_insert(&bdi->cgwb_tree, memcg_css->id, wb);
                if (!ret) {
                        atomic_inc(&bdi->usage_cnt);
+                        list_add_tail_rcu(&wb->bdi_node, &bdi->wb_list);
                        list_add(&wb->memcg_node, memcg_cgwb_list);
                        list_add(&wb->blkcg_node, blkcg_cgwb_list);
                        css_get(memcg_css);
@@ -676,7 +681,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
 static void cgwb_bdi_destroy(struct backing_dev_info *bdi)
 {
        struct radix_tree_iter iter;
-        struct bdi_writeback_congested *congested, *congested_n;
+        struct rb_node *rbn;
        void **slot;
        WARN_ON(test_bit(WB_registered, &bdi->wb.state));
@@ -686,9 +691,11 @@ static void cgwb_bdi_destroy(struct backing_dev_info *bdi)
        radix_tree_for_each_slot(slot, &bdi->cgwb_tree, &iter, 0)
                cgwb_kill(*slot);
-        rbtree_postorder_for_each_entry_safe(congested, congested_n,
+        while ((rbn = rb_first(&bdi->cgwb_congested_tree))) {
-                                        &bdi->cgwb_congested_tree, rb_node) {
+                struct bdi_writeback_congested *congested =
-                rb_erase(&congested->rb_node, &bdi->cgwb_congested_tree);
+                        rb_entry(rbn, struct bdi_writeback_congested, rb_node);
+                rb_erase(rbn, &bdi->cgwb_congested_tree);
                congested->bdi = NULL;  /* mark @congested unlinked */
        }
@@ -764,15 +771,22 @@ static void cgwb_bdi_destroy(struct backing_dev_info *bdi) { }
 int bdi_init(struct backing_dev_info *bdi)
 {
+        int ret;
        bdi->dev = NULL;
        bdi->min_ratio = 0;
        bdi->max_ratio = 100;
        bdi->max_prop_frac = FPROP_FRAC_BASE;
        INIT_LIST_HEAD(&bdi->bdi_list);
+        INIT_LIST_HEAD(&bdi->wb_list);
        init_waitqueue_head(&bdi->wb_waitq);
-        return cgwb_bdi_init(bdi);
+        ret = cgwb_bdi_init(bdi);
+        list_add_tail_rcu(&bdi->wb.bdi_node, &bdi->wb_list);
+        return ret;
 }
 EXPORT_SYMBOL(bdi_init);
@@ -823,7 +837,7 @@ static void bdi_remove_from_list(struct backing_dev_info *bdi)
        synchronize_rcu_expedited();
 }
-void bdi_destroy(struct backing_dev_info *bdi)
+void bdi_unregister(struct backing_dev_info *bdi)
 {
        /* make sure nobody finds us on the bdi_list anymore */
        bdi_remove_from_list(bdi);
@@ -835,9 +849,19 @@ void bdi_destroy(struct backing_dev_info *bdi)
                device_unregister(bdi->dev);
                bdi->dev = NULL;
        }
+}
+void bdi_exit(struct backing_dev_info *bdi)
+{
+        WARN_ON_ONCE(bdi->dev);
        wb_exit(&bdi->wb);
 }
+void bdi_destroy(struct backing_dev_info *bdi)
+{
+        bdi_unregister(bdi);
+        bdi_exit(bdi);
+}
 EXPORT_SYMBOL(bdi_destroy);
 /*
diff --git a/mm/cma.c b/mm/cma.c
index e7d1db533025..4eb56badf37e 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -361,7 +361,7 @@ err:
 * This function allocates part of contiguous memory on specific
 * contiguous memory area.
 */
-struct page *cma_alloc(struct cma *cma, unsigned int count, unsigned int align)
+struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align)
 {
        unsigned long mask, offset, pfn, start = 0;
        unsigned long bitmap_maxno, bitmap_no, bitmap_count;
@@ -371,7 +371,7 @@ struct page *cma_alloc(struct cma *cma, unsigned int count, unsigned int align)
        if (!cma || !cma->count)
                return NULL;
-        pr_debug("%s(cma %p, count %d, align %d)\n", __func__, (void *)cma,
+        pr_debug("%s(cma %p, count %zu, align %d)\n", __func__, (void *)cma,
                 count, align);
        if (!count)
diff --git a/mm/filemap.c b/mm/filemap.c
index 1cc5467cf36c..327910c2400c 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2488,6 +2488,11 @@ again:
                        break;
                }
+                if (fatal_signal_pending(current)) {
+                        status = -EINTR;
+                        break;
+                }
                status = a_ops->write_begin(file, mapping, pos, bytes, flags,
                                                &page, &fsdata);
                if (unlikely(status < 0))
@@ -2525,10 +2530,6 @@ again:
                written += copied;
                balance_dirty_pages_ratelimited(mapping);
-                if (fatal_signal_pending(current)) {
-                        status = -EINTR;
-                        break;
-                }
        } while (iov_iter_count(i));
        return written ? written : status;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 4b06b8db9df2..bbac913f96bc 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2206,7 +2206,8 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
        for (_pte = pte; _pte < pte+HPAGE_PMD_NR;
             _pte++, address += PAGE_SIZE) {
                pte_t pteval = *_pte;
-                if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) {
+                if (pte_none(pteval) || (pte_present(pteval) &&
+                                is_zero_pfn(pte_pfn(pteval)))) {
                        if (!userfaultfd_armed(vma) &&
                            ++none_or_zero <= khugepaged_max_ptes_none)
                                continue;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index d9b5c817dce8..c57c4423c688 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3741,44 +3741,43 @@ struct wb_domain *mem_cgroup_wb_domain(struct bdi_writeback *wb)
 /**
 * mem_cgroup_wb_stats - retrieve writeback related stats from its memcg
 * @wb: bdi_writeback in question
- * @pavail: out parameter for number of available pages
+ * @pfilepages: out parameter for number of file pages
+ * @pheadroom: out parameter for number of allocatable pages according to memcg
 * @pdirty: out parameter for number of dirty pages
 * @pwriteback: out parameter for number of pages under writeback
 *
- * Determine the numbers of available, dirty, and writeback pages in @wb's
+ * Determine the numbers of file, headroom, dirty, and writeback pages in
- * memcg.  Dirty and writeback are self-explanatory.  Available is a bit
+ * @wb's memcg.  File, dirty and writeback are self-explanatory.  Headroom
- * more involved.
+ * is a bit more involved.
 *
- * A memcg's headroom is "min(max, high) - used".  The available memory is
+ * A memcg's headroom is "min(max, high) - used".  In the hierarchy, the
- * calculated as the lowest headroom of itself and the ancestors plus the
+ * headroom is calculated as the lowest headroom of itself and the
- * number of pages already being used for file pages.  Note that this
+ * ancestors.  Note that this doesn't consider the actual amount of
- * doesn't consider the actual amount of available memory in the system.
+ * available memory in the system.  The caller should further cap
- * The caller should further cap *@pavail accordingly.
+ * *@pheadroom accordingly.
 */
-void mem_cgroup_wb_stats(struct bdi_writeback *wb, unsigned long *pavail,
+void mem_cgroup_wb_stats(struct bdi_writeback *wb, unsigned long *pfilepages,
-                         unsigned long *pdirty, unsigned long *pwriteback)
+                         unsigned long *pheadroom, unsigned long *pdirty,
+                         unsigned long *pwriteback)
 {
        struct mem_cgroup *memcg = mem_cgroup_from_css(wb->memcg_css);
        struct mem_cgroup *parent;
-        unsigned long head_room = PAGE_COUNTER_MAX;
-        unsigned long file_pages;
        *pdirty = mem_cgroup_read_stat(memcg, MEM_CGROUP_STAT_DIRTY);
        /* this should eventually include NR_UNSTABLE_NFS */
        *pwriteback = mem_cgroup_read_stat(memcg, MEM_CGROUP_STAT_WRITEBACK);
+        *pfilepages = mem_cgroup_nr_lru_pages(memcg, (1 << LRU_INACTIVE_FILE) |
+                                                     (1 << LRU_ACTIVE_FILE));
+        *pheadroom = PAGE_COUNTER_MAX;
-        file_pages = mem_cgroup_nr_lru_pages(memcg, (1 << LRU_INACTIVE_FILE) |
-                                                    (1 << LRU_ACTIVE_FILE));
        while ((parent = parent_mem_cgroup(memcg))) {
                unsigned long ceiling = min(memcg->memory.limit, memcg->high);
                unsigned long used = page_counter_read(&memcg->memory);
-                head_room = min(head_room, ceiling - min(ceiling, used));
+                *pheadroom = min(*pheadroom, ceiling - min(ceiling, used));
                memcg = parent;
        }
-        *pavail = file_pages + head_room;
 }
 #else   /* CONFIG_CGROUP_WRITEBACK */
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 0a931cdd4f6b..2c90357c34ea 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -145,9 +145,6 @@ struct dirty_throttle_control {
        unsigned long           pos_ratio;
 };
-#define DTC_INIT_COMMON(__wb)   .wb = (__wb),                           \
-                                .wb_completions = &(__wb)->completions
 /*
 * Length of period for aging writeout fractions of bdis. This is an
 * arbitrarily chosen number. The longer the period, the slower fractions will
@@ -157,12 +154,16 @@ struct dirty_throttle_control {
 #ifdef CONFIG_CGROUP_WRITEBACK
-#define GDTC_INIT(__wb)         .dom = &global_wb_domain,               \
+#define GDTC_INIT(__wb)         .wb = (__wb),                           \
-                                DTC_INIT_COMMON(__wb)
+                                .dom = &global_wb_domain,               \
+                                .wb_completions = &(__wb)->completions
 #define GDTC_INIT_NO_WB         .dom = &global_wb_domain
-#define MDTC_INIT(__wb, __gdtc) .dom = mem_cgroup_wb_domain(__wb),      \
-                                .gdtc = __gdtc,                         \
+#define MDTC_INIT(__wb, __gdtc) .wb = (__wb),                           \
-                                DTC_INIT_COMMON(__wb)
+                                .dom = mem_cgroup_wb_domain(__wb),      \
+                                .wb_completions = &(__wb)->memcg_completions, \
+                                .gdtc = __gdtc
 static bool mdtc_valid(struct dirty_throttle_control *dtc)
 {
@@ -213,7 +214,8 @@ static void wb_min_max_ratio(struct bdi_writeback *wb,
 #else   /* CONFIG_CGROUP_WRITEBACK */
-#define GDTC_INIT(__wb)         DTC_INIT_COMMON(__wb)
+#define GDTC_INIT(__wb)         .wb = (__wb),                           \
+                                .wb_completions = &(__wb)->completions
 #define GDTC_INIT_NO_WB
 #define MDTC_INIT(__wb, __gdtc)
@@ -682,13 +684,19 @@ static unsigned long hard_dirty_limit(struct wb_domain *dom,
        return max(thresh, dom->dirty_limit);
 }
-/* memory available to a memcg domain is capped by system-wide clean memory */
+/*
-static void mdtc_cap_avail(struct dirty_throttle_control *mdtc)
+ * Memory which can be further allocated to a memcg domain is capped by
+ * system-wide clean memory excluding the amount being used in the domain.
+ */
+static void mdtc_calc_avail(struct dirty_throttle_control *mdtc,
+                            unsigned long filepages, unsigned long headroom)
 {
        struct dirty_throttle_control *gdtc = mdtc_gdtc(mdtc);
-        unsigned long clean = gdtc->avail - min(gdtc->avail, gdtc->dirty);
+        unsigned long clean = filepages - min(filepages, mdtc->dirty);
+        unsigned long global_clean = gdtc->avail - min(gdtc->avail, gdtc->dirty);
+        unsigned long other_clean = global_clean - min(global_clean, clean);
-        mdtc->avail = min(mdtc->avail, clean);
+        mdtc->avail = filepages + min(headroom, other_clean);
 }
 /**
@@ -1562,16 +1570,16 @@ static void balance_dirty_pages(struct address_space *mapping,
                }
                if (mdtc) {
-                        unsigned long writeback;
+                        unsigned long filepages, headroom, writeback;
                        /*
                         * If @wb belongs to !root memcg, repeat the same
                         * basic calculations for the memcg domain.
