90 files changed, 834 insertions, 410 deletions
diff --git a/Documentation/DocBook/Makefile b/Documentation/DocBook/Makefile
index c75e5d6b8fa8..a6eb7dcd4dd5 100644
--- a/Documentation/DocBook/Makefile
+++ b/Documentation/DocBook/Makefile
@@ -12,7 +12,7 @@ DOCBOOKS := z8530book.xml  \
            kernel-api.xml filesystems.xml lsm.xml kgdb.xml \
            gadget.xml libata.xml mtdnand.xml librs.xml rapidio.xml \
            genericirq.xml s390-drivers.xml uio-howto.xml scsi.xml \
-            80211.xml sh.xml regulator.xml w1.xml \
+            sh.xml regulator.xml w1.xml \
            writing_musb_glue_layer.xml iio.xml
 ifeq ($(DOCBOOKS),)
diff --git a/Documentation/unaligned-memory-access.txt b/Documentation/unaligned-memory-access.txt
index a445da098bc6..3f76c0c37920 100644
--- a/Documentation/unaligned-memory-access.txt
+++ b/Documentation/unaligned-memory-access.txt
@@ -151,7 +151,7 @@ bool ether_addr_equal(const u8 *addr1, const u8 *addr2)
 #else
        const u16 *a = (const u16 *)addr1;
        const u16 *b = (const u16 *)addr2;
-        return ((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2])) != 0;
+        return ((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2])) == 0;
 #endif
 }
diff --git a/MAINTAINERS b/MAINTAINERS
index cfff2c9e3d94..9effa390177d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1689,6 +1689,7 @@ M:	Krzysztof Kozlowski <krzk@kernel.org>
 R:      Javier Martinez Canillas <javier@osg.samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
+Q:      https://patchwork.kernel.org/project/linux-samsung-soc/list/
 S:      Maintained
 F:      arch/arm/boot/dts/s3c*
 F:      arch/arm/boot/dts/s5p*
@@ -9842,7 +9843,7 @@ M:	Mark Rutland <mark.rutland@arm.com>
 M:      Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
 L:      linux-arm-kernel@lists.infradead.org
 S:      Maintained
-F:      drivers/firmware/psci.c
+F:      drivers/firmware/psci*.c
 F:      include/linux/psci.h
 F:      include/uapi/linux/psci.h
diff --git a/Makefile b/Makefile
index ec411ba9e40f..5470d599384a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 10
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = Roaring Lionus
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 5fab553fd03a..186c4c214e0a 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1502,8 +1502,7 @@ source kernel/Kconfig.preempt
 config HZ_FIXED
        int
-        default 200 if ARCH_EBSA110 || ARCH_S3C24XX || \
+        default 200 if ARCH_EBSA110
-                ARCH_S5PV210 || ARCH_EXYNOS4
        default 128 if SOC_AT91RM9200
        default 0
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 7327250f0bb6..f10fe8526239 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -846,6 +846,7 @@ dtb-$(CONFIG_MACH_SUN8I) += \
        sun8i-a83t-allwinner-h8homlet-v2.dtb \
        sun8i-a83t-cubietruck-plus.dtb \
        sun8i-h3-bananapi-m2-plus.dtb \
+        sun8i-h3-nanopi-m1.dtb  \
        sun8i-h3-nanopi-neo.dtb \
        sun8i-h3-orangepi-2.dtb \
        sun8i-h3-orangepi-lite.dtb \
diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
index b6142bda661e..15f07f9af3b3 100644
--- a/arch/arm/boot/dts/bcm-nsp.dtsi
+++ b/arch/arm/boot/dts/bcm-nsp.dtsi
@@ -160,7 +160,7 @@
        axi {
                compatible = "simple-bus";
-                ranges = <0x00000000 0x18000000 0x0011c40a>;
+                ranges = <0x00000000 0x18000000 0x0011c40c>;
                #address-cells = <1>;
                #size-cells = <1>;
diff --git a/arch/arm/boot/dts/imx31.dtsi b/arch/arm/boot/dts/imx31.dtsi
index 685916e3d8a1..85cd8be22f71 100644
--- a/arch/arm/boot/dts/imx31.dtsi
+++ b/arch/arm/boot/dts/imx31.dtsi
@@ -31,11 +31,11 @@
                };
        };
-        avic: avic-interrupt-controller@60000000 {
+        avic: interrupt-controller@68000000 {
                compatible = "fsl,imx31-avic", "fsl,avic";
                interrupt-controller;
                #interrupt-cells = <1>;
-                reg = <0x60000000 0x100000>;
+                reg = <0x68000000 0x100000>;
        };
        soc {
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
index 34887a10c5f1..47ba97229a48 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
@@ -319,8 +319,6 @@
                compatible = "fsl,imx6q-nitrogen6_max-sgtl5000",
                             "fsl,imx-audio-sgtl5000";
                model = "imx6q-nitrogen6_max-sgtl5000";
-                pinctrl-names = "default";
-                pinctrl-0 = <&pinctrl_sgtl5000>;
                ssi-controller = <&ssi1>;
                audio-codec = <&codec>;
                audio-routing =
@@ -402,6 +400,8 @@
        codec: sgtl5000@0a {
                compatible = "fsl,sgtl5000";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pinctrl_sgtl5000>;
                reg = <0x0a>;
                clocks = <&clks IMX6QDL_CLK_CKO>;
                VDDA-supply = <&reg_2p5v>;
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
index d80f21abea62..31d4cc62dbc7 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
@@ -250,8 +250,6 @@
                compatible = "fsl,imx6q-nitrogen6_som2-sgtl5000",
                             "fsl,imx-audio-sgtl5000";
                model = "imx6q-nitrogen6_som2-sgtl5000";
-                pinctrl-names = "default";
-                pinctrl-0 = <&pinctrl_sgtl5000>;
                ssi-controller = <&ssi1>;
                audio-codec = <&codec>;
                audio-routing =
@@ -320,6 +318,8 @@
        codec: sgtl5000@0a {
                compatible = "fsl,sgtl5000";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pinctrl_sgtl5000>;
                reg = <0x0a>;
                clocks = <&clks IMX6QDL_CLK_CKO>;
                VDDA-supply = <&reg_2p5v>;
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
index e476d01959ea..26d060484728 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
@@ -533,7 +533,6 @@
                                MX6QDL_PAD_SD2_DAT1__SD2_DATA1          0x17071
                                MX6QDL_PAD_SD2_DAT2__SD2_DATA2          0x17071
                                MX6QDL_PAD_SD2_DAT3__SD2_DATA3          0x17071
-                                MX6QDL_PAD_NANDF_CS2__GPIO6_IO15        0x000b0
                        >;
                };
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index 53e6e63cbb02..89b834f3fa17 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -1100,6 +1100,7 @@
                                interrupts = <0 14 IRQ_TYPE_LEVEL_HIGH>;
                                clocks = <&clks IMX6QDL_CLK_EIM_SLOW>;
                                fsl,weim-cs-gpr = <&gpr>;
+                                status = "disabled";
                        };
                        ocotp: ocotp@021bc000 {
diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
index 4fd6de29f07d..19cbd879c448 100644
--- a/arch/arm/boot/dts/imx6sl.dtsi
+++ b/arch/arm/boot/dts/imx6sl.dtsi
@@ -900,6 +900,7 @@
                                reg = <0x021b8000 0x4000>;
                                interrupts = <0 14 IRQ_TYPE_LEVEL_HIGH>;
                                fsl,weim-cs-gpr = <&gpr>;
+                                status = "disabled";
                        };
                        ocotp: ocotp@021bc000 {
diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
index 076a30f9bcae..10f333016197 100644
--- a/arch/arm/boot/dts/imx6sx.dtsi
+++ b/arch/arm/boot/dts/imx6sx.dtsi
@@ -977,6 +977,7 @@
                                interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
                                clocks = <&clks IMX6SX_CLK_EIM_SLOW>;
                                fsl,weim-cs-gpr = <&gpr>;
+                                status = "disabled";
                        };
                        ocotp: ocotp@021bc000 {
diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
index 268bd470c865..407a4610f4a7 100644
--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
+++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
@@ -4,6 +4,7 @@
 #include <dt-bindings/clock/qcom,gcc-msm8960.h>
 #include <dt-bindings/reset/qcom,gcc-msm8960.h>
 #include <dt-bindings/clock/qcom,mmcc-msm8960.h>
+#include <dt-bindings/clock/qcom,rpmcc.h>
 #include <dt-bindings/soc/qcom,gsbi.h>
 #include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/interrupt-controller/arm-gic.h>
@@ -303,6 +304,9 @@
        firmware {
                scm {
                        compatible = "qcom,scm-apq8064";
+                        clocks = <&rpmcc RPM_DAYTONA_FABRIC_CLK>;
+                        clock-names = "core";
                };
        };
diff --git a/arch/arm/boot/dts/qcom-mdm9615.dtsi b/arch/arm/boot/dts/qcom-mdm9615.dtsi
index 5ae4ec59e6ea..c852b69229c9 100644
--- a/arch/arm/boot/dts/qcom-mdm9615.dtsi
+++ b/arch/arm/boot/dts/qcom-mdm9615.dtsi
@@ -357,7 +357,7 @@
                };
                amba {
-                        compatible = "arm,amba-bus";
+                        compatible = "simple-bus";
                        #address-cells = <1>;
                        #size-cells = <1>;
                        ranges;
diff --git a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
index 735914f6ae44..7cae328398b1 100644
--- a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
+++ b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
@@ -140,6 +140,10 @@
        cpu-supply = <&reg_dcdc3>;
 };
+&de {
+        status = "okay";
+};
 &ehci0 {
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
index 2b26175d55d1..e78faaf9243c 100644
--- a/arch/arm/boot/dts/sun6i-a31.dtsi
+++ b/arch/arm/boot/dts/sun6i-a31.dtsi
@@ -234,6 +234,7 @@
        de: display-engine {
                compatible = "allwinner,sun6i-a31-display-engine";
                allwinner,pipelines = <&fe0>;
+                status = "disabled";
        };
        soc@01c00000 {
diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts
index 5ea4915f6d75..10d307408f23 100644
--- a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts
+++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts
@@ -56,7 +56,7 @@
 };
 &pio {
-        mmc2_pins_nrst: mmc2@0 {
+        mmc2_pins_nrst: mmc2-rst-pin {
                allwinner,pins = "PC16";
                allwinner,function = "gpio_out";
                allwinner,drive = <SUN4I_PINCTRL_10_MA>;
diff --git a/arch/arm/boot/dts/vexpress-v2p-ca15-tc1.dts b/arch/arm/boot/dts/vexpress-v2p-ca15-tc1.dts
index 102838fcc588..15f4fd3f4695 100644
--- a/arch/arm/boot/dts/vexpress-v2p-ca15-tc1.dts
+++ b/arch/arm/boot/dts/vexpress-v2p-ca15-tc1.dts
@@ -81,7 +81,7 @@
                #address-cells = <0>;
                interrupt-controller;
                reg = <0 0x2c001000 0 0x1000>,
-                      <0 0x2c002000 0 0x1000>,
+                      <0 0x2c002000 0 0x2000>,
                      <0 0x2c004000 0 0x2000>,
                      <0 0x2c006000 0 0x2000>;
                interrupts = <1 9 0xf04>;
diff --git a/arch/arm/boot/dts/vexpress-v2p-ca15_a7.dts b/arch/arm/boot/dts/vexpress-v2p-ca15_a7.dts
index 45d08cc37b01..bd107c5a0226 100644
--- a/arch/arm/boot/dts/vexpress-v2p-ca15_a7.dts
+++ b/arch/arm/boot/dts/vexpress-v2p-ca15_a7.dts
@@ -131,7 +131,7 @@
                #address-cells = <0>;
                interrupt-controller;
                reg = <0 0x2c001000 0 0x1000>,
-                      <0 0x2c002000 0 0x1000>,
+                      <0 0x2c002000 0 0x2000>,
                      <0 0x2c004000 0 0x2000>,
                      <0 0x2c006000 0 0x2000>;
                interrupts = <1 9 0xf04>;
diff --git a/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts b/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts
index 7ea617e47fe4..958b4c42d320 100644
--- a/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts
+++ b/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts
@@ -153,7 +153,8 @@
                                        switch0phy1: switch1phy0@1 {
                                                reg = <1>;
                                                interrupt-parent = <&switch0>;
-                                                interrupts = <1 IRQ_TYPE_LEVEL_HIGH>;                                   };
+                                                interrupts = <1 IRQ_TYPE_LEVEL_HIGH>;
+                                        };
                                        switch0phy2: switch1phy0@2 {
                                                reg = <2>;
                                                interrupt-parent = <&switch0>;
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index b01a43851294..028d2b70e3b5 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -471,7 +471,7 @@ CONFIG_MESON_WATCHDOG=y
 CONFIG_DW_WATCHDOG=y
 CONFIG_DIGICOLOR_WATCHDOG=y
 CONFIG_BCM2835_WDT=y
-CONFIG_BCM47XX_WATCHDOG=y
+CONFIG_BCM47XX_WDT=y
 CONFIG_BCM7038_WDT=m
 CONFIG_BCM_KONA_WDT=y
 CONFIG_MFD_ACT8945A=y
@@ -893,7 +893,7 @@ CONFIG_BCM2835_MBOX=y
 CONFIG_RASPBERRYPI_FIRMWARE=y
 CONFIG_EFI_VARS=m
 CONFIG_EFI_CAPSULE_LOADER=m
-CONFIG_CONFIG_BCM47XX_NVRAM=y
+CONFIG_BCM47XX_NVRAM=y
 CONFIG_BCM47XX_SPROM=y
 CONFIG_EXT4_FS=y
 CONFIG_AUTOFS4_FS=y
diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig
index 4364040ed696..1e6c48dd7b11 100644
--- a/arch/arm/configs/s3c2410_defconfig
+++ b/arch/arm/configs/s3c2410_defconfig
@@ -86,9 +86,9 @@ CONFIG_IPV6_TUNNEL=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_DCCP=m
+CONFIG_NF_CT_PROTO_DCCP=y
-CONFIG_NF_CT_PROTO_SCTP=m
+CONFIG_NF_CT_PROTO_SCTP=y
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/arm/mach-davinci/clock.c b/arch/arm/mach-davinci/clock.c
index df42c93a93d6..f5dce9b4e617 100644
--- a/arch/arm/mach-davinci/clock.c
+++ b/arch/arm/mach-davinci/clock.c
@@ -31,10 +31,10 @@ static LIST_HEAD(clocks);
 static DEFINE_MUTEX(clocks_mutex);
 static DEFINE_SPINLOCK(clockfw_lock);
-static void __clk_enable(struct clk *clk)
+void davinci_clk_enable(struct clk *clk)
 {
        if (clk->parent)
-                __clk_enable(clk->parent);
+                davinci_clk_enable(clk->parent);
        if (clk->usecount++ == 0) {
                if (clk->flags & CLK_PSC)
                        davinci_psc_config(clk->domain, clk->gpsc, clk->lpsc,
@@ -44,7 +44,7 @@ static void __clk_enable(struct clk *clk)
        }
 }
-static void __clk_disable(struct clk *clk)
+void davinci_clk_disable(struct clk *clk)
 {
        if (WARN_ON(clk->usecount == 0))
                return;
@@ -56,7 +56,7 @@ static void __clk_disable(struct clk *clk)
                        clk->clk_disable(clk);
        }
        if (clk->parent)
-                __clk_disable(clk->parent);
+                davinci_clk_disable(clk->parent);
 }
 int davinci_clk_reset(struct clk *clk, bool reset)
@@ -103,7 +103,7 @@ int clk_enable(struct clk *clk)
                return -EINVAL;
        spin_lock_irqsave(&clockfw_lock, flags);
-        __clk_enable(clk);
+        davinci_clk_enable(clk);
        spin_unlock_irqrestore(&clockfw_lock, flags);
        return 0;
@@ -118,7 +118,7 @@ void clk_disable(struct clk *clk)
                return;
        spin_lock_irqsave(&clockfw_lock, flags);
-        __clk_disable(clk);
+        davinci_clk_disable(clk);
        spin_unlock_irqrestore(&clockfw_lock, flags);
 }
 EXPORT_SYMBOL(clk_disable);
diff --git a/arch/arm/mach-davinci/clock.h b/arch/arm/mach-davinci/clock.h
index e2a5437a1aee..fa2b83752e03 100644
--- a/arch/arm/mach-davinci/clock.h
+++ b/arch/arm/mach-davinci/clock.h
@@ -132,6 +132,8 @@ int davinci_set_sysclk_rate(struct clk *clk, unsigned long rate);
 int davinci_set_refclk_rate(unsigned long rate);
 int davinci_simple_set_rate(struct clk *clk, unsigned long rate);
 int davinci_clk_reset(struct clk *clk, bool reset);
+void davinci_clk_enable(struct clk *clk);
+void davinci_clk_disable(struct clk *clk);
 extern struct platform_device davinci_wdt_device;
 extern void davinci_watchdog_reset(struct platform_device *);
diff --git a/arch/arm/mach-davinci/da850.c b/arch/arm/mach-davinci/da850.c
index e770c97ea45c..1d873d15b545 100644
--- a/arch/arm/mach-davinci/da850.c
+++ b/arch/arm/mach-davinci/da850.c
@@ -319,6 +319,16 @@ static struct clk emac_clk = {
        .gpsc           = 1,
 };
+/*
+ * In order to avoid adding the emac_clk to the clock lookup table twice (and
+ * screwing up the linked list in the process) create a separate clock for
+ * mdio inheriting the rate from emac_clk.
