384 files changed, 2992 insertions, 1840 deletions
diff --git a/.mailmap b/.mailmap
index 2a91c14c80bf..093a8ac9996e 100644
--- a/.mailmap
+++ b/.mailmap
@@ -158,6 +158,8 @@ Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
 Viresh Kumar <vireshk@kernel.org> <viresh.kumar@st.com>
 Viresh Kumar <vireshk@kernel.org> <viresh.linux@gmail.com>
 Viresh Kumar <vireshk@kernel.org> <viresh.kumar2@arm.com>
+Vladimir Davydov <vdavydov.dev@gmail.com> <vdavydov@virtuozzo.com>
+Vladimir Davydov <vdavydov.dev@gmail.com> <vdavydov@parallels.com>
 Takashi YOSHII <takashi.yoshii.zj@renesas.com>
 Yusuke Goda <goda.yusuke@renesas.com>
 Gustavo Padovan <gustavo@las.ic.unicamp.br>
diff --git a/Documentation/ABI/stable/sysfs-devices b/Documentation/ABI/stable/sysfs-devices
index 43f78b88da28..df449d79b563 100644
--- a/Documentation/ABI/stable/sysfs-devices
+++ b/Documentation/ABI/stable/sysfs-devices
@@ -1,7 +1,7 @@
 # Note: This documents additional properties of any device beyond what
 # is documented in Documentation/sysfs-rules.txt
-What:           /sys/devices/*/of_path
+What:           /sys/devices/*/of_node
 Date:           February 2015
 Contact:        Device Tree mailing list <devicetree@vger.kernel.org>
 Description:
diff --git a/Documentation/PCI/pci.txt b/Documentation/PCI/pci.txt
index 123881f62219..77f49dc5be23 100644
--- a/Documentation/PCI/pci.txt
+++ b/Documentation/PCI/pci.txt
@@ -124,7 +124,6 @@ initialization with a pointer to a structure describing the driver
 The ID table is an array of struct pci_device_id entries ending with an
 all-zero entry.  Definitions with static const are generally preferred.
-Use of the deprecated macro DEFINE_PCI_DEVICE_TABLE should be avoided.
 Each entry consists of:
diff --git a/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt b/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
index bf99e2f24788..205593f56fe7 100644
--- a/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
+++ b/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
@@ -16,6 +16,11 @@ Required properties:
 - vref-supply: The regulator supply ADC reference voltage.
 - #io-channel-cells: Should be 1, see ../iio-bindings.txt
+Optional properties:
+- resets: Must contain an entry for each entry in reset-names if need support
+          this option. See ../reset/reset.txt for details.
+- reset-names: Must include the name "saradc-apb".
 Example:
        saradc: saradc@2006c000 {
                compatible = "rockchip,saradc";
@@ -23,6 +28,8 @@ Example:
                interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                #io-channel-cells = <1>;
                vref-supply = <&vcc18>;
        };
diff --git a/Documentation/devicetree/bindings/serial/8250.txt b/Documentation/devicetree/bindings/serial/8250.txt
index f5561ac7e17e..936ab5b87324 100644
--- a/Documentation/devicetree/bindings/serial/8250.txt
+++ b/Documentation/devicetree/bindings/serial/8250.txt
@@ -42,9 +42,6 @@ Optional properties:
 - auto-flow-control: one way to enable automatic flow control support. The
  driver is allowed to detect support for the capability even without this
  property.
- {rts,cts,dtr,dsr,rng,dcd}-gpios: specify a GPIO for RTS/CTS/DTR/DSR/RI/DCD
-  line respectively. It will use specified GPIO instead of the peripheral
-  function pin for the UART feature. If unsure, don't specify this property.
 Note:
 * fsl,ns16550:
@@ -66,19 +63,3 @@ Example:
                interrupts = <10>;
                reg-shift = <2>;
        };
-Example for OMAP UART using GPIO-based modem control signals:
-        uart4: serial@49042000 {
-                compatible = "ti,omap3-uart";
-                reg = <0x49042000 0x400>;
-                interrupts = <80>;
-                ti,hwmods = "uart4";
-                clock-frequency = <48000000>;
-                cts-gpios = <&gpio3 5 GPIO_ACTIVE_LOW>;
-                rts-gpios = <&gpio3 6 GPIO_ACTIVE_LOW>;
-                dtr-gpios = <&gpio1 12 GPIO_ACTIVE_LOW>;
-                dsr-gpios = <&gpio1 13 GPIO_ACTIVE_LOW>;
-                dcd-gpios = <&gpio1 14 GPIO_ACTIVE_LOW>;
-                rng-gpios = <&gpio1 15 GPIO_ACTIVE_LOW>;
-        };
diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
index d6259c786316..bcbf9710e4af 100644
--- a/Documentation/filesystems/overlayfs.txt
+++ b/Documentation/filesystems/overlayfs.txt
@@ -183,12 +183,10 @@ The copy_up operation essentially creates a new, identical file and
 moves it over to the old name.  The new file may be on a different
 filesystem, so both st_dev and st_ino of the file may change.
-Any open files referring to this inode will access the old data and
+Any open files referring to this inode will access the old data.
-metadata.  Similarly any file locks obtained before copy_up will not
-apply to the copied up file.
-On a file opened with O_RDONLY fchmod(2), fchown(2), futimesat(2) and
+Any file locks (and leases) obtained before copy_up will not apply
-fsetxattr(2) will fail with EROFS.
+to the copied up file.
 If a file with multiple hard links is copied up, then this will
 "break" the link.  Changes will not be propagated to other names
diff --git a/Documentation/networking/dsa/dsa.txt b/Documentation/networking/dsa/dsa.txt
index 9d05ed7f7da5..f20c884c048a 100644
--- a/Documentation/networking/dsa/dsa.txt
+++ b/Documentation/networking/dsa/dsa.txt
@@ -587,26 +587,6 @@ of DSA, would be the its port-based VLAN, used by the associated bridge device.
 TODO
 ====
-The platform device problem
---------------------------
-DSA is currently implemented as a platform device driver which is far from ideal
-as was discussed in this thread:
-http://permalink.gmane.org/gmane.linux.network/329848
-This basically prevents the device driver model to be properly used and applied,
-and support non-MDIO, non-MMIO Ethernet connected switches.
-Another problem with the platform device driver approach is that it prevents the
-use of a modular switch drivers build due to a circular dependency, illustrated
-here:
-http://comments.gmane.org/gmane.linux.network/345803
-Attempts of reworking this has been done here:
-https://lwn.net/Articles/643149/
 Making SWITCHDEV and DSA converge towards an unified codebase
 -------------------------------------------------------------
diff --git a/Documentation/powerpc/transactional_memory.txt b/Documentation/powerpc/transactional_memory.txt
index ba0a2a4a54ba..e32fdbb4c9a7 100644
--- a/Documentation/powerpc/transactional_memory.txt
+++ b/Documentation/powerpc/transactional_memory.txt
@@ -167,6 +167,8 @@ signal will be rolled back anyway.
 For signals taken in non-TM or suspended mode, we use the
 normal/non-checkpointed stack pointer.
+Any transaction initiated inside a sighandler and suspended on return
+from the sighandler to the kernel will get reclaimed and discarded.
 Failure cause codes used by kernel
 ==================================
diff --git a/Documentation/rapidio/mport_cdev.txt b/Documentation/rapidio/mport_cdev.txt
index 6e491a662461..a53f786ee2e9 100644
--- a/Documentation/rapidio/mport_cdev.txt
+++ b/Documentation/rapidio/mport_cdev.txt
@@ -80,6 +80,10 @@ functionality of their platform when planning to use this driver:
 III. Module parameters
+- 'dma_timeout' - DMA transfer completion timeout (in msec, default value 3000).
+        This parameter set a maximum completion wait time for SYNC mode DMA
+        transfer requests and for RIO_WAIT_FOR_ASYNC ioctl requests.
 - 'dbg_level' - This parameter allows to control amount of debug information
        generated by this device driver. This parameter is formed by set of
        bit masks that correspond to the specific functional blocks.
diff --git a/MAINTAINERS b/MAINTAINERS
index 71aa5daeae8f..1fbd77d2de77 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -798,6 +798,7 @@ M:	Laura Abbott <labbott@redhat.com>
 M:      Sumit Semwal <sumit.semwal@linaro.org>
 L:      devel@driverdev.osuosl.org
 S:      Supported
+F:      Documentation/devicetree/bindings/staging/ion/
 F:      drivers/staging/android/ion
 F:      drivers/staging/android/uapi/ion.h
 F:      drivers/staging/android/uapi/ion_test.h
@@ -1643,7 +1644,6 @@ F:	drivers/*/*s3c64xx*
 F:      drivers/*/*s5pv210*
 F:      drivers/memory/samsung/*
 F:      drivers/soc/samsung/*
-F:      drivers/spi/spi-s3c*
 F:      Documentation/arm/Samsung/
 F:      Documentation/devicetree/bindings/arm/samsung/
 F:      Documentation/devicetree/bindings/sram/samsung-sram.txt
@@ -3247,7 +3247,7 @@ F:	kernel/cpuset.c
 CONTROL GROUP - MEMORY RESOURCE CONTROLLER (MEMCG)
 M:      Johannes Weiner <hannes@cmpxchg.org>
 M:      Michal Hocko <mhocko@kernel.org>
-M:      Vladimir Davydov <vdavydov@virtuozzo.com>
+M:      Vladimir Davydov <vdavydov.dev@gmail.com>
 L:      cgroups@vger.kernel.org
 L:      linux-mm@kvack.org
 S:      Maintained
@@ -10253,6 +10253,17 @@ S:	Supported
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 F:      drivers/clk/samsung/
+SAMSUNG SPI DRIVERS
+M:      Kukjin Kim <kgene@kernel.org>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Andi Shyti <andi.shyti@samsung.com>
+L:      linux-spi@vger.kernel.org
+L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
+S:      Maintained
+F:      Documentation/devicetree/bindings/spi/spi-samsung.txt
+F:      drivers/spi/spi-s3c*
+F:      include/linux/platform_data/spi-s3c64xx.h
 SAMSUNG SXGBE DRIVERS
 M:      Byungho An <bh74.an@samsung.com>
 M:      Girish K S <ks.giri@samsung.com>
@@ -11232,12 +11243,8 @@ S:	Odd Fixes
 F:      drivers/staging/vt665?/
 STAGING - WILC1000 WIFI DRIVER
-M:      Johnny Kim <johnny.kim@atmel.com>
+M:      Aditya Shankar <aditya.shankar@microchip.com>
-M:      Austin Shin <austin.shin@atmel.com>
+M:      Ganesh Krishna <ganesh.krishna@microchip.com>
-M:      Chris Park <chris.park@atmel.com>
-M:      Tony Cho <tony.cho@atmel.com>
-M:      Glen Lee <glen.lee@atmel.com>
-M:      Leo Kim <leo.kim@atmel.com>
 L:      linux-wireless@vger.kernel.org
 S:      Supported
 F:      drivers/staging/wilc1000/
diff --git a/Makefile b/Makefile
index 67f42d57e6e7..a4e6cc531f81 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Psychotic Stoned Sheep
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/rk3066a.dtsi b/arch/arm/boot/dts/rk3066a.dtsi
index c0ba86c3a2ab..0d0dae3a1694 100644
--- a/arch/arm/boot/dts/rk3066a.dtsi
+++ b/arch/arm/boot/dts/rk3066a.dtsi
@@ -197,6 +197,8 @@
                clock-names = "saradc", "apb_pclk";
                interrupts = <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>;
                #io-channel-cells = <1>;
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                status = "disabled";
        };
diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index cd33f0170890..91c4b3c7a8d5 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -279,6 +279,8 @@
                #io-channel-cells = <1>;
                clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                status = "disabled";
        };
diff --git a/arch/arm/boot/dts/rk3xxx.dtsi b/arch/arm/boot/dts/rk3xxx.dtsi
index 99bbcc2c9b89..e2cd683b4e4b 100644
--- a/arch/arm/boot/dts/rk3xxx.dtsi
+++ b/arch/arm/boot/dts/rk3xxx.dtsi
@@ -399,6 +399,8 @@
                #io-channel-cells = <1>;
                clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                status = "disabled";
        };
diff --git a/arch/arm/mach-pxa/idp.c b/arch/arm/mach-pxa/idp.c
index c410d84b243d..66070acaa888 100644
--- a/arch/arm/mach-pxa/idp.c
+++ b/arch/arm/mach-pxa/idp.c
@@ -83,7 +83,8 @@ static struct resource smc91x_resources[] = {
 };
 static struct smc91x_platdata smc91x_platdata = {
-        .flags = SMC91X_USE_32BIT | SMC91X_USE_DMA | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_USE_DMA | SMC91X_NOWAIT,
 };
 static struct platform_device smc91x_device = {
diff --git a/arch/arm/mach-pxa/xcep.c b/arch/arm/mach-pxa/xcep.c
index 3f06cd90567a..056369ef250e 100644
--- a/arch/arm/mach-pxa/xcep.c
+++ b/arch/arm/mach-pxa/xcep.c
@@ -120,7 +120,8 @@ static struct resource smc91x_resources[] = {
 };
 static struct smc91x_platdata xcep_smc91x_info = {
-        .flags  = SMC91X_USE_32BIT | SMC91X_NOWAIT | SMC91X_USE_DMA,
+        .flags  = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                  SMC91X_NOWAIT | SMC91X_USE_DMA,
 };
 static struct platform_device smc91x_device = {
diff --git a/arch/arm/mach-realview/core.c b/arch/arm/mach-realview/core.c
index baf174542e36..a0ead0ae23d6 100644
--- a/arch/arm/mach-realview/core.c
+++ b/arch/arm/mach-realview/core.c
@@ -93,7 +93,8 @@ static struct smsc911x_platform_config smsc911x_config = {
 };
 static struct smc91x_platdata smc91x_platdata = {
-        .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_NOWAIT,
 };
 static struct platform_device realview_eth_device = {
diff --git a/arch/arm/mach-sa1100/pleb.c b/arch/arm/mach-sa1100/pleb.c
index 1525d7b5f1b7..88149f85bc49 100644
--- a/arch/arm/mach-sa1100/pleb.c
+++ b/arch/arm/mach-sa1100/pleb.c
@@ -45,7 +45,7 @@ static struct resource smc91x_resources[] = {
 };
 static struct smc91x_platdata smc91x_platdata = {
-        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_16BIT | SMC91X_USE_8BIT | SMC91X_NOWAIT,
 };
 static struct platform_device smc91x_device = {
diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
index d02a900378e1..4f44d1191bfd 100644
--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
@@ -270,6 +270,8 @@
                #io-channel-cells = <1>;
                clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                status = "disabled";
        };
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 5bb61de23201..9d37e967fa19 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -100,7 +100,16 @@ ENTRY(cpu_do_resume)
        msr     tcr_el1, x8
        msr     vbar_el1, x9
+        /*
+         * __cpu_setup() cleared MDSCR_EL1.MDE and friends, before unmasking
+         * debug exceptions. By restoring MDSCR_EL1 here, we may take a debug
+         * exception. Mask them until local_dbg_restore() in cpu_suspend()
+         * resets them.
+         */
+        disable_dbg
        msr     mdscr_el1, x10
        msr     sctlr_el1, x12
        /*
         * Restore oslsr_el1 by writing oslar_el1
diff --git a/arch/blackfin/mach-bf561/boards/cm_bf561.c b/arch/blackfin/mach-bf561/boards/cm_bf561.c
index c6db52ba3a06..10c57771822d 100644
--- a/arch/blackfin/mach-bf561/boards/cm_bf561.c
+++ b/arch/blackfin/mach-bf561/boards/cm_bf561.c
@@ -146,7 +146,8 @@ static struct platform_device hitachi_fb_device = {
 #include <linux/smc91x.h>
 static struct smc91x_platdata smc91x_info = {
-        .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_NOWAIT,
        .leda = RPC_LED_100_10,
        .ledb = RPC_LED_TX_RX,
 };
diff --git a/arch/blackfin/mach-bf561/boards/ezkit.c b/arch/blackfin/mach-bf561/boards/ezkit.c
index f35525b55819..57d1c43726d9 100644
--- a/arch/blackfin/mach-bf561/boards/ezkit.c
+++ b/arch/blackfin/mach-bf561/boards/ezkit.c
@@ -134,7 +134,8 @@ static struct platform_device net2272_bfin_device = {
 #include <linux/smc91x.h>
 static struct smc91x_platdata smc91x_info = {
-        .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_NOWAIT,
        .leda = RPC_LED_100_10,
        .ledb = RPC_LED_TX_RX,
 };
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index cd8778103165..af12c2db9bb8 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -1,6 +1,5 @@
 config PARISC
        def_bool y
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
        select ARCH_MIGHT_HAVE_PC_PARPORT
        select HAVE_IDE
        select HAVE_OPROFILE
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
index 1a8f6f95689e..f6a4c016304b 100644
--- a/arch/parisc/configs/c8000_defconfig
+++ b/arch/parisc/configs/c8000_defconfig
@@ -245,7 +245,6 @@ CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_PROVE_RCU_DELAY=y
 CONFIG_DEBUG_BLOCK_EXT_DEVT=y
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_KEYS=y
 # CONFIG_CRYPTO_HW is not set
 CONFIG_FONTS=y
diff --git a/arch/parisc/configs/generic-64bit_defconfig b/arch/parisc/configs/generic-64bit_defconfig
index 7e0792658952..c564e6e1fa23 100644
--- a/arch/parisc/configs/generic-64bit_defconfig
+++ b/arch/parisc/configs/generic-64bit_defconfig
@@ -291,7 +291,6 @@ CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 # CONFIG_SCHED_DEBUG is not set
 CONFIG_TIMER_STATS=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_PCBC=m
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index 0f59fd9ca205..e9150487e20d 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -208,13 +208,13 @@ unsigned long copy_in_user(void __user *dst, const void __user *src, unsigned lo
 #define __copy_to_user_inatomic __copy_to_user
 #define __copy_from_user_inatomic __copy_from_user
-extern void copy_from_user_overflow(void)
+extern void __compiletime_error("usercopy buffer size is too small")
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
+__bad_copy_user(void);
-        __compiletime_error("copy_from_user() buffer size is not provably correct")
-#else
+static inline void copy_user_overflow(int size, unsigned long count)
-        __compiletime_warning("copy_from_user() buffer size is not provably correct")
+{
-#endif
+        WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
-;
+}
 static inline unsigned long __must_check copy_from_user(void *to,
                                          const void __user *from,
@@ -223,10 +223,12 @@ static inline unsigned long __must_check copy_from_user(void *to,
        int sz = __compiletime_object_size(to);
        int ret = -EFAULT;
-        if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
+        if (likely(sz == -1 || sz >= n))
                ret = __copy_from_user(to, from, n);
-        else
+        else if (!__builtin_constant_p(n))
-                copy_from_user_overflow();
+                copy_user_overflow(sz, n);
+        else
+                __bad_copy_user();
        return ret;
 }
diff --git a/arch/powerpc/include/asm/cputhreads.h b/arch/powerpc/include/asm/cputhreads.h
index 666bef4ebfae..9377bdf42eb8 100644
--- a/arch/powerpc/include/asm/cputhreads.h
+++ b/arch/powerpc/include/asm/cputhreads.h
@@ -3,6 +3,7 @@
 #ifndef __ASSEMBLY__
 #include <linux/cpumask.h>
+#include <asm/cpu_has_feature.h>
 /*
 * Mapping of threads to cores
diff --git a/arch/powerpc/include/asm/hmi.h b/arch/powerpc/include/asm/hmi.h
index 88b4901ac4ee..85b7a1a21e22 100644
--- a/arch/powerpc/include/asm/hmi.h
+++ b/arch/powerpc/include/asm/hmi.h
@@ -21,7 +21,7 @@
 #ifndef __ASM_PPC64_HMI_H__
 #define __ASM_PPC64_HMI_H__
-#ifdef CONFIG_PPC_BOOK3S_64
+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
 #define CORE_TB_RESYNC_REQ_BIT          63
 #define MAX_SUBCORE_PER_CORE            4
diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h
index 148303e7771f..6a6792bb39fb 100644
--- a/arch/powerpc/include/asm/paca.h
+++ b/arch/powerpc/include/asm/paca.h
@@ -183,11 +183,6 @@ struct paca_struct {
         */
        u16 in_mce;
        u8 hmi_event_available;          /* HMI event is available */
-        /*
-         * Bitmap for sibling subcore status. See kvm/book3s_hv_ras.c for
-         * more details
-         */
-        struct sibling_subcore_state *sibling_subcore_state;
 #endif
        /* Stuff for accurate time accounting */
@@ -202,6 +197,13 @@ struct paca_struct {
        struct kvmppc_book3s_shadow_vcpu shadow_vcpu;
 #endif
        struct kvmppc_host_state kvm_hstate;
+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
+        /*
+         * Bitmap for sibling subcore status. See kvm/book3s_hv_ras.c for
+         * more details
+         */
+        struct sibling_subcore_state *sibling_subcore_state;
+#endif
 #endif
 };
diff --git a/arch/powerpc/include/asm/pci-bridge.h b/arch/powerpc/include/asm/pci-bridge.h
index b5e88e4a171a..c0309c59bed8 100644
--- a/arch/powerpc/include/asm/pci-bridge.h
+++ b/arch/powerpc/include/asm/pci-bridge.h
@@ -301,6 +301,7 @@ extern void pci_process_bridge_OF_ranges(struct pci_controller *hose,
 /* Allocate & free a PCI host bridge structure */
 extern struct pci_controller *pcibios_alloc_controller(struct device_node *dev);
 extern void pcibios_free_controller(struct pci_controller *phb);
+extern void pcibios_free_controller_deferred(struct pci_host_bridge *bridge);
 #ifdef CONFIG_PCI
 extern int pcibios_vaddr_is_ioport(void __iomem *address);
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index b2027a5cf508..fe4c075bcf50 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -41,7 +41,7 @@ obj-$(CONFIG_VDSO32)		+= vdso32/
 obj-$(CONFIG_HAVE_HW_BREAKPOINT)        += hw_breakpoint.o
 obj-$(CONFIG_PPC_BOOK3S_64)     += cpu_setup_ppc970.o cpu_setup_pa6t.o
 obj-$(CONFIG_PPC_BOOK3S_64)     += cpu_setup_power.o
-obj-$(CONFIG_PPC_BOOK3S_64)     += mce.o mce_power.o hmi.o
+obj-$(CONFIG_PPC_BOOK3S_64)     += mce.o mce_power.o
 obj-$(CONFIG_PPC_BOOK3E_64)     += exceptions-64e.o idle_book3e.o
 obj-$(CONFIG_PPC64)             += vdso64/
 obj-$(CONFIG_ALTIVEC)           += vecemu.o
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 6b8bc0dd09d4..5afd03e5e8b8 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -368,13 +368,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
 tabort_syscall:
        /* Firstly we need to enable TM in the kernel */
        mfmsr   r10
-        li      r13, 1
+        li      r9, 1
-        rldimi  r10, r13, MSR_TM_LG, 63-MSR_TM_LG
+        rldimi  r10, r9, MSR_TM_LG, 63-MSR_TM_LG
        mtmsrd  r10, 0
        /* tabort, this dooms the transaction, nothing else */
-        li      r13, (TM_CAUSE_SYSCALL|TM_CAUSE_PERSISTENT)
+        li      r9, (TM_CAUSE_SYSCALL|TM_CAUSE_PERSISTENT)
-        TABORT(R13)
+        TABORT(R9)
        /*
         * Return directly to userspace. We have corrupted user register state,
@@ -382,8 +382,8 @@ tabort_syscall:
         * resume after the tbegin of the aborted transaction with the
         * checkpointed register state.
         */
-        li      r13, MSR_RI
+        li      r9, MSR_RI
-        andc    r10, r10, r13
+        andc    r10, r10, r9
        mtmsrd  r10, 1
        mtspr   SPRN_SRR0, r11
        mtspr   SPRN_SRR1, r12
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index df6d45eb4115..bffec73dbffc 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -485,7 +485,23 @@ machine_check_fwnmi:
        EXCEPTION_PROLOG_0(PACA_EXMC)
 machine_check_pSeries_0:
        EXCEPTION_PROLOG_1(PACA_EXMC, KVMTEST, 0x200)
-        EXCEPTION_PROLOG_PSERIES_1(machine_check_common, EXC_STD)
+        /*
+         * The following is essentially EXCEPTION_PROLOG_PSERIES_1 with the
+         * difference that MSR_RI is not enabled, because PACA_EXMC is being
+         * used, so nested machine check corrupts it. machine_check_common
+         * enables MSR_RI.
+         */
+        ld      r12,PACAKBASE(r13)
+        ld      r10,PACAKMSR(r13)
+        xori    r10,r10,MSR_RI
+        mfspr   r11,SPRN_SRR0
+        LOAD_HANDLER(r12, machine_check_common)
+        mtspr   SPRN_SRR0,r12
+        mfspr   r12,SPRN_SRR1
+        mtspr   SPRN_SRR1,r10
+        rfid
+        b       .       /* prevent speculative execution */
        KVM_HANDLER_SKIP(PACA_EXMC, EXC_STD, 0x200)
        KVM_HANDLER_SKIP(PACA_EXGEN, EXC_STD, 0x300)
        KVM_HANDLER_SKIP(PACA_EXSLB, EXC_STD, 0x380)
@@ -969,14 +985,17 @@ ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX)
 machine_check_common:
        mfspr   r10,SPRN_DAR
-        std     r10,PACA_EXGEN+EX_DAR(r13)
+        std     r10,PACA_EXMC+EX_DAR(r13)
        mfspr   r10,SPRN_DSISR
-        stw     r10,PACA_EXGEN+EX_DSISR(r13)
+        stw     r10,PACA_EXMC+EX_DSISR(r13)
        EXCEPTION_PROLOG_COMMON(0x200, PACA_EXMC)
        FINISH_NAP
        RECONCILE_IRQ_STATE(r10, r11)
-        ld      r3,PACA_EXGEN+EX_DAR(r13)
+        ld      r3,PACA_EXMC+EX_DAR(r13)
-        lwz     r4,PACA_EXGEN+EX_DSISR(r13)
+        lwz     r4,PACA_EXMC+EX_DSISR(r13)
+        /* Enable MSR_RI when finished with PACA_EXMC */
+        li      r10,MSR_RI
+        mtmsrd  r10,1
        std     r3,_DAR(r1)
        std     r4,_DSISR(r1)
        bl      save_nvgprs
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 3ed8ec09b5c9..e785cc9e1ecd 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -29,7 +29,7 @@
 #include <linux/kprobes.h>
 #include <linux/ptrace.h>
 #include <linux/preempt.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/kdebug.h>
 #include <linux/slab.h>
 #include <asm/code-patching.h>
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index 7fdf324d5b51..e58908066b0e 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -154,6 +154,42 @@ void pcibios_free_controller(struct pci_controller *phb)
 EXPORT_SYMBOL_GPL(pcibios_free_controller);
 /*
+ * This function is used to call pcibios_free_controller()
+ * in a deferred manner: a callback from the PCI subsystem.
+ *
+ * _*DO NOT*_ call pcibios_free_controller() explicitly if
+ * this is used (or it may access an invalid *phb pointer).
+ *
+ * The callback occurs when all references to the root bus
+ * are dropped (e.g., child buses/devices and their users).
+ *
+ * It's called as .release_fn() of 'struct pci_host_bridge'
+ * which is associated with the 'struct pci_controller.bus'
+ * (root bus) - it expects .release_data to hold a pointer
+ * to 'struct pci_controller'.
+ *
+ * In order to use it, register .release_fn()/release_data
+ * like this:
+ *
+ * pci_set_host_bridge_release(bridge,
+ *                             pcibios_free_controller_deferred
+ *                             (void *) phb);
+ *
+ * e.g. in the pcibios_root_bridge_prepare() callback from
+ * pci_create_root_bus().
+ */
+void pcibios_free_controller_deferred(struct pci_host_bridge *bridge)
+{
+        struct pci_controller *phb = (struct pci_controller *)
+                                         bridge->release_data;
+        pr_debug("domain %d, dynamic %d\n", phb->global_number, phb->is_dynamic);
+        pcibios_free_controller(phb);
+}
+EXPORT_SYMBOL_GPL(pcibios_free_controller_deferred);
+/*
 * The function is used to return the minimal alignment
 * for memory or I/O windows of the associated P2P bridge.
 * By default, 4KiB alignment for I/O windows and 1MiB for
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 4e74fc588a3f..d3eff99e938c 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -695,7 +695,7 @@ unsigned char ibm_architecture_vec[] = {
        OV4_MIN_ENT_CAP,                /* minimum VP entitled capacity */
        /* option vector 5: PAPR/OF options */
-        VECTOR_LENGTH(18),              /* length */
+        VECTOR_LENGTH(21),              /* length */
        0,                              /* don't ignore, don't halt */
        OV5_FEAT(OV5_LPAR) | OV5_FEAT(OV5_SPLPAR) | OV5_FEAT(OV5_LARGE_PAGES) |
        OV5_FEAT(OV5_DRCONF_MEMORY) | OV5_FEAT(OV5_DONATE_DEDICATE_CPU) |
@@ -726,8 +726,11 @@ unsigned char ibm_architecture_vec[] = {
        0,
        0,
        OV5_FEAT(OV5_PFO_HW_RNG) | OV5_FEAT(OV5_PFO_HW_ENCR) |
-        OV5_FEAT(OV5_PFO_HW_842),
+        OV5_FEAT(OV5_PFO_HW_842),                               /* Byte 17 */
-        OV5_FEAT(OV5_SUB_PROCESSORS),
+        0,                                                      /* Byte 18 */
+        0,                                                      /* Byte 19 */
+        0,                                                      /* Byte 20 */
+        OV5_FEAT(OV5_SUB_PROCESSORS),                           /* Byte 21 */
        /* option vector 6: IBM PAPR hints */
        VECTOR_LENGTH(3),               /* length */
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index b6aa378aff63..a7daf749b97f 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -1226,7 +1226,21 @@ long sys_rt_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
                (regs->gpr[1] + __SIGNAL_FRAMESIZE + 16);
        if (!access_ok(VERIFY_READ, rt_sf, sizeof(*rt_sf)))
                goto bad;
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        /*
+         * If there is a transactional state then throw it away.
+         * The purpose of a sigreturn is to destroy all traces of the
+         * signal frame, this includes any transactional state created
+         * within in. We only check for suspended as we can never be
+         * active in the kernel, we are active, there is nothing better to
+         * do than go ahead and Bad Thing later.
+         * The cause is not important as there will never be a
+         * recheckpoint so it's not user visible.
+         */
+        if (MSR_TM_SUSPENDED(mfmsr()))
+                tm_reclaim_current(0);
        if (__get_user(tmp, &rt_sf->uc.uc_link))
                goto bad;
        uc_transact = (struct ucontext __user *)(uintptr_t)tmp;
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 7e49984d4331..70409bb90a95 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -676,7 +676,21 @@ int sys_rt_sigreturn(unsigned long r3, unsigned long r4, unsigned long r5,
        if (__copy_from_user(&set, &uc->uc_sigmask, sizeof(set)))
                goto badframe;
        set_current_blocked(&set);
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        /*
+         * If there is a transactional state then throw it away.
+         * The purpose of a sigreturn is to destroy all traces of the
+         * signal frame, this includes any transactional state created
+         * within in. We only check for suspended as we can never be
+         * active in the kernel, we are active, there is nothing better to
+         * do than go ahead and Bad Thing later.
+         * The cause is not important as there will never be a
+         * recheckpoint so it's not user visible.
+         */
+        if (MSR_TM_SUSPENDED(mfmsr()))
+                tm_reclaim_current(0);
        if (__get_user(msr, &uc->uc_mcontext.gp_regs[PT_MSR]))
                goto badframe;
        if (MSR_TM_ACTIVE(msr)) {
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 25a39052bf6b..9c6f3fd58059 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -830,7 +830,7 @@ int __cpu_disable(void)
        /* Update sibling maps */
        base = cpu_first_thread_sibling(cpu);
-        for (i = 0; i < threads_per_core; i++) {
+        for (i = 0; i < threads_per_core && base + i < nr_cpu_ids; i++) {
                cpumask_clear_cpu(cpu, cpu_sibling_mask(base + i));
                cpumask_clear_cpu(base + i, cpu_sibling_mask(cpu));
                cpumask_clear_cpu(cpu, cpu_core_mask(base + i));
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 2cb589264cb7..62859ebe0062 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -25,7 +25,8 @@
 #include <linux/user.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
-#include <linux/module.h>
+#include <linux/extable.h>
+#include <linux/module.h>       /* print_modules */
 #include <linux/prctl.h>
 #include <linux/delay.h>
 #include <linux/kprobes.h>
diff --git a/arch/powerpc/kvm/Makefile b/arch/powerpc/kvm/Makefile
index 1f9e5529e692..855d4b95d752 100644
--- a/arch/powerpc/kvm/Makefile
+++ b/arch/powerpc/kvm/Makefile
@@ -78,6 +78,7 @@ kvm-book3s_64-builtin-xics-objs-$(CONFIG_KVM_XICS) := \
 ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
 kvm-book3s_64-builtin-objs-$(CONFIG_KVM_BOOK3S_64_HANDLER) += \
+        book3s_hv_hmi.o \
        book3s_hv_rmhandlers.o \
        book3s_hv_rm_mmu.o \
        book3s_hv_ras.o \
diff --git a/arch/powerpc/kernel/hmi.c b/arch/powerpc/kvm/book3s_hv_hmi.c
index e3f738eb1cac..e3f738eb1cac 100644
--- a/arch/powerpc/kernel/hmi.c
+++ b/arch/powerpc/kvm/book3s_hv_hmi.c
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index a4db22f65021..bb1ffc559f38 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -26,7 +26,7 @@
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/highmem.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/kprobes.h>
 #include <linux/kdebug.h>
 #include <linux/perf_event.h>
diff --git a/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c b/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
index 8eb82b043dd8..d93dd4acf40b 100644
--- a/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
+++ b/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
@@ -528,7 +528,6 @@ static struct platform_driver mpc512x_lpbfifo_driver = {
        .remove = mpc512x_lpbfifo_remove,
        .driver = {
                .name = DRV_NAME,
-                .owner = THIS_MODULE,
                .of_match_table = mpc512x_lpbfifo_match,
        },
 };
diff --git a/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c b/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
index dbcd0303afed..63c5ab6489c9 100644
--- a/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
+++ b/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
@@ -222,7 +222,6 @@ static const struct of_device_id mcu_of_match_table[] = {
 static struct i2c_driver mcu_driver = {
        .driver = {
                .name = "mcu-mpc8349emitx",
-                .owner = THIS_MODULE,
                .of_match_table = mcu_of_match_table,
        },
        .probe = mcu_probe,
diff --git a/arch/powerpc/platforms/embedded6xx/holly.c b/arch/powerpc/platforms/embedded6xx/holly.c
index dafba1057a47..dfd310031549 100644
--- a/arch/powerpc/platforms/embedded6xx/holly.c
+++ b/arch/powerpc/platforms/embedded6xx/holly.c
@@ -26,7 +26,7 @@
 #include <linux/tty.h>
 #include <linux/serial_core.h>
 #include <linux/of_platform.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <asm/time.h>
 #include <asm/machdep.h>
diff --git a/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c b/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c
index 80804f9916ee..f97bab8e37a2 100644
--- a/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c
+++ b/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c
@@ -23,7 +23,7 @@
 #include <linux/pci.h>
 #include <linux/kdev_t.h>
 #include <linux/console.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/delay.h>
 #include <linux/irq.h>
 #include <linux/seq_file.h>
diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c
index 2ee96431f736..4c827826c05e 100644
--- a/arch/powerpc/platforms/powernv/opal-dump.c
+++ b/arch/powerpc/platforms/powernv/opal-dump.c
@@ -370,6 +370,7 @@ static irqreturn_t process_dump(int irq, void *data)
        uint32_t dump_id, dump_size, dump_type;
        struct dump_obj *dump;
        char name[22];
+        struct kobject *kobj;
        rc = dump_read_info(&dump_id, &dump_size, &dump_type);
        if (rc != OPAL_SUCCESS)
@@ -381,8 +382,12 @@ static irqreturn_t process_dump(int irq, void *data)
         * that gracefully and not create two conflicting
         * entries.
         */
-        if (kset_find_obj(dump_kset, name))
+        kobj = kset_find_obj(dump_kset, name);
+        if (kobj) {
+                /* Drop reference added by kset_find_obj() */
+                kobject_put(kobj);
                return 0;
+        }
        dump = create_dump_obj(dump_id, dump_size, dump_type);
        if (!dump)
diff --git a/arch/powerpc/platforms/powernv/opal-elog.c b/arch/powerpc/platforms/powernv/opal-elog.c
index 37f959bf392e..f2344cbd2f46 100644
--- a/arch/powerpc/platforms/powernv/opal-elog.c
+++ b/arch/powerpc/platforms/powernv/opal-elog.c
@@ -247,6 +247,7 @@ static irqreturn_t elog_event(int irq, void *data)
        uint64_t elog_type;
        int rc;
        char name[2+16+1];
+        struct kobject *kobj;
        rc = opal_get_elog_size(&id, &size, &type);
        if (rc != OPAL_SUCCESS) {
@@ -269,8 +270,12 @@ static irqreturn_t elog_event(int irq, void *data)
         * that gracefully and not create two conflicting
         * entries.
         */
-        if (kset_find_obj(elog_kset, name))
+        kobj = kset_find_obj(elog_kset, name);
+        if (kobj) {
+                /* Drop reference added by kset_find_obj() */
+                kobject_put(kobj);
                return IRQ_HANDLED;
+        }
        create_elog_obj(log_id, elog_size, elog_type);
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index fd9444f9fb0c..13218263e66e 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -149,7 +149,7 @@ static void pnv_ioda_reserve_pe(struct pnv_phb *phb, int pe_no)
 static struct pnv_ioda_pe *pnv_ioda_alloc_pe(struct pnv_phb *phb)
 {
-        unsigned long pe = phb->ioda.total_pe_num - 1;
+        long pe;
        for (pe = phb->ioda.total_pe_num - 1; pe >= 0; pe--) {
                if (!test_and_set_bit(pe, phb->ioda.pe_alloc))
diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
index fe16a50700de..09eba5a9929a 100644
--- a/arch/powerpc/platforms/pseries/pci.c
+++ b/arch/powerpc/platforms/pseries/pci.c
@@ -119,6 +119,10 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
        bus = bridge->bus;
+        /* Rely on the pcibios_free_controller_deferred() callback. */
+        pci_set_host_bridge_release(bridge, pcibios_free_controller_deferred,
+                                        (void *) pci_bus_to_host(bus));
        dn = pcibios_get_phb_of_node(bus);
        if (!dn)
                return 0;
diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
index 906dbaa97fe2..547fd13e4f8e 100644
--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
+++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
@@ -106,8 +106,11 @@ int remove_phb_dynamic(struct pci_controller *phb)
                release_resource(res);
        }
-        /* Free pci_controller data structure */
+        /*
-        pcibios_free_controller(phb);
+         * The pci_controller data structure is freed by
+         * the pcibios_free_controller_deferred() callback;
+         * see pseries_root_bridge_prepare().
+         */
        return 0;
 }
diff --git a/arch/powerpc/sysdev/cpm1.c b/arch/powerpc/sysdev/cpm1.c
index 6c110994d902..81d49476c47e 100644
--- a/arch/powerpc/sysdev/cpm1.c
+++ b/arch/powerpc/sysdev/cpm1.c
@@ -534,7 +534,8 @@ struct cpm1_gpio16_chip {
 static void cpm1_gpio16_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct cpm1_gpio16_chip *cpm1_gc = gpiochip_get_data(&mm_gc->gc);
+        struct cpm1_gpio16_chip *cpm1_gc =
+                container_of(mm_gc, struct cpm1_gpio16_chip, mm_gc);
        struct cpm_ioport16 __iomem *iop = mm_gc->regs;
        cpm1_gc->cpdata = in_be16(&iop->dat);
@@ -649,7 +650,8 @@ struct cpm1_gpio32_chip {
 static void cpm1_gpio32_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct cpm1_gpio32_chip *cpm1_gc = gpiochip_get_data(&mm_gc->gc);
+        struct cpm1_gpio32_chip *cpm1_gc =
+                container_of(mm_gc, struct cpm1_gpio32_chip, mm_gc);
        struct cpm_ioport32b __iomem *iop = mm_gc->regs;
        cpm1_gc->cpdata = in_be32(&iop->dat);
diff --git a/arch/powerpc/sysdev/cpm_common.c b/arch/powerpc/sysdev/cpm_common.c
index 911456d17713..947f42007734 100644
--- a/arch/powerpc/sysdev/cpm_common.c
+++ b/arch/powerpc/sysdev/cpm_common.c
@@ -94,7 +94,8 @@ struct cpm2_gpio32_chip {
 static void cpm2_gpio32_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct cpm2_gpio32_chip *cpm2_gc = gpiochip_get_data(&mm_gc->gc);
+        struct cpm2_gpio32_chip *cpm2_gc =
+                container_of(mm_gc, struct cpm2_gpio32_chip, mm_gc);
        struct cpm2_ioports __iomem *iop = mm_gc->regs;
        cpm2_gc->cpdata = in_be32(&iop->dat);
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 68e7c0dd2e45..3cc7cace194a 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -23,7 +23,7 @@
 */
 #include <linux/init.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/types.h>
 #include <linux/dma-mapping.h>
 #include <linux/interrupt.h>
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index e751fe25d6ab..c109f073d454 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -68,7 +68,6 @@ config DEBUG_RODATA
 config S390
        def_bool y
        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select ARCH_HAS_ELF_RANDOMIZE
        select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index 26e0c7f08814..412b1bd21029 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -602,7 +602,6 @@ CONFIG_FAIL_FUTEX=y
 CONFIG_FAULT_INJECTION_DEBUG_FS=y
 CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_IRQSOFF_TRACER=y
 CONFIG_PREEMPT_TRACER=y
 CONFIG_SCHED_TRACER=y
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index 24879dab47bc..bec279eb4b93 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -552,7 +552,6 @@ CONFIG_NOTIFIER_ERROR_INJECTION=m
 CONFIG_CPU_NOTIFIER_ERROR_INJECT=m
 CONFIG_PM_NOTIFIER_ERROR_INJECT=m
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_BLK_DEV_IO_TRACE=y
 # CONFIG_KPROBE_EVENT is not set
 CONFIG_TRACE_ENUM_MAP_FILE=y
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index a5c1e5f2a0ca..1751446a5bbb 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -549,7 +549,6 @@ CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 73610f2e3b4f..2d40ef0a6295 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -172,7 +172,6 @@ CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_RCU_TRACE=y
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
index 9b49cf1daa8f..95aefdba4be2 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -311,6 +311,14 @@ int __get_user_bad(void) __attribute__((noreturn));
 #define __put_user_unaligned __put_user
 #define __get_user_unaligned __get_user
+extern void __compiletime_error("usercopy buffer size is too small")
+__bad_copy_user(void);
+static inline void copy_user_overflow(int size, unsigned long count)
+{
+        WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
+}
 /**
 * copy_to_user: - Copy a block of data into user space.
 * @to:   Destination address, in user space.
@@ -332,12 +340,6 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
        return __copy_to_user(to, from, n);
 }
-void copy_from_user_overflow(void)
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-__compiletime_warning("copy_from_user() buffer size is not provably correct")
-#endif
-;
 /**
 * copy_from_user: - Copy a block of data from user space.
 * @to:   Destination address, in kernel space.
@@ -362,7 +364,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
        might_fault();
        if (unlikely(sz != -1 && sz < n)) {
-                copy_from_user_overflow();
+                if (!__builtin_constant_p(n))
+                        copy_user_overflow(sz, n);
+                else
+                        __bad_copy_user();
                return n;
        }
        return __copy_from_user(to, from, n);
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 4820a02838ac..78da75b670bc 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -4,7 +4,6 @@
 config TILE
        def_bool y
        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select ARCH_HAVE_NMI_SAFE_CMPXCHG
        select ARCH_WANT_FRAME_POINTERS
diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h
index 0a9c4265763b..a77369e91e54 100644
--- a/arch/tile/include/asm/uaccess.h
+++ b/arch/tile/include/asm/uaccess.h
@@ -416,14 +416,13 @@ _copy_from_user(void *to, const void __user *from, unsigned long n)
        return n;
 }
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
+extern void __compiletime_error("usercopy buffer size is too small")
-/*
+__bad_copy_user(void);
- * There are still unprovable places in the generic code as of 2.6.34, so this
- * option is not really compatible with -Werror, which is more useful in
+static inline void copy_user_overflow(int size, unsigned long count)
- * general.
+{
- */
+        WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
-extern void copy_from_user_overflow(void)
+}
-        __compiletime_warning("copy_from_user() size is not provably correct");
 static inline unsigned long __must_check copy_from_user(void *to,
                                          const void __user *from,
@@ -433,14 +432,13 @@ static inline unsigned long __must_check copy_from_user(void *to,
        if (likely(sz == -1 || sz >= n))
                n = _copy_from_user(to, from, n);
+        else if (!__builtin_constant_p(n))
+                copy_user_overflow(sz, n);
        else
-                copy_from_user_overflow();
+                __bad_copy_user();
        return n;
 }
-#else
-#define copy_from_user _copy_from_user
-#endif
 #ifdef __tilegx__
 /**
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c580d8c33562..2a1f0ce7c59a 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -24,7 +24,6 @@ config X86
        select ARCH_DISCARD_MEMBLOCK
        select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI
        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
        select ARCH_HAS_DEVMEM_IS_ALLOWED
        select ARCH_HAS_ELF_RANDOMIZE
        select ARCH_HAS_FAST_MULTIPLIER
diff --git a/arch/x86/configs/tiny.config b/arch/x86/configs/tiny.config
index 4e2ecfa23c15..4b429df40d7a 100644
--- a/arch/x86/configs/tiny.config
+++ b/arch/x86/configs/tiny.config
@@ -1 +1,3 @@
 CONFIG_NOHIGHMEM=y
+# CONFIG_HIGHMEM4G is not set
+# CONFIG_HIGHMEM64G is not set
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index a0ae610b9280..c3f291195294 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -697,43 +697,14 @@ unsigned long __must_check _copy_from_user(void *to, const void __user *from,
 unsigned long __must_check _copy_to_user(void __user *to, const void *from,
                                         unsigned n);
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
+extern void __compiletime_error("usercopy buffer size is too small")
-# define copy_user_diag __compiletime_error
+__bad_copy_user(void);
-#else
-# define copy_user_diag __compiletime_warning
-#endif
-extern void copy_user_diag("copy_from_user() buffer size is too small")
-copy_from_user_overflow(void);
-extern void copy_user_diag("copy_to_user() buffer size is too small")
-copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
-#undef copy_user_diag
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-extern void
-__compiletime_warning("copy_from_user() buffer size is not provably correct")
-__copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
-#define __copy_from_user_overflow(size, count) __copy_from_user_overflow()
-extern void
-__compiletime_warning("copy_to_user() buffer size is not provably correct")
-__copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
-#define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
-#else
-static inline void
+static inline void copy_user_overflow(int size, unsigned long count)
-__copy_from_user_overflow(int size, unsigned long count)
 {
        WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
 }
-#define __copy_to_user_overflow __copy_from_user_overflow
-#endif
 static inline unsigned long __must_check
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
@@ -743,31 +714,13 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
        kasan_check_write(to, n);
-        /*
-         * While we would like to have the compiler do the checking for us
-         * even in the non-constant size case, any false positives there are
-         * a problem (especially when DEBUG_STRICT_USER_COPY_CHECKS, but even
-         * without - the [hopefully] dangerous looking nature of the warning
-         * would make people go look at the respecitive call sites over and
-         * over again just to find that there's no problem).
-         *
-         * And there are cases where it's just not realistic for the compiler
-         * to prove the count to be in range. For example when multiple call
-         * sites of a helper function - perhaps in different source files -
-         * all doing proper range checking, yet the helper function not doing
-         * so again.
-         *
-         * Therefore limit the compile time checking to the constant size
-         * case, and do only runtime checking for non-constant sizes.
-         */
        if (likely(sz < 0 || sz >= n)) {
                check_object_size(to, n, false);
                n = _copy_from_user(to, from, n);
-        } else if (__builtin_constant_p(n))
+        } else if (!__builtin_constant_p(n))
-                copy_from_user_overflow();
+                copy_user_overflow(sz, n);
        else
-                __copy_from_user_overflow(sz, n);
+                __bad_copy_user();
        return n;
 }
@@ -781,21 +734,17 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
        might_fault();
-        /* See the comment in copy_from_user() above. */
        if (likely(sz < 0 || sz >= n)) {
                check_object_size(from, n, true);
                n = _copy_to_user(to, from, n);
-        } else if (__builtin_constant_p(n))
+        } else if (!__builtin_constant_p(n))
-                copy_to_user_overflow();
+                copy_user_overflow(sz, n);
        else
-                __copy_to_user_overflow(sz, n);
+                __bad_copy_user();
        return n;
 }
-#undef __copy_from_user_overflow
-#undef __copy_to_user_overflow
 /*
 * We rely on the nested NMI work to allow atomic faults from the NMI path; the
 * nested NMI paths are careful to preserve CR2.
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index f5c69d8974e1..b81fe2d63e15 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -669,6 +669,17 @@ static void init_amd_gh(struct cpuinfo_x86 *c)
                set_cpu_bug(c, X86_BUG_AMD_TLB_MMATCH);
 }
+#define MSR_AMD64_DE_CFG        0xC0011029
+static void init_amd_ln(struct cpuinfo_x86 *c)
+{
+        /*
+         * Apply erratum 665 fix unconditionally so machines without a BIOS
+         * fix work.