                         */
-                        mem_cgroup_wb_stats(wb, &mdtc->avail, &mdtc->dirty,
+                        mem_cgroup_wb_stats(wb, &filepages, &headroom,
-                                            &writeback);
+                                            &mdtc->dirty, &writeback);
-                        mdtc_cap_avail(mdtc);
                        mdtc->dirty += writeback;
+                        mdtc_calc_avail(mdtc, filepages, headroom);
                        domain_dirty_limits(mdtc);
@@ -1893,10 +1901,11 @@ bool wb_over_bg_thresh(struct bdi_writeback *wb)
                return true;
        if (mdtc) {
-                unsigned long writeback;
+                unsigned long filepages, headroom, writeback;
-                mem_cgroup_wb_stats(wb, &mdtc->avail, &mdtc->dirty, &writeback);
+                mem_cgroup_wb_stats(wb, &filepages, &headroom, &mdtc->dirty,
-                mdtc_cap_avail(mdtc);
+                                    &writeback);
+                mdtc_calc_avail(mdtc, filepages, headroom);
                domain_dirty_limits(mdtc);      /* ditto, ignore writeback */
                if (mdtc->dirty > mdtc->bg_thresh)
@@ -1956,7 +1965,6 @@ void laptop_mode_timer_fn(unsigned long data)
        int nr_pages = global_page_state(NR_FILE_DIRTY) +
                global_page_state(NR_UNSTABLE_NFS);
        struct bdi_writeback *wb;
-        struct wb_iter iter;
        /*
         * We want to write everything out, not just down to the dirty
@@ -1965,10 +1973,12 @@ void laptop_mode_timer_fn(unsigned long data)
        if (!bdi_has_dirty_io(&q->backing_dev_info))
                return;
-        bdi_for_each_wb(wb, &q->backing_dev_info, &iter, 0)
+        rcu_read_lock();
+        list_for_each_entry_rcu(wb, &q->backing_dev_info.wb_list, bdi_node)
                if (wb_has_dirty_io(wb))
                        wb_start_writeback(wb, nr_pages, true,
                                           WB_REASON_LAPTOP_TIMER);
+        rcu_read_unlock();
 }
 /*
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b4548c739a64..2dda439c8cb8 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -91,10 +91,50 @@ static void hci_connect_le_scan_cleanup(struct hci_conn *conn)
         * autoconnect action, remove them completely. If they are, just unmark
         * them as waiting for connection, by clearing explicit_connect field.
         */
-        if (params->auto_connect == HCI_AUTO_CONN_EXPLICIT)
+        params->explicit_connect = false;
+        list_del_init(&params->action);
+        switch (params->auto_connect) {
+        case HCI_AUTO_CONN_EXPLICIT:
                hci_conn_params_del(conn->hdev, bdaddr, bdaddr_type);
-        else
+                /* return instead of break to avoid duplicate scan update */
-                params->explicit_connect = false;
+                return;
+        case HCI_AUTO_CONN_DIRECT:
+        case HCI_AUTO_CONN_ALWAYS:
+                list_add(&params->action, &conn->hdev->pend_le_conns);
+                break;
+        case HCI_AUTO_CONN_REPORT:
+                list_add(&params->action, &conn->hdev->pend_le_reports);
+                break;
+        default:
+                break;
+        }
+        hci_update_background_scan(conn->hdev);
+}
+static void hci_conn_cleanup(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
+                hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
+        hci_chan_list_flush(conn);
+        hci_conn_hash_del(hdev, conn);
+        if (hdev->notify)
+                hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
+        hci_conn_del_sysfs(conn);
+        debugfs_remove_recursive(conn->debugfs);
+        hci_dev_put(hdev);
+        hci_conn_put(conn);
 }
 /* This function requires the caller holds hdev->lock */
@@ -102,8 +142,13 @@ static void hci_connect_le_scan_remove(struct hci_conn *conn)
 {
        hci_connect_le_scan_cleanup(conn);
-        hci_conn_hash_del(conn->hdev, conn);
+        /* We can't call hci_conn_del here since that would deadlock
-        hci_update_background_scan(conn->hdev);
+         * with trying to call cancel_delayed_work_sync(&conn->disc_work).
+         * Instead, call just hci_conn_cleanup() which contains the bare
+         * minimum cleanup operations needed for a connection in this
+         * state.
+         */
+        hci_conn_cleanup(conn);
 }
 static void hci_acl_create_connection(struct hci_conn *conn)
@@ -581,27 +626,17 @@ int hci_conn_del(struct hci_conn *conn)
                }
        }
-        hci_chan_list_flush(conn);
        if (conn->amp_mgr)
                amp_mgr_put(conn->amp_mgr);
-        hci_conn_hash_del(hdev, conn);
-        if (hdev->notify)
-                hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
        skb_queue_purge(&conn->data_q);
-        hci_conn_del_sysfs(conn);
+        /* Remove the connection from the list and cleanup its remaining
+         * state. This is a separate function since for some cases like
-        debugfs_remove_recursive(conn->debugfs);
+         * BT_CONNECT_SCAN we *only* want the cleanup part without the
+         * rest of hci_conn_del.
-        if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
+         */
-                hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
+        hci_conn_cleanup(conn);
-        hci_dev_put(hdev);
-        hci_conn_put(conn);
        return 0;
 }
@@ -973,15 +1008,23 @@ static int hci_explicit_conn_params_set(struct hci_request *req,
        if (is_connected(hdev, addr, addr_type))
                return -EISCONN;
-        params = hci_conn_params_add(hdev, addr, addr_type);
+        params = hci_conn_params_lookup(hdev, addr, addr_type);
-        if (!params)
+        if (!params) {
-                return -EIO;
+                params = hci_conn_params_add(hdev, addr, addr_type);
+                if (!params)
+                        return -ENOMEM;
-        /* If we created new params, or existing params were marked as disabled,
+                /* If we created new params, mark them to be deleted in
-         * mark them to be used just once to connect.
+                 * hci_connect_le_scan_cleanup. It's different case than
-         */
+                 * existing disabled params, those will stay after cleanup.
-        if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
+                 */
                params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
+        }
+        /* We're trying to connect, so make sure params are at pend_le_conns */
+        if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
+            params->auto_connect == HCI_AUTO_CONN_REPORT ||
+            params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
                list_del_init(&params->action);
                list_add(&params->action, &hdev->pend_le_conns);
        }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index adcbc74c2432..e837539452fb 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2861,13 +2861,6 @@ struct hci_conn_params *hci_explicit_connect_lookup(struct hci_dev *hdev,
                        return param;
        }
-        list_for_each_entry(param, &hdev->pend_le_reports, action) {
-                if (bacmp(&param->addr, addr) == 0 &&
-                    param->addr_type == addr_type &&
-                    param->explicit_connect)
-                        return param;
-        }
        return NULL;
 }
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 186041866315..bc31099d3b5b 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -55,7 +55,12 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
        wake_up_bit(&hdev->flags, HCI_INQUIRY);
        hci_dev_lock(hdev);
-        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+        /* Set discovery state to stopped if we're not doing LE active
+         * scanning.
+         */
+        if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
+            hdev->le_scan_type != LE_SCAN_ACTIVE)
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
        hci_dev_unlock(hdev);
        hci_conn_check_pending(hdev);
@@ -4648,8 +4653,8 @@ static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
        /* If we're not connectable only connect devices that we have in
         * our pend_le_conns list.
         */
-        params = hci_explicit_connect_lookup(hdev, addr, addr_type);
+        params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
+                                           addr_type);
        if (!params)
                return NULL;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index ccaf5a436d8f..c4fe2fee753f 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -3545,6 +3545,7 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                                       auth_type);
        } else {
                u8 addr_type;
+                struct hci_conn_params *p;
                /* Convert from L2CAP channel address type to HCI address type
                 */
@@ -3562,7 +3563,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                 * If connection parameters already exist, then they
                 * will be kept and this function does nothing.
                 */
-                hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
+                p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
+                if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
+                        p->auto_connect = HCI_AUTO_CONN_DISABLED;
                conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
                                           addr_type, sec_level,
@@ -6117,14 +6121,21 @@ static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
                __hci_update_background_scan(req);
                break;
        case HCI_AUTO_CONN_REPORT:
-                list_add(&params->action, &hdev->pend_le_reports);
+                if (params->explicit_connect)
+                        list_add(&params->action, &hdev->pend_le_conns);
+                else
+                        list_add(&params->action, &hdev->pend_le_reports);
                __hci_update_background_scan(req);
                break;
        case HCI_AUTO_CONN_DIRECT:
        case HCI_AUTO_CONN_ALWAYS:
                if (!is_connected(hdev, addr, addr_type)) {
                        list_add(&params->action, &hdev->pend_le_conns);
-                        __hci_update_background_scan(req);
+                        /* If we are in scan phase of connecting, we were
+                         * already added to pend_le_conns and scanning.
+                         */
+                        if (params->auto_connect != HCI_AUTO_CONN_EXPLICIT)
+                                __hci_update_background_scan(req);
                }
                break;
        }
@@ -6379,7 +6390,8 @@ static int remove_device(struct sock *sk, struct hci_dev *hdev,
                        goto unlock;
                }
-                if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
+                if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
+                    params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
                        err = cmd->cmd_complete(cmd,
                                                MGMT_STATUS_INVALID_PARAMS);
                        mgmt_pending_remove(cmd);
@@ -6415,6 +6427,10 @@ static int remove_device(struct sock *sk, struct hci_dev *hdev,
                        if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
                                continue;
                        device_removed(sk, hdev, &p->addr, p->addr_type);
+                        if (p->explicit_connect) {
+                                p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
+                                continue;
+                        }
                        list_del(&p->action);
                        list_del(&p->list);
                        kfree(p);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index b495ab1797fa..29edf74846fc 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1284,7 +1284,7 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr)
        gstrings.len = ret;
-        data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
+        data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER);
        if (!data)
                return -ENOMEM;
diff --git a/net/core/filter.c b/net/core/filter.c
index 05a04ea87172..bb18c3680001 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1415,6 +1415,7 @@ static u64 bpf_clone_redirect(u64 r1, u64 ifindex, u64 flags, u64 r4, u64 r5)
                return dev_forward_skb(dev, skb2);
        skb2->dev = dev;
+        skb_sender_cpu_clear(skb2);
        return dev_queue_xmit(skb2);
 }
@@ -1854,9 +1855,13 @@ int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf,
                goto out;
        /* We're copying the filter that has been originally attached,
-         * so no conversion/decode needed anymore.
+         * so no conversion/decode needed anymore. eBPF programs that
+         * have no original program cannot be dumped through this.
         */
+        ret = -EACCES;
        fprog = filter->prog->orig_prog;
+        if (!fprog)
+                goto out;
        ret = fprog->len;
        if (!len)
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index c59fa5d9c22c..adb5325f4934 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -22,6 +22,7 @@
 #include <linux/of_platform.h>
 #include <linux/of_net.h>
 #include <linux/sysfs.h>
+#include <linux/phy_fixed.h>
 #include "dsa_priv.h"
 char dsa_driver_version[] = "0.1";
@@ -305,7 +306,7 @@ static int dsa_switch_setup_one(struct dsa_switch *ds, struct device *parent)
        if (ret < 0)
                goto out;
-        ds->slave_mii_bus = mdiobus_alloc();
+        ds->slave_mii_bus = devm_mdiobus_alloc(parent);
        if (ds->slave_mii_bus == NULL) {
                ret = -ENOMEM;
                goto out;
@@ -314,7 +315,7 @@ static int dsa_switch_setup_one(struct dsa_switch *ds, struct device *parent)
        ret = mdiobus_register(ds->slave_mii_bus);
        if (ret < 0)
-                goto out_free;
+                goto out;
        /*
@@ -367,10 +368,7 @@ static int dsa_switch_setup_one(struct dsa_switch *ds, struct device *parent)
        return ret;
-out_free:
-        mdiobus_free(ds->slave_mii_bus);
 out:
-        kfree(ds);
        return ret;
 }
@@ -400,7 +398,7 @@ dsa_switch_setup(struct dsa_switch_tree *dst, int index,
        /*
         * Allocate and initialise switch state.