+ */
+static struct clk mdio_clk = {
+        .name           = "mdio",
+        .parent         = &emac_clk,
+};
 static struct clk mcasp_clk = {
        .name           = "mcasp",
        .parent         = &async3_clk,
@@ -367,6 +377,16 @@ static struct clk aemif_clk = {
        .flags          = ALWAYS_ENABLED,
 };
+/*
+ * In order to avoid adding the aemif_clk to the clock lookup table twice (and
+ * screwing up the linked list in the process) create a separate clock for
+ * nand inheriting the rate from aemif_clk.
+ */
+static struct clk aemif_nand_clk = {
+        .name           = "nand",
+        .parent         = &aemif_clk,
+};
 static struct clk usb11_clk = {
        .name           = "usb11",
        .parent         = &pll0_sysclk4,
@@ -529,7 +549,7 @@ static struct clk_lookup da850_clks[] = {
        CLK(NULL,               "arm",          &arm_clk),
        CLK(NULL,               "rmii",         &rmii_clk),
        CLK("davinci_emac.1",   NULL,           &emac_clk),
-        CLK("davinci_mdio.0",   "fck",          &emac_clk),
+        CLK("davinci_mdio.0",   "fck",          &mdio_clk),
        CLK("davinci-mcasp.0",  NULL,           &mcasp_clk),
        CLK("davinci-mcbsp.0",  NULL,           &mcbsp0_clk),
        CLK("davinci-mcbsp.1",  NULL,           &mcbsp1_clk),
@@ -537,7 +557,15 @@ static struct clk_lookup da850_clks[] = {
        CLK("da830-mmc.0",      NULL,           &mmcsd0_clk),
        CLK("da830-mmc.1",      NULL,           &mmcsd1_clk),
        CLK("ti-aemif",         NULL,           &aemif_clk),
-        CLK(NULL,               "aemif",        &aemif_clk),
+        /*
+         * The only user of this clock is davinci_nand and it get's it through
+         * con_id. The nand node itself is created from within the aemif
+         * driver to guarantee that it's probed after the aemif timing
+         * parameters are configured. of_dev_auxdata is not accessible from
+         * the aemif driver and can't be passed to of_platform_populate(). For
+         * that reason we're leaving the dev_id here as NULL.
+         */
+        CLK(NULL,               "aemif",        &aemif_nand_clk),
        CLK("ohci-da8xx",       "usb11",        &usb11_clk),
        CLK("musb-da8xx",       "usb20",        &usb20_clk),
        CLK("spi_davinci.0",    NULL,           &spi0_clk),
diff --git a/arch/arm/mach-davinci/usb-da8xx.c b/arch/arm/mach-davinci/usb-da8xx.c
index c6feecf7ae24..9a6af0bd5dc3 100644
--- a/arch/arm/mach-davinci/usb-da8xx.c
+++ b/arch/arm/mach-davinci/usb-da8xx.c
@@ -22,6 +22,8 @@
 #define DA8XX_USB0_BASE         0x01e00000
 #define DA8XX_USB1_BASE         0x01e25000
+static struct clk *usb20_clk;
 static struct platform_device da8xx_usb_phy = {
        .name           = "da8xx-usb-phy",
        .id             = -1,
@@ -158,26 +160,13 @@ int __init da8xx_register_usb_refclkin(int rate)
 static void usb20_phy_clk_enable(struct clk *clk)
 {
-        struct clk *usb20_clk;
-        int err;
        u32 val;
        u32 timeout = 500000; /* 500 msec */
        val = readl(DA8XX_SYSCFG0_VIRT(DA8XX_CFGCHIP2_REG));
-        usb20_clk = clk_get(&da8xx_usb20_dev.dev, "usb20");
-        if (IS_ERR(usb20_clk)) {
-                pr_err("could not get usb20 clk: %ld\n", PTR_ERR(usb20_clk));
-                return;
-        }
        /* The USB 2.O PLL requires that the USB 2.O PSC is enabled as well. */
-        err = clk_prepare_enable(usb20_clk);
+        davinci_clk_enable(usb20_clk);
-        if (err) {
-                pr_err("failed to enable usb20 clk: %d\n", err);
-                clk_put(usb20_clk);
-                return;
-        }
        /*
         * Turn on the USB 2.0 PHY, but just the PLL, and not OTG. The USB 1.1
@@ -197,8 +186,7 @@ static void usb20_phy_clk_enable(struct clk *clk)
        pr_err("Timeout waiting for USB 2.0 PHY clock good\n");
 done:
-        clk_disable_unprepare(usb20_clk);
+        davinci_clk_disable(usb20_clk);
-        clk_put(usb20_clk);
 }
 static void usb20_phy_clk_disable(struct clk *clk)
@@ -285,11 +273,19 @@ static struct clk_lookup usb20_phy_clk_lookup =
 int __init da8xx_register_usb20_phy_clk(bool use_usb_refclkin)
 {
        struct clk *parent;
-        int ret = 0;
+        int ret;
+        usb20_clk = clk_get(&da8xx_usb20_dev.dev, "usb20");
+        ret = PTR_ERR_OR_ZERO(usb20_clk);
+        if (ret)
+                return ret;
        parent = clk_get(NULL, use_usb_refclkin ? "usb_refclkin" : "pll0_aux");
-        if (IS_ERR(parent))
+        ret = PTR_ERR_OR_ZERO(parent);
-                return PTR_ERR(parent);
+        if (ret) {
+                clk_put(usb20_clk);
+                return ret;
+        }
        usb20_phy_clk.parent = parent;
        ret = clk_register(&usb20_phy_clk);
diff --git a/arch/arm/mach-exynos/platsmp.c b/arch/arm/mach-exynos/platsmp.c
index 98ffe1e62ad5..a5d68411a037 100644
--- a/arch/arm/mach-exynos/platsmp.c
+++ b/arch/arm/mach-exynos/platsmp.c
@@ -385,36 +385,6 @@ fail:
        return pen_release != -1 ? ret : 0;
 }
-/*
- * Initialise the CPU possible map early - this describes the CPUs
- * which may be present or become present in the system.
- */
-static void __init exynos_smp_init_cpus(void)
-{
-        void __iomem *scu_base = scu_base_addr();
-        unsigned int i, ncores;
-        if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9)
-                ncores = scu_base ? scu_get_core_count(scu_base) : 1;
-        else
-                /*
-                 * CPU Nodes are passed thru DT and set_cpu_possible
-                 * is set by "arm_dt_init_cpu_maps".
-                 */
-                return;
-        /* sanity check */
-        if (ncores > nr_cpu_ids) {
-                pr_warn("SMP: %u cores greater than maximum (%u), clipping\n",
-                        ncores, nr_cpu_ids);
-                ncores = nr_cpu_ids;
-        }
-        for (i = 0; i < ncores; i++)
-                set_cpu_possible(i, true);
-}
 static void __init exynos_smp_prepare_cpus(unsigned int max_cpus)
 {
        int i;
@@ -479,7 +449,6 @@ static void exynos_cpu_die(unsigned int cpu)
 #endif /* CONFIG_HOTPLUG_CPU */
 const struct smp_operations exynos_smp_ops __initconst = {
-        .smp_init_cpus          = exynos_smp_init_cpus,
        .smp_prepare_cpus       = exynos_smp_prepare_cpus,
        .smp_secondary_init     = exynos_secondary_init,
        .smp_boot_secondary     = exynos_boot_secondary,
diff --git a/arch/arm/mach-imx/mach-imx1.c b/arch/arm/mach-imx/mach-imx1.c
index de5ab8d88549..3a8406e45b65 100644
--- a/arch/arm/mach-imx/mach-imx1.c
+++ b/arch/arm/mach-imx/mach-imx1.c
@@ -37,7 +37,6 @@ static const char * const imx1_dt_board_compat[] __initconst = {
 };
 DT_MACHINE_START(IMX1_DT, "Freescale i.MX1 (Device Tree Support)")
-        .map_io         = debug_ll_io_init,
        .init_early     = imx1_init_early,
        .init_irq       = imx1_init_irq,
        .dt_compat      = imx1_dt_board_compat,
diff --git a/arch/arm/mach-s3c24xx/common.c b/arch/arm/mach-s3c24xx/common.c
index f6c3f151d0d4..b59f4f4f256f 100644
--- a/arch/arm/mach-s3c24xx/common.c
+++ b/arch/arm/mach-s3c24xx/common.c
@@ -345,10 +345,40 @@ static struct s3c24xx_dma_channel s3c2410_dma_channels[DMACH_MAX] = {
        [DMACH_USB_EP4] = { S3C24XX_DMA_APB, true, S3C24XX_DMA_CHANREQ(4, 3), },
 };
+static const struct dma_slave_map s3c2410_dma_slave_map[] = {
+        { "s3c2410-sdi", "rx-tx", (void *)DMACH_SDI },
+        { "s3c2410-spi.0", "rx", (void *)DMACH_SPI0_RX },
+        { "s3c2410-spi.0", "tx", (void *)DMACH_SPI0_TX },
+        { "s3c2410-spi.1", "rx", (void *)DMACH_SPI1_RX },
+        { "s3c2410-spi.1", "tx", (void *)DMACH_SPI1_TX },
+        /*
+         * The DMA request source[1] (DMACH_UARTx_SRC2) are
+         * not used in the UART driver.