+         */
+        msr_set_bit(MSR_AMD64_DE_CFG, 31);
+}
 static void init_amd_bd(struct cpuinfo_x86 *c)
 {
        u64 value;
@@ -726,6 +737,7 @@ static void init_amd(struct cpuinfo_x86 *c)
        case 6:    init_amd_k7(c); break;
        case 0xf:  init_amd_k8(c); break;
        case 0x10: init_amd_gh(c); break;
+        case 0x12: init_amd_ln(c); break;
        case 0x15: init_amd_bd(c); break;
        }
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index ad5bc9578a73..1acfd76e3e26 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -56,12 +56,12 @@ asm (".pushsection .entry.text, \"ax\"\n"
     ".popsection");
 /* identity function, which can be inlined */
-u32 _paravirt_ident_32(u32 x)
+u32 notrace _paravirt_ident_32(u32 x)
 {
        return x;
 }
-u64 _paravirt_ident_64(u64 x)
+u64 notrace _paravirt_ident_64(u64 x)
 {
        return x;
 }
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
index cf8037a87b2d..77207b41940c 100644
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -733,13 +733,14 @@ static void cryptd_aead_crypt(struct aead_request *req,
        rctx = aead_request_ctx(req);
        compl = rctx->complete;
+        tfm = crypto_aead_reqtfm(req);
        if (unlikely(err == -EINPROGRESS))
                goto out;
        aead_request_set_tfm(req, child);
        err = crypt( req );
 out:
-        tfm = crypto_aead_reqtfm(req);
        ctx = crypto_aead_ctx(tfm);
        refcnt = atomic_read(&ctx->refcnt);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index ad9fc84a8601..e878fc799af7 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2054,7 +2054,7 @@ int __init acpi_scan_init(void)
 static struct acpi_probe_entry *ape;
 static int acpi_probe_count;
-static DEFINE_SPINLOCK(acpi_probe_lock);
+static DEFINE_MUTEX(acpi_probe_mutex);
 static int __init acpi_match_madt(struct acpi_subtable_header *header,
                                  const unsigned long end)
@@ -2073,7 +2073,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
        if (acpi_disabled)
                return 0;
-        spin_lock(&acpi_probe_lock);
+        mutex_lock(&acpi_probe_mutex);
        for (ape = ap_head; nr; ape++, nr--) {
                if (ACPI_COMPARE_NAME(ACPI_SIG_MADT, ape->id)) {
                        acpi_probe_count = 0;
@@ -2086,7 +2086,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
                                count++;
                }
        }
-        spin_unlock(&acpi_probe_lock);
+        mutex_unlock(&acpi_probe_mutex);
        return count;
 }
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 7461a587b39b..dcf2c724fd06 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2524,7 +2524,7 @@ static int ahci_host_activate_multi_irqs(struct ata_host *host,
                /* Do not receive interrupts sent by dummy ports */
                if (!pp) {
-                        disable_irq(irq + i);
+                        disable_irq(irq);
                        continue;
                }
diff --git a/drivers/ata/pata_ninja32.c b/drivers/ata/pata_ninja32.c
index 633aa2934a18..44f97ad3c88d 100644
--- a/drivers/ata/pata_ninja32.c
+++ b/drivers/ata/pata_ninja32.c
@@ -144,7 +144,7 @@ static int ninja32_init_one(struct pci_dev *dev, const struct pci_device_id *id)
        ap->ioaddr.altstatus_addr = base + 0x1E;
        ap->ioaddr.bmdma_addr = base;
        ata_sff_std_ports(&ap->ioaddr);
-        ap->pflags = ATA_PFLAG_PIO32 | ATA_PFLAG_PIO32CHANGE;
+        ap->pflags |= ATA_PFLAG_PIO32 | ATA_PFLAG_PIO32CHANGE;
        ninja32_program(base);
        /* FIXME: Should we disable them at remove ? */
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index e097d355cc04..17995fadebd7 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -301,7 +301,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
        int (*callback)(struct device *);
        int retval;
-        trace_rpm_idle(dev, rpmflags);
+        trace_rpm_idle_rcuidle(dev, rpmflags);
        retval = rpm_check_suspend_allowed(dev);
        if (retval < 0)
                ;       /* Conditions are wrong. */
@@ -337,7 +337,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
                        dev->power.request_pending = true;
                        queue_work(pm_wq, &dev->power.work);
                }
-                trace_rpm_return_int(dev, _THIS_IP_, 0);
+                trace_rpm_return_int_rcuidle(dev, _THIS_IP_, 0);
                return 0;
        }
@@ -352,7 +352,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
        wake_up_all(&dev->power.wait_queue);
 out:
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
        return retval ? retval : rpm_suspend(dev, rpmflags | RPM_AUTO);
 }
@@ -601,7 +601,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
        struct device *parent = NULL;
        int retval = 0;
-        trace_rpm_resume(dev, rpmflags);
+        trace_rpm_resume_rcuidle(dev, rpmflags);
 repeat:
        if (dev->power.runtime_error)
@@ -764,7 +764,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
                spin_lock_irq(&dev->power.lock);
        }
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
        return retval;
 }
diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index 56ad5a5936a9..8c0770bf8881 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -244,7 +244,7 @@ config HW_RANDOM_TX4939
 config HW_RANDOM_MXC_RNGA
        tristate "Freescale i.MX RNGA Random Number Generator"
-        depends on ARCH_HAS_RNGA
+        depends on SOC_IMX31
        default HW_RANDOM
        ---help---
          This driver provides kernel-side support for the Random Number
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 08c7e23ed535..0c75c3f1689f 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -957,7 +957,7 @@ int tpm2_auto_startup(struct tpm_chip *chip)
                goto out;
        rc = tpm2_do_selftest(chip);
-        if (rc != TPM2_RC_INITIALIZE) {
+        if (rc != 0 && rc != TPM2_RC_INITIALIZE) {
                dev_err(&chip->dev, "TPM self test failed\n");
                goto out;
        }
@@ -974,7 +974,6 @@ int tpm2_auto_startup(struct tpm_chip *chip)
                }
        }
-        return rc;
 out:
        if (rc > 0)
                rc = -ENODEV;
diff --git a/drivers/clk/renesas/r8a7795-cpg-mssr.c b/drivers/clk/renesas/r8a7795-cpg-mssr.c
index d359c92e13a6..e38bf60c0ff4 100644
--- a/drivers/clk/renesas/r8a7795-cpg-mssr.c
+++ b/drivers/clk/renesas/r8a7795-cpg-mssr.c
@@ -69,6 +69,7 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
        DEF_FIXED(".s1",        CLK_S1,            CLK_PLL1_DIV2,  3, 1),
        DEF_FIXED(".s2",        CLK_S2,            CLK_PLL1_DIV2,  4, 1),
        DEF_FIXED(".s3",        CLK_S3,            CLK_PLL1_DIV2,  6, 1),
+        DEF_FIXED(".sdsrc",     CLK_SDSRC,         CLK_PLL1_DIV2,  2, 1),
        /* Core Clock Outputs */
        DEF_FIXED("ztr",        R8A7795_CLK_ZTR,   CLK_PLL1_DIV2,  6, 1),
@@ -87,10 +88,10 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
        DEF_FIXED("s3d2",       R8A7795_CLK_S3D2,  CLK_S3,         2, 1),
        DEF_FIXED("s3d4",       R8A7795_CLK_S3D4,  CLK_S3,         4, 1),
-        DEF_GEN3_SD("sd0",      R8A7795_CLK_SD0,   CLK_PLL1_DIV2, 0x0074),
+        DEF_GEN3_SD("sd0",      R8A7795_CLK_SD0,   CLK_SDSRC,     0x0074),
-        DEF_GEN3_SD("sd1",      R8A7795_CLK_SD1,   CLK_PLL1_DIV2, 0x0078),
+        DEF_GEN3_SD("sd1",      R8A7795_CLK_SD1,   CLK_SDSRC,     0x0078),
-        DEF_GEN3_SD("sd2",      R8A7795_CLK_SD2,   CLK_PLL1_DIV2, 0x0268),
+        DEF_GEN3_SD("sd2",      R8A7795_CLK_SD2,   CLK_SDSRC,     0x0268),
-        DEF_GEN3_SD("sd3",      R8A7795_CLK_SD3,   CLK_PLL1_DIV2, 0x026c),
+        DEF_GEN3_SD("sd3",      R8A7795_CLK_SD3,   CLK_SDSRC,     0x026c),
        DEF_FIXED("cl",         R8A7795_CLK_CL,    CLK_PLL1_DIV2, 48, 1),
        DEF_FIXED("cp",         R8A7795_CLK_CP,    CLK_EXTAL,      2, 1),
diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c
index c109d80e7a8a..cdfabeb9a034 100644
--- a/drivers/clk/rockchip/clk-rk3399.c
+++ b/drivers/clk/rockchip/clk-rk3399.c
@@ -833,9 +833,9 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
        /* perihp */
        GATE(0, "cpll_aclk_perihp_src", "cpll", CLK_IGNORE_UNUSED,
-                        RK3399_CLKGATE_CON(5), 0, GFLAGS),
-        GATE(0, "gpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
                        RK3399_CLKGATE_CON(5), 1, GFLAGS),
+        GATE(0, "gpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
+                        RK3399_CLKGATE_CON(5), 0, GFLAGS),
        COMPOSITE(ACLK_PERIHP, "aclk_perihp", mux_aclk_perihp_p, CLK_IGNORE_UNUSED,
                        RK3399_CLKSEL_CON(14), 7, 1, MFLAGS, 0, 5, DFLAGS,
                        RK3399_CLKGATE_CON(5), 2, GFLAGS),
@@ -923,9 +923,9 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
                        RK3399_CLKGATE_CON(6), 14, GFLAGS),
        GATE(0, "cpll_aclk_emmc_src", "cpll", CLK_IGNORE_UNUSED,
-                        RK3399_CLKGATE_CON(6), 12, GFLAGS),
-        GATE(0, "gpll_aclk_emmc_src", "gpll", CLK_IGNORE_UNUSED,
                        RK3399_CLKGATE_CON(6), 13, GFLAGS),
+        GATE(0, "gpll_aclk_emmc_src", "gpll", CLK_IGNORE_UNUSED,
+                        RK3399_CLKGATE_CON(6), 12, GFLAGS),
        COMPOSITE_NOGATE(ACLK_EMMC, "aclk_emmc", mux_aclk_emmc_p, CLK_IGNORE_UNUSED,
                        RK3399_CLKSEL_CON(21), 7, 1, MFLAGS, 0, 5, DFLAGS),
        GATE(ACLK_EMMC_CORE, "aclk_emmccore", "aclk_emmc", CLK_IGNORE_UNUSED,
@@ -1071,7 +1071,7 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
        /* vio */
        COMPOSITE(ACLK_VIO, "aclk_vio", mux_pll_src_cpll_gpll_ppll_p, CLK_IGNORE_UNUSED,
                        RK3399_CLKSEL_CON(42), 6, 2, MFLAGS, 0, 5, DFLAGS,
-                        RK3399_CLKGATE_CON(11), 10, GFLAGS),
+                        RK3399_CLKGATE_CON(11), 0, GFLAGS),
        COMPOSITE_NOMUX(PCLK_VIO, "pclk_vio", "aclk_vio", 0,
                        RK3399_CLKSEL_CON(43), 0, 5, DFLAGS,
                        RK3399_CLKGATE_CON(11), 1, GFLAGS),
@@ -1484,6 +1484,7 @@ static const char *const rk3399_cru_critical_clocks[] __initconst = {
        "hclk_perilp1",
        "hclk_perilp1_noc",
        "aclk_dmac0_perilp",
+        "aclk_emmc_noc",
        "gpll_hclk_perilp1_src",
        "gpll_aclk_perilp0_src",
        "gpll_aclk_perihp_src",
diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c
index fc17b5295e16..51d4bac97ab3 100644
--- a/drivers/clk/sunxi-ng/ccu_common.c
+++ b/drivers/clk/sunxi-ng/ccu_common.c
@@ -31,7 +31,7 @@ void ccu_helper_wait_for_lock(struct ccu_common *common, u32 lock)
                return;
        WARN_ON(readl_relaxed_poll_timeout(common->base + common->reg, reg,
-                                           !(reg & lock), 100, 70000));
+                                           reg & lock, 100, 70000));
 }
 int sunxi_ccu_probe(struct device_node *node, void __iomem *reg,
diff --git a/drivers/clk/tegra/clk-tegra114.c b/drivers/clk/tegra/clk-tegra114.c
index 64da7b79a6e4..933b5dd698b8 100644
--- a/drivers/clk/tegra/clk-tegra114.c
+++ b/drivers/clk/tegra/clk-tegra114.c
@@ -428,7 +428,7 @@ static struct tegra_clk_pll_params pll_d_params = {
        .div_nmp = &pllp_nmp,
        .freq_table = pll_d_freq_table,
        .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_SET_LFCON |
-                 TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+                 TEGRA_PLL_HAS_LOCK_ENABLE,
 };
 static struct tegra_clk_pll_params pll_d2_params = {
@@ -446,7 +446,7 @@ static struct tegra_clk_pll_params pll_d2_params = {
        .div_nmp = &pllp_nmp,
        .freq_table = pll_d_freq_table,
        .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_SET_LFCON |
-                 TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+                 TEGRA_PLL_HAS_LOCK_ENABLE,
 };
 static const struct pdiv_map pllu_p[] = {
diff --git a/drivers/clocksource/timer-atmel-pit.c b/drivers/clocksource/timer-atmel-pit.c
index 3494bc5a21d5..7f0f5b26d8c5 100644
--- a/drivers/clocksource/timer-atmel-pit.c
+++ b/drivers/clocksource/timer-atmel-pit.c
@@ -240,6 +240,7 @@ static int __init at91sam926x_pit_common_init(struct pit_data *data)
 static int __init at91sam926x_pit_dt_init(struct device_node *node)
 {
        struct pit_data *data;
+        int ret;
        data = kzalloc(sizeof(*data), GFP_KERNEL);
        if (!data)
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index 0bb44d5b5df4..2ee40fd360ca 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -74,6 +74,8 @@ static const struct of_device_id machines[] __initconst = {
        { .compatible = "ti,omap5", },
        { .compatible = "xlnx,zynq-7000", },
+        { }
 };
 static int __init cpufreq_dt_platdev_init(void)
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 6dc597126b79..b3044219772c 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -556,7 +556,10 @@ skip_enc:
        /* Read and write assoclen bytes */
        append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
-        append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
+        if (alg->caam.geniv)
+                append_math_add_imm_u32(desc, VARSEQOUTLEN, REG3, IMM, ivsize);
+        else
+                append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
        /* Skip assoc data */
        append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
@@ -565,6 +568,14 @@ skip_enc:
        append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS2 | FIFOLD_TYPE_MSG |
                             KEY_VLF);
+        if (alg->caam.geniv) {
+                append_seq_load(desc, ivsize, LDST_CLASS_1_CCB |
+                                LDST_SRCDST_BYTE_CONTEXT |
+                                (ctx1_iv_off << LDST_OFFSET_SHIFT));
+                append_move(desc, MOVE_SRC_CLASS1CTX | MOVE_DEST_CLASS2INFIFO |
+                            (ctx1_iv_off << MOVE_OFFSET_SHIFT) | ivsize);
+        }
        /* Load Counter into CONTEXT1 reg */
        if (is_rfc3686)
                append_load_imm_u32(desc, be32_to_cpu(1), LDST_IMM |
@@ -2150,7 +2161,7 @@ static void init_authenc_job(struct aead_request *req,
        init_aead_job(req, edesc, all_contig, encrypt);
-        if (ivsize && (is_rfc3686 || !(alg->caam.geniv && encrypt)))
+        if (ivsize && ((is_rfc3686 && encrypt) || !alg->caam.geniv))
                append_load_as_imm(desc, req->iv, ivsize,
                                   LDST_CLASS_1_CCB |
                                   LDST_SRCDST_BYTE_CONTEXT |
@@ -2537,20 +2548,6 @@ static int aead_decrypt(struct aead_request *req)
        return ret;
 }
-static int aead_givdecrypt(struct aead_request *req)
-{
-        struct crypto_aead *aead = crypto_aead_reqtfm(req);
-        unsigned int ivsize = crypto_aead_ivsize(aead);
-        if (req->cryptlen < ivsize)
-                return -EINVAL;
-        req->cryptlen -= ivsize;
-        req->assoclen += ivsize;
-        return aead_decrypt(req);
-}
 /*
 * allocate and map the ablkcipher extended descriptor for ablkcipher
 */
@@ -3210,7 +3207,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = AES_BLOCK_SIZE,
                        .maxauthsize = MD5_DIGEST_SIZE,
                },
@@ -3256,7 +3253,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = AES_BLOCK_SIZE,
                        .maxauthsize = SHA1_DIGEST_SIZE,
                },
@@ -3302,7 +3299,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = AES_BLOCK_SIZE,
                        .maxauthsize = SHA224_DIGEST_SIZE,
                },
@@ -3348,7 +3345,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = AES_BLOCK_SIZE,
                        .maxauthsize = SHA256_DIGEST_SIZE,
                },
@@ -3394,7 +3391,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = AES_BLOCK_SIZE,
                        .maxauthsize = SHA384_DIGEST_SIZE,
                },
@@ -3440,7 +3437,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = AES_BLOCK_SIZE,
                        .maxauthsize = SHA512_DIGEST_SIZE,
                },
@@ -3486,7 +3483,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES3_EDE_BLOCK_SIZE,
                        .maxauthsize = MD5_DIGEST_SIZE,
                },
@@ -3534,7 +3531,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES3_EDE_BLOCK_SIZE,
                        .maxauthsize = SHA1_DIGEST_SIZE,
                },
@@ -3582,7 +3579,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES3_EDE_BLOCK_SIZE,
                        .maxauthsize = SHA224_DIGEST_SIZE,
                },
@@ -3630,7 +3627,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES3_EDE_BLOCK_SIZE,
                        .maxauthsize = SHA256_DIGEST_SIZE,
                },
@@ -3678,7 +3675,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES3_EDE_BLOCK_SIZE,
                        .maxauthsize = SHA384_DIGEST_SIZE,
                },
@@ -3726,7 +3723,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES3_EDE_BLOCK_SIZE,
                        .maxauthsize = SHA512_DIGEST_SIZE,
                },
@@ -3772,7 +3769,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES_BLOCK_SIZE,
                        .maxauthsize = MD5_DIGEST_SIZE,
                },
@@ -3818,7 +3815,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES_BLOCK_SIZE,
                        .maxauthsize = SHA1_DIGEST_SIZE,
                },
@@ -3864,7 +3861,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES_BLOCK_SIZE,
                        .maxauthsize = SHA224_DIGEST_SIZE,
                },
@@ -3910,7 +3907,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES_BLOCK_SIZE,
                        .maxauthsize = SHA256_DIGEST_SIZE,
                },
@@ -3956,7 +3953,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES_BLOCK_SIZE,
                        .maxauthsize = SHA384_DIGEST_SIZE,
                },
@@ -4002,7 +3999,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = DES_BLOCK_SIZE,
                        .maxauthsize = SHA512_DIGEST_SIZE,
                },
@@ -4051,7 +4048,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = CTR_RFC3686_IV_SIZE,
                        .maxauthsize = MD5_DIGEST_SIZE,
                },
@@ -4102,7 +4099,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = CTR_RFC3686_IV_SIZE,
                        .maxauthsize = SHA1_DIGEST_SIZE,
                },
@@ -4153,7 +4150,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = CTR_RFC3686_IV_SIZE,
                        .maxauthsize = SHA224_DIGEST_SIZE,
                },
@@ -4204,7 +4201,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = CTR_RFC3686_IV_SIZE,
                        .maxauthsize = SHA256_DIGEST_SIZE,
                },
@@ -4255,7 +4252,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = CTR_RFC3686_IV_SIZE,
                        .maxauthsize = SHA384_DIGEST_SIZE,
                },
@@ -4306,7 +4303,7 @@ static struct caam_aead_alg driver_aeads[] = {
                        .setkey = aead_setkey,
                        .setauthsize = aead_setauthsize,
                        .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                        .ivsize = CTR_RFC3686_IV_SIZE,
                        .maxauthsize = SHA512_DIGEST_SIZE,
                },
diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
index 769148dbaeb3..20f35df8a01f 100644
--- a/drivers/crypto/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_algs.c
@@ -1260,8 +1260,8 @@ static struct crypto_alg qat_algs[] = { {
                        .setkey = qat_alg_ablkcipher_xts_setkey,
                        .decrypt = qat_alg_ablkcipher_decrypt,
                        .encrypt = qat_alg_ablkcipher_encrypt,
-                        .min_keysize = AES_MIN_KEY_SIZE,
+                        .min_keysize = 2 * AES_MIN_KEY_SIZE,
-                        .max_keysize = AES_MAX_KEY_SIZE,
+                        .max_keysize = 2 * AES_MAX_KEY_SIZE,
                        .ivsize = AES_BLOCK_SIZE,
                },
        },
diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c
index cfb25413917c..24353ec336c5 100644
--- a/drivers/crypto/vmx/aes_xts.c
+++ b/drivers/crypto/vmx/aes_xts.c
@@ -129,8 +129,8 @@ static int p8_aes_xts_crypt(struct blkcipher_desc *desc,
                blkcipher_walk_init(&walk, dst, src, nbytes);
-                iv = (u8 *)walk.iv;
                ret = blkcipher_walk_virt(desc, &walk);
+                iv = walk.iv;
                memset(tweak, 0, AES_BLOCK_SIZE);
                aes_p8_encrypt(iv, tweak, &ctx->tweak_key);
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index e434ffe7bc5c..832cbd647145 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -2067,7 +2067,7 @@ err_dma_unregister:
 err_clk_disable:
        clk_disable_unprepare(atxdmac->clk);
 err_free_irq:
-        free_irq(atxdmac->irq, atxdmac->dma.dev);
+        free_irq(atxdmac->irq, atxdmac);
        return ret;
 }
@@ -2081,7 +2081,7 @@ static int at_xdmac_remove(struct platform_device *pdev)
        dma_async_device_unregister(&atxdmac->dma);
        clk_disable_unprepare(atxdmac->clk);
-        free_irq(atxdmac->irq, atxdmac->dma.dev);
+        free_irq(atxdmac->irq, atxdmac);
        for (i = 0; i < atxdmac->dma.chancnt; i++) {
                struct at_xdmac_chan *atchan = &atxdmac->chan[i];
diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
index aad167eaaee8..de2a2a2b1d75 100644
--- a/drivers/dma/fsl_raid.c
+++ b/drivers/dma/fsl_raid.c
@@ -836,6 +836,7 @@ static int fsl_re_probe(struct platform_device *ofdev)
                rc = of_property_read_u32(np, "reg", &off);
                if (rc) {
                        dev_err(dev, "Reg property not found in JQ node\n");
+                        of_node_put(np);
                        return -ENODEV;
                }
                /* Find out the Job Rings present under each JQ */
diff --git a/drivers/dma/img-mdc-dma.c b/drivers/dma/img-mdc-dma.c
index a4c53be482cf..624f1e1e9c55 100644
--- a/drivers/dma/img-mdc-dma.c
+++ b/drivers/dma/img-mdc-dma.c
@@ -861,7 +861,6 @@ static int mdc_dma_probe(struct platform_device *pdev)
 {
        struct mdc_dma *mdma;
        struct resource *res;
-        const struct of_device_id *match;
        unsigned int i;
        u32 val;
        int ret;
@@ -871,8 +870,7 @@ static int mdc_dma_probe(struct platform_device *pdev)
                return -ENOMEM;
        platform_set_drvdata(pdev, mdma);
-        match = of_match_device(mdc_dma_of_match, &pdev->dev);
+        mdma->soc = of_device_get_match_data(&pdev->dev);
-        mdma->soc = match->data;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        mdma->regs = devm_ioremap_resource(&pdev->dev, res);
diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c
index dc7850a422b8..3f56f9ca4482 100644
--- a/drivers/dma/pxa_dma.c
+++ b/drivers/dma/pxa_dma.c
@@ -638,7 +638,7 @@ static bool pxad_try_hotchain(struct virt_dma_chan *vc,
                vd_last_issued = list_entry(vc->desc_issued.prev,
                                            struct virt_dma_desc, node);
                pxad_desc_chain(vd_last_issued, vd);
-                if (is_chan_running(chan) || is_desc_completed(vd_last_issued))
+                if (is_chan_running(chan) || is_desc_completed(vd))
                        return true;
        }
@@ -671,6 +671,7 @@ static irqreturn_t pxad_chan_handler(int irq, void *dev_id)
        struct virt_dma_desc *vd, *tmp;
        unsigned int dcsr;
        unsigned long flags;
+        bool vd_completed;
        dma_cookie_t last_started = 0;
        BUG_ON(!chan);
@@ -681,15 +682,17 @@ static irqreturn_t pxad_chan_handler(int irq, void *dev_id)
        spin_lock_irqsave(&chan->vc.lock, flags);
        list_for_each_entry_safe(vd, tmp, &chan->vc.desc_issued, node) {
+                vd_completed = is_desc_completed(vd);
                dev_dbg(&chan->vc.chan.dev->device,
-                        "%s(): checking txd %p[%x]: completed=%d\n",
+                        "%s(): checking txd %p[%x]: completed=%d dcsr=0x%x\n",
-                        __func__, vd, vd->tx.cookie, is_desc_completed(vd));
+                        __func__, vd, vd->tx.cookie, vd_completed,
+                        dcsr);
                last_started = vd->tx.cookie;
                if (to_pxad_sw_desc(vd)->cyclic) {
                        vchan_cyclic_callback(vd);
                        break;
                }
-                if (is_desc_completed(vd)) {
+                if (vd_completed) {
                        list_del(&vd->node);
                        vchan_cookie_complete(vd);
                } else {
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index 749f1bd5d65d..06ecdc38cee0 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -600,27 +600,30 @@ static irqreturn_t usb_dmac_isr_channel(int irq, void *dev)
 {
        struct usb_dmac_chan *chan = dev;
        irqreturn_t ret = IRQ_NONE;
-        u32 mask = USB_DMACHCR_TE;
+        u32 mask = 0;
-        u32 check_bits = USB_DMACHCR_TE | USB_DMACHCR_SP;
        u32 chcr;
+        bool xfer_end = false;
        spin_lock(&chan->vc.lock);
        chcr = usb_dmac_chan_read(chan, USB_DMACHCR);
-        if (chcr & check_bits)
+        if (chcr & (USB_DMACHCR_TE | USB_DMACHCR_SP)) {
-                mask |= USB_DMACHCR_DE | check_bits;
+                mask |= USB_DMACHCR_DE | USB_DMACHCR_TE | USB_DMACHCR_SP;
+                if (chcr & USB_DMACHCR_DE)
+                        xfer_end = true;
+                ret |= IRQ_HANDLED;
+        }
        if (chcr & USB_DMACHCR_NULL) {
                /* An interruption of TE will happen after we set FTE */
                mask |= USB_DMACHCR_NULL;
                chcr |= USB_DMACHCR_FTE;
                ret |= IRQ_HANDLED;
        }
-        usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
+        if (mask)
+                usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
-        if (chcr & check_bits) {
+        if (xfer_end)
                usb_dmac_isr_transfer_end(chan);
-                ret |= IRQ_HANDLED;
-        }
        spin_unlock(&chan->vc.lock);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index a31d7ef3032c..ec1282af2479 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -280,7 +280,7 @@ void amdgpu_ib_pool_fini(struct amdgpu_device *adev)
 int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
 {
        unsigned i;
-        int r;
+        int r, ret = 0;
        for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
                struct amdgpu_ring *ring = adev->rings[i];
@@ -301,10 +301,11 @@ int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
                        } else {
                                /* still not good, but we can live with it */
                                DRM_ERROR("amdgpu: failed testing IB on ring %d (%d).\n", i, r);
+                                ret = r;
                        }
                }
        }
-        return 0;
+        return ret;
 }
 /*
diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
index ee6466912497..77fdd9911c3c 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
@@ -52,6 +52,7 @@ static void cik_sdma_set_ring_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_irq_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_buffer_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_vm_pte_funcs(struct amdgpu_device *adev);
+static int cik_sdma_soft_reset(void *handle);
 MODULE_FIRMWARE("radeon/bonaire_sdma.bin");
 MODULE_FIRMWARE("radeon/bonaire_sdma1.bin");
@@ -1037,6 +1038,8 @@ static int cik_sdma_resume(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        cik_sdma_soft_reset(handle);
        return cik_sdma_hw_init(adev);
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index d869d058ef24..425413fcaf02 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -2755,8 +2755,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
        u64 wb_gpu_addr;
        u32 *buf;
        struct bonaire_mqd *mqd;
+        struct amdgpu_ring *ring;
-        gfx_v7_0_cp_compute_enable(adev, true);
        /* fix up chicken bits */
        tmp = RREG32(mmCP_CPF_DEBUG);
@@ -2791,7 +2790,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
        /* init the queues.  Just two for now. */
        for (i = 0; i < adev->gfx.num_compute_rings; i++) {
-                struct amdgpu_ring *ring = &adev->gfx.compute_ring[i];
+                ring = &adev->gfx.compute_ring[i];
                if (ring->mqd_obj == NULL) {
                        r = amdgpu_bo_create(adev,
@@ -2970,6 +2969,13 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
                amdgpu_bo_unreserve(ring->mqd_obj);
                ring->ready = true;
+        }
+        gfx_v7_0_cp_compute_enable(adev, true);
+        for (i = 0; i < adev->gfx.num_compute_rings; i++) {
+                ring = &adev->gfx.compute_ring[i];
                r = amdgpu_ring_test_ring(ring);
                if (r)
                        ring->ready = false;
diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
index 9f7dafce3a4c..7bf90e9e6139 100644
--- a/drivers/gpu/drm/imx/imx-drm-core.c
+++ b/drivers/gpu/drm/imx/imx-drm-core.c
@@ -171,10 +171,34 @@ static void imx_drm_output_poll_changed(struct drm_device *drm)
        drm_fbdev_cma_hotplug_event(imxdrm->fbhelper);
 }
+static int imx_drm_atomic_check(struct drm_device *dev,
+                                struct drm_atomic_state *state)
+{
+        int ret;
+        ret = drm_atomic_helper_check_modeset(dev, state);
+        if (ret)
+                return ret;
+        ret = drm_atomic_helper_check_planes(dev, state);
+        if (ret)
+                return ret;
+        /*
+         * Check modeset again in case crtc_state->mode_changed is
+         * updated in plane's ->atomic_check callback.
+         */
+        ret = drm_atomic_helper_check_modeset(dev, state);
+        if (ret)
+                return ret;
+        return ret;
+}
 static const struct drm_mode_config_funcs imx_drm_mode_config_funcs = {
        .fb_create = drm_fb_cma_create,
        .output_poll_changed = imx_drm_output_poll_changed,
-        .atomic_check = drm_atomic_helper_check,
+        .atomic_check = imx_drm_atomic_check,
        .atomic_commit = drm_atomic_helper_commit,
 };
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 08e188bc10fc..462056e4b9e4 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -76,6 +76,8 @@ static void ipu_crtc_disable(struct drm_crtc *crtc)
                crtc->state->event = NULL;
        }
        spin_unlock_irq(&crtc->dev->event_lock);
+        drm_crtc_vblank_off(crtc);
 }
 static void imx_drm_crtc_reset(struct drm_crtc *crtc)
@@ -175,6 +177,8 @@ static int ipu_crtc_atomic_check(struct drm_crtc *crtc,
 static void ipu_crtc_atomic_begin(struct drm_crtc *crtc,
                                  struct drm_crtc_state *old_crtc_state)
 {
+        drm_crtc_vblank_on(crtc);
        spin_lock_irq(&crtc->dev->event_lock);
        if (crtc->state->event) {
                WARN_ON(drm_crtc_vblank_get(crtc));
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index 4ad67d015ec7..29423e757d36 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -319,13 +319,14 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                return -EINVAL;
        /*
-         * since we cannot touch active IDMAC channels, we do not support
+         * We support resizing active plane or changing its format by
-         * resizing the enabled plane or changing its format
+         * forcing CRTC mode change and disabling-enabling plane in plane's
+         * ->atomic_update callback.
         */
        if (old_fb && (state->src_w != old_state->src_w ||
                              state->src_h != old_state->src_h ||
                              fb->pixel_format != old_fb->pixel_format))
-                return -EINVAL;
+                crtc_state->mode_changed = true;
        eba = drm_plane_state_to_eba(state);
@@ -336,7 +337,7 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                return -EINVAL;
        if (old_fb && fb->pitches[0] != old_fb->pitches[0])
-                return -EINVAL;
+                crtc_state->mode_changed = true;
        switch (fb->pixel_format) {
        case DRM_FORMAT_YUV420:
@@ -372,7 +373,7 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                        return -EINVAL;
                if (old_fb && old_fb->pitches[1] != fb->pitches[1])
-                        return -EINVAL;
+                        crtc_state->mode_changed = true;
        }
        return 0;
@@ -392,8 +393,14 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
        enum ipu_color_space ics;
        if (old_state->fb) {
-                ipu_plane_atomic_set_base(ipu_plane, old_state);
+                struct drm_crtc_state *crtc_state = state->crtc->state;
-                return;
+                if (!crtc_state->mode_changed) {
+                        ipu_plane_atomic_set_base(ipu_plane, old_state);
+                        return;
+                }
+                ipu_disable_plane(plane);
        }
        switch (ipu_plane->dp_flow) {
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index b4bc7f1ef717..d0da52f2a806 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -157,6 +157,12 @@ struct msm_drm_private {
        struct shrinker shrinker;
        struct msm_vblank_ctrl vblank_ctrl;
+        /* task holding struct_mutex.. currently only used in submit path
+         * to detect and reject faults from copy_from_user() for submit
+         * ioctl.
+         */
+        struct task_struct *struct_mutex_task;
 };
 struct msm_format {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 6cd4af443139..85f3047e05ae 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -196,11 +196,20 @@ int msm_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
        struct drm_gem_object *obj = vma->vm_private_data;
        struct drm_device *dev = obj->dev;
+        struct msm_drm_private *priv = dev->dev_private;
        struct page **pages;
        unsigned long pfn;
        pgoff_t pgoff;
        int ret;
+        /* This should only happen if userspace tries to pass a mmap'd
+         * but unfaulted gem bo vaddr into submit ioctl, triggering
+         * a page fault while struct_mutex is already held.  This is
+         * not a valid use-case so just bail.
+         */
+        if (priv->struct_mutex_task == current)
+                return VM_FAULT_SIGBUS;
        /* Make sure we don't parallel update on a fault, nor move or remove
         * something from beneath our feet
         */
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 9766f9ae4b7d..880d6a9af7c8 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -64,6 +64,14 @@ void msm_gem_submit_free(struct msm_gem_submit *submit)
        kfree(submit);
 }
+static inline unsigned long __must_check
+copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
+{
+        if (access_ok(VERIFY_READ, from, n))
+                return __copy_from_user_inatomic(to, from, n);
+        return -EFAULT;
+}
 static int submit_lookup_objects(struct msm_gem_submit *submit,
                struct drm_msm_gem_submit *args, struct drm_file *file)
 {
@@ -71,6 +79,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
        int ret = 0;
        spin_lock(&file->table_lock);
+        pagefault_disable();
        for (i = 0; i < args->nr_bos; i++) {
                struct drm_msm_gem_submit_bo submit_bo;
@@ -84,10 +93,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
                 */
                submit->bos[i].flags = 0;
-                ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
+                ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));
-                if (ret) {
+                if (unlikely(ret)) {
-                        ret = -EFAULT;
+                        pagefault_enable();
-                        goto out_unlock;
+                        spin_unlock(&file->table_lock);
+                        ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
+                        if (ret)
+                                goto out;
+                        spin_lock(&file->table_lock);
+                        pagefault_disable();
                }
                if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
@@ -127,9 +141,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
        }
 out_unlock:
-        submit->nr_bos = i;
+        pagefault_enable();
        spin_unlock(&file->table_lock);
+out:
+        submit->nr_bos = i;
        return ret;
 }
@@ -377,6 +394,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
        if (ret)
                return ret;
+        priv->struct_mutex_task = current;
        submit = submit_create(dev, gpu, args->nr_bos, args->nr_cmds);
        if (!submit) {
                ret = -ENOMEM;
@@ -468,6 +487,7 @@ out:
        if (ret)
                msm_gem_submit_free(submit);
 out_unlock:
+        priv->struct_mutex_task = NULL;
        mutex_unlock(&dev->struct_mutex);
        return ret;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index f2ad17aa33f0..dc57b628e074 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -225,6 +225,17 @@ static bool nouveau_pr3_present(struct pci_dev *pdev)
        if (!parent_pdev)
                return false;
+        if (!parent_pdev->bridge_d3) {
+                /*
+                 * Parent PCI bridge is currently not power managed.
+                 * Since userspace can change these afterwards to be on
+                 * the safe side we stick with _DSM and prevent usage of
+                 * _PR3 from the bridge.
+                 */
+                pci_d3cold_disable(pdev);
+                return false;
+        }
        parent_adev = ACPI_COMPANION(&parent_pdev->dev);
        if (!parent_adev)
                return false;
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 8b42d31a7f0e..9ecef9385491 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -57,21 +57,21 @@ static int vc4_get_param_ioctl(struct drm_device *dev, void *data,
        switch (args->param) {
        case DRM_VC4_PARAM_V3D_IDENT0:
                ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                        return ret;
                args->value = V3D_READ(V3D_IDENT0);
                pm_runtime_put(&vc4->v3d->pdev->dev);
                break;
        case DRM_VC4_PARAM_V3D_IDENT1:
                ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                        return ret;
                args->value = V3D_READ(V3D_IDENT1);
                pm_runtime_put(&vc4->v3d->pdev->dev);
                break;
        case DRM_VC4_PARAM_V3D_IDENT2:
                ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                        return ret;
                args->value = V3D_READ(V3D_IDENT2);
                pm_runtime_put(&vc4->v3d->pdev->dev);
diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index 489e3de0c050..428e24919ef1 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -321,6 +321,15 @@ vc4_first_render_job(struct vc4_dev *vc4)
                                struct vc4_exec_info, head);
 }
+static inline struct vc4_exec_info *
+vc4_last_render_job(struct vc4_dev *vc4)
+{
+        if (list_empty(&vc4->render_job_list))
+                return NULL;
+        return list_last_entry(&vc4->render_job_list,
+                               struct vc4_exec_info, head);
+}
 /**
 * struct vc4_texture_sample_info - saves the offsets into the UBO for texture
 * setup parameters.
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 6155e8aca1c6..b262c5c26f10 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -534,8 +534,8 @@ vc4_cl_lookup_bos(struct drm_device *dev,
                return -EINVAL;
        }
-        exec->bo = kcalloc(exec->bo_count, sizeof(struct drm_gem_cma_object *),
+        exec->bo = drm_calloc_large(exec->bo_count,
-                           GFP_KERNEL);
+                                    sizeof(struct drm_gem_cma_object *));
        if (!exec->bo) {
                DRM_ERROR("Failed to allocate validated BO pointers\n");
                return -ENOMEM;
@@ -572,8 +572,8 @@ vc4_cl_lookup_bos(struct drm_device *dev,
        spin_unlock(&file_priv->table_lock);
 fail:
-        kfree(handles);
+        drm_free_large(handles);
-        return 0;
+        return ret;
 }
 static int
@@ -608,7 +608,7 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
         * read the contents back for validation, and I think the
         * bo->vaddr is uncached access.
         */
-        temp = kmalloc(temp_size, GFP_KERNEL);
+        temp = drm_malloc_ab(temp_size, 1);
        if (!temp) {
                DRM_ERROR("Failed to allocate storage for copying "
                          "in bin/render CLs.\n");
@@ -675,7 +675,7 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
        ret = vc4_validate_shader_recs(dev, exec);
 fail:
-        kfree(temp);
+        drm_free_large(temp);
        return ret;
 }
@@ -688,7 +688,7 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
        if (exec->bo) {
                for (i = 0; i < exec->bo_count; i++)
                        drm_gem_object_unreference_unlocked(&exec->bo[i]->base);
-                kfree(exec->bo);
+                drm_free_large(exec->bo);
        }
        while (!list_empty(&exec->unref_list)) {
@@ -942,8 +942,8 @@ vc4_gem_destroy(struct drm_device *dev)
                vc4->overflow_mem = NULL;
        }
-        vc4_bo_cache_destroy(dev);
        if (vc4->hang_state)
                vc4_free_hang_state(dev, vc4->hang_state);
+        vc4_bo_cache_destroy(dev);
 }
diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
index b0104a346a74..094bc6a475c1 100644
--- a/drivers/gpu/drm/vc4/vc4_irq.c
+++ b/drivers/gpu/drm/vc4/vc4_irq.c
@@ -83,8 +83,10 @@ vc4_overflow_mem_work(struct work_struct *work)
                spin_lock_irqsave(&vc4->job_lock, irqflags);
                current_exec = vc4_first_bin_job(vc4);
+                if (!current_exec)
+                        current_exec = vc4_last_render_job(vc4);
                if (current_exec) {
-                        vc4->overflow_mem->seqno = vc4->finished_seqno + 1;
+                        vc4->overflow_mem->seqno = current_exec->seqno;
                        list_add_tail(&vc4->overflow_mem->unref_head,
                                      &current_exec->unref_list);
                        vc4->overflow_mem = NULL;
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index d0203a115eff..4667012b46b7 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -2015,6 +2015,7 @@ static struct attribute *it87_attributes_in[] = {
        &sensor_dev_attr_in10_input.dev_attr.attr,      /* 41 */
        &sensor_dev_attr_in11_input.dev_attr.attr,      /* 41 */
        &sensor_dev_attr_in12_input.dev_attr.attr,      /* 41 */
+        NULL
 };
 static const struct attribute_group it87_group_in = {
diff --git a/drivers/iio/accel/Kconfig b/drivers/iio/accel/Kconfig
index 89d78208de3f..78f148ea9d9f 100644
--- a/drivers/iio/accel/Kconfig
+++ b/drivers/iio/accel/Kconfig
@@ -20,6 +20,8 @@ config BMA180
 config BMA220
    tristate "Bosch BMA220 3-Axis Accelerometer Driver"
        depends on SPI
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
    help
      Say yes here to add support for the Bosch BMA220 triaxial
      acceleration sensor.
@@ -234,7 +236,8 @@ config STK8312
 config STK8BA50
        tristate "Sensortek STK8BA50 3-Axis Accelerometer Driver"
        depends on I2C
-        depends on IIO_TRIGGER
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
        help
          Say yes here to get support for the Sensortek STK8BA50 3-axis
          accelerometer.
diff --git a/drivers/iio/accel/bma220_spi.c b/drivers/iio/accel/bma220_spi.c
index 1098d10df8e8..5099f295dd37 100644
--- a/drivers/iio/accel/bma220_spi.c
+++ b/drivers/iio/accel/bma220_spi.c
@@ -253,7 +253,7 @@ static int bma220_probe(struct spi_device *spi)
        if (ret < 0)
                return ret;
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                                         bma220_trigger_handler, NULL);
        if (ret < 0) {
                dev_err(&spi->dev, "iio triggered buffer setup failed\n");
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index 3a9f106787d2..da5fb67ecb34 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -160,6 +160,7 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
                if (ret < 0)
                        goto error_ret;
                *val = ret;
+                ret = IIO_VAL_INT;
                break;
        case IIO_CHAN_INFO_SCALE:
                ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 1de31bdd4ce4..767577298ee3 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -389,6 +389,7 @@ config QCOM_SPMI_VADC
 config ROCKCHIP_SARADC
        tristate "Rockchip SARADC driver"
        depends on ARCH_ROCKCHIP || (ARM && COMPILE_TEST)
+        depends on RESET_CONTROLLER
        help
          Say yes here to build support for the SARADC found in SoCs from
          Rockchip.
diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
index b6163764489c..9704090b7908 100644
--- a/drivers/iio/adc/ad799x.c
+++ b/drivers/iio/adc/ad799x.c
@@ -527,6 +527,7 @@ static struct attribute_group ad799x_event_attrs_group = {
 static const struct iio_info ad7991_info = {
        .read_raw = &ad799x_read_raw,
        .driver_module = THIS_MODULE,
+        .update_scan_mode = ad799x_update_scan_mode,
 };
 static const struct iio_info ad7993_4_7_8_noirq_info = {
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 52430ba171f3..0438c68015e8 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -381,8 +381,8 @@ static irqreturn_t at91_adc_rl_interrupt(int irq, void *private)
                st->ts_bufferedmeasure = false;
                input_report_key(st->ts_input, BTN_TOUCH, 0);
                input_sync(st->ts_input);
-        } else if (status & AT91_ADC_EOC(3)) {
+        } else if (status & AT91_ADC_EOC(3) && st->ts_input) {
-                /* Conversion finished */
+                /* Conversion finished and we've a touchscreen */
                if (st->ts_bufferedmeasure) {
                        /*
                         * Last measurement is always discarded, since it can
diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
index f9ad6c2d6821..85d701291654 100644
--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -21,6 +21,8 @@
 #include <linux/of_device.h>
 #include <linux/clk.h>
 #include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/reset.h>
 #include <linux/regulator/consumer.h>
 #include <linux/iio/iio.h>
@@ -53,6 +55,7 @@ struct rockchip_saradc {
        struct clk              *clk;
        struct completion       completion;
        struct regulator        *vref;
+        struct reset_control    *reset;
        const struct rockchip_saradc_data *data;
        u16                     last_val;
 };
@@ -190,6 +193,16 @@ static const struct of_device_id rockchip_saradc_match[] = {
 };
 MODULE_DEVICE_TABLE(of, rockchip_saradc_match);
+/**
+ * Reset SARADC Controller.
+ */
+static void rockchip_saradc_reset_controller(struct reset_control *reset)
+{
+        reset_control_assert(reset);
+        usleep_range(10, 20);
+        reset_control_deassert(reset);
+}
 static int rockchip_saradc_probe(struct platform_device *pdev)
 {
        struct rockchip_saradc *info = NULL;
@@ -218,6 +231,20 @@ static int rockchip_saradc_probe(struct platform_device *pdev)
        if (IS_ERR(info->regs))
                return PTR_ERR(info->regs);
+        /*
+         * The reset should be an optional property, as it should work
+         * with old devicetrees as well
+         */
+        info->reset = devm_reset_control_get(&pdev->dev, "saradc-apb");
+        if (IS_ERR(info->reset)) {
+                ret = PTR_ERR(info->reset);
+                if (ret != -ENOENT)
+                        return ret;
+                dev_dbg(&pdev->dev, "no reset control found\n");
+                info->reset = NULL;
+        }
        init_completion(&info->completion);
        irq = platform_get_irq(pdev, 0);
@@ -252,6 +279,9 @@ static int rockchip_saradc_probe(struct platform_device *pdev)
                return PTR_ERR(info->vref);
        }
+        if (info->reset)
+                rockchip_saradc_reset_controller(info->reset);
        /*
         * Use a default value for the converter clock.
         * This may become user-configurable in the future.
diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
index 1ef398770a1f..066abaf80201 100644
--- a/drivers/iio/adc/ti-ads1015.c
+++ b/drivers/iio/adc/ti-ads1015.c
@@ -489,7 +489,8 @@ static struct iio_info ads1115_info = {
 #ifdef CONFIG_OF
 static int ads1015_get_channels_config_of(struct i2c_client *client)
 {
-        struct ads1015_data *data = i2c_get_clientdata(client);
+        struct iio_dev *indio_dev = i2c_get_clientdata(client);
+        struct ads1015_data *data = iio_priv(indio_dev);
        struct device_node *node;
        if (!client->dev.of_node ||
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 8a368756881b..c3cfacca2541 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -32,6 +32,7 @@
 struct tiadc_device {
        struct ti_tscadc_dev *mfd_tscadc;
+        struct mutex fifo1_lock; /* to protect fifo access */
        int channels;
        u8 channel_line[8];
        u8 channel_step[8];
@@ -359,6 +360,7 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
                int *val, int *val2, long mask)
 {
        struct tiadc_device *adc_dev = iio_priv(indio_dev);
+        int ret = IIO_VAL_INT;
        int i, map_val;
        unsigned int fifo1count, read, stepid;
        bool found = false;
@@ -372,13 +374,14 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
        if (!step_en)
                return -EINVAL;
+        mutex_lock(&adc_dev->fifo1_lock);
        fifo1count = tiadc_readl(adc_dev, REG_FIFO1CNT);
        while (fifo1count--)
                tiadc_readl(adc_dev, REG_FIFO1);
        am335x_tsc_se_set_once(adc_dev->mfd_tscadc, step_en);
-        timeout = jiffies + usecs_to_jiffies
+        timeout = jiffies + msecs_to_jiffies
                                (IDLE_TIMEOUT * adc_dev->channels);
        /* Wait for Fifo threshold interrupt */
        while (1) {
@@ -388,7 +391,8 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
                if (time_after(jiffies, timeout)) {
                        am335x_tsc_se_adc_done(adc_dev->mfd_tscadc);
-                        return -EAGAIN;
+                        ret = -EAGAIN;
+                        goto err_unlock;
                }
        }
        map_val = adc_dev->channel_step[chan->scan_index];
@@ -414,8 +418,11 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
        am335x_tsc_se_adc_done(adc_dev->mfd_tscadc);
        if (found == false)
-                return -EBUSY;
+                ret =  -EBUSY;
-        return IIO_VAL_INT;
+err_unlock:
+        mutex_unlock(&adc_dev->fifo1_lock);
+        return ret;
 }
 static const struct iio_info tiadc_info = {
@@ -483,6 +490,7 @@ static int tiadc_probe(struct platform_device *pdev)
        tiadc_step_config(indio_dev);
        tiadc_writel(adc_dev, REG_FIFO1THR, FIFO1_THRESHOLD);
+        mutex_init(&adc_dev->fifo1_lock);
        err = tiadc_channel_init(indio_dev, adc_dev->channels);
        if (err < 0)
diff --git a/drivers/iio/chemical/atlas-ph-sensor.c b/drivers/iio/chemical/atlas-ph-sensor.c
index ae038a59d256..407f141a1eee 100644
--- a/drivers/iio/chemical/atlas-ph-sensor.c
+++ b/drivers/iio/chemical/atlas-ph-sensor.c
@@ -434,7 +434,7 @@ static int atlas_read_raw(struct iio_dev *indio_dev,
                        break;
                case IIO_ELECTRICALCONDUCTIVITY:
                        *val = 1; /* 0.00001 */
-                        *val = 100000;
+                        *val2 = 100000;
                        break;
                case IIO_CONCENTRATION:
                        *val = 0; /* 0.000000001 */
diff --git a/drivers/iio/dac/stx104.c b/drivers/iio/dac/stx104.c
index 792a97164cb2..bebbd00304ce 100644
--- a/drivers/iio/dac/stx104.c
+++ b/drivers/iio/dac/stx104.c
@@ -65,6 +65,16 @@ struct stx104_gpio {
        unsigned int out_state;
 };
+/**
+ * struct stx104_dev - STX104 device private data structure
+ * @indio_dev:  IIO device
+ * @chip:       instance of the gpio_chip
+ */
+struct stx104_dev {
+        struct iio_dev *indio_dev;
+        struct gpio_chip *chip;
+};
 static int stx104_read_raw(struct iio_dev *indio_dev,
        struct iio_chan_spec const *chan, int *val, int *val2, long mask)
 {
@@ -107,6 +117,7 @@ static const struct iio_chan_spec stx104_channels[STX104_NUM_CHAN] = {
 static int stx104_gpio_get_direction(struct gpio_chip *chip,
        unsigned int offset)
 {
+        /* GPIO 0-3 are input only, while the rest are output only */
        if (offset < 4)
                return 1;
@@ -169,6 +180,7 @@ static int stx104_probe(struct device *dev, unsigned int id)
        struct iio_dev *indio_dev;
        struct stx104_iio *priv;
        struct stx104_gpio *stx104gpio;
+        struct stx104_dev *stx104dev;
        int err;
        indio_dev = devm_iio_device_alloc(dev, sizeof(*priv));
@@ -179,6 +191,10 @@ static int stx104_probe(struct device *dev, unsigned int id)
        if (!stx104gpio)
                return -ENOMEM;
+        stx104dev = devm_kzalloc(dev, sizeof(*stx104dev), GFP_KERNEL);
+        if (!stx104dev)
+                return -ENOMEM;
        if (!devm_request_region(dev, base[id], STX104_EXTENT,
                dev_name(dev))) {
                dev_err(dev, "Unable to lock port addresses (0x%X-0x%X)\n",
@@ -199,12 +215,6 @@ static int stx104_probe(struct device *dev, unsigned int id)
        outw(0, base[id] + 4);
        outw(0, base[id] + 6);
-        err = devm_iio_device_register(dev, indio_dev);
-        if (err) {
-                dev_err(dev, "IIO device registering failed (%d)\n", err);
-                return err;
-        }
        stx104gpio->chip.label = dev_name(dev);
        stx104gpio->chip.parent = dev;
        stx104gpio->chip.owner = THIS_MODULE;
@@ -220,7 +230,9 @@ static int stx104_probe(struct device *dev, unsigned int id)
        spin_lock_init(&stx104gpio->lock);
-        dev_set_drvdata(dev, stx104gpio);
+        stx104dev->indio_dev = indio_dev;
+        stx104dev->chip = &stx104gpio->chip;
+        dev_set_drvdata(dev, stx104dev);
        err = gpiochip_add_data(&stx104gpio->chip, stx104gpio);
        if (err) {
@@ -228,14 +240,22 @@ static int stx104_probe(struct device *dev, unsigned int id)
                return err;
        }
+        err = iio_device_register(indio_dev);
+        if (err) {
+                dev_err(dev, "IIO device registering failed (%d)\n", err);
+                gpiochip_remove(&stx104gpio->chip);
+                return err;
+        }
        return 0;
 }
 static int stx104_remove(struct device *dev, unsigned int id)
 {
-        struct stx104_gpio *const stx104gpio = dev_get_drvdata(dev);
+        struct stx104_dev *const stx104dev = dev_get_drvdata(dev);
-        gpiochip_remove(&stx104gpio->chip);
+        iio_device_unregister(stx104dev->indio_dev);
+        gpiochip_remove(stx104dev->chip);
        return 0;
 }
diff --git a/drivers/iio/humidity/Kconfig b/drivers/iio/humidity/Kconfig
index 738a86d9e4a9..d04124345992 100644
--- a/drivers/iio/humidity/Kconfig
+++ b/drivers/iio/humidity/Kconfig
@@ -6,6 +6,8 @@ menu "Humidity sensors"
 config AM2315
    tristate "Aosong AM2315 relative humidity and temperature sensor"
    depends on I2C
+    select IIO_BUFFER
+    select IIO_TRIGGERED_BUFFER
    help
      If you say yes here you get support for the Aosong AM2315
      relative humidity and ambient temperature sensor.
diff --git a/drivers/iio/humidity/am2315.c b/drivers/iio/humidity/am2315.c
index 3e200f69e886..ff96b6d0fdae 100644
--- a/drivers/iio/humidity/am2315.c
+++ b/drivers/iio/humidity/am2315.c
@@ -244,7 +244,7 @@ static int am2315_probe(struct i2c_client *client,
        indio_dev->channels = am2315_channels;
        indio_dev->num_channels = ARRAY_SIZE(am2315_channels);
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                                         am2315_trigger_handler, NULL);
        if (ret < 0) {
                dev_err(&client->dev, "iio triggered buffer setup failed\n");
diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c
index a03832a5fc95..e0c9c70c2a4a 100644
--- a/drivers/iio/humidity/hdc100x.c
+++ b/drivers/iio/humidity/hdc100x.c
@@ -142,7 +142,7 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
        struct i2c_client *client = data->client;
        int delay = data->adc_int_us[chan->address];
        int ret;
-        int val;
+        __be16 val;
        /* start measurement */
        ret = i2c_smbus_write_byte(client, chan->address);
@@ -154,26 +154,13 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
        /* wait for integration time to pass */
        usleep_range(delay, delay + 1000);
-        /*
+        /* read measurement */
-         * i2c_smbus_read_word_data cannot() be used here due to the command
+        ret = i2c_master_recv(data->client, (char *)&val, sizeof(val));
-         * value not being understood and causes NAKs preventing any reading
-         * from being accessed.