         */
-        ds = kzalloc(sizeof(*ds) + drv->priv_size, GFP_KERNEL);
+        ds = devm_kzalloc(parent, sizeof(*ds) + drv->priv_size, GFP_KERNEL);
        if (ds == NULL)
                return ERR_PTR(-ENOMEM);
@@ -420,10 +418,47 @@ dsa_switch_setup(struct dsa_switch_tree *dst, int index,
 static void dsa_switch_destroy(struct dsa_switch *ds)
 {
+        struct device_node *port_dn;
+        struct phy_device *phydev;
+        struct dsa_chip_data *cd = ds->pd;
+        int port;
 #ifdef CONFIG_NET_DSA_HWMON
        if (ds->hwmon_dev)
                hwmon_device_unregister(ds->hwmon_dev);
 #endif
+        /* Disable configuration of the CPU and DSA ports */
+        for (port = 0; port < DSA_MAX_PORTS; port++) {
+                if (!(dsa_is_cpu_port(ds, port) || dsa_is_dsa_port(ds, port)))
+                        continue;
+                port_dn = cd->port_dn[port];
+                if (of_phy_is_fixed_link(port_dn)) {
+                        phydev = of_phy_find_device(port_dn);
+                        if (phydev) {
+                                int addr = phydev->addr;
+                                phy_device_free(phydev);
+                                of_node_put(port_dn);
+                                fixed_phy_del(addr);
+                        }
+                }
+        }
+        /* Destroy network devices for physical switch ports. */
+        for (port = 0; port < DSA_MAX_PORTS; port++) {
+                if (!(ds->phys_port_mask & (1 << port)))
+                        continue;
+                if (!ds->ports[port])
+                        continue;
+                unregister_netdev(ds->ports[port]);
+                free_netdev(ds->ports[port]);
+        }
+        mdiobus_unregister(ds->slave_mii_bus);
 }
 #ifdef CONFIG_PM_SLEEP
@@ -802,10 +837,11 @@ static inline void dsa_of_remove(struct device *dev)
 }
 #endif
-static void dsa_setup_dst(struct dsa_switch_tree *dst, struct net_device *dev,
+static int dsa_setup_dst(struct dsa_switch_tree *dst, struct net_device *dev,
-                          struct device *parent, struct dsa_platform_data *pd)
+                         struct device *parent, struct dsa_platform_data *pd)
 {
        int i;
+        unsigned configured = 0;
        dst->pd = pd;
        dst->master_netdev = dev;
@@ -825,9 +861,17 @@ static void dsa_setup_dst(struct dsa_switch_tree *dst, struct net_device *dev,
                dst->ds[i] = ds;
                if (ds->drv->poll_link != NULL)
                        dst->link_poll_needed = 1;
+                ++configured;
        }
        /*
+         * If no switch was found, exit cleanly
+         */
+        if (!configured)
+                return -EPROBE_DEFER;
+        /*
         * If we use a tagging format that doesn't have an ethertype
         * field, make sure that all packets from this point on get
         * sent to the tag format's receive function.
@@ -843,6 +887,8 @@ static void dsa_setup_dst(struct dsa_switch_tree *dst, struct net_device *dev,
                dst->link_poll_timer.expires = round_jiffies(jiffies + HZ);
                add_timer(&dst->link_poll_timer);
        }
+        return 0;
 }
 static int dsa_probe(struct platform_device *pdev)
@@ -883,7 +929,7 @@ static int dsa_probe(struct platform_device *pdev)
                goto out;
        }
-        dst = kzalloc(sizeof(*dst), GFP_KERNEL);
+        dst = devm_kzalloc(&pdev->dev, sizeof(*dst), GFP_KERNEL);
        if (dst == NULL) {
                dev_put(dev);
                ret = -ENOMEM;
@@ -892,7 +938,9 @@ static int dsa_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, dst);
-        dsa_setup_dst(dst, dev, &pdev->dev, pd);
+        ret = dsa_setup_dst(dst, dev, &pdev->dev, pd);
+        if (ret)
+                goto out;
        return 0;
@@ -914,7 +962,7 @@ static void dsa_remove_dst(struct dsa_switch_tree *dst)
        for (i = 0; i < dst->pd->nr_chips; i++) {
                struct dsa_switch *ds = dst->ds[i];
-                if (ds != NULL)
+                if (ds)
                        dsa_switch_destroy(ds);
        }
 }
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index f03db8b7abee..0c9c3482e419 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -312,7 +312,7 @@ static void arp_send_dst(int type, int ptype, __be32 dest_ip,
        if (!skb)
                return;
-        skb_dst_set(skb, dst);
+        skb_dst_set(skb, dst_clone(dst));
        arp_xmit(skb);
 }
@@ -384,7 +384,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
        }
        if (skb && !(dev->priv_flags & IFF_XMIT_DST_RELEASE))
-                dst = dst_clone(skb_dst(skb));
+                dst = skb_dst(skb);
        arp_send_dst(ARPOP_REQUEST, ETH_P_ARP, target, dev, saddr,
                     dst_hw, dev->dev_addr, NULL, dst);
 }
@@ -811,7 +811,7 @@ static int arp_process(struct sock *sk, struct sk_buff *skb)
                                } else {
                                        pneigh_enqueue(&arp_tbl,
                                                       in_dev->arp_parms, skb);
-                                        return 0;
+                                        goto out_free_dst;
                                }
                                goto out;
                        }
@@ -865,6 +865,8 @@ static int arp_process(struct sock *sk, struct sk_buff *skb)
 out:
        consume_skb(skb);
+out_free_dst:
+        dst_release(reply_dst);
        return 0;
 }
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 7bb9c39e0a4d..61b45a17fc73 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -577,21 +577,22 @@ EXPORT_SYMBOL(inet_rtx_syn_ack);
 static bool reqsk_queue_unlink(struct request_sock_queue *queue,
                               struct request_sock *req)
 {
-        struct listen_sock *lopt = queue->listen_opt;
        struct request_sock **prev;
+        struct listen_sock *lopt;
        bool found = false;
        spin_lock(&queue->syn_wait_lock);
+        lopt = queue->listen_opt;
-        for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL;
+        if (lopt) {
-             prev = &(*prev)->dl_next) {
+                for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL;
-                if (*prev == req) {
+                     prev = &(*prev)->dl_next) {
-                        *prev = req->dl_next;
+                        if (*prev == req) {
-                        found = true;
+                                *prev = req->dl_next;
-                        break;
+                                found = true;
+                                break;
+                        }
                }
        }
        spin_unlock(&queue->syn_wait_lock);
        if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer))
                reqsk_put(req);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 900113376d4e..36b85bd05ac8 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3119,6 +3119,8 @@ static void addrconf_gre_config(struct net_device *dev)
        }
        addrconf_addr_gen(idev, true);
+        if (dev->flags & IFF_POINTOPOINT)
+                addrconf_add_mroute(dev);
 }
 #endif
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 92b1aa38f121..61d403ee1031 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -376,6 +376,9 @@ int ip6_forward(struct sk_buff *skb)
        if (skb->pkt_type != PACKET_HOST)
                goto drop;
+        if (unlikely(skb->sk))
+                goto drop;
        if (skb_warn_if_lro(skb))
                goto drop;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index cb32ce250db0..968f31c01f89 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -142,6 +142,9 @@ static void rt6_uncached_list_flush_dev(struct net *net, struct net_device *dev)
        struct net_device *loopback_dev = net->loopback_dev;
        int cpu;
+        if (dev == loopback_dev)
+                return;
        for_each_possible_cpu(cpu) {
                struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu);
                struct rt6_info *rt;
@@ -151,14 +154,12 @@ static void rt6_uncached_list_flush_dev(struct net *net, struct net_device *dev)
                        struct inet6_dev *rt_idev = rt->rt6i_idev;
                        struct net_device *rt_dev = rt->dst.dev;
-                        if (rt_idev && (rt_idev->dev == dev || !dev) &&
+                        if (rt_idev->dev == dev) {
-                            rt_idev->dev != loopback_dev) {
                                rt->rt6i_idev = in6_dev_get(loopback_dev);
                                in6_dev_put(rt_idev);
                        }
-                        if (rt_dev && (rt_dev == dev || !dev) &&
+                        if (rt_dev == dev) {
-                            rt_dev != loopback_dev) {
                                rt->dst.dev = loopback_dev;
                                dev_hold(rt->dst.dev);
                                dev_put(rt_dev);
@@ -247,12 +248,6 @@ static void ip6_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
 {
 }
-static u32 *ip6_rt_blackhole_cow_metrics(struct dst_entry *dst,
-                                         unsigned long old)
-{
-        return NULL;
-}
 static struct dst_ops ip6_dst_blackhole_ops = {
        .family                 =       AF_INET6,
        .destroy                =       ip6_dst_destroy,
@@ -261,7 +256,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
        .default_advmss         =       ip6_default_advmss,
        .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
        .redirect               =       ip6_rt_blackhole_redirect,
-        .cow_metrics            =       ip6_rt_blackhole_cow_metrics,
+        .cow_metrics            =       dst_cow_metrics_generic,
        .neigh_lookup           =       ip6_neigh_lookup,
 };
@@ -318,6 +313,15 @@ static const struct rt6_info ip6_blk_hole_entry_template = {
 #endif
+static void rt6_info_init(struct rt6_info *rt)
+{
+        struct dst_entry *dst = &rt->dst;
+        memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
+        INIT_LIST_HEAD(&rt->rt6i_siblings);
+        INIT_LIST_HEAD(&rt->rt6i_uncached);
+}
 /* allocate dst with ip6_dst_ops */
 static struct rt6_info *__ip6_dst_alloc(struct net *net,
                                        struct net_device *dev,
@@ -326,13 +330,9 @@ static struct rt6_info *__ip6_dst_alloc(struct net *net,
        struct rt6_info *rt = dst_alloc(&net->ipv6.ip6_dst_ops, dev,
                                        0, DST_OBSOLETE_FORCE_CHK, flags);
-        if (rt) {
+        if (rt)
-                struct dst_entry *dst = &rt->dst;
+                rt6_info_init(rt);
-                memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
-                INIT_LIST_HEAD(&rt->rt6i_siblings);
-                INIT_LIST_HEAD(&rt->rt6i_uncached);
-        }
        return rt;
 }
@@ -1213,24 +1213,20 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
        rt = dst_alloc(&ip6_dst_blackhole_ops, ort->dst.dev, 1, DST_OBSOLETE_NONE, 0);
        if (rt) {
-                new = &rt->dst;
+                rt6_info_init(rt);
-                memset(new + 1, 0, sizeof(*rt) - sizeof(*new));
+                new = &rt->dst;
                new->__use = 1;
                new->input = dst_discard;
                new->output = dst_discard_sk;
-                if (dst_metrics_read_only(&ort->dst))
+                dst_copy_metrics(new, &ort->dst);
-                        new->_metrics = ort->dst._metrics;
-                else
-                        dst_copy_metrics(new, &ort->dst);
                rt->rt6i_idev = ort->rt6i_idev;
                if (rt->rt6i_idev)
                        in6_dev_hold(rt->rt6i_idev);
                rt->rt6i_gateway = ort->rt6i_gateway;
-                rt->rt6i_flags = ort->rt6i_flags;
+                rt->rt6i_flags = ort->rt6i_flags & ~RTF_PCPU;
                rt->rt6i_metric = 0;
                memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
@@ -2622,7 +2618,8 @@ void rt6_ifdown(struct net *net, struct net_device *dev)
        fib6_clean_all(net, fib6_ifdown, &adn);
        icmp6_clean_all(fib6_ifdown, &adn);
-        rt6_uncached_list_flush_dev(net, dev);
+        if (dev)
+                rt6_uncached_list_flush_dev(net, dev);
 }
 struct rt6_mtu_change_arg {
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 30caa289c5db..5cedfda4b241 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -37,6 +37,7 @@ static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,
        memset(&fl6, 0, sizeof(fl6));
        fl6.flowi6_oif = oif;
+        fl6.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF;
        memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
        if (saddr)
                memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index ced6bf3be8d6..1560c8482bcb 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -149,7 +149,7 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
        for (i = 0; i < NUM_IEEE80211_HW_FLAGS; i++) {
                if (test_bit(i, local->hw.flags))
-                        pos += scnprintf(pos, end - pos, "%s",
+                        pos += scnprintf(pos, end - pos, "%s\n",
                                         hw_flag_names[i]);
        }
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 8ba583243509..3ed7ddfbf8e8 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -101,6 +101,7 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
         * when it wakes up for the next time.