+         */
+        { "s3c2410-uart.0", "rx", (void *)DMACH_UART0 },
+        { "s3c2410-uart.0", "tx", (void *)DMACH_UART0 },
+        { "s3c2410-uart.1", "rx", (void *)DMACH_UART1 },
+        { "s3c2410-uart.1", "tx", (void *)DMACH_UART1 },
+        { "s3c2410-uart.2", "rx", (void *)DMACH_UART2 },
+        { "s3c2410-uart.2", "tx", (void *)DMACH_UART2 },
+        { "s3c24xx-iis", "rx", (void *)DMACH_I2S_IN },
+        { "s3c24xx-iis", "tx", (void *)DMACH_I2S_OUT },
+        { "s3c-hsudc", "rx0", (void *)DMACH_USB_EP1 },
+        { "s3c-hsudc", "tx0", (void *)DMACH_USB_EP1 },
+        { "s3c-hsudc", "rx1", (void *)DMACH_USB_EP2 },
+        { "s3c-hsudc", "tx1", (void *)DMACH_USB_EP2 },
+        { "s3c-hsudc", "rx2", (void *)DMACH_USB_EP3 },
+        { "s3c-hsudc", "tx2", (void *)DMACH_USB_EP3 },
+        { "s3c-hsudc", "rx3", (void *)DMACH_USB_EP4 },
+        { "s3c-hsudc", "tx3", (void *)DMACH_USB_EP4 }
+};
 static struct s3c24xx_dma_platdata s3c2410_dma_platdata = {
        .num_phy_channels = 4,
        .channels = s3c2410_dma_channels,
        .num_channels = DMACH_MAX,
+        .slave_map = s3c2410_dma_slave_map,
+        .slavecnt = ARRAY_SIZE(s3c2410_dma_slave_map),
 };
 struct platform_device s3c2410_device_dma = {
@@ -388,10 +418,36 @@ static struct s3c24xx_dma_channel s3c2412_dma_channels[DMACH_MAX] = {
        [DMACH_USB_EP4] = { S3C24XX_DMA_APB, true, 16 },
 };
+static const struct dma_slave_map s3c2412_dma_slave_map[] = {
+        { "s3c2412-sdi", "rx-tx", (void *)DMACH_SDI },
+        { "s3c2412-spi.0", "rx", (void *)DMACH_SPI0_RX },
+        { "s3c2412-spi.0", "tx", (void *)DMACH_SPI0_TX },
+        { "s3c2412-spi.1", "rx", (void *)DMACH_SPI1_RX },
+        { "s3c2412-spi.1", "tx", (void *)DMACH_SPI1_TX },
+        { "s3c2440-uart.0", "rx", (void *)DMACH_UART0 },
+        { "s3c2440-uart.0", "tx", (void *)DMACH_UART0 },
+        { "s3c2440-uart.1", "rx", (void *)DMACH_UART1 },
+        { "s3c2440-uart.1", "tx", (void *)DMACH_UART1 },
+        { "s3c2440-uart.2", "rx", (void *)DMACH_UART2 },
+        { "s3c2440-uart.2", "tx", (void *)DMACH_UART2 },
+        { "s3c2412-iis", "rx", (void *)DMACH_I2S_IN },
+        { "s3c2412-iis", "tx", (void *)DMACH_I2S_OUT },
+        { "s3c-hsudc", "rx0", (void *)DMACH_USB_EP1 },
+        { "s3c-hsudc", "tx0", (void *)DMACH_USB_EP1 },
+        { "s3c-hsudc", "rx1", (void *)DMACH_USB_EP2 },
+        { "s3c-hsudc", "tx1", (void *)DMACH_USB_EP2 },
+        { "s3c-hsudc", "rx2", (void *)DMACH_USB_EP3 },
+        { "s3c-hsudc", "tx2", (void *)DMACH_USB_EP3 },
+        { "s3c-hsudc", "rx3", (void *)DMACH_USB_EP4 },
+        { "s3c-hsudc", "tx3", (void *)DMACH_USB_EP4 }
+};
 static struct s3c24xx_dma_platdata s3c2412_dma_platdata = {
        .num_phy_channels = 4,
        .channels = s3c2412_dma_channels,
        .num_channels = DMACH_MAX,
+        .slave_map = s3c2412_dma_slave_map,
+        .slavecnt = ARRAY_SIZE(s3c2412_dma_slave_map),
 };
 struct platform_device s3c2412_device_dma = {
@@ -534,10 +590,30 @@ static struct s3c24xx_dma_channel s3c2443_dma_channels[DMACH_MAX] = {
        [DMACH_MIC_IN] = { S3C24XX_DMA_APB, true, 29 },
 };
+static const struct dma_slave_map s3c2443_dma_slave_map[] = {
+        { "s3c2440-sdi", "rx-tx", (void *)DMACH_SDI },
+        { "s3c2443-spi.0", "rx", (void *)DMACH_SPI0_RX },
+        { "s3c2443-spi.0", "tx", (void *)DMACH_SPI0_TX },
+        { "s3c2443-spi.1", "rx", (void *)DMACH_SPI1_RX },
+        { "s3c2443-spi.1", "tx", (void *)DMACH_SPI1_TX },
+        { "s3c2440-uart.0", "rx", (void *)DMACH_UART0 },
+        { "s3c2440-uart.0", "tx", (void *)DMACH_UART0 },
+        { "s3c2440-uart.1", "rx", (void *)DMACH_UART1 },
+        { "s3c2440-uart.1", "tx", (void *)DMACH_UART1 },
+        { "s3c2440-uart.2", "rx", (void *)DMACH_UART2 },
+        { "s3c2440-uart.2", "tx", (void *)DMACH_UART2 },
+        { "s3c2440-uart.3", "rx", (void *)DMACH_UART3 },
+        { "s3c2440-uart.3", "tx", (void *)DMACH_UART3 },
+        { "s3c24xx-iis", "rx", (void *)DMACH_I2S_IN },
+        { "s3c24xx-iis", "tx", (void *)DMACH_I2S_OUT },
+};
 static struct s3c24xx_dma_platdata s3c2443_dma_platdata = {
        .num_phy_channels = 6,
        .channels = s3c2443_dma_channels,
        .num_channels = DMACH_MAX,
+        .slave_map = s3c2443_dma_slave_map,
+        .slavecnt = ARRAY_SIZE(s3c2443_dma_slave_map),
 };
 struct platform_device s3c2443_device_dma = {
diff --git a/arch/arm/mach-ux500/pm.c b/arch/arm/mach-ux500/pm.c
index 8538910db202..a970e7fcba9e 100644
--- a/arch/arm/mach-ux500/pm.c
+++ b/arch/arm/mach-ux500/pm.c
@@ -134,8 +134,8 @@ bool prcmu_pending_irq(void)
 */
 bool prcmu_is_cpu_in_wfi(int cpu)
 {
-        return readl(PRCM_ARM_WFI_STANDBY) & cpu ? PRCM_ARM_WFI_STANDBY_WFI1 :
+        return readl(PRCM_ARM_WFI_STANDBY) &
-                     PRCM_ARM_WFI_STANDBY_WFI0;
+                (cpu ? PRCM_ARM_WFI_STANDBY_WFI1 : PRCM_ARM_WFI_STANDBY_WFI0);
 }
 /*
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
index fc033c0d2a0f..eada0b58ba1c 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
@@ -356,5 +356,21 @@
                                status = "disabled";
                        };
                };
+                vpu: vpu@d0100000 {
+                        compatible = "amlogic,meson-gx-vpu";
+                        reg = <0x0 0xd0100000 0x0 0x100000>,
+                              <0x0 0xc883c000 0x0 0x1000>,
+                              <0x0 0xc8838000 0x0 0x1000>;
+                        reg-names = "vpu", "hhi", "dmc";
+                        interrupts = <GIC_SPI 3 IRQ_TYPE_EDGE_RISING>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        /* CVBS VDAC output port */
+                        cvbs_vdac_port: port@0 {
+                                reg = <0>;
+                        };
+                };
        };
 };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
index 969682092e0f..4cbd626a9e88 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
@@ -142,6 +142,16 @@
                clocks = <&wifi32k>;
                clock-names = "ext_clock";
        };
+        cvbs-connector {
+                compatible = "composite-video-connector";
+                port {
+                        cvbs_connector_in: endpoint {
+                                remote-endpoint = <&cvbs_vdac_out>;
+                        };
+                };
+        };
 };
 &uart_AO {
@@ -229,3 +239,9 @@
        clocks = <&clkc CLKID_FCLK_DIV4>;
        clock-names = "clkin0";
 };
+&cvbs_vdac_port {
+        cvbs_vdac_out: endpoint {
+                remote-endpoint = <&cvbs_connector_in>;
+        };
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
index 238fbeacd330..5d28e1cdc998 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
@@ -137,6 +137,10 @@
        };
 };
+&scpi_clocks {
+        status = "disabled";
+};
 &uart_AO {
        status = "okay";
        pinctrl-0 = <&uart_ao_a_pins>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
index 203be28978d5..4a96e0f6f926 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
@@ -125,6 +125,16 @@
                clocks = <&wifi32k>;
                clock-names = "ext_clock";
        };
+        cvbs-connector {
+                compatible = "composite-video-connector";
+                port {
+                        cvbs_connector_in: endpoint {
+                                remote-endpoint = <&cvbs_vdac_out>;
+                        };
+                };
+        };
 };
 /* This UART is brought out to the DB9 connector */
@@ -234,3 +244,9 @@
        clocks = <&clkc CLKID_FCLK_DIV4>;
        clock-names = "clkin0";
 };
+&cvbs_vdac_port {
+        cvbs_vdac_out: endpoint {
+                remote-endpoint = <&cvbs_connector_in>;
+        };
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
index 51edd5b5c460..b35307321b63 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
@@ -55,7 +55,7 @@
                mboxes = <&mailbox 1 &mailbox 2>;
                shmem = <&cpu_scp_lpri &cpu_scp_hpri>;
-                clocks {
+                scpi_clocks: clocks {
                        compatible = "arm,scpi-clocks";
                        scpi_dvfs: scpi_clocks@0 {
@@ -506,3 +506,7 @@
                 <&clkc CLKID_FCLK_DIV2>;
        clock-names = "core", "clkin0", "clkin1";
 };
+&vpu {
+        compatible = "amlogic,meson-gxbb-vpu", "amlogic,meson-gx-vpu";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-nexbox-a95x.dts
index e99101ae9664..cea4a3eded9b 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-nexbox-a95x.dts
@@ -117,6 +117,16 @@
                clocks = <&wifi32k>;
                clock-names = "ext_clock";
        };
+        cvbs-connector {
+                compatible = "composite-video-connector";
+                port {
+                        cvbs_connector_in: endpoint {
+                                remote-endpoint = <&cvbs_vdac_out>;
+                        };
+                };
+        };
 };
 &uart_AO {
@@ -203,3 +213,9 @@
        clocks = <&clkc CLKID_FCLK_DIV4>;
        clock-names = "clkin0";
 };
+&cvbs_vdac_port {
+        cvbs_vdac_out: endpoint {
+                remote-endpoint = <&cvbs_connector_in>;
+        };
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
index 9f89b99c4806..69216246275d 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -43,7 +43,7 @@
 #include "meson-gx.dtsi"
 #include <dt-bindings/clock/gxbb-clkc.h>
-#include <dt-bindings/gpio/meson-gxbb-gpio.h>
+#include <dt-bindings/gpio/meson-gxl-gpio.h>
 / {
        compatible = "amlogic,meson-gxl";
@@ -299,3 +299,7 @@
                 <&clkc CLKID_FCLK_DIV2>;
        clock-names = "core", "clkin0", "clkin1";
 };
+&vpu {
+        compatible = "amlogic,meson-gxl-vpu", "amlogic,meson-gx-vpu";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
index f859d75db8bd..5a337d339df1 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
@@ -90,6 +90,16 @@
                compatible = "mmc-pwrseq-emmc";
                reset-gpios = <&gpio BOOT_9 GPIO_ACTIVE_LOW>;
        };
+        cvbs-connector {
+                compatible = "composite-video-connector";
+                port {
+                        cvbs_connector_in: endpoint {
+                                remote-endpoint = <&cvbs_vdac_out>;
+                        };
+                };
+        };
 };
 /* This UART is brought out to the DB9 connector */
@@ -167,3 +177,9 @@
                max-speed = <1000>;
        };
 };
+&cvbs_vdac_port {
+        cvbs_vdac_out: endpoint {
+                remote-endpoint = <&cvbs_connector_in>;
+        };
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
index c1974bbbddea..eb2f0c3e5e53 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
@@ -112,3 +112,7 @@
                };
        };
 };
+&vpu {
+        compatible = "amlogic,meson-gxm-vpu", "amlogic,meson-gx-vpu";
+};
diff --git a/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts b/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts
index a852e28a40e1..a83ed2c6bbf7 100644
--- a/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts
+++ b/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts
@@ -81,7 +81,7 @@
                #address-cells = <0>;
                interrupt-controller;
                reg = <0x0 0x2c001000 0 0x1000>,
-                      <0x0 0x2c002000 0 0x1000>,
+                      <0x0 0x2c002000 0 0x2000>,
                      <0x0 0x2c004000 0 0x2000>,
                      <0x0 0x2c006000 0 0x2000>;
                interrupts = <1 9 0xf04>;
diff --git a/arch/arm64/boot/dts/exynos/exynos5433.dtsi b/arch/arm64/boot/dts/exynos/exynos5433.dtsi
index 64226d5ae471..135890cd8a85 100644
--- a/arch/arm64/boot/dts/exynos/exynos5433.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos5433.dtsi
@@ -1367,7 +1367,7 @@
                };
                amba {
-                        compatible = "arm,amba-bus";
+                        compatible = "simple-bus";
                        #address-cells = <1>;
                        #size-cells = <1>;
                        ranges;
diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
index 9d1d7ad9b075..29ed6b61c737 100644
--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
@@ -64,6 +64,16 @@
                        reg = <0x0 0x86000000 0x0 0x200000>;
                        no-map;
                };
+                memory@85800000 {
+                        reg = <0x0 0x85800000 0x0 0x800000>;
+                        no-map;
+                };
+                memory@86200000 {
+                        reg = <0x0 0x86200000 0x0 0x2600000>;
+                        no-map;
+                };
        };
        cpus {
diff --git a/arch/arm64/boot/dts/renesas/r8a7795-h3ulcb.dts b/arch/arm64/boot/dts/renesas/r8a7795-h3ulcb.dts
index 6ffb0517421a..dbea2c3d8f0c 100644
--- a/arch/arm64/boot/dts/renesas/r8a7795-h3ulcb.dts
+++ b/arch/arm64/boot/dts/renesas/r8a7795-h3ulcb.dts
@@ -169,7 +169,7 @@
                power-source = <3300>;
        };
-        sdhi0_pins_uhs: sd0 {
+        sdhi0_pins_uhs: sd0_uhs {
                groups = "sdhi0_data4", "sdhi0_ctrl";
                function = "sdhi0";
                power-source = <1800>;
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts b/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
index 358089687a69..ef1b9e573af0 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
+++ b/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
@@ -27,7 +27,7 @@
                stdout-path = "serial0:115200n8";
        };
-        memory {
+        memory@0 {
                device_type = "memory";
                reg = <0x0 0x0 0x0 0x40000000>;
        };
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
index 68a908334c7b..54dc28351c8c 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
@@ -72,7 +72,7 @@
                             <1 10 0xf08>;
        };
-        amba_apu {
+        amba_apu: amba_apu@0 {
                compatible = "simple-bus";
                #address-cells = <2>;
                #size-cells = <1>;
@@ -175,7 +175,7 @@
                };
                i2c0: i2c@ff020000 {
-                        compatible = "cdns,i2c-r1p10";
+                        compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
                        status = "disabled";
                        interrupt-parent = <&gic>;
                        interrupts = <0 17 4>;
@@ -185,7 +185,7 @@
                };
                i2c1: i2c@ff030000 {
-                        compatible = "cdns,i2c-r1p10";
+                        compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
                        status = "disabled";
                        interrupt-parent = <&gic>;
                        interrupts = <0 18 4>;
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 869dded0f09f..33b744d54739 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -331,6 +331,7 @@ CONFIG_DRM_VC4=m
 CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_I2C_ADV7511=m
 CONFIG_DRM_HISI_KIRIN=m
+CONFIG_DRM_MESON=m
 CONFIG_FB=y
 CONFIG_FB_ARMCLCD=y
 CONFIG_BACKLIGHT_GENERIC=m
diff --git a/arch/arm64/include/asm/asm-uaccess.h b/arch/arm64/include/asm/asm-uaccess.h
new file mode 100644
index 000000000000..df411f3e083c
--- /dev/null
+++ b/arch/arm64/include/asm/asm-uaccess.h
@@ -0,0 +1,65 @@
+#ifndef __ASM_ASM_UACCESS_H
+#define __ASM_ASM_UACCESS_H
+#include <asm/alternative.h>
+#include <asm/kernel-pgtable.h>
+#include <asm/sysreg.h>
+#include <asm/assembler.h>
+/*
+ * User access enabling/disabling macros.