-         */
-        ret = i2c_smbus_read_byte(client);
        if (ret < 0) {
-                dev_err(&client->dev, "cannot read high byte measurement");
+                dev_err(&client->dev, "cannot read sensor data\n");
                return ret;
        }
-        val = ret << 8;
+        return be16_to_cpu(val);
-        ret = i2c_smbus_read_byte(client);
-        if (ret < 0) {
-                dev_err(&client->dev, "cannot read low byte measurement");
-                return ret;
-        }
-        val |= ret;
-        return val;
 }
 static int hdc100x_get_heater_status(struct hdc100x_data *data)
@@ -272,8 +259,8 @@ static int hdc100x_probe(struct i2c_client *client,
        struct iio_dev *indio_dev;
        struct hdc100x_data *data;
-        if (!i2c_check_functionality(client->adapter,
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_WORD_DATA |
-                                I2C_FUNC_SMBUS_WORD_DATA | I2C_FUNC_SMBUS_BYTE))
+                                     I2C_FUNC_SMBUS_BYTE | I2C_FUNC_I2C))
                return -EOPNOTSUPP;
        indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*data));
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 90462fcf5436..49bf9c59f117 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -107,6 +107,7 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
 {
        struct iio_dev *indio_dev = filp->private_data;
        struct iio_buffer *rb = indio_dev->buffer;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        size_t datum_size;
        size_t to_wait;
        int ret;
@@ -131,19 +132,29 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
        else
                to_wait = min_t(size_t, n / datum_size, rb->watermark);
+        add_wait_queue(&rb->pollq, &wait);
        do {
-                ret = wait_event_interruptible(rb->pollq,
+                if (!indio_dev->info) {
-                      iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size));
+                        ret = -ENODEV;
-                if (ret)
+                        break;
-                        return ret;
+                }
-                if (!indio_dev->info)
+                if (!iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size)) {
-                        return -ENODEV;
+                        if (signal_pending(current)) {
+                                ret = -ERESTARTSYS;
+                                break;
+                        }
+                        wait_woken(&wait, TASK_INTERRUPTIBLE,
+                                   MAX_SCHEDULE_TIMEOUT);
+                        continue;
+                }
                ret = rb->access->read_first_n(rb, n, buf);
                if (ret == 0 && (filp->f_flags & O_NONBLOCK))
                        ret = -EAGAIN;
         } while (ret == 0);
+        remove_wait_queue(&rb->pollq, &wait);
        return ret;
 }
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index 7c566f516572..3574945183fe 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -76,7 +76,6 @@ config BH1750
 config BH1780
        tristate "ROHM BH1780 ambient light sensor"
        depends on I2C
-        depends on !SENSORS_BH1780
        help
         Say Y here to build support for the ROHM BH1780GLI ambient
         light sensor.
@@ -238,6 +237,8 @@ config MAX44000
        tristate "MAX44000 Ambient and Infrared Proximity Sensor"
        depends on I2C
        select REGMAP_I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
        help
         Say Y here if you want to build support for Maxim Integrated's
         MAX44000 ambient and infrared proximity sensor device.
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index 6943688e66df..e5a533cbd53f 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -970,7 +970,7 @@ int bmp280_common_probe(struct device *dev,
        data->vdda = devm_regulator_get(dev, "vdda");
        if (IS_ERR(data->vdda)) {
                dev_err(dev, "failed to get VDDA regulator\n");
-                ret = PTR_ERR(data->vddd);
+                ret = PTR_ERR(data->vdda);
                goto out_disable_vddd;
        }
        ret = regulator_enable(data->vdda);
@@ -1079,7 +1079,8 @@ EXPORT_SYMBOL(bmp280_common_remove);
 #ifdef CONFIG_PM
 static int bmp280_runtime_suspend(struct device *dev)
 {
-        struct bmp280_data *data = dev_get_drvdata(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
+        struct bmp280_data *data = iio_priv(indio_dev);
        int ret;
        ret = regulator_disable(data->vdda);
@@ -1090,7 +1091,8 @@ static int bmp280_runtime_suspend(struct device *dev)
 static int bmp280_runtime_resume(struct device *dev)
 {
-        struct bmp280_data *data = dev_get_drvdata(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
+        struct bmp280_data *data = iio_priv(indio_dev);
        int ret;
        ret = regulator_enable(data->vddd);
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index 2e3a70e1b245..5656deb17261 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -397,7 +397,7 @@ static int as3935_probe(struct spi_device *spi)
                return ret;
        }
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                &as3935_trigger_handler, NULL);
        if (ret) {
diff --git a/drivers/macintosh/ams/ams-i2c.c b/drivers/macintosh/ams/ams-i2c.c
index 978eda8d6678..8a3ba565106f 100644
--- a/drivers/macintosh/ams/ams-i2c.c
+++ b/drivers/macintosh/ams/ams-i2c.c
@@ -73,7 +73,6 @@ MODULE_DEVICE_TABLE(i2c, ams_id);
 static struct i2c_driver ams_i2c_driver = {
        .driver = {
                .name   = "ams",
-                .owner  = THIS_MODULE,
        },
        .probe          = ams_i2c_probe,
        .remove         = ams_i2c_remove,
diff --git a/drivers/macintosh/windfarm_pm112.c b/drivers/macintosh/windfarm_pm112.c
index 3024685e4cca..96d16fca68b2 100644
--- a/drivers/macintosh/windfarm_pm112.c
+++ b/drivers/macintosh/windfarm_pm112.c
@@ -668,7 +668,6 @@ static struct platform_driver wf_pm112_driver = {
        .remove = wf_pm112_remove,
        .driver = {
                .name = "windfarm",
-                .owner  = THIS_MODULE,
        },
 };
diff --git a/drivers/macintosh/windfarm_pm72.c b/drivers/macintosh/windfarm_pm72.c
index 2f506b9d5a52..e88cfb36a74d 100644
--- a/drivers/macintosh/windfarm_pm72.c
+++ b/drivers/macintosh/windfarm_pm72.c
@@ -789,7 +789,6 @@ static struct platform_driver wf_pm72_driver = {
        .remove = wf_pm72_remove,
        .driver = {
                .name = "windfarm",
-                .owner  = THIS_MODULE,
        },
 };
diff --git a/drivers/macintosh/windfarm_rm31.c b/drivers/macintosh/windfarm_rm31.c
index 82fc86a90c1a..bdfcb8a8bfbb 100644
--- a/drivers/macintosh/windfarm_rm31.c
+++ b/drivers/macintosh/windfarm_rm31.c
@@ -682,7 +682,6 @@ static struct platform_driver wf_rm31_driver = {
        .remove = wf_rm31_remove,
        .driver = {
                .name = "windfarm",
-                .owner  = THIS_MODULE,
        },
 };
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 6fff794e0c72..13041ee37ad6 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -2183,19 +2183,29 @@ location_show(struct mddev *mddev, char *page)
 static ssize_t
 location_store(struct mddev *mddev, const char *buf, size_t len)
 {
+        int rv;
+        rv = mddev_lock(mddev);
+        if (rv)
+                return rv;
        if (mddev->pers) {
-                if (!mddev->pers->quiesce)
+                if (!mddev->pers->quiesce) {
-                        return -EBUSY;
+                        rv = -EBUSY;
-                if (mddev->recovery || mddev->sync_thread)
+                        goto out;
-                        return -EBUSY;
+                }
+                if (mddev->recovery || mddev->sync_thread) {
+                        rv = -EBUSY;
+                        goto out;
+                }
        }
        if (mddev->bitmap || mddev->bitmap_info.file ||
            mddev->bitmap_info.offset) {
                /* bitmap already configured.  Only option is to clear it */
-                if (strncmp(buf, "none", 4) != 0)
+                if (strncmp(buf, "none", 4) != 0) {
-                        return -EBUSY;
+                        rv = -EBUSY;
+                        goto out;
+                }
                if (mddev->pers) {
                        mddev->pers->quiesce(mddev, 1);
                        bitmap_destroy(mddev);
@@ -2214,21 +2224,25 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                        /* nothing to be done */;
                else if (strncmp(buf, "file:", 5) == 0) {
                        /* Not supported yet */
-                        return -EINVAL;
+                        rv = -EINVAL;
+                        goto out;
                } else {
-                        int rv;
                        if (buf[0] == '+')
                                rv = kstrtoll(buf+1, 10, &offset);
                        else
                                rv = kstrtoll(buf, 10, &offset);
                        if (rv)
-                                return rv;
+                                goto out;
-                        if (offset == 0)
+                        if (offset == 0) {
-                                return -EINVAL;
+                                rv = -EINVAL;
+                                goto out;
+                        }
                        if (mddev->bitmap_info.external == 0 &&
                            mddev->major_version == 0 &&
-                            offset != mddev->bitmap_info.default_offset)
+                            offset != mddev->bitmap_info.default_offset) {
-                                return -EINVAL;
+                                rv = -EINVAL;
+                                goto out;
+                        }
                        mddev->bitmap_info.offset = offset;
                        if (mddev->pers) {
                                struct bitmap *bitmap;
@@ -2245,7 +2259,7 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                                mddev->pers->quiesce(mddev, 0);
                                if (rv) {
                                        bitmap_destroy(mddev);
-                                        return rv;
+                                        goto out;
                                }
                        }
                }
@@ -2257,6 +2271,11 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                set_bit(MD_CHANGE_DEVS, &mddev->flags);
                md_wakeup_thread(mddev->thread);
        }
+        rv = 0;
+out:
+        mddev_unlock(mddev);
+        if (rv)
+                return rv;
        return len;
 }
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 6571c81465e1..8625040bae92 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1879,7 +1879,7 @@ static int __init dm_bufio_init(void)
        __cache_size_refresh();
        mutex_unlock(&dm_bufio_clients_lock);
-        dm_bufio_wq = create_singlethread_workqueue("dm_bufio_cache");
+        dm_bufio_wq = alloc_workqueue("dm_bufio_cache", WQ_MEM_RECLAIM, 0);
        if (!dm_bufio_wq)
                return -ENOMEM;
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index eedba67b0e3e..874295757caa 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1453,7 +1453,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode)
        unsigned i;
        int err;
-        cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
+        cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
                           GFP_KERNEL);
        if (!cc->tfms)
                return -ENOMEM;
@@ -1924,6 +1924,13 @@ static int crypt_map(struct dm_target *ti, struct bio *bio)
                return DM_MAPIO_REMAPPED;
        }
+        /*
+         * Check if bio is too large, split as needed.
+         */
+        if (unlikely(bio->bi_iter.bi_size > (BIO_MAX_PAGES << PAGE_SHIFT)) &&
+            bio_data_dir(bio) == WRITE)
+                dm_accept_partial_bio(bio, ((BIO_MAX_PAGES << PAGE_SHIFT) >> SECTOR_SHIFT));
        io = dm_per_bio_data(bio, cc->per_bio_data_size);
        crypt_io_init(io, cc, bio, dm_target_offset(ti, bio->bi_iter.bi_sector));
        io->ctx.req = (struct skcipher_request *)(io + 1);
diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c
index 4ab68033f9d1..49e4d8d4558f 100644
--- a/drivers/md/dm-log-writes.c
+++ b/drivers/md/dm-log-writes.c
@@ -259,12 +259,12 @@ static int log_one_block(struct log_writes_c *lc,
                goto out;
        sector++;
-        bio = bio_alloc(GFP_KERNEL, block->vec_cnt);
+        atomic_inc(&lc->io_blocks);
+        bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES));
        if (!bio) {
                DMERR("Couldn't alloc log bio");
                goto error;
        }
-        atomic_inc(&lc->io_blocks);
        bio->bi_iter.bi_size = 0;
        bio->bi_iter.bi_sector = sector;
        bio->bi_bdev = lc->logdev->bdev;
@@ -282,7 +282,7 @@ static int log_one_block(struct log_writes_c *lc,
                if (ret != block->vecs[i].bv_len) {
                        atomic_inc(&lc->io_blocks);
                        submit_bio(bio);
-                        bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i);
+                        bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, BIO_MAX_PAGES));
                        if (!bio) {
                                DMERR("Couldn't alloc log bio");
                                goto error;
@@ -459,9 +459,9 @@ static int log_writes_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                goto bad;
        }
-        ret = -EINVAL;
        lc->log_kthread = kthread_run(log_writes_kthread, lc, "log-write");
-        if (!lc->log_kthread) {
+        if (IS_ERR(lc->log_kthread)) {
+                ret = PTR_ERR(lc->log_kthread);
                ti->error = "Couldn't alloc kthread";
                dm_put_device(ti, lc->dev);
                dm_put_device(ti, lc->logdev);
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 41573f1f626f..34a840d9df76 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -834,8 +834,10 @@ static int join(struct mddev *mddev, int nodes)
                goto err;
        }
        cinfo->ack_lockres = lockres_init(mddev, "ack", ack_bast, 0);
-        if (!cinfo->ack_lockres)
+        if (!cinfo->ack_lockres) {
+                ret = -ENOMEM;
                goto err;
+        }
        /* get sync CR lock on ACK. */
        if (dlm_lock_sync(cinfo->ack_lockres, DLM_LOCK_CR))
                pr_err("md-cluster: failed to get a sync CR lock on ACK!(%d)\n",
@@ -849,8 +851,10 @@ static int join(struct mddev *mddev, int nodes)
        pr_info("md-cluster: Joined cluster %s slot %d\n", str, cinfo->slot_number);
        snprintf(str, 64, "bitmap%04d", cinfo->slot_number - 1);
        cinfo->bitmap_lockres = lockres_init(mddev, str, NULL, 1);
-        if (!cinfo->bitmap_lockres)
+        if (!cinfo->bitmap_lockres) {
+                ret = -ENOMEM;
                goto err;
+        }
        if (dlm_lock_sync(cinfo->bitmap_lockres, DLM_LOCK_PW)) {
                pr_err("Failed to get bitmap lock\n");
                ret = -EINVAL;
@@ -858,8 +862,10 @@ static int join(struct mddev *mddev, int nodes)
        }
        cinfo->resync_lockres = lockres_init(mddev, "resync", NULL, 0);
-        if (!cinfo->resync_lockres)
+        if (!cinfo->resync_lockres) {
+                ret = -ENOMEM;
                goto err;
+        }
        return 0;
 err:
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d646f6e444f0..67642bacd597 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1604,11 +1604,8 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
                        mddev->new_chunk_sectors = mddev->chunk_sectors;
                }
-                if (le32_to_cpu(sb->feature_map) & MD_FEATURE_JOURNAL) {
+                if (le32_to_cpu(sb->feature_map) & MD_FEATURE_JOURNAL)
                        set_bit(MD_HAS_JOURNAL, &mddev->flags);
-                        if (mddev->recovery_cp == MaxSector)
-                                set_bit(MD_JOURNAL_CLEAN, &mddev->flags);
-                }
        } else if (mddev->pers == NULL) {
                /* Insist of good event counter while assembling, except for
                 * spares (which don't need an event count) */
@@ -5851,6 +5848,9 @@ static int get_array_info(struct mddev *mddev, void __user *arg)
                        working++;
                        if (test_bit(In_sync, &rdev->flags))
                                insync++;
+                        else if (test_bit(Journal, &rdev->flags))
+                                /* TODO: add journal count to md_u.h */
+                                ;
                        else
                                spare++;
                }
@@ -7862,6 +7862,7 @@ void md_do_sync(struct md_thread *thread)
         */
        do {
+                int mddev2_minor = -1;
                mddev->curr_resync = 2;
        try_again:
@@ -7891,10 +7892,14 @@ void md_do_sync(struct md_thread *thread)
                                prepare_to_wait(&resync_wait, &wq, TASK_INTERRUPTIBLE);
                                if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
                                    mddev2->curr_resync >= mddev->curr_resync) {
-                                        printk(KERN_INFO "md: delaying %s of %s"
+                                        if (mddev2_minor != mddev2->md_minor) {
-                                               " until %s has finished (they"
+                                                mddev2_minor = mddev2->md_minor;
-                                               " share one or more physical units)\n",
+                                                printk(KERN_INFO "md: delaying %s of %s"
-                                               desc, mdname(mddev), mdname(mddev2));
+                                                       " until %s has finished (they"
+                                                       " share one or more physical units)\n",
+                                                       desc, mdname(mddev),
+                                                       mdname(mddev2));
+                                        }
                                        mddev_put(mddev2);
                                        if (signal_pending(current))
                                                flush_signals(current);
@@ -8275,16 +8280,13 @@ no_add:
 static void md_start_sync(struct work_struct *ws)
 {
        struct mddev *mddev = container_of(ws, struct mddev, del_work);
-        int ret = 0;
        mddev->sync_thread = md_register_thread(md_do_sync,
                                                mddev,
                                                "resync");
        if (!mddev->sync_thread) {
-                if (!(mddev_is_clustered(mddev) && ret == -EAGAIN))
+                printk(KERN_ERR "%s: could not start resync thread...\n",
-                        printk(KERN_ERR "%s: could not start resync"
+                       mdname(mddev));
-                               " thread...\n",
-                               mdname(mddev));
                /* leave the spares where they are, it shouldn't hurt */
                clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
                clear_bit(MD_RECOVERY_RESHAPE, &mddev->recovery);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 0e4efcd10795..be1a9fca3b2d 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1064,6 +1064,8 @@ static void __make_request(struct mddev *mddev, struct bio *bio)
        int max_sectors;
        int sectors;
+        md_write_start(mddev, bio);
        /*
         * Register the new request and wait if the reconstruction
         * thread has put up a bar for new requests.
@@ -1445,8 +1447,6 @@ static void raid10_make_request(struct mddev *mddev, struct bio *bio)
                return;
        }
-        md_write_start(mddev, bio);
        do {
                /*
@@ -2465,20 +2465,21 @@ static int narrow_write_error(struct r10bio *r10_bio, int i)
        while (sect_to_write) {
                struct bio *wbio;
+                sector_t wsector;
                if (sectors > sect_to_write)
                        sectors = sect_to_write;
                /* Write at 'sector' for 'sectors' */
                wbio = bio_clone_mddev(bio, GFP_NOIO, mddev);
                bio_trim(wbio, sector - bio->bi_iter.bi_sector, sectors);
-                wbio->bi_iter.bi_sector = (r10_bio->devs[i].addr+
+                wsector = r10_bio->devs[i].addr + (sector - r10_bio->sector);
-                                   choose_data_offset(r10_bio, rdev) +
+                wbio->bi_iter.bi_sector = wsector +
-                                   (sector - r10_bio->sector));
+                                   choose_data_offset(r10_bio, rdev);
                wbio->bi_bdev = rdev->bdev;
                bio_set_op_attrs(wbio, REQ_OP_WRITE, 0);
                if (submit_bio_wait(wbio) < 0)
                        /* Failure! */
-                        ok = rdev_set_badblocks(rdev, sector,
+                        ok = rdev_set_badblocks(rdev, wsector,
                                                sectors, 0)
                                && ok;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 8912407a4dd0..da583bb43c84 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -659,6 +659,7 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
 {
        struct stripe_head *sh;
        int hash = stripe_hash_locks_hash(sector);
+        int inc_empty_inactive_list_flag;
        pr_debug("get_stripe, sector %llu\n", (unsigned long long)sector);
@@ -703,7 +704,12 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
                                        atomic_inc(&conf->active_stripes);
                                BUG_ON(list_empty(&sh->lru) &&
                                       !test_bit(STRIPE_EXPANDING, &sh->state));
+                                inc_empty_inactive_list_flag = 0;
+                                if (!list_empty(conf->inactive_list + hash))
+                                        inc_empty_inactive_list_flag = 1;
                                list_del_init(&sh->lru);
+                                if (list_empty(conf->inactive_list + hash) && inc_empty_inactive_list_flag)
+                                        atomic_inc(&conf->empty_inactive_list_nr);
                                if (sh->group) {
                                        sh->group->stripes_cnt--;
                                        sh->group = NULL;
@@ -762,6 +768,7 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
        sector_t head_sector, tmp_sec;
        int hash;
        int dd_idx;
+        int inc_empty_inactive_list_flag;
        /* Don't cross chunks, so stripe pd_idx/qd_idx is the same */
        tmp_sec = sh->sector;
@@ -779,7 +786,12 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
                                atomic_inc(&conf->active_stripes);
                        BUG_ON(list_empty(&head->lru) &&
                               !test_bit(STRIPE_EXPANDING, &head->state));
+                        inc_empty_inactive_list_flag = 0;
+                        if (!list_empty(conf->inactive_list + hash))
+                                inc_empty_inactive_list_flag = 1;
                        list_del_init(&head->lru);
+                        if (list_empty(conf->inactive_list + hash) && inc_empty_inactive_list_flag)
+                                atomic_inc(&conf->empty_inactive_list_nr);
                        if (head->group) {
                                head->group->stripes_cnt--;
                                head->group = NULL;
@@ -993,7 +1005,6 @@ again:
                        set_bit(STRIPE_IO_STARTED, &sh->state);
-                        bio_reset(bi);
                        bi->bi_bdev = rdev->bdev;
                        bio_set_op_attrs(bi, op, op_flags);
                        bi->bi_end_io = op_is_write(op)
@@ -1045,7 +1056,6 @@ again:
                        set_bit(STRIPE_IO_STARTED, &sh->state);
-                        bio_reset(rbi);
                        rbi->bi_bdev = rrdev->bdev;
                        bio_set_op_attrs(rbi, op, op_flags);
                        BUG_ON(!op_is_write(op));
@@ -1978,9 +1988,11 @@ static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
        put_cpu();
 }
-static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp)
+static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp,
+        int disks)
 {
        struct stripe_head *sh;
+        int i;
        sh = kmem_cache_zalloc(sc, gfp);
        if (sh) {
@@ -1989,6 +2001,17 @@ static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp)
                INIT_LIST_HEAD(&sh->batch_list);
                INIT_LIST_HEAD(&sh->lru);
                atomic_set(&sh->count, 1);
+                for (i = 0; i < disks; i++) {
+                        struct r5dev *dev = &sh->dev[i];
+                        bio_init(&dev->req);
+                        dev->req.bi_io_vec = &dev->vec;
+                        dev->req.bi_max_vecs = 1;
+                        bio_init(&dev->rreq);
+                        dev->rreq.bi_io_vec = &dev->rvec;
+                        dev->rreq.bi_max_vecs = 1;
+                }
        }
        return sh;
 }
@@ -1996,7 +2019,7 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp)
 {
        struct stripe_head *sh;
-        sh = alloc_stripe(conf->slab_cache, gfp);
+        sh = alloc_stripe(conf->slab_cache, gfp, conf->pool_size);
        if (!sh)
                return 0;
@@ -2167,7 +2190,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
        mutex_lock(&conf->cache_size_mutex);
        for (i = conf->max_nr_stripes; i; i--) {
-                nsh = alloc_stripe(sc, GFP_KERNEL);
+                nsh = alloc_stripe(sc, GFP_KERNEL, newsize);
                if (!nsh)
                        break;
@@ -2299,6 +2322,7 @@ static void raid5_end_read_request(struct bio * bi)
                (unsigned long long)sh->sector, i, atomic_read(&sh->count),
                bi->bi_error);
        if (i == disks) {
+                bio_reset(bi);
                BUG();
                return;
        }
@@ -2402,6 +2426,7 @@ static void raid5_end_read_request(struct bio * bi)
        clear_bit(R5_LOCKED, &sh->dev[i].flags);
        set_bit(STRIPE_HANDLE, &sh->state);
        raid5_release_stripe(sh);
+        bio_reset(bi);
 }
 static void raid5_end_write_request(struct bio *bi)
@@ -2436,6 +2461,7 @@ static void raid5_end_write_request(struct bio *bi)
                (unsigned long long)sh->sector, i, atomic_read(&sh->count),
                bi->bi_error);
        if (i == disks) {
+                bio_reset(bi);
                BUG();
                return;
        }
@@ -2479,22 +2505,13 @@ static void raid5_end_write_request(struct bio *bi)
        if (sh->batch_head && sh != sh->batch_head)
                raid5_release_stripe(sh->batch_head);
+        bio_reset(bi);
 }
 static void raid5_build_block(struct stripe_head *sh, int i, int previous)
 {
        struct r5dev *dev = &sh->dev[i];
-        bio_init(&dev->req);
-        dev->req.bi_io_vec = &dev->vec;
-        dev->req.bi_max_vecs = 1;
-        dev->req.bi_private = sh;
-        bio_init(&dev->rreq);
-        dev->rreq.bi_io_vec = &dev->rvec;
-        dev->rreq.bi_max_vecs = 1;
-        dev->rreq.bi_private = sh;
        dev->flags = 0;
        dev->sector = raid5_compute_blocknr(sh, i, previous);
 }
@@ -4628,7 +4645,9 @@ finish:
        }
        if (!bio_list_empty(&s.return_bi)) {
-                if (test_bit(MD_CHANGE_PENDING, &conf->mddev->flags)) {
+                if (test_bit(MD_CHANGE_PENDING, &conf->mddev->flags) &&
+                                (s.failed <= conf->max_degraded ||
+                                        conf->mddev->external == 0)) {
                        spin_lock_irq(&conf->device_lock);
                        bio_list_merge(&conf->return_bi, &s.return_bi);
                        spin_unlock_irq(&conf->device_lock);
@@ -6826,11 +6845,14 @@ static int raid5_run(struct mddev *mddev)
        if (IS_ERR(conf))
                return PTR_ERR(conf);
-        if (test_bit(MD_HAS_JOURNAL, &mddev->flags) && !journal_dev) {
+        if (test_bit(MD_HAS_JOURNAL, &mddev->flags)) {
-                printk(KERN_ERR "md/raid:%s: journal disk is missing, force array readonly\n",
+                if (!journal_dev) {
-                       mdname(mddev));
+                        pr_err("md/raid:%s: journal disk is missing, force array readonly\n",
-                mddev->ro = 1;
+                               mdname(mddev));
-                set_disk_ro(mddev->gendisk, 1);
+                        mddev->ro = 1;
+                        set_disk_ro(mddev->gendisk, 1);
+                } else if (mddev->recovery_cp == MaxSector)
+                        set_bit(MD_JOURNAL_CLEAN, &mddev->flags);
        }
        conf->min_offset_diff = min_offset_diff;
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index a216b4667742..d00252828966 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -345,16 +345,6 @@ config SENSORS_TSL2550
          This driver can also be built as a module.  If so, the module
          will be called tsl2550.
-config SENSORS_BH1780
-        tristate "ROHM BH1780GLI ambient light sensor"
-        depends on I2C && SYSFS
-        help
-          If you say yes here you get support for the ROHM BH1780GLI
-          ambient light sensor.
-          This driver can also be built as a module.  If so, the module
-          will be called bh1780gli.
 config SENSORS_BH1770
         tristate "BH1770GLC / SFH7770 combined ALS - Proximity sensor"
         depends on I2C
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 7410c6d9a34d..fb32516ddfe2 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -19,7 +19,6 @@ obj-$(CONFIG_TIFM_CORE)       	+= tifm_core.o
 obj-$(CONFIG_TIFM_7XX1)         += tifm_7xx1.o
 obj-$(CONFIG_PHANTOM)           += phantom.o
 obj-$(CONFIG_QCOM_COINCELL)     += qcom-coincell.o
-obj-$(CONFIG_SENSORS_BH1780)    += bh1780gli.o
 obj-$(CONFIG_SENSORS_BH1770)    += bh1770glc.o
 obj-$(CONFIG_SENSORS_APDS990X)  += apds990x.o
 obj-$(CONFIG_SGI_IOC4)          += ioc4.o
diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
deleted file mode 100644
index 7f90ce5a569a..000000000000
--- a/drivers/misc/bh1780gli.c
+++ /dev/null
@@ -1,259 +0,0 @@
-/*
- * bh1780gli.c
- * ROHM Ambient Light Sensor Driver
- *
- * Copyright (C) 2010 Texas Instruments
- * Author: Hemanth V <hemanthv@ti.com>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-#include <linux/i2c.h>
-#include <linux/slab.h>
-#include <linux/mutex.h>
-#include <linux/platform_device.h>
-#include <linux/delay.h>
-#include <linux/module.h>
-#include <linux/of.h>
-#define BH1780_REG_CONTROL      0x80
-#define BH1780_REG_PARTID       0x8A
-#define BH1780_REG_MANFID       0x8B
-#define BH1780_REG_DLOW 0x8C
-#define BH1780_REG_DHIGH        0x8D
-#define BH1780_REVMASK          (0xf)
-#define BH1780_POWMASK          (0x3)
-#define BH1780_POFF             (0x0)
-#define BH1780_PON              (0x3)
-/* power on settling time in ms */
-#define BH1780_PON_DELAY        2
-struct bh1780_data {
-        struct i2c_client *client;
-        int power_state;
-        /* lock for sysfs operations */
-        struct mutex lock;
-};
-static int bh1780_write(struct bh1780_data *ddata, u8 reg, u8 val, char *msg)
-{
-        int ret = i2c_smbus_write_byte_data(ddata->client, reg, val);
-        if (ret < 0)
-                dev_err(&ddata->client->dev,
-                        "i2c_smbus_write_byte_data failed error %d Register (%s)\n",
-                        ret, msg);
-        return ret;
-}
-static int bh1780_read(struct bh1780_data *ddata, u8 reg, char *msg)
-{
-        int ret = i2c_smbus_read_byte_data(ddata->client, reg);
-        if (ret < 0)
-                dev_err(&ddata->client->dev,
-                        "i2c_smbus_read_byte_data failed error %d Register (%s)\n",
-                        ret, msg);
-        return ret;
-}
-static ssize_t bh1780_show_lux(struct device *dev,
-                                struct device_attribute *attr, char *buf)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        int lsb, msb;
-        lsb = bh1780_read(ddata, BH1780_REG_DLOW, "DLOW");
-        if (lsb < 0)
-                return lsb;
-        msb = bh1780_read(ddata, BH1780_REG_DHIGH, "DHIGH");
-        if (msb < 0)
-                return msb;
-        return sprintf(buf, "%d\n", (msb << 8) | lsb);
-}
-static ssize_t bh1780_show_power_state(struct device *dev,
-                                        struct device_attribute *attr,
-                                        char *buf)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        int state;
-        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
-        if (state < 0)
-                return state;
-        return sprintf(buf, "%d\n", state & BH1780_POWMASK);
-}
-static ssize_t bh1780_store_power_state(struct device *dev,
-                                        struct device_attribute *attr,
-                                        const char *buf, size_t count)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        unsigned long val;
-        int error;
-        error = kstrtoul(buf, 0, &val);
-        if (error)
-                return error;
-        if (val < BH1780_POFF || val > BH1780_PON)
-                return -EINVAL;
-        mutex_lock(&ddata->lock);
-        error = bh1780_write(ddata, BH1780_REG_CONTROL, val, "CONTROL");
-        if (error < 0) {
-                mutex_unlock(&ddata->lock);
-                return error;
-        }
-        msleep(BH1780_PON_DELAY);
-        ddata->power_state = val;
-        mutex_unlock(&ddata->lock);
-        return count;
-}
-static DEVICE_ATTR(lux, S_IRUGO, bh1780_show_lux, NULL);
-static DEVICE_ATTR(power_state, S_IWUSR | S_IRUGO,
-                bh1780_show_power_state, bh1780_store_power_state);
-static struct attribute *bh1780_attributes[] = {
-        &dev_attr_power_state.attr,
-        &dev_attr_lux.attr,
-        NULL
-};
-static const struct attribute_group bh1780_attr_group = {
-        .attrs = bh1780_attributes,
-};
-static int bh1780_probe(struct i2c_client *client,
-                                                const struct i2c_device_id *id)
-{
-        int ret;
-        struct bh1780_data *ddata;
-        struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
-        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE))
-                return -EIO;
-        ddata = devm_kzalloc(&client->dev, sizeof(struct bh1780_data),
-                             GFP_KERNEL);
-        if (ddata == NULL)
-                return -ENOMEM;
-        ddata->client = client;
-        i2c_set_clientdata(client, ddata);
-        ret = bh1780_read(ddata, BH1780_REG_PARTID, "PART ID");
-        if (ret < 0)
-                return ret;
-        dev_info(&client->dev, "Ambient Light Sensor, Rev : %d\n",
-                        (ret & BH1780_REVMASK));
-        mutex_init(&ddata->lock);
-        return sysfs_create_group(&client->dev.kobj, &bh1780_attr_group);
-}
-static int bh1780_remove(struct i2c_client *client)
-{
-        sysfs_remove_group(&client->dev.kobj, &bh1780_attr_group);
-        return 0;
-}
-#ifdef CONFIG_PM_SLEEP
-static int bh1780_suspend(struct device *dev)
-{
-        struct bh1780_data *ddata;
-        int state, ret;
-        struct i2c_client *client = to_i2c_client(dev);
-        ddata = i2c_get_clientdata(client);
-        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
-        if (state < 0)
-                return state;
-        ddata->power_state = state & BH1780_POWMASK;
-        ret = bh1780_write(ddata, BH1780_REG_CONTROL, BH1780_POFF,
-                                "CONTROL");
-        if (ret < 0)
-                return ret;
-        return 0;
-}
-static int bh1780_resume(struct device *dev)
-{
-        struct bh1780_data *ddata;
-        int state, ret;
-        struct i2c_client *client = to_i2c_client(dev);
-        ddata = i2c_get_clientdata(client);
-        state = ddata->power_state;
-        ret = bh1780_write(ddata, BH1780_REG_CONTROL, state,
-                                "CONTROL");
-        if (ret < 0)
-                return ret;
-        return 0;
-}
-#endif /* CONFIG_PM_SLEEP */
-static SIMPLE_DEV_PM_OPS(bh1780_pm, bh1780_suspend, bh1780_resume);
-static const struct i2c_device_id bh1780_id[] = {
-        { "bh1780", 0 },
-        { },
-};
-MODULE_DEVICE_TABLE(i2c, bh1780_id);
-#ifdef CONFIG_OF
-static const struct of_device_id of_bh1780_match[] = {
-        { .compatible = "rohm,bh1780gli", },
-        {},
-};
-MODULE_DEVICE_TABLE(of, of_bh1780_match);
-#endif
-static struct i2c_driver bh1780_driver = {
-        .probe          = bh1780_probe,
-        .remove         = bh1780_remove,
-        .id_table       = bh1780_id,
-        .driver = {
-                .name = "bh1780",
-                .pm     = &bh1780_pm,
-                .of_match_table = of_match_ptr(of_bh1780_match),
-        },
-};
-module_i2c_driver(bh1780_driver);
-MODULE_DESCRIPTION("BH1780GLI Ambient Light Sensor Driver");
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Hemanth V <hemanthv@ti.com>");
diff --git a/drivers/misc/cxl/vphb.c b/drivers/misc/cxl/vphb.c
index 7ada5f1b7bb6..3519acebfdab 100644
--- a/drivers/misc/cxl/vphb.c
+++ b/drivers/misc/cxl/vphb.c
@@ -230,6 +230,11 @@ int cxl_pci_vphb_add(struct cxl_afu *afu)
        if (phb->bus == NULL)
                return -ENXIO;
+        /* Set release hook on root bus */
+        pci_set_host_bridge_release(to_pci_host_bridge(phb->bus->bridge),
+                                    pcibios_free_controller_deferred,
+                                    (void *) phb);
        /* Claim resources. This might need some rework as well depending
         * whether we are doing probe-only or not, like assigning unassigned
         * resources etc...
@@ -256,7 +261,10 @@ void cxl_pci_vphb_remove(struct cxl_afu *afu)
        afu->phb = NULL;
        pci_remove_root_bus(phb->bus);
-        pcibios_free_controller(phb);
+        /*
+         * We don't free phb here - that's handled by
+         * pcibios_free_controller_deferred()
+         */
 }
 static bool _cxl_pci_is_vphb_device(struct pci_controller *phb)
diff --git a/drivers/misc/lkdtm_rodata.c b/drivers/misc/lkdtm_rodata.c
index 166b1db3969f..3564477b8c2d 100644
--- a/drivers/misc/lkdtm_rodata.c
+++ b/drivers/misc/lkdtm_rodata.c
@@ -4,7 +4,7 @@
 */
 #include "lkdtm.h"
-void lkdtm_rodata_do_nothing(void)
+void notrace lkdtm_rodata_do_nothing(void)
 {
        /* Does nothing. We just want an architecture agnostic "return". */
 }
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index e2fb44cc5c37..dc3a854e02d3 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -1263,8 +1263,14 @@ static bool mei_me_fw_type_nm(struct pci_dev *pdev)
 static bool mei_me_fw_type_sps(struct pci_dev *pdev)
 {
        u32 reg;
-        /* Read ME FW Status check for SPS Firmware */
+        unsigned int devfn;
-        pci_read_config_dword(pdev, PCI_CFG_HFS_1, &reg);
+        /*
+         * Read ME FW Status register to check for SPS Firmware
+         * The SPS FW is only signaled in pci function 0
+         */
+        devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
+        pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_1, &reg);
        trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_1", PCI_CFG_HFS_1, reg);
        /* if bits [19:16] = 15, running SPS Firmware */
        return (reg & 0xf0000) == 0xf0000;
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 64e64da6da44..71cea9b296b2 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -85,8 +85,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, mei_me_pch8_cfg)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_cfg)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_cfg)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
diff --git a/drivers/net/dsa/bcm_sf2.h b/drivers/net/dsa/bcm_sf2.h
index 463bed8cbe4c..dd446e466699 100644
--- a/drivers/net/dsa/bcm_sf2.h
+++ b/drivers/net/dsa/bcm_sf2.h
@@ -205,8 +205,8 @@ static inline void name##_writeq(struct bcm_sf2_priv *priv, u64 val,	\
 static inline void intrl2_##which##_mask_clear(struct bcm_sf2_priv *priv, \
                                                u32 mask)               \
 {                                                                       \
-        intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR);     \
        priv->irq##which##_mask &= ~(mask);                             \
+        intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR);     \
 }                                                                       \
 static inline void intrl2_##which##_mask_set(struct bcm_sf2_priv *priv, \
                                                u32 mask)               \
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index d1d9d3cf9139..710679067594 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -2656,15 +2656,19 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
                        return ret;
        }
+        /* Rate Control: disable ingress rate limiting. */
        if (mv88e6xxx_6352_family(chip) || mv88e6xxx_6351_family(chip) ||
            mv88e6xxx_6165_family(chip) || mv88e6xxx_6097_family(chip) ||
-            mv88e6xxx_6185_family(chip) || mv88e6xxx_6095_family(chip) ||
            mv88e6xxx_6320_family(chip)) {
-                /* Rate Control: disable ingress rate limiting. */
                ret = _mv88e6xxx_reg_write(chip, REG_PORT(port),
                                           PORT_RATE_CONTROL, 0x0001);
                if (ret)
                        return ret;
+        } else if (mv88e6xxx_6185_family(chip) || mv88e6xxx_6095_family(chip)) {
+                ret = _mv88e6xxx_reg_write(chip, REG_PORT(port),
+                                           PORT_RATE_CONTROL, 0x0000);
+                if (ret)
+                        return ret;
        }
        /* Port Control 1: disable trunking, disable sending
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 6453148d066a..4eb17daefc4f 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1545,6 +1545,8 @@ static const struct pci_device_id alx_pci_tbl[] = {
          .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
        { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_E2400),
          .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
+        { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_E2500),
+          .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
        { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_AR8162),
          .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
        { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_AR8171) },
diff --git a/drivers/net/ethernet/atheros/alx/reg.h b/drivers/net/ethernet/atheros/alx/reg.h
index 0959e6824cb6..1fc2d852249f 100644
--- a/drivers/net/ethernet/atheros/alx/reg.h
+++ b/drivers/net/ethernet/atheros/alx/reg.h
@@ -38,6 +38,7 @@
 #define ALX_DEV_ID_AR8161                               0x1091
 #define ALX_DEV_ID_E2200                                0xe091
 #define ALX_DEV_ID_E2400                                0xe0a1
+#define ALX_DEV_ID_E2500                                0xe0b1
 #define ALX_DEV_ID_AR8162                               0x1090
 #define ALX_DEV_ID_AR8171                               0x10A1
 #define ALX_DEV_ID_AR8172                               0x10A0
diff --git a/drivers/net/ethernet/broadcom/bgmac-bcma.c b/drivers/net/ethernet/broadcom/bgmac-bcma.c
index 9a9745c4047c..625235db644f 100644
--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
+++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
@@ -159,7 +159,7 @@ static int bgmac_probe(struct bcma_device *core)
        if (!bgmac_is_bcm4707_family(core)) {
                mii_bus = bcma_mdio_mii_register(core, bgmac->phyaddr);
-                if (!IS_ERR(mii_bus)) {
+                if (IS_ERR(mii_bus)) {
                        err = PTR_ERR(mii_bus);
                        goto err;
                }
diff --git a/drivers/net/ethernet/cavium/thunder/nic_reg.h b/drivers/net/ethernet/cavium/thunder/nic_reg.h
index afb10e326b4f..fab35a593898 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_reg.h
+++ b/drivers/net/ethernet/cavium/thunder/nic_reg.h
@@ -170,7 +170,6 @@
 #define   NIC_QSET_SQ_0_7_DOOR                  (0x010838)
 #define   NIC_QSET_SQ_0_7_STATUS                (0x010840)
 #define   NIC_QSET_SQ_0_7_DEBUG                 (0x010848)
-#define   NIC_QSET_SQ_0_7_CNM_CHG               (0x010860)
 #define   NIC_QSET_SQ_0_7_STAT_0_1              (0x010900)
 #define   NIC_QSET_RBDR_0_1_CFG                 (0x010C00)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
index d2d8ef270142..ad4fddb55421 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
@@ -382,7 +382,10 @@ static void nicvf_get_regs(struct net_device *dev,
                p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_DOOR, q);
                p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_STATUS, q);
                p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_DEBUG, q);
-                p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_CNM_CHG, q);
+                /* Padding, was NIC_QSET_SQ_0_7_CNM_CHG, which
+                 * produces bus errors when read
+                 */
+                p[i++] = 0;
                p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_STAT_0_1, q);
                reg_offset = NIC_QSET_SQ_0_7_STAT_0_1 | (1 << 3);
                p[i++] = nicvf_queue_reg_read(nic, reg_offset, q);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index c45de49dc963..c762a8c8c954 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4335,6 +4335,11 @@ static void cfg_queues(struct adapter *adap)
 #endif
        int ciq_size;
+        /* Reduce memory usage in kdump environment, disable all offload.
+         */
+        if (is_kdump_kernel())
+                adap->params.offload = 0;
        for_each_port(adap, i)
                n10g += is_x_10g_port(&adap2pinfo(adap, i)->link_cfg);
 #ifdef CONFIG_CHELSIO_T4_DCB
@@ -4365,11 +4370,6 @@ static void cfg_queues(struct adapter *adap)
        if (q10g > netif_get_num_default_rss_queues())
                q10g = netif_get_num_default_rss_queues();
-        /* Reduce memory usage in kdump environment, disable all offload.
-         */
-        if (is_kdump_kernel())
-                adap->params.offload = 0;
        for_each_port(adap, i) {
                struct port_info *pi = adap2pinfo(adap, i);
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index d20935dc8399..4b4f5bc0e279 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2922,17 +2922,25 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
 {
        unsigned int size = lstatus & BD_LENGTH_MASK;
        struct page *page = rxb->page;
+        bool last = !!(lstatus & BD_LFLAG(RXBD_LAST));
        /* Remove the FCS from the packet length */
-        if (likely(lstatus & BD_LFLAG(RXBD_LAST)))
+        if (last)
                size -= ETH_FCS_LEN;
-        if (likely(first))
+        if (likely(first)) {
                skb_put(skb, size);
-        else
+        } else {
-                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+                /* the last fragments' length contains the full frame length */
-                                rxb->page_offset + RXBUF_ALIGNMENT,
+                if (last)
-                                size, GFAR_RXB_TRUESIZE);
+                        size -= skb->len;
+                /* in case the last fragment consisted only of the FCS */
+                if (size > 0)
+                        skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+                                        rxb->page_offset + RXBUF_ALIGNMENT,
+                                        size, GFAR_RXB_TRUESIZE);
+        }
        /* try reuse page */
        if (unlikely(page_count(page) != 1))
diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
index 373fd094f2f3..6e8a9c8467b9 100644
--- a/drivers/net/ethernet/freescale/gianfar.h
+++ b/drivers/net/ethernet/freescale/gianfar.h
@@ -100,7 +100,8 @@ extern const char gfar_driver_version[];
 #define DEFAULT_RX_LFC_THR  16
 #define DEFAULT_LFC_PTVVAL  4
-#define GFAR_RXB_SIZE 1536
+/* prevent fragmenation by HW in DSA environments */
+#define GFAR_RXB_SIZE roundup(1536 + 8, 64)
 #define GFAR_SKBFRAG_SIZE (RXBUF_ALIGNMENT + GFAR_RXB_SIZE \
                          + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 #define GFAR_RXB_TRUESIZE 2048
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index ff8b6a468b24..6ea872287307 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -328,9 +328,10 @@ static void hns_ppe_init_hw(struct hns_ppe_cb *ppe_cb)
 static void hns_ppe_uninit_hw(struct hns_ppe_cb *ppe_cb)
 {
        u32 port;
-        struct dsaf_device *dsaf_dev = ppe_cb->ppe_common_cb->dsaf_dev;
        if (ppe_cb->ppe_common_cb) {
+                struct dsaf_device *dsaf_dev = ppe_cb->ppe_common_cb->dsaf_dev;
                port = ppe_cb->index;
                dsaf_dev->misc_op->ppe_srst(dsaf_dev, port, 0);
        }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
index e1370c556a3c..618f18436618 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
@@ -199,6 +199,7 @@ void i40e_notify_client_of_l2_param_changes(struct i40e_vsi *vsi)
 void i40e_notify_client_of_netdev_open(struct i40e_vsi *vsi)
 {
        struct i40e_client_instance *cdev;
+        int ret = 0;
        if (!vsi)
                return;
@@ -211,7 +212,14 @@ void i40e_notify_client_of_netdev_open(struct i40e_vsi *vsi)
                                        "Cannot locate client instance open routine\n");
                                continue;
                        }
-                        cdev->client->ops->open(&cdev->lan_info, cdev->client);
+                        if (!(test_bit(__I40E_CLIENT_INSTANCE_OPENED,
+                                       &cdev->state))) {
+                                ret = cdev->client->ops->open(&cdev->lan_info,
+                                                              cdev->client);
+                                if (!ret)
+                                        set_bit(__I40E_CLIENT_INSTANCE_OPENED,
+                                                &cdev->state);
+                        }
                }
        }
        mutex_unlock(&i40e_client_instance_mutex);
@@ -407,12 +415,14 @@ struct i40e_vsi *i40e_vsi_lookup(struct i40e_pf *pf,
 * i40e_client_add_instance - add a client instance struct to the instance list
 * @pf: pointer to the board struct
 * @client: pointer to a client struct in the client list.
+ * @existing: if there was already an existing instance
 *
- * Returns cdev ptr on success, NULL on failure
+ * Returns cdev ptr on success or if already exists, NULL on failure
 **/
 static
 struct i40e_client_instance *i40e_client_add_instance(struct i40e_pf *pf,
-                                                      struct i40e_client *client)
+                                                     struct i40e_client *client,
+                                                     bool *existing)
 {
        struct i40e_client_instance *cdev;
        struct netdev_hw_addr *mac = NULL;
@@ -421,7 +431,7 @@ struct i40e_client_instance *i40e_client_add_instance(struct i40e_pf *pf,
        mutex_lock(&i40e_client_instance_mutex);
        list_for_each_entry(cdev, &i40e_client_instances, list) {
                if ((cdev->lan_info.pf == pf) && (cdev->client == client)) {
-                        cdev = NULL;
+                        *existing = true;
                        goto out;
                }
        }
@@ -505,6 +515,7 @@ void i40e_client_subtask(struct i40e_pf *pf)
 {
        struct i40e_client_instance *cdev;
        struct i40e_client *client;
+        bool existing = false;
        int ret = 0;
        if (!(pf->flags & I40E_FLAG_SERVICE_CLIENT_REQUESTED))
@@ -528,18 +539,25 @@ void i40e_client_subtask(struct i40e_pf *pf)
                        /* check if L2 VSI is up, if not we are not ready */
                        if (test_bit(__I40E_DOWN, &pf->vsi[pf->lan_vsi]->state))
                                continue;
+                } else {
+                        dev_warn(&pf->pdev->dev, "This client %s is being instanciated at probe\n",
+                                 client->name);
                }
                /* Add the client instance to the instance list */
-                cdev = i40e_client_add_instance(pf, client);
+                cdev = i40e_client_add_instance(pf, client, &existing);
                if (!cdev)
                        continue;
-                /* Also up the ref_cnt of no. of instances of this client */
+                if (!existing) {
-                atomic_inc(&client->ref_cnt);
+                        /* Also up the ref_cnt for no. of instances of this
-                dev_info(&pf->pdev->dev, "Added instance of Client %s to PF%d bus=0x%02x func=0x%02x\n",
+                         * client.
-                         client->name, pf->hw.pf_id,
+                         */
-                         pf->hw.bus.device, pf->hw.bus.func);
+                        atomic_inc(&client->ref_cnt);
+                        dev_info(&pf->pdev->dev, "Added instance of Client %s to PF%d bus=0x%02x func=0x%02x\n",
+                                 client->name, pf->hw.pf_id,
+                                 pf->hw.bus.device, pf->hw.bus.func);
+                }
                /* Send an Open request to the client */
                atomic_inc(&cdev->ref_cnt);
@@ -588,7 +606,8 @@ int i40e_lan_add_device(struct i40e_pf *pf)
                 pf->hw.pf_id, pf->hw.bus.device, pf->hw.bus.func);
        /* Since in some cases register may have happened before a device gets
-         * added, we can schedule a subtask to go initiate the clients.
+         * added, we can schedule a subtask to go initiate the clients if
+         * they can be launched at probe time.