         */
        set_sta_flag(sta, WLAN_STA_CLEAR_PS_FILT);
+        ieee80211_clear_fast_xmit(sta);
        /*
         * This code races in the following way:
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 84e0e8c7fb23..7892eb8ed4c8 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1218,8 +1218,10 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
        if (!tx->sta)
                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
-        else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT))
+        else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT)) {
                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
+                ieee80211_check_fast_xmit(tx->sta);
+        }
        info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
@@ -2451,7 +2453,8 @@ void ieee80211_check_fast_xmit(struct sta_info *sta)
        if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
            test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
-            test_sta_flag(sta, WLAN_STA_PS_DELIVER))
+            test_sta_flag(sta, WLAN_STA_PS_DELIVER) ||
+            test_sta_flag(sta, WLAN_STA_CLEAR_PS_FILT))
                goto out;
        if (sdata->noack_map)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 8f060d7f9a0e..0a49a8c7c564 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2785,6 +2785,7 @@ static int netlink_dump(struct sock *sk)
        struct sk_buff *skb = NULL;
        struct nlmsghdr *nlh;
        int len, err = -ENOBUFS;
+        int alloc_min_size;
        int alloc_size;
        mutex_lock(nlk->cb_mutex);
@@ -2793,9 +2794,6 @@ static int netlink_dump(struct sock *sk)
                goto errout_skb;
        }
-        cb = &nlk->cb;
-        alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
        if (!netlink_rx_is_mmaped(sk) &&
            atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
                goto errout_skb;
@@ -2805,23 +2803,35 @@ static int netlink_dump(struct sock *sk)
         * to reduce number of system calls on dump operations, if user
         * ever provided a big enough buffer.
         */
-        if (alloc_size < nlk->max_recvmsg_len) {
+        cb = &nlk->cb;
-                skb = netlink_alloc_skb(sk,
+        alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
-                                        nlk->max_recvmsg_len,
-                                        nlk->portid,
+        if (alloc_min_size < nlk->max_recvmsg_len) {
+                alloc_size = nlk->max_recvmsg_len;
+                skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
                                        GFP_KERNEL |
                                        __GFP_NOWARN |
                                        __GFP_NORETRY);
-                /* available room should be exact amount to avoid MSG_TRUNC */
-                if (skb)
-                        skb_reserve(skb, skb_tailroom(skb) -
-                                         nlk->max_recvmsg_len);
        }
-        if (!skb)
+        if (!skb) {
+                alloc_size = alloc_min_size;
                skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
                                        GFP_KERNEL);
+        }
        if (!skb)
                goto errout_skb;
+        /* Trim skb to allocated size. User is expected to provide buffer as
+         * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at
+         * netlink_recvmsg())). dump will pack as many smaller messages as
+         * could fit within the allocated skb. skb is typically allocated
+         * with larger space than required (could be as much as near 2x the
+         * requested size with align to next power of 2 approach). Allowing
+         * dump to use the excess space makes it difficult for a user to have a
+         * reasonable static buffer based on the expected largest dump of a
+         * single netdev. The outcome is MSG_TRUNC error.
+         */
+        skb_reserve(skb, skb_tailroom(skb) - alloc_size);
        netlink_skb_set_owner_r(skb, sk);
        len = cb->dump(skb, cb);
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 315f5330b6e5..c6a39bf2c3b9 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -684,7 +684,7 @@ static void ovs_fragment(struct vport *vport, struct sk_buff *skb, u16 mru,
 {
        if (skb_network_offset(skb) > MAX_L2_LEN) {
                OVS_NLERR(1, "L2 header too long to fragment");
-                return;
+                goto err;
        }
        if (ethertype == htons(ETH_P_IP)) {
@@ -708,8 +708,7 @@ static void ovs_fragment(struct vport *vport, struct sk_buff *skb, u16 mru,
                struct rt6_info ovs_rt;
                if (!v6ops) {
-                        kfree_skb(skb);
+                        goto err;
-                        return;
                }
                prepare_frag(vport, skb);
@@ -728,8 +727,12 @@ static void ovs_fragment(struct vport *vport, struct sk_buff *skb, u16 mru,
                WARN_ONCE(1, "Failed fragment ->%s: eth=%04x, MRU=%d, MTU=%d.",
                          ovs_vport_name(vport), ntohs(ethertype), mru,
                          vport->dev->mtu);
-                kfree_skb(skb);
+                goto err;
        }
+        return;
+err:
+        kfree_skb(skb);
 }
 static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port,
@@ -968,7 +971,7 @@ static int execute_masked_set_action(struct sk_buff *skb,
        case OVS_KEY_ATTR_CT_STATE:
        case OVS_KEY_ATTR_CT_ZONE:
        case OVS_KEY_ATTR_CT_MARK:
-        case OVS_KEY_ATTR_CT_LABEL:
+        case OVS_KEY_ATTR_CT_LABELS:
                err = -EINVAL;
                break;
        }
@@ -1099,6 +1102,12 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
                        break;
                case OVS_ACTION_ATTR_CT:
+                        if (!is_flow_key_valid(key)) {
+                                err = ovs_flow_key_update(skb, key);
+                                if (err)
+                                        return err;
+                        }
                        err = ovs_ct_execute(ovs_dp_get_net(dp), skb, key,
                                             nla_data(a));
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 002a755fa07e..80bf702715bb 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -37,9 +37,9 @@ struct md_mark {
 };
 /* Metadata label for masked write to conntrack label. */
-struct md_label {
+struct md_labels {
-        struct ovs_key_ct_label value;
+        struct ovs_key_ct_labels value;
-        struct ovs_key_ct_label mask;
+        struct ovs_key_ct_labels mask;
 };
 /* Conntrack action context for execution. */
@@ -47,10 +47,10 @@ struct ovs_conntrack_info {
        struct nf_conntrack_helper *helper;
        struct nf_conntrack_zone zone;
        struct nf_conn *ct;
-        u32 flags;
+        u8 commit : 1;
        u16 family;
        struct md_mark mark;
-        struct md_label label;
+        struct md_labels labels;
 };
 static u16 key_to_nfproto(const struct sw_flow_key *key)
@@ -109,21 +109,21 @@ static u32 ovs_ct_get_mark(const struct nf_conn *ct)
 #endif
 }
-static void ovs_ct_get_label(const struct nf_conn *ct,
+static void ovs_ct_get_labels(const struct nf_conn *ct,
-                             struct ovs_key_ct_label *label)
+                              struct ovs_key_ct_labels *labels)
 {
        struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL;
        if (cl) {
                size_t len = cl->words * sizeof(long);
-                if (len > OVS_CT_LABEL_LEN)
+                if (len > OVS_CT_LABELS_LEN)
-                        len = OVS_CT_LABEL_LEN;
+                        len = OVS_CT_LABELS_LEN;
-                else if (len < OVS_CT_LABEL_LEN)
+                else if (len < OVS_CT_LABELS_LEN)
-                        memset(label, 0, OVS_CT_LABEL_LEN);
+                        memset(labels, 0, OVS_CT_LABELS_LEN);
-                memcpy(label, cl->bits, len);
+                memcpy(labels, cl->bits, len);
        } else {
-                memset(label, 0, OVS_CT_LABEL_LEN);
+                memset(labels, 0, OVS_CT_LABELS_LEN);
        }
 }
@@ -134,7 +134,7 @@ static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
        key->ct.state = state;
        key->ct.zone = zone->id;
        key->ct.mark = ovs_ct_get_mark(ct);
-        ovs_ct_get_label(ct, &key->ct.label);
+        ovs_ct_get_labels(ct, &key->ct.labels);
 }
 /* Update 'key' based on skb->nfct. If 'post_ct' is true, then OVS has
@@ -167,7 +167,7 @@ void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
 int ovs_ct_put_key(const struct sw_flow_key *key, struct sk_buff *skb)
 {
-        if (nla_put_u8(skb, OVS_KEY_ATTR_CT_STATE, key->ct.state))
+        if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, key->ct.state))
                return -EMSGSIZE;
        if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
@@ -179,8 +179,8 @@ int ovs_ct_put_key(const struct sw_flow_key *key, struct sk_buff *skb)
                return -EMSGSIZE;
        if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
-            nla_put(skb, OVS_KEY_ATTR_CT_LABEL, sizeof(key->ct.label),
+            nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(key->ct.labels),
-                    &key->ct.label))
+                    &key->ct.labels))
                return -EMSGSIZE;
        return 0;
@@ -213,9 +213,9 @@ static int ovs_ct_set_mark(struct sk_buff *skb, struct sw_flow_key *key,
 #endif
 }
-static int ovs_ct_set_label(struct sk_buff *skb, struct sw_flow_key *key,
+static int ovs_ct_set_labels(struct sk_buff *skb, struct sw_flow_key *key,
-                            const struct ovs_key_ct_label *label,
+                             const struct ovs_key_ct_labels *labels,
-                            const struct ovs_key_ct_label *mask)
+                             const struct ovs_key_ct_labels *mask)
 {
        enum ip_conntrack_info ctinfo;
        struct nf_conn_labels *cl;
@@ -235,15 +235,15 @@ static int ovs_ct_set_label(struct sk_buff *skb, struct sw_flow_key *key,
                nf_ct_labels_ext_add(ct);
                cl = nf_ct_labels_find(ct);
        }
-        if (!cl || cl->words * sizeof(long) < OVS_CT_LABEL_LEN)
+        if (!cl || cl->words * sizeof(long) < OVS_CT_LABELS_LEN)
                return -ENOSPC;
-        err = nf_connlabels_replace(ct, (u32 *)label, (u32 *)mask,
+        err = nf_connlabels_replace(ct, (u32 *)labels, (u32 *)mask,
-                                    OVS_CT_LABEL_LEN / sizeof(u32));
+                                    OVS_CT_LABELS_LEN / sizeof(u32));
        if (err)
                return err;
-        ovs_ct_get_label(ct, &key->ct.label);
+        ovs_ct_get_labels(ct, &key->ct.labels);
        return 0;
 }
@@ -465,12 +465,12 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
        return 0;
 }
-static bool label_nonzero(const struct ovs_key_ct_label *label)
+static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
 {
        size_t i;
-        for (i = 0; i < sizeof(*label); i++)
+        for (i = 0; i < sizeof(*labels); i++)
-                if (label->ct_label[i])
+                if (labels->ct_labels[i])
                        return true;
        return false;
@@ -493,7 +493,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
                        return err;
        }
-        if (info->flags & OVS_CT_F_COMMIT)
+        if (info->commit)
                err = ovs_ct_commit(net, key, info, skb);
        else
                err = ovs_ct_lookup(net, key, info, skb);
@@ -506,9 +506,9 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
                if (err)
                        goto err;
        }
-        if (label_nonzero(&info->label.mask))
+        if (labels_nonzero(&info->labels.mask))
-                err = ovs_ct_set_label(skb, key, &info->label.value,
+                err = ovs_ct_set_labels(skb, key, &info->labels.value,
-                                       &info->label.mask);
+                                        &info->labels.mask);
 err:
        skb_push(skb, nh_ofs);
        return err;
@@ -539,14 +539,13 @@ static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
 }
 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