+ */
+#ifdef CONFIG_ARM64_SW_TTBR0_PAN
+        .macro  __uaccess_ttbr0_disable, tmp1
+        mrs     \tmp1, ttbr1_el1                // swapper_pg_dir
+        add     \tmp1, \tmp1, #SWAPPER_DIR_SIZE // reserved_ttbr0 at the end of swapper_pg_dir
+        msr     ttbr0_el1, \tmp1                // set reserved TTBR0_EL1
+        isb
+        .endm
+        .macro  __uaccess_ttbr0_enable, tmp1
+        get_thread_info \tmp1
+        ldr     \tmp1, [\tmp1, #TSK_TI_TTBR0]   // load saved TTBR0_EL1
+        msr     ttbr0_el1, \tmp1                // set the non-PAN TTBR0_EL1
+        isb
+        .endm
+        .macro  uaccess_ttbr0_disable, tmp1
+alternative_if_not ARM64_HAS_PAN
+        __uaccess_ttbr0_disable \tmp1
+alternative_else_nop_endif
+        .endm
+        .macro  uaccess_ttbr0_enable, tmp1, tmp2
+alternative_if_not ARM64_HAS_PAN
+        save_and_disable_irq \tmp2              // avoid preemption
+        __uaccess_ttbr0_enable \tmp1
+        restore_irq \tmp2
+alternative_else_nop_endif
+        .endm
+#else
+        .macro  uaccess_ttbr0_disable, tmp1
+        .endm
+        .macro  uaccess_ttbr0_enable, tmp1, tmp2
+        .endm
+#endif
+/*
+ * These macros are no-ops when UAO is present.
+ */
+        .macro  uaccess_disable_not_uao, tmp1
+        uaccess_ttbr0_disable \tmp1
+alternative_if ARM64_ALT_PAN_NOT_UAO
+        SET_PSTATE_PAN(1)
+alternative_else_nop_endif
+        .endm
+        .macro  uaccess_enable_not_uao, tmp1, tmp2
+        uaccess_ttbr0_enable \tmp1, \tmp2
+alternative_if ARM64_ALT_PAN_NOT_UAO
+        SET_PSTATE_PAN(0)
+alternative_else_nop_endif
+        .endm
+#endif
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index d26750ca6e06..46da3ea638bb 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -22,8 +22,6 @@
 #include <asm/kernel-pgtable.h>
 #include <asm/sysreg.h>
-#ifndef __ASSEMBLY__
 /*
 * User space memory access functions
 */
@@ -424,66 +422,4 @@ extern long strncpy_from_user(char *dest, const char __user *src, long count);
 extern __must_check long strlen_user(const char __user *str);
 extern __must_check long strnlen_user(const char __user *str, long n);
-#else   /* __ASSEMBLY__ */
-#include <asm/assembler.h>
-/*
- * User access enabling/disabling macros.
- */
-#ifdef CONFIG_ARM64_SW_TTBR0_PAN
-        .macro  __uaccess_ttbr0_disable, tmp1
-        mrs     \tmp1, ttbr1_el1                // swapper_pg_dir
-        add     \tmp1, \tmp1, #SWAPPER_DIR_SIZE // reserved_ttbr0 at the end of swapper_pg_dir
-        msr     ttbr0_el1, \tmp1                // set reserved TTBR0_EL1
-        isb
-        .endm
-        .macro  __uaccess_ttbr0_enable, tmp1
-        get_thread_info \tmp1
-        ldr     \tmp1, [\tmp1, #TSK_TI_TTBR0]   // load saved TTBR0_EL1
-        msr     ttbr0_el1, \tmp1                // set the non-PAN TTBR0_EL1
-        isb
-        .endm
-        .macro  uaccess_ttbr0_disable, tmp1
-alternative_if_not ARM64_HAS_PAN
-        __uaccess_ttbr0_disable \tmp1
-alternative_else_nop_endif
-        .endm
-        .macro  uaccess_ttbr0_enable, tmp1, tmp2
-alternative_if_not ARM64_HAS_PAN
-        save_and_disable_irq \tmp2              // avoid preemption
-        __uaccess_ttbr0_enable \tmp1
-        restore_irq \tmp2
-alternative_else_nop_endif
-        .endm
-#else
-        .macro  uaccess_ttbr0_disable, tmp1
-        .endm
-        .macro  uaccess_ttbr0_enable, tmp1, tmp2
-        .endm
-#endif
-/*
- * These macros are no-ops when UAO is present.
- */
-        .macro  uaccess_disable_not_uao, tmp1
-        uaccess_ttbr0_disable \tmp1
-alternative_if ARM64_ALT_PAN_NOT_UAO
-        SET_PSTATE_PAN(1)
-alternative_else_nop_endif
-        .endm
-        .macro  uaccess_enable_not_uao, tmp1, tmp2
-        uaccess_ttbr0_enable \tmp1, \tmp2
-alternative_if ARM64_ALT_PAN_NOT_UAO
-        SET_PSTATE_PAN(0)
-alternative_else_nop_endif
-        .endm
-#endif  /* __ASSEMBLY__ */
 #endif /* __ASM_UACCESS_H */
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index a7504f40d7ee..923841ffe4a9 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -31,7 +31,7 @@
 #include <asm/memory.h>
 #include <asm/ptrace.h>
 #include <asm/thread_info.h>
-#include <linux/uaccess.h>
+#include <asm/asm-uaccess.h>
 #include <asm/unistd.h>
 /*
diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S
index add4a1334085..e88fb99c1561 100644
--- a/arch/arm64/lib/clear_user.S
+++ b/arch/arm64/lib/clear_user.S
@@ -17,7 +17,7 @@
 */
 #include <linux/linkage.h>
-#include <linux/uaccess.h>
+#include <asm/asm-uaccess.h>
        .text
diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
index fd6cd05593f9..4b5d826895ff 100644
--- a/arch/arm64/lib/copy_from_user.S
+++ b/arch/arm64/lib/copy_from_user.S
@@ -17,7 +17,7 @@
 #include <linux/linkage.h>
 #include <asm/cache.h>
-#include <linux/uaccess.h>
+#include <asm/asm-uaccess.h>
 /*
 * Copy from user space to a kernel buffer (alignment handled by the hardware)
diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
index d828540ded6f..47184c3a97da 100644
--- a/arch/arm64/lib/copy_in_user.S
+++ b/arch/arm64/lib/copy_in_user.S
@@ -19,7 +19,7 @@
 #include <linux/linkage.h>
 #include <asm/cache.h>
-#include <linux/uaccess.h>
+#include <asm/asm-uaccess.h>
 /*
 * Copy from user space to user space (alignment handled by the hardware)
diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
index 3e6ae2663b82..351f0766f7a6 100644
--- a/arch/arm64/lib/copy_to_user.S
+++ b/arch/arm64/lib/copy_to_user.S
@@ -17,7 +17,7 @@
 #include <linux/linkage.h>
 #include <asm/cache.h>
-#include <linux/uaccess.h>
+#include <asm/asm-uaccess.h>
 /*
 * Copy to user space from a kernel buffer (alignment handled by the hardware)
diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S
index 17f422a4dc55..83c27b6e6dca 100644
--- a/arch/arm64/mm/cache.S
+++ b/arch/arm64/mm/cache.S
@@ -23,7 +23,7 @@
 #include <asm/assembler.h>
 #include <asm/cpufeature.h>
 #include <asm/alternative.h>
-#include <linux/uaccess.h>
+#include <asm/asm-uaccess.h>
 /*
 *      flush_icache_range(start,end)
diff --git a/arch/arm64/xen/hypercall.S b/arch/arm64/xen/hypercall.S
index 47cf3f9d89ff..947830a459d2 100644
--- a/arch/arm64/xen/hypercall.S
+++ b/arch/arm64/xen/hypercall.S
@@ -49,7 +49,7 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <linux/uaccess.h>
+#include <asm/asm-uaccess.h>
 #include <xen/interface/xen.h>
diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
index 68557f52b961..854022772c5b 100644
--- a/arch/x86/include/asm/bitops.h
+++ b/arch/x86/include/asm/bitops.h
@@ -139,6 +139,19 @@ static __always_inline void __clear_bit(long nr, volatile unsigned long *addr)
        asm volatile("btr %1,%0" : ADDR : "Ir" (nr));
 }
+static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile unsigned long *addr)
+{
+        bool negative;
+        asm volatile(LOCK_PREFIX "andb %2,%1\n\t"
+                CC_SET(s)
+                : CC_OUT(s) (negative), ADDR
+                : "ir" ((char) ~(1 << nr)) : "memory");
+        return negative;
+}
+// Let everybody know we have it
+#define clear_bit_unlock_is_negative_byte clear_bit_unlock_is_negative_byte
 /*
 * __clear_bit_unlock - Clears a bit in memory
 * @nr: Bit to clear
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index ffacfdcacb85..a5fd137417a2 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -1182,6 +1182,9 @@ static int threshold_create_bank(unsigned int cpu, unsigned int bank)
        const char *name = get_name(bank, NULL);
        int err = 0;
+        if (!dev)
+                return -ENODEV;
        if (is_shared_bank(bank)) {
                nb = node_to_amd_nb(amd_get_nb_id(cpu));
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index f616ad74cce7..44e888b0b041 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -1461,16 +1461,25 @@ static int test_acomp(struct crypto_acomp *tfm, struct comp_testvec *ctemplate,
        for (i = 0; i < ctcount; i++) {
                unsigned int dlen = COMP_BUF_SIZE;
                int ilen = ctemplate[i].inlen;
+                void *input_vec;
+                input_vec = kmalloc(ilen, GFP_KERNEL);
+                if (!input_vec) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+                memcpy(input_vec, ctemplate[i].input, ilen);
                memset(output, 0, dlen);
                init_completion(&result.completion);
-                sg_init_one(&src, ctemplate[i].input, ilen);
+                sg_init_one(&src, input_vec, ilen);
                sg_init_one(&dst, output, dlen);
                req = acomp_request_alloc(tfm);
                if (!req) {
                        pr_err("alg: acomp: request alloc failed for %s\n",
                               algo);
+                        kfree(input_vec);
                        ret = -ENOMEM;
                        goto out;
                }
@@ -1483,6 +1492,7 @@ static int test_acomp(struct crypto_acomp *tfm, struct comp_testvec *ctemplate,
                if (ret) {
                        pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
                               i + 1, algo, -ret);
+                        kfree(input_vec);
                        acomp_request_free(req);
                        goto out;
                }
@@ -1491,6 +1501,7 @@ static int test_acomp(struct crypto_acomp *tfm, struct comp_testvec *ctemplate,
                        pr_err("alg: acomp: Compression test %d failed for %s: output len = %d\n",
                               i + 1, algo, req->dlen);
                        ret = -EINVAL;
+                        kfree(input_vec);
                        acomp_request_free(req);
                        goto out;
                }
@@ -1500,26 +1511,37 @@ static int test_acomp(struct crypto_acomp *tfm, struct comp_testvec *ctemplate,
                               i + 1, algo);
                        hexdump(output, req->dlen);
                        ret = -EINVAL;
+                        kfree(input_vec);
                        acomp_request_free(req);
                        goto out;
                }
+                kfree(input_vec);
                acomp_request_free(req);
        }
        for (i = 0; i < dtcount; i++) {
                unsigned int dlen = COMP_BUF_SIZE;
                int ilen = dtemplate[i].inlen;
+                void *input_vec;
+                input_vec = kmalloc(ilen, GFP_KERNEL);
+                if (!input_vec) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+                memcpy(input_vec, dtemplate[i].input, ilen);
                memset(output, 0, dlen);
                init_completion(&result.completion);
-                sg_init_one(&src, dtemplate[i].input, ilen);
+                sg_init_one(&src, input_vec, ilen);
                sg_init_one(&dst, output, dlen);
                req = acomp_request_alloc(tfm);
                if (!req) {
                        pr_err("alg: acomp: request alloc failed for %s\n",
                               algo);
+                        kfree(input_vec);
                        ret = -ENOMEM;
                        goto out;
                }
@@ -1532,6 +1554,7 @@ static int test_acomp(struct crypto_acomp *tfm, struct comp_testvec *ctemplate,
                if (ret) {
                        pr_err("alg: acomp: decompression failed on test %d for %s: ret=%d\n",
                               i + 1, algo, -ret);
+                        kfree(input_vec);
                        acomp_request_free(req);
                        goto out;
                }
@@ -1540,6 +1563,7 @@ static int test_acomp(struct crypto_acomp *tfm, struct comp_testvec *ctemplate,
                        pr_err("alg: acomp: Decompression test %d failed for %s: output len = %d\n",
                               i + 1, algo, req->dlen);
                        ret = -EINVAL;
+                        kfree(input_vec);
                        acomp_request_free(req);
                        goto out;
                }
@@ -1549,10 +1573,12 @@ static int test_acomp(struct crypto_acomp *tfm, struct comp_testvec *ctemplate,
                               i + 1, algo);
                        hexdump(output, req->dlen);
                        ret = -EINVAL;
+                        kfree(input_vec);
                        acomp_request_free(req);
                        goto out;
                }
+                kfree(input_vec);
                acomp_request_free(req);
        }
diff --git a/drivers/crypto/marvell/cesa.h b/drivers/crypto/marvell/cesa.h
index a768da7138a1..b7872f62f674 100644
--- a/drivers/crypto/marvell/cesa.h
+++ b/drivers/crypto/marvell/cesa.h
@@ -273,7 +273,8 @@ struct mv_cesa_op_ctx {
 #define CESA_TDMA_SRC_IN_SRAM                   BIT(30)
 #define CESA_TDMA_END_OF_REQ                    BIT(29)
 #define CESA_TDMA_BREAK_CHAIN                   BIT(28)
-#define CESA_TDMA_TYPE_MSK                      GENMASK(27, 0)
+#define CESA_TDMA_SET_STATE                     BIT(27)
+#define CESA_TDMA_TYPE_MSK                      GENMASK(26, 0)
 #define CESA_TDMA_DUMMY                         0
 #define CESA_TDMA_DATA                          1
 #define CESA_TDMA_OP                            2
diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
index 317cf029c0cf..77c0fb936f47 100644
--- a/drivers/crypto/marvell/hash.c
+++ b/drivers/crypto/marvell/hash.c
@@ -280,13 +280,32 @@ static void mv_cesa_ahash_std_prepare(struct ahash_request *req)
        sreq->offset = 0;
 }
+static void mv_cesa_ahash_dma_step(struct ahash_request *req)
+{
+        struct mv_cesa_ahash_req *creq = ahash_request_ctx(req);
+        struct mv_cesa_req *base = &creq->base;
+        /* We must explicitly set the digest state. */
+        if (base->chain.first->flags & CESA_TDMA_SET_STATE) {
+                struct mv_cesa_engine *engine = base->engine;
+                int i;
+                /* Set the hash state in the IVDIG regs. */
+                for (i = 0; i < ARRAY_SIZE(creq->state); i++)
+                        writel_relaxed(creq->state[i], engine->regs +
+                                       CESA_IVDIG(i));
+        }
+        mv_cesa_dma_step(base);
+}
 static void mv_cesa_ahash_step(struct crypto_async_request *req)
 {
        struct ahash_request *ahashreq = ahash_request_cast(req);
        struct mv_cesa_ahash_req *creq = ahash_request_ctx(ahashreq);
        if (mv_cesa_req_get_type(&creq->base) == CESA_DMA_REQ)
-                mv_cesa_dma_step(&creq->base);
+                mv_cesa_ahash_dma_step(ahashreq);
        else
                mv_cesa_ahash_std_step(ahashreq);
 }
@@ -584,12 +603,16 @@ static int mv_cesa_ahash_dma_req_init(struct ahash_request *req)
        struct mv_cesa_ahash_dma_iter iter;
        struct mv_cesa_op_ctx *op = NULL;
        unsigned int frag_len;
+        bool set_state = false;
        int ret;
        u32 type;
        basereq->chain.first = NULL;
        basereq->chain.last = NULL;
+        if (!mv_cesa_mac_op_is_first_frag(&creq->op_tmpl))
+                set_state = true;
        if (creq->src_nents) {
                ret = dma_map_sg(cesa_dev->dev, req->src, creq->src_nents,
                                 DMA_TO_DEVICE);
@@ -683,6 +706,15 @@ static int mv_cesa_ahash_dma_req_init(struct ahash_request *req)
        if (type != CESA_TDMA_RESULT)
                basereq->chain.last->flags |= CESA_TDMA_BREAK_CHAIN;
+        if (set_state) {
+                /*
+                 * Put the CESA_TDMA_SET_STATE flag on the first tdma desc to
+                 * let the step logic know that the IVDIG registers should be
+                 * explicitly set before launching a TDMA chain.
+                 */
+                basereq->chain.first->flags |= CESA_TDMA_SET_STATE;
+        }
        return 0;
 err_free_tdma:
diff --git a/drivers/crypto/marvell/tdma.c b/drivers/crypto/marvell/tdma.c
index 4416b88eca70..c76375ff376d 100644
--- a/drivers/crypto/marvell/tdma.c
+++ b/drivers/crypto/marvell/tdma.c
@@ -109,7 +109,14 @@ void mv_cesa_tdma_chain(struct mv_cesa_engine *engine,
                last->next = dreq->chain.first;
                engine->chain.last = dreq->chain.last;
-                if (!(last->flags & CESA_TDMA_BREAK_CHAIN))
+                /*
+                 * Break the DMA chain if the CESA_TDMA_BREAK_CHAIN is set on
+                 * the last element of the current chain, or if the request
+                 * being queued needs the IV regs to be set before lauching
+                 * the request.
+                 */
+                if (!(last->flags & CESA_TDMA_BREAK_CHAIN) &&
+                    !(dreq->chain.first->flags & CESA_TDMA_SET_STATE))
                        last->next_dma = dreq->chain.first->cur_dma;
        }
 }
diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
index 70e13230d8db..9ad0b1934be9 100644
--- a/drivers/firmware/arm_scpi.c
+++ b/drivers/firmware/arm_scpi.c
@@ -721,11 +721,17 @@ static int scpi_sensor_get_value(u16 sensor, u64 *val)
        ret = scpi_send_message(CMD_SENSOR_VALUE, &id, sizeof(id),
                                &buf, sizeof(buf));
-        if (!ret)
+        if (ret)
+                return ret;
+        if (scpi_info->is_legacy)
+                /* only 32-bits supported, hi_val can be junk */
+                *val = le32_to_cpu(buf.lo_val);
+        else
                *val = (u64)le32_to_cpu(buf.hi_val) << 32 |
                        le32_to_cpu(buf.lo_val);
-        return ret;
+        return 0;
 }
 static int scpi_device_get_power_state(u16 dev_id)
diff --git a/drivers/firmware/psci_checker.c b/drivers/firmware/psci_checker.c
index 44bdb78f837b..29d58feaf675 100644
--- a/drivers/firmware/psci_checker.c
+++ b/drivers/firmware/psci_checker.c
@@ -270,8 +270,7 @@ static int suspend_test_thread(void *arg)
        struct cpuidle_device *dev;
        struct cpuidle_driver *drv;
        /* No need for an actual callback, we just want to wake up the CPU. */
-        struct timer_list wakeup_timer =
+        struct timer_list wakeup_timer;
-                TIMER_INITIALIZER(dummy_callback, 0, 0);
        /* Wait for the main thread to give the start signal. */
        wait_for_completion(&suspend_threads_started);
@@ -287,6 +286,7 @@ static int suspend_test_thread(void *arg)
        pr_info("CPU %d entering suspend cycles, states 1 through %d\n",
                cpu, drv->state_count - 1);
+        setup_timer_on_stack(&wakeup_timer, dummy_callback, 0);
        for (i = 0; i < NUM_SUSPEND_CYCLE; ++i) {
                int index;
                /*
diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
index cbeea915f026..8037426ec50f 100644
--- a/drivers/net/ethernet/korina.c
+++ b/drivers/net/ethernet/korina.c
@@ -900,10 +900,10 @@ static void korina_restart_task(struct work_struct *work)
                                DMA_STAT_DONE | DMA_STAT_HALT | DMA_STAT_ERR,
                                &lp->rx_dma_regs->dmasm);
-        korina_free_ring(dev);
        napi_disable(&lp->napi);
+        korina_free_ring(dev);
        if (korina_init(dev) < 0) {
                printk(KERN_ERR "%s: cannot restart device\n", dev->name);
                return;
@@ -1064,12 +1064,12 @@ static int korina_close(struct net_device *dev)
        tmp = tmp | DMA_STAT_DONE | DMA_STAT_HALT | DMA_STAT_ERR;
        writel(tmp, &lp->rx_dma_regs->dmasm);
-        korina_free_ring(dev);
        napi_disable(&lp->napi);
        cancel_work_sync(&lp->restart_task);
+        korina_free_ring(dev);
        free_irq(lp->rx_irq, dev);
        free_irq(lp->tx_irq, dev);
        free_irq(lp->ovr_irq, dev);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index bcd955339058..edbe200ac2fa 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1638,7 +1638,8 @@ int mlx4_en_start_port(struct net_device *dev)
        /* Configure tx cq's and rings */
        for (t = 0 ; t < MLX4_EN_NUM_TX_TYPES; t++) {
-                u8 num_tx_rings_p_up = t == TX ? priv->num_tx_rings_p_up : 1;
+                u8 num_tx_rings_p_up = t == TX ?
+                        priv->num_tx_rings_p_up : priv->tx_ring_num[t];
                for (i = 0; i < priv->tx_ring_num[t]; i++) {
                        /* Configure cq */
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index f9b97f5946f8..44389c90056a 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -326,6 +326,7 @@ enum cfg_version {
 static const struct pci_device_id rtl8169_pci_tbl[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8129), 0, 0, RTL_CFG_0 },
        { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8136), 0, 0, RTL_CFG_2 },
+        { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8161), 0, 0, RTL_CFG_1 },
        { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8167), 0, 0, RTL_CFG_0 },
        { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8168), 0, 0, RTL_CFG_1 },
        { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8169), 0, 0, RTL_CFG_0 },
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index fda01f770eff..b0344c213752 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -116,7 +116,7 @@ static int stmmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg,
        unsigned int mii_address = priv->hw->mii.addr;
        unsigned int mii_data = priv->hw->mii.data;
-        u32 value = MII_WRITE | MII_BUSY;
+        u32 value = MII_BUSY;
        value |= (phyaddr << priv->hw->mii.addr_shift)
                & priv->hw->mii.addr_mask;
@@ -126,6 +126,8 @@ static int stmmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg,
                & priv->hw->mii.clk_csr_mask;
        if (priv->plat->has_gmac4)
                value |= MII_GMAC4_WRITE;
+        else
+                value |= MII_WRITE;
        /* Wait until any existing MII operation is complete */
        if (stmmac_mdio_busy_wait(priv->ioaddr, mii_address))
diff --git a/drivers/net/ipvlan/ipvlan.h b/drivers/net/ipvlan/ipvlan.h
index 031093e1c25f..dbfbb33ac66c 100644
--- a/drivers/net/ipvlan/ipvlan.h
+++ b/drivers/net/ipvlan/ipvlan.h
@@ -99,6 +99,11 @@ struct ipvl_port {
        int                     count;
 };
+struct ipvl_skb_cb {
+        bool tx_pkt;
+};
+#define IPVL_SKB_CB(_skb) ((struct ipvl_skb_cb *)&((_skb)->cb[0]))
 static inline struct ipvl_port *ipvlan_port_get_rcu(const struct net_device *d)
 {
        return rcu_dereference(d->rx_handler_data);
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index b4e990743e1d..83ce74acf82d 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -198,7 +198,7 @@ void ipvlan_process_multicast(struct work_struct *work)
        unsigned int mac_hash;
        int ret;
        u8 pkt_type;
-        bool hlocal, dlocal;
+        bool tx_pkt;
        __skb_queue_head_init(&list);
@@ -207,8 +207,11 @@ void ipvlan_process_multicast(struct work_struct *work)
        spin_unlock_bh(&port->backlog.lock);
        while ((skb = __skb_dequeue(&list)) != NULL) {
+                struct net_device *dev = skb->dev;
+                bool consumed = false;
                ethh = eth_hdr(skb);
-                hlocal = ether_addr_equal(ethh->h_source, port->dev->dev_addr);
+                tx_pkt = IPVL_SKB_CB(skb)->tx_pkt;
                mac_hash = ipvlan_mac_hash(ethh->h_dest);
                if (ether_addr_equal(ethh->h_dest, port->dev->broadcast))
@@ -216,41 +219,45 @@ void ipvlan_process_multicast(struct work_struct *work)
                else
                        pkt_type = PACKET_MULTICAST;
-                dlocal = false;
                rcu_read_lock();
                list_for_each_entry_rcu(ipvlan, &port->ipvlans, pnode) {
-                        if (hlocal && (ipvlan->dev == skb->dev)) {
+                        if (tx_pkt && (ipvlan->dev == skb->dev))
-                                dlocal = true;
                                continue;
-                        }
                        if (!test_bit(mac_hash, ipvlan->mac_filters))
                                continue;
+                        if (!(ipvlan->dev->flags & IFF_UP))
+                                continue;
                        ret = NET_RX_DROP;
                        len = skb->len + ETH_HLEN;
                        nskb = skb_clone(skb, GFP_ATOMIC);
-                        if (!nskb)
+                        local_bh_disable();
-                                goto acct;
+                        if (nskb) {
+                                consumed = true;
-                        nskb->pkt_type = pkt_type;
+                                nskb->pkt_type = pkt_type;
-                        nskb->dev = ipvlan->dev;
+                                nskb->dev = ipvlan->dev;
-                        if (hlocal)
+                                if (tx_pkt)
-                                ret = dev_forward_skb(ipvlan->dev, nskb);
+                                        ret = dev_forward_skb(ipvlan->dev, nskb);
-                        else
+                                else
-                                ret = netif_rx(nskb);
+                                        ret = netif_rx(nskb);
-acct:
+                        }
                        ipvlan_count_rx(ipvlan, len, ret == NET_RX_SUCCESS, true);
+                        local_bh_enable();
                }
                rcu_read_unlock();
-                if (dlocal) {
+                if (tx_pkt) {
                        /* If the packet originated here, send it out. */
                        skb->dev = port->dev;
                        skb->pkt_type = pkt_type;
                        dev_queue_xmit(skb);
                } else {
-                        kfree_skb(skb);
+                        if (consumed)
+                                consume_skb(skb);
+                        else
+                                kfree_skb(skb);
                }
+                if (dev)
+                        dev_put(dev);
        }
 }
@@ -470,15 +477,24 @@ out:
 }
 static void ipvlan_multicast_enqueue(struct ipvl_port *port,
-                                     struct sk_buff *skb)
+                                     struct sk_buff *skb, bool tx_pkt)
 {
        if (skb->protocol == htons(ETH_P_PAUSE)) {
                kfree_skb(skb);
                return;
        }
+        /* Record that the deferred packet is from TX or RX path. By
+         * looking at mac-addresses on packet will lead to erronus decisions.