         */
        pf->flags |= I40E_FLAG_SERVICE_CLIENT_REQUESTED;
        i40e_service_event_schedule(pf);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index c6ac7a61812f..828ed28c3c14 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -5431,7 +5431,6 @@ int i40e_open(struct net_device *netdev)
        wr32(&pf->hw, I40E_GLLAN_TSOMSK_L, be32_to_cpu(TCP_FLAG_CWR) >> 16);
        udp_tunnel_get_rx_info(netdev);
-        i40e_notify_client_of_netdev_open(vsi);
        return 0;
 }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index b4217f30e89c..c47b605e8651 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -2958,8 +2958,10 @@ s32 ixgbe_clear_vmdq_generic(struct ixgbe_hw *hw, u32 rar, u32 vmdq)
        }
        /* was that the last pool using this rar? */
-        if (mpsar_lo == 0 && mpsar_hi == 0 && rar != 0)
+        if (mpsar_lo == 0 && mpsar_hi == 0 &&
+            rar != 0 && rar != hw->mac.san_mac_rar_index)
                hw->mac.ops.clear_rar(hw, rar);
        return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index d6e2a1cae19a..c2ec01a22d55 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -143,13 +143,14 @@ static struct mlx5_cmd_layout *get_inst(struct mlx5_cmd *cmd, int idx)
        return cmd->cmd_buf + (idx << cmd->log_stride);
 }
-static u8 xor8_buf(void *buf, int len)
+static u8 xor8_buf(void *buf, size_t offset, int len)
 {
        u8 *ptr = buf;
        u8 sum = 0;
        int i;
+        int end = len + offset;
-        for (i = 0; i < len; i++)
+        for (i = offset; i < end; i++)
                sum ^= ptr[i];
        return sum;
@@ -157,41 +158,49 @@ static u8 xor8_buf(void *buf, int len)
 static int verify_block_sig(struct mlx5_cmd_prot_block *block)
 {
-        if (xor8_buf(block->rsvd0, sizeof(*block) - sizeof(block->data) - 1) != 0xff)
+        size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
+        int xor_len = sizeof(*block) - sizeof(block->data) - 1;
+        if (xor8_buf(block, rsvd0_off, xor_len) != 0xff)
                return -EINVAL;
-        if (xor8_buf(block, sizeof(*block)) != 0xff)
+        if (xor8_buf(block, 0, sizeof(*block)) != 0xff)
                return -EINVAL;
        return 0;
 }
-static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token,
+static void calc_block_sig(struct mlx5_cmd_prot_block *block)
-                           int csum)
 {
-        block->token = token;
+        int ctrl_xor_len = sizeof(*block) - sizeof(block->data) - 2;
-        if (csum) {
+        size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
-                block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) -
-                                            sizeof(block->data) - 2);
+        block->ctrl_sig = ~xor8_buf(block, rsvd0_off, ctrl_xor_len);
-                block->sig = ~xor8_buf(block, sizeof(*block) - 1);
+        block->sig = ~xor8_buf(block, 0, sizeof(*block) - 1);
-        }
 }
-static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token, int csum)
+static void calc_chain_sig(struct mlx5_cmd_msg *msg)
 {
        struct mlx5_cmd_mailbox *next = msg->next;
+        int size = msg->len;
-        while (next) {
+        int blen = size - min_t(int, sizeof(msg->first.data), size);
-                calc_block_sig(next->buf, token, csum);
+        int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
+                / MLX5_CMD_DATA_BLOCK_SIZE;
+        int i = 0;
+        for (i = 0; i < n && next; i++)  {
+                calc_block_sig(next->buf);
                next = next->next;
        }
 }
 static void set_signature(struct mlx5_cmd_work_ent *ent, int csum)
 {
-        ent->lay->sig = ~xor8_buf(ent->lay, sizeof(*ent->lay));
+        ent->lay->sig = ~xor8_buf(ent->lay, 0,  sizeof(*ent->lay));
-        calc_chain_sig(ent->in, ent->token, csum);
+        if (csum) {
-        calc_chain_sig(ent->out, ent->token, csum);
+                calc_chain_sig(ent->in);
+                calc_chain_sig(ent->out);
+        }
 }
 static void poll_timeout(struct mlx5_cmd_work_ent *ent)
@@ -222,12 +231,17 @@ static int verify_signature(struct mlx5_cmd_work_ent *ent)
        struct mlx5_cmd_mailbox *next = ent->out->next;
        int err;
        u8 sig;
+        int size = ent->out->len;
+        int blen = size - min_t(int, sizeof(ent->out->first.data), size);
+        int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
+                / MLX5_CMD_DATA_BLOCK_SIZE;
+        int i = 0;
-        sig = xor8_buf(ent->lay, sizeof(*ent->lay));
+        sig = xor8_buf(ent->lay, 0, sizeof(*ent->lay));
        if (sig != 0xff)
                return -EINVAL;
-        while (next) {
+        for (i = 0; i < n && next; i++) {
                err = verify_block_sig(next->buf);
                if (err)
                        return err;
@@ -656,7 +670,6 @@ static void cmd_work_handler(struct work_struct *work)
                spin_unlock_irqrestore(&cmd->alloc_lock, flags);
        }
-        ent->token = alloc_token(cmd);
        cmd->ent_arr[ent->idx] = ent;
        lay = get_inst(cmd, ent->idx);
        ent->lay = lay;
@@ -766,7 +779,8 @@ static u8 *get_status_ptr(struct mlx5_outbox_hdr *out)
 static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
                           struct mlx5_cmd_msg *out, void *uout, int uout_size,
                           mlx5_cmd_cbk_t callback,
-                           void *context, int page_queue, u8 *status)
+                           void *context, int page_queue, u8 *status,
+                           u8 token)
 {
        struct mlx5_cmd *cmd = &dev->cmd;
        struct mlx5_cmd_work_ent *ent;
@@ -783,6 +797,8 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
        if (IS_ERR(ent))
                return PTR_ERR(ent);
+        ent->token = token;
        if (!callback)
                init_completion(&ent->done);
@@ -854,7 +870,8 @@ static const struct file_operations fops = {
        .write  = dbg_write,
 };
-static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size)
+static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size,
+                            u8 token)
 {
        struct mlx5_cmd_prot_block *block;
        struct mlx5_cmd_mailbox *next;
@@ -880,6 +897,7 @@ static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size)
                memcpy(block->data, from, copy);
                from += copy;
                size -= copy;
+                block->token = token;
                next = next->next;
        }
@@ -949,7 +967,8 @@ static void free_cmd_box(struct mlx5_core_dev *dev,
 }
 static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev,
-                                               gfp_t flags, int size)
+                                               gfp_t flags, int size,
+                                               u8 token)
 {
        struct mlx5_cmd_mailbox *tmp, *head = NULL;
        struct mlx5_cmd_prot_block *block;
@@ -978,6 +997,7 @@ static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev,
                tmp->next = head;
                block->next = cpu_to_be64(tmp->next ? tmp->next->dma : 0);
                block->block_num = cpu_to_be32(n - i - 1);
+                block->token = token;
                head = tmp;
        }
        msg->next = head;
@@ -1352,7 +1372,7 @@ static struct mlx5_cmd_msg *alloc_msg(struct mlx5_core_dev *dev, int in_size,
        }
        if (IS_ERR(msg))
-                msg = mlx5_alloc_cmd_msg(dev, gfp, in_size);
+                msg = mlx5_alloc_cmd_msg(dev, gfp, in_size, 0);
        return msg;
 }
@@ -1377,6 +1397,7 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out,
        int err;
        u8 status = 0;
        u32 drv_synd;
+        u8 token;
        if (pci_channel_offline(dev->pdev) ||
            dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
@@ -1395,20 +1416,22 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out,
                return err;
        }
-        err = mlx5_copy_to_msg(inb, in, in_size);
+        token = alloc_token(&dev->cmd);
+        err = mlx5_copy_to_msg(inb, in, in_size, token);
        if (err) {
                mlx5_core_warn(dev, "err %d\n", err);
                goto out_in;
        }
-        outb = mlx5_alloc_cmd_msg(dev, gfp, out_size);
+        outb = mlx5_alloc_cmd_msg(dev, gfp, out_size, token);
        if (IS_ERR(outb)) {
                err = PTR_ERR(outb);
                goto out_in;
        }
        err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context,
-                              pages_queue, &status);
+                              pages_queue, &status, token);
        if (err)
                goto out_out;
@@ -1476,7 +1499,7 @@ static int create_msg_cache(struct mlx5_core_dev *dev)
        INIT_LIST_HEAD(&cmd->cache.med.head);
        for (i = 0; i < NUM_LONG_LISTS; i++) {
-                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE);
+                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE, 0);
                if (IS_ERR(msg)) {
                        err = PTR_ERR(msg);
                        goto ex_err;
@@ -1486,7 +1509,7 @@ static int create_msg_cache(struct mlx5_core_dev *dev)
        }
        for (i = 0; i < NUM_MED_LISTS; i++) {
-                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE);
+                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE, 0);
                if (IS_ERR(msg)) {
                        err = PTR_ERR(msg);
                        goto ex_err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 1b495efa7490..bf722aa88cf0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -73,8 +73,12 @@
 #define MLX5_MPWRQ_PAGES_PER_WQE                BIT(MLX5_MPWRQ_WQE_PAGE_ORDER)
 #define MLX5_MPWRQ_STRIDES_PER_PAGE             (MLX5_MPWRQ_NUM_STRIDES >> \
                                                 MLX5_MPWRQ_WQE_PAGE_ORDER)
-#define MLX5_CHANNEL_MAX_NUM_MTTS (ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8) * \
-                                   BIT(MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW))
+#define MLX5_MTT_OCTW(npages) (ALIGN(npages, 8) / 2)
+#define MLX5E_REQUIRED_MTTS(rqs, wqes)\
+        (rqs * wqes * ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8))
+#define MLX5E_VALID_NUM_MTTS(num_mtts) (MLX5_MTT_OCTW(num_mtts) <= U16_MAX)
 #define MLX5_UMR_ALIGN                          (2048)
 #define MLX5_MPWRQ_SMALL_PACKET_THRESHOLD       (128)
@@ -219,9 +223,8 @@ struct mlx5e_tstamp {
 };
 enum {
-        MLX5E_RQ_STATE_POST_WQES_ENABLE,
+        MLX5E_RQ_STATE_FLUSH,
        MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS,
-        MLX5E_RQ_STATE_FLUSH_TIMEOUT,
        MLX5E_RQ_STATE_AM,
 };
@@ -304,6 +307,7 @@ struct mlx5e_rq {
        unsigned long          state;
        int                    ix;
+        u32                    mpwqe_mtt_offset;
        struct mlx5e_rx_am     am; /* Adaptive Moderation */
@@ -365,9 +369,8 @@ struct mlx5e_sq_dma {
 };
 enum {
-        MLX5E_SQ_STATE_WAKE_TXQ_ENABLE,
+        MLX5E_SQ_STATE_FLUSH,
        MLX5E_SQ_STATE_BF_ENABLE,
-        MLX5E_SQ_STATE_TX_TIMEOUT,
 };
 struct mlx5e_ico_wqe_info {
@@ -698,7 +701,6 @@ int mlx5e_napi_poll(struct napi_struct *napi, int budget);
 bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget);
 int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget);
 void mlx5e_free_tx_descs(struct mlx5e_sq *sq);
-void mlx5e_free_rx_descs(struct mlx5e_rq *rq);
 void mlx5e_handle_rx_cqe(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe);
 void mlx5e_handle_rx_cqe_mpwrq(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe);
@@ -814,11 +816,6 @@ static inline int mlx5e_get_max_num_channels(struct mlx5_core_dev *mdev)
                     MLX5E_MAX_NUM_CHANNELS);
 }
-static inline int mlx5e_get_mtt_octw(int npages)
-{
-        return ALIGN(npages, 8) / 2;
-}
 extern const struct ethtool_ops mlx5e_ethtool_ops;
 #ifdef CONFIG_MLX5_CORE_EN_DCB
 extern const struct dcbnl_rtnl_ops mlx5e_dcbnl_ops;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
index 673043ccd76c..9cce153e1035 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
@@ -139,7 +139,7 @@ int mlx5e_refresh_tirs_self_loopback_enable(struct mlx5_core_dev *mdev)
        struct mlx5e_tir *tir;
        void *in;
        int inlen;
-        int err;
+        int err = 0;
        inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
        in = mlx5_vzalloc(inlen);
@@ -151,10 +151,11 @@ int mlx5e_refresh_tirs_self_loopback_enable(struct mlx5_core_dev *mdev)
        list_for_each_entry(tir, &mdev->mlx5e_res.td.tirs_list, list) {
                err = mlx5_core_modify_tir(mdev, tir->tirn, in, inlen);
                if (err)
-                        return err;
+                        goto out;
        }
+out:
        kvfree(in);
-        return 0;
+        return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index caa9a3ccc3f3..762af16ed021 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -127,29 +127,40 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
        return mlx5_set_port_tc_bw_alloc(mdev, tc_tx_bw);
 }
-static int mlx5e_dbcnl_validate_ets(struct ieee_ets *ets)
+static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
+                                    struct ieee_ets *ets)
 {
        int bw_sum = 0;
        int i;
        /* Validate Priority */
        for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
-                if (ets->prio_tc[i] >= MLX5E_MAX_PRIORITY)
+                if (ets->prio_tc[i] >= MLX5E_MAX_PRIORITY) {
+                        netdev_err(netdev,
+                                   "Failed to validate ETS: priority value greater than max(%d)\n",
+                                    MLX5E_MAX_PRIORITY);
                        return -EINVAL;
+                }
        }
        /* Validate Bandwidth Sum */
        for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
-                        if (!ets->tc_tx_bw[i])
+                        if (!ets->tc_tx_bw[i]) {
+                                netdev_err(netdev,
+                                           "Failed to validate ETS: BW 0 is illegal\n");
                                return -EINVAL;
+                        }
                        bw_sum += ets->tc_tx_bw[i];
                }
        }
-        if (bw_sum != 0 && bw_sum != 100)
+        if (bw_sum != 0 && bw_sum != 100) {
+                netdev_err(netdev,
+                           "Failed to validate ETS: BW sum is illegal\n");
                return -EINVAL;
+        }
        return 0;
 }
@@ -159,7 +170,7 @@ static int mlx5e_dcbnl_ieee_setets(struct net_device *netdev,
        struct mlx5e_priv *priv = netdev_priv(netdev);
        int err;
-        err = mlx5e_dbcnl_validate_ets(ets);
+        err = mlx5e_dbcnl_validate_ets(netdev, ets);
        if (err)
                return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 4a3757e60441..d0cf8fa22659 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -352,15 +352,61 @@ static void mlx5e_get_ethtool_stats(struct net_device *dev,
                                                                   sq_stats_desc, j);
 }
+static u32 mlx5e_rx_wqes_to_packets(struct mlx5e_priv *priv, int rq_wq_type,
+                                    int num_wqe)
+{
+        int packets_per_wqe;
+        int stride_size;
+        int num_strides;
+        int wqe_size;
+        if (rq_wq_type != MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ)
+                return num_wqe;
+        stride_size = 1 << priv->params.mpwqe_log_stride_sz;
+        num_strides = 1 << priv->params.mpwqe_log_num_strides;
+        wqe_size = stride_size * num_strides;
+        packets_per_wqe = wqe_size /
+                          ALIGN(ETH_DATA_LEN, stride_size);
+        return (1 << (order_base_2(num_wqe * packets_per_wqe) - 1));
+}
+static u32 mlx5e_packets_to_rx_wqes(struct mlx5e_priv *priv, int rq_wq_type,
+                                    int num_packets)
+{
+        int packets_per_wqe;
+        int stride_size;
+        int num_strides;
+        int wqe_size;
+        int num_wqes;
+        if (rq_wq_type != MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ)
+                return num_packets;
+        stride_size = 1 << priv->params.mpwqe_log_stride_sz;
+        num_strides = 1 << priv->params.mpwqe_log_num_strides;
+        wqe_size = stride_size * num_strides;
+        num_packets = (1 << order_base_2(num_packets));
+        packets_per_wqe = wqe_size /
+                          ALIGN(ETH_DATA_LEN, stride_size);
+        num_wqes = DIV_ROUND_UP(num_packets, packets_per_wqe);
+        return 1 << (order_base_2(num_wqes));
+}
 static void mlx5e_get_ringparam(struct net_device *dev,
                                struct ethtool_ringparam *param)
 {
        struct mlx5e_priv *priv = netdev_priv(dev);
        int rq_wq_type = priv->params.rq_wq_type;
-        param->rx_max_pending = 1 << mlx5_max_log_rq_size(rq_wq_type);
+        param->rx_max_pending = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                                         1 << mlx5_max_log_rq_size(rq_wq_type));
        param->tx_max_pending = 1 << MLX5E_PARAMS_MAXIMUM_LOG_SQ_SIZE;
-        param->rx_pending     = 1 << priv->params.log_rq_size;
+        param->rx_pending = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                                     1 << priv->params.log_rq_size);
        param->tx_pending     = 1 << priv->params.log_sq_size;
 }
@@ -370,9 +416,13 @@ static int mlx5e_set_ringparam(struct net_device *dev,
        struct mlx5e_priv *priv = netdev_priv(dev);
        bool was_opened;
        int rq_wq_type = priv->params.rq_wq_type;
+        u32 rx_pending_wqes;
+        u32 min_rq_size;
+        u32 max_rq_size;
        u16 min_rx_wqes;
        u8 log_rq_size;
        u8 log_sq_size;
+        u32 num_mtts;
        int err = 0;
        if (param->rx_jumbo_pending) {
@@ -385,18 +435,36 @@ static int mlx5e_set_ringparam(struct net_device *dev,
                            __func__);
                return -EINVAL;
        }
-        if (param->rx_pending < (1 << mlx5_min_log_rq_size(rq_wq_type))) {
+        min_rq_size = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                               1 << mlx5_min_log_rq_size(rq_wq_type));
+        max_rq_size = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                               1 << mlx5_max_log_rq_size(rq_wq_type));
+        rx_pending_wqes = mlx5e_packets_to_rx_wqes(priv, rq_wq_type,
+                                                   param->rx_pending);
+        if (param->rx_pending < min_rq_size) {
                netdev_info(dev, "%s: rx_pending (%d) < min (%d)\n",
                            __func__, param->rx_pending,
-                            1 << mlx5_min_log_rq_size(rq_wq_type));
+                            min_rq_size);
                return -EINVAL;
        }
-        if (param->rx_pending > (1 << mlx5_max_log_rq_size(rq_wq_type))) {
+        if (param->rx_pending > max_rq_size) {
                netdev_info(dev, "%s: rx_pending (%d) > max (%d)\n",
                            __func__, param->rx_pending,
-                            1 << mlx5_max_log_rq_size(rq_wq_type));
+                            max_rq_size);
                return -EINVAL;
        }
+        num_mtts = MLX5E_REQUIRED_MTTS(priv->params.num_channels,
+                                       rx_pending_wqes);
+        if (priv->params.rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ &&
+            !MLX5E_VALID_NUM_MTTS(num_mtts)) {
+                netdev_info(dev, "%s: rx_pending (%d) request can't be satisfied, try to reduce.\n",
+                            __func__, param->rx_pending);
+                return -EINVAL;
+        }
        if (param->tx_pending < (1 << MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE)) {
                netdev_info(dev, "%s: tx_pending (%d) < min (%d)\n",
                            __func__, param->tx_pending,
@@ -410,9 +478,9 @@ static int mlx5e_set_ringparam(struct net_device *dev,
                return -EINVAL;
        }
-        log_rq_size = order_base_2(param->rx_pending);
+        log_rq_size = order_base_2(rx_pending_wqes);
        log_sq_size = order_base_2(param->tx_pending);
-        min_rx_wqes = mlx5_min_rx_wqes(rq_wq_type, param->rx_pending);
+        min_rx_wqes = mlx5_min_rx_wqes(rq_wq_type, rx_pending_wqes);
        if (log_rq_size == priv->params.log_rq_size &&
            log_sq_size == priv->params.log_sq_size &&
@@ -454,6 +522,7 @@ static int mlx5e_set_channels(struct net_device *dev,
        unsigned int count = ch->combined_count;
        bool arfs_enabled;
        bool was_opened;
+        u32 num_mtts;
        int err = 0;
        if (!count) {
@@ -472,6 +541,14 @@ static int mlx5e_set_channels(struct net_device *dev,
                return -EINVAL;
        }
+        num_mtts = MLX5E_REQUIRED_MTTS(count, BIT(priv->params.log_rq_size));
+        if (priv->params.rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ &&
+            !MLX5E_VALID_NUM_MTTS(num_mtts)) {
+                netdev_info(dev, "%s: rx count (%d) request can't be satisfied, try to reduce.\n",
+                            __func__, count);
+                return -EINVAL;
+        }
        if (priv->params.num_channels == count)
                return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 870bea37c57c..2459c7f3db8d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -39,13 +39,6 @@
 #include "eswitch.h"
 #include "vxlan.h"
-enum {
-        MLX5_EN_QP_FLUSH_TIMEOUT_MS     = 5000,
-        MLX5_EN_QP_FLUSH_MSLEEP_QUANT   = 20,
-        MLX5_EN_QP_FLUSH_MAX_ITER       = MLX5_EN_QP_FLUSH_TIMEOUT_MS /
-                                          MLX5_EN_QP_FLUSH_MSLEEP_QUANT,
-};
 struct mlx5e_rq_param {
        u32                     rqc[MLX5_ST_SZ_DW(rqc)];
        struct mlx5_wq_param    wq;
@@ -162,6 +155,7 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                        s->tx_queue_stopped     += sq_stats->stopped;
                        s->tx_queue_wake        += sq_stats->wake;
                        s->tx_queue_dropped     += sq_stats->dropped;
+                        s->tx_xmit_more         += sq_stats->xmit_more;
                        s->tx_csum_partial_inner += sq_stats->csum_partial_inner;
                        tx_offload_none         += sq_stats->csum_none;
                }
@@ -340,6 +334,9 @@ static int mlx5e_create_rq(struct mlx5e_channel *c,
                rq->alloc_wqe = mlx5e_alloc_rx_mpwqe;
                rq->dealloc_wqe = mlx5e_dealloc_rx_mpwqe;
+                rq->mpwqe_mtt_offset = c->ix *
+                        MLX5E_REQUIRED_MTTS(1, BIT(priv->params.log_rq_size));
                rq->mpwqe_stride_sz = BIT(priv->params.mpwqe_log_stride_sz);
                rq->mpwqe_num_strides = BIT(priv->params.mpwqe_log_num_strides);
                rq->wqe_sz = rq->mpwqe_stride_sz * rq->mpwqe_num_strides;
@@ -428,7 +425,6 @@ static int mlx5e_enable_rq(struct mlx5e_rq *rq, struct mlx5e_rq_param *param)
        MLX5_SET(rqc,  rqc, cqn,                rq->cq.mcq.cqn);
        MLX5_SET(rqc,  rqc, state,              MLX5_RQC_STATE_RST);
-        MLX5_SET(rqc,  rqc, flush_in_error_en,  1);
        MLX5_SET(rqc,  rqc, vsd, priv->params.vlan_strip_disable);
        MLX5_SET(wq,   wq,  log_wq_pg_sz,       rq->wq_ctrl.buf.page_shift -
                                                MLX5_ADAPTER_PAGE_SHIFT);
@@ -525,6 +521,27 @@ static int mlx5e_wait_for_min_rx_wqes(struct mlx5e_rq *rq)
        return -ETIMEDOUT;
 }
+static void mlx5e_free_rx_descs(struct mlx5e_rq *rq)
+{
+        struct mlx5_wq_ll *wq = &rq->wq;
+        struct mlx5e_rx_wqe *wqe;
+        __be16 wqe_ix_be;
+        u16 wqe_ix;
+        /* UMR WQE (if in progress) is always at wq->head */
+        if (test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
+                mlx5e_free_rx_fragmented_mpwqe(rq, &rq->wqe_info[wq->head]);
+        while (!mlx5_wq_ll_is_empty(wq)) {
+                wqe_ix_be = *wq->tail_next;
+                wqe_ix    = be16_to_cpu(wqe_ix_be);
+                wqe       = mlx5_wq_ll_get_wqe(&rq->wq, wqe_ix);
+                rq->dealloc_wqe(rq, wqe_ix);
+                mlx5_wq_ll_pop(&rq->wq, wqe_ix_be,
+                               &wqe->next.next_wqe_index);
+        }
+}
 static int mlx5e_open_rq(struct mlx5e_channel *c,
                         struct mlx5e_rq_param *param,
                         struct mlx5e_rq *rq)
@@ -548,8 +565,6 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
        if (param->am_enabled)
                set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
-        set_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state);
        sq->ico_wqe_info[pi].opcode     = MLX5_OPCODE_NOP;
        sq->ico_wqe_info[pi].num_wqebbs = 1;
        mlx5e_send_nop(sq, true); /* trigger mlx5e_post_rx_wqes() */
@@ -566,23 +581,8 @@ err_destroy_rq:
 static void mlx5e_close_rq(struct mlx5e_rq *rq)
 {
-        int tout = 0;
+        set_bit(MLX5E_RQ_STATE_FLUSH, &rq->state);
-        int err;
-        clear_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state);
        napi_synchronize(&rq->channel->napi); /* prevent mlx5e_post_rx_wqes */
-        err = mlx5e_modify_rq_state(rq, MLX5_RQC_STATE_RDY, MLX5_RQC_STATE_ERR);
-        while (!mlx5_wq_ll_is_empty(&rq->wq) && !err &&
-               tout++ < MLX5_EN_QP_FLUSH_MAX_ITER)
-                msleep(MLX5_EN_QP_FLUSH_MSLEEP_QUANT);
-        if (err || tout == MLX5_EN_QP_FLUSH_MAX_ITER)
-                set_bit(MLX5E_RQ_STATE_FLUSH_TIMEOUT, &rq->state);
-        /* avoid destroying rq before mlx5e_poll_rx_cq() is done with it */
-        napi_synchronize(&rq->channel->napi);
        cancel_work_sync(&rq->am.work);
        mlx5e_disable_rq(rq);
@@ -821,7 +821,6 @@ static int mlx5e_open_sq(struct mlx5e_channel *c,
                goto err_disable_sq;
        if (sq->txq) {
-                set_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state);
                netdev_tx_reset_queue(sq->txq);
                netif_tx_start_queue(sq->txq);
        }
@@ -845,38 +844,20 @@ static inline void netif_tx_disable_queue(struct netdev_queue *txq)
 static void mlx5e_close_sq(struct mlx5e_sq *sq)
 {
-        int tout = 0;
+        set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
-        int err;
+        /* prevent netif_tx_wake_queue */
+        napi_synchronize(&sq->channel->napi);
        if (sq->txq) {
-                clear_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state);
-                /* prevent netif_tx_wake_queue */
-                napi_synchronize(&sq->channel->napi);
                netif_tx_disable_queue(sq->txq);
-                /* ensure hw is notified of all pending wqes */
+                /* last doorbell out, godspeed .. */
                if (mlx5e_sq_has_room_for(sq, 1))
                        mlx5e_send_nop(sq, true);
-                err = mlx5e_modify_sq(sq, MLX5_SQC_STATE_RDY,
-                                      MLX5_SQC_STATE_ERR, false, 0);
-                if (err)
-                        set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
-        }
-        /* wait till sq is empty, unless a TX timeout occurred on this SQ */
-        while (sq->cc != sq->pc &&
-               !test_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state)) {
-                msleep(MLX5_EN_QP_FLUSH_MSLEEP_QUANT);
-                if (tout++ > MLX5_EN_QP_FLUSH_MAX_ITER)
-                        set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
        }
-        /* avoid destroying sq before mlx5e_poll_tx_cq() is done with it */
-        napi_synchronize(&sq->channel->napi);
-        mlx5e_free_tx_descs(sq);
        mlx5e_disable_sq(sq);
+        mlx5e_free_tx_descs(sq);
        mlx5e_destroy_sq(sq);
 }
@@ -1826,10 +1807,6 @@ int mlx5e_open_locked(struct net_device *netdev)
        netif_set_real_num_tx_queues(netdev, num_txqs);
        netif_set_real_num_rx_queues(netdev, priv->params.num_channels);
-        err = mlx5e_set_dev_port_mtu(netdev);
-        if (err)
-                goto err_clear_state_opened_flag;
        err = mlx5e_open_channels(priv);
        if (err) {
                netdev_err(netdev, "%s: mlx5e_open_channels failed, %d\n",
@@ -2573,6 +2550,7 @@ static int mlx5e_change_mtu(struct net_device *netdev, int new_mtu)
        u16 max_mtu;
        u16 min_mtu;
        int err = 0;
+        bool reset;
        mlx5_query_port_max_mtu(mdev, &max_mtu, 1);
@@ -2588,13 +2566,18 @@ static int mlx5e_change_mtu(struct net_device *netdev, int new_mtu)
        mutex_lock(&priv->state_lock);
+        reset = !priv->params.lro_en &&
+                (priv->params.rq_wq_type !=
+                 MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ);
        was_opened = test_bit(MLX5E_STATE_OPENED, &priv->state);
-        if (was_opened)
+        if (was_opened && reset)
                mlx5e_close_locked(netdev);
        netdev->mtu = new_mtu;
+        mlx5e_set_dev_port_mtu(netdev);
-        if (was_opened)
+        if (was_opened && reset)
                err = mlx5e_open_locked(netdev);
        mutex_unlock(&priv->state_lock);
@@ -2794,7 +2777,7 @@ static void mlx5e_tx_timeout(struct net_device *dev)
                if (!netif_xmit_stopped(netdev_get_tx_queue(dev, i)))
                        continue;
                sched_work = true;
-                set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
+                set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
                netdev_err(dev, "TX timeout on queue: %d, SQ: 0x%x, CQ: 0x%x, SQ Cons: 0x%x SQ Prod: 0x%x\n",
                           i, sq->sqn, sq->cq.mcq.cqn, sq->cc, sq->pc);
        }
@@ -3231,8 +3214,8 @@ static int mlx5e_create_umr_mkey(struct mlx5e_priv *priv)
        struct mlx5_create_mkey_mbox_in *in;
        struct mlx5_mkey_seg *mkc;
        int inlen = sizeof(*in);
-        u64 npages =
+        u64 npages = MLX5E_REQUIRED_MTTS(priv->profile->max_nch(mdev),
-                priv->profile->max_nch(mdev) * MLX5_CHANNEL_MAX_NUM_MTTS;
+                                         BIT(MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW));
        int err;
        in = mlx5_vzalloc(inlen);
@@ -3246,10 +3229,12 @@ static int mlx5e_create_umr_mkey(struct mlx5e_priv *priv)
                     MLX5_PERM_LOCAL_WRITE |
                     MLX5_ACCESS_MODE_MTT;
+        npages = min_t(u32, ALIGN(U16_MAX, 4) * 2, npages);
        mkc->qpn_mkey7_0 = cpu_to_be32(0xffffff << 8);
        mkc->flags_pd = cpu_to_be32(mdev->mlx5e_res.pdn);
        mkc->len = cpu_to_be64(npages << PAGE_SHIFT);
-        mkc->xlt_oct_size = cpu_to_be32(mlx5e_get_mtt_octw(npages));
+        mkc->xlt_oct_size = cpu_to_be32(MLX5_MTT_OCTW(npages));
        mkc->log2_page_size = PAGE_SHIFT;
        err = mlx5_core_create_mkey(mdev, &priv->umr_mkey, in, inlen, NULL,
@@ -3385,6 +3370,7 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv)
        queue_work(priv->wq, &priv->set_rx_mode_work);
        if (MLX5_CAP_GEN(mdev, vport_group_manager)) {
+                mlx5_query_nic_vport_mac_address(mdev, 0, rep.hw_id);
                rep.load = mlx5e_nic_rep_load;
                rep.unload = mlx5e_nic_rep_unload;
                rep.vport = 0;
@@ -3463,6 +3449,8 @@ void *mlx5e_create_netdev(struct mlx5_core_dev *mdev,
        mlx5e_init_l2_addr(priv);
+        mlx5e_set_dev_port_mtu(netdev);
        err = register_netdev(netdev);
        if (err) {
                mlx5_core_err(mdev, "register_netdev failed, %d\n", err);
@@ -3501,16 +3489,20 @@ static void mlx5e_register_vport_rep(struct mlx5_core_dev *mdev)
        struct mlx5_eswitch *esw = mdev->priv.eswitch;
        int total_vfs = MLX5_TOTAL_VPORTS(mdev);
        int vport;
+        u8 mac[ETH_ALEN];
        if (!MLX5_CAP_GEN(mdev, vport_group_manager))
                return;
+        mlx5_query_nic_vport_mac_address(mdev, 0, mac);
        for (vport = 1; vport < total_vfs; vport++) {
                struct mlx5_eswitch_rep rep;
                rep.load = mlx5e_vport_rep_load;
                rep.unload = mlx5e_vport_rep_unload;
                rep.vport = vport;
+                ether_addr_copy(rep.hw_id, mac);
                mlx5_eswitch_register_vport_rep(esw, &rep);
        }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 1c7d8b8314bf..134de4a11f1d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -135,17 +135,16 @@ static const struct ethtool_ops mlx5e_rep_ethtool_ops = {
 int mlx5e_attr_get(struct net_device *dev, struct switchdev_attr *attr)
 {
        struct mlx5e_priv *priv = netdev_priv(dev);
+        struct mlx5_eswitch_rep *rep = priv->ppriv;
        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
-        u8 mac[ETH_ALEN];
        if (esw->mode == SRIOV_NONE)
                return -EOPNOTSUPP;
        switch (attr->id) {
        case SWITCHDEV_ATTR_ID_PORT_PARENT_ID:
-                mlx5_query_nic_vport_mac_address(priv->mdev, 0, mac);
                attr->u.ppid.id_len = ETH_ALEN;
-                memcpy(&attr->u.ppid.id, &mac, ETH_ALEN);
+                ether_addr_copy(attr->u.ppid.id, rep->hw_id);
                break;
        default:
                return -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 9f2a16a507e0..b6f8ebbdb487 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -324,9 +324,9 @@ mlx5e_copy_skb_header_fragmented_mpwqe(struct device *pdev,
        }
 }
-static u16 mlx5e_get_wqe_mtt_offset(u16 rq_ix, u16 wqe_ix)
+static u32 mlx5e_get_wqe_mtt_offset(struct mlx5e_rq *rq, u16 wqe_ix)
 {
-        return rq_ix * MLX5_CHANNEL_MAX_NUM_MTTS +
+        return rq->mpwqe_mtt_offset +
                wqe_ix * ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8);
 }
@@ -340,7 +340,7 @@ static void mlx5e_build_umr_wqe(struct mlx5e_rq *rq,
        struct mlx5_wqe_data_seg      *dseg = &wqe->data;
        struct mlx5e_mpw_info *wi = &rq->wqe_info[ix];
        u8 ds_cnt = DIV_ROUND_UP(sizeof(*wqe), MLX5_SEND_WQE_DS);
-        u16 umr_wqe_mtt_offset = mlx5e_get_wqe_mtt_offset(rq->ix, ix);
+        u32 umr_wqe_mtt_offset = mlx5e_get_wqe_mtt_offset(rq, ix);
        memset(wqe, 0, sizeof(*wqe));
        cseg->opmod_idx_opcode =
@@ -353,9 +353,9 @@ static void mlx5e_build_umr_wqe(struct mlx5e_rq *rq,
        ucseg->flags = MLX5_UMR_TRANSLATION_OFFSET_EN;
        ucseg->klm_octowords =
-                cpu_to_be16(mlx5e_get_mtt_octw(MLX5_MPWRQ_PAGES_PER_WQE));
+                cpu_to_be16(MLX5_MTT_OCTW(MLX5_MPWRQ_PAGES_PER_WQE));
        ucseg->bsf_octowords =
-                cpu_to_be16(mlx5e_get_mtt_octw(umr_wqe_mtt_offset));
+                cpu_to_be16(MLX5_MTT_OCTW(umr_wqe_mtt_offset));
        ucseg->mkey_mask     = cpu_to_be64(MLX5_MKEY_MASK_FREE);
        dseg->lkey = sq->mkey_be;
@@ -423,7 +423,7 @@ static int mlx5e_alloc_rx_fragmented_mpwqe(struct mlx5e_rq *rq,
 {
        struct mlx5e_mpw_info *wi = &rq->wqe_info[ix];
        int mtt_sz = mlx5e_get_wqe_mtt_sz();
-        u32 dma_offset = mlx5e_get_wqe_mtt_offset(rq->ix, ix) << PAGE_SHIFT;
+        u64 dma_offset = (u64)mlx5e_get_wqe_mtt_offset(rq, ix) << PAGE_SHIFT;
        int i;
        wi->umr.dma_info = kmalloc(sizeof(*wi->umr.dma_info) *
@@ -506,6 +506,12 @@ void mlx5e_post_rx_fragmented_mpwqe(struct mlx5e_rq *rq)
        struct mlx5e_rx_wqe *wqe = mlx5_wq_ll_get_wqe(wq, wq->head);
        clear_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state);
+        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state))) {
+                mlx5e_free_rx_fragmented_mpwqe(rq, &rq->wqe_info[wq->head]);
+                return;
+        }
        mlx5_wq_ll_push(wq, be16_to_cpu(wqe->next.next_wqe_index));
        rq->stats.mpwqe_frag++;
@@ -595,26 +601,9 @@ void mlx5e_dealloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)
        wi->free_wqe(rq, wi);
 }
-void mlx5e_free_rx_descs(struct mlx5e_rq *rq)
-{
-        struct mlx5_wq_ll *wq = &rq->wq;
-        struct mlx5e_rx_wqe *wqe;
-        __be16 wqe_ix_be;
-        u16 wqe_ix;
-        while (!mlx5_wq_ll_is_empty(wq)) {
-                wqe_ix_be = *wq->tail_next;
-                wqe_ix    = be16_to_cpu(wqe_ix_be);
-                wqe       = mlx5_wq_ll_get_wqe(&rq->wq, wqe_ix);
-                rq->dealloc_wqe(rq, wqe_ix);
-                mlx5_wq_ll_pop(&rq->wq, wqe_ix_be,
-                               &wqe->next.next_wqe_index);
-        }
-}
 #define RQ_CANNOT_POST(rq) \
-                (!test_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state) || \
+        (test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state) || \
-                 test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
+         test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
 bool mlx5e_post_rx_wqes(struct mlx5e_rq *rq)
 {
@@ -916,7 +905,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
        struct mlx5e_rq *rq = container_of(cq, struct mlx5e_rq, cq);
        int work_done = 0;
-        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH_TIMEOUT, &rq->state)))
+        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state)))
                return 0;
        if (cq->decmprs_left)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 7b9d8a989b52..499487ce3b53 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -70,6 +70,7 @@ struct mlx5e_sw_stats {
        u64 tx_queue_stopped;
        u64 tx_queue_wake;
        u64 tx_queue_dropped;
+        u64 tx_xmit_more;
        u64 rx_wqe_err;
        u64 rx_mpwqe_filler;
        u64 rx_mpwqe_frag;
@@ -101,6 +102,7 @@ static const struct counter_desc sw_stats_desc[] = {
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_stopped) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_wake) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_dropped) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_xmit_more) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_wqe_err) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_frag) },
@@ -298,6 +300,7 @@ struct mlx5e_sq_stats {
        /* commonly accessed in data path */
        u64 packets;
        u64 bytes;
+        u64 xmit_more;
        u64 tso_packets;
        u64 tso_bytes;
        u64 tso_inner_packets;
@@ -324,6 +327,7 @@ static const struct counter_desc sq_stats_desc[] = {
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, stopped) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, wake) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, dropped) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, xmit_more) },
 };
 #define NUM_SW_COUNTERS                 ARRAY_SIZE(sw_stats_desc)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index dc8b1cb0fdc8..22cfc4ac1837 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -170,7 +170,7 @@ static int parse_cls_flower(struct mlx5e_priv *priv, struct mlx5_flow_spec *spec
        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CONTROL)) {
                struct flow_dissector_key_control *key =
                        skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_CONTROL,
                                                  f->key);
                addr_type = key->addr_type;
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index e073bf59890d..988eca99ee0f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -375,6 +375,7 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
        sq->stats.packets++;
        sq->stats.bytes += num_bytes;
+        sq->stats.xmit_more += skb->xmit_more;
        return NETDEV_TX_OK;
 dma_unmap_wqe_err:
@@ -394,35 +395,6 @@ netdev_tx_t mlx5e_xmit(struct sk_buff *skb, struct net_device *dev)
        return mlx5e_sq_xmit(sq, skb);
 }
-void mlx5e_free_tx_descs(struct mlx5e_sq *sq)
-{
-        struct mlx5e_tx_wqe_info *wi;
-        struct sk_buff *skb;
-        u16 ci;
-        int i;
-        while (sq->cc != sq->pc) {
-                ci = sq->cc & sq->wq.sz_m1;
-                skb = sq->skb[ci];
-                wi = &sq->wqe_info[ci];
-                if (!skb) { /* nop */
-                        sq->cc++;
-                        continue;
-                }
-                for (i = 0; i < wi->num_dma; i++) {
-                        struct mlx5e_sq_dma *dma =
-                                mlx5e_dma_get(sq, sq->dma_fifo_cc++);
-                        mlx5e_tx_dma_unmap(sq->pdev, dma);
-                }
-                dev_kfree_skb_any(skb);
-                sq->cc += wi->num_wqebbs;
-        }
-}
 bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
 {
        struct mlx5e_sq *sq;
@@ -434,7 +406,7 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
        sq = container_of(cq, struct mlx5e_sq, cq);
-        if (unlikely(test_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state)))
+        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
                return false;
        npkts = 0;
@@ -512,11 +484,39 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
        netdev_tx_completed_queue(sq->txq, npkts, nbytes);
        if (netif_tx_queue_stopped(sq->txq) &&
-            mlx5e_sq_has_room_for(sq, MLX5E_SQ_STOP_ROOM) &&
+            mlx5e_sq_has_room_for(sq, MLX5E_SQ_STOP_ROOM)) {
-            likely(test_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state))) {
+                netif_tx_wake_queue(sq->txq);
-                                netif_tx_wake_queue(sq->txq);
+                sq->stats.wake++;
-                                sq->stats.wake++;
        }
        return (i == MLX5E_TX_CQ_POLL_BUDGET);
 }
+void mlx5e_free_tx_descs(struct mlx5e_sq *sq)
+{
+        struct mlx5e_tx_wqe_info *wi;
+        struct sk_buff *skb;
+        u16 ci;
+        int i;
+        while (sq->cc != sq->pc) {
+                ci = sq->cc & sq->wq.sz_m1;
+                skb = sq->skb[ci];
+                wi = &sq->wqe_info[ci];
+                if (!skb) { /* nop */
+                        sq->cc++;
+                        continue;
+                }
+                for (i = 0; i < wi->num_dma; i++) {
+                        struct mlx5e_sq_dma *dma =
+                                mlx5e_dma_get(sq, sq->dma_fifo_cc++);
+                        mlx5e_tx_dma_unmap(sq->pdev, dma);
+                }
+                dev_kfree_skb_any(skb);
+                sq->cc += wi->num_wqebbs;
+        }
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
index 64ae2e800daa..9bf33bb69210 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
@@ -51,16 +51,18 @@ struct mlx5_cqe64 *mlx5e_get_cqe(struct mlx5e_cq *cq)
 static void mlx5e_poll_ico_cq(struct mlx5e_cq *cq)
 {
+        struct mlx5e_sq *sq = container_of(cq, struct mlx5e_sq, cq);
        struct mlx5_wq_cyc *wq;
        struct mlx5_cqe64 *cqe;
-        struct mlx5e_sq *sq;
        u16 sqcc;
+        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
+                return;
        cqe = mlx5e_get_cqe(cq);
        if (likely(!cqe))
                return;
-        sq = container_of(cq, struct mlx5e_sq, cq);
        wq = &sq->wq;
        /* sq->cc must be updated only after mlx5_cqwq_update_db_record(),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index f6d667797ee1..8b78f156214e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1451,7 +1451,8 @@ static void esw_enable_vport(struct mlx5_eswitch *esw, int vport_num,
        esw_debug(esw->dev, "Enabling VPORT(%d)\n", vport_num);
-        if (vport_num) { /* Only VFs need ACLs for VST and spoofchk filtering */
+        /* Only VFs need ACLs for VST and spoofchk filtering */
+        if (vport_num && esw->mode == SRIOV_LEGACY) {
                esw_vport_ingress_config(esw, vport);
                esw_vport_egress_config(esw, vport);
        }
@@ -1502,7 +1503,7 @@ static void esw_disable_vport(struct mlx5_eswitch *esw, int vport_num)
         */
        esw_vport_change_handle_locked(vport);
        vport->enabled_events = 0;
-        if (vport_num) {
+        if (vport_num && esw->mode == SRIOV_LEGACY) {
                esw_vport_disable_egress_acl(esw, vport);
                esw_vport_disable_ingress_acl(esw, vport);
        }
@@ -1767,7 +1768,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
                               vport, err);
        mutex_lock(&esw->state_lock);
-        if (evport->enabled)
+        if (evport->enabled && esw->mode == SRIOV_LEGACY)
                err = esw_vport_ingress_config(esw, evport);
        mutex_unlock(&esw->state_lock);
        return err;
@@ -1839,7 +1840,7 @@ int mlx5_eswitch_set_vport_vlan(struct mlx5_eswitch *esw,
        mutex_lock(&esw->state_lock);
        evport->vlan = vlan;
        evport->qos = qos;
-        if (evport->enabled) {
+        if (evport->enabled && esw->mode == SRIOV_LEGACY) {
                err = esw_vport_ingress_config(esw, evport);
                if (err)
                        goto out;
@@ -1868,10 +1869,11 @@ int mlx5_eswitch_set_vport_spoofchk(struct mlx5_eswitch *esw,
        mutex_lock(&esw->state_lock);
        pschk = evport->spoofchk;
        evport->spoofchk = spoofchk;
-        if (evport->enabled)
+        if (evport->enabled && esw->mode == SRIOV_LEGACY) {
                err = esw_vport_ingress_config(esw, evport);
-        if (err)
+                if (err)
-                evport->spoofchk = pschk;
+                        evport->spoofchk = pschk;
+        }
        mutex_unlock(&esw->state_lock);
        return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index c0b05603fc31..a96140971d77 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -174,6 +174,7 @@ struct mlx5_eswitch_rep {
        void                  *priv_data;
        struct list_head       vport_sqs_list;
        bool                   valid;
+        u8                     hw_id[ETH_ALEN];
 };
 struct mlx5_esw_offload {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index a357e8eeeed8..3dc83a9459a4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -113,7 +113,7 @@ mlx5_eswitch_add_send_to_vport_rule(struct mlx5_eswitch *esw, int vport, u32 sqn
        dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
        dest.vport_num = vport;
-        flow_rule = mlx5_add_flow_rule(esw->fdb_table.fdb, spec,
+        flow_rule = mlx5_add_flow_rule(esw->fdb_table.offloads.fdb, spec,
                                       MLX5_FLOW_CONTEXT_ACTION_FWD_DEST,
                                       0, &dest);
        if (IS_ERR(flow_rule))
@@ -535,7 +535,7 @@ void esw_offloads_cleanup(struct mlx5_eswitch *esw, int nvports)
        esw_destroy_offloads_fdb_table(esw);
 }
-static int mlx5_esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
+static int esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
 {
        switch (mode) {
        case DEVLINK_ESWITCH_MODE_LEGACY:
@@ -551,6 +551,22 @@ static int mlx5_esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
        return 0;
 }
+static int esw_mode_to_devlink(u16 mlx5_mode, u16 *mode)
+{
+        switch (mlx5_mode) {
+        case SRIOV_LEGACY:
+                *mode = DEVLINK_ESWITCH_MODE_LEGACY;
+                break;
+        case SRIOV_OFFLOADS:
+                *mode = DEVLINK_ESWITCH_MODE_SWITCHDEV;
+                break;
+        default:
+                return -EINVAL;
+        }
+        return 0;
+}
 int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
 {
        struct mlx5_core_dev *dev;
@@ -566,7 +582,7 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
        if (cur_mlx5_mode == SRIOV_NONE)
                return -EOPNOTSUPP;
-        if (mlx5_esw_mode_from_devlink(mode, &mlx5_mode))
+        if (esw_mode_from_devlink(mode, &mlx5_mode))
                return -EINVAL;
        if (cur_mlx5_mode == mlx5_mode)
@@ -592,9 +608,7 @@ int mlx5_devlink_eswitch_mode_get(struct devlink *devlink, u16 *mode)
        if (dev->priv.eswitch->mode == SRIOV_NONE)
                return -EOPNOTSUPP;
-        *mode = dev->priv.eswitch->mode;
+        return esw_mode_to_devlink(dev->priv.eswitch->mode, mode);
-        return 0;
 }
 void mlx5_eswitch_register_vport_rep(struct mlx5_eswitch *esw,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 75bb8c864557..3d6c1f65e586 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -80,7 +80,7 @@
                           LEFTOVERS_NUM_PRIOS)
 #define ETHTOOL_PRIO_NUM_LEVELS 1
-#define ETHTOOL_NUM_PRIOS 10
+#define ETHTOOL_NUM_PRIOS 11
 #define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)
 /* Vlan, mac, ttc, aRFS */
 #define KERNEL_NIC_PRIO_NUM_LEVELS 4
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
index c2877e9de8a1..3a9195b4169d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
@@ -126,12 +126,21 @@ static struct rb_node *mlx5_fc_stats_query(struct mlx5_core_dev *dev,
        for (node = &first->node; node; node = rb_next(node)) {
                struct mlx5_fc *counter = rb_entry(node, struct mlx5_fc, node);
                struct mlx5_fc_cache *c = &counter->cache;
+                u64 packets;
+                u64 bytes;
                if (counter->id > last_id)
                        break;
                mlx5_cmd_fc_bulk_get(dev, b,
-                                     counter->id, &c->packets, &c->bytes);
+                                     counter->id, &packets, &bytes);
+                if (c->packets == packets)
+                        continue;
+                c->packets = packets;
+                c->bytes = bytes;
+                c->lastuse = jiffies;
        }
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 4f491d43e77d..2385bae92672 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1420,36 +1420,12 @@ static pci_ers_result_t mlx5_pci_err_detected(struct pci_dev *pdev,
        dev_info(&pdev->dev, "%s was called\n", __func__);
        mlx5_enter_error_state(dev);
        mlx5_unload_one(dev, priv);
+        pci_save_state(pdev);
        mlx5_pci_disable_device(dev);
        return state == pci_channel_io_perm_failure ?
                PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET;
 }
-static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
-{
-        struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
-        int err = 0;
-        dev_info(&pdev->dev, "%s was called\n", __func__);
-        err = mlx5_pci_enable_device(dev);
-        if (err) {
-                dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
-                        , __func__, err);
-                return PCI_ERS_RESULT_DISCONNECT;
-        }
-        pci_set_master(pdev);
-        pci_set_power_state(pdev, PCI_D0);
-        pci_restore_state(pdev);
-        return err ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED;
-}
-void mlx5_disable_device(struct mlx5_core_dev *dev)
-{
-        mlx5_pci_err_detected(dev->pdev, 0);
-}
 /* wait for the device to show vital signs by waiting
 * for the health counter to start counting.
 */
@@ -1477,21 +1453,44 @@ static int wait_vital(struct pci_dev *pdev)
        return -ETIMEDOUT;
 }
-static void mlx5_pci_resume(struct pci_dev *pdev)
+static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
 {
        struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
-        struct mlx5_priv *priv = &dev->priv;
        int err;
        dev_info(&pdev->dev, "%s was called\n", __func__);
-        pci_save_state(pdev);
+        err = mlx5_pci_enable_device(dev);
-        err = wait_vital(pdev);
        if (err) {
+                dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
+                        , __func__, err);
+                return PCI_ERS_RESULT_DISCONNECT;
+        }
+        pci_set_master(pdev);
+        pci_restore_state(pdev);
+        if (wait_vital(pdev)) {
                dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__);
-                return;
+                return PCI_ERS_RESULT_DISCONNECT;
        }
+        return PCI_ERS_RESULT_RECOVERED;
+}
+void mlx5_disable_device(struct mlx5_core_dev *dev)
+{
+        mlx5_pci_err_detected(dev->pdev, 0);
+}
+static void mlx5_pci_resume(struct pci_dev *pdev)
+{
+        struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
+        struct mlx5_priv *priv = &dev->priv;
+        int err;
+        dev_info(&pdev->dev, "%s was called\n", __func__);
        err = mlx5_load_one(dev, priv);
        if (err)
                dev_err(&pdev->dev, "%s: mlx5_load_one failed with error code: %d\n"
diff --git a/drivers/net/ethernet/mellanox/mlxsw/port.h b/drivers/net/ethernet/mellanox/mlxsw/port.h
index f33b997f2b61..af371a82c35b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/port.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/port.h
@@ -56,6 +56,7 @@
 #define MLXSW_PORT_PHY_BITS_MASK        (MLXSW_PORT_MAX_PHY_PORTS - 1)
 #define MLXSW_PORT_CPU_PORT             0x0
+#define MLXSW_PORT_ROUTER_PORT          (MLXSW_PORT_MAX_PHY_PORTS + 2)
 #define MLXSW_PORT_DONT_CARE            (MLXSW_PORT_MAX_PORTS)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 1f8168906811..7291f2c4b0c7 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -3324,6 +3324,39 @@ static struct mlxsw_sp_fid *mlxsw_sp_bridge_fid_get(struct mlxsw_sp *mlxsw_sp,
        return mlxsw_sp_fid_find(mlxsw_sp, fid);
 }
+static enum mlxsw_flood_table_type mlxsw_sp_flood_table_type_get(u16 fid)
+{
+        return mlxsw_sp_fid_is_vfid(fid) ? MLXSW_REG_SFGC_TABLE_TYPE_FID :
+               MLXSW_REG_SFGC_TABLE_TYPE_FID_OFFEST;
+}
+static u16 mlxsw_sp_flood_table_index_get(u16 fid)
+{
+        return mlxsw_sp_fid_is_vfid(fid) ? mlxsw_sp_fid_to_vfid(fid) : fid;
+}
+static int mlxsw_sp_router_port_flood_set(struct mlxsw_sp *mlxsw_sp, u16 fid,
+                                          bool set)
+{
+        enum mlxsw_flood_table_type table_type;
+        char *sftr_pl;
+        u16 index;
+        int err;
+        sftr_pl = kmalloc(MLXSW_REG_SFTR_LEN, GFP_KERNEL);
+        if (!sftr_pl)
+                return -ENOMEM;
+        table_type = mlxsw_sp_flood_table_type_get(fid);
+        index = mlxsw_sp_flood_table_index_get(fid);
+        mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_BM, index, table_type,
+                            1, MLXSW_PORT_ROUTER_PORT, set);
+        err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
+        kfree(sftr_pl);
+        return err;
+}
 static enum mlxsw_reg_ritr_if_type mlxsw_sp_rif_type_get(u16 fid)
 {
        if (mlxsw_sp_fid_is_vfid(fid))
@@ -3360,10 +3393,14 @@ static int mlxsw_sp_rif_bridge_create(struct mlxsw_sp *mlxsw_sp,
        if (rif == MLXSW_SP_RIF_MAX)
                return -ERANGE;
-        err = mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, true);
+        err = mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, true);
        if (err)
                return err;
+        err = mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, true);
+        if (err)
+                goto err_rif_bridge_op;
        err = mlxsw_sp_rif_fdb_op(mlxsw_sp, l3_dev->dev_addr, f->fid, true);
        if (err)
                goto err_rif_fdb_op;
@@ -3385,6 +3422,8 @@ err_rif_alloc:
        mlxsw_sp_rif_fdb_op(mlxsw_sp, l3_dev->dev_addr, f->fid, false);
 err_rif_fdb_op:
        mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, false);
+err_rif_bridge_op:
+        mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, false);
        return err;
 }
@@ -3404,6 +3443,8 @@ void mlxsw_sp_rif_bridge_destroy(struct mlxsw_sp *mlxsw_sp,
        mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, false);
+        mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, false);
        netdev_dbg(l3_dev, "RIF=%d destroyed\n", rif);
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 237418a0e6e0..953b214f38d0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -717,22 +717,18 @@ int mlxsw_sp_sb_tc_pool_bind_set(struct mlxsw_core_port *mlxsw_core_port,
        u8 local_port = mlxsw_sp_port->local_port;
        u8 pg_buff = tc_index;
        enum mlxsw_reg_sbxx_dir dir = pool_type;
-        u8 pool = pool_index;
+        u8 pool = pool_get(pool_index);
        u32 max_buff;
        int err;
+        if (dir != dir_get(pool_index))
+                return -EINVAL;
        err = mlxsw_sp_sb_threshold_in(mlxsw_sp, pool, dir,
                                       threshold, &max_buff);
        if (err)
                return err;
-        if (pool_type == DEVLINK_SB_POOL_TYPE_EGRESS) {
-                if (pool < MLXSW_SP_SB_POOL_COUNT)
-                        return -EINVAL;
-                pool -= MLXSW_SP_SB_POOL_COUNT;
-        } else if (pool >= MLXSW_SP_SB_POOL_COUNT) {
-                return -EINVAL;
-        }
        return mlxsw_sp_sb_cm_write(mlxsw_sp, local_port, pg_buff, dir,
                                    0, max_buff, pool);
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 90bb93b037ec..917ddd1e422f 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -657,7 +657,7 @@ int mlxsw_sp_router_neigh_construct(struct net_device *dev,
                return 0;
        }
-        r = mlxsw_sp_rif_find_by_dev(mlxsw_sp, dev);
+        r = mlxsw_sp_rif_find_by_dev(mlxsw_sp, n->dev);
        if (WARN_ON(!r))
                return -EINVAL;
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index 4d4ecba0aad9..8e13ec84c538 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -475,14 +475,6 @@ static void __lpc_get_mac(struct netdata_local *pldat, u8 *mac)
        mac[5] = tmp >> 8;
 }
-static void __lpc_eth_clock_enable(struct netdata_local *pldat, bool enable)
-{
-        if (enable)
-                clk_prepare_enable(pldat->clk);
-        else
-                clk_disable_unprepare(pldat->clk);
-}
 static void __lpc_params_setup(struct netdata_local *pldat)
 {
        u32 tmp;
@@ -1056,7 +1048,7 @@ static int lpc_eth_close(struct net_device *ndev)
        writel(0, LPC_ENET_MAC2(pldat->net_base));
        spin_unlock_irqrestore(&pldat->lock, flags);
-        __lpc_eth_clock_enable(pldat, false);
+        clk_disable_unprepare(pldat->clk);
        return 0;
 }
@@ -1197,11 +1189,14 @@ static int lpc_eth_ioctl(struct net_device *ndev, struct ifreq *req, int cmd)
 static int lpc_eth_open(struct net_device *ndev)
 {
        struct netdata_local *pldat = netdev_priv(ndev);
+        int ret;
        if (netif_msg_ifup(pldat))
                dev_dbg(&pldat->pdev->dev, "enabling %s\n", ndev->name);
-        __lpc_eth_clock_enable(pldat, true);
+        ret = clk_prepare_enable(pldat->clk);
+        if (ret)
+                return ret;
        /* Suspended PHY makes LPC ethernet core block, so resume now */
        phy_resume(ndev->phydev);
@@ -1320,7 +1315,9 @@ static int lpc_eth_drv_probe(struct platform_device *pdev)
        }
        /* Enable network clock */
-        __lpc_eth_clock_enable(pldat, true);
+        ret = clk_prepare_enable(pldat->clk);
+        if (ret)
+                goto err_out_clk_put;
        /* Map IO space */
        pldat->net_base = ioremap(res->start, resource_size(res));
@@ -1454,6 +1451,7 @@ err_out_iounmap:
        iounmap(pldat->net_base);
 err_out_disable_clocks:
        clk_disable_unprepare(pldat->clk);
+err_out_clk_put:
        clk_put(pldat->clk);
 err_out_free_dev:
        free_netdev(ndev);
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 35e53771533f..45ab74676573 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -561,9 +561,18 @@ struct qed_dev {
 static inline u8 qed_concrete_to_sw_fid(struct qed_dev *cdev,
                                        u32 concrete_fid)
 {
+        u8 vfid = GET_FIELD(concrete_fid, PXP_CONCRETE_FID_VFID);
        u8 pfid = GET_FIELD(concrete_fid, PXP_CONCRETE_FID_PFID);
+        u8 vf_valid = GET_FIELD(concrete_fid,
+                                PXP_CONCRETE_FID_VFVALID);
+        u8 sw_fid;
-        return pfid;
+        if (vf_valid)
+                sw_fid = vfid + MAX_NUM_PFS;
+        else
+                sw_fid = pfid;
+        return sw_fid;
 }
 #define PURE_LB_TC 8
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index e4bd02e46e57..a6eb6af8cbe8 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -722,11 +722,14 @@ netdev_tx_t qede_start_xmit(struct sk_buff *skb,
        txq->tx_db.data.bd_prod =
                cpu_to_le16(qed_chain_get_prod_idx(&txq->tx_pbl));
-        if (!skb->xmit_more || netif_tx_queue_stopped(netdev_txq))
+        if (!skb->xmit_more || netif_xmit_stopped(netdev_txq))
                qede_update_tx_producer(txq);
        if (unlikely(qed_chain_get_elem_left(&txq->tx_pbl)
                      < (MAX_SKB_FRAGS + 1))) {
+                if (skb->xmit_more)
+                        qede_update_tx_producer(txq);
                netif_tx_stop_queue(netdev_txq);
                DP_VERBOSE(edev, NETIF_MSG_TX_QUEUED,
                           "Stop queue was called\n");
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index deae10d7426d..5297bf77211c 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -467,8 +467,8 @@ static int cp_rx_poll(struct napi_struct *napi, int budget)
        unsigned int rx_tail = cp->rx_tail;
        int rx;
-rx_status_loop:
        rx = 0;
+rx_status_loop:
        cpw16(IntrStatus, cp_rx_intr_mask);
        while (rx < budget) {
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index f658fee74f18..e00a669e9e09 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -1517,13 +1517,14 @@ static void efx_ef10_get_stat_mask(struct efx_nic *efx, unsigned long *mask)
        }
 #if BITS_PER_LONG == 64
+        BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 2);
        mask[0] = raw_mask[0];
        mask[1] = raw_mask[1];
 #else
+        BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 3);
        mask[0] = raw_mask[0] & 0xffffffff;
        mask[1] = raw_mask[0] >> 32;
        mask[2] = raw_mask[1] & 0xffffffff;
-        mask[3] = raw_mask[1] >> 32;
 #endif
 }
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 726b80f45906..503a3b6dce91 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2275,6 +2275,13 @@ static int smc_drv_probe(struct platform_device *pdev)
        if (pd) {
                memcpy(&lp->cfg, pd, sizeof(lp->cfg));
                lp->io_shift = SMC91X_IO_SHIFT(lp->cfg.flags);
+                if (!SMC_8BIT(lp) && !SMC_16BIT(lp)) {
+                        dev_err(&pdev->dev,
+                                "at least one of 8-bit or 16-bit access support is required.\n");
+                        ret = -ENXIO;
+                        goto out_free_netdev;
+                }
        }
 #if IS_BUILTIN(CONFIG_OF)
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 1a55c7976df0..e17671c9d1b0 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -37,6 +37,27 @@
 #include <linux/smc91x.h>
 /*
+ * Any 16-bit access is performed with two 8-bit accesses if the hardware
+ * can't do it directly. Most registers are 16-bit so those are mandatory.