-        [OVS_CT_ATTR_FLAGS]     = { .minlen = sizeof(u32),
+        [OVS_CT_ATTR_COMMIT]    = { .minlen = 0, .maxlen = 0 },
-                                    .maxlen = sizeof(u32) },
        [OVS_CT_ATTR_ZONE]      = { .minlen = sizeof(u16),
                                    .maxlen = sizeof(u16) },
        [OVS_CT_ATTR_MARK]      = { .minlen = sizeof(struct md_mark),
                                    .maxlen = sizeof(struct md_mark) },
-        [OVS_CT_ATTR_LABEL]     = { .minlen = sizeof(struct md_label),
+        [OVS_CT_ATTR_LABELS]    = { .minlen = sizeof(struct md_labels),
-                                    .maxlen = sizeof(struct md_label) },
+                                    .maxlen = sizeof(struct md_labels) },
        [OVS_CT_ATTR_HELPER]    = { .minlen = 1,
                                    .maxlen = NF_CT_HELPER_NAME_LEN }
 };
@@ -576,8 +575,8 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
                }
                switch (type) {
-                case OVS_CT_ATTR_FLAGS:
+                case OVS_CT_ATTR_COMMIT:
-                        info->flags = nla_get_u32(a);
+                        info->commit = true;
                        break;
 #ifdef CONFIG_NF_CONNTRACK_ZONES
                case OVS_CT_ATTR_ZONE:
@@ -593,10 +592,10 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
                }
 #endif
 #ifdef CONFIG_NF_CONNTRACK_LABELS
-                case OVS_CT_ATTR_LABEL: {
+                case OVS_CT_ATTR_LABELS: {
-                        struct md_label *label = nla_data(a);
+                        struct md_labels *labels = nla_data(a);
-                        info->label = *label;
+                        info->labels = *labels;
                        break;
                }
 #endif
@@ -633,7 +632,7 @@ bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr)
            attr == OVS_KEY_ATTR_CT_MARK)
                return true;
        if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
-            attr == OVS_KEY_ATTR_CT_LABEL) {
+            attr == OVS_KEY_ATTR_CT_LABELS) {
                struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
                return ovs_net->xt_label;
@@ -701,7 +700,7 @@ int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
        if (!start)
                return -EMSGSIZE;
-        if (nla_put_u32(skb, OVS_CT_ATTR_FLAGS, ct_info->flags))
+        if (ct_info->commit && nla_put_flag(skb, OVS_CT_ATTR_COMMIT))
                return -EMSGSIZE;
        if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
            nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
@@ -711,8 +710,8 @@ int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
                    &ct_info->mark))
                return -EMSGSIZE;
        if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
-            nla_put(skb, OVS_CT_ATTR_LABEL, sizeof(ct_info->label),
+            nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels),
-                    &ct_info->label))
+                    &ct_info->labels))
                return -EMSGSIZE;
        if (ct_info->helper) {
                if (nla_put_string(skb, OVS_CT_ATTR_HELPER,
@@ -737,7 +736,7 @@ void ovs_ct_free_action(const struct nlattr *a)
 void ovs_ct_init(struct net *net)
 {
-        unsigned int n_bits = sizeof(struct ovs_key_ct_label) * BITS_PER_BYTE;
+        unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
        struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
        if (nf_connlabels_get(net, n_bits)) {
diff --git a/net/openvswitch/conntrack.h b/net/openvswitch/conntrack.h
index 43f5dd7a5577..da8714942c95 100644
--- a/net/openvswitch/conntrack.h
+++ b/net/openvswitch/conntrack.h
@@ -34,6 +34,13 @@ int ovs_ct_execute(struct net *, struct sk_buff *, struct sw_flow_key *,
 void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key);
 int ovs_ct_put_key(const struct sw_flow_key *key, struct sk_buff *skb);
 void ovs_ct_free_action(const struct nlattr *a);
+static inline bool ovs_ct_state_supported(u32 state)
+{
+        return !(state & ~(OVS_CS_F_NEW | OVS_CS_F_ESTABLISHED |
+                         OVS_CS_F_RELATED | OVS_CS_F_REPLY_DIR |
+                         OVS_CS_F_INVALID | OVS_CS_F_TRACKED));
+}
 #else
 #include <linux/errno.h>
@@ -46,6 +53,11 @@ static inline bool ovs_ct_verify(struct net *net, int attr)
        return false;
 }
+static inline bool ovs_ct_state_supported(u32 state)
+{
+        return false;
+}
 static inline int ovs_ct_copy_action(struct net *net, const struct nlattr *nla,
                                     const struct sw_flow_key *key,
                                     struct sw_flow_actions **acts, bool log)
@@ -72,7 +84,7 @@ static inline void ovs_ct_fill_key(const struct sk_buff *skb,
        key->ct.state = 0;
        key->ct.zone = 0;
        key->ct.mark = 0;
-        memset(&key->ct.label, 0, sizeof(key->ct.label));
+        memset(&key->ct.labels, 0, sizeof(key->ct.labels));
 }
 static inline int ovs_ct_put_key(const struct sw_flow_key *key,
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index fe527d2dd4b7..8cfa15a08668 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -116,7 +116,7 @@ struct sw_flow_key {
                u16 zone;
                u32 mark;
                u8 state;
-                struct ovs_key_ct_label label;
+                struct ovs_key_ct_labels labels;
        } ct;
 } __aligned(BITS_PER_LONG/8); /* Ensure that we can do comparisons as longs. */
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 5c030a4d7338..171a691f1c32 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -291,10 +291,10 @@ size_t ovs_key_attr_size(void)
                + nla_total_size(4)   /* OVS_KEY_ATTR_SKB_MARK */
                + nla_total_size(4)   /* OVS_KEY_ATTR_DP_HASH */
                + nla_total_size(4)   /* OVS_KEY_ATTR_RECIRC_ID */
-                + nla_total_size(1)   /* OVS_KEY_ATTR_CT_STATE */
+                + nla_total_size(4)   /* OVS_KEY_ATTR_CT_STATE */
                + nla_total_size(2)   /* OVS_KEY_ATTR_CT_ZONE */
                + nla_total_size(4)   /* OVS_KEY_ATTR_CT_MARK */
-                + nla_total_size(16)  /* OVS_KEY_ATTR_CT_LABEL */
+                + nla_total_size(16)  /* OVS_KEY_ATTR_CT_LABELS */
                + nla_total_size(12)  /* OVS_KEY_ATTR_ETHERNET */
                + nla_total_size(2)   /* OVS_KEY_ATTR_ETHERTYPE */
                + nla_total_size(4)   /* OVS_KEY_ATTR_VLAN */
@@ -349,10 +349,10 @@ static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
        [OVS_KEY_ATTR_TUNNEL]    = { .len = OVS_ATTR_NESTED,
                                     .next = ovs_tunnel_key_lens, },
        [OVS_KEY_ATTR_MPLS]      = { .len = sizeof(struct ovs_key_mpls) },
-        [OVS_KEY_ATTR_CT_STATE]  = { .len = sizeof(u8) },
+        [OVS_KEY_ATTR_CT_STATE]  = { .len = sizeof(u32) },
        [OVS_KEY_ATTR_CT_ZONE]   = { .len = sizeof(u16) },
        [OVS_KEY_ATTR_CT_MARK]   = { .len = sizeof(u32) },
-        [OVS_KEY_ATTR_CT_LABEL]  = { .len = sizeof(struct ovs_key_ct_label) },
+        [OVS_KEY_ATTR_CT_LABELS] = { .len = sizeof(struct ovs_key_ct_labels) },
 };
 static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
@@ -814,7 +814,13 @@ static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match,
        if (*attrs & (1 << OVS_KEY_ATTR_CT_STATE) &&
            ovs_ct_verify(net, OVS_KEY_ATTR_CT_STATE)) {
-                u8 ct_state = nla_get_u8(a[OVS_KEY_ATTR_CT_STATE]);
+                u32 ct_state = nla_get_u32(a[OVS_KEY_ATTR_CT_STATE]);
+                if (!is_mask && !ovs_ct_state_supported(ct_state)) {
+                        OVS_NLERR(log, "ct_state flags %08x unsupported",
+                                  ct_state);
+                        return -EINVAL;
+                }
                SW_FLOW_KEY_PUT(match, ct.state, ct_state, is_mask);
                *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_STATE);
@@ -833,14 +839,14 @@ static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match,
                SW_FLOW_KEY_PUT(match, ct.mark, mark, is_mask);
                *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_MARK);
        }
-        if (*attrs & (1 << OVS_KEY_ATTR_CT_LABEL) &&
+        if (*attrs & (1 << OVS_KEY_ATTR_CT_LABELS) &&
-            ovs_ct_verify(net, OVS_KEY_ATTR_CT_LABEL)) {
+            ovs_ct_verify(net, OVS_KEY_ATTR_CT_LABELS)) {
-                const struct ovs_key_ct_label *cl;
+                const struct ovs_key_ct_labels *cl;
-                cl = nla_data(a[OVS_KEY_ATTR_CT_LABEL]);
+                cl = nla_data(a[OVS_KEY_ATTR_CT_LABELS]);
-                SW_FLOW_KEY_MEMCPY(match, ct.label, cl->ct_label,
+                SW_FLOW_KEY_MEMCPY(match, ct.labels, cl->ct_labels,
                                   sizeof(*cl), is_mask);
-                *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_LABEL);
+                *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_LABELS);
        }
        return 0;
 }
@@ -1973,7 +1979,7 @@ static int validate_set(const struct nlattr *a,
        case OVS_KEY_ATTR_PRIORITY:
        case OVS_KEY_ATTR_SKB_MARK:
        case OVS_KEY_ATTR_CT_MARK:
-        case OVS_KEY_ATTR_CT_LABEL:
+        case OVS_KEY_ATTR_CT_LABELS:
        case OVS_KEY_ATTR_ETHERNET:
                break;
diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index f2ea83ba4763..c7f74aab34b9 100644
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -93,7 +93,8 @@ struct sw_flow *ovs_flow_alloc(void)
        /* Initialize the default stat node. */
        stats = kmem_cache_alloc_node(flow_stats_cache,
-                                      GFP_KERNEL | __GFP_ZERO, 0);
+                                      GFP_KERNEL | __GFP_ZERO,
+                                      node_online(0) ? 0 : NUMA_NO_NODE);
        if (!stats)
                goto err;
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index dc81dc619aa2..12a36ac21eda 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -280,35 +280,19 @@ void ovs_vport_del(struct vport *vport)
 */
 void ovs_vport_get_stats(struct vport *vport, struct ovs_vport_stats *stats)
 {
-        struct net_device *dev = vport->dev;
+        const struct rtnl_link_stats64 *dev_stats;
-        int i;
+        struct rtnl_link_stats64 temp;
-        memset(stats, 0, sizeof(*stats));
+        dev_stats = dev_get_stats(vport->dev, &temp);
-        stats->rx_errors  = dev->stats.rx_errors;
+        stats->rx_errors  = dev_stats->rx_errors;
-        stats->tx_errors  = dev->stats.tx_errors;
+        stats->tx_errors  = dev_stats->tx_errors;
-        stats->tx_dropped = dev->stats.tx_dropped;
+        stats->tx_dropped = dev_stats->tx_dropped;
-        stats->rx_dropped = dev->stats.rx_dropped;
+        stats->rx_dropped = dev_stats->rx_dropped;
-        stats->rx_dropped += atomic_long_read(&dev->rx_dropped);
+        stats->rx_bytes   = dev_stats->rx_bytes;
-        stats->tx_dropped += atomic_long_read(&dev->tx_dropped);
+        stats->rx_packets = dev_stats->rx_packets;
+        stats->tx_bytes   = dev_stats->tx_bytes;
-        for_each_possible_cpu(i) {
+        stats->tx_packets = dev_stats->tx_packets;
-                const struct pcpu_sw_netstats *percpu_stats;
-                struct pcpu_sw_netstats local_stats;
-                unsigned int start;
-                percpu_stats = per_cpu_ptr(dev->tstats, i);
-                do {
-                        start = u64_stats_fetch_begin_irq(&percpu_stats->syncp);
-                        local_stats = *percpu_stats;
-                } while (u64_stats_fetch_retry_irq(&percpu_stats->syncp, start));
-                stats->rx_bytes         += local_stats.rx_bytes;
-                stats->rx_packets       += local_stats.rx_packets;
-                stats->tx_bytes         += local_stats.tx_bytes;
-                stats->tx_packets       += local_stats.tx_packets;
-        }
 }
 /**
@@ -460,6 +444,15 @@ int ovs_vport_receive(struct vport *vport, struct sk_buff *skb,
        OVS_CB(skb)->input_vport = vport;
        OVS_CB(skb)->mru = 0;
+        if (unlikely(dev_net(skb->dev) != ovs_dp_get_net(vport->dp))) {
+                u32 mark;
+                mark = skb->mark;
+                skb_scrub_packet(skb, true);
+                skb->mark = mark;