+         * (This would be true for a loopback-mode on master device or a
+         * hair-pin mode of the switch.)
+         */
+        IPVL_SKB_CB(skb)->tx_pkt = tx_pkt;
        spin_lock(&port->backlog.lock);
        if (skb_queue_len(&port->backlog) < IPVLAN_QBACKLOG_LIMIT) {
+                if (skb->dev)
+                        dev_hold(skb->dev);
                __skb_queue_tail(&port->backlog, skb);
                spin_unlock(&port->backlog.lock);
                schedule_work(&port->wq);
@@ -537,7 +553,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
        } else if (is_multicast_ether_addr(eth->h_dest)) {
                ipvlan_skb_crossing_ns(skb, NULL);
-                ipvlan_multicast_enqueue(ipvlan->port, skb);
+                ipvlan_multicast_enqueue(ipvlan->port, skb, true);
                return NET_XMIT_SUCCESS;
        }
@@ -634,7 +650,7 @@ static rx_handler_result_t ipvlan_handle_mode_l2(struct sk_buff **pskb,
                         */
                        if (nskb) {
                                ipvlan_skb_crossing_ns(nskb, NULL);
-                                ipvlan_multicast_enqueue(port, nskb);
+                                ipvlan_multicast_enqueue(port, nskb, false);
                        }
                }
        } else {
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 693ec5b66222..8b0f99300cbc 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -135,6 +135,7 @@ err:
 static void ipvlan_port_destroy(struct net_device *dev)
 {
        struct ipvl_port *port = ipvlan_port_get_rtnl(dev);
+        struct sk_buff *skb;
        dev->priv_flags &= ~IFF_IPVLAN_MASTER;
        if (port->mode == IPVLAN_MODE_L3S) {
@@ -144,7 +145,11 @@ static void ipvlan_port_destroy(struct net_device *dev)
        }
        netdev_rx_handler_unregister(dev);
        cancel_work_sync(&port->wq);
-        __skb_queue_purge(&port->backlog);
+        while ((skb = __skb_dequeue(&port->backlog)) != NULL) {
+                if (skb->dev)
+                        dev_put(skb->dev);
+                kfree_skb(skb);
+        }
        kfree(port);
 }
diff --git a/fs/dax.c b/fs/dax.c
index a8732fbed381..5c74f60d0a50 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -451,16 +451,37 @@ void dax_wake_mapping_entry_waiter(struct address_space *mapping,
                __wake_up(wq, TASK_NORMAL, wake_all ? 0 : 1, &key);
 }
+static int __dax_invalidate_mapping_entry(struct address_space *mapping,
+                                          pgoff_t index, bool trunc)
+{
+        int ret = 0;
+        void *entry;
+        struct radix_tree_root *page_tree = &mapping->page_tree;
+        spin_lock_irq(&mapping->tree_lock);
+        entry = get_unlocked_mapping_entry(mapping, index, NULL);
+        if (!entry || !radix_tree_exceptional_entry(entry))
+                goto out;
+        if (!trunc &&
+            (radix_tree_tag_get(page_tree, index, PAGECACHE_TAG_DIRTY) ||
+             radix_tree_tag_get(page_tree, index, PAGECACHE_TAG_TOWRITE)))
+                goto out;
+        radix_tree_delete(page_tree, index);
+        mapping->nrexceptional--;
+        ret = 1;
+out:
+        put_unlocked_mapping_entry(mapping, index, entry);
+        spin_unlock_irq(&mapping->tree_lock);
+        return ret;
+}
 /*
 * Delete exceptional DAX entry at @index from @mapping. Wait for radix tree
 * entry to get unlocked before deleting it.
 */
 int dax_delete_mapping_entry(struct address_space *mapping, pgoff_t index)
 {
-        void *entry;
+        int ret = __dax_invalidate_mapping_entry(mapping, index, true);
-        spin_lock_irq(&mapping->tree_lock);
-        entry = get_unlocked_mapping_entry(mapping, index, NULL);
        /*
         * This gets called from truncate / punch_hole path. As such, the caller
         * must hold locks protecting against concurrent modifications of the
@@ -468,16 +489,46 @@ int dax_delete_mapping_entry(struct address_space *mapping, pgoff_t index)
         * caller has seen exceptional entry for this index, we better find it
         * at that index as well...
         */
-        if (WARN_ON_ONCE(!entry || !radix_tree_exceptional_entry(entry))) {
+        WARN_ON_ONCE(!ret);
-                spin_unlock_irq(&mapping->tree_lock);
+        return ret;
-                return 0;
+}
-        }
-        radix_tree_delete(&mapping->page_tree, index);
+/*
+ * Invalidate exceptional DAX entry if easily possible. This handles DAX
+ * entries for invalidate_inode_pages() so we evict the entry only if we can
+ * do so without blocking.
+ */
+int dax_invalidate_mapping_entry(struct address_space *mapping, pgoff_t index)
+{
+        int ret = 0;
+        void *entry, **slot;
+        struct radix_tree_root *page_tree = &mapping->page_tree;
+        spin_lock_irq(&mapping->tree_lock);
+        entry = __radix_tree_lookup(page_tree, index, NULL, &slot);
+        if (!entry || !radix_tree_exceptional_entry(entry) ||
+            slot_locked(mapping, slot))
+                goto out;
+        if (radix_tree_tag_get(page_tree, index, PAGECACHE_TAG_DIRTY) ||
+            radix_tree_tag_get(page_tree, index, PAGECACHE_TAG_TOWRITE))
+                goto out;
+        radix_tree_delete(page_tree, index);
        mapping->nrexceptional--;
+        ret = 1;
+out:
        spin_unlock_irq(&mapping->tree_lock);
-        dax_wake_mapping_entry_waiter(mapping, index, entry, true);
+        if (ret)
+                dax_wake_mapping_entry_waiter(mapping, index, entry, true);
+        return ret;
+}
-        return 1;
+/*
+ * Invalidate exceptional DAX entry if it is clean.
+ */
+int dax_invalidate_mapping_entry_sync(struct address_space *mapping,
+                                      pgoff_t index)
+{
+        return __dax_invalidate_mapping_entry(mapping, index, false);
 }
 /*
@@ -488,15 +539,16 @@ int dax_delete_mapping_entry(struct address_space *mapping, pgoff_t index)
 * otherwise it will simply fall out of the page cache under memory
 * pressure without ever having been dirtied.
 */
-static int dax_load_hole(struct address_space *mapping, void *entry,
+static int dax_load_hole(struct address_space *mapping, void **entry,
                         struct vm_fault *vmf)
 {
        struct page *page;
+        int ret;
        /* Hole page already exists? Return it...  */
-        if (!radix_tree_exceptional_entry(entry)) {
+        if (!radix_tree_exceptional_entry(*entry)) {
-                vmf->page = entry;
+                page = *entry;
-                return VM_FAULT_LOCKED;
+                goto out;
        }
        /* This will replace locked radix tree entry with a hole page */
@@ -504,8 +556,17 @@ static int dax_load_hole(struct address_space *mapping, void *entry,
                                   vmf->gfp_mask | __GFP_ZERO);
        if (!page)
                return VM_FAULT_OOM;
+ out:
        vmf->page = page;
-        return VM_FAULT_LOCKED;
+        ret = finish_fault(vmf);
+        vmf->page = NULL;
+        *entry = page;
+        if (!ret) {
+                /* Grab reference for PTE that is now referencing the page */
+                get_page(page);
+                return VM_FAULT_NOPAGE;
+        }
+        return ret;
 }
 static int copy_user_dax(struct block_device *bdev, sector_t sector, size_t size,
@@ -934,6 +995,17 @@ dax_iomap_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
        if (WARN_ON_ONCE(iomap->type != IOMAP_MAPPED))
                return -EIO;
+        /*
+         * Write can allocate block for an area which has a hole page mapped
+         * into page tables. We have to tear down these mappings so that data
+         * written by write(2) is visible in mmap.
+         */
+        if ((iomap->flags & IOMAP_F_NEW) && inode->i_mapping->nrpages) {
+                invalidate_inode_pages2_range(inode->i_mapping,
+                                              pos >> PAGE_SHIFT,
+                                              (end - 1) >> PAGE_SHIFT);
+        }
        while (pos < end) {
                unsigned offset = pos & (PAGE_SIZE - 1);
                struct blk_dax_ctl dax = { 0 };
@@ -992,23 +1064,6 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
        if (iov_iter_rw(iter) == WRITE)
                flags |= IOMAP_WRITE;
-        /*
-         * Yes, even DAX files can have page cache attached to them:  A zeroed
-         * page is inserted into the pagecache when we have to serve a write
-         * fault on a hole.  It should never be dirtied and can simply be
-         * dropped from the pagecache once we get real data for the page.
-         *
-         * XXX: This is racy against mmap, and there's nothing we can do about
-         * it. We'll eventually need to shift this down even further so that
-         * we can check if we allocated blocks over a hole first.
-         */
-        if (mapping->nrpages) {
-                ret = invalidate_inode_pages2_range(mapping,
-                                pos >> PAGE_SHIFT,
-                                (pos + iov_iter_count(iter) - 1) >> PAGE_SHIFT);
-                WARN_ON_ONCE(ret);
-        }
        while (iov_iter_count(iter)) {
                ret = iomap_apply(inode, pos, iov_iter_count(iter), flags, ops,
                                iter, dax_iomap_actor);
@@ -1023,6 +1078,15 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
 }
 EXPORT_SYMBOL_GPL(dax_iomap_rw);
+static int dax_fault_return(int error)
+{
+        if (error == 0)
+                return VM_FAULT_NOPAGE;
+        if (error == -ENOMEM)
+                return VM_FAULT_OOM;
+        return VM_FAULT_SIGBUS;
+}
 /**
 * dax_iomap_fault - handle a page fault on a DAX file
 * @vma: The virtual memory area where the fault occurred
@@ -1055,12 +1119,6 @@ int dax_iomap_fault(struct vm_area_struct *vma, struct vm_fault *vmf,
        if (pos >= i_size_read(inode))
                return VM_FAULT_SIGBUS;
-        entry = grab_mapping_entry(mapping, vmf->pgoff, 0);
-        if (IS_ERR(entry)) {
-                error = PTR_ERR(entry);
-                goto out;
-        }
        if ((vmf->flags & FAULT_FLAG_WRITE) && !vmf->cow_page)
                flags |= IOMAP_WRITE;
@@ -1071,9 +1129,15 @@ int dax_iomap_fault(struct vm_area_struct *vma, struct vm_fault *vmf,
         */
        error = ops->iomap_begin(inode, pos, PAGE_SIZE, flags, &iomap);
        if (error)
-                goto unlock_entry;
+                return dax_fault_return(error);
        if (WARN_ON_ONCE(iomap.offset + iomap.length < pos + PAGE_SIZE)) {
-                error = -EIO;           /* fs corruption? */
+                vmf_ret = dax_fault_return(-EIO);       /* fs corruption? */
+                goto finish_iomap;
+        }
+        entry = grab_mapping_entry(mapping, vmf->pgoff, 0);
+        if (IS_ERR(entry)) {
+                vmf_ret = dax_fault_return(PTR_ERR(entry));
                goto finish_iomap;
        }
@@ -1096,13 +1160,13 @@ int dax_iomap_fault(struct vm_area_struct *vma, struct vm_fault *vmf,
                }
                if (error)
-                        goto finish_iomap;
+                        goto error_unlock_entry;
                __SetPageUptodate(vmf->cow_page);
                vmf_ret = finish_fault(vmf);
                if (!vmf_ret)
                        vmf_ret = VM_FAULT_DONE_COW;
-                goto finish_iomap;
+                goto unlock_entry;
        }
        switch (iomap.type) {
@@ -1114,12 +1178,15 @@ int dax_iomap_fault(struct vm_area_struct *vma, struct vm_fault *vmf,
                }
                error = dax_insert_mapping(mapping, iomap.bdev, sector,
                                PAGE_SIZE, &entry, vma, vmf);
+                /* -EBUSY is fine, somebody else faulted on the same PTE */
+                if (error == -EBUSY)
+                        error = 0;
                break;
        case IOMAP_UNWRITTEN:
        case IOMAP_HOLE:
                if (!(vmf->flags & FAULT_FLAG_WRITE)) {
-                        vmf_ret = dax_load_hole(mapping, entry, vmf);
+                        vmf_ret = dax_load_hole(mapping, &entry, vmf);
-                        break;
+                        goto unlock_entry;
                }
                /*FALLTHRU*/
        default:
@@ -1128,31 +1195,25 @@ int dax_iomap_fault(struct vm_area_struct *vma, struct vm_fault *vmf,
                break;
        }
+ error_unlock_entry:
+        vmf_ret = dax_fault_return(error) | major;
+ unlock_entry:
+        put_locked_mapping_entry(mapping, vmf->pgoff, entry);
 finish_iomap:
        if (ops->iomap_end) {
-                if (error || (vmf_ret & VM_FAULT_ERROR)) {
+                int copied = PAGE_SIZE;
-                        /* keep previous error */
-                        ops->iomap_end(inode, pos, PAGE_SIZE, 0, flags,
+                if (vmf_ret & VM_FAULT_ERROR)
-                                        &iomap);
+                        copied = 0;
-                } else {
+                /*
-                        error = ops->iomap_end(inode, pos, PAGE_SIZE,
+                 * The fault is done by now and there's no way back (other
-                                        PAGE_SIZE, flags, &iomap);
+                 * thread may be already happily using PTE we have installed).