+ */
+#define SMC_outw_b(x, a, r)                                             \
+        do {                                                            \
+                unsigned int __val16 = (x);                             \
+                unsigned int __reg = (r);                               \
+                SMC_outb(__val16, a, __reg);                            \
+                SMC_outb(__val16 >> 8, a, __reg + (1 << SMC_IO_SHIFT)); \
+        } while (0)
+#define SMC_inw_b(a, r)                                                 \
+        ({                                                              \
+                unsigned int __val16;                                   \
+                unsigned int __reg = r;                                 \
+                __val16  = SMC_inb(a, __reg);                           \
+                __val16 |= SMC_inb(a, __reg + (1 << SMC_IO_SHIFT)) << 8; \
+                __val16;                                                \
+        })
+/*
 * Define your architecture specific bus configuration parameters here.
 */
@@ -55,10 +76,30 @@
 #define SMC_IO_SHIFT            (lp->io_shift)
 #define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_inw(a, r)           readw((a) + (r))
+#define SMC_inw(a, r)                                                   \
+        ({                                                              \
+                unsigned int __smc_r = r;                               \
+                SMC_16BIT(lp) ? readw((a) + __smc_r) :                  \
+                SMC_8BIT(lp) ? SMC_inw_b(a, __smc_r) :                  \
+                ({ BUG(); 0; });                                        \
+        })
 #define SMC_inl(a, r)           readl((a) + (r))
 #define SMC_outb(v, a, r)       writeb(v, (a) + (r))
+#define SMC_outw(v, a, r)                                               \
+        do {                                                            \
+                unsigned int __v = v, __smc_r = r;                      \
+                if (SMC_16BIT(lp))                                      \
+                        __SMC_outw(__v, a, __smc_r);                    \
+                else if (SMC_8BIT(lp))                                  \
+                        SMC_outw_b(__v, a, __smc_r);                    \
+                else                                                    \
+                        BUG();                                          \
+        } while (0)
 #define SMC_outl(v, a, r)       writel(v, (a) + (r))
+#define SMC_insb(a, r, p, l)    readsb((a) + (r), p, l)
+#define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, l)
 #define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
 #define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
 #define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
@@ -66,7 +107,7 @@
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 /* We actually can't write halfwords properly if not word aligned */
-static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
+static inline void __SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 {
        if ((machine_is_mainstone() || machine_is_stargate2() ||
             machine_is_pxa_idp()) && reg & 2) {
@@ -416,24 +457,8 @@ smc_pxa_dma_insw(void __iomem *ioaddr, struct smc_local *lp, int reg, int dma,
 #if ! SMC_CAN_USE_16BIT
-/*
+#define SMC_outw(x, ioaddr, reg)        SMC_outw_b(x, ioaddr, reg)
- * Any 16-bit access is performed with two 8-bit accesses if the hardware
+#define SMC_inw(ioaddr, reg)            SMC_inw_b(ioaddr, reg)
- * can't do it directly. Most registers are 16-bit so those are mandatory.
- */
-#define SMC_outw(x, ioaddr, reg)                                        \
-        do {                                                            \
-                unsigned int __val16 = (x);                             \
-                SMC_outb( __val16, ioaddr, reg );                       \
-                SMC_outb( __val16 >> 8, ioaddr, reg + (1 << SMC_IO_SHIFT));\
-        } while (0)
-#define SMC_inw(ioaddr, reg)                                            \
-        ({                                                              \
-                unsigned int __val16;                                   \
-                __val16 =  SMC_inb( ioaddr, reg );                      \
-                __val16 |= SMC_inb( ioaddr, reg + (1 << SMC_IO_SHIFT)) << 8; \
-                __val16;                                                \
-        })
 #define SMC_insw(a, r, p, l)            BUG()
 #define SMC_outsw(a, r, p, l)           BUG()
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index 9f159a775af3..5a3941bf250f 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
+++ b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -1622,13 +1622,7 @@ static void dwceqos_init_hw(struct net_local *lp)
                DWCEQOS_MMC_CTRL_RSTONRD);
        dwceqos_enable_mmc_interrupt(lp);
-        /* Enable Interrupts */
+        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE, 0);
-        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE,
-                      DWCEQOS_DMA_CH0_IE_NIE |
-                      DWCEQOS_DMA_CH0_IE_RIE | DWCEQOS_DMA_CH0_IE_TIE |
-                      DWCEQOS_DMA_CH0_IE_AIE |
-                      DWCEQOS_DMA_CH0_IE_FBEE);
        dwceqos_write(lp, REG_DWCEQOS_MAC_IE, 0);
        dwceqos_write(lp, REG_DWCEQOS_MAC_CFG, DWCEQOS_MAC_CFG_IPC |
@@ -1905,6 +1899,15 @@ static int dwceqos_open(struct net_device *ndev)
        netif_start_queue(ndev);
        tasklet_enable(&lp->tx_bdreclaim_tasklet);
+        /* Enable Interrupts -- do this only after we enable NAPI and the
+         * tasklet.
+         */
+        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE,
+                      DWCEQOS_DMA_CH0_IE_NIE |
+                      DWCEQOS_DMA_CH0_IE_RIE | DWCEQOS_DMA_CH0_IE_TIE |
+                      DWCEQOS_DMA_CH0_IE_AIE |
+                      DWCEQOS_DMA_CH0_IE_FBEE);
        return 0;
 }
diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index 7452b5f9d024..7108c68f16d3 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -1987,7 +1987,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        if ((readl(nic->regs + FPGA_VER) & 0xFFF) >= 378) {
                err = pci_enable_msi(pdev);
                if (err)
-                        pr_err("Can't eneble msi. error is %d\n", err);
+                        pr_err("Can't enable msi. error is %d\n", err);
                else
                        nic->irq_type = IRQ_MSI;
        } else
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 3cee84a24815..93dc10b10c09 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -1131,11 +1131,13 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
        lp->rx_ping_pong = get_bool(ofdev, "xlnx,rx-ping-pong");
        mac_address = of_get_mac_address(ofdev->dev.of_node);
-        if (mac_address)
+        if (mac_address) {
                /* Set the MAC address. */
                memcpy(ndev->dev_addr, mac_address, ETH_ALEN);
-        else
+        } else {
-                dev_warn(dev, "No MAC address found\n");
+                dev_warn(dev, "No MAC address found, using random\n");
+                eth_hw_addr_random(ndev);
+        }
        /* Clear the Tx CSR's in case this is a restart */
        __raw_writel(0, lp->base_addr + XEL_TSR_OFFSET);
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 053e87905b94..885ac9cbab5a 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -964,7 +964,7 @@ static struct phy_driver ksphy_driver[] = {
        .get_strings    = kszphy_get_strings,
        .get_stats      = kszphy_get_stats,
        .suspend        = genphy_suspend,
-        .resume         = genphy_resume,
+        .resume         = kszphy_resume,
 }, {
        .phy_id         = PHY_ID_KSZ8873MLL,
        .phy_id_mask    = MICREL_PHY_ID_MASK,
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index c5dc2c363f96..c6f66832a1a6 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -722,8 +722,10 @@ phy_err:
 int phy_start_interrupts(struct phy_device *phydev)
 {
        atomic_set(&phydev->irq_disable, 0);
-        if (request_irq(phydev->irq, phy_interrupt, 0, "phy_interrupt",
+        if (request_irq(phydev->irq, phy_interrupt,
-                        phydev) < 0) {
+                                IRQF_SHARED,
+                                "phy_interrupt",
+                                phydev) < 0) {
                pr_warn("%s: Can't get IRQ %d (PHY)\n",
                        phydev->mdio.bus->name, phydev->irq);
                phydev->irq = PHY_POLL;
diff --git a/drivers/net/team/team_mode_loadbalance.c b/drivers/net/team/team_mode_loadbalance.c
index cdb19b385d42..b228bea7931f 100644
--- a/drivers/net/team/team_mode_loadbalance.c
+++ b/drivers/net/team/team_mode_loadbalance.c
@@ -14,9 +14,23 @@
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/filter.h>
 #include <linux/if_team.h>
+static rx_handler_result_t lb_receive(struct team *team, struct team_port *port,
+                                      struct sk_buff *skb)
+{
+        if (unlikely(skb->protocol == htons(ETH_P_SLOW))) {
+                /* LACPDU packets should go to exact delivery */
+                const unsigned char *dest = eth_hdr(skb)->h_dest;
+                if (is_link_local_ether_addr(dest) && dest[5] == 0x02)
+                        return RX_HANDLER_EXACT;
+        }
+        return RX_HANDLER_ANOTHER;
+}
 struct lb_priv;
 typedef struct team_port *lb_select_tx_port_func_t(struct team *,
@@ -652,6 +666,7 @@ static const struct team_mode_ops lb_mode_ops = {
        .port_enter             = lb_port_enter,
        .port_leave             = lb_port_leave,
        .port_disabled          = lb_port_disabled,
+        .receive                = lb_receive,
        .transmit               = lb_transmit,
 };
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 9c8b5bc2b9d8..6f9df375c5d4 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -894,11 +894,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
        if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
                goto drop;
-        if (skb->sk && sk_fullsock(skb->sk)) {
+        skb_tx_timestamp(skb);
-                sock_tx_timestamp(skb->sk, skb->sk->sk_tsflags,
-                                  &skb_shinfo(skb)->tx_flags);
-                sw_tx_timestamp(skb);
-        }
        /* Orphan the skb - required as we might hang on to it
         * for indefinite time.
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 770212baaf05..528b9c9c4e60 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -1009,6 +1009,7 @@ static int kaweth_probe(
        struct net_device *netdev;
        const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
        int result = 0;
+        int rv = -EIO;
        dev_dbg(dev,
                "Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
@@ -1029,6 +1030,7 @@ static int kaweth_probe(
        kaweth = netdev_priv(netdev);
        kaweth->dev = udev;
        kaweth->net = netdev;
+        kaweth->intf = intf;
        spin_lock_init(&kaweth->device_lock);
        init_waitqueue_head(&kaweth->term_wait);
@@ -1048,6 +1050,10 @@ static int kaweth_probe(
                /* Download the firmware */
                dev_info(dev, "Downloading firmware...\n");
                kaweth->firmware_buf = (__u8 *)__get_free_page(GFP_KERNEL);
+                if (!kaweth->firmware_buf) {
+                        rv = -ENOMEM;
+                        goto err_free_netdev;
+                }
                if ((result = kaweth_download_firmware(kaweth,
                                                      "kaweth/new_code.bin",
                                                      100,
@@ -1139,8 +1145,6 @@ err_fw:
        dev_dbg(dev, "Initializing net device.\n");
-        kaweth->intf = intf;
        kaweth->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
        if (!kaweth->tx_urb)
                goto err_free_netdev;
@@ -1204,7 +1208,7 @@ err_only_tx:
 err_free_netdev:
        free_netdev(netdev);
-        return -EIO;
+        return rv;
 }
 /****************************************************************
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index c68fe495d3f9..4244b9d4418e 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -914,7 +914,9 @@ vmxnet3_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
 {
        struct Vmxnet3_TxDataDesc *tdd;
-        tdd = tq->data_ring.base + tq->tx_ring.next2fill;
+        tdd = (struct Vmxnet3_TxDataDesc *)((u8 *)tq->data_ring.base +
+                                            tq->tx_ring.next2fill *
+                                            tq->txdata_desc_size);
        memcpy(tdd->data, skb->data, ctx->copy_size);
        netdev_dbg(adapter->netdev,
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 74fc03072b87..7dc37a090549 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
 * Version numbers
 */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.9.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.a.0-k"
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040900
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040a00
 #if defined(CONFIG_PCI_MSI)
        /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index db39d53cdfb9..0c644f7bdf80 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -31,7 +31,7 @@ config NVME_FABRICS
 config NVME_RDMA
        tristate "NVM Express over Fabrics RDMA host driver"
        depends on INFINIBAND
-        depends on BLK_DEV_NVME
+        select NVME_CORE
        select NVME_FABRICS
        select SG_POOL
        help
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index dc996761042f..4eff49174466 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -47,8 +47,10 @@ static struct nvmf_host *nvmf_host_add(const char *hostnqn)
        mutex_lock(&nvmf_hosts_mutex);
        host = __nvmf_host_find(hostnqn);
-        if (host)
+        if (host) {
+                kref_get(&host->ref);
                goto out_unlock;
+        }
        host = kmalloc(sizeof(*host), GFP_KERNEL);
        if (!host)
@@ -56,7 +58,7 @@ static struct nvmf_host *nvmf_host_add(const char *hostnqn)
        kref_init(&host->ref);
        memcpy(host->nqn, hostnqn, NVMF_NQN_SIZE);
-        uuid_le_gen(&host->id);
+        uuid_be_gen(&host->id);
        list_add_tail(&host->list, &nvmf_hosts);
 out_unlock:
@@ -73,9 +75,9 @@ static struct nvmf_host *nvmf_host_default(void)
                return NULL;
        kref_init(&host->ref);
-        uuid_le_gen(&host->id);
+        uuid_be_gen(&host->id);
        snprintf(host->nqn, NVMF_NQN_SIZE,
-                "nqn.2014-08.org.nvmexpress:NVMf:uuid:%pUl", &host->id);
+                "nqn.2014-08.org.nvmexpress:NVMf:uuid:%pUb", &host->id);
        mutex_lock(&nvmf_hosts_mutex);
        list_add_tail(&host->list, &nvmf_hosts);
@@ -363,7 +365,14 @@ int nvmf_connect_admin_queue(struct nvme_ctrl *ctrl)
        cmd.connect.opcode = nvme_fabrics_command;
        cmd.connect.fctype = nvme_fabrics_type_connect;
        cmd.connect.qid = 0;
-        cmd.connect.sqsize = cpu_to_le16(ctrl->sqsize);
+        /*
+         * fabrics spec sets a minimum of depth 32 for admin queue,
+         * so set the queue with this depth always until
+         * justification otherwise.
+         */
+        cmd.connect.sqsize = cpu_to_le16(NVMF_AQ_DEPTH - 1);
        /*
         * Set keep-alive timeout in seconds granularity (ms * 1000)
         * and add a grace period for controller kato enforcement
@@ -375,7 +384,7 @@ int nvmf_connect_admin_queue(struct nvme_ctrl *ctrl)
        if (!data)
                return -ENOMEM;
-        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_le));
+        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_be));
        data->cntlid = cpu_to_le16(0xffff);
        strncpy(data->subsysnqn, ctrl->opts->subsysnqn, NVMF_NQN_SIZE);
        strncpy(data->hostnqn, ctrl->opts->host->nqn, NVMF_NQN_SIZE);
@@ -434,7 +443,7 @@ int nvmf_connect_io_queue(struct nvme_ctrl *ctrl, u16 qid)
        if (!data)
                return -ENOMEM;
-        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_le));
+        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_be));
        data->cntlid = cpu_to_le16(ctrl->cntlid);
        strncpy(data->subsysnqn, ctrl->opts->subsysnqn, NVMF_NQN_SIZE);
        strncpy(data->hostnqn, ctrl->opts->host->nqn, NVMF_NQN_SIZE);
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index 89df52c8be97..46e460aee52d 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -34,7 +34,7 @@ struct nvmf_host {
        struct kref             ref;
        struct list_head        list;
        char                    nqn[NVMF_NQN_SIZE];
-        uuid_le                 id;
+        uuid_be                 id;
 };
 /**
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 8d2875b4c56d..ab545fb347a0 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -43,10 +43,6 @@
 #define NVME_RDMA_MAX_INLINE_SEGMENTS   1
-#define NVME_RDMA_MAX_PAGES_PER_MR      512
-#define NVME_RDMA_DEF_RECONNECT_DELAY   20
 /*
 * We handle AEN commands ourselves and don't even let the
 * block layer know about them.
@@ -77,7 +73,6 @@ struct nvme_rdma_request {
        u32                     num_sge;
        int                     nents;
        bool                    inline_data;
-        bool                    need_inval;
        struct ib_reg_wr        reg_wr;
        struct ib_cqe           reg_cqe;
        struct nvme_rdma_queue  *queue;
@@ -286,7 +281,7 @@ static int nvme_rdma_reinit_request(void *data, struct request *rq)
        struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
        int ret = 0;
-        if (!req->need_inval)
+        if (!req->mr->need_inval)
                goto out;
        ib_dereg_mr(req->mr);
@@ -298,7 +293,7 @@ static int nvme_rdma_reinit_request(void *data, struct request *rq)
                req->mr = NULL;
        }
-        req->need_inval = false;
+        req->mr->need_inval = false;
 out:
        return ret;
@@ -645,7 +640,8 @@ static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl)
        int i, ret;
        for (i = 1; i < ctrl->queue_count; i++) {
-                ret = nvme_rdma_init_queue(ctrl, i, ctrl->ctrl.sqsize);
+                ret = nvme_rdma_init_queue(ctrl, i,
+                                           ctrl->ctrl.opts->queue_size);
                if (ret) {
                        dev_info(ctrl->ctrl.device,
                                "failed to initialize i/o queue: %d\n", ret);
@@ -849,7 +845,7 @@ static void nvme_rdma_unmap_data(struct nvme_rdma_queue *queue,
        if (!blk_rq_bytes(rq))
                return;
-        if (req->need_inval) {
+        if (req->mr->need_inval) {
                res = nvme_rdma_inv_rkey(queue, req);
                if (res < 0) {
                        dev_err(ctrl->ctrl.device,
@@ -935,7 +931,7 @@ static int nvme_rdma_map_sg_fr(struct nvme_rdma_queue *queue,
                             IB_ACCESS_REMOTE_READ |
                             IB_ACCESS_REMOTE_WRITE;
-        req->need_inval = true;
+        req->mr->need_inval = true;
        sg->addr = cpu_to_le64(req->mr->iova);
        put_unaligned_le24(req->mr->length, sg->length);
@@ -958,7 +954,7 @@ static int nvme_rdma_map_data(struct nvme_rdma_queue *queue,
        req->num_sge = 1;
        req->inline_data = false;
-        req->need_inval = false;
+        req->mr->need_inval = false;
        c->common.flags |= NVME_CMD_SGL_METABUF;
@@ -1145,7 +1141,7 @@ static int nvme_rdma_process_nvme_rsp(struct nvme_rdma_queue *queue,
        if ((wc->wc_flags & IB_WC_WITH_INVALIDATE) &&
            wc->ex.invalidate_rkey == req->mr->rkey)
-                req->need_inval = false;
+                req->mr->need_inval = false;
        blk_mq_complete_request(rq, status);
@@ -1278,8 +1274,22 @@ static int nvme_rdma_route_resolved(struct nvme_rdma_queue *queue)
        priv.recfmt = cpu_to_le16(NVME_RDMA_CM_FMT_1_0);
        priv.qid = cpu_to_le16(nvme_rdma_queue_idx(queue));
-        priv.hrqsize = cpu_to_le16(queue->queue_size);
+        /*
-        priv.hsqsize = cpu_to_le16(queue->queue_size);
+         * set the admin queue depth to the minimum size
+         * specified by the Fabrics standard.
+         */
+        if (priv.qid == 0) {
+                priv.hrqsize = cpu_to_le16(NVMF_AQ_DEPTH);
+                priv.hsqsize = cpu_to_le16(NVMF_AQ_DEPTH - 1);
+        } else {
+                /*
+                 * current interpretation of the fabrics spec
+                 * is at minimum you make hrqsize sqsize+1, or a
+                 * 1's based representation of sqsize.
+                 */
+                priv.hrqsize = cpu_to_le16(queue->queue_size);
+                priv.hsqsize = cpu_to_le16(queue->ctrl->ctrl.sqsize);
+        }
        ret = rdma_connect(queue->cm_id, &param);
        if (ret) {
@@ -1319,7 +1329,7 @@ out_destroy_queue_ib:
 static int nvme_rdma_device_unplug(struct nvme_rdma_queue *queue)
 {
        struct nvme_rdma_ctrl *ctrl = queue->ctrl;
-        int ret;
+        int ret = 0;
        /* Own the controller deletion */
        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING))
@@ -1461,7 +1471,7 @@ static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
        if (rq->cmd_type == REQ_TYPE_FS && req_op(rq) == REQ_OP_FLUSH)
                flush = true;
        ret = nvme_rdma_post_send(queue, sqe, req->sge, req->num_sge,
-                        req->need_inval ? &req->reg_wr.wr : NULL, flush);
+                        req->mr->need_inval ? &req->reg_wr.wr : NULL, flush);
        if (ret) {
                nvme_rdma_unmap_data(queue, rq);
                goto err;
@@ -1816,7 +1826,7 @@ static int nvme_rdma_create_io_queues(struct nvme_rdma_ctrl *ctrl)
        memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
        ctrl->tag_set.ops = &nvme_rdma_mq_ops;
-        ctrl->tag_set.queue_depth = ctrl->ctrl.sqsize;
+        ctrl->tag_set.queue_depth = ctrl->ctrl.opts->queue_size;
        ctrl->tag_set.reserved_tags = 1; /* fabric connect */
        ctrl->tag_set.numa_node = NUMA_NO_NODE;
        ctrl->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
@@ -1914,7 +1924,7 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
        spin_lock_init(&ctrl->lock);
        ctrl->queue_count = opts->nr_io_queues + 1; /* +1 for admin queue */
-        ctrl->ctrl.sqsize = opts->queue_size;
+        ctrl->ctrl.sqsize = opts->queue_size - 1;
        ctrl->ctrl.kato = opts->kato;
        ret = -ENOMEM;
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index a5c31cbeb481..3a5b9d0576cb 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -15,8 +15,8 @@ config NVME_TARGET
 config NVME_TARGET_LOOP
        tristate "NVMe loopback device support"
-        depends on BLK_DEV_NVME
        depends on NVME_TARGET
+        select NVME_CORE
        select NVME_FABRICS
        select SG_POOL
        help
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index 7affd40a6b33..395e60dad835 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -556,7 +556,7 @@ static int nvme_loop_create_io_queues(struct nvme_loop_ctrl *ctrl)
        memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
        ctrl->tag_set.ops = &nvme_loop_mq_ops;
-        ctrl->tag_set.queue_depth = ctrl->ctrl.sqsize;
+        ctrl->tag_set.queue_depth = ctrl->ctrl.opts->queue_size;
        ctrl->tag_set.reserved_tags = 1; /* fabric connect */
        ctrl->tag_set.numa_node = NUMA_NO_NODE;
        ctrl->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
@@ -620,7 +620,7 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
        ret = -ENOMEM;
-        ctrl->ctrl.sqsize = opts->queue_size;
+        ctrl->ctrl.sqsize = opts->queue_size - 1;
        ctrl->ctrl.kato = opts->kato;
        ctrl->queues = kcalloc(opts->nr_io_queues + 1, sizeof(*ctrl->queues),
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index b4d648536c3e..1cbe6e053b5b 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -978,10 +978,11 @@ static void nvmet_rdma_release_queue_work(struct work_struct *w)
                container_of(w, struct nvmet_rdma_queue, release_work);
        struct rdma_cm_id *cm_id = queue->cm_id;
        struct nvmet_rdma_device *dev = queue->dev;
+        enum nvmet_rdma_queue_state state = queue->state;
        nvmet_rdma_free_queue(queue);
-        if (queue->state != NVMET_RDMA_IN_DEVICE_REMOVAL)
+        if (state != NVMET_RDMA_IN_DEVICE_REMOVAL)
                rdma_destroy_id(cm_id);
        kref_put(&dev->ref, nvmet_rdma_free_dev);
@@ -1003,10 +1004,10 @@ nvmet_rdma_parse_cm_connect_req(struct rdma_conn_param *conn,
        queue->host_qid = le16_to_cpu(req->qid);
        /*
-         * req->hsqsize corresponds to our recv queue size
+         * req->hsqsize corresponds to our recv queue size plus 1
         * req->hrqsize corresponds to our send queue size
         */
-        queue->recv_queue_size = le16_to_cpu(req->hsqsize);
+        queue->recv_queue_size = le16_to_cpu(req->hsqsize) + 1;
        queue->send_queue_size = le16_to_cpu(req->hrqsize);
        if (!queue->host_qid && queue->recv_queue_size > NVMF_AQ_DEPTH)
diff --git a/drivers/pci/host-bridge.c b/drivers/pci/host-bridge.c
index 5f4a2e04c8d7..add66236215c 100644
--- a/drivers/pci/host-bridge.c
+++ b/drivers/pci/host-bridge.c
@@ -44,6 +44,7 @@ void pci_set_host_bridge_release(struct pci_host_bridge *bridge,
        bridge->release_fn = release_fn;
        bridge->release_data = release_data;
 }
+EXPORT_SYMBOL_GPL(pci_set_host_bridge_release);
 void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region,
                             struct resource *res)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 37ff0158e45f..44e0ff37480b 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3327,9 +3327,9 @@ static void quirk_apple_wait_for_thunderbolt(struct pci_dev *dev)
        if (nhi->vendor != PCI_VENDOR_ID_INTEL
                    || (nhi->device != PCI_DEVICE_ID_INTEL_LIGHT_RIDGE &&
                        nhi->device != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C &&
+                        nhi->device != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_NHI &&
                        nhi->device != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_NHI)
-                    || nhi->subsystem_vendor != 0x2222
+                    || nhi->class != PCI_CLASS_SYSTEM_OTHER << 8)
-                    || nhi->subsystem_device != 0x1111)
                goto out;
        dev_info(&dev->dev, "quirk: waiting for thunderbolt to reestablish PCI tunnels...\n");
        device_pm_wait_for_dev(&dev->dev, &nhi->dev);
@@ -3344,6 +3344,9 @@ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
                               PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C,
                               quirk_apple_wait_for_thunderbolt);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
+                               PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE,
+                               quirk_apple_wait_for_thunderbolt);
+DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
                               PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE,
                               quirk_apple_wait_for_thunderbolt);
 #endif
diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index c494613c1909..f5e1008a223d 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -925,6 +925,7 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
                        if (i > 0 && spi != using_spi) {
                                pr_err("PPI/SPI IRQ type mismatch for %s!\n",
                                        dn->name);
+                                of_node_put(dn);
                                kfree(irqs);
                                return -EINVAL;
                        }
@@ -969,7 +970,7 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
        if (cpumask_weight(&pmu->supported_cpus) == 0) {
                int irq = platform_get_irq(pdev, 0);
-                if (irq_is_percpu(irq)) {
+                if (irq >= 0 && irq_is_percpu(irq)) {
                        /* If using PPIs, check the affinity of the partition */
                        int ret;
diff --git a/drivers/phy/phy-brcm-sata.c b/drivers/phy/phy-brcm-sata.c
index 18d662610075..8ffc44afdb75 100644
--- a/drivers/phy/phy-brcm-sata.c
+++ b/drivers/phy/phy-brcm-sata.c
@@ -367,7 +367,7 @@ static int brcm_sata_phy_init(struct phy *phy)
                rc = -ENODEV;
        };
-        return 0;
+        return rc;
 }
 static const struct phy_ops phy_ops = {
diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
index 0a45bc6088ae..8c7eb335622e 100644
--- a/drivers/phy/phy-sun4i-usb.c
+++ b/drivers/phy/phy-sun4i-usb.c
@@ -40,6 +40,7 @@
 #include <linux/power_supply.h>
 #include <linux/regulator/consumer.h>
 #include <linux/reset.h>
+#include <linux/usb/of.h>
 #include <linux/workqueue.h>
 #define REG_ISCR                        0x00
@@ -110,6 +111,7 @@ struct sun4i_usb_phy_cfg {
 struct sun4i_usb_phy_data {
        void __iomem *base;
        const struct sun4i_usb_phy_cfg *cfg;
+        enum usb_dr_mode dr_mode;
        struct mutex mutex;
        struct sun4i_usb_phy {
                struct phy *phy;
@@ -120,6 +122,7 @@ struct sun4i_usb_phy_data {
                bool regulator_on;
                int index;
        } phys[MAX_PHYS];
+        int first_phy;
        /* phy0 / otg related variables */
        struct extcon_dev *extcon;
        bool phy0_init;
@@ -285,16 +288,10 @@ static int sun4i_usb_phy_init(struct phy *_phy)
                sun4i_usb_phy0_update_iscr(_phy, 0, ISCR_DPDM_PULLUP_EN);
                sun4i_usb_phy0_update_iscr(_phy, 0, ISCR_ID_PULLUP_EN);
-                if (data->id_det_gpio) {
+                /* Force ISCR and cable state updates */
-                        /* OTG mode, force ISCR and cable state updates */
+                data->id_det = -1;
-                        data->id_det = -1;
+                data->vbus_det = -1;
-                        data->vbus_det = -1;
+                queue_delayed_work(system_wq, &data->detect, 0);
-                        queue_delayed_work(system_wq, &data->detect, 0);
-                } else {
-                        /* Host only mode */
-                        sun4i_usb_phy0_set_id_detect(_phy, 0);
-                        sun4i_usb_phy0_set_vbus_detect(_phy, 1);
-                }
        }
        return 0;
@@ -319,6 +316,19 @@ static int sun4i_usb_phy_exit(struct phy *_phy)
        return 0;
 }
+static int sun4i_usb_phy0_get_id_det(struct sun4i_usb_phy_data *data)
+{
+        switch (data->dr_mode) {
+        case USB_DR_MODE_OTG:
+                return gpiod_get_value_cansleep(data->id_det_gpio);
+        case USB_DR_MODE_HOST:
+                return 0;
+        case USB_DR_MODE_PERIPHERAL:
+        default:
+                return 1;
+        }
+}
 static int sun4i_usb_phy0_get_vbus_det(struct sun4i_usb_phy_data *data)
 {
        if (data->vbus_det_gpio)
@@ -432,7 +442,10 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
        struct phy *phy0 = data->phys[0].phy;
        int id_det, vbus_det, id_notify = 0, vbus_notify = 0;
-        id_det = gpiod_get_value_cansleep(data->id_det_gpio);
+        if (phy0 == NULL)
+                return;
+        id_det = sun4i_usb_phy0_get_id_det(data);
        vbus_det = sun4i_usb_phy0_get_vbus_det(data);
        mutex_lock(&phy0->mutex);
@@ -448,7 +461,8 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
                 * without vbus detection report vbus low for long enough for
                 * the musb-ip to end the current device session.
                 */
-                if (!sun4i_usb_phy0_have_vbus_det(data) && id_det == 0) {
+                if (data->dr_mode == USB_DR_MODE_OTG &&
+                    !sun4i_usb_phy0_have_vbus_det(data) && id_det == 0) {
                        sun4i_usb_phy0_set_vbus_detect(phy0, 0);
                        msleep(200);
                        sun4i_usb_phy0_set_vbus_detect(phy0, 1);
@@ -474,7 +488,8 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
                 * without vbus detection report vbus low for long enough to
                 * the musb-ip to end the current host session.
                 */
-                if (!sun4i_usb_phy0_have_vbus_det(data) && id_det == 1) {
+                if (data->dr_mode == USB_DR_MODE_OTG &&
+                    !sun4i_usb_phy0_have_vbus_det(data) && id_det == 1) {
                        mutex_lock(&phy0->mutex);
                        sun4i_usb_phy0_set_vbus_detect(phy0, 0);
                        msleep(1000);
@@ -519,7 +534,8 @@ static struct phy *sun4i_usb_phy_xlate(struct device *dev,
 {
        struct sun4i_usb_phy_data *data = dev_get_drvdata(dev);
-        if (args->args[0] >= data->cfg->num_phys)
+        if (args->args[0] < data->first_phy ||
+            args->args[0] >= data->cfg->num_phys)
                return ERR_PTR(-ENODEV);
        return data->phys[args->args[0]].phy;
@@ -593,13 +609,17 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
                        return -EPROBE_DEFER;
        }
-        /* vbus_det without id_det makes no sense, and is not supported */
+        data->dr_mode = of_usb_get_dr_mode_by_phy(np, 0);
-        if (sun4i_usb_phy0_have_vbus_det(data) && !data->id_det_gpio) {
+        switch (data->dr_mode) {
-                dev_err(dev, "usb0_id_det missing or invalid\n");
+        case USB_DR_MODE_OTG:
-                return -ENODEV;
+                /* otg without id_det makes no sense, and is not supported */
-        }
+                if (!data->id_det_gpio) {
+                        dev_err(dev, "usb0_id_det missing or invalid\n");
-        if (data->id_det_gpio) {
+                        return -ENODEV;
+                }
+                /* fall through */
+        case USB_DR_MODE_HOST:
+        case USB_DR_MODE_PERIPHERAL:
                data->extcon = devm_extcon_dev_allocate(dev,
                                                        sun4i_usb_phy0_cable);
                if (IS_ERR(data->extcon))
@@ -610,9 +630,13 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
                        dev_err(dev, "failed to register extcon: %d\n", ret);
                        return ret;
                }
+                break;
+        default:
+                dev_info(dev, "dr_mode unknown, not registering usb phy0\n");
+                data->first_phy = 1;
        }
-        for (i = 0; i < data->cfg->num_phys; i++) {
+        for (i = data->first_phy; i < data->cfg->num_phys; i++) {
                struct sun4i_usb_phy *phy = data->phys + i;
                char name[16];
diff --git a/drivers/phy/phy-sun9i-usb.c b/drivers/phy/phy-sun9i-usb.c
index ac4f31abefe3..28fce4bce638 100644
--- a/drivers/phy/phy-sun9i-usb.c
+++ b/drivers/phy/phy-sun9i-usb.c
@@ -141,9 +141,9 @@ static int sun9i_usb_phy_probe(struct platform_device *pdev)
                }
                phy->hsic_clk = devm_clk_get(dev, "hsic_12M");
-                if (IS_ERR(phy->clk)) {
+                if (IS_ERR(phy->hsic_clk)) {
                        dev_err(dev, "failed to get hsic_12M clock\n");
-                        return PTR_ERR(phy->clk);
+                        return PTR_ERR(phy->hsic_clk);
                }
                phy->reset = devm_reset_control_get(dev, "hsic");
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 5749a4eee746..0fe8fad25e4d 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1539,12 +1539,11 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                offset += range->npins;
        }
-        /* Mask and clear all interrupts */
+        /* Clear all interrupts */
-        chv_writel(0, pctrl->regs + CHV_INTMASK);
        chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
        ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
-                                   handle_simple_irq, IRQ_TYPE_NONE);
+                                   handle_bad_irq, IRQ_TYPE_NONE);
        if (ret) {
                dev_err(pctrl->dev, "failed to add IRQ chip\n");
                goto fail;
diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
index 7bad200bd67c..55375b1b3cc8 100644
--- a/drivers/pinctrl/pinctrl-pistachio.c
+++ b/drivers/pinctrl/pinctrl-pistachio.c
@@ -809,17 +809,17 @@ static const struct pistachio_pin_group pistachio_groups[] = {
                           PADS_FUNCTION_SELECT2, 12, 0x3),
        MFIO_MUX_PIN_GROUP(83, MIPS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
                           PADS_FUNCTION_SELECT2, 14, 0x3),
-        MFIO_MUX_PIN_GROUP(84, SYS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
+        MFIO_MUX_PIN_GROUP(84, AUDIO_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
                           PADS_FUNCTION_SELECT2, 16, 0x3),
-        MFIO_MUX_PIN_GROUP(85, WIFI_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+        MFIO_MUX_PIN_GROUP(85, RPU_V_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
                           PADS_FUNCTION_SELECT2, 18, 0x3),
-        MFIO_MUX_PIN_GROUP(86, BT_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+        MFIO_MUX_PIN_GROUP(86, RPU_L_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
                           PADS_FUNCTION_SELECT2, 20, 0x3),
-        MFIO_MUX_PIN_GROUP(87, RPU_V_PLL_LOCK, DREQ2, SOCIF_DEBUG,
+        MFIO_MUX_PIN_GROUP(87, SYS_PLL_LOCK, DREQ2, SOCIF_DEBUG,
                           PADS_FUNCTION_SELECT2, 22, 0x3),
-        MFIO_MUX_PIN_GROUP(88, RPU_L_PLL_LOCK, DREQ3, SOCIF_DEBUG,
+        MFIO_MUX_PIN_GROUP(88, WIFI_PLL_LOCK, DREQ3, SOCIF_DEBUG,
                           PADS_FUNCTION_SELECT2, 24, 0x3),
-        MFIO_MUX_PIN_GROUP(89, AUDIO_PLL_LOCK, DREQ4, DREQ5,
+        MFIO_MUX_PIN_GROUP(89, BT_PLL_LOCK, DREQ4, DREQ5,
                           PADS_FUNCTION_SELECT2, 26, 0x3),
        PIN_GROUP(TCK, "tck"),
        PIN_GROUP(TRSTN, "trstn"),
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
index ce483b03a263..f9d661e5c14a 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
@@ -485,12 +485,12 @@ static const struct sunxi_desc_pin sun8i_a23_pins[] = {
        SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
                  SUNXI_FUNCTION(0x0, "gpio_in"),
                  SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* RTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* RTS */
                  SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 8)),  /* PG_EINT8 */
        SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
                  SUNXI_FUNCTION(0x0, "gpio_in"),
                  SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* CTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* CTS */
                  SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 9)),  /* PG_EINT9 */
        SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
                  SUNXI_FUNCTION(0x0, "gpio_in"),
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
index 3040abe6f73a..3131cac2b76f 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
@@ -407,12 +407,12 @@ static const struct sunxi_desc_pin sun8i_a33_pins[] = {
        SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
                  SUNXI_FUNCTION(0x0, "gpio_in"),
                  SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* RTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* RTS */
                  SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 8)),  /* PG_EINT8 */
        SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
                  SUNXI_FUNCTION(0x0, "gpio_in"),
                  SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* CTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* CTS */
                  SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 9)),  /* PG_EINT9 */
        SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
                  SUNXI_FUNCTION(0x0, "gpio_in"),
diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
index f99b183d5296..374a8028fec7 100644
--- a/drivers/platform/olpc/olpc-ec.c
+++ b/drivers/platform/olpc/olpc-ec.c
@@ -1,6 +1,8 @@
 /*
 * Generic driver for the OLPC Embedded Controller.
 *
+ * Author: Andres Salomon <dilinger@queued.net>
+ *
 * Copyright (C) 2011-2012 One Laptop per Child Foundation.
 *
 * Licensed under the GPL v2 or later.
@@ -12,7 +14,7 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/workqueue.h>
-#include <linux/module.h>
+#include <linux/init.h>
 #include <linux/list.h>
 #include <linux/olpc-ec.h>
 #include <asm/olpc.h>
@@ -326,8 +328,4 @@ static int __init olpc_ec_init_module(void)
 {
        return platform_driver_register(&olpc_ec_plat_driver);
 }
 arch_initcall(olpc_ec_init_module);
-MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
-MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/intel_pmic_gpio.c b/drivers/platform/x86/intel_pmic_gpio.c
index 63b371d6ee55..91ae58510d92 100644
--- a/drivers/platform/x86/intel_pmic_gpio.c
+++ b/drivers/platform/x86/intel_pmic_gpio.c
@@ -1,6 +1,8 @@
 /* Moorestown PMIC GPIO (access through IPC) driver
 * Copyright (c) 2008 - 2009, Intel Corporation.
 *
+ * Author: Alek Du <alek.du@intel.com>
+ *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
@@ -21,7 +23,6 @@
 #define pr_fmt(fmt) "%s: " fmt, __func__
-#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
@@ -322,9 +323,4 @@ static int __init platform_pmic_gpio_init(void)
 {
        return platform_driver_register(&platform_pmic_gpio_driver);
 }
 subsys_initcall(platform_pmic_gpio_init);
-MODULE_AUTHOR("Alek Du <alek.du@intel.com>");
-MODULE_DESCRIPTION("Intel Moorestown PMIC GPIO driver");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 32f0f014a067..9d19b9a62011 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -1161,7 +1161,7 @@ static int tsi721_rio_map_inb_mem(struct rio_mport *mport, dma_addr_t lstart,
                } else if (ibw_start < (ib_win->rstart + ib_win->size) &&
                           (ibw_start + ibw_size) > ib_win->rstart) {
                        /* Return error if address translation involved */
-                        if (direct && ib_win->xlat) {
+                        if (!direct || ib_win->xlat) {
                                ret = -EFAULT;
                                break;
                        }
diff --git a/drivers/regulator/max14577-regulator.c b/drivers/regulator/max14577-regulator.c
index b2daa6641417..c9ff26199711 100644
--- a/drivers/regulator/max14577-regulator.c
+++ b/drivers/regulator/max14577-regulator.c
@@ -2,7 +2,7 @@
 * max14577.c - Regulator driver for the Maxim 14577/77836
 *
 * Copyright (C) 2013,2014 Samsung Electronics
- * Krzysztof Kozlowski <k.kozlowski@samsung.com>
+ * Krzysztof Kozlowski <krzk@kernel.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -331,7 +331,7 @@ static void __exit max14577_regulator_exit(void)
 }
 module_exit(max14577_regulator_exit);
-MODULE_AUTHOR("Krzysztof Kozlowski <k.kozlowski@samsung.com>");
+MODULE_AUTHOR("Krzysztof Kozlowski <krzk@kernel.org>");
 MODULE_DESCRIPTION("Maxim 14577/77836 regulator driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:max14577-regulator");
diff --git a/drivers/regulator/max77693-regulator.c b/drivers/regulator/max77693-regulator.c
index de730fd3f8a5..cfbb9512e486 100644
--- a/drivers/regulator/max77693-regulator.c
+++ b/drivers/regulator/max77693-regulator.c
@@ -3,7 +3,7 @@
 *
 * Copyright (C) 2013-2015 Samsung Electronics
 * Jonghwa Lee <jonghwa3.lee@samsung.com>
- * Krzysztof Kozlowski <k.kozlowski.k@gmail.com>
+ * Krzysztof Kozlowski <krzk@kernel.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -314,5 +314,5 @@ module_exit(max77693_pmic_cleanup);
 MODULE_DESCRIPTION("MAXIM 77693/77843 regulator driver");
 MODULE_AUTHOR("Jonghwa Lee <jonghwa3.lee@samsung.com>");
-MODULE_AUTHOR("Krzysztof Kozlowski <k.kozlowski.k@gmail.com>");
+MODULE_AUTHOR("Krzysztof Kozlowski <krzk@kernel.org>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
index 5022fa8d10c6..8ed46a9a55c8 100644
--- a/drivers/regulator/qcom_smd-regulator.c
+++ b/drivers/regulator/qcom_smd-regulator.c
@@ -178,20 +178,21 @@ static const struct regulator_desc pma8084_hfsmps = {
 static const struct regulator_desc pma8084_ftsmps = {
        .linear_ranges = (struct regulator_linear_range[]) {
                REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-                REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+                REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
        },
        .n_linear_ranges = 2,
-        .n_voltages = 340,
+        .n_voltages = 262,
        .ops = &rpm_smps_ldo_ops,
 };
 static const struct regulator_desc pma8084_pldo = {
        .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE(750000,  0,  30, 25000),
+                REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
-                REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+                REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+                REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
        },
-        .n_linear_ranges = 2,
+        .n_linear_ranges = 3,
-        .n_voltages = 100,
+        .n_voltages = 164,
        .ops = &rpm_smps_ldo_ops,
 };
@@ -221,29 +222,30 @@ static const struct regulator_desc pm8x41_hfsmps = {
 static const struct regulator_desc pm8841_ftsmps = {
        .linear_ranges = (struct regulator_linear_range[]) {
                REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-                REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+                REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
        },
        .n_linear_ranges = 2,
-        .n_voltages = 340,
+        .n_voltages = 262,
        .ops = &rpm_smps_ldo_ops,
 };
 static const struct regulator_desc pm8941_boost = {
        .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000),
+                REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000),
        },
        .n_linear_ranges = 1,
-        .n_voltages = 16,
+        .n_voltages = 31,
        .ops = &rpm_smps_ldo_ops,
 };
 static const struct regulator_desc pm8941_pldo = {
        .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE( 750000,  0,  30, 25000),
+                REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
-                REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+                REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+                REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
        },
-        .n_linear_ranges = 2,
+        .n_linear_ranges = 3,
-        .n_voltages = 100,
+        .n_voltages = 164,
        .ops = &rpm_smps_ldo_ops,
 };
diff --git a/drivers/scsi/wd719x.c b/drivers/scsi/wd719x.c
index e3da1a2fdb66..2a9da2e0ea6b 100644
--- a/drivers/scsi/wd719x.c
+++ b/drivers/scsi/wd719x.c
@@ -962,7 +962,7 @@ static void wd719x_pci_remove(struct pci_dev *pdev)
        scsi_host_put(sh);
 }
-static DEFINE_PCI_DEVICE_TABLE(wd719x_pci_table) = {
+static const struct pci_device_id wd719x_pci_table[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_WD, 0x3296) },
        {}
 };
diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index 823cbc92d1e7..7a37090dabbe 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -720,8 +720,6 @@ static int img_spfi_remove(struct platform_device *pdev)
                clk_disable_unprepare(spfi->sys_clk);
        }
-        spi_master_put(master);
        return 0;
 }
diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
index 0be89e052428..899d7a8f0889 100644
--- a/drivers/spi/spi-mt65xx.c
+++ b/drivers/spi/spi-mt65xx.c
@@ -685,7 +685,6 @@ static int mtk_spi_remove(struct platform_device *pdev)
        pm_runtime_disable(&pdev->dev);
        mtk_spi_reset(mdata);
-        spi_master_put(master);
        return 0;
 }
diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
index f3df522db93b..58d2d48e16a5 100644
--- a/drivers/spi/spi-pxa2xx-pci.c
+++ b/drivers/spi/spi-pxa2xx-pci.c
@@ -214,6 +214,7 @@ static int pxa2xx_spi_pci_probe(struct pci_dev *dev,
                return PTR_ERR(ssp->clk);
        memset(&pi, 0, sizeof(pi));
+        pi.fwnode = dev->dev.fwnode;
        pi.parent = &dev->dev;
        pi.name = "pxa2xx-spi";
        pi.id = ssp->port_id;
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index c338ef1136f6..7f1555621f8e 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -1030,7 +1030,6 @@ static int spi_qup_remove(struct platform_device *pdev)
        pm_runtime_put_noidle(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
-        spi_master_put(master);
        return 0;
 }
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 0f83ad1d5a58..1de3a772eb7d 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -262,6 +262,9 @@ static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p,
        for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) {
                brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div);
+                /* SCR_BRDV_DIV_1 is valid only if BRPS is x 1/1 or x 1/2 */
+                if (sh_msiof_spi_div_table[k].div == 1 && brps > 2)
+                        continue;
                if (brps <= 32) /* max of brdv is 32 */
                        break;
        }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 51ad42fad567..200ca228d885 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -960,7 +960,7 @@ static int spi_transfer_one_message(struct spi_master *master,
        struct spi_transfer *xfer;
        bool keep_cs = false;
        int ret = 0;
-        unsigned long ms = 1;
+        unsigned long long ms = 1;
        struct spi_statistics *statm = &master->statistics;
        struct spi_statistics *stats = &msg->spi->statistics;
@@ -991,9 +991,13 @@ static int spi_transfer_one_message(struct spi_master *master,
                        if (ret > 0) {
                                ret = 0;
-                                ms = xfer->len * 8 * 1000 / xfer->speed_hz;
+                                ms = 8LL * 1000LL * xfer->len;
+                                do_div(ms, xfer->speed_hz);
                                ms += ms + 100; /* some tolerance */
+                                if (ms > UINT_MAX)
+                                        ms = UINT_MAX;
                                ms = wait_for_completion_timeout(&master->xfer_completion,
                                                                 msecs_to_jiffies(ms));
                        }
@@ -1159,6 +1163,7 @@ static void __spi_pump_messages(struct spi_master *master, bool in_kthread)
                if (ret < 0) {
                        dev_err(&master->dev, "Failed to power device: %d\n",
                                ret);
+                        mutex_unlock(&master->io_mutex);
                        return;
                }
        }
@@ -1174,6 +1179,7 @@ static void __spi_pump_messages(struct spi_master *master, bool in_kthread)
                        if (master->auto_runtime_pm)
                                pm_runtime_put(master->dev.parent);
+                        mutex_unlock(&master->io_mutex);
                        return;
                }
        }
diff --git a/drivers/staging/comedi/drivers/adv_pci1760.c b/drivers/staging/comedi/drivers/adv_pci1760.c
index d7dd1e55e347..9f525ff7290c 100644
--- a/drivers/staging/comedi/drivers/adv_pci1760.c
+++ b/drivers/staging/comedi/drivers/adv_pci1760.c
@@ -196,6 +196,7 @@ static int pci1760_pwm_ns_to_div(unsigned int flags, unsigned int ns)
                break;
        case CMDF_ROUND_DOWN:
                divisor = ns / PCI1760_PWM_TIMEBASE;
+                break;
        default:
                return -EINVAL;
        }
diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
index 4ab186669f0c..ec5b9a23494d 100644
--- a/drivers/staging/comedi/drivers/comedi_test.c
+++ b/drivers/staging/comedi/drivers/comedi_test.c
@@ -56,11 +56,6 @@
 #define N_CHANS 8
-enum waveform_state_bits {
-        WAVEFORM_AI_RUNNING,
-        WAVEFORM_AO_RUNNING
-};
 /* Data unique to this driver */
 struct waveform_private {
        struct timer_list ai_timer;     /* timer for AI commands */
@@ -68,7 +63,6 @@ struct waveform_private {
        unsigned int wf_amplitude;      /* waveform amplitude in microvolts */
        unsigned int wf_period;         /* waveform period in microseconds */
        unsigned int wf_current;        /* current time in waveform period */
-        unsigned long state_bits;
        unsigned int ai_scan_period;    /* AI scan period in usec */
        unsigned int ai_convert_period; /* AI conversion period in usec */
        struct timer_list ao_timer;     /* timer for AO commands */
@@ -191,10 +185,6 @@ static void waveform_ai_timer(unsigned long arg)
        unsigned int nsamples;
        unsigned int time_increment;
-        /* check command is still active */
-        if (!test_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits))
-                return;
        now = ktime_to_us(ktime_get());
        nsamples = comedi_nsamples_left(s, UINT_MAX);
@@ -386,11 +376,6 @@ static int waveform_ai_cmd(struct comedi_device *dev,
         */
        devpriv->ai_timer.expires =
                jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1;
-        /* mark command as active */
-        smp_mb__before_atomic();
-        set_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
        add_timer(&devpriv->ai_timer);
        return 0;
 }
@@ -400,11 +385,12 @@ static int waveform_ai_cancel(struct comedi_device *dev,
 {
        struct waveform_private *devpriv = dev->private;
-        /* mark command as no longer active */
+        if (in_softirq()) {
-        clear_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
+                /* Assume we were called from the timer routine itself. */
-        smp_mb__after_atomic();
+                del_timer(&devpriv->ai_timer);
-        /* cannot call del_timer_sync() as may be called from timer routine */
+        } else {
-        del_timer(&devpriv->ai_timer);
+                del_timer_sync(&devpriv->ai_timer);
+        }
        return 0;
 }
@@ -436,10 +422,6 @@ static void waveform_ao_timer(unsigned long arg)
        u64 scans_since;
        unsigned int scans_avail = 0;
-        /* check command is still active */
-        if (!test_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits))
-                return;
        /* determine number of scan periods since last time */
        now = ktime_to_us(ktime_get());
        scans_since = now - devpriv->ao_last_scan_time;
@@ -518,11 +500,6 @@ static int waveform_ao_inttrig_start(struct comedi_device *dev,
        devpriv->ao_last_scan_time = ktime_to_us(ktime_get());
        devpriv->ao_timer.expires =
                jiffies + usecs_to_jiffies(devpriv->ao_scan_period);
-        /* mark command as active */
-        smp_mb__before_atomic();
-        set_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
        add_timer(&devpriv->ao_timer);
        return 1;
@@ -608,11 +585,12 @@ static int waveform_ao_cancel(struct comedi_device *dev,
        struct waveform_private *devpriv = dev->private;
        s->async->inttrig = NULL;
-        /* mark command as no longer active */
+        if (in_softirq()) {
-        clear_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
+                /* Assume we were called from the timer routine itself. */
-        smp_mb__after_atomic();
+                del_timer(&devpriv->ao_timer);
-        /* cannot call del_timer_sync() as may be called from timer routine */
+        } else {
-        del_timer(&devpriv->ao_timer);
+                del_timer_sync(&devpriv->ao_timer);
+        }
        return 0;
 }
diff --git a/drivers/staging/comedi/drivers/daqboard2000.c b/drivers/staging/comedi/drivers/daqboard2000.c
index 65daef0c00d5..0f4eb954aa80 100644
--- a/drivers/staging/comedi/drivers/daqboard2000.c
+++ b/drivers/staging/comedi/drivers/daqboard2000.c
@@ -634,7 +634,7 @@ static const void *daqboard2000_find_boardinfo(struct comedi_device *dev,
        const struct daq200_boardtype *board;
        int i;
-        if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH)
+        if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH)
                return NULL;
        for (i = 0; i < ARRAY_SIZE(boardtypes); i++) {
diff --git a/drivers/staging/comedi/drivers/dt2811.c b/drivers/staging/comedi/drivers/dt2811.c
index 904f637797b6..8bbd93814340 100644
--- a/drivers/staging/comedi/drivers/dt2811.c
+++ b/drivers/staging/comedi/drivers/dt2811.c
@@ -588,8 +588,8 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it)
        s = &dev->subdevices[0];
        s->type         = COMEDI_SUBD_AI;
        s->subdev_flags = SDF_READABLE |
-                          (it->options[2] == 1) ? SDF_DIFF :
+                          ((it->options[2] == 1) ? SDF_DIFF :
-                          (it->options[2] == 2) ? SDF_COMMON : SDF_GROUND;
+                           (it->options[2] == 2) ? SDF_COMMON : SDF_GROUND);
        s->n_chan       = (it->options[2] == 1) ? 8 : 16;
        s->maxdata      = 0x0fff;
        s->range_table  = board->is_pgh ? &dt2811_pgh_ai_ranges
diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index 8dabb19519a5..0f97d7b611d7 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -2772,7 +2772,15 @@ static int ni_ao_inttrig(struct comedi_device *dev,
        int i;
        static const int timeout = 1000;
-        if (trig_num != cmd->start_arg)
+        /*
+         * Require trig_num == cmd->start_arg when cmd->start_src == TRIG_INT.