+                tun_info = NULL;
+        }
        /* Extract flow from 'skb' into 'key'. */
        error = ovs_flow_key_extract(tun_info, skb, &key);
        if (unlikely(error)) {
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 2d1be4a760fd..32fcdecdb9e2 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -31,13 +31,17 @@
 #define MIRRED_TAB_MASK     7
 static LIST_HEAD(mirred_list);
+static DEFINE_SPINLOCK(mirred_list_lock);
 static void tcf_mirred_release(struct tc_action *a, int bind)
 {
        struct tcf_mirred *m = to_mirred(a);
        struct net_device *dev = rcu_dereference_protected(m->tcfm_dev, 1);
+        /* We could be called either in a RCU callback or with RTNL lock held. */
+        spin_lock_bh(&mirred_list_lock);
        list_del(&m->tcfm_list);
+        spin_unlock_bh(&mirred_list_lock);
        if (dev)
                dev_put(dev);
 }
@@ -103,10 +107,10 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
        } else {
                if (bind)
                        return 0;
-                if (!ovr) {
-                        tcf_hash_release(a, bind);
+                tcf_hash_release(a, bind);
+                if (!ovr)
                        return -EEXIST;
-                }
        }
        m = to_mirred(a);
@@ -123,7 +127,9 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
        }
        if (ret == ACT_P_CREATED) {
+                spin_lock_bh(&mirred_list_lock);
                list_add(&m->tcfm_list, &mirred_list);
+                spin_unlock_bh(&mirred_list_lock);
                tcf_hash_insert(a);
        }
@@ -173,6 +179,7 @@ static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a,
        skb2->skb_iif = skb->dev->ifindex;
        skb2->dev = dev;
+        skb_sender_cpu_clear(skb2);
        err = dev_queue_xmit(skb2);
        if (err) {
@@ -221,7 +228,8 @@ static int mirred_device_event(struct notifier_block *unused,
        struct tcf_mirred *m;
        ASSERT_RTNL();
-        if (event == NETDEV_UNREGISTER)
+        if (event == NETDEV_UNREGISTER) {
+                spin_lock_bh(&mirred_list_lock);
                list_for_each_entry(m, &mirred_list, tcfm_list) {
                        if (rcu_access_pointer(m->tcfm_dev) == dev) {
                                dev_put(dev);
@@ -231,6 +239,8 @@ static int mirred_device_event(struct notifier_block *unused,
                                RCU_INIT_POINTER(m->tcfm_dev, NULL);
                        }
                }
+                spin_unlock_bh(&mirred_list_lock);
+        }
        return NOTIFY_DONE;
 }
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index 9d15cb6b8cb1..86b04e31e60b 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -368,6 +368,15 @@ static unsigned int hhf_drop(struct Qdisc *sch)
        return bucket - q->buckets;
 }
+static unsigned int hhf_qdisc_drop(struct Qdisc *sch)
+{
+        unsigned int prev_backlog;
+        prev_backlog = sch->qstats.backlog;
+        hhf_drop(sch);
+        return prev_backlog - sch->qstats.backlog;
+}
 static int hhf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
        struct hhf_sched_data *q = qdisc_priv(sch);
@@ -696,7 +705,7 @@ static struct Qdisc_ops hhf_qdisc_ops __read_mostly = {
        .enqueue        =       hhf_enqueue,
        .dequeue        =       hhf_dequeue,
        .peek           =       qdisc_peek_dequeued,
-        .drop           =       hhf_drop,
+        .drop           =       hhf_qdisc_drop,
        .init           =       hhf_init,
        .reset          =       hhf_reset,
        .destroy        =       hhf_destroy,
diff --git a/net/switchdev/switchdev.c b/net/switchdev/switchdev.c
index fda38f830a10..77f5d17e2612 100644
--- a/net/switchdev/switchdev.c
+++ b/net/switchdev/switchdev.c
@@ -16,6 +16,7 @@
 #include <linux/notifier.h>
 #include <linux/netdevice.h>
 #include <linux/if_bridge.h>
+#include <linux/if_vlan.h>
 #include <net/ip_fib.h>
 #include <net/switchdev.h>
@@ -634,6 +635,8 @@ static int switchdev_port_br_afspec(struct net_device *dev,
                if (nla_len(attr) != sizeof(struct bridge_vlan_info))
                        return -EINVAL;
                vinfo = nla_data(attr);
+                if (!vinfo->vid || vinfo->vid >= VLAN_VID_MASK)
+                        return -EINVAL;
                vlan->flags = vinfo->flags;
                if (vinfo->flags & BRIDGE_VLAN_INFO_RANGE_BEGIN) {
                        if (vlan->vid_begin)
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index a82c5848d4bc..5351a3f97e8e 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -357,7 +357,7 @@ static inline u32 msg_importance(struct tipc_msg *m)
        if (likely((usr <= TIPC_CRITICAL_IMPORTANCE) && !msg_errcode(m)))
                return usr;
        if ((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER))
-                return msg_bits(m, 5, 13, 0x7);
+                return msg_bits(m, 9, 0, 0x7);
        return TIPC_SYSTEM_IMPORTANCE;
 }
@@ -366,7 +366,7 @@ static inline void msg_set_importance(struct tipc_msg *m, u32 i)
        int usr = msg_user(m);
        if (likely((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER)))
-                msg_set_bits(m, 5, 13, 0x7, i);
+                msg_set_bits(m, 9, 0, 0x7, i);
        else if (i < TIPC_SYSTEM_IMPORTANCE)
                msg_set_user(m, i);
        else
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 703875fd6cde..2c32a83037a3 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1116,7 +1116,7 @@ static bool tipc_node_check_state(struct tipc_node *n, struct sk_buff *skb,
        }
        /* Ignore duplicate packets */
-        if (less(oseqno, rcv_nxt))
+        if ((usr != LINK_PROTOCOL) && less(oseqno, rcv_nxt))
                return true;
        /* Initiate or update failover mode if applicable */
@@ -1146,8 +1146,8 @@ static bool tipc_node_check_state(struct tipc_node *n, struct sk_buff *skb,
        if (!pl || !tipc_link_is_up(pl))
                return true;
-        /* Initiate or update synch mode if applicable */
+        /* Initiate synch mode if applicable */
-        if ((usr == TUNNEL_PROTOCOL) && (mtyp == SYNCH_MSG)) {
+        if ((usr == TUNNEL_PROTOCOL) && (mtyp == SYNCH_MSG) && (oseqno == 1)) {
                syncpt = iseqno + exp_pkts - 1;
                if (!tipc_link_is_up(l)) {
                        tipc_link_fsm_evt(l, LINK_ESTABLISH_EVT);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index ef31b40ad550..94f658235fb4 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2064,6 +2064,11 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state)
                goto out;
        }
+        if (flags & MSG_PEEK)
+                skip = sk_peek_offset(sk, flags);
+        else
+                skip = 0;
        do {
                int chunk;
                struct sk_buff *skb, *last;
@@ -2112,7 +2117,6 @@ unlock:
                        break;
                }
-                skip = sk_peek_offset(sk, flags);
                while (skip >= unix_skb_len(skb)) {
                        skip -= unix_skb_len(skb);
                        last = skb;
@@ -2179,14 +2183,12 @@ unlock:
                        if (UNIXCB(skb).fp)
                                scm.fp = scm_fp_dup(UNIXCB(skb).fp);
-                        if (skip) {
+                        sk_peek_offset_fwd(sk, chunk);
-                                sk_peek_offset_fwd(sk, chunk);
-                                skip -= chunk;
-                        }
                        if (UNIXCB(skb).fp)
                                break;
+                        skip = 0;
                        last = skb;
                        last_len = skb->len;
                        unix_state_lock(sk);
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 39eac1fd5706..addf060399e0 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -134,8 +134,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
                kdebug("- %u", key->serial);
                key_check(key);
-                /* Throw away the key data */
+                /* Throw away the key data if the key is instantiated */
-                if (key->type->destroy)
+                if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
+                    !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
+                    key->type->destroy)
                        key->type->destroy(key);
                security_key_free(key);
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 486ef6fa393b..0d6253124278 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -440,6 +440,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
        kenter("");
+        if (ctx->index_key.type == &key_type_keyring)
+                return ERR_PTR(-EPERM);
+        
        user = key_user_lookup(current_fsuid());
        if (!user)
                return ERR_PTR(-ENOMEM);
diff --git a/sound/hda/ext/hdac_ext_bus.c b/sound/hda/ext/hdac_ext_bus.c
index 4449d1a99089..2433f7c81472 100644
--- a/sound/hda/ext/hdac_ext_bus.c
+++ b/sound/hda/ext/hdac_ext_bus.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/io.h>
 #include <sound/hdaudio_ext.h>
 MODULE_DESCRIPTION("HDA extended core");
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 37f43a1b34ef..a249d5486889 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -3367,10 +3367,8 @@ int snd_hda_codec_build_pcms(struct hda_codec *codec)
        int dev, err;
        err = snd_hda_codec_parse_pcms(codec);
-        if (err < 0) {
+        if (err < 0)
-                snd_hda_codec_reset(codec);
                return err;
-        }
        /* attach a new PCM streams */
        list_for_each_entry(cpcm, &codec->pcm_list_head, list) {
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index ca03c40609fc..2f0ec7c45fc7 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -819,6 +819,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
        SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410),
        SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410),
        SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD),
+        SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC),
        SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
        SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
        SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
diff --git a/sound/soc/codecs/rt298.c b/sound/soc/codecs/rt298.c
index 3c2f0f8d6266..f823eb502367 100644
--- a/sound/soc/codecs/rt298.c
+++ b/sound/soc/codecs/rt298.c
@@ -50,24 +50,24 @@ struct rt298_priv {
 };
 static struct reg_default rt298_index_def[] = {
-        { 0x01, 0xaaaa },
+        { 0x01, 0xa5a8 },
-        { 0x02, 0x8aaa },
+        { 0x02, 0x8e95 },
        { 0x03, 0x0002 },
-        { 0x04, 0xaf01 },
+        { 0x04, 0xaf67 },
-        { 0x08, 0x000d },
+        { 0x08, 0x200f },
-        { 0x09, 0xd810 },
+        { 0x09, 0xd010 },
-        { 0x0a, 0x0120 },
+        { 0x0a, 0x0100 },
        { 0x0b, 0x0000 },
        { 0x0d, 0x2800 },
-        { 0x0f, 0x0000 },
+        { 0x0f, 0x0022 },
-        { 0x19, 0x0a17 },
+        { 0x19, 0x0217 },
        { 0x20, 0x0020 },
        { 0x33, 0x0208 },
        { 0x46, 0x0300 },
-        { 0x49, 0x0004 },
+        { 0x49, 0x4004 },
-        { 0x4f, 0x50e9 },
+        { 0x4f, 0x50c9 },
-        { 0x50, 0x2000 },
+        { 0x50, 0x3000 },
-        { 0x63, 0x2902 },
+        { 0x63, 0x1b02 },
        { 0x67, 0x1111 },
        { 0x68, 0x1016 },
        { 0x69, 0x273f },
@@ -1214,7 +1214,7 @@ static int rt298_i2c_probe(struct i2c_client *i2c,
        mdelay(10);
        if (!rt298->pdata.gpio2_en)
-                regmap_write(rt298->regmap, RT298_SET_DMIC2_DEFAULT, 0x4000);
+                regmap_write(rt298->regmap, RT298_SET_DMIC2_DEFAULT, 0x40);
        else
                regmap_write(rt298->regmap, RT298_SET_DMIC2_DEFAULT, 0);
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 2fbc6ef8cbdb..39ebd7bf4f53 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -3808,6 +3808,8 @@ static int wm8962_runtime_resume(struct device *dev)
        wm8962_reset(wm8962);
+        regcache_mark_dirty(wm8962->regmap);
        /* SYSCLK defaults to on; make sure it is off so we can safely
         * write to registers if the device is declocked.
         */
diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
index 100d92b5b77e..05977ae1ff2a 100644
--- a/sound/soc/soc-ops.c
+++ b/sound/soc/soc-ops.c
@@ -207,6 +207,34 @@ int snd_soc_info_volsw(struct snd_kcontrol *kcontrol,
 EXPORT_SYMBOL_GPL(snd_soc_info_volsw);
 /**
+ * snd_soc_info_volsw_sx - Mixer info callback for SX TLV controls
+ * @kcontrol: mixer control
+ * @uinfo: control element information
+ *
+ * Callback to provide information about a single mixer control, or a double
+ * mixer control that spans 2 registers of the SX TLV type. SX TLV controls
+ * have a range that represents both positive and negative values either side
+ * of zero but without a sign bit.
+ *
+ * Returns 0 for success.
+ */
+int snd_soc_info_volsw_sx(struct snd_kcontrol *kcontrol,
+                          struct snd_ctl_elem_info *uinfo)
+{
+        struct soc_mixer_control *mc =
+                (struct soc_mixer_control *)kcontrol->private_value;
+        snd_soc_info_volsw(kcontrol, uinfo);
+        /* Max represents the number of levels in an SX control not the
+         * maximum value, so add the minimum value back on
+         */
+        uinfo->value.integer.max += mc->min;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(snd_soc_info_volsw_sx);
+/**
 * snd_soc_get_volsw - single mixer get callback
 * @kcontrol: mixer control
 * @ucontrol: control element information
diff --git a/tools/power/cpupower/debug/i386/dump_psb.c b/tools/power/cpupower/debug/i386/dump_psb.c
index 8d6a47514253..2c768cf70128 100644
--- a/tools/power/cpupower/debug/i386/dump_psb.c
+++ b/tools/power/cpupower/debug/i386/dump_psb.c
@@ -134,7 +134,7 @@ next_one:
 }
 static struct option info_opts[] = {
-        {.name = "numpst",      .has_arg=no_argument,   .flag=NULL, .val='n'},
+     {"numpst", no_argument, NULL, 'n'},
 };
 void print_help(void)
diff --git a/tools/power/cpupower/man/cpupower-idle-set.1 b/tools/power/cpupower/man/cpupower-idle-set.1
index 3e6799d7a79f..580c4e3ea92a 100644
--- a/tools/power/cpupower/man/cpupower-idle-set.1
+++ b/tools/power/cpupower/man/cpupower-idle-set.1
@@ -20,7 +20,9 @@ Disable a specific processor sleep state.
 Enable a specific processor sleep state.
 .TP
 \fB\-D\fR \fB\-\-disable-by-latency\fR <LATENCY>
-Disable all idle states with a equal or higher latency than <LATENCY>
+Disable all idle states with a equal or higher latency than <LATENCY>.
+Enable all idle states with a latency lower than <LATENCY>.
 .TP
 \fB\-E\fR \fB\-\-enable-all\fR
 Enable all idle states if not enabled already.
diff --git a/tools/power/cpupower/utils/cpufreq-info.c b/tools/power/cpupower/utils/cpufreq-info.c
index b4b90a97662c..0e6764330241 100644
--- a/tools/power/cpupower/utils/cpufreq-info.c
+++ b/tools/power/cpupower/utils/cpufreq-info.c
@@ -536,21 +536,21 @@ static int get_latency(unsigned int cpu, unsigned int human)
 }
 static struct option info_opts[] = {
-        { .name = "debug",      .has_arg = no_argument,         .flag = NULL,   .val = 'e'},
+        {"debug",        no_argument,            NULL,   'e'},
-        { .name = "boost",      .has_arg = no_argument,         .flag = NULL,   .val = 'b'},
+        {"boost",        no_argument,            NULL,   'b'},
-        { .name = "freq",       .has_arg = no_argument,         .flag = NULL,   .val = 'f'},
+        {"freq",         no_argument,            NULL,   'f'},
-        { .name = "hwfreq",     .has_arg = no_argument,         .flag = NULL,   .val = 'w'},
+        {"hwfreq",       no_argument,            NULL,   'w'},
-        { .name = "hwlimits",   .has_arg = no_argument,         .flag = NULL,   .val = 'l'},
+        {"hwlimits",     no_argument,            NULL,   'l'},
-        { .name = "driver",     .has_arg = no_argument,         .flag = NULL,   .val = 'd'},
+        {"driver",       no_argument,            NULL,   'd'},
-        { .name = "policy",     .has_arg = no_argument,         .flag = NULL,   .val = 'p'},
+        {"policy",       no_argument,            NULL,   'p'},
-        { .name = "governors",  .has_arg = no_argument,         .flag = NULL,   .val = 'g'},
+        {"governors",    no_argument,            NULL,   'g'},
-        { .name = "related-cpus", .has_arg = no_argument,       .flag = NULL,   .val = 'r'},
+        {"related-cpus",  no_argument,   NULL,   'r'},
-        { .name = "affected-cpus",.has_arg = no_argument,       .flag = NULL,   .val = 'a'},
+        {"affected-cpus", no_argument,   NULL,   'a'},
-        { .name = "stats",      .has_arg = no_argument,         .flag = NULL,   .val = 's'},
+        {"stats",        no_argument,            NULL,   's'},
-        { .name = "latency",    .has_arg = no_argument,         .flag = NULL,   .val = 'y'},
+        {"latency",      no_argument,            NULL,   'y'},
-        { .name = "proc",       .has_arg = no_argument,         .flag = NULL,   .val = 'o'},
+        {"proc",         no_argument,            NULL,   'o'},
-        { .name = "human",      .has_arg = no_argument,         .flag = NULL,   .val = 'm'},
+        {"human",        no_argument,            NULL,   'm'},
-        { .name = "no-rounding", .has_arg = no_argument,        .flag = NULL,   .val = 'n'},
+        {"no-rounding", no_argument,     NULL,   'n'},
        { },
 };
diff --git a/tools/power/cpupower/utils/cpufreq-set.c b/tools/power/cpupower/utils/cpufreq-set.c
index 4e213576381e..0fbd1a22c0a9 100644
--- a/tools/power/cpupower/utils/cpufreq-set.c
+++ b/tools/power/cpupower/utils/cpufreq-set.c
@@ -22,11 +22,11 @@
 #define NORM_FREQ_LEN 32
 static struct option set_opts[] = {
-        { .name = "min",        .has_arg = required_argument,   .flag = NULL,   .val = 'd'},
+        {"min",         required_argument,      NULL, 'd'},
-        { .name = "max",        .has_arg = required_argument,   .flag = NULL,   .val = 'u'},
+        {"max",         required_argument,      NULL, 'u'},
-        { .name = "governor",   .has_arg = required_argument,   .flag = NULL,   .val = 'g'},
+        {"governor",    required_argument,      NULL, 'g'},
-        { .name = "freq",       .has_arg = required_argument,   .flag = NULL,   .val = 'f'},
+        {"freq",        required_argument,      NULL, 'f'},
-        { .name = "related",    .has_arg = no_argument,         .flag = NULL,   .val='r'},
+        {"related",     no_argument,            NULL, 'r'},
        { },
 };
diff --git a/tools/power/cpupower/utils/cpuidle-info.c b/tools/power/cpupower/utils/cpuidle-info.c
index 75e66de7e7a7..750c1d82c3f7 100644
--- a/tools/power/cpupower/utils/cpuidle-info.c
+++ b/tools/power/cpupower/utils/cpuidle-info.c
@@ -126,8 +126,8 @@ static void proc_cpuidle_cpu_output(unsigned int cpu)
 }
 static struct option info_opts[] = {
-        { .name = "silent",     .has_arg = no_argument, .flag = NULL,   .val = 's'},
+        {"silent", no_argument, NULL, 's'},
-        { .name = "proc",       .has_arg = no_argument, .flag = NULL,   .val = 'o'},
+        {"proc", no_argument, NULL, 'o'},
        { },
 };
diff --git a/tools/power/cpupower/utils/cpuidle-set.c b/tools/power/cpupower/utils/cpuidle-set.c
index d45d8d775c02..d6b6ae44b8c2 100644
--- a/tools/power/cpupower/utils/cpuidle-set.c
+++ b/tools/power/cpupower/utils/cpuidle-set.c
@@ -13,15 +13,11 @@
 #include "helpers/sysfs.h"
 static struct option info_opts[] = {
-        { .name = "disable",
+     {"disable",        required_argument,              NULL, 'd'},
-          .has_arg = required_argument, .flag = NULL,   .val = 'd'},
+     {"enable",         required_argument,              NULL, 'e'},
-        { .name = "enable",
+     {"disable-by-latency", required_argument,          NULL, 'D'},
-          .has_arg = required_argument, .flag = NULL,   .val = 'e'},
+     {"enable-all",     no_argument,                    NULL, 'E'},
-        { .name = "disable-by-latency",
+     { },
-          .has_arg = required_argument, .flag = NULL,   .val = 'D'},
-        { .name = "enable-all",
-          .has_arg = no_argument,       .flag = NULL,   .val = 'E'},
-        { },
 };
@@ -148,14 +144,21 @@ int cmd_idle_set(int argc, char **argv)
                                        (cpu, idlestate);
                                state_latency = sysfs_get_idlestate_latency
                                        (cpu, idlestate);
-                                printf("CPU: %u - idlestate %u - state_latency: %llu - latency: %llu\n",
+                                if (disabled == 1) {
-                                       cpu, idlestate, state_latency, latency);
+                                        if (latency > state_latency){
-                                if (disabled == 1 || latency > state_latency)
+                                                ret = sysfs_idlestate_disable
+                                                        (cpu, idlestate, 0);
+                                                if (ret == 0)
+                printf(_("Idlestate %u enabled on CPU %u\n"),  idlestate, cpu);
+                                        }
                                        continue;
-                                ret = sysfs_idlestate_disable
+                                }
-                                        (cpu, idlestate, 1);
+                                if (latency <= state_latency){
-                                if (ret == 0)
+                                        ret = sysfs_idlestate_disable
+                                                (cpu, idlestate, 1);
+                                        if (ret == 0)
                printf(_("Idlestate %u disabled on CPU %u\n"), idlestate, cpu);
+                                }
                        }
                        break;
                case 'E':
diff --git a/tools/power/cpupower/utils/cpupower-info.c b/tools/power/cpupower/utils/cpupower-info.c
index 136d979e9586..10299f2e9d2a 100644
--- a/tools/power/cpupower/utils/cpupower-info.c
+++ b/tools/power/cpupower/utils/cpupower-info.c
@@ -17,8 +17,8 @@
 #include "helpers/sysfs.h"
 static struct option set_opts[] = {
-        { .name = "perf-bias",  .has_arg = optional_argument,   .flag = NULL,   .val = 'b'},
+     {"perf-bias", optional_argument, NULL, 'b'},
-        { },
+     { },
 };
 static void print_wrong_arg_exit(void)
diff --git a/tools/power/cpupower/utils/cpupower-set.c b/tools/power/cpupower/utils/cpupower-set.c
index 573c75f8e3f5..3e6f374f8dd7 100644
--- a/tools/power/cpupower/utils/cpupower-set.c
+++ b/tools/power/cpupower/utils/cpupower-set.c
@@ -18,7 +18,7 @@
 #include "helpers/bitmask.h"
 static struct option set_opts[] = {
-        { .name = "perf-bias",  .has_arg = required_argument,   .flag = NULL,   .val = 'b'},
+        {"perf-bias", required_argument, NULL, 'b'},
        { },
 };
diff --git a/tools/power/cpupower/utils/helpers/topology.c b/tools/power/cpupower/utils/helpers/topology.c
index cea398c176e7..9cbb7fd75171 100644
--- a/tools/power/cpupower/utils/helpers/topology.c
+++ b/tools/power/cpupower/utils/helpers/topology.c
@@ -73,18 +73,22 @@ int get_cpu_topology(struct cpupower_topology *cpu_top)
        for (cpu = 0; cpu < cpus; cpu++) {
                cpu_top->core_info[cpu].cpu = cpu;
                cpu_top->core_info[cpu].is_online = sysfs_is_cpu_online(cpu);
-                if (!cpu_top->core_info[cpu].is_online)
-                        continue;
                if(sysfs_topology_read_file(
                        cpu,
                        "physical_package_id",
-                        &(cpu_top->core_info[cpu].pkg)) < 0)
+                        &(cpu_top->core_info[cpu].pkg)) < 0) {
-                        return -1;
+                        cpu_top->core_info[cpu].pkg = -1;
+                        cpu_top->core_info[cpu].core = -1;
+                        continue;
+                }
                if(sysfs_topology_read_file(
                        cpu,
                        "core_id",
-                        &(cpu_top->core_info[cpu].core)) < 0)
+                        &(cpu_top->core_info[cpu].core)) < 0) {
-                        return -1;
+                        cpu_top->core_info[cpu].pkg = -1;
+                        cpu_top->core_info[cpu].core = -1;
+                        continue;
+                }
        }
        qsort(cpu_top->core_info, cpus, sizeof(struct cpuid_core_info),
@@ -95,12 +99,15 @@ int get_cpu_topology(struct cpupower_topology *cpu_top)
           done by pkg value. */
        last_pkg = cpu_top->core_info[0].pkg;
        for(cpu = 1; cpu < cpus; cpu++) {
-                if(cpu_top->core_info[cpu].pkg != last_pkg) {
+                if (cpu_top->core_info[cpu].pkg != last_pkg &&
+                                cpu_top->core_info[cpu].pkg != -1) {
                        last_pkg = cpu_top->core_info[cpu].pkg;
                        cpu_top->pkgs++;
                }
        }
-        cpu_top->pkgs++;
+        if (!cpu_top->core_info[0].pkg == -1)
+                cpu_top->pkgs++;
        /* Intel's cores count is not consecutively numbered, there may
         * be a core_id of 3, but none of 2. Assume there always is 0
diff --git a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
index c4bae9203a69..05f953f0f0a0 100644
--- a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
+++ b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
@@ -143,6 +143,9 @@ void print_results(int topology_depth, int cpu)
        /* Be careful CPUs may got resorted for pkg value do not just use cpu */
        if (!bitmask_isbitset(cpus_chosen, cpu_top.core_info[cpu].cpu))
                return;
+        if (!cpu_top.core_info[cpu].is_online &&
+            cpu_top.core_info[cpu].pkg == -1)
+                return;
        if (topology_depth > 2)
                printf("%4d|", cpu_top.core_info[cpu].pkg);
@@ -191,7 +194,8 @@ void print_results(int topology_depth, int cpu)
         * It's up to the monitor plug-in to check .is_online, this one
         * is just for additional info.
         */
-        if (!cpu_top.core_info[cpu].is_online) {
+        if (!cpu_top.core_info[cpu].is_online &&
+            cpu_top.core_info[cpu].pkg != -1) {
                printf(_(" *is offline\n"));
                return;
        } else
@@ -388,6 +392,9 @@ int cmd_monitor(int argc, char **argv)
                return EXIT_FAILURE;
        }
+        if (!cpu_top.core_info[0].is_online)
+                printf("WARNING: at least one cpu is offline\n");
        /* Default is: monitor all CPUs */
        if (bitmask_isallclear(cpus_chosen))
                bitmask_setall(cpus_chosen);
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index 48c6e1ac6827..b9d3a32cbc04 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -137,6 +137,8 @@ bool kvm_timer_should_fire(struct kvm_vcpu *vcpu)
 void kvm_timer_flush_hwstate(struct kvm_vcpu *vcpu)
 {
        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
+        bool phys_active;
+        int ret;
        /*
         * We're about to run this vcpu again, so there is no need to
@@ -151,6 +153,23 @@ void kvm_timer_flush_hwstate(struct kvm_vcpu *vcpu)
         */
        if (kvm_timer_should_fire(vcpu))
                kvm_timer_inject_irq(vcpu);
+        /*
+         * We keep track of whether the edge-triggered interrupt has been
+         * signalled to the vgic/guest, and if so, we mask the interrupt and
+         * the physical distributor to prevent the timer from raising a
+         * physical interrupt whenever we run a guest, preventing forward
+         * VCPU progress.
+         */
+        if (kvm_vgic_get_phys_irq_active(timer->map))
+                phys_active = true;
+        else
+                phys_active = false;
+        ret = irq_set_irqchip_state(timer->map->irq,
+                                    IRQCHIP_STATE_ACTIVE,
+                                    phys_active);
+        WARN_ON(ret);
 }
 /**
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 6bd1c9bf7ae7..66c66165e712 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -531,6 +531,34 @@ bool vgic_handle_set_pending_reg(struct kvm *kvm,
        return false;
 }
+/*
+ * If a mapped interrupt's state has been modified by the guest such that it
+ * is no longer active or pending, without it have gone through the sync path,
+ * then the map->active field must be cleared so the interrupt can be taken
+ * again.
+ */
+static void vgic_handle_clear_mapped_irq(struct kvm_vcpu *vcpu)
+{
+        struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
+        struct list_head *root;
+        struct irq_phys_map_entry *entry;
+        struct irq_phys_map *map;
+        rcu_read_lock();
+        /* Check for PPIs */
+        root = &vgic_cpu->irq_phys_map_list;
+        list_for_each_entry_rcu(entry, root, entry) {
+                map = &entry->map;
+                if (!vgic_dist_irq_is_pending(vcpu, map->virt_irq) &&
+                    !vgic_irq_is_active(vcpu, map->virt_irq))
+                        map->active = false;
+        }
+        rcu_read_unlock();
+}
 bool vgic_handle_clear_pending_reg(struct kvm *kvm,
                                   struct kvm_exit_mmio *mmio,
                                   phys_addr_t offset, int vcpu_id)
@@ -561,6 +589,7 @@ bool vgic_handle_clear_pending_reg(struct kvm *kvm,
                                          vcpu_id, offset);
                vgic_reg_access(mmio, reg, offset, mode);
+                vgic_handle_clear_mapped_irq(kvm_get_vcpu(kvm, vcpu_id));
                vgic_update_state(kvm);
                return true;
        }
@@ -598,6 +627,7 @@ bool vgic_handle_clear_active_reg(struct kvm *kvm,
                        ACCESS_READ_VALUE | ACCESS_WRITE_CLEARBIT);
        if (mmio->is_write) {
+                vgic_handle_clear_mapped_irq(kvm_get_vcpu(kvm, vcpu_id));
                vgic_update_state(kvm);
                return true;
        }
@@ -982,6 +1012,12 @@ static int compute_pending_for_cpu(struct kvm_vcpu *vcpu)
        pend_percpu = vcpu->arch.vgic_cpu.pending_percpu;
        pend_shared = vcpu->arch.vgic_cpu.pending_shared;
+        if (!dist->enabled) {
+                bitmap_zero(pend_percpu, VGIC_NR_PRIVATE_IRQS);
+                bitmap_zero(pend_shared, nr_shared);
+                return 0;
+        }
        pending = vgic_bitmap_get_cpu_map(&dist->irq_pending, vcpu_id);
        enabled = vgic_bitmap_get_cpu_map(&dist->irq_enabled, vcpu_id);
        bitmap_and(pend_percpu, pending, enabled, VGIC_NR_PRIVATE_IRQS);
@@ -1009,11 +1045,6 @@ void vgic_update_state(struct kvm *kvm)
        struct kvm_vcpu *vcpu;
        int c;
-        if (!dist->enabled) {
-                set_bit(0, dist->irq_pending_on_cpu);
-                return;
-        }
        kvm_for_each_vcpu(c, vcpu, kvm) {
                if (compute_pending_for_cpu(vcpu))
                        set_bit(c, dist->irq_pending_on_cpu);
@@ -1092,6 +1123,15 @@ static void vgic_retire_lr(int lr_nr, int irq, struct kvm_vcpu *vcpu)
        struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
        struct vgic_lr vlr = vgic_get_lr(vcpu, lr_nr);
+        /*
+         * We must transfer the pending state back to the distributor before
+         * retiring the LR, otherwise we may loose edge-triggered interrupts.
+         */
+        if (vlr.state & LR_STATE_PENDING) {
+                vgic_dist_irq_set_pending(vcpu, irq);
+                vlr.hwirq = 0;
+        }
        vlr.state = 0;
        vgic_set_lr(vcpu, lr_nr, vlr);
        clear_bit(lr_nr, vgic_cpu->lr_used);
@@ -1132,7 +1172,8 @@ static void vgic_queue_irq_to_lr(struct kvm_vcpu *vcpu, int irq,
                kvm_debug("Set active, clear distributor: 0x%x\n", vlr.state);
                vgic_irq_clear_active(vcpu, irq);
                vgic_update_state(vcpu->kvm);
-        } else if (vgic_dist_irq_is_pending(vcpu, irq)) {
+        } else {
+                WARN_ON(!vgic_dist_irq_is_pending(vcpu, irq));
                vlr.state |= LR_STATE_PENDING;
                kvm_debug("Set pending: 0x%x\n", vlr.state);
        }
@@ -1240,7 +1281,7 @@ static void __kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
        struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
        unsigned long *pa_percpu, *pa_shared;
-        int i, vcpu_id, lr, ret;
+        int i, vcpu_id;
        int overflow = 0;
        int nr_shared = vgic_nr_shared_irqs(dist);
@@ -1295,31 +1336,6 @@ epilog:
                 */
                clear_bit(vcpu_id, dist->irq_pending_on_cpu);
        }
-        for (lr = 0; lr < vgic->nr_lr; lr++) {
-                struct vgic_lr vlr;
-                if (!test_bit(lr, vgic_cpu->lr_used))
-                        continue;
-                vlr = vgic_get_lr(vcpu, lr);
-                /*
-                 * If we have a mapping, and the virtual interrupt is
-                 * presented to the guest (as pending or active), then we must
-                 * set the state to active in the physical world. See
-                 * Documentation/virtual/kvm/arm/vgic-mapped-irqs.txt.
-                 */
-                if (vlr.state & LR_HW) {
-                        struct irq_phys_map *map;
-                        map = vgic_irq_map_search(vcpu, vlr.irq);
-                        ret = irq_set_irqchip_state(map->irq,
-                                                    IRQCHIP_STATE_ACTIVE,
-                                                    true);
-                        WARN_ON(ret);
-                }
-        }
 }
 static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
@@ -1421,7 +1437,7 @@ static int vgic_sync_hwirq(struct kvm_vcpu *vcpu, struct vgic_lr vlr)
                return 0;
        map = vgic_irq_map_search(vcpu, vlr.irq);
-        BUG_ON(!map || !map->active);
+        BUG_ON(!map);
        ret = irq_get_irqchip_state(map->irq,
                                    IRQCHIP_STATE_ACTIVE,
@@ -1429,13 +1445,8 @@ static int vgic_sync_hwirq(struct kvm_vcpu *vcpu, struct vgic_lr vlr)
        WARN_ON(ret);
-        if (map->active) {
+        if (map->active)
-                ret = irq_set_irqchip_state(map->irq,
-                                            IRQCHIP_STATE_ACTIVE,
-                                            false);
-                WARN_ON(ret);
                return 0;
-        }
        return 1;
 }
@@ -1607,8 +1618,12 @@ static int vgic_update_irq_pending(struct kvm *kvm, int cpuid,
        } else {
                if (level_triggered) {
                        vgic_dist_irq_clear_level(vcpu, irq_num);
-                        if (!vgic_dist_irq_soft_pend(vcpu, irq_num))
+                        if (!vgic_dist_irq_soft_pend(vcpu, irq_num)) {
                                vgic_dist_irq_clear_pending(vcpu, irq_num);
+                                vgic_cpu_irq_clear(vcpu, irq_num);
+                                if (!compute_pending_for_cpu(vcpu))
+                                        clear_bit(cpuid, dist->irq_pending_on_cpu);
+                        }
                }
                ret = false;