-                }
+                 * Just ignore error from ->iomap_end since we cannot do much
-        }
+                 * with it.
- unlock_entry:
+                 */
-        if (vmf_ret != VM_FAULT_LOCKED || error)
+                ops->iomap_end(inode, pos, PAGE_SIZE, copied, flags, &iomap);
-                put_locked_mapping_entry(mapping, vmf->pgoff, entry);
- out:
-        if (error == -ENOMEM)
-                return VM_FAULT_OOM | major;
-        /* -EBUSY is fine, somebody else faulted on the same PTE */
-        if (error < 0 && error != -EBUSY)
-                return VM_FAULT_SIGBUS | major;
-        if (vmf_ret) {
-                WARN_ON_ONCE(error); /* -EBUSY from ops->iomap_end? */
-                return vmf_ret;
        }
-        return VM_FAULT_NOPAGE | major;
+        return vmf_ret;
 }
 EXPORT_SYMBOL_GPL(dax_iomap_fault);
@@ -1277,16 +1338,6 @@ int dax_iomap_pmd_fault(struct vm_area_struct *vma, unsigned long address,
                goto fallback;
        /*
-         * grab_mapping_entry() will make sure we get a 2M empty entry, a DAX
-         * PMD or a HZP entry.  If it can't (because a 4k page is already in
-         * the tree, for instance), it will return -EEXIST and we just fall
-         * back to 4k entries.
-         */
-        entry = grab_mapping_entry(mapping, pgoff, RADIX_DAX_PMD);
-        if (IS_ERR(entry))
-                goto fallback;
-        /*
         * Note that we don't use iomap_apply here.  We aren't doing I/O, only
         * setting up a mapping, so really we're using iomap_begin() as a way
         * to look up our filesystem block.
@@ -1294,10 +1345,21 @@ int dax_iomap_pmd_fault(struct vm_area_struct *vma, unsigned long address,
        pos = (loff_t)pgoff << PAGE_SHIFT;
        error = ops->iomap_begin(inode, pos, PMD_SIZE, iomap_flags, &iomap);
        if (error)
-                goto unlock_entry;
+                goto fallback;
        if (iomap.offset + iomap.length < pos + PMD_SIZE)
                goto finish_iomap;
+        /*
+         * grab_mapping_entry() will make sure we get a 2M empty entry, a DAX
+         * PMD or a HZP entry.  If it can't (because a 4k page is already in
+         * the tree, for instance), it will return -EEXIST and we just fall
+         * back to 4k entries.
+         */
+        entry = grab_mapping_entry(mapping, pgoff, RADIX_DAX_PMD);
+        if (IS_ERR(entry))
+                goto finish_iomap;
        vmf.pgoff = pgoff;
        vmf.flags = flags;
        vmf.gfp_mask = mapping_gfp_mask(mapping) | __GFP_IO;
@@ -1310,7 +1372,7 @@ int dax_iomap_pmd_fault(struct vm_area_struct *vma, unsigned long address,
        case IOMAP_UNWRITTEN:
        case IOMAP_HOLE:
                if (WARN_ON_ONCE(write))
-                        goto finish_iomap;
+                        goto unlock_entry;
                result = dax_pmd_load_hole(vma, pmd, &vmf, address, &iomap,
                                &entry);
                break;
@@ -1319,20 +1381,23 @@ int dax_iomap_pmd_fault(struct vm_area_struct *vma, unsigned long address,
                break;
        }
+ unlock_entry:
+        put_locked_mapping_entry(mapping, pgoff, entry);
 finish_iomap:
        if (ops->iomap_end) {
-                if (result == VM_FAULT_FALLBACK) {
+                int copied = PMD_SIZE;
-                        ops->iomap_end(inode, pos, PMD_SIZE, 0, iomap_flags,
-                                        &iomap);
+                if (result == VM_FAULT_FALLBACK)
-                } else {
+                        copied = 0;
-                        error = ops->iomap_end(inode, pos, PMD_SIZE, PMD_SIZE,
+                /*
-                                        iomap_flags, &iomap);
+                 * The fault is done by now and there's no way back (other
-                        if (error)
+                 * thread may be already happily using PMD we have installed).
-                                result = VM_FAULT_FALLBACK;
+                 * Just ignore error from ->iomap_end since we cannot do much
-                }
+                 * with it.
+                 */
+                ops->iomap_end(inode, pos, PMD_SIZE, copied, iomap_flags,
+                                &iomap);
        }
- unlock_entry:
-        put_locked_mapping_entry(mapping, pgoff, entry);
 fallback:
        if (result == VM_FAULT_FALLBACK) {
                split_huge_pmd(vma, pmd, address);
diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
index 0093ea2512a8..f073bfca694b 100644
--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -751,9 +751,8 @@ static int ext2_get_blocks(struct inode *inode,
                        mutex_unlock(&ei->truncate_mutex);
                        goto cleanup;
                }
-        } else {
-                *new = true;
        }
+        *new = true;
        ext2_splice_branch(inode, iblock, partial, indirect_blks, count);
        mutex_unlock(&ei->truncate_mutex);
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index b5f184493c57..d663d3d7c81c 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -258,7 +258,6 @@ out:
 static int ext4_dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
        int result;
-        handle_t *handle = NULL;
        struct inode *inode = file_inode(vma->vm_file);
        struct super_block *sb = inode->i_sb;
        bool write = vmf->flags & FAULT_FLAG_WRITE;
@@ -266,24 +265,12 @@ static int ext4_dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        if (write) {
                sb_start_pagefault(sb);
                file_update_time(vma->vm_file);
-                down_read(&EXT4_I(inode)->i_mmap_sem);
+        }
-                handle = ext4_journal_start_sb(sb, EXT4_HT_WRITE_PAGE,
+        down_read(&EXT4_I(inode)->i_mmap_sem);
-                                                EXT4_DATA_TRANS_BLOCKS(sb));
+        result = dax_iomap_fault(vma, vmf, &ext4_iomap_ops);
-        } else
+        up_read(&EXT4_I(inode)->i_mmap_sem);
-                down_read(&EXT4_I(inode)->i_mmap_sem);
+        if (write)
-        if (IS_ERR(handle))
-                result = VM_FAULT_SIGBUS;
-        else
-                result = dax_iomap_fault(vma, vmf, &ext4_iomap_ops);
-        if (write) {
-                if (!IS_ERR(handle))
-                        ext4_journal_stop(handle);
-                up_read(&EXT4_I(inode)->i_mmap_sem);
                sb_end_pagefault(sb);
-        } else
-                up_read(&EXT4_I(inode)->i_mmap_sem);
        return result;
 }
@@ -292,7 +279,6 @@ static int ext4_dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr,
                                                pmd_t *pmd, unsigned int flags)
 {
        int result;
-        handle_t *handle = NULL;
        struct inode *inode = file_inode(vma->vm_file);
        struct super_block *sb = inode->i_sb;
        bool write = flags & FAULT_FLAG_WRITE;
@@ -300,27 +286,13 @@ static int ext4_dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr,
        if (write) {
                sb_start_pagefault(sb);
                file_update_time(vma->vm_file);
-                down_read(&EXT4_I(inode)->i_mmap_sem);
-                handle = ext4_journal_start_sb(sb, EXT4_HT_WRITE_PAGE,
-                                ext4_chunk_trans_blocks(inode,
-                                                        PMD_SIZE / PAGE_SIZE));
-        } else
-                down_read(&EXT4_I(inode)->i_mmap_sem);
-        if (IS_ERR(handle))
-                result = VM_FAULT_SIGBUS;
-        else {
-                result = dax_iomap_pmd_fault(vma, addr, pmd, flags,
-                                             &ext4_iomap_ops);
        }
+        down_read(&EXT4_I(inode)->i_mmap_sem);
-        if (write) {
+        result = dax_iomap_pmd_fault(vma, addr, pmd, flags,
-                if (!IS_ERR(handle))
+                                     &ext4_iomap_ops);
-                        ext4_journal_stop(handle);
+        up_read(&EXT4_I(inode)->i_mmap_sem);
-                up_read(&EXT4_I(inode)->i_mmap_sem);
+        if (write)
                sb_end_pagefault(sb);
-        } else
-                up_read(&EXT4_I(inode)->i_mmap_sem);
        return result;
 }
diff --git a/include/linux/dax.h b/include/linux/dax.h
index f97bcfe79472..24ad71173995 100644
--- a/include/linux/dax.h
+++ b/include/linux/dax.h
@@ -41,6 +41,9 @@ ssize_t dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
 int dax_iomap_fault(struct vm_area_struct *vma, struct vm_fault *vmf,
                        struct iomap_ops *ops);
 int dax_delete_mapping_entry(struct address_space *mapping, pgoff_t index);
+int dax_invalidate_mapping_entry(struct address_space *mapping, pgoff_t index);
+int dax_invalidate_mapping_entry_sync(struct address_space *mapping,
+                                      pgoff_t index);
 void dax_wake_mapping_entry_waiter(struct address_space *mapping,
                pgoff_t index, void *entry, bool wake_all);
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 702314253797..a0934e6c9bab 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -610,7 +610,6 @@ bool bpf_helper_changes_pkt_data(void *func);
 struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
                                       const struct bpf_insn *patch, u32 len);
 void bpf_warn_invalid_xdp_action(u32 act);
-void bpf_warn_invalid_xdp_buffer(void);
 #ifdef CONFIG_BPF_JIT
 extern int bpf_jit_enable;
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index c56b39890a41..6b5818d6de32 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -73,13 +73,13 @@
 */
 enum pageflags {
        PG_locked,              /* Page is locked. Don't touch. */
-        PG_waiters,             /* Page has waiters, check its waitqueue */
        PG_error,
        PG_referenced,
        PG_uptodate,
        PG_dirty,
        PG_lru,
        PG_active,
+        PG_waiters,             /* Page has waiters, check its waitqueue. Must be bit #7 and in the same byte as "PG_locked" */
        PG_slab,
        PG_owner_priv_1,        /* Owner use. If pagecache, fs may use*/
        PG_arch_1,
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index f0cf5a1b777e..0378e88f6fd3 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -110,6 +110,7 @@ struct netns_ipv4 {
        int sysctl_tcp_orphan_retries;
        int sysctl_tcp_fin_timeout;
        unsigned int sysctl_tcp_notsent_lowat;
+        int sysctl_tcp_tw_reuse;
        int sysctl_igmp_max_memberships;
        int sysctl_igmp_max_msf;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 207147b4c6b2..6061963cca98 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -252,7 +252,6 @@ extern int sysctl_tcp_wmem[3];
 extern int sysctl_tcp_rmem[3];
 extern int sysctl_tcp_app_win;
 extern int sysctl_tcp_adv_win_scale;
-extern int sysctl_tcp_tw_reuse;
 extern int sysctl_tcp_frto;
 extern int sysctl_tcp_low_latency;
 extern int sysctl_tcp_nometrics_save;
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 042fd7e8e030..f75c4d031eeb 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1471,6 +1471,7 @@ int __cpuhp_setup_state(enum cpuhp_state state,
                        bool multi_instance)
 {
        int cpu, ret = 0;
+        bool dynstate;
        if (cpuhp_cb_check(state) || !name)
                return -EINVAL;
@@ -1480,6 +1481,12 @@ int __cpuhp_setup_state(enum cpuhp_state state,
        ret = cpuhp_store_callbacks(state, name, startup, teardown,
                                    multi_instance);
+        dynstate = state == CPUHP_AP_ONLINE_DYN;
+        if (ret > 0 && dynstate) {
+                state = ret;
+                ret = 0;
+        }
        if (ret || !invoke || !startup)
                goto out;
@@ -1508,7 +1515,7 @@ out:
         * If the requested state is CPUHP_AP_ONLINE_DYN, return the
         * dynamically allocated state in case of success.
         */
-        if (!ret && state == CPUHP_AP_ONLINE_DYN)
+        if (!ret && dynstate)
                return state;
        return ret;
 }
diff --git a/mm/filemap.c b/mm/filemap.c
index 82f26cde830c..d0e4d1002059 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -912,6 +912,29 @@ void add_page_wait_queue(struct page *page, wait_queue_t *waiter)
 }
 EXPORT_SYMBOL_GPL(add_page_wait_queue);
+#ifndef clear_bit_unlock_is_negative_byte
+/*
+ * PG_waiters is the high bit in the same byte as PG_lock.
+ *
+ * On x86 (and on many other architectures), we can clear PG_lock and
+ * test the sign bit at the same time. But if the architecture does
+ * not support that special operation, we just do this all by hand
+ * instead.
+ *
+ * The read of PG_waiters has to be after (or concurrently with) PG_locked
+ * being cleared, but a memory barrier should be unneccssary since it is
+ * in the same byte as PG_locked.
+ */
+static inline bool clear_bit_unlock_is_negative_byte(long nr, volatile void *mem)
+{
+        clear_bit_unlock(nr, mem);
+        /* smp_mb__after_atomic(); */
+        return test_bit(PG_waiters, mem);
+}
+#endif
 /**
 * unlock_page - unlock a locked page
 * @page: the page
@@ -921,16 +944,19 @@ EXPORT_SYMBOL_GPL(add_page_wait_queue);
 * mechanism between PageLocked pages and PageWriteback pages is shared.