+         * For backwards compatibility, also allow trig_num == 0 when
+         * cmd->start_src != TRIG_INT (i.e. when cmd->start_src == TRIG_EXT);
+         * in that case, the internal trigger is being used as a pre-trigger
+         * before the external trigger.
+         */
+        if (!(trig_num == cmd->start_arg ||
+              (trig_num == 0 && cmd->start_src != TRIG_INT)))
                return -EINVAL;
        /*
@@ -5480,7 +5488,7 @@ static int ni_E_init(struct comedi_device *dev,
                s->maxdata      = (devpriv->is_m_series) ? 0xffffffff
                                                         : 0x00ffffff;
                s->insn_read    = ni_tio_insn_read;
-                s->insn_write   = ni_tio_insn_read;
+                s->insn_write   = ni_tio_insn_write;
                s->insn_config  = ni_tio_insn_config;
 #ifdef PCIDMA
                if (dev->irq && devpriv->mite) {
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 170ac980abcb..24c348d2f5bb 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -419,6 +419,7 @@ static ssize_t ad5933_store(struct device *dev,
        mutex_lock(&indio_dev->mlock);
        switch ((u32)this_attr->address) {
        case AD5933_OUT_RANGE:
+                ret = -EINVAL;
                for (i = 0; i < 4; i++)
                        if (val == st->range_avail[i]) {
                                st->ctrl_hb &= ~AD5933_CTRL_RANGE(0x3);
@@ -426,7 +427,6 @@ static ssize_t ad5933_store(struct device *dev,
                                ret = ad5933_cmd(st, 0);
                                break;
                        }
-                ret = -EINVAL;
                break;
        case AD5933_IN_PGA_GAIN:
                if (sysfs_streq(buf, "1")) {
diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c
index 3664bfd0178b..2c4dc69731e8 100644
--- a/drivers/staging/lustre/lustre/llite/namei.c
+++ b/drivers/staging/lustre/lustre/llite/namei.c
@@ -388,6 +388,7 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
        struct inode *inode = NULL;
        __u64 bits = 0;
        int rc = 0;
+        struct dentry *alias;
        /* NB 1 request reference will be taken away by ll_intent_lock()
         * when I return
@@ -412,26 +413,12 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
                 */
        }
-        /* Only hash *de if it is unhashed (new dentry).
+        alias = ll_splice_alias(inode, *de);
-         * Atoimc_open may passing hashed dentries for open.
+        if (IS_ERR(alias)) {
-         */
+                rc = PTR_ERR(alias);
-        if (d_unhashed(*de)) {
+                goto out;
-                struct dentry *alias;
-                alias = ll_splice_alias(inode, *de);
-                if (IS_ERR(alias)) {
-                        rc = PTR_ERR(alias);
-                        goto out;
-                }
-                *de = alias;
-        } else if (!it_disposition(it, DISP_LOOKUP_NEG)  &&
-                   !it_disposition(it, DISP_OPEN_CREATE)) {
-                /* With DISP_OPEN_CREATE dentry will be
-                 * instantiated in ll_create_it.
-                 */
-                LASSERT(!d_inode(*de));
-                d_instantiate(*de, inode);
        }
+        *de = alias;
        if (!it_disposition(it, DISP_LOOKUP_NEG)) {
                /* we have lookup look - unhide dentry */
@@ -587,6 +574,24 @@ static int ll_atomic_open(struct inode *dir, struct dentry *dentry,
               dentry, PFID(ll_inode2fid(dir)), dir, file, open_flags, mode,
               *opened);
+        /* Only negative dentries enter here */
+        LASSERT(!d_inode(dentry));
+        if (!d_in_lookup(dentry)) {
+                /* A valid negative dentry that just passed revalidation,
+                 * there's little point to try and open it server-side,
+                 * even though there's a minuscle chance it might succeed.
+                 * Either way it's a valid race to just return -ENOENT here.
+                 */
+                if (!(open_flags & O_CREAT))
+                        return -ENOENT;
+                /* Otherwise we just unhash it to be rehashed afresh via
+                 * lookup if necessary
+                 */
+                d_drop(dentry);
+        }
        it = kzalloc(sizeof(*it), GFP_NOFS);
        if (!it)
                return -ENOMEM;
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 0b1760cba6e3..78f524fcd214 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -3363,7 +3363,7 @@ int wilc_init(struct net_device *dev, struct host_if_drv **hif_drv_handler)
                if (!hif_workqueue) {
                        netdev_err(vif->ndev, "Failed to create workqueue\n");
                        result = -ENOMEM;
-                        goto _fail_mq_;
+                        goto _fail_;
                }
                setup_timer(&periodic_rssi, GetPeriodicRSSI,
@@ -3391,7 +3391,6 @@ int wilc_init(struct net_device *dev, struct host_if_drv **hif_drv_handler)
        clients_count++;
-_fail_mq_:
        destroy_workqueue(hif_workqueue);
 _fail_:
        return result;
diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c
index 3a66255f14fc..32215110d597 100644
--- a/drivers/staging/wilc1000/linux_wlan.c
+++ b/drivers/staging/wilc1000/linux_wlan.c
@@ -648,7 +648,7 @@ void wilc1000_wlan_deinit(struct net_device *dev)
                        mutex_unlock(&wl->hif_cs);
                }
                if (&wl->txq_event)
-                        wait_for_completion(&wl->txq_event);
+                        complete(&wl->txq_event);
                wlan_deinitialize_threads(dev);
                deinit_irq(dev);
diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
index 9092600a1794..2c2e8aca8305 100644
--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
+++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
@@ -1191,7 +1191,7 @@ static int get_station(struct wiphy *wiphy, struct net_device *dev,
        struct wilc_priv *priv;
        struct wilc_vif *vif;
        u32 i = 0;
-        u32 associatedsta = 0;
+        u32 associatedsta = ~0;
        u32 inactive_time = 0;
        priv = wiphy_priv(wiphy);
        vif = netdev_priv(dev);
@@ -1204,7 +1204,7 @@ static int get_station(struct wiphy *wiphy, struct net_device *dev,
                        }
                }
-                if (associatedsta == -1) {
+                if (associatedsta == ~0) {
                        netdev_err(dev, "sta required is not associated\n");
                        return -ENOENT;
                }
diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
index 9c15344b657a..a8c20413dbda 100644
--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -651,6 +651,12 @@ static struct pci_device_id nhi_ids[] = {
        {
                .class = PCI_CLASS_SYSTEM_OTHER << 8, .class_mask = ~0,
                .vendor = PCI_VENDOR_ID_INTEL,
+                .device = PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_NHI,
+                .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID,
+        },
+        {
+                .class = PCI_CLASS_SYSTEM_OTHER << 8, .class_mask = ~0,
+                .vendor = PCI_VENDOR_ID_INTEL,
                .device = PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_NHI,
                .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID,
        },
diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 1e116f53d6dd..9840fdecb73b 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -372,7 +372,9 @@ struct tb_switch *tb_switch_alloc(struct tb *tb, u64 route)
        if (sw->config.device_id != PCI_DEVICE_ID_INTEL_LIGHT_RIDGE &&
            sw->config.device_id != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C &&
-            sw->config.device_id != PCI_DEVICE_ID_INTEL_PORT_RIDGE)
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_PORT_RIDGE &&
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE &&
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE)
                tb_sw_warn(sw, "unsupported switch device id %#x\n",
                           sw->config.device_id);
diff --git a/drivers/tty/serial/8250/8250.h b/drivers/tty/serial/8250/8250.h
index 122e0e4029fe..1a16feac9a36 100644
--- a/drivers/tty/serial/8250/8250.h
+++ b/drivers/tty/serial/8250/8250.h
@@ -15,8 +15,6 @@
 #include <linux/serial_reg.h>
 #include <linux/dmaengine.h>
-#include "../serial_mctrl_gpio.h"
 struct uart_8250_dma {
        int (*tx_dma)(struct uart_8250_port *p);
        int (*rx_dma)(struct uart_8250_port *p);
@@ -133,43 +131,12 @@ void serial8250_em485_destroy(struct uart_8250_port *p);
 static inline void serial8250_out_MCR(struct uart_8250_port *up, int value)
 {
-        int mctrl_gpio = 0;
        serial_out(up, UART_MCR, value);
-        if (value & UART_MCR_RTS)
-                mctrl_gpio |= TIOCM_RTS;
-        if (value & UART_MCR_DTR)
-                mctrl_gpio |= TIOCM_DTR;
-        mctrl_gpio_set(up->gpios, mctrl_gpio);
 }
 static inline int serial8250_in_MCR(struct uart_8250_port *up)
 {
-        int mctrl, mctrl_gpio = 0;
+        return serial_in(up, UART_MCR);
-        mctrl = serial_in(up, UART_MCR);
-        /* save current MCR values */
-        if (mctrl & UART_MCR_RTS)
-                mctrl_gpio |= TIOCM_RTS;
-        if (mctrl & UART_MCR_DTR)
-                mctrl_gpio |= TIOCM_DTR;
-        mctrl_gpio = mctrl_gpio_get_outputs(up->gpios, &mctrl_gpio);
-        if (mctrl_gpio & TIOCM_RTS)
-                mctrl |= UART_MCR_RTS;
-        else
-                mctrl &= ~UART_MCR_RTS;
-        if (mctrl_gpio & TIOCM_DTR)
-                mctrl |= UART_MCR_DTR;
-        else
-                mctrl &= ~UART_MCR_DTR;
-        return mctrl;
 }
 #if defined(__alpha__) && !defined(CONFIG_PCI)
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 13ad5c3d2e68..dcf43f66404f 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -974,8 +974,6 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
        uart = serial8250_find_match_or_unused(&up->port);
        if (uart && uart->port.type != PORT_8250_CIR) {
-                struct mctrl_gpios *gpios;
                if (uart->port.dev)
                        uart_remove_one_port(&serial8250_reg, &uart->port);
@@ -1013,13 +1011,6 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
                if (up->port.flags & UPF_FIXED_TYPE)
                        uart->port.type = up->port.type;
-                gpios = mctrl_gpio_init(&uart->port, 0);
-                if (IS_ERR(gpios)) {
-                        if (PTR_ERR(gpios) != -ENOSYS)
-                                return PTR_ERR(gpios);
-                } else
-                        uart->gpios = gpios;
                serial8250_set_defaults(uart);
                /* Possibly override default I/O functions.  */
diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c
index 737b4b3957b0..0facc789fe7d 100644
--- a/drivers/tty/serial/8250/8250_fintek.c
+++ b/drivers/tty/serial/8250/8250_fintek.c
@@ -31,7 +31,7 @@
 #define IO_ADDR2 0x60
 #define LDN 0x7
-#define IRQ_MODE        0x70
+#define FINTEK_IRQ_MODE 0x70
 #define IRQ_SHARE       BIT(4)
 #define IRQ_MODE_MASK   (BIT(6) | BIT(5))
 #define IRQ_LEVEL_LOW   0
@@ -195,7 +195,7 @@ static int fintek_8250_set_irq_mode(struct fintek_8250 *pdata, bool level_mode)
        outb(LDN, pdata->base_port + ADDR_PORT);
        outb(pdata->index, pdata->base_port + DATA_PORT);
-        outb(IRQ_MODE, pdata->base_port + ADDR_PORT);
+        outb(FINTEK_IRQ_MODE, pdata->base_port + ADDR_PORT);
        tmp = inb(pdata->base_port + DATA_PORT);
        tmp &= ~IRQ_MODE_MASK;
diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c
index 339de9cd0866..20c5db2f4264 100644
--- a/drivers/tty/serial/8250/8250_mid.c
+++ b/drivers/tty/serial/8250/8250_mid.c
@@ -168,6 +168,9 @@ static void mid8250_set_termios(struct uart_port *p,
        unsigned long w = BIT(24) - 1;
        unsigned long mul, div;
+        /* Gracefully handle the B0 case: fall back to B9600 */
+        fuart = fuart ? fuart : 9600 * 16;
        if (mid->board->freq < fuart) {
                /* Find prescaler value that satisfies Fuart < Fref */
                if (mid->board->freq > baud)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index e14982f36a04..61ad6c3b20a0 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -134,21 +134,18 @@ static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl)
        serial8250_do_set_mctrl(port, mctrl);
-        if (IS_ERR_OR_NULL(mctrl_gpio_to_gpiod(up->gpios,
+        /*
-                                                UART_GPIO_RTS))) {
+         * Turn off autoRTS if RTS is lowered and restore autoRTS setting
-                /*
+         * if RTS is raised
-                 * Turn off autoRTS if RTS is lowered and restore autoRTS
+         */
-                 * setting if RTS is raised
+        lcr = serial_in(up, UART_LCR);
-                 */
+        serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B);
-                lcr = serial_in(up, UART_LCR);
+        if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS))
-                serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B);
+                priv->efr |= UART_EFR_RTS;
-                if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS))
+        else
-                        priv->efr |= UART_EFR_RTS;
+                priv->efr &= ~UART_EFR_RTS;
-                else
+        serial_out(up, UART_EFR, priv->efr);
-                        priv->efr &= ~UART_EFR_RTS;
+        serial_out(up, UART_LCR, lcr);
-                serial_out(up, UART_EFR, priv->efr);
-                serial_out(up, UART_LCR, lcr);
-        }
 }
 /*
@@ -449,9 +446,7 @@ static void omap_8250_set_termios(struct uart_port *port,
        priv->efr = 0;
        up->port.status &= ~(UPSTAT_AUTOCTS | UPSTAT_AUTORTS | UPSTAT_AUTOXOFF);
-        if (termios->c_cflag & CRTSCTS && up->port.flags & UPF_HARD_FLOW
+        if (termios->c_cflag & CRTSCTS && up->port.flags & UPF_HARD_FLOW) {
-                && IS_ERR_OR_NULL(mctrl_gpio_to_gpiod(up->gpios,
-                                                        UART_GPIO_RTS))) {
                /* Enable AUTOCTS (autoRTS is enabled when RTS is raised) */
                up->port.status |= UPSTAT_AUTOCTS | UPSTAT_AUTORTS;
                priv->efr |= UART_EFR_CTS;
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 20ebaea5c414..bc51b32b2774 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1950,6 +1950,43 @@ pci_wch_ch38x_setup(struct serial_private *priv,
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7954        0x7954
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7958        0x7958
+#define PCI_VENDOR_ID_ACCESIO                   0x494f
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB     0x1051
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S      0x1053
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB     0x105C
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S      0x105E
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB   0x1091
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2    0x1093
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB   0x1099
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4    0x109B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB    0x10D1
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM     0x10D3
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB    0x10DA
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM     0x10DC
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1    0x1108
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2    0x1110
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2    0x1111
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4    0x1118
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4    0x1119
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S       0x1152
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S       0x115A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2     0x1190
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2    0x1191
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4     0x1198
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4    0x1199
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM      0x11D0
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4     0x105A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4     0x105B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8     0x106A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8     0x106B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4     0x1098
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8     0x10A9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM      0x10D9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM      0x10E9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM      0x11D8
 /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588
@@ -5113,6 +5150,108 @@ static struct pci_device_id serial_pci_tbl[] = {
                0,
                0, pbn_pericom_PI7C9X7958 },
        /*
+         * ACCES I/O Products quad
+         */
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        /*
         * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke)
         */
        {       PCI_VENDOR_ID_TOPIC, PCI_DEVICE_ID_TOPIC_TP560,
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 7481b95c6d84..bdfa659b9606 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1618,8 +1618,6 @@ static void serial8250_disable_ms(struct uart_port *port)
        if (up->bugs & UART_BUG_NOMSR)
                return;
-        mctrl_gpio_disable_ms(up->gpios);
        up->ier &= ~UART_IER_MSI;
        serial_port_out(port, UART_IER, up->ier);
 }
@@ -1632,8 +1630,6 @@ static void serial8250_enable_ms(struct uart_port *port)
        if (up->bugs & UART_BUG_NOMSR)
                return;
-        mctrl_gpio_enable_ms(up->gpios);
        up->ier |= UART_IER_MSI;
        serial8250_rpm_get(up);
@@ -1917,8 +1913,7 @@ unsigned int serial8250_do_get_mctrl(struct uart_port *port)
                ret |= TIOCM_DSR;
        if (status & UART_MSR_CTS)
                ret |= TIOCM_CTS;
+        return ret;
-        return mctrl_gpio_get(up->gpios, &ret);
 }
 EXPORT_SYMBOL_GPL(serial8250_do_get_mctrl);
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index c9ec839a5ddf..7c6f7afca5dd 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -6,7 +6,6 @@
 config SERIAL_8250
        tristate "8250/16550 and compatible serial support"
        select SERIAL_CORE
-        select SERIAL_MCTRL_GPIO if GPIOLIB
        ---help---
          This selects whether you want to include the driver for the standard
          serial ports.  The standard answer is Y.  People who might say N
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 065f5d97aa67..dfec5a176315 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1596,8 +1596,11 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on)
 {
        struct ci_hdrc *ci = container_of(_gadget, struct ci_hdrc, gadget);
-        /* Data+ pullup controlled by OTG state machine in OTG fsm mode */
+        /*
-        if (ci_otg_is_fsm_mode(ci))
+         * Data+ pullup controlled by OTG state machine in OTG fsm mode;
+         * and don't touch Data+ in host mode for dual role config.
+         */
+        if (ci_otg_is_fsm_mode(ci) || ci->role == CI_ROLE_HOST)
                return 0;
        pm_runtime_get_sync(&ci->gadget.dev);
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 051163189810..15ce4ab11688 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -187,7 +187,7 @@ static const unsigned short high_speed_maxpacket_maxes[4] = {
        [USB_ENDPOINT_XFER_CONTROL] = 64,
        [USB_ENDPOINT_XFER_ISOC] = 1024,
        [USB_ENDPOINT_XFER_BULK] = 512,
-        [USB_ENDPOINT_XFER_INT] = 1023,
+        [USB_ENDPOINT_XFER_INT] = 1024,
 };
 static const unsigned short super_speed_maxpacket_maxes[4] = {
        [USB_ENDPOINT_XFER_CONTROL] = 512,
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index e6a6d67c8705..09c8d9ca61ae 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1709,11 +1709,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
        as->urb->start_frame = uurb->start_frame;
        as->urb->number_of_packets = number_of_packets;
        as->urb->stream_id = stream_id;
-        if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
-                        ps->dev->speed == USB_SPEED_HIGH)
+        if (ep->desc.bInterval) {
-                as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
+                if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
-        else
+                                ps->dev->speed == USB_SPEED_HIGH ||
-                as->urb->interval = ep->desc.bInterval;
+                                ps->dev->speed >= USB_SPEED_SUPER)
+                        as->urb->interval = 1 <<
+                                        min(15, ep->desc.bInterval - 1);
+                else
+                        as->urb->interval = ep->desc.bInterval;
+        }
        as->urb->context = as;
        as->urb->complete = async_completed;
        for (totlen = u = 0; u < number_of_packets; u++) {
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index 9fae0291cd69..d64551243789 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -868,6 +868,7 @@ struct dwc2_hsotg {
        void *priv;
        int     irq;
        struct clk *clk;
+        struct reset_control *reset;
        unsigned int queuing_high_bandwidth:1;
        unsigned int srp_success:1;
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index fc6f5251de5d..530959a8a6d1 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -45,6 +45,7 @@
 #include <linux/platform_device.h>
 #include <linux/phy/phy.h>
 #include <linux/platform_data/s3c-hsotg.h>
+#include <linux/reset.h>
 #include <linux/usb/of.h>
@@ -337,6 +338,24 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
 {
        int i, ret;
+        hsotg->reset = devm_reset_control_get_optional(hsotg->dev, "dwc2");
+        if (IS_ERR(hsotg->reset)) {
+                ret = PTR_ERR(hsotg->reset);
+                switch (ret) {
+                case -ENOENT:
+                case -ENOTSUPP:
+                        hsotg->reset = NULL;
+                        break;
+                default:
+                        dev_err(hsotg->dev, "error getting reset control %d\n",
+                                ret);
+                        return ret;
+                }
+        }
+        if (hsotg->reset)
+                reset_control_deassert(hsotg->reset);
        /* Set default UTMI width */
        hsotg->phyif = GUSBCFG_PHYIF16;
@@ -434,6 +453,9 @@ static int dwc2_driver_remove(struct platform_device *dev)
        if (hsotg->ll_hw_enabled)
                dwc2_lowlevel_hw_disable(hsotg);
+        if (hsotg->reset)
+                reset_control_assert(hsotg->reset);
        return 0;
 }
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 946643157b78..35d092456bec 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1192,6 +1192,7 @@ static int dwc3_runtime_resume(struct device *dev)
        }
        pm_runtime_mark_last_busy(dev);
+        pm_runtime_put(dev);
        return 0;
 }
diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h
index 22dfc3dd6a13..33ab2a203c1b 100644
--- a/drivers/usb/dwc3/debug.h
+++ b/drivers/usb/dwc3/debug.h
@@ -192,7 +192,7 @@ dwc3_ep_event_string(const struct dwc3_event_depevt *event)
        int ret;
        ret = sprintf(str, "ep%d%s: ", epnum >> 1,
-                        (epnum & 1) ? "in" : "in");
+                        (epnum & 1) ? "in" : "out");
        if (ret < 0)
                return "UNKNOWN";
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 2eb84d6c24a6..0a32430f4c41 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -243,6 +243,13 @@ static int dwc3_pci_runtime_suspend(struct device *dev)
        return -EBUSY;
 }
+static int dwc3_pci_runtime_resume(struct device *dev)
+{
+        struct platform_device *dwc3 = dev_get_drvdata(dev);
+        return pm_runtime_get(&dwc3->dev);
+}
 static int dwc3_pci_pm_dummy(struct device *dev)
 {
        /*
@@ -259,7 +266,7 @@ static int dwc3_pci_pm_dummy(struct device *dev)
 static struct dev_pm_ops dwc3_pci_dev_pm_ops = {
        SET_SYSTEM_SLEEP_PM_OPS(dwc3_pci_pm_dummy, dwc3_pci_pm_dummy)
-        SET_RUNTIME_PM_OPS(dwc3_pci_runtime_suspend, dwc3_pci_pm_dummy,
+        SET_RUNTIME_PM_OPS(dwc3_pci_runtime_suspend, dwc3_pci_runtime_resume,
                NULL)
 };
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 1f5597ef945d..7a8d3d822b54 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -884,12 +884,9 @@ static u32 dwc3_calc_trbs_left(struct dwc3_ep *dep)
                return DWC3_TRB_NUM - 1;
        }
-        trbs_left = dep->trb_dequeue - dep->trb_enqueue;
+        trbs_left = dep->trb_dequeue - dep->trb_enqueue - 1;
        trbs_left &= (DWC3_TRB_NUM - 1);
-        if (dep->trb_dequeue < dep->trb_enqueue)
-                trbs_left--;
        return trbs_left;
 }
@@ -1433,7 +1430,7 @@ static int dwc3_gadget_get_frame(struct usb_gadget *g)
 static int __dwc3_gadget_wakeup(struct dwc3 *dwc)
 {
-        unsigned long           timeout;
+        int                     retries;
        int                     ret;
        u32                     reg;
@@ -1484,9 +1481,9 @@ static int __dwc3_gadget_wakeup(struct dwc3 *dwc)
        }
        /* poll until Link State changes to ON */
-        timeout = jiffies + msecs_to_jiffies(100);
+        retries = 20000;
-        while (!time_after(jiffies, timeout)) {
+        while (retries--) {
                reg = dwc3_readl(dwc->regs, DWC3_DSTS);
                /* in HS, means ON */
diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index d58bfc32be9e..8741fd740174 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -341,11 +341,15 @@ static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb)
 {
        struct sk_buff  *skb2 = NULL;
        struct usb_ep   *in = port->in_ep;
-        int             padlen = 0;
+        int             headroom, tailroom, padlen = 0;
        u16             len = skb->len;
-        int headroom = skb_headroom(skb);
+        if (!skb)
-        int tailroom = skb_tailroom(skb);
+                return NULL;
+        len = skb->len;
+        headroom = skb_headroom(skb);
+        tailroom = skb_tailroom(skb);
        /* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0,
         * stick two bytes of zero-length EEM packet on the end.
diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index c8005823b190..16562e461121 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -374,6 +374,9 @@ static struct sk_buff *rndis_add_header(struct gether *port,
 {
        struct sk_buff *skb2;
+        if (!skb)
+                return NULL;
        skb2 = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type));
        rndis_add_hdr(skb2);
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index 6ded6345cd09..e0cd1e4c8892 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -375,10 +375,15 @@ __acquires(&port->port_lock)
 */
 {
        struct list_head        *pool = &port->write_pool;
-        struct usb_ep           *in = port->port_usb->in;
+        struct usb_ep           *in;
        int                     status = 0;
        bool                    do_tty_wake = false;
+        if (!port->port_usb)
+                return status;
+        in = port->port_usb->in;
        while (!port->write_busy && !list_empty(pool)) {
                struct usb_request      *req;
                int                     len;
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 934f83881c30..40c04bb25f2f 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -827,7 +827,7 @@ void usb_gadget_unmap_request_by_dev(struct device *dev,
                return;
        if (req->num_mapped_sgs) {
-                dma_unmap_sg(dev, req->sg, req->num_mapped_sgs,
+                dma_unmap_sg(dev, req->sg, req->num_sgs,
                                is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
                req->num_mapped_sgs = 0;
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index cf8819a5c5b2..8bb011ea78f7 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -1878,11 +1878,8 @@ static int qe_get_frame(struct usb_gadget *gadget)
        tmp = in_be16(&udc->usb_param->frame_n);
        if (tmp & 0x8000)
-                tmp = tmp & 0x07ff;
+                return tmp & 0x07ff;
-        else
+        return -EINVAL;
-                tmp = -EINVAL;
-        return (int)tmp;
 }
 static int fsl_qe_start(struct usb_gadget *gadget,
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index 192248f974ec..fe08e776fec3 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -290,6 +290,7 @@ int musb_hub_control(
        u32             temp;
        int             retval = 0;
        unsigned long   flags;
+        bool            start_musb = false;
        spin_lock_irqsave(&musb->lock, flags);
@@ -390,7 +391,7 @@ int musb_hub_control(
                         * logic relating to VBUS power-up.
                         */
                        if (!hcd->self.is_b_host && musb_has_gadget(musb))
-                                musb_start(musb);
+                                start_musb = true;
                        break;
                case USB_PORT_FEAT_RESET:
                        musb_port_reset(musb, true);
@@ -451,5 +452,9 @@ error:
                retval = -EPIPE;
        }
        spin_unlock_irqrestore(&musb->lock, flags);
+        if (start_musb)
+                musb_start(musb);
        return retval;
 }
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 92bc83b92d10..c4c64740a3e7 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -1076,7 +1076,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv)
        gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED);
        dev_info(dev, "%stransceiver found\n",
-                 gpriv->transceiver ? "" : "no ");
+                 !IS_ERR(gpriv->transceiver) ? "" : "no ");
        /*
         * CAUTION
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 5608af4a369d..de9992b492b0 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -1252,7 +1252,7 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port,
        if (urb->transfer_buffer == NULL) {
                urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
-                                               GFP_KERNEL);
+                                               GFP_ATOMIC);
                if (!urb->transfer_buffer)
                        goto exit;
        }
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index ed378fb232e7..57426d703a09 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1340,8 +1340,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
        }
        if (urb->transfer_buffer == NULL) {
-                urb->transfer_buffer =
+                urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
-                    kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL);
+                                               GFP_ATOMIC);
                if (!urb->transfer_buffer)
                        goto exit;
        }
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index bc472584a229..9894e341c6ac 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -525,6 +525,12 @@ static void option_instat_callback(struct urb *urb);
 #define VIATELECOM_VENDOR_ID                    0x15eb
 #define VIATELECOM_PRODUCT_CDS7                 0x0001
+/* WeTelecom products */
+#define WETELECOM_VENDOR_ID                     0x22de
+#define WETELECOM_PRODUCT_WMD200                0x6801
+#define WETELECOM_PRODUCT_6802                  0x6802
+#define WETELECOM_PRODUCT_WMD300                0x6803
 struct option_blacklist_info {
        /* bitmask of interface numbers blacklisted for send_setup */
        const unsigned long sendsetup;
@@ -1991,6 +1997,9 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
        { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
        { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
        { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 7f6aff3f72eb..e5495f37c6ed 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -853,6 +853,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
                current->flags |= PF_RANDOMIZE;
        setup_new_exec(bprm);
+        install_exec_creds(bprm);
        /* Do this so that we can load the interpreter, if need be.  We will
           change some of these later */
@@ -1044,7 +1045,6 @@ static int load_elf_binary(struct linux_binprm *bprm)
                goto out;
 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
-        install_exec_creds(bprm);
        retval = create_elf_tables(bprm, &loc->elf_ex,
                          load_addr, interp_load_addr);
        if (retval < 0)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 0450dc410533..8c8a4d1e02b9 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4901,11 +4901,6 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_root *root,
        u64 expected;
        u64 to_reclaim = 0;
-        to_reclaim = min_t(u64, num_online_cpus() * SZ_1M, SZ_16M);
-        if (can_overcommit(root, space_info, to_reclaim,
-                           BTRFS_RESERVE_FLUSH_ALL))
-                return 0;
        list_for_each_entry(ticket, &space_info->tickets, list)
                to_reclaim += ticket->bytes;
        list_for_each_entry(ticket, &space_info->priority_tickets, list)
@@ -4913,6 +4908,11 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_root *root,
        if (to_reclaim)
                return to_reclaim;
+        to_reclaim = min_t(u64, num_online_cpus() * SZ_1M, SZ_16M);
+        if (can_overcommit(root, space_info, to_reclaim,
+                           BTRFS_RESERVE_FLUSH_ALL))
+                return 0;
        used = space_info->bytes_used + space_info->bytes_reserved +
               space_info->bytes_pinned + space_info->bytes_readonly +
               space_info->bytes_may_use;
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 8a2c2a07987b..c0c13dc6fe12 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -4200,9 +4200,11 @@ restart:
                err = PTR_ERR(trans);
                goto out_free;
        }
-        err = qgroup_fix_relocated_data_extents(trans, rc);
+        ret = qgroup_fix_relocated_data_extents(trans, rc);
-        if (err < 0) {
+        if (ret < 0) {
-                btrfs_abort_transaction(trans, err);
+                btrfs_abort_transaction(trans, ret);
+                if (!err)
+                        err = ret;
                goto out_free;
        }
        btrfs_commit_transaction(trans, rc->extent_root);
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index efe129fe2678..a87675ffd02b 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -4268,10 +4268,12 @@ static int process_all_refs(struct send_ctx *sctx,
        }
        btrfs_release_path(path);
+        /*
+         * We don't actually care about pending_move as we are simply
+         * re-creating this inode and will be rename'ing it into place once we
+         * rename the parent directory.
+         */
        ret = process_recorded_refs(sctx, &pending_move);
-        /* Only applicable to an incremental send. */
-        ASSERT(pending_move == 0);
 out:
        btrfs_free_path(path);
        return ret;
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index d116453b0276..79a5941c2474 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -585,7 +585,8 @@ struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv)
 */
 void *devpts_get_priv(struct dentry *dentry)
 {
-        WARN_ON_ONCE(dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC);
+        if (dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC)
+                return NULL;
        return dentry->d_fsdata;
 }
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 3131747199e1..c6ea25a190f8 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5466,8 +5466,6 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
                                                      sbi->s_want_extra_isize,
                                                      iloc, handle);
                        if (ret) {
-                                ext4_set_inode_state(inode,
-                                                     EXT4_STATE_NO_EXPAND);
                                if (mnt_count !=
                                        le16_to_cpu(sbi->s_es->s_mnt_count)) {
                                        ext4_warning(inode->i_sb,
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 1c593aa0218e..3ec8708989ca 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2211,6 +2211,7 @@ void ext4_group_desc_csum_set(struct super_block *sb, __u32 block_group,
 /* Called at mount-time, super-block is locked */
 static int ext4_check_descriptors(struct super_block *sb,
+                                  ext4_fsblk_t sb_block,
                                  ext4_group_t *first_not_zeroed)
 {
        struct ext4_sb_info *sbi = EXT4_SB(sb);
@@ -2241,6 +2242,11 @@ static int ext4_check_descriptors(struct super_block *sb,
                        grp = i;
                block_bitmap = ext4_block_bitmap(sb, gdp);
+                if (block_bitmap == sb_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+                                 "Block bitmap for group %u overlaps "
+                                 "superblock", i);
+                }
                if (block_bitmap < first_block || block_bitmap > last_block) {
                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
                               "Block bitmap for group %u not in group "
@@ -2248,6 +2254,11 @@ static int ext4_check_descriptors(struct super_block *sb,
                        return 0;
                }
                inode_bitmap = ext4_inode_bitmap(sb, gdp);
+                if (inode_bitmap == sb_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+                                 "Inode bitmap for group %u overlaps "
+                                 "superblock", i);
+                }
                if (inode_bitmap < first_block || inode_bitmap > last_block) {
                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
                               "Inode bitmap for group %u not in group "
@@ -2255,6 +2266,11 @@ static int ext4_check_descriptors(struct super_block *sb,
                        return 0;
                }
                inode_table = ext4_inode_table(sb, gdp);
+                if (inode_table == sb_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+                                 "Inode table for group %u overlaps "
+                                 "superblock", i);
+                }
                if (inode_table < first_block ||
                    inode_table + sbi->s_itb_per_group - 1 > last_block) {
                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
@@ -3757,7 +3773,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                        goto failed_mount2;
                }
        }
-        if (!ext4_check_descriptors(sb, &first_not_zeroed)) {
+        if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
                ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
                ret = -EFSCORRUPTED;
                goto failed_mount2;
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 39e9cfb1b371..2eb935ca5d9e 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1353,15 +1353,19 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
        size_t min_offs, free;
        int total_ino;
        void *base, *start, *end;
-        int extra_isize = 0, error = 0, tried_min_extra_isize = 0;
+        int error = 0, tried_min_extra_isize = 0;
        int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize);
+        int isize_diff; /* How much do we need to grow i_extra_isize */
        down_write(&EXT4_I(inode)->xattr_sem);
+        /*
+         * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty
+         */
+        ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
 retry:
-        if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) {
+        isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize;
-                up_write(&EXT4_I(inode)->xattr_sem);
+        if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)
-                return 0;
+                goto out;
-        }
        header = IHDR(inode, raw_inode);
        entry = IFIRST(header);
@@ -1382,7 +1386,7 @@ retry:
                goto cleanup;
        free = ext4_xattr_free_space(last, &min_offs, base, &total_ino);
-        if (free >= new_extra_isize) {
+        if (free >= isize_diff) {
                entry = IFIRST(header);
                ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize
                                - new_extra_isize, (void *)raw_inode +
@@ -1390,8 +1394,7 @@ retry:
                                (void *)header, total_ino,
                                inode->i_sb->s_blocksize);
                EXT4_I(inode)->i_extra_isize = new_extra_isize;
-                error = 0;
+                goto out;
-                goto cleanup;
        }
        /*
@@ -1414,7 +1417,7 @@ retry:
                end = bh->b_data + bh->b_size;
                min_offs = end - base;
                free = ext4_xattr_free_space(first, &min_offs, base, NULL);
-                if (free < new_extra_isize) {
+                if (free < isize_diff) {
                        if (!tried_min_extra_isize && s_min_extra_isize) {
                                tried_min_extra_isize++;
                                new_extra_isize = s_min_extra_isize;
@@ -1428,7 +1431,7 @@ retry:
                free = inode->i_sb->s_blocksize;
        }
-        while (new_extra_isize > 0) {
+        while (isize_diff > 0) {
                size_t offs, size, entry_size;
                struct ext4_xattr_entry *small_entry = NULL;
                struct ext4_xattr_info i = {
@@ -1459,7 +1462,7 @@ retry:
                        EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) +
                                        EXT4_XATTR_LEN(last->e_name_len);
                        if (total_size <= free && total_size < min_total_size) {
-                                if (total_size < new_extra_isize) {
+                                if (total_size < isize_diff) {
                                        small_entry = last;
                                } else {
                                        entry = last;
@@ -1514,22 +1517,22 @@ retry:
                error = ext4_xattr_ibody_set(handle, inode, &i, is);
                if (error)
                        goto cleanup;
+                total_ino -= entry_size;
                entry = IFIRST(header);
-                if (entry_size + EXT4_XATTR_SIZE(size) >= new_extra_isize)
+                if (entry_size + EXT4_XATTR_SIZE(size) >= isize_diff)
-                        shift_bytes = new_extra_isize;
+                        shift_bytes = isize_diff;
                else
-                        shift_bytes = entry_size + size;
+                        shift_bytes = entry_size + EXT4_XATTR_SIZE(size);
                /* Adjust the offsets and shift the remaining entries ahead */
-                ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize -
+                ext4_xattr_shift_entries(entry, -shift_bytes,
-                        shift_bytes, (void *)raw_inode +
+                        (void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
-                        EXT4_GOOD_OLD_INODE_SIZE + extra_isize + shift_bytes,
+                        EXT4_I(inode)->i_extra_isize + shift_bytes,
-                        (void *)header, total_ino - entry_size,
+                        (void *)header, total_ino, inode->i_sb->s_blocksize);
-                        inode->i_sb->s_blocksize);
-                extra_isize += shift_bytes;
+                isize_diff -= shift_bytes;
-                new_extra_isize -= shift_bytes;
+                EXT4_I(inode)->i_extra_isize += shift_bytes;
-                EXT4_I(inode)->i_extra_isize = extra_isize;
+                header = IHDR(inode, raw_inode);
                i.name = b_entry_name;
                i.value = buffer;
@@ -1551,6 +1554,8 @@ retry:
                kfree(bs);
        }
        brelse(bh);
+out:
+        ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
        up_write(&EXT4_I(inode)->xattr_sem);
        return 0;
@@ -1562,6 +1567,10 @@ cleanup:
        kfree(is);
        kfree(bs);
        brelse(bh);
+        /*
+         * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode
+         * size expansion failed.
+         */
        up_write(&EXT4_I(inode)->xattr_sem);
        return error;
 }
diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
index 69dd3e6566e0..a92e783fa057 100644
--- a/fs/ext4/xattr.h
+++ b/fs/ext4/xattr.h
@@ -24,6 +24,7 @@
 #define EXT4_XATTR_INDEX_SYSTEM                 7
 #define EXT4_XATTR_INDEX_RICHACL                8
 #define EXT4_XATTR_INDEX_ENCRYPTION             9
+#define EXT4_XATTR_INDEX_HURD                   10 /* Reserved for Hurd */
 struct ext4_xattr_header {
        __le32  h_magic;        /* magic number for identification */
diff --git a/fs/iomap.c b/fs/iomap.c
index 0342254646e3..706270f21b35 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -428,9 +428,12 @@ static int iomap_to_fiemap(struct fiemap_extent_info *fi,
                break;
        }
+        if (iomap->flags & IOMAP_F_MERGED)
+                flags |= FIEMAP_EXTENT_MERGED;
        return fiemap_fill_next_extent(fi, iomap->offset,
                        iomap->blkno != IOMAP_NULL_BLOCK ? iomap->blkno << 9: 0,
-                        iomap->length, flags | FIEMAP_EXTENT_MERGED);
+                        iomap->length, flags);
 }
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index e1574008adc9..2bcb86e6e6ca 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -840,21 +840,35 @@ repeat:
        mutex_lock(&kernfs_mutex);
        list_for_each_entry(info, &kernfs_root(kn)->supers, node) {
+                struct kernfs_node *parent;
                struct inode *inode;
-                struct dentry *dentry;
+                /*
+                 * We want fsnotify_modify() on @kn but as the
+                 * modifications aren't originating from userland don't
+                 * have the matching @file available.  Look up the inodes
+                 * and generate the events manually.
+                 */
                inode = ilookup(info->sb, kn->ino);
                if (!inode)
                        continue;
-                dentry = d_find_any_alias(inode);
+                parent = kernfs_get_parent(kn);
-                if (dentry) {
+                if (parent) {
-                        fsnotify_parent(NULL, dentry, FS_MODIFY);
+                        struct inode *p_inode;
-                        fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE,
-                                 NULL, 0);
+                        p_inode = ilookup(info->sb, parent->ino);
-                        dput(dentry);
+                        if (p_inode) {
+                                fsnotify(p_inode, FS_MODIFY | FS_EVENT_ON_CHILD,
+                                         inode, FSNOTIFY_EVENT_INODE, kn->name, 0);
+                                iput(p_inode);
+                        }
+                        kernfs_put(parent);
                }
+                fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE,
+                         kn->name, 0);
                iput(inode);
        }
diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
index f55a4e756047..217847679f0e 100644
--- a/fs/nfs/blocklayout/blocklayout.c
+++ b/fs/nfs/blocklayout/blocklayout.c
@@ -346,7 +346,7 @@ static void bl_write_cleanup(struct work_struct *work)
                        PAGE_SIZE - 1) & (loff_t)PAGE_MASK;
                ext_tree_mark_written(bl, start >> SECTOR_SHIFT,
-                                        (end - start) >> SECTOR_SHIFT);
+                                        (end - start) >> SECTOR_SHIFT, end);
        }
        pnfs_ld_write_done(hdr);
diff --git a/fs/nfs/blocklayout/blocklayout.h b/fs/nfs/blocklayout/blocklayout.h
index 18e6fd0b9506..efc007f00742 100644
--- a/fs/nfs/blocklayout/blocklayout.h
+++ b/fs/nfs/blocklayout/blocklayout.h
@@ -141,6 +141,7 @@ struct pnfs_block_layout {
        struct rb_root          bl_ext_ro;
        spinlock_t              bl_ext_lock;   /* Protects list manipulation */
        bool                    bl_scsi_layout;
+        u64                     bl_lwb;
 };
 static inline struct pnfs_block_layout *
@@ -182,7 +183,7 @@ int ext_tree_insert(struct pnfs_block_layout *bl,
 int ext_tree_remove(struct pnfs_block_layout *bl, bool rw, sector_t start,
                sector_t end);
 int ext_tree_mark_written(struct pnfs_block_layout *bl, sector_t start,
-                sector_t len);
+                sector_t len, u64 lwb);
 bool ext_tree_lookup(struct pnfs_block_layout *bl, sector_t isect,
                struct pnfs_block_extent *ret, bool rw);
 int ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg);
diff --git a/fs/nfs/blocklayout/extent_tree.c b/fs/nfs/blocklayout/extent_tree.c
index 992bcb19c11e..c85fbfd2d0d9 100644
--- a/fs/nfs/blocklayout/extent_tree.c
+++ b/fs/nfs/blocklayout/extent_tree.c
@@ -402,7 +402,7 @@ ext_tree_split(struct rb_root *root, struct pnfs_block_extent *be,
 int
 ext_tree_mark_written(struct pnfs_block_layout *bl, sector_t start,
-                sector_t len)
+                sector_t len, u64 lwb)
 {
        struct rb_root *root = &bl->bl_ext_rw;
        sector_t end = start + len;
@@ -471,6 +471,8 @@ ext_tree_mark_written(struct pnfs_block_layout *bl, sector_t start,
                }
        }
 out:
+        if (bl->bl_lwb < lwb)
+                bl->bl_lwb = lwb;
        spin_unlock(&bl->bl_ext_lock);
        __ext_put_deviceids(&tmp);
@@ -518,7 +520,7 @@ static __be32 *encode_scsi_range(struct pnfs_block_extent *be, __be32 *p)
 }
 static int ext_tree_encode_commit(struct pnfs_block_layout *bl, __be32 *p,
-                size_t buffer_size, size_t *count)
+                size_t buffer_size, size_t *count, __u64 *lastbyte)
 {
        struct pnfs_block_extent *be;
        int ret = 0;
@@ -542,6 +544,8 @@ static int ext_tree_encode_commit(struct pnfs_block_layout *bl, __be32 *p,
                        p = encode_block_extent(be, p);
                be->be_tag = EXTENT_COMMITTING;
        }
+        *lastbyte = bl->bl_lwb - 1;
+        bl->bl_lwb = 0;
        spin_unlock(&bl->bl_ext_lock);
        return ret;
@@ -564,7 +568,7 @@ ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg)
        arg->layoutupdate_pages = &arg->layoutupdate_page;
 retry:
-        ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size, &count);
+        ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size, &count, &arg->lastbytewritten);
        if (unlikely(ret)) {
                ext_tree_free_commitdata(arg, buffer_size);
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index a7f2e6e33305..52a28311e2a4 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -275,6 +275,7 @@ static int nfs_callback_up_net(int minorversion, struct svc_serv *serv,
 err_socks:
        svc_rpcb_cleanup(serv, net);
 err_bind:
+        nn->cb_users[minorversion]--;
        dprintk("NFS: Couldn't create callback socket: err = %d; "
                        "net = %p\n", ret, net);
        return ret;
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index c92a75e066a6..f953ef6b2f2e 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -454,11 +454,8 @@ static bool referring_call_exists(struct nfs_client *clp,
                                ((u32 *)&rclist->rcl_sessionid.data)[3],
                                ref->rc_sequenceid, ref->rc_slotid);
-                        spin_lock(&tbl->slot_tbl_lock);
+                        status = nfs4_slot_wait_on_seqid(tbl, ref->rc_slotid,
-                        status = (test_bit(ref->rc_slotid, tbl->used_slots) &&
+                                        ref->rc_sequenceid, HZ >> 1) < 0;
-                                  tbl->slots[ref->rc_slotid].seq_nr ==
-                                        ref->rc_sequenceid);
-                        spin_unlock(&tbl->slot_tbl_lock);
                        if (status)
                                goto out;
                }
@@ -487,7 +484,6 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
                goto out;
        tbl = &clp->cl_session->bc_slot_table;
-        slot = tbl->slots + args->csa_slotid;
        /* Set up res before grabbing the spinlock */
        memcpy(&res->csr_sessionid, &args->csa_sessionid,
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 003ebce4bbc4..1e106780a237 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -426,7 +426,7 @@ EXPORT_SYMBOL_GPL(nfs_mark_client_ready);
 * Initialise the timeout values for a connection
 */
 void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
-                                    unsigned int timeo, unsigned int retrans)
+                                    int timeo, int retrans)
 {
        to->to_initval = timeo * HZ / 10;
        to->to_retries = retrans;
@@ -434,9 +434,9 @@ void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
        switch (proto) {
        case XPRT_TRANSPORT_TCP:
        case XPRT_TRANSPORT_RDMA:
-                if (to->to_retries == 0)
+                if (retrans == NFS_UNSPEC_RETRANS)
                        to->to_retries = NFS_DEF_TCP_RETRANS;
-                if (to->to_initval == 0)
+                if (timeo == NFS_UNSPEC_TIMEO || to->to_retries == 0)
                        to->to_initval = NFS_DEF_TCP_TIMEO * HZ / 10;
                if (to->to_initval > NFS_MAX_TCP_TIMEOUT)
                        to->to_initval = NFS_MAX_TCP_TIMEOUT;
@@ -449,9 +449,9 @@ void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
                to->to_exponential = 0;
                break;
        case XPRT_TRANSPORT_UDP:
-                if (to->to_retries == 0)
+                if (retrans == NFS_UNSPEC_RETRANS)
                        to->to_retries = NFS_DEF_UDP_RETRANS;
-                if (!to->to_initval)
+                if (timeo == NFS_UNSPEC_TIMEO || to->to_initval == 0)
                        to->to_initval = NFS_DEF_UDP_TIMEO * HZ / 10;
                if (to->to_initval > NFS_MAX_UDP_TIMEOUT)
                        to->to_initval = NFS_MAX_UDP_TIMEOUT;
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index e6206eaf2bdf..51b51369704c 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -37,6 +37,7 @@ ff_layout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags)
        if (ffl) {
                INIT_LIST_HEAD(&ffl->error_list);
                INIT_LIST_HEAD(&ffl->mirrors);
+                ffl->last_report_time = ktime_get();
                return &ffl->generic_hdr;
        } else
                return NULL;
@@ -640,19 +641,18 @@ nfs4_ff_layoutstat_start_io(struct nfs4_ff_layout_mirror *mirror,
 {
        static const ktime_t notime = {0};
        s64 report_interval = FF_LAYOUTSTATS_REPORT_INTERVAL;
+        struct nfs4_flexfile_layout *ffl = FF_LAYOUT_FROM_HDR(mirror->layout);
        nfs4_ff_start_busy_timer(&layoutstat->busy_timer, now);
        if (ktime_equal(mirror->start_time, notime))
                mirror->start_time = now;
-        if (ktime_equal(mirror->last_report_time, notime))
-                mirror->last_report_time = now;
        if (mirror->report_interval != 0)
                report_interval = (s64)mirror->report_interval * 1000LL;
        else if (layoutstats_timer != 0)
                report_interval = (s64)layoutstats_timer * 1000LL;
-        if (ktime_to_ms(ktime_sub(now, mirror->last_report_time)) >=
+        if (ktime_to_ms(ktime_sub(now, ffl->last_report_time)) >=
                        report_interval) {
-                mirror->last_report_time = now;
+                ffl->last_report_time = now;
                return true;
        }
@@ -806,11 +806,14 @@ ff_layout_choose_best_ds_for_read(struct pnfs_layout_segment *lseg,
 {
        struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg);
        struct nfs4_pnfs_ds *ds;
+        bool fail_return = false;
        int idx;
        /* mirrors are sorted by efficiency */
        for (idx = start_idx; idx < fls->mirror_array_cnt; idx++) {
-                ds = nfs4_ff_layout_prepare_ds(lseg, idx, false);
+                if (idx+1 == fls->mirror_array_cnt)
+                        fail_return = true;
+                ds = nfs4_ff_layout_prepare_ds(lseg, idx, fail_return);
                if (ds) {
                        *best_idx = idx;
                        return ds;
@@ -859,6 +862,7 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio,
        struct nfs4_pnfs_ds *ds;
        int ds_idx;
+retry:
        /* Use full layout for now */
        if (!pgio->pg_lseg)
                ff_layout_pg_get_read(pgio, req, false);
@@ -871,10 +875,13 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio,
        ds = ff_layout_choose_best_ds_for_read(pgio->pg_lseg, 0, &ds_idx);
        if (!ds) {
-                if (ff_layout_no_fallback_to_mds(pgio->pg_lseg))
+                if (!ff_layout_no_fallback_to_mds(pgio->pg_lseg))
-                        goto out_pnfs;
-                else
                        goto out_mds;
+                pnfs_put_lseg(pgio->pg_lseg);
+                pgio->pg_lseg = NULL;
+                /* Sleep for 1 second before retrying */
+                ssleep(1);
+                goto retry;
        }
        mirror = FF_LAYOUT_COMP(pgio->pg_lseg, ds_idx);
@@ -890,12 +897,6 @@ out_mds:
        pnfs_put_lseg(pgio->pg_lseg);
        pgio->pg_lseg = NULL;
        nfs_pageio_reset_read_mds(pgio);
-        return;
-out_pnfs:
-        pnfs_set_lo_fail(pgio->pg_lseg);
-        pnfs_put_lseg(pgio->pg_lseg);
-        pgio->pg_lseg = NULL;
 }
 static void
@@ -909,6 +910,7 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio,
        int i;
        int status;
+retry:
        if (!pgio->pg_lseg) {
                pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
                                                   req->wb_context,
@@ -940,10 +942,13 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio,
        for (i = 0; i < pgio->pg_mirror_count; i++) {
                ds = nfs4_ff_layout_prepare_ds(pgio->pg_lseg, i, true);
                if (!ds) {
-                        if (ff_layout_no_fallback_to_mds(pgio->pg_lseg))
+                        if (!ff_layout_no_fallback_to_mds(pgio->pg_lseg))
-                                goto out_pnfs;
-                        else
                                goto out_mds;
+                        pnfs_put_lseg(pgio->pg_lseg);
+                        pgio->pg_lseg = NULL;
+                        /* Sleep for 1 second before retrying */
+                        ssleep(1);
+                        goto retry;
                }
                pgm = &pgio->pg_mirrors[i];
                mirror = FF_LAYOUT_COMP(pgio->pg_lseg, i);
@@ -956,12 +961,6 @@ out_mds:
        pnfs_put_lseg(pgio->pg_lseg);
        pgio->pg_lseg = NULL;
        nfs_pageio_reset_write_mds(pgio);
-        return;
-out_pnfs:
-        pnfs_set_lo_fail(pgio->pg_lseg);
-        pnfs_put_lseg(pgio->pg_lseg);
-        pgio->pg_lseg = NULL;
 }
 static unsigned int
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index 1bcdb15d0c41..3ee0c9fcea76 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -84,7 +84,6 @@ struct nfs4_ff_layout_mirror {
        struct nfs4_ff_layoutstat       read_stat;
        struct nfs4_ff_layoutstat       write_stat;
        ktime_t                         start_time;
-        ktime_t                         last_report_time;
        u32                             report_interval;
 };
@@ -101,6 +100,7 @@ struct nfs4_flexfile_layout {
        struct pnfs_ds_commit_info commit_info;
        struct list_head        mirrors;
        struct list_head        error_list; /* nfs4_ff_layout_ds_err */
+        ktime_t                 last_report_time; /* Layoutstat report times */
 };
 static inline struct nfs4_flexfile_layout *
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 0aa36be71fce..f7a3f6b05369 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -17,8 +17,8 @@
 #define NFSDBG_FACILITY         NFSDBG_PNFS_LD
-static unsigned int dataserver_timeo = NFS4_DEF_DS_TIMEO;
+static unsigned int dataserver_timeo = NFS_DEF_TCP_RETRANS;
-static unsigned int dataserver_retrans = NFS4_DEF_DS_RETRANS;
+static unsigned int dataserver_retrans;
 void nfs4_ff_layout_put_deviceid(struct nfs4_ff_layout_ds *mirror_ds)
 {
@@ -379,7 +379,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
        devid = &mirror->mirror_ds->id_node;
        if (ff_layout_test_devid_unavailable(devid))
-                goto out;
+                goto out_fail;
        ds = mirror->mirror_ds->ds;
        /* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */
@@ -405,15 +405,16 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
                        mirror->mirror_ds->ds_versions[0].rsize = max_payload;
                if (mirror->mirror_ds->ds_versions[0].wsize > max_payload)
                        mirror->mirror_ds->ds_versions[0].wsize = max_payload;
-        } else {
+                goto out;
-                ff_layout_track_ds_error(FF_LAYOUT_FROM_HDR(lseg->pls_layout),
-                                         mirror, lseg->pls_range.offset,
-                                         lseg->pls_range.length, NFS4ERR_NXIO,
-                                         OP_ILLEGAL, GFP_NOIO);
-                if (fail_return || !ff_layout_has_available_ds(lseg))
-                        pnfs_error_mark_layout_for_return(ino, lseg);
-                ds = NULL;
        }
+        ff_layout_track_ds_error(FF_LAYOUT_FROM_HDR(lseg->pls_layout),
+                                 mirror, lseg->pls_range.offset,
+                                 lseg->pls_range.length, NFS4ERR_NXIO,
+                                 OP_ILLEGAL, GFP_NOIO);
+out_fail:
+        if (fail_return || !ff_layout_has_available_ds(lseg))
+                pnfs_error_mark_layout_for_return(ino, lseg);
+        ds = NULL;
 out:
        return ds;
 }
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 7ce5e023c3c3..74935a19e4bf 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -58,6 +58,9 @@ struct nfs_clone_mount {
 */
 #define NFS_UNSPEC_PORT         (-1)
+#define NFS_UNSPEC_RETRANS      (UINT_MAX)
+#define NFS_UNSPEC_TIMEO        (UINT_MAX)
 /*
 * Maximum number of pages that readdir can use for creating
 * a vmapped array of pages.
@@ -156,7 +159,7 @@ struct nfs_client *nfs_get_client(const struct nfs_client_initdata *,
 int nfs_probe_fsinfo(struct nfs_server *server, struct nfs_fh *, struct nfs_fattr *);
 void nfs_server_insert_lists(struct nfs_server *);
 void nfs_server_remove_lists(struct nfs_server *);
-void nfs_init_timeout_values(struct rpc_timeout *, int, unsigned int, unsigned int);
+void nfs_init_timeout_values(struct rpc_timeout *to, int proto, int timeo, int retrans);
 int nfs_init_server_rpcclient(struct nfs_server *, const struct rpc_timeout *t,
                rpc_authflavor_t);
 struct nfs_server *nfs_alloc_server(void);
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index 6f4752734804..64b43b4ad9dd 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -318,10 +318,22 @@ static void
 nfs42_layoutstat_prepare(struct rpc_task *task, void *calldata)
 {
        struct nfs42_layoutstat_data *data = calldata;
-        struct nfs_server *server = NFS_SERVER(data->args.inode);
+        struct inode *inode = data->inode;
+        struct nfs_server *server = NFS_SERVER(inode);
+        struct pnfs_layout_hdr *lo;
+        spin_lock(&inode->i_lock);
+        lo = NFS_I(inode)->layout;
+        if (!pnfs_layout_is_valid(lo)) {
+                spin_unlock(&inode->i_lock);
+                rpc_exit(task, 0);
+                return;
+        }
+        nfs4_stateid_copy(&data->args.stateid, &lo->plh_stateid);
+        spin_unlock(&inode->i_lock);
        nfs41_setup_sequence(nfs4_get_session(server), &data->args.seq_args,
                             &data->res.seq_res, task);
 }
 static void
@@ -341,11 +353,11 @@ nfs42_layoutstat_done(struct rpc_task *task, void *calldata)
        case -NFS4ERR_ADMIN_REVOKED:
        case -NFS4ERR_DELEG_REVOKED:
        case -NFS4ERR_STALE_STATEID:
-        case -NFS4ERR_OLD_STATEID:
        case -NFS4ERR_BAD_STATEID:
                spin_lock(&inode->i_lock);
                lo = NFS_I(inode)->layout;
-                if (lo && nfs4_stateid_match(&data->args.stateid,
+                if (pnfs_layout_is_valid(lo) &&
+                    nfs4_stateid_match(&data->args.stateid,
                                             &lo->plh_stateid)) {
                        LIST_HEAD(head);
@@ -359,11 +371,23 @@ nfs42_layoutstat_done(struct rpc_task *task, void *calldata)
                } else
                        spin_unlock(&inode->i_lock);
                break;
+        case -NFS4ERR_OLD_STATEID:
+                spin_lock(&inode->i_lock);
+                lo = NFS_I(inode)->layout;
+                if (pnfs_layout_is_valid(lo) &&
+                    nfs4_stateid_match_other(&data->args.stateid,
+                                        &lo->plh_stateid)) {
+                        /* Do we need to delay before resending? */
+                        if (!nfs4_stateid_is_newer(&lo->plh_stateid,
+                                                &data->args.stateid))
+                                rpc_delay(task, HZ);
+                        rpc_restart_call_prepare(task);
+                }
+                spin_unlock(&inode->i_lock);
+                break;
        case -ENOTSUPP:
        case -EOPNOTSUPP:
                NFS_SERVER(inode)->caps &= ~NFS_CAP_LAYOUTSTATS;
-        default:
-                break;
        }
        dprintk("%s server returns %d\n", __func__, task->tk_status);
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 8d7d08d4f95f..cd3b7cfdde16 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -817,6 +817,11 @@ static int nfs4_set_client(struct nfs_server *server,
                goto error;
        }
+        if (server->nfs_client == clp) {
+                error = -ELOOP;
+                goto error;
+        }
        /*
         * Query for the lease time on clientid setup or renewal
         *
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 1949bbd806eb..f5aecaabcb7c 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -634,15 +634,11 @@ out_sleep:
 }
 EXPORT_SYMBOL_GPL(nfs40_setup_sequence);
-static int nfs40_sequence_done(struct rpc_task *task,
+static void nfs40_sequence_free_slot(struct nfs4_sequence_res *res)
-                               struct nfs4_sequence_res *res)
 {
        struct nfs4_slot *slot = res->sr_slot;
        struct nfs4_slot_table *tbl;
-        if (slot == NULL)
-                goto out;
        tbl = slot->table;
        spin_lock(&tbl->slot_tbl_lock);
        if (!nfs41_wake_and_assign_slot(tbl, slot))
@@ -650,7 +646,13 @@ static int nfs40_sequence_done(struct rpc_task *task,
        spin_unlock(&tbl->slot_tbl_lock);
        res->sr_slot = NULL;
-out:
+}
+static int nfs40_sequence_done(struct rpc_task *task,
+                               struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot != NULL)
+                nfs40_sequence_free_slot(res);
        return 1;
 }
@@ -666,6 +668,11 @@ static void nfs41_sequence_free_slot(struct nfs4_sequence_res *res)
        tbl = slot->table;
        session = tbl->session;
+        /* Bump the slot sequence number */
+        if (slot->seq_done)
+                slot->seq_nr++;
+        slot->seq_done = 0;
        spin_lock(&tbl->slot_tbl_lock);
        /* Be nice to the server: try to ensure that the last transmitted
         * value for highest_user_slotid <= target_highest_slotid
@@ -686,9 +693,12 @@ out_unlock:
        res->sr_slot = NULL;
        if (send_new_highest_used_slotid)
                nfs41_notify_server(session->clp);
+        if (waitqueue_active(&tbl->slot_waitq))
+                wake_up_all(&tbl->slot_waitq);
 }
-int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
+static int nfs41_sequence_process(struct rpc_task *task,
+                struct nfs4_sequence_res *res)
 {
        struct nfs4_session *session;
        struct nfs4_slot *slot = res->sr_slot;
@@ -714,7 +724,7 @@ int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
        switch (res->sr_status) {
        case 0:
                /* Update the slot's sequence and clientid lease timer */
-                ++slot->seq_nr;
+                slot->seq_done = 1;
                clp = session->clp;
                do_renew_lease(clp, res->sr_timestamp);
                /* Check sequence flags */
@@ -769,16 +779,16 @@ int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
                goto retry_nowait;
        default:
                /* Just update the slot sequence no. */
-                ++slot->seq_nr;
+                slot->seq_done = 1;
        }
 out:
        /* The session may be reset by one of the error handlers. */
        dprintk("%s: Error %d free the slot \n", __func__, res->sr_status);
-        nfs41_sequence_free_slot(res);
 out_noaction:
        return ret;
 retry_nowait:
        if (rpc_restart_call_prepare(task)) {
+                nfs41_sequence_free_slot(res);
                task->tk_status = 0;
                ret = 0;
        }
@@ -789,8 +799,37 @@ out_retry:
        rpc_delay(task, NFS4_POLL_RETRY_MAX);
        return 0;
 }
+int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
+{
+        if (!nfs41_sequence_process(task, res))
+                return 0;
+        if (res->sr_slot != NULL)
+                nfs41_sequence_free_slot(res);
+        return 1;
+}
 EXPORT_SYMBOL_GPL(nfs41_sequence_done);
+static int nfs4_sequence_process(struct rpc_task *task, struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot == NULL)
+                return 1;
+        if (res->sr_slot->table->session != NULL)
+                return nfs41_sequence_process(task, res);
+        return nfs40_sequence_done(task, res);
+}
+static void nfs4_sequence_free_slot(struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot != NULL) {
+                if (res->sr_slot->table->session != NULL)
+                        nfs41_sequence_free_slot(res);
+                else
+                        nfs40_sequence_free_slot(res);
+        }
+}
 int nfs4_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
 {
        if (res->sr_slot == NULL)
@@ -920,6 +959,17 @@ static int nfs4_setup_sequence(const struct nfs_server *server,
                                    args, res, task);
 }
+static int nfs4_sequence_process(struct rpc_task *task, struct nfs4_sequence_res *res)
+{
+        return nfs40_sequence_done(task, res);
+}
+static void nfs4_sequence_free_slot(struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot != NULL)
+                nfs40_sequence_free_slot(res);
+}
 int nfs4_sequence_done(struct rpc_task *task,
                       struct nfs4_sequence_res *res)
 {
@@ -1197,6 +1247,7 @@ static void nfs4_opendata_free(struct kref *kref)
        struct super_block *sb = p->dentry->d_sb;
        nfs_free_seqid(p->o_arg.seqid);
+        nfs4_sequence_free_slot(&p->o_res.seq_res);
        if (p->state != NULL)
                nfs4_put_open_state(p->state);
        nfs4_put_state_owner(p->owner);
@@ -1656,9 +1707,14 @@ err:
 static struct nfs4_state *
 nfs4_opendata_to_nfs4_state(struct nfs4_opendata *data)
 {
+        struct nfs4_state *ret;
        if (data->o_arg.claim == NFS4_OPEN_CLAIM_PREVIOUS)
-                return _nfs4_opendata_reclaim_to_nfs4_state(data);
+                ret =_nfs4_opendata_reclaim_to_nfs4_state(data);
-        return _nfs4_opendata_to_nfs4_state(data);
+        else
+                ret = _nfs4_opendata_to_nfs4_state(data);
+        nfs4_sequence_free_slot(&data->o_res.seq_res);
+        return ret;
 }
 static struct nfs_open_context *nfs4_state_find_open_context(struct nfs4_state *state)
@@ -2056,7 +2112,7 @@ static void nfs4_open_done(struct rpc_task *task, void *calldata)
        data->rpc_status = task->tk_status;
-        if (!nfs4_sequence_done(task, &data->o_res.seq_res))
+        if (!nfs4_sequence_process(task, &data->o_res.seq_res))
                return;
        if (task->tk_status == 0) {
@@ -7864,7 +7920,7 @@ static void nfs4_layoutget_done(struct rpc_task *task, void *calldata)
        struct nfs4_layoutget *lgp = calldata;
        dprintk("--> %s\n", __func__);
-        nfs41_sequence_done(task, &lgp->res.seq_res);
+        nfs41_sequence_process(task, &lgp->res.seq_res);
        dprintk("<-- %s\n", __func__);
 }
@@ -8080,6 +8136,7 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout, gfp_t gfp_flags)
        /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
        if (status == 0 && lgp->res.layoutp->len)
                lseg = pnfs_layout_process(lgp);
+        nfs4_sequence_free_slot(&lgp->res.seq_res);
        rpc_put_task(task);
        dprintk("<-- %s status=%d\n", __func__, status);
        if (status)
@@ -8106,7 +8163,7 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
        dprintk("--> %s\n", __func__);
-        if (!nfs41_sequence_done(task, &lrp->res.seq_res))
+        if (!nfs41_sequence_process(task, &lrp->res.seq_res))
                return;
        server = NFS_SERVER(lrp->args.inode);
@@ -8118,6 +8175,7 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
        case -NFS4ERR_DELAY:
                if (nfs4_async_handle_error(task, server, NULL, NULL) != -EAGAIN)
                        break;
+                nfs4_sequence_free_slot(&lrp->res.seq_res);
                rpc_restart_call_prepare(task);
                return;
        }
@@ -8138,6 +8196,7 @@ static void nfs4_layoutreturn_release(void *calldata)
                pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
        pnfs_clear_layoutreturn_waitbit(lo);
        spin_unlock(&lo->plh_inode->i_lock);
+        nfs4_sequence_free_slot(&lrp->res.seq_res);
        pnfs_free_lseg_list(&freeme);
        pnfs_put_layout_hdr(lrp->args.layout);
        nfs_iput_and_deactive(lrp->inode);
diff --git a/fs/nfs/nfs4session.c b/fs/nfs/nfs4session.c
index 332d06e64fa9..b62973045a3e 100644
--- a/fs/nfs/nfs4session.c
+++ b/fs/nfs/nfs4session.c
@@ -28,6 +28,7 @@ static void nfs4_init_slot_table(struct nfs4_slot_table *tbl, const char *queue)
        tbl->highest_used_slotid = NFS4_NO_SLOT;
        spin_lock_init(&tbl->slot_tbl_lock);
        rpc_init_priority_wait_queue(&tbl->slot_tbl_waitq, queue);
+        init_waitqueue_head(&tbl->slot_waitq);
        init_completion(&tbl->complete);
 }
@@ -172,6 +173,58 @@ struct nfs4_slot *nfs4_lookup_slot(struct nfs4_slot_table *tbl, u32 slotid)
        return ERR_PTR(-E2BIG);
 }
+static int nfs4_slot_get_seqid(struct nfs4_slot_table  *tbl, u32 slotid,
+                u32 *seq_nr)
+        __must_hold(&tbl->slot_tbl_lock)
+{
+        struct nfs4_slot *slot;
+        slot = nfs4_lookup_slot(tbl, slotid);
+        if (IS_ERR(slot))
+                return PTR_ERR(slot);
+        *seq_nr = slot->seq_nr;
+        return 0;
+}
+/*
+ * nfs4_slot_seqid_in_use - test if a slot sequence id is still in use
+ *
+ * Given a slot table, slot id and sequence number, determine if the
+ * RPC call in question is still in flight. This function is mainly
+ * intended for use by the callback channel.
+ */
+static bool nfs4_slot_seqid_in_use(struct nfs4_slot_table *tbl,
+                u32 slotid, u32 seq_nr)
+{
+        u32 cur_seq;
+        bool ret = false;
+        spin_lock(&tbl->slot_tbl_lock);
+        if (nfs4_slot_get_seqid(tbl, slotid, &cur_seq) == 0 &&
+            cur_seq == seq_nr && test_bit(slotid, tbl->used_slots))
+                ret = true;
+        spin_unlock(&tbl->slot_tbl_lock);
+        return ret;
+}
+/*
+ * nfs4_slot_wait_on_seqid - wait until a slot sequence id is complete
+ *
+ * Given a slot table, slot id and sequence number, wait until the
+ * corresponding RPC call completes. This function is mainly
+ * intended for use by the callback channel.
+ */
+int nfs4_slot_wait_on_seqid(struct nfs4_slot_table *tbl,
+                u32 slotid, u32 seq_nr,
+                unsigned long timeout)
+{
+        if (wait_event_timeout(tbl->slot_waitq,
+                        !nfs4_slot_seqid_in_use(tbl, slotid, seq_nr),
+                        timeout) == 0)
+                return -ETIMEDOUT;
+        return 0;
+}
 /*
 * nfs4_alloc_slot - efficiently look for a free slot
 *
diff --git a/fs/nfs/nfs4session.h b/fs/nfs/nfs4session.h
index 5b51298d1d03..f703b755351b 100644
--- a/fs/nfs/nfs4session.h
+++ b/fs/nfs/nfs4session.h
@@ -21,7 +21,8 @@ struct nfs4_slot {
        unsigned long           generation;
        u32                     slot_nr;
        u32                     seq_nr;
-        unsigned int            interrupted : 1;
+        unsigned int            interrupted : 1,
+                                seq_done : 1;
 };
 /* Sessions */
@@ -36,6 +37,7 @@ struct nfs4_slot_table {
        unsigned long   used_slots[SLOT_TABLE_SZ]; /* used/unused bitmap */
        spinlock_t      slot_tbl_lock;
        struct rpc_wait_queue   slot_tbl_waitq; /* allocators may wait here */
+        wait_queue_head_t       slot_waitq;     /* Completion wait on slot */
        u32             max_slots;              /* # slots in table */
        u32             max_slotid;             /* Max allowed slotid value */
        u32             highest_used_slotid;    /* sent to server on each SEQ.
@@ -78,6 +80,9 @@ extern int nfs4_setup_slot_table(struct nfs4_slot_table *tbl,
 extern void nfs4_shutdown_slot_table(struct nfs4_slot_table *tbl);
 extern struct nfs4_slot *nfs4_alloc_slot(struct nfs4_slot_table *tbl);
 extern struct nfs4_slot *nfs4_lookup_slot(struct nfs4_slot_table *tbl, u32 slotid);
+extern int nfs4_slot_wait_on_seqid(struct nfs4_slot_table *tbl,
+                u32 slotid, u32 seq_nr,
+                unsigned long timeout);
 extern bool nfs4_try_to_lock_slot(struct nfs4_slot_table *tbl, struct nfs4_slot *slot);
 extern void nfs4_free_slot(struct nfs4_slot_table *tbl, struct nfs4_slot *slot);
 extern void nfs4_slot_tbl_drain_complete(struct nfs4_slot_table *tbl);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 70806cae0d36..6daf034645c8 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1555,6 +1555,7 @@ pnfs_update_layout(struct inode *ino,
        }
 lookup_again:
+        nfs4_client_recover_expired_lease(clp);
        first = false;
        spin_lock(&ino->i_lock);
        lo = pnfs_find_alloc_layout(ino, ctx, gfp_flags);
@@ -2510,7 +2511,6 @@ pnfs_report_layoutstat(struct inode *inode, gfp_t gfp_flags)
        data->args.fh = NFS_FH(inode);
        data->args.inode = inode;
-        nfs4_stateid_copy(&data->args.stateid, &hdr->plh_stateid);
        status = ld->prepare_layoutstats(&data->args);
        if (status)
                goto out_free;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 18d446e1a82b..d39601381adf 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -923,6 +923,8 @@ static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(void)
        data = kzalloc(sizeof(*data), GFP_KERNEL);
        if (data) {
+                data->timeo             = NFS_UNSPEC_TIMEO;
+                data->retrans           = NFS_UNSPEC_RETRANS;
                data->acregmin          = NFS_DEF_ACREGMIN;
                data->acregmax          = NFS_DEF_ACREGMAX;
                data->acdirmin          = NFS_DEF_ACDIRMIN;
@@ -1189,6 +1191,19 @@ static int nfs_get_option_ul(substring_t args[], unsigned long *option)
        return rc;
 }
+static int nfs_get_option_ul_bound(substring_t args[], unsigned long *option,
+                unsigned long l_bound, unsigned long u_bound)
+{
+        int ret;
+        ret = nfs_get_option_ul(args, option);
+        if (ret != 0)
+                return ret;
+        if (*option < l_bound || *option > u_bound)
+                return -ERANGE;
+        return 0;
+}
 /*
 * Error-check and convert a string of mount options from user space into
 * a data structure.  The whole mount string is processed; bad options are
@@ -1352,12 +1367,12 @@ static int nfs_parse_mount_options(char *raw,
                        mnt->bsize = option;
                        break;
                case Opt_timeo:
-                        if (nfs_get_option_ul(args, &option) || option == 0)
+                        if (nfs_get_option_ul_bound(args, &option, 1, INT_MAX))
                                goto out_invalid_value;
                        mnt->timeo = option;
                        break;
                case Opt_retrans:
-                        if (nfs_get_option_ul(args, &option) || option == 0)
+                        if (nfs_get_option_ul_bound(args, &option, 0, INT_MAX))
                                goto out_invalid_value;
                        mnt->retrans = option;
                        break;
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 54e5d6681786..43fdc2765aea 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -80,6 +80,8 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
        }
        for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
+                if (ovl_is_private_xattr(name))
+                        continue;
 retry:
                size = vfs_getxattr(old, name, value, value_size);
                if (size == -ERANGE)
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 12bcd07b9e32..1560fdc09a5f 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -12,6 +12,8 @@
 #include <linux/xattr.h>
 #include <linux/security.h>
 #include <linux/cred.h>
+#include <linux/posix_acl.h>
+#include <linux/posix_acl_xattr.h>
 #include "overlayfs.h"
 void ovl_cleanup(struct inode *wdir, struct dentry *wdentry)
@@ -186,6 +188,9 @@ static int ovl_create_upper(struct dentry *dentry, struct inode *inode,
        struct dentry *newdentry;
        int err;
+        if (!hardlink && !IS_POSIXACL(udir))
+                stat->mode &= ~current_umask();
        inode_lock_nested(udir, I_MUTEX_PARENT);
        newdentry = lookup_one_len(dentry->d_name.name, upperdir,
                                   dentry->d_name.len);
@@ -335,6 +340,32 @@ out_free:
        return ret;
 }
+static int ovl_set_upper_acl(struct dentry *upperdentry, const char *name,
+                             const struct posix_acl *acl)
+{
+        void *buffer;
+        size_t size;
+        int err;
+        if (!IS_ENABLED(CONFIG_FS_POSIX_ACL) || !acl)
+                return 0;
+        size = posix_acl_to_xattr(NULL, acl, NULL, 0);
+        buffer = kmalloc(size, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
+        size = posix_acl_to_xattr(&init_user_ns, acl, buffer, size);
+        err = size;
+        if (err < 0)
+                goto out_free;
+        err = vfs_setxattr(upperdentry, name, buffer, size, XATTR_CREATE);
+out_free:
+        kfree(buffer);
+        return err;
+}
 static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
                                    struct kstat *stat, const char *link,
                                    struct dentry *hardlink)
@@ -346,10 +377,18 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
        struct dentry *upper;
        struct dentry *newdentry;
        int err;
+        struct posix_acl *acl, *default_acl;
        if (WARN_ON(!workdir))
                return -EROFS;
+        if (!hardlink) {
+                err = posix_acl_create(dentry->d_parent->d_inode,
+                                       &stat->mode, &default_acl, &acl);
+                if (err)
+                        return err;
+        }
        err = ovl_lock_rename_workdir(workdir, upperdir);
        if (err)
                goto out;
@@ -384,6 +423,17 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
                if (err)
                        goto out_cleanup;
        }
+        if (!hardlink) {
+                err = ovl_set_upper_acl(newdentry, XATTR_NAME_POSIX_ACL_ACCESS,
+                                        acl);
+                if (err)
+                        goto out_cleanup;
+                err = ovl_set_upper_acl(newdentry, XATTR_NAME_POSIX_ACL_DEFAULT,
+                                        default_acl);
+                if (err)
+                        goto out_cleanup;
+        }
        if (!hardlink && S_ISDIR(stat->mode)) {
                err = ovl_set_opaque(newdentry);
@@ -410,6 +460,10 @@ out_dput:
 out_unlock:
        unlock_rename(workdir, upperdir);
 out:
+        if (!hardlink) {
+                posix_acl_release(acl);
+                posix_acl_release(default_acl);
+        }
        return err;
 out_cleanup:
@@ -950,9 +1004,9 @@ const struct inode_operations ovl_dir_inode_operations = {
        .permission     = ovl_permission,
        .getattr        = ovl_dir_getattr,
        .setxattr       = generic_setxattr,
-        .getxattr       = ovl_getxattr,
+        .getxattr       = generic_getxattr,
        .listxattr      = ovl_listxattr,
-        .removexattr    = ovl_removexattr,
+        .removexattr    = generic_removexattr,
        .get_acl        = ovl_get_acl,
        .update_time    = ovl_update_time,
 };
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 1b885c156028..c75625c1efa3 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -10,6 +10,7 @@
 #include <linux/fs.h>
 #include <linux/slab.h>
 #include <linux/xattr.h>
+#include <linux/posix_acl.h>
 #include "overlayfs.h"
 static int ovl_copy_up_truncate(struct dentry *dentry)
@@ -191,32 +192,44 @@ static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
        return err;
 }
-static bool ovl_is_private_xattr(const char *name)
+bool ovl_is_private_xattr(const char *name)
 {
-#define OVL_XATTR_PRE_NAME OVL_XATTR_PREFIX "."
+        return strncmp(name, OVL_XATTR_PREFIX,
-        return strncmp(name, OVL_XATTR_PRE_NAME,
+                       sizeof(OVL_XATTR_PREFIX) - 1) == 0;
-                       sizeof(OVL_XATTR_PRE_NAME) - 1) == 0;
 }
-int ovl_setxattr(struct dentry *dentry, struct inode *inode,
+int ovl_xattr_set(struct dentry *dentry, const char *name, const void *value,
-                 const char *name, const void *value,
+                  size_t size, int flags)
-                 size_t size, int flags)
 {
        int err;
-        struct dentry *upperdentry;
+        struct path realpath;
+        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
        const struct cred *old_cred;
        err = ovl_want_write(dentry);
        if (err)
                goto out;
+        if (!value && !OVL_TYPE_UPPER(type)) {
+                err = vfs_getxattr(realpath.dentry, name, NULL, 0);
+                if (err < 0)
+                        goto out_drop_write;
+        }
        err = ovl_copy_up(dentry);
        if (err)
                goto out_drop_write;
-        upperdentry = ovl_dentry_upper(dentry);
+        if (!OVL_TYPE_UPPER(type))
+                ovl_path_upper(dentry, &realpath);
        old_cred = ovl_override_creds(dentry->d_sb);
-        err = vfs_setxattr(upperdentry, name, value, size, flags);
+        if (value)
+                err = vfs_setxattr(realpath.dentry, name, value, size, flags);
+        else {
+                WARN_ON(flags != XATTR_REPLACE);
+                err = vfs_removexattr(realpath.dentry, name);
+        }
        revert_creds(old_cred);
 out_drop_write:
@@ -225,16 +238,13 @@ out:
        return err;
 }
-ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode,
+int ovl_xattr_get(struct dentry *dentry, const char *name,
-                     const char *name, void *value, size_t size)
+                  void *value, size_t size)
 {
        struct dentry *realdentry = ovl_dentry_real(dentry);
        ssize_t res;
        const struct cred *old_cred;
-        if (ovl_is_private_xattr(name))
-                return -ENODATA;
        old_cred = ovl_override_creds(dentry->d_sb);
        res = vfs_getxattr(realdentry, name, value, size);
        revert_creds(old_cred);
@@ -245,7 +255,8 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
 {
        struct dentry *realdentry = ovl_dentry_real(dentry);
        ssize_t res;
-        int off;
+        size_t len;
+        char *s;
        const struct cred *old_cred;
        old_cred = ovl_override_creds(dentry->d_sb);
@@ -255,73 +266,39 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
                return res;
        /* filter out private xattrs */
-        for (off = 0; off < res;) {
+        for (s = list, len = res; len;) {
-                char *s = list + off;
+                size_t slen = strnlen(s, len) + 1;
-                size_t slen = strlen(s) + 1;
-                BUG_ON(off + slen > res);
+                /* underlying fs providing us with an broken xattr list? */
+                if (WARN_ON(slen > len))
+                        return -EIO;
+                len -= slen;
                if (ovl_is_private_xattr(s)) {
                        res -= slen;
-                        memmove(s, s + slen, res - off);
+                        memmove(s, s + slen, len);
                } else {
-                        off += slen;
+                        s += slen;
                }
        }
        return res;
 }
-int ovl_removexattr(struct dentry *dentry, const char *name)
-{
-        int err;
-        struct path realpath;
-        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
-        const struct cred *old_cred;
-        err = ovl_want_write(dentry);
-        if (err)
-                goto out;
-        err = -ENODATA;
-        if (ovl_is_private_xattr(name))
-                goto out_drop_write;
-        if (!OVL_TYPE_UPPER(type)) {
-                err = vfs_getxattr(realpath.dentry, name, NULL, 0);
-                if (err < 0)
-                        goto out_drop_write;
-                err = ovl_copy_up(dentry);
-                if (err)
-                        goto out_drop_write;
-                ovl_path_upper(dentry, &realpath);
-        }
-        old_cred = ovl_override_creds(dentry->d_sb);
-        err = vfs_removexattr(realpath.dentry, name);
-        revert_creds(old_cred);
-out_drop_write:
-        ovl_drop_write(dentry);
-out:
-        return err;
-}
 struct posix_acl *ovl_get_acl(struct inode *inode, int type)
 {
        struct inode *realinode = ovl_inode_real(inode, NULL);
        const struct cred *old_cred;
        struct posix_acl *acl;
-        if (!IS_POSIXACL(realinode))
+        if (!IS_ENABLED(CONFIG_FS_POSIX_ACL) || !IS_POSIXACL(realinode))
                return NULL;
        if (!realinode->i_op->get_acl)
                return NULL;
        old_cred = ovl_override_creds(inode->i_sb);
-        acl = realinode->i_op->get_acl(realinode, type);
+        acl = get_acl(realinode, type);
        revert_creds(old_cred);
        return acl;
@@ -391,9 +368,9 @@ static const struct inode_operations ovl_file_inode_operations = {
        .permission     = ovl_permission,
        .getattr        = ovl_getattr,
        .setxattr       = generic_setxattr,
-        .getxattr       = ovl_getxattr,
+        .getxattr       = generic_getxattr,
        .listxattr      = ovl_listxattr,
-        .removexattr    = ovl_removexattr,
+        .removexattr    = generic_removexattr,
        .get_acl        = ovl_get_acl,
        .update_time    = ovl_update_time,
 };
@@ -404,9 +381,9 @@ static const struct inode_operations ovl_symlink_inode_operations = {
        .readlink       = ovl_readlink,
        .getattr        = ovl_getattr,
        .setxattr       = generic_setxattr,
-        .getxattr       = ovl_getxattr,
+        .getxattr       = generic_getxattr,
        .listxattr      = ovl_listxattr,
-        .removexattr    = ovl_removexattr,
+        .removexattr    = generic_removexattr,
        .update_time    = ovl_update_time,
 };
@@ -415,6 +392,9 @@ static void ovl_fill_inode(struct inode *inode, umode_t mode)
        inode->i_ino = get_next_ino();
        inode->i_mode = mode;
        inode->i_flags |= S_NOCMTIME;
+#ifdef CONFIG_FS_POSIX_ACL
+        inode->i_acl = inode->i_default_acl = ACL_DONT_CACHE;
+#endif
        mode &= S_IFMT;
        switch (mode) {
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index e4f5c9536bfe..5813ccff8cd9 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -24,8 +24,8 @@ enum ovl_path_type {
        (OVL_TYPE_MERGE(type) || !OVL_TYPE_UPPER(type))
-#define OVL_XATTR_PREFIX XATTR_TRUSTED_PREFIX "overlay"
+#define OVL_XATTR_PREFIX XATTR_TRUSTED_PREFIX "overlay."
-#define OVL_XATTR_OPAQUE OVL_XATTR_PREFIX ".opaque"
+#define OVL_XATTR_OPAQUE OVL_XATTR_PREFIX "opaque"
 #define OVL_ISUPPER_MASK 1UL
@@ -179,20 +179,21 @@ int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list);
 void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list);
 void ovl_cache_free(struct list_head *list);
 int ovl_check_d_type_supported(struct path *realpath);
+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
+                         struct dentry *dentry, int level);
 /* inode.c */
 int ovl_setattr(struct dentry *dentry, struct iattr *attr);
 int ovl_permission(struct inode *inode, int mask);
-int ovl_setxattr(struct dentry *dentry, struct inode *inode,
+int ovl_xattr_set(struct dentry *dentry, const char *name, const void *value,
-                 const char *name, const void *value,
+                  size_t size, int flags);
-                 size_t size, int flags);
+int ovl_xattr_get(struct dentry *dentry, const char *name,
-ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode,
+                  void *value, size_t size);
-                     const char *name, void *value, size_t size);
 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
-int ovl_removexattr(struct dentry *dentry, const char *name);
 struct posix_acl *ovl_get_acl(struct inode *inode, int type);
 int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags);
 int ovl_update_time(struct inode *inode, struct timespec *ts, int flags);
+bool ovl_is_private_xattr(const char *name);
 struct inode *ovl_new_inode(struct super_block *sb, umode_t mode);
 struct inode *ovl_get_inode(struct super_block *sb, struct inode *realinode);
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index cf37fc76fc9f..f241b4ee3d8a 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -248,7 +248,7 @@ static inline int ovl_dir_read(struct path *realpath,
                        err = rdd->err;
        } while (!err && rdd->count);
-        if (!err && rdd->first_maybe_whiteout)
+        if (!err && rdd->first_maybe_whiteout && rdd->dentry)
                err = ovl_check_whiteouts(realpath->dentry, rdd);
        fput(realfile);
@@ -606,3 +606,64 @@ int ovl_check_d_type_supported(struct path *realpath)
        return rdd.d_type_supported;
 }
+static void ovl_workdir_cleanup_recurse(struct path *path, int level)
+{
+        int err;
+        struct inode *dir = path->dentry->d_inode;
+        LIST_HEAD(list);
+        struct ovl_cache_entry *p;
+        struct ovl_readdir_data rdd = {
+                .ctx.actor = ovl_fill_merge,
+                .dentry = NULL,
+                .list = &list,
+                .root = RB_ROOT,
+                .is_lowest = false,
+        };
+        err = ovl_dir_read(path, &rdd);
+        if (err)
+                goto out;
+        inode_lock_nested(dir, I_MUTEX_PARENT);
+        list_for_each_entry(p, &list, l_node) {
+                struct dentry *dentry;
+                if (p->name[0] == '.') {
+                        if (p->len == 1)
+                                continue;
+                        if (p->len == 2 && p->name[1] == '.')
+                                continue;
+                }
+                dentry = lookup_one_len(p->name, path->dentry, p->len);
+                if (IS_ERR(dentry))
+                        continue;
+                if (dentry->d_inode)
+                        ovl_workdir_cleanup(dir, path->mnt, dentry, level);
+                dput(dentry);
+        }
+        inode_unlock(dir);
+out:
+        ovl_cache_free(&list);
+}
+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
+                         struct dentry *dentry, int level)
+{
+        int err;
+        if (!d_is_dir(dentry) || level > 1) {
+                ovl_cleanup(dir, dentry);
+                return;
+        }
+        err = ovl_do_rmdir(dir, dentry);
+        if (err) {
+                struct path path = { .mnt = mnt, .dentry = dentry };
+                inode_unlock(dir);
+                ovl_workdir_cleanup_recurse(&path, level + 1);
+                inode_lock_nested(dir, I_MUTEX_PARENT);
+                ovl_cleanup(dir, dentry);
+        }
+}
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 4036132842b5..a4585f961bf9 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -814,6 +814,10 @@ retry:
                struct kstat stat = {
                        .mode = S_IFDIR | 0,
                };
+                struct iattr attr = {
+                        .ia_valid = ATTR_MODE,
+                        .ia_mode = stat.mode,
+                };
                if (work->d_inode) {
                        err = -EEXIST;
@@ -821,7 +825,7 @@ retry:
                                goto out_dput;
                        retried = true;
-                        ovl_cleanup(dir, work);
+                        ovl_workdir_cleanup(dir, mnt, work, 0);
                        dput(work);
                        goto retry;
                }
@@ -829,6 +833,21 @@ retry:
                err = ovl_create_real(dir, work, &stat, NULL, NULL, true);
                if (err)
                        goto out_dput;
+                err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
+                if (err && err != -ENODATA)
+                        goto out_dput;
+                err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
+                if (err && err != -ENODATA)
+                        goto out_dput;
+                /* Clear any inherited mode bits */
+                inode_lock(work->d_inode);
+                err = notify_change(work, &attr, NULL);
+                inode_unlock(work->d_inode);
+                if (err)
+                        goto out_dput;
        }
 out_unlock:
        inode_unlock(dir);
@@ -967,10 +986,19 @@ static unsigned int ovl_split_lowerdirs(char *str)
        return ctr;
 }
-static int ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
+static int __maybe_unused
-                                   struct dentry *dentry, struct inode *inode,
+ovl_posix_acl_xattr_get(const struct xattr_handler *handler,
-                                   const char *name, const void *value,
+                        struct dentry *dentry, struct inode *inode,
-                                   size_t size, int flags)
+                        const char *name, void *buffer, size_t size)
+{
+        return ovl_xattr_get(dentry, handler->name, buffer, size);
+}
+static int __maybe_unused
+ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
+                        struct dentry *dentry, struct inode *inode,
+                        const char *name, const void *value,
+                        size_t size, int flags)
 {
        struct dentry *workdir = ovl_workdir(dentry);
        struct inode *realinode = ovl_inode_real(inode, NULL);
@@ -998,19 +1026,22 @@ static int ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
        posix_acl_release(acl);
-        return ovl_setxattr(dentry, inode, handler->name, value, size, flags);
+        err = ovl_xattr_set(dentry, handler->name, value, size, flags);
+        if (!err)
+                ovl_copyattr(ovl_inode_real(inode, NULL), inode);
+        return err;
 out_acl_release:
        posix_acl_release(acl);
        return err;
 }
-static int ovl_other_xattr_set(const struct xattr_handler *handler,
+static int ovl_own_xattr_get(const struct xattr_handler *handler,
-                               struct dentry *dentry, struct inode *inode,
+                             struct dentry *dentry, struct inode *inode,
-                               const char *name, const void *value,
+                             const char *name, void *buffer, size_t size)
-                               size_t size, int flags)
 {
-        return ovl_setxattr(dentry, inode, name, value, size, flags);
+        return -EPERM;
 }
 static int ovl_own_xattr_set(const struct xattr_handler *handler,
@@ -1021,42 +1052,59 @@ static int ovl_own_xattr_set(const struct xattr_handler *handler,
        return -EPERM;
 }
-static const struct xattr_handler ovl_posix_acl_access_xattr_handler = {
+static int ovl_other_xattr_get(const struct xattr_handler *handler,
+                               struct dentry *dentry, struct inode *inode,
+                               const char *name, void *buffer, size_t size)
+{
+        return ovl_xattr_get(dentry, name, buffer, size);
+}
+static int ovl_other_xattr_set(const struct xattr_handler *handler,
+                               struct dentry *dentry, struct inode *inode,
+                               const char *name, const void *value,
+                               size_t size, int flags)
+{
+        return ovl_xattr_set(dentry, name, value, size, flags);
+}
+static const struct xattr_handler __maybe_unused
+ovl_posix_acl_access_xattr_handler = {
        .name = XATTR_NAME_POSIX_ACL_ACCESS,
        .flags = ACL_TYPE_ACCESS,
+        .get = ovl_posix_acl_xattr_get,
        .set = ovl_posix_acl_xattr_set,
 };
-static const struct xattr_handler ovl_posix_acl_default_xattr_handler = {
+static const struct xattr_handler __maybe_unused
+ovl_posix_acl_default_xattr_handler = {
        .name = XATTR_NAME_POSIX_ACL_DEFAULT,
        .flags = ACL_TYPE_DEFAULT,
+        .get = ovl_posix_acl_xattr_get,
        .set = ovl_posix_acl_xattr_set,
 };
 static const struct xattr_handler ovl_own_xattr_handler = {
        .prefix = OVL_XATTR_PREFIX,
+        .get = ovl_own_xattr_get,
        .set = ovl_own_xattr_set,
 };
 static const struct xattr_handler ovl_other_xattr_handler = {
        .prefix = "", /* catch all */
+        .get = ovl_other_xattr_get,
        .set = ovl_other_xattr_set,
 };
 static const struct xattr_handler *ovl_xattr_handlers[] = {
+#ifdef CONFIG_FS_POSIX_ACL
        &ovl_posix_acl_access_xattr_handler,
        &ovl_posix_acl_default_xattr_handler,
+#endif
        &ovl_own_xattr_handler,
        &ovl_other_xattr_handler,
        NULL
 };
-static const struct xattr_handler *ovl_xattr_noacl_handlers[] = {
-        &ovl_own_xattr_handler,
-        &ovl_other_xattr_handler,
-        NULL,
-};
 static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 {
        struct path upperpath = { NULL, NULL };
@@ -1132,7 +1180,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
        err = -EINVAL;
        stacklen = ovl_split_lowerdirs(lowertmp);
        if (stacklen > OVL_MAX_STACK) {
-                pr_err("overlayfs: too many lower directries, limit is %d\n",
+                pr_err("overlayfs: too many lower directories, limit is %d\n",
                       OVL_MAX_STACK);
                goto out_free_lowertmp;
        } else if (!ufs->config.upperdir && stacklen == 1) {
@@ -1269,10 +1317,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
        sb->s_magic = OVERLAYFS_SUPER_MAGIC;
        sb->s_op = &ovl_super_operations;
-        if (IS_ENABLED(CONFIG_FS_POSIX_ACL))
+        sb->s_xattr = ovl_xattr_handlers;
-                sb->s_xattr = ovl_xattr_handlers;
-        else
-                sb->s_xattr = ovl_xattr_noacl_handlers;
        sb->s_root = root_dentry;
        sb->s_fs_info = ufs;
        sb->s_flags |= MS_POSIXACL;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 54e270262979..ac0df4dde823 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1556,18 +1556,13 @@ static const struct file_operations proc_pid_set_comm_operations = {
 static int proc_exe_link(struct dentry *dentry, struct path *exe_path)
 {
        struct task_struct *task;
-        struct mm_struct *mm;
        struct file *exe_file;
        task = get_proc_task(d_inode(dentry));
        if (!task)
                return -ENOENT;
-        mm = get_task_mm(task);
+        exe_file = get_task_exe_file(task);
        put_task_struct(task);
-        if (!mm)
-                return -ENOENT;
-        exe_file = get_mm_exe_file(mm);
-        mmput(mm);
        if (exe_file) {
                *exe_path = exe_file->f_path;
                path_get(&exe_file->f_path);
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index f35523d4fa3a..b803213d1307 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -114,9 +114,15 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf,
         * If buf != of->prealloc_buf, we don't know how
         * large it is, so cannot safely pass it to ->show
         */
-        if (pos || WARN_ON_ONCE(buf != of->prealloc_buf))
+        if (WARN_ON_ONCE(buf != of->prealloc_buf))
                return 0;
        len = ops->show(kobj, of->kn->priv, buf);
+        if (pos) {
+                if (len <= pos)
+                        return 0;
+                len -= pos;
+                memmove(buf, buf + pos, len);
+        }
        return min(count, len);
 }
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index 3dd8f1d54498..05b5243d89f6 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -2278,6 +2278,8 @@ xfs_alloc_log_agf(
                offsetof(xfs_agf_t, agf_btreeblks),
                offsetof(xfs_agf_t, agf_uuid),
                offsetof(xfs_agf_t, agf_rmap_blocks),
+                /* needed so that we don't log the whole rest of the structure: */
+                offsetof(xfs_agf_t, agf_spare64),
                sizeof(xfs_agf_t)
        };
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index b5c213a051cd..08569792fe20 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -1814,6 +1814,10 @@ xfs_btree_lookup(
        XFS_BTREE_STATS_INC(cur, lookup);
+        /* No such thing as a zero-level tree. */
+        if (cur->bc_nlevels == 0)
+                return -EFSCORRUPTED;
        block = NULL;
        keyno = 0;
@@ -4554,15 +4558,22 @@ xfs_btree_simple_query_range(
        if (error)
                goto out;
+        /* Nothing?  See if there's anything to the right. */
+        if (!stat) {
+                error = xfs_btree_increment(cur, 0, &stat);
+                if (error)
+                        goto out;
+        }
        while (stat) {
                /* Find the record. */
                error = xfs_btree_get_rec(cur, &recp, &stat);
                if (error || !stat)
                        break;
-                cur->bc_ops->init_high_key_from_rec(&rec_key, recp);
                /* Skip if high_key(rec) < low_key. */
                if (firstrec) {
+                        cur->bc_ops->init_high_key_from_rec(&rec_key, recp);
                        firstrec = false;
                        diff = cur->bc_ops->diff_two_keys(cur, low_key,
                                        &rec_key);
@@ -4571,6 +4582,7 @@ xfs_btree_simple_query_range(
                }
                /* Stop if high_key < low_key(rec). */
+                cur->bc_ops->init_key_from_rec(&rec_key, recp);
                diff = cur->bc_ops->diff_two_keys(cur, &rec_key, high_key);
                if (diff > 0)
                        break;
diff --git a/fs/xfs/libxfs/xfs_defer.c b/fs/xfs/libxfs/xfs_defer.c
index 054a2032fdb3..c221d0ecd52e 100644
--- a/fs/xfs/libxfs/xfs_defer.c
+++ b/fs/xfs/libxfs/xfs_defer.c
@@ -194,7 +194,7 @@ xfs_defer_trans_abort(
        /* Abort intent items. */
        list_for_each_entry(dfp, &dop->dop_pending, dfp_list) {
                trace_xfs_defer_pending_abort(tp->t_mountp, dfp);
-                if (dfp->dfp_committed)
+                if (!dfp->dfp_done)
                        dfp->dfp_type->abort_intent(dfp->dfp_intent);
        }
@@ -290,7 +290,6 @@ xfs_defer_finish(
        struct xfs_defer_pending        *dfp;
        struct list_head                *li;
        struct list_head                *n;
-        void                            *done_item = NULL;
        void                            *state;
        int                             error = 0;
        void                            (*cleanup_fn)(struct xfs_trans *, void *, int);
@@ -309,19 +308,11 @@ xfs_defer_finish(
                if (error)
                        goto out;
-                /* Mark all pending intents as committed. */
-                list_for_each_entry_reverse(dfp, &dop->dop_pending, dfp_list) {
-                        if (dfp->dfp_committed)
-                                break;
-                        trace_xfs_defer_pending_commit((*tp)->t_mountp, dfp);
-                        dfp->dfp_committed = true;
-                }
                /* Log an intent-done item for the first pending item. */
                dfp = list_first_entry(&dop->dop_pending,
                                struct xfs_defer_pending, dfp_list);
                trace_xfs_defer_pending_finish((*tp)->t_mountp, dfp);
-                done_item = dfp->dfp_type->create_done(*tp, dfp->dfp_intent,
+                dfp->dfp_done = dfp->dfp_type->create_done(*tp, dfp->dfp_intent,
                                dfp->dfp_count);
                cleanup_fn = dfp->dfp_type->finish_cleanup;
@@ -331,7 +322,7 @@ xfs_defer_finish(
                        list_del(li);
                        dfp->dfp_count--;
                        error = dfp->dfp_type->finish_item(*tp, dop, li,
-                                        done_item, &state);
+                                        dfp->dfp_done, &state);
                        if (error) {
                                /*
                                 * Clean up after ourselves and jump out.
@@ -428,8 +419,8 @@ xfs_defer_add(
                dfp = kmem_alloc(sizeof(struct xfs_defer_pending),
                                KM_SLEEP | KM_NOFS);
                dfp->dfp_type = defer_op_types[type];
-                dfp->dfp_committed = false;
                dfp->dfp_intent = NULL;
+                dfp->dfp_done = NULL;
                dfp->dfp_count = 0;
                INIT_LIST_HEAD(&dfp->dfp_work);
                list_add_tail(&dfp->dfp_list, &dop->dop_intake);
diff --git a/fs/xfs/libxfs/xfs_defer.h b/fs/xfs/libxfs/xfs_defer.h
index cc3981c48296..e96533d178cf 100644
--- a/fs/xfs/libxfs/xfs_defer.h
+++ b/fs/xfs/libxfs/xfs_defer.h
@@ -30,8 +30,8 @@ struct xfs_defer_op_type;
 struct xfs_defer_pending {
        const struct xfs_defer_op_type  *dfp_type;      /* function pointers */
        struct list_head                dfp_list;       /* pending items */
-        bool                            dfp_committed;  /* committed trans? */
        void                            *dfp_intent;    /* log intent item */
+        void                            *dfp_done;      /* log done item */
        struct list_head                dfp_work;       /* work items */
        unsigned int                    dfp_count;      /* # extent items */
 };
diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h
index e6a8bea0f7ba..270fb5cf4fa1 100644
--- a/fs/xfs/libxfs/xfs_format.h
+++ b/fs/xfs/libxfs/xfs_format.h
@@ -674,7 +674,8 @@ typedef struct xfs_agf {
 #define XFS_AGF_BTREEBLKS       0x00000800
 #define XFS_AGF_UUID            0x00001000
 #define XFS_AGF_RMAP_BLOCKS     0x00002000
-#define XFS_AGF_NUM_BITS        14
+#define XFS_AGF_SPARE64         0x00004000
+#define XFS_AGF_NUM_BITS        15
 #define XFS_AGF_ALL_BITS        ((1 << XFS_AGF_NUM_BITS) - 1)
 #define XFS_AGF_FLAGS \
@@ -691,7 +692,8 @@ typedef struct xfs_agf {
        { XFS_AGF_LONGEST,      "LONGEST" }, \
        { XFS_AGF_BTREEBLKS,    "BTREEBLKS" }, \
        { XFS_AGF_UUID,         "UUID" }, \
-        { XFS_AGF_RMAP_BLOCKS,  "RMAP_BLOCKS" }
+        { XFS_AGF_RMAP_BLOCKS,  "RMAP_BLOCKS" }, \
+        { XFS_AGF_SPARE64,      "SPARE64" }
 /* disk block (xfs_daddr_t) in the AG */
 #define XFS_AGF_DADDR(mp)       ((xfs_daddr_t)(1 << (mp)->m_sectbb_log))
diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
index 0e3d4f5ec33c..4aecc5fefe96 100644
--- a/fs/xfs/libxfs/xfs_sb.c
+++ b/fs/xfs/libxfs/xfs_sb.c
@@ -583,7 +583,8 @@ xfs_sb_verify(
         * Only check the in progress field for the primary superblock as
         * mkfs.xfs doesn't clear it from secondary superblocks.
         */
-        return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR,
+        return xfs_mount_validate_sb(mp, &sb,
+                                     bp->b_maps[0].bm_bn == XFS_SB_DADDR,
                                     check_version);
 }
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 607cc29bba21..b5b9bffe3520 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -1611,7 +1611,7 @@ xfs_wait_buftarg(
         */
        while (percpu_counter_sum(&btp->bt_io_count))
                delay(100);
-        drain_workqueue(btp->bt_mount->m_buf_workqueue);
+        flush_workqueue(btp->bt_mount->m_buf_workqueue);
        /* loop until there is nothing left on the lru list. */
        while (list_lru_count(&btp->bt_lru)) {
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 24ef83ef04de..fd6be45b3a1e 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1574,9 +1574,16 @@ xfs_fs_fill_super(
                }
        }
-        if (xfs_sb_version_hasrmapbt(&mp->m_sb))
+        if (xfs_sb_version_hasrmapbt(&mp->m_sb)) {
+                if (mp->m_sb.sb_rblocks) {
+                        xfs_alert(mp,
+        "EXPERIMENTAL reverse mapping btree not compatible with realtime device!");
+                        error = -EINVAL;
+                        goto out_filestream_unmount;
+                }
                xfs_alert(mp,
        "EXPERIMENTAL reverse mapping btree feature enabled. Use at your own risk!");
+        }
        error = xfs_mountfs(mp);
        if (error)
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index 7e88bec3f359..d303a665dba9 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -2295,7 +2295,7 @@ DECLARE_EVENT_CLASS(xfs_defer_pending_class,
                __entry->dev = mp ? mp->m_super->s_dev : 0;
                __entry->type = dfp->dfp_type->type;
                __entry->intent = dfp->dfp_intent;
-                __entry->committed = dfp->dfp_committed;
+                __entry->committed = dfp->dfp_done != NULL;
                __entry->nr = dfp->dfp_count;
        ),
        TP_printk("dev %d:%d optype %d intent %p committed %d nr %d\n",
diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
index 1bfa602958f2..5dea1fb6979c 100644
--- a/include/asm-generic/uaccess.h
+++ b/include/asm-generic/uaccess.h
@@ -72,6 +72,7 @@ struct exception_table_entry
 /* Returns 0 if exception not found and fixup otherwise.  */
 extern unsigned long search_exception_table(unsigned long);
 /*
 * architectures with an MMU should override these two
 */
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 4d8452c2384b..c5eaf2f80a4c 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -1056,7 +1056,7 @@ static inline struct fwnode_handle *acpi_get_next_subnode(struct device *dev,
        return NULL;
 }
-#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, validate, data, fn) \
+#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, valid, data, fn) \
        static const void * __acpi_table_##name[]                       \
                __attribute__((unused))                                 \
                 = { (void *) table_id,                                 \
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 8dbc8929a6a0..573c5a18908f 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -158,7 +158,7 @@
 #define __compiler_offsetof(a, b)                                       \
        __builtin_offsetof(a, b)
-#if GCC_VERSION >= 40100 && GCC_VERSION < 40600
+#if GCC_VERSION >= 40100
 # define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
 #endif
diff --git a/include/linux/fence.h b/include/linux/fence.h
index 8cc719a63728..2ac6fa5f4712 100644
--- a/include/linux/fence.h
+++ b/include/linux/fence.h
@@ -49,8 +49,6 @@ struct fence_cb;
 * @timestamp: Timestamp when the fence was signaled.
 * @status: Optional, only valid if < 0, must be set before calling
 * fence_signal, indicates that the fence has completed with an error.
- * @child_list: list of children fences
- * @active_list: list of active fences
 *
 * the flags member must be manipulated and read using the appropriate
 * atomic ops (bit_*), so taking the spinlock will not be needed most
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 3523bf62f328..901e25d495cc 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -574,6 +574,7 @@ static inline void mapping_allow_writable(struct address_space *mapping)
 struct posix_acl;
 #define ACL_NOT_CACHED ((void *)(-1))
+#define ACL_DONT_CACHE ((void *)(-3))
 static inline struct posix_acl *
 uncached_acl_sentinel(struct task_struct *task)
diff --git a/include/linux/iio/sw_trigger.h b/include/linux/iio/sw_trigger.h
index 5198f8ed08a4..c97eab67558f 100644
--- a/include/linux/iio/sw_trigger.h
+++ b/include/linux/iio/sw_trigger.h
@@ -62,7 +62,7 @@ void iio_swt_group_init_type_name(struct iio_sw_trigger *t,
                                  const char *name,
                                  struct config_item_type *type)
 {
-#ifdef CONFIG_CONFIGFS_FS
+#if IS_ENABLED(CONFIG_CONFIGFS_FS)
        config_group_init_type_name(&t->group, name, type);
 #endif
 }
diff --git a/include/linux/iomap.h b/include/linux/iomap.h
index 3267df461012..3d70ece10313 100644
--- a/include/linux/iomap.h
+++ b/include/linux/iomap.h
@@ -19,6 +19,11 @@ struct vm_fault;
 #define IOMAP_UNWRITTEN 0x04    /* blocks allocated @blkno in unwritten state */
 /*
+ * Flags for iomap mappings:
+ */
+#define IOMAP_F_MERGED  0x01    /* contains multiple blocks/extents */
+/*
 * Magic value for blkno:
 */
 #define IOMAP_NULL_BLOCK -1LL   /* blkno is not valid */
@@ -27,7 +32,8 @@ struct iomap {
        sector_t                blkno;  /* 1st sector of mapping, 512b units */
        loff_t                  offset; /* file offset of mapping, bytes */
        u64                     length; /* length of mapping, bytes */
-        int                     type;   /* type of mapping */
+        u16                     type;   /* type of mapping */
+        u16                     flags;  /* flags for mapping */
        struct block_device     *bdev;  /* block device for I/O */
 };
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index 4429d255c8ab..5e5b2969d931 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -195,6 +195,7 @@ static inline bool vma_migratable(struct vm_area_struct *vma)
 }
 extern int mpol_misplaced(struct page *, struct vm_area_struct *, unsigned long);
+extern void mpol_put_task_policy(struct task_struct *);
 #else
@@ -297,5 +298,8 @@ static inline int mpol_misplaced(struct page *page, struct vm_area_struct *vma,
        return -1; /* no node preference */
 }
+static inline void mpol_put_task_policy(struct task_struct *task)
+{
+}
 #endif /* CONFIG_NUMA */
 #endif
diff --git a/include/linux/mfd/da8xx-cfgchip.h b/include/linux/mfd/da8xx-cfgchip.h
new file mode 100644
index 000000000000..304985e288d2
--- /dev/null
+++ b/include/linux/mfd/da8xx-cfgchip.h
@@ -0,0 +1,153 @@
+/*
+ * TI DaVinci DA8xx CHIPCFGx registers for syscon consumers.
+ *
+ * Copyright (C) 2016 David Lechner <david@lechnology.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+#ifndef __LINUX_MFD_DA8XX_CFGCHIP_H
+#define __LINUX_MFD_DA8XX_CFGCHIP_H
+#include <linux/bitops.h>
+/* register offset (32-bit registers) */
+#define CFGCHIP(n)                              ((n) * 4)
+/* CFGCHIP0 (PLL0/EDMA3_0) register bits */
+#define CFGCHIP0_PLL_MASTER_LOCK                BIT(4)
+#define CFGCHIP0_EDMA30TC1DBS(n)                ((n) << 2)
+#define CFGCHIP0_EDMA30TC1DBS_MASK              CFGCHIP0_EDMA30TC1DBS(0x3)
+#define CFGCHIP0_EDMA30TC1DBS_16                CFGCHIP0_EDMA30TC1DBS(0x0)
+#define CFGCHIP0_EDMA30TC1DBS_32                CFGCHIP0_EDMA30TC1DBS(0x1)
+#define CFGCHIP0_EDMA30TC1DBS_64                CFGCHIP0_EDMA30TC1DBS(0x2)
+#define CFGCHIP0_EDMA30TC0DBS(n)                ((n) << 0)
+#define CFGCHIP0_EDMA30TC0DBS_MASK              CFGCHIP0_EDMA30TC0DBS(0x3)
+#define CFGCHIP0_EDMA30TC0DBS_16                CFGCHIP0_EDMA30TC0DBS(0x0)
+#define CFGCHIP0_EDMA30TC0DBS_32                CFGCHIP0_EDMA30TC0DBS(0x1)
+#define CFGCHIP0_EDMA30TC0DBS_64                CFGCHIP0_EDMA30TC0DBS(0x2)
+/* CFGCHIP1 (eCAP/HPI/EDMA3_1/eHRPWM TBCLK/McASP0 AMUTEIN) register bits */
+#define CFGCHIP1_CAP2SRC(n)                     ((n) << 27)
+#define CFGCHIP1_CAP2SRC_MASK                   CFGCHIP1_CAP2SRC(0x1f)
+#define CFGCHIP1_CAP2SRC_ECAP_PIN               CFGCHIP1_CAP2SRC(0x0)
+#define CFGCHIP1_CAP2SRC_MCASP0_TX              CFGCHIP1_CAP2SRC(0x1)
+#define CFGCHIP1_CAP2SRC_MCASP0_RX              CFGCHIP1_CAP2SRC(0x2)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_RX_THRESHOLD   CFGCHIP1_CAP2SRC(0x7)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_RX             CFGCHIP1_CAP2SRC(0x8)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_TX             CFGCHIP1_CAP2SRC(0x9)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_MISC           CFGCHIP1_CAP2SRC(0xa)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_RX_THRESHOLD   CFGCHIP1_CAP2SRC(0xb)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_RX             CFGCHIP1_CAP2SRC(0xc)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_TX             CFGCHIP1_CAP2SRC(0xd)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_MISC           CFGCHIP1_CAP2SRC(0xe)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_RX_THRESHOLD   CFGCHIP1_CAP2SRC(0xf)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_RX             CFGCHIP1_CAP2SRC(0x10)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_TX             CFGCHIP1_CAP2SRC(0x11)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_MISC           CFGCHIP1_CAP2SRC(0x12)
+#define CFGCHIP1_CAP1SRC(n)                     ((n) << 22)
+#define CFGCHIP1_CAP1SRC_MASK                   CFGCHIP1_CAP1SRC(0x1f)
+#define CFGCHIP1_CAP1SRC_ECAP_PIN               CFGCHIP1_CAP1SRC(0x0)
+#define CFGCHIP1_CAP1SRC_MCASP0_TX              CFGCHIP1_CAP1SRC(0x1)
+#define CFGCHIP1_CAP1SRC_MCASP0_RX              CFGCHIP1_CAP1SRC(0x2)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_RX_THRESHOLD   CFGCHIP1_CAP1SRC(0x7)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_RX             CFGCHIP1_CAP1SRC(0x8)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_TX             CFGCHIP1_CAP1SRC(0x9)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_MISC           CFGCHIP1_CAP1SRC(0xa)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_RX_THRESHOLD   CFGCHIP1_CAP1SRC(0xb)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_RX             CFGCHIP1_CAP1SRC(0xc)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_TX             CFGCHIP1_CAP1SRC(0xd)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_MISC           CFGCHIP1_CAP1SRC(0xe)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_RX_THRESHOLD   CFGCHIP1_CAP1SRC(0xf)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_RX             CFGCHIP1_CAP1SRC(0x10)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_TX             CFGCHIP1_CAP1SRC(0x11)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_MISC           CFGCHIP1_CAP1SRC(0x12)
+#define CFGCHIP1_CAP0SRC(n)                     ((n) << 17)
+#define CFGCHIP1_CAP0SRC_MASK                   CFGCHIP1_CAP0SRC(0x1f)
+#define CFGCHIP1_CAP0SRC_ECAP_PIN               CFGCHIP1_CAP0SRC(0x0)
+#define CFGCHIP1_CAP0SRC_MCASP0_TX              CFGCHIP1_CAP0SRC(0x1)
+#define CFGCHIP1_CAP0SRC_MCASP0_RX              CFGCHIP1_CAP0SRC(0x2)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_RX_THRESHOLD   CFGCHIP1_CAP0SRC(0x7)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_RX             CFGCHIP1_CAP0SRC(0x8)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_TX             CFGCHIP1_CAP0SRC(0x9)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_MISC           CFGCHIP1_CAP0SRC(0xa)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_RX_THRESHOLD   CFGCHIP1_CAP0SRC(0xb)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_RX             CFGCHIP1_CAP0SRC(0xc)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_TX             CFGCHIP1_CAP0SRC(0xd)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_MISC           CFGCHIP1_CAP0SRC(0xe)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_RX_THRESHOLD   CFGCHIP1_CAP0SRC(0xf)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_RX             CFGCHIP1_CAP0SRC(0x10)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_TX             CFGCHIP1_CAP0SRC(0x11)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_MISC           CFGCHIP1_CAP0SRC(0x12)
+#define CFGCHIP1_HPIBYTEAD                      BIT(16)
+#define CFGCHIP1_HPIENA                         BIT(15)
+#define CFGCHIP0_EDMA31TC0DBS(n)                ((n) << 13)
+#define CFGCHIP0_EDMA31TC0DBS_MASK              CFGCHIP0_EDMA31TC0DBS(0x3)
+#define CFGCHIP0_EDMA31TC0DBS_16                CFGCHIP0_EDMA31TC0DBS(0x0)
+#define CFGCHIP0_EDMA31TC0DBS_32                CFGCHIP0_EDMA31TC0DBS(0x1)
+#define CFGCHIP0_EDMA31TC0DBS_64                CFGCHIP0_EDMA31TC0DBS(0x2)
+#define CFGCHIP1_TBCLKSYNC                      BIT(12)
+#define CFGCHIP1_AMUTESEL0(n)                   ((n) << 0)
+#define CFGCHIP1_AMUTESEL0_MASK                 CFGCHIP1_AMUTESEL0(0xf)
+#define CFGCHIP1_AMUTESEL0_LOW                  CFGCHIP1_AMUTESEL0(0x0)
+#define CFGCHIP1_AMUTESEL0_BANK_0               CFGCHIP1_AMUTESEL0(0x1)
+#define CFGCHIP1_AMUTESEL0_BANK_1               CFGCHIP1_AMUTESEL0(0x2)
+#define CFGCHIP1_AMUTESEL0_BANK_2               CFGCHIP1_AMUTESEL0(0x3)
+#define CFGCHIP1_AMUTESEL0_BANK_3               CFGCHIP1_AMUTESEL0(0x4)
+#define CFGCHIP1_AMUTESEL0_BANK_4               CFGCHIP1_AMUTESEL0(0x5)
+#define CFGCHIP1_AMUTESEL0_BANK_5               CFGCHIP1_AMUTESEL0(0x6)
+#define CFGCHIP1_AMUTESEL0_BANK_6               CFGCHIP1_AMUTESEL0(0x7)
+#define CFGCHIP1_AMUTESEL0_BANK_7               CFGCHIP1_AMUTESEL0(0x8)
+/* CFGCHIP2 (USB PHY) register bits */
+#define CFGCHIP2_PHYCLKGD                       BIT(17)
+#define CFGCHIP2_VBUSSENSE                      BIT(16)
+#define CFGCHIP2_RESET                          BIT(15)
+#define CFGCHIP2_OTGMODE(n)                     ((n) << 13)
+#define CFGCHIP2_OTGMODE_MASK                   CFGCHIP2_OTGMODE(0x3)
+#define CFGCHIP2_OTGMODE_NO_OVERRIDE            CFGCHIP2_OTGMODE(0x0)
+#define CFGCHIP2_OTGMODE_FORCE_HOST             CFGCHIP2_OTGMODE(0x1)
+#define CFGCHIP2_OTGMODE_FORCE_DEVICE           CFGCHIP2_OTGMODE(0x2)
+#define CFGCHIP2_OTGMODE_FORCE_HOST_VBUS_LOW    CFGCHIP2_OTGMODE(0x3)
+#define CFGCHIP2_USB1PHYCLKMUX                  BIT(12)
+#define CFGCHIP2_USB2PHYCLKMUX                  BIT(11)
+#define CFGCHIP2_PHYPWRDN                       BIT(10)
+#define CFGCHIP2_OTGPWRDN                       BIT(9)
+#define CFGCHIP2_DATPOL                         BIT(8)
+#define CFGCHIP2_USB1SUSPENDM                   BIT(7)
+#define CFGCHIP2_PHY_PLLON                      BIT(6)
+#define CFGCHIP2_SESENDEN                       BIT(5)
+#define CFGCHIP2_VBDTCTEN                       BIT(4)
+#define CFGCHIP2_REFFREQ(n)                     ((n) << 0)
+#define CFGCHIP2_REFFREQ_MASK                   CFGCHIP2_REFFREQ(0xf)
+#define CFGCHIP2_REFFREQ_12MHZ                  CFGCHIP2_REFFREQ(0x1)
+#define CFGCHIP2_REFFREQ_24MHZ                  CFGCHIP2_REFFREQ(0x2)
+#define CFGCHIP2_REFFREQ_48MHZ                  CFGCHIP2_REFFREQ(0x3)
+#define CFGCHIP2_REFFREQ_19_2MHZ                CFGCHIP2_REFFREQ(0x4)
+#define CFGCHIP2_REFFREQ_38_4MHZ                CFGCHIP2_REFFREQ(0x5)
+#define CFGCHIP2_REFFREQ_13MHZ                  CFGCHIP2_REFFREQ(0x6)
+#define CFGCHIP2_REFFREQ_26MHZ                  CFGCHIP2_REFFREQ(0x7)
+#define CFGCHIP2_REFFREQ_20MHZ                  CFGCHIP2_REFFREQ(0x8)
+#define CFGCHIP2_REFFREQ_40MHZ                  CFGCHIP2_REFFREQ(0x9)
+/* CFGCHIP3 (EMAC/uPP/PLL1/ASYNC3/PRU/DIV4.5/EMIFA) register bits */
+#define CFGCHIP3_RMII_SEL                       BIT(8)
+#define CFGCHIP3_UPP_TX_CLKSRC                  BIT(6)
+#define CFGCHIP3_PLL1_MASTER_LOCK               BIT(5)
+#define CFGCHIP3_ASYNC3_CLKSRC                  BIT(4)
+#define CFGCHIP3_PRUEVTSEL                      BIT(3)
+#define CFGCHIP3_DIV45PENA                      BIT(2)
+#define CFGCHIP3_EMA_CLKSRC                     BIT(1)
+/* CFGCHIP4 (McASP0 AMUNTEIN) register bits */
+#define CFGCHIP4_AMUTECLR0                      BIT(0)
+#endif /* __LINUX_MFD_DA8XX_CFGCHIP_H */
diff --git a/include/linux/mfd/ti_am335x_tscadc.h b/include/linux/mfd/ti_am335x_tscadc.h
index 2567a87872b0..7f55b8b41032 100644
--- a/include/linux/mfd/ti_am335x_tscadc.h
+++ b/include/linux/mfd/ti_am335x_tscadc.h
@@ -138,16 +138,16 @@
 /*
 * time in us for processing a single channel, calculated as follows:
 *
- * num cycles = open delay + (sample delay + conv time) * averaging
+ * max num cycles = open delay + (sample delay + conv time) * averaging
 *
- * num cycles: 152 + (1 + 13) * 16 = 376
+ * max num cycles: 262143 + (255 + 13) * 16 = 266431
 *
 * clock frequency: 26MHz / 8 = 3.25MHz
 * clock period: 1 / 3.25MHz = 308ns
 *
- * processing time: 376 * 308ns = 116us
+ * max processing time: 266431 * 308ns = 83ms(approx)
 */
-#define IDLE_TIMEOUT 116 /* microsec */
+#define IDLE_TIMEOUT 83 /* milliseconds */
 #define TSCADC_CELLS            2
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 08ed53eeedd5..ef815b9cd426 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -2014,6 +2014,7 @@ extern void mm_drop_all_locks(struct mm_struct *mm);
 extern void set_mm_exe_file(struct mm_struct *mm, struct file *new_exe_file);
 extern struct file *get_mm_exe_file(struct mm_struct *mm);
+extern struct file *get_task_exe_file(struct task_struct *task);
 extern bool may_expand_vm(struct mm_struct *, vm_flags_t, unsigned long npages);
 extern void vm_stat_account(struct mm_struct *, vm_flags_t, long npages);
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index d572b78b65e1..7f2ae99e5daf 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -828,9 +828,21 @@ unsigned long __init node_memmap_size_bytes(int, unsigned long, unsigned long);
 */
 #define zone_idx(zone)          ((zone) - (zone)->zone_pgdat->node_zones)
-static inline int populated_zone(struct zone *zone)
+/*
+ * Returns true if a zone has pages managed by the buddy allocator.
+ * All the reclaim decisions have to use this function rather than
+ * populated_zone(). If the whole zone is reserved then we can easily
+ * end up with populated_zone() && !managed_zone().
+ */
+static inline bool managed_zone(struct zone *zone)
+{
+        return zone->managed_pages;
+}
+/* Returns true if a zone has memory */
+static inline bool populated_zone(struct zone *zone)
 {
-        return (!!zone->present_pages);
+        return zone->present_pages;
 }
 extern int movable_zone;
diff --git a/include/linux/netfilter/nfnetlink_acct.h b/include/linux/netfilter/nfnetlink_acct.h
index 80ca889b164e..664da0048625 100644
--- a/include/linux/netfilter/nfnetlink_acct.h
+++ b/include/linux/netfilter/nfnetlink_acct.h
@@ -15,6 +15,6 @@ struct nf_acct;
 struct nf_acct *nfnl_acct_find_get(struct net *net, const char *filter_name);
 void nfnl_acct_put(struct nf_acct *acct);
 void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct);
-extern int nfnl_acct_overquota(const struct sk_buff *skb,
+int nfnl_acct_overquota(struct net *net, const struct sk_buff *skb,
-                              struct nf_acct *nfacct);
+                        struct nf_acct *nfacct);
 #endif /* _NFNL_ACCT_H */
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index d8b37bab2887..7676557ce357 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -794,7 +794,7 @@ struct nvmf_connect_command {
 };
 struct nvmf_connect_data {
-        uuid_le         hostid;
+        uuid_be         hostid;
        __le16          cntlid;
        char            resv4[238];
        char            subsysnqn[NVMF_NQN_FIELD_LEN];
diff --git a/include/linux/pci.h b/include/linux/pci.h
index fbc1fa625c3e..0ab835965669 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -683,15 +683,6 @@ struct pci_driver {
 #define to_pci_driver(drv) container_of(drv, struct pci_driver, driver)
 /**
- * DEFINE_PCI_DEVICE_TABLE - macro used to describe a pci device table
- * @_table: device table name
- *
- * This macro is deprecated and should not be used in new code.
- */
-#define DEFINE_PCI_DEVICE_TABLE(_table) \
-        const struct pci_device_id _table[]
-/**
 * PCI_DEVICE - macro used to describe a specific pci device
 * @vend: the 16 bit PCI Vendor ID
 * @dev: the 16 bit PCI Device ID
diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h
index 923266cd294a..48ec7651989b 100644
--- a/include/linux/serial_8250.h
+++ b/include/linux/serial_8250.h
@@ -111,7 +111,6 @@ struct uart_8250_port {
                                                 *   if no_console_suspend
                                                 */
        unsigned char           probe;
-        struct mctrl_gpios      *gpios;
 #define UART_PROBE_RSA  (1 << 0)
        /*
diff --git a/include/linux/smc91x.h b/include/linux/smc91x.h
index 76199b75d584..e302c447e057 100644
--- a/include/linux/smc91x.h
+++ b/include/linux/smc91x.h
@@ -1,6 +1,16 @@
 #ifndef __SMC91X_H__
 #define __SMC91X_H__
+/*
+ * These bits define which access sizes a platform can support, rather
+ * than the maximal access size.  So, if your platform can do 16-bit
+ * and 32-bit accesses to the SMC91x device, but not 8-bit, set both
+ * SMC91X_USE_16BIT and SMC91X_USE_32BIT.
+ *
+ * The SMC91x driver requires at least one of SMC91X_USE_8BIT or
+ * SMC91X_USE_16BIT to be supported - just setting SMC91X_USE_32BIT is
+ * an invalid configuration.
+ */
 #define SMC91X_USE_8BIT (1 << 0)
 #define SMC91X_USE_16BIT (1 << 1)
 #define SMC91X_USE_32BIT (1 << 2)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index c00e7d51bb18..7717302cab91 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1523,6 +1523,8 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli
 {
        if (sk->sk_send_head == skb_unlinked)
                sk->sk_send_head = NULL;
+        if (tcp_sk(sk)->highest_sack == skb_unlinked)
+                tcp_sk(sk)->highest_sack = NULL;
 }
 static inline void tcp_init_send_head(struct sock *sk)
diff --git a/include/uapi/linux/atm_zatm.h b/include/uapi/linux/atm_zatm.h
index 9c9c6ad55f14..5cd4d4d2dd1d 100644
--- a/include/uapi/linux/atm_zatm.h
+++ b/include/uapi/linux/atm_zatm.h
@@ -14,6 +14,7 @@
 #include <linux/atmapi.h>
 #include <linux/atmioc.h>
+#include <linux/time.h>
 #define ZATM_GETPOOL    _IOW('a',ATMIOC_SARPRV+1,struct atmif_sioc)
                                                /* get pool statistics */
diff --git a/include/uapi/linux/if_pppol2tp.h b/include/uapi/linux/if_pppol2tp.h
index 163e8adac2d6..4bd1f55d6377 100644
--- a/include/uapi/linux/if_pppol2tp.h
+++ b/include/uapi/linux/if_pppol2tp.h
@@ -16,7 +16,8 @@
 #define _UAPI__LINUX_IF_PPPOL2TP_H
 #include <linux/types.h>
+#include <linux/in.h>
+#include <linux/in6.h>
 /* Structure used to connect() the socket to a particular tunnel UDP
 * socket over IPv4.
diff --git a/include/uapi/linux/if_pppox.h b/include/uapi/linux/if_pppox.h
index e128769331b5..d37bbb17a007 100644
--- a/include/uapi/linux/if_pppox.h
+++ b/include/uapi/linux/if_pppox.h
@@ -21,8 +21,11 @@
 #include <asm/byteorder.h>
 #include <linux/socket.h>
+#include <linux/if.h>
 #include <linux/if_ether.h>
 #include <linux/if_pppol2tp.h>
+#include <linux/in.h>
+#include <linux/in6.h>
 /* For user-space programs to pick up these definitions
 * which they wouldn't get otherwise without defining __KERNEL__
diff --git a/include/uapi/linux/if_tunnel.h b/include/uapi/linux/if_tunnel.h
index 1046f5515174..777b6cdb1b7b 100644
--- a/include/uapi/linux/if_tunnel.h
+++ b/include/uapi/linux/if_tunnel.h
@@ -2,6 +2,9 @@
 #define _UAPI_IF_TUNNEL_H_
 #include <linux/types.h>
+#include <linux/if.h>
+#include <linux/ip.h>
+#include <linux/in6.h>
 #include <asm/byteorder.h>
diff --git a/include/uapi/linux/ipx.h b/include/uapi/linux/ipx.h
index 3d48014cdd71..30f031db12f6 100644
--- a/include/uapi/linux/ipx.h
+++ b/include/uapi/linux/ipx.h
@@ -1,11 +1,13 @@
 #ifndef _IPX_H_
 #define _IPX_H_
+#include <linux/libc-compat.h>  /* for compatibility with glibc netipx/ipx.h */
 #include <linux/types.h>
 #include <linux/sockios.h>
 #include <linux/socket.h>
 #define IPX_NODE_LEN    6
 #define IPX_MTU         576
+#if __UAPI_DEF_SOCKADDR_IPX
 struct sockaddr_ipx {
        __kernel_sa_family_t sipx_family;
        __be16          sipx_port;
@@ -14,6 +16,7 @@ struct sockaddr_ipx {
        __u8            sipx_type;
        unsigned char   sipx_zero;      /* 16 byte fill */
 };
+#endif /* __UAPI_DEF_SOCKADDR_IPX */
 /*
 * So we can fit the extra info for SIOCSIFADDR into the address nicely
@@ -23,12 +26,15 @@ struct sockaddr_ipx {
 #define IPX_DLTITF      0
 #define IPX_CRTITF      1
+#if __UAPI_DEF_IPX_ROUTE_DEFINITION
 struct ipx_route_definition {
        __be32        ipx_network;
        __be32        ipx_router_network;
        unsigned char ipx_router_node[IPX_NODE_LEN];
 };
+#endif /* __UAPI_DEF_IPX_ROUTE_DEFINITION */
+#if __UAPI_DEF_IPX_INTERFACE_DEFINITION
 struct ipx_interface_definition {
        __be32        ipx_network;
        unsigned char ipx_device[16];
@@ -45,16 +51,20 @@ struct ipx_interface_definition {
 #define IPX_INTERNAL            2
        unsigned char ipx_node[IPX_NODE_LEN];
 };
-        
+#endif /* __UAPI_DEF_IPX_INTERFACE_DEFINITION */
+#if __UAPI_DEF_IPX_CONFIG_DATA
 struct ipx_config_data {
        unsigned char   ipxcfg_auto_select_primary;
        unsigned char   ipxcfg_auto_create_interfaces;
 };
+#endif /* __UAPI_DEF_IPX_CONFIG_DATA */
 /*
 * OLD Route Definition for backward compatibility.
 */
+#if __UAPI_DEF_IPX_ROUTE_DEF
 struct ipx_route_def {
        __be32          ipx_network;
        __be32          ipx_router_network;
@@ -67,6 +77,7 @@ struct ipx_route_def {
 #define IPX_RT_BLUEBOOK         2
 #define IPX_RT_ROUTED           1
 };
+#endif /* __UAPI_DEF_IPX_ROUTE_DEF */
 #define SIOCAIPXITFCRT          (SIOCPROTOPRIVATE)
 #define SIOCAIPXPRISLT          (SIOCPROTOPRIVATE + 1)
diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
index e4f048ee7043..44b8a6bd5fe1 100644
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -139,6 +139,25 @@
 #endif /* _NETINET_IN_H */
+/* Coordinate with glibc netipx/ipx.h header. */
+#if defined(__NETIPX_IPX_H)
+#define __UAPI_DEF_SOCKADDR_IPX                 0
+#define __UAPI_DEF_IPX_ROUTE_DEFINITION         0
+#define __UAPI_DEF_IPX_INTERFACE_DEFINITION     0
+#define __UAPI_DEF_IPX_CONFIG_DATA              0
+#define __UAPI_DEF_IPX_ROUTE_DEF                0
+#else /* defined(__NETIPX_IPX_H) */
+#define __UAPI_DEF_SOCKADDR_IPX                 1
+#define __UAPI_DEF_IPX_ROUTE_DEFINITION         1
+#define __UAPI_DEF_IPX_INTERFACE_DEFINITION     1
+#define __UAPI_DEF_IPX_CONFIG_DATA              1
+#define __UAPI_DEF_IPX_ROUTE_DEF                1
+#endif /* defined(__NETIPX_IPX_H) */
 /* Definitions for xattr.h */
 #if defined(_SYS_XATTR_H)
 #define __UAPI_DEF_XATTR                0
@@ -179,6 +198,13 @@
 #define __UAPI_DEF_IN6_PKTINFO          1
 #define __UAPI_DEF_IP6_MTUINFO          1
+/* Definitions for ipx.h */
+#define __UAPI_DEF_SOCKADDR_IPX                 1
+#define __UAPI_DEF_IPX_ROUTE_DEFINITION         1
+#define __UAPI_DEF_IPX_INTERFACE_DEFINITION     1
+#define __UAPI_DEF_IPX_CONFIG_DATA              1
+#define __UAPI_DEF_IPX_ROUTE_DEF                1
 /* Definitions for xattr.h */
 #define __UAPI_DEF_XATTR                1
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index d95a3018f6a1..54c3b4f4aceb 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -583,7 +583,7 @@ enum ovs_userspace_attr {
 #define OVS_USERSPACE_ATTR_MAX (__OVS_USERSPACE_ATTR_MAX - 1)
 struct ovs_action_trunc {
-        uint32_t max_len; /* Max packet size in bytes. */
+        __u32 max_len; /* Max packet size in bytes. */
 };
 /**
@@ -632,8 +632,8 @@ enum ovs_hash_alg {
 * @hash_basis: basis used for computing hash.
 */
 struct ovs_action_hash {
-        uint32_t  hash_alg;     /* One of ovs_hash_alg. */
+        __u32  hash_alg;     /* One of ovs_hash_alg. */
-        uint32_t  hash_basis;
+        __u32  hash_basis;
 };
 /**
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index d6709eb70970..0d302a87f21b 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -19,6 +19,7 @@
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
+#include <linux/file.h>
 #include <linux/kernel.h>
 #include <linux/audit.h>
 #include <linux/kthread.h>
@@ -544,10 +545,11 @@ int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
        unsigned long ino;
        dev_t dev;
-        rcu_read_lock();
+        exe_file = get_task_exe_file(tsk);
-        exe_file = rcu_dereference(tsk->mm->exe_file);
+        if (!exe_file)
+                return 0;
        ino = exe_file->f_inode->i_ino;
        dev = exe_file->f_inode->i_sb->s_dev;
-        rcu_read_unlock();
+        fput(exe_file);
        return audit_mark_compare(mark, ino, dev);
 }
diff --git a/kernel/configs/tiny.config b/kernel/configs/tiny.config
index c2de56ab0fce..7fa0c4ae6394 100644
--- a/kernel/configs/tiny.config
+++ b/kernel/configs/tiny.config
@@ -1,4 +1,12 @@
+# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+# CONFIG_KERNEL_GZIP is not set
+# CONFIG_KERNEL_BZIP2 is not set
+# CONFIG_KERNEL_LZMA is not set
 CONFIG_KERNEL_XZ=y
+# CONFIG_KERNEL_LZO is not set
+# CONFIG_KERNEL_LZ4 is not set
 CONFIG_OPTIMIZE_INLINING=y
+# CONFIG_SLAB is not set
+# CONFIG_SLUB is not set
 CONFIG_SLOB=y
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index c7fd2778ed50..c27e53326bef 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -2069,6 +2069,20 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css)
        mutex_unlock(&cpuset_mutex);
 }
+/*
+ * Make sure the new task conform to the current state of its parent,
+ * which could have been changed by cpuset just after it inherits the
+ * state from the parent and before it sits on the cgroup's task list.
+ */
+void cpuset_fork(struct task_struct *task)
+{
+        if (task_css_is_root(task, cpuset_cgrp_id))
+                return;
+        set_cpus_allowed_ptr(task, &current->cpus_allowed);
+        task->mems_allowed = current->mems_allowed;
+}
 struct cgroup_subsys cpuset_cgrp_subsys = {
        .css_alloc      = cpuset_css_alloc,
        .css_online     = cpuset_css_online,
@@ -2079,6 +2093,7 @@ struct cgroup_subsys cpuset_cgrp_subsys = {
        .attach         = cpuset_attach,
        .post_attach    = cpuset_post_attach,
        .bind           = cpuset_bind,
+        .fork           = cpuset_fork,
        .legacy_cftypes = files,
        .early_init     = true,
 };
diff --git a/kernel/exit.c b/kernel/exit.c
index 2f974ae042a6..091a78be3b09 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -848,12 +848,7 @@ void do_exit(long code)
        TASKS_RCU(preempt_enable());
        exit_notify(tsk, group_dead);
        proc_exit_connector(tsk);
-#ifdef CONFIG_NUMA
+        mpol_put_task_policy(tsk);
-        task_lock(tsk);
-        mpol_put(tsk->mempolicy);
-        tsk->mempolicy = NULL;
-        task_unlock(tsk);
-#endif
 #ifdef CONFIG_FUTEX
        if (unlikely(current->pi_state_cache))
                kfree(current->pi_state_cache);
diff --git a/kernel/fork.c b/kernel/fork.c
index 52e725d4a866..beb31725f7e2 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -799,6 +799,29 @@ struct file *get_mm_exe_file(struct mm_struct *mm)
 EXPORT_SYMBOL(get_mm_exe_file);
 /**
+ * get_task_exe_file - acquire a reference to the task's executable file
+ *
+ * Returns %NULL if task's mm (if any) has no associated executable file or
+ * this is a kernel thread with borrowed mm (see the comment above get_task_mm).
+ * User must release file via fput().
+ */
+struct file *get_task_exe_file(struct task_struct *task)
+{
+        struct file *exe_file = NULL;
+        struct mm_struct *mm;
+        task_lock(task);
+        mm = task->mm;
+        if (mm) {
+                if (!(task->flags & PF_KTHREAD))
+                        exe_file = get_mm_exe_file(mm);
+        }
+        task_unlock(task);
+        return exe_file;
+}
+EXPORT_SYMBOL(get_task_exe_file);
+/**
 * get_task_mm - acquire a reference to the task's mm
 *
 * Returns %NULL if the task has no mm.  Checks PF_KTHREAD (meaning
@@ -913,14 +936,12 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
        deactivate_mm(tsk, mm);
        /*
-         * If we're exiting normally, clear a user-space tid field if
+         * Signal userspace if we're not exiting with a core dump
-         * requested.  We leave this alone when dying by signal, to leave
+         * because we want to leave the value intact for debugging
-         * the value intact in a core dump, and to save the unnecessary
+         * purposes.
-         * trouble, say, a killed vfork parent shouldn't touch this mm.
-         * Userland only wants this done for a sys_exit.
         */
        if (tsk->clear_child_tid) {
-                if (!(tsk->flags & PF_SIGNALED) &&
+                if (!(tsk->signal->flags & SIGNAL_GROUP_COREDUMP) &&
                    atomic_read(&mm->mm_users) > 1) {
                        /*
                         * We don't check the error code - if userspace has
@@ -1404,7 +1425,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        p->real_start_time = ktime_get_boot_ns();
        p->io_context = NULL;
        p->audit_context = NULL;
-        threadgroup_change_begin(current);
        cgroup_fork(p);
 #ifdef CONFIG_NUMA
        p->mempolicy = mpol_dup(p->mempolicy);
@@ -1556,6 +1576,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        INIT_LIST_HEAD(&p->thread_group);
        p->task_works = NULL;
+        threadgroup_change_begin(current);
        /*
         * Ensure that the cgroup subsystem policies allow the new process to be
         * forked. It should be noted the the new process's css_set can be changed
@@ -1656,6 +1677,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 bad_fork_cancel_cgroup:
        cgroup_cancel_fork(p);
 bad_fork_free_pid:
+        threadgroup_change_end(current);
        if (pid != &init_struct_pid)
                free_pid(pid);
 bad_fork_cleanup_thread:
@@ -1688,7 +1710,6 @@ bad_fork_cleanup_policy:
        mpol_put(p->mempolicy);
 bad_fork_cleanup_threadgroup_lock:
 #endif
-        threadgroup_change_end(current);
        delayacct_tsk_free(p);
 bad_fork_cleanup_count:
        atomic_dec(&p->cred->user->processes);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 503bc2d348e5..037c321c5618 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -887,7 +887,10 @@ int kexec_load_purgatory(struct kimage *image, unsigned long min,
        return 0;
 out:
        vfree(pi->sechdrs);
+        pi->sechdrs = NULL;
        vfree(pi->purgatory_buf);
+        pi->purgatory_buf = NULL;
        return ret;
 }
diff --git a/kernel/printk/nmi.c b/kernel/printk/nmi.c
index b69eb8a2876f..16bab471c7e2 100644
--- a/kernel/printk/nmi.c
+++ b/kernel/printk/nmi.c
@@ -99,27 +99,33 @@ again:
        return add;
 }
-/*
+static void printk_nmi_flush_line(const char *text, int len)
- * printk one line from the temporary buffer from @start index until
- * and including the @end index.
- */
-static void print_nmi_seq_line(struct nmi_seq_buf *s, int start, int end)
 {
-        const char *buf = s->buffer + start;
        /*
         * The buffers are flushed in NMI only on panic.  The messages must
         * go only into the ring buffer at this stage.  Consoles will get
         * explicitly called later when a crashdump is not generated.
         */
        if (in_nmi())
-                printk_deferred("%.*s", (end - start) + 1, buf);
+                printk_deferred("%.*s", len, text);
        else
-                printk("%.*s", (end - start) + 1, buf);
+                printk("%.*s", len, text);
 }
 /*
+ * printk one line from the temporary buffer from @start index until
+ * and including the @end index.
+ */
+static void printk_nmi_flush_seq_line(struct nmi_seq_buf *s,
+                                        int start, int end)
+{
+        const char *buf = s->buffer + start;
+        printk_nmi_flush_line(buf, (end - start) + 1);
+}
+/*
 * Flush data from the associated per_CPU buffer. The function
 * can be called either via IRQ work or independently.
 */
@@ -150,9 +156,11 @@ more:
         * the buffer an unexpected way. If we printed something then
         * @len must only increase.
         */
-        if (i && i >= len)
+        if (i && i >= len) {
-                pr_err("printk_nmi_flush: internal error: i=%d >= len=%zu\n",
+                const char *msg = "printk_nmi_flush: internal error\n";
-                       i, len);
+                printk_nmi_flush_line(msg, strlen(msg));
+        }
        if (!len)
                goto out; /* Someone else has already flushed the buffer. */
@@ -166,14 +174,14 @@ more:
        /* Print line by line. */
        for (; i < size; i++) {
                if (s->buffer[i] == '\n') {
-                        print_nmi_seq_line(s, last_i, i);
+                        printk_nmi_flush_seq_line(s, last_i, i);
                        last_i = i + 1;
                }
        }
        /* Check if there was a partial line. */
        if (last_i < size) {
-                print_nmi_seq_line(s, last_i, size - 1);
+                printk_nmi_flush_seq_line(s, last_i, size - 1);
-                pr_cont("\n");
+                printk_nmi_flush_line("\n", strlen("\n"));
        }
        /*
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index ef6c6c3f9d8a..0db7c8a2afe2 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -605,12 +605,16 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
                ptrace_event(PTRACE_EVENT_SECCOMP, data);
                /*
                 * The delivery of a fatal signal during event
-                 * notification may silently skip tracer notification.
+                 * notification may silently skip tracer notification,
-                 * Terminating the task now avoids executing a system
+                 * which could leave us with a potentially unmodified
-                 * call that may not be intended.
+                 * syscall that the tracer would have liked to have
+                 * changed. Since the process is about to die, we just
+                 * force the syscall to be skipped and let the signal
+                 * kill the process and correctly handle any tracer exit
+                 * notifications.
                 */
                if (fatal_signal_pending(current))
-                        do_exit(SIGSYS);
+                        goto skip;
                /* Check if the tracer forced the syscall to be skipped. */
                this_syscall = syscall_get_nr(current, task_pt_regs(current));
                if (this_syscall < 0)
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 204fdc86863d..2ec7c00228f3 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -908,10 +908,11 @@ static void __tick_nohz_idle_enter(struct tick_sched *ts)
        ktime_t now, expires;
        int cpu = smp_processor_id();
+        now = tick_nohz_start_idle(ts);
        if (can_stop_idle_tick(cpu, ts)) {
                int was_stopped = ts->tick_stopped;
-                now = tick_nohz_start_idle(ts);
                ts->idle_calls++;
                expires = tick_nohz_stop_sched_tick(ts, now, cpu);
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 2307d7c89dac..2e2cca509231 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1686,24 +1686,6 @@ config LATENCYTOP
          Enable this option if you want to use the LatencyTOP tool
          to find out which userspace is blocking on what kernel operations.
-config ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
-        bool
-config DEBUG_STRICT_USER_COPY_CHECKS
-        bool "Strict user copy size checks"
-        depends on ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
-        depends on DEBUG_KERNEL && !TRACE_BRANCH_PROFILING
-        help
-          Enabling this option turns a certain set of sanity checks for user
-          copy operations into compile time failures.
-          The copy_from_user() etc checks are there to help test if there
-          are sufficient security checks on the length argument of
-          the copy operation, by having gcc prove that the argument is
-          within bounds.
-          If unsure, say N.
 source kernel/trace/Kconfig
 menu "Runtime Testing"
diff --git a/lib/Makefile b/lib/Makefile
index cfa68eb269e4..5dc77a8ec297 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -24,7 +24,6 @@ lib-y := ctype.o string.o vsprintf.o cmdline.o \
         is_single_threaded.o plist.o decompress.o kobject_uevent.o \
         earlycpio.o seq_buf.o nmi_backtrace.o nodemask.o
-obj-$(CONFIG_ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS) += usercopy.o
 lib-$(CONFIG_MMU) += ioremap.o
 lib-$(CONFIG_SMP) += cpumask.o
 lib-$(CONFIG_HAS_DMA) += dma-noop.o
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 5ba520b544d7..56054e541a0f 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -77,17 +77,18 @@ static int alloc_bucket_locks(struct rhashtable *ht, struct bucket_table *tbl,
        size = min_t(unsigned int, size, tbl->size >> 1);
        if (sizeof(spinlock_t) != 0) {
+                tbl->locks = NULL;
 #ifdef CONFIG_NUMA
                if (size * sizeof(spinlock_t) > PAGE_SIZE &&
                    gfp == GFP_KERNEL)
                        tbl->locks = vmalloc(size * sizeof(spinlock_t));
-                else
 #endif
                if (gfp != GFP_KERNEL)
                        gfp |= __GFP_NOWARN | __GFP_NORETRY;
-                tbl->locks = kmalloc_array(size, sizeof(spinlock_t),
+                if (!tbl->locks)
-                                           gfp);
+                        tbl->locks = kmalloc_array(size, sizeof(spinlock_t),
+                                                   gfp);
                if (!tbl->locks)
                        return -ENOMEM;
                for (i = 0; i < size; i++)
diff --git a/lib/test_hash.c b/lib/test_hash.c
index 66c5fc8351e8..cac20c5fb304 100644
--- a/lib/test_hash.c
+++ b/lib/test_hash.c
@@ -143,7 +143,7 @@ static int __init
 test_hash_init(void)
 {
        char buf[SIZE+1];
-        u32 string_or = 0, hash_or[2][33] = { 0 };
+        u32 string_or = 0, hash_or[2][33] = { { 0, } };
        unsigned tests = 0;
        unsigned long long h64 = 0;
        int i, j;
@@ -219,21 +219,27 @@ test_hash_init(void)
        }
        /* Issue notices about skipped tests. */
-#ifndef HAVE_ARCH__HASH_32
+#ifdef HAVE_ARCH__HASH_32
-        pr_info("__hash_32() has no arch implementation to test.");
+#if HAVE_ARCH__HASH_32 != 1
-#elif HAVE_ARCH__HASH_32 != 1
        pr_info("__hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_32
+#else
-        pr_info("hash_32() has no arch implementation to test.");
+        pr_info("__hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_32 != 1
+#endif
+#ifdef HAVE_ARCH_HASH_32
+#if HAVE_ARCH_HASH_32 != 1
        pr_info("hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_64
+#else
-        pr_info("hash_64() has no arch implementation to test.");
+        pr_info("hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_64 != 1
+#endif
+#ifdef HAVE_ARCH_HASH_64
+#if HAVE_ARCH_HASH_64 != 1
        pr_info("hash_64() is arch-specific; not compared to generic.");
 #endif
+#else
+        pr_info("hash_64() has no arch implementation to test.");
+#endif
        pr_notice("%u tests passed.", tests);
diff --git a/lib/usercopy.c b/lib/usercopy.c
deleted file mode 100644
index 4f5b1ddbcd25..000000000000
--- a/lib/usercopy.c
+++ /dev/null
@@ -1,9 +0,0 @@
-#include <linux/export.h>
-#include <linux/bug.h>
-#include <linux/uaccess.h>
-void copy_from_user_overflow(void)
-{
-        WARN(1, "Buffer overflow detected!\n");
-}
-EXPORT_SYMBOL(copy_from_user_overflow);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index d8c4e38fb5f4..2da72a5b6ecc 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2336,6 +2336,23 @@ out:
        return ret;
 }
+/*
+ * Drop the (possibly final) reference to task->mempolicy.  It needs to be
+ * dropped after task->mempolicy is set to NULL so that any allocation done as
+ * part of its kmem_cache_free(), such as by KASAN, doesn't reference a freed
+ * policy.
+ */
+void mpol_put_task_policy(struct task_struct *task)
+{
+        struct mempolicy *pol;
+        task_lock(task);
+        pol = task->mempolicy;
+        task->mempolicy = NULL;
+        task_unlock(task);
+        mpol_put(pol);
+}
 static void sp_delete(struct shared_policy *sp, struct sp_node *n)
 {
        pr_debug("deleting %lx-l%lx\n", n->start, n->end);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 3fbe73a6fe4b..a2214c64ed3c 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3137,54 +3137,6 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
        return NULL;
 }
-static inline bool
-should_compact_retry(struct alloc_context *ac, int order, int alloc_flags,
-                     enum compact_result compact_result,
-                     enum compact_priority *compact_priority,
-                     int compaction_retries)
-{
-        int max_retries = MAX_COMPACT_RETRIES;
-        if (!order)
-                return false;
-        /*
-         * compaction considers all the zone as desperately out of memory
-         * so it doesn't really make much sense to retry except when the
-         * failure could be caused by insufficient priority
-         */
-        if (compaction_failed(compact_result)) {
-                if (*compact_priority > MIN_COMPACT_PRIORITY) {
-                        (*compact_priority)--;
-                        return true;
-                }
-                return false;
-        }
-        /*
-         * make sure the compaction wasn't deferred or didn't bail out early
-         * due to locks contention before we declare that we should give up.
-         * But do not retry if the given zonelist is not suitable for
-         * compaction.
-         */
-        if (compaction_withdrawn(compact_result))
-                return compaction_zonelist_suitable(ac, order, alloc_flags);
-        /*
-         * !costly requests are much more important than __GFP_REPEAT
-         * costly ones because they are de facto nofail and invoke OOM
-         * killer to move on while costly can fail and users are ready
-         * to cope with that. 1/4 retries is rather arbitrary but we
-         * would need much more detailed feedback from compaction to
-         * make a better decision.
-         */
-        if (order > PAGE_ALLOC_COSTLY_ORDER)
-                max_retries /= 4;
-        if (compaction_retries <= max_retries)
-                return true;
-        return false;
-}
 #else
 static inline struct page *
 __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
@@ -3195,6 +3147,8 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
        return NULL;
 }
+#endif /* CONFIG_COMPACTION */
 static inline bool
 should_compact_retry(struct alloc_context *ac, unsigned int order, int alloc