 * But that's OK - sleepers in wait_on_page_writeback() just go back to sleep.
 *
- * The mb is necessary to enforce ordering between the clear_bit and the read
+ * Note that this depends on PG_waiters being the sign bit in the byte
- * of the waitqueue (to avoid SMP races with a parallel wait_on_page_locked()).
+ * that contains PG_locked - thus the BUILD_BUG_ON(). That allows us to
+ * clear the PG_locked bit and test PG_waiters at the same time fairly
+ * portably (architectures that do LL/SC can test any bit, while x86 can
+ * test the sign bit).
 */
 void unlock_page(struct page *page)
 {
+        BUILD_BUG_ON(PG_waiters != 7);
        page = compound_head(page);
        VM_BUG_ON_PAGE(!PageLocked(page), page);
-        clear_bit_unlock(PG_locked, &page->flags);
+        if (clear_bit_unlock_is_negative_byte(PG_locked, &page->flags))
-        smp_mb__after_atomic();
+                wake_up_page_bit(page, PG_locked);
-        wake_up_page(page, PG_locked);
 }
 EXPORT_SYMBOL(unlock_page);
diff --git a/mm/truncate.c b/mm/truncate.c
index fd97f1dbce29..dd7b24e083c5 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -24,20 +24,12 @@
 #include <linux/rmap.h>
 #include "internal.h"
-static void clear_exceptional_entry(struct address_space *mapping,
+static void clear_shadow_entry(struct address_space *mapping, pgoff_t index,
-                                    pgoff_t index, void *entry)
+                               void *entry)
 {
        struct radix_tree_node *node;
        void **slot;
-        /* Handled by shmem itself */
-        if (shmem_mapping(mapping))
-                return;
-        if (dax_mapping(mapping)) {
-                dax_delete_mapping_entry(mapping, index);
-                return;
-        }
        spin_lock_irq(&mapping->tree_lock);
        /*
         * Regular page slots are stabilized by the page lock even
@@ -55,6 +47,56 @@ unlock:
        spin_unlock_irq(&mapping->tree_lock);
 }
+/*
+ * Unconditionally remove exceptional entry. Usually called from truncate path.
+ */
+static void truncate_exceptional_entry(struct address_space *mapping,
+                                       pgoff_t index, void *entry)
+{
+        /* Handled by shmem itself */
+        if (shmem_mapping(mapping))
+                return;
+        if (dax_mapping(mapping)) {
+                dax_delete_mapping_entry(mapping, index);
+                return;
+        }
+        clear_shadow_entry(mapping, index, entry);
+}
+/*
+ * Invalidate exceptional entry if easily possible. This handles exceptional
+ * entries for invalidate_inode_pages() so for DAX it evicts only unlocked and
+ * clean entries.
+ */
+static int invalidate_exceptional_entry(struct address_space *mapping,
+                                        pgoff_t index, void *entry)
+{
+        /* Handled by shmem itself */
+        if (shmem_mapping(mapping))
+                return 1;
+        if (dax_mapping(mapping))
+                return dax_invalidate_mapping_entry(mapping, index);
+        clear_shadow_entry(mapping, index, entry);
+        return 1;
+}
+/*
+ * Invalidate exceptional entry if clean. This handles exceptional entries for
+ * invalidate_inode_pages2() so for DAX it evicts only clean entries.
+ */
+static int invalidate_exceptional_entry2(struct address_space *mapping,
+                                         pgoff_t index, void *entry)
+{
+        /* Handled by shmem itself */
+        if (shmem_mapping(mapping))
+                return 1;
+        if (dax_mapping(mapping))
+                return dax_invalidate_mapping_entry_sync(mapping, index);
+        clear_shadow_entry(mapping, index, entry);
+        return 1;
+}
 /**
 * do_invalidatepage - invalidate part or all of a page
 * @page: the page which is affected
@@ -262,7 +304,8 @@ void truncate_inode_pages_range(struct address_space *mapping,
                                break;
                        if (radix_tree_exceptional_entry(page)) {
-                                clear_exceptional_entry(mapping, index, page);
+                                truncate_exceptional_entry(mapping, index,
+                                                           page);
                                continue;
                        }
@@ -351,7 +394,8 @@ void truncate_inode_pages_range(struct address_space *mapping,
                        }
                        if (radix_tree_exceptional_entry(page)) {
-                                clear_exceptional_entry(mapping, index, page);
+                                truncate_exceptional_entry(mapping, index,
+                                                           page);
                                continue;
                        }
@@ -470,7 +514,8 @@ unsigned long invalidate_mapping_pages(struct address_space *mapping,
                                break;
                        if (radix_tree_exceptional_entry(page)) {
-                                clear_exceptional_entry(mapping, index, page);
+                                invalidate_exceptional_entry(mapping, index,
+                                                             page);
                                continue;
                        }
@@ -592,7 +637,9 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
                                break;
                        if (radix_tree_exceptional_entry(page)) {
-                                clear_exceptional_entry(mapping, index, page);
+                                if (!invalidate_exceptional_entry2(mapping,
+                                                                   index, page))
+                                        ret = -EBUSY;
                                continue;
                        }
diff --git a/net/core/filter.c b/net/core/filter.c
index e6c412b94dec..1969b3f118c1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2972,12 +2972,6 @@ void bpf_warn_invalid_xdp_action(u32 act)
 }
 EXPORT_SYMBOL_GPL(bpf_warn_invalid_xdp_action);
-void bpf_warn_invalid_xdp_buffer(void)
-{
-        WARN_ONCE(1, "Illegal XDP buffer encountered, expect throughput degradation\n");
-}
-EXPORT_SYMBOL_GPL(bpf_warn_invalid_xdp_buffer);
 static u32 sk_filter_convert_ctx_access(enum bpf_access_type type, int dst_reg,
                                        int src_reg, int ctx_off,
                                        struct bpf_insn *insn_buf,
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 80bc36b25de2..22cbd61079b5 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -433,13 +433,6 @@ static struct ctl_table ipv4_table[] = {
                .extra2         = &tcp_adv_win_scale_max,
        },
        {
-                .procname       = "tcp_tw_reuse",
-                .data           = &sysctl_tcp_tw_reuse,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
                .procname       = "tcp_frto",
                .data           = &sysctl_tcp_frto,
                .maxlen         = sizeof(int),
@@ -960,6 +953,13 @@ static struct ctl_table ipv4_net_table[] = {
                .mode           = 0644,
                .proc_handler   = proc_dointvec,
        },
+        {
+                .procname       = "tcp_tw_reuse",
+                .data           = &init_net.ipv4.sysctl_tcp_tw_reuse,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
        {
                .procname       = "fib_multipath_use_neigh",
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 30d81f533ada..fe9da4fb96bf 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -84,7 +84,6 @@
 #include <crypto/hash.h>
 #include <linux/scatterlist.h>
-int sysctl_tcp_tw_reuse __read_mostly;
 int sysctl_tcp_low_latency __read_mostly;
 #ifdef CONFIG_TCP_MD5SIG
@@ -120,7 +119,7 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
           and use initial timestamp retrieved from peer table.
         */
        if (tcptw->tw_ts_recent_stamp &&
-            (!twp || (sysctl_tcp_tw_reuse &&
+            (!twp || (sock_net(sk)->ipv4.sysctl_tcp_tw_reuse &&
                             get_seconds() - tcptw->tw_ts_recent_stamp > 1))) {
                tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
                if (tp->write_seq == 0)
@@ -2456,6 +2455,7 @@ static int __net_init tcp_sk_init(struct net *net)
        net->ipv4.sysctl_tcp_orphan_retries = 0;
        net->ipv4.sysctl_tcp_fin_timeout = TCP_FIN_TIMEOUT;
        net->ipv4.sysctl_tcp_notsent_lowat = UINT_MAX;
+        net->ipv4.sysctl_tcp_tw_reuse = 0;
        return 0;
 fail:
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 2d4c4d3911c0..9c62b6325f7a 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -606,7 +606,6 @@ static int ovs_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info)
        rcu_assign_pointer(flow->sf_acts, acts);
        packet->priority = flow->key.phy.priority;
        packet->mark = flow->key.phy.skb_mark;
-        packet->protocol = flow->key.eth.type;
        rcu_read_lock();
        dp = get_dp_rcu(net, ovs_header->dp_ifindex);
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 08aa926cd5cf..2c0a00f7f1b7 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -312,7 +312,8 @@ static bool icmp6hdr_ok(struct sk_buff *skb)
 * Returns 0 if it encounters a non-vlan or incomplete packet.
 * Returns 1 after successfully parsing vlan tag.
 */
-static int parse_vlan_tag(struct sk_buff *skb, struct vlan_head *key_vh)
+static int parse_vlan_tag(struct sk_buff *skb, struct vlan_head *key_vh,
+                          bool untag_vlan)
 {
        struct vlan_head *vh = (struct vlan_head *)skb->data;
@@ -330,7 +331,20 @@ static int parse_vlan_tag(struct sk_buff *skb, struct vlan_head *key_vh)
        key_vh->tci = vh->tci | htons(VLAN_TAG_PRESENT);
        key_vh->tpid = vh->tpid;
-        __skb_pull(skb, sizeof(struct vlan_head));
+        if (unlikely(untag_vlan)) {
+                int offset = skb->data - skb_mac_header(skb);
+                u16 tci;
+                int err;
+                __skb_push(skb, offset);
+                err = __skb_vlan_pop(skb, &tci);
+                __skb_pull(skb, offset);
+                if (err)
+                        return err;
+                __vlan_hwaccel_put_tag(skb, key_vh->tpid, tci);
+        } else {
+                __skb_pull(skb, sizeof(struct vlan_head));
+        }
        return 1;
 }
@@ -351,13 +365,13 @@ static int parse_vlan(struct sk_buff *skb, struct sw_flow_key *key)
                key->eth.vlan.tpid = skb->vlan_proto;
        } else {
                /* Parse outer vlan tag in the non-accelerated case. */
-                res = parse_vlan_tag(skb, &key->eth.vlan);
+                res = parse_vlan_tag(skb, &key->eth.vlan, true);
                if (res <= 0)
                        return res;
        }
        /* Parse inner vlan tag. */
-        res = parse_vlan_tag(skb, &key->eth.cvlan);
+        res = parse_vlan_tag(skb, &key->eth.cvlan, false);
        if (res <= 0)
                return res;
@@ -800,29 +814,15 @@ int ovs_flow_key_extract_userspace(struct net *net, const struct nlattr *attr,
        if (err)
                return err;
-        if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) {
+        /* key_extract assumes that skb->protocol is set-up for
-                /* key_extract assumes that skb->protocol is set-up for
+         * layer 3 packets which is the case for other callers,
-                 * layer 3 packets which is the case for other callers,
+         * in particular packets received from the network stack.
-                 * in particular packets recieved from the network stack.
+         * Here the correct value can be set from the metadata
-                 * Here the correct value can be set from the metadata
+         * extracted above.
-                 * extracted above.
+         * For L2 packet key eth type would be zero. skb protocol
-                 */
+         * would be set to correct value later during key-extact.
-                skb->protocol = key->eth.type;
+         */
-        } else {
-                struct ethhdr *eth;
-                skb_reset_mac_header(skb);
-                eth = eth_hdr(skb);
-                /* Normally, setting the skb 'protocol' field would be
-                 * handled by a call to eth_type_trans(), but it assumes
-                 * there's a sending device, which we may not have.
-                 */
-                if (eth_proto_is_802_3(eth->h_proto))
-                        skb->protocol = eth->h_proto;
-                else
-                        skb->protocol = htons(ETH_P_802_2);
-        }
+        skb->protocol = key->eth.type;
        return key_extract(skb, key);
 }
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 3fbba79a4ef0..1ecdf809b5fa 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -148,13 +148,15 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n)
        unsigned long cl;
        unsigned long fh;
        int err;
-        int tp_created = 0;
+        int tp_created;
        if ((n->nlmsg_type != RTM_GETTFILTER) &&
            !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
                return -EPERM;
 replay:
+        tp_created = 0;
        err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL);
        if (err < 0)
                return err;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 333c5dae0072..800caaa699a1 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -441,15 +441,19 @@ static void __tipc_shutdown(struct socket *sock, int error)
        while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
                if (TIPC_SKB_CB(skb)->bytes_read) {
                        kfree_skb(skb);
-                } else {
+                        continue;
-                        if (!tipc_sk_type_connectionless(sk) &&
+                }
-                            sk->sk_state != TIPC_DISCONNECTING) {
+                if (!tipc_sk_type_connectionless(sk) &&
-                                tipc_set_sk_state(sk, TIPC_DISCONNECTING);
+                    sk->sk_state != TIPC_DISCONNECTING) {
-                                tipc_node_remove_conn(net, dnode, tsk->portid);
+                        tipc_set_sk_state(sk, TIPC_DISCONNECTING);
-                        }
+                        tipc_node_remove_conn(net, dnode, tsk->portid);
-                        tipc_sk_respond(sk, skb, error);
                }
+                tipc_sk_respond(sk, skb, error);
        }
+        if (tipc_sk_type_connectionless(sk))
+                return;
        if (sk->sk_state != TIPC_DISCONNECTING) {
                skb = tipc_msg_create(TIPC_CRITICAL_IMPORTANCE,
                                      TIPC_CONN_MSG, SHORT_H_SIZE, 0, dnode,
@@ -457,10 +461,8 @@ static void __tipc_shutdown(struct socket *sock, int error)
                                      tsk->portid, error);
                if (skb)
                        tipc_node_xmit_skb(net, skb, dnode, tsk->portid);
-                if (!tipc_sk_type_connectionless(sk)) {
+                tipc_node_remove_conn(net, dnode, tsk->portid);
-                        tipc_node_remove_conn(net, dnode, tsk->portid);
+                tipc_set_sk_state(sk, TIPC_DISCONNECTING);
-                        tipc_set_sk_state(sk, TIPC_DISCONNECTING);
-                }
        }
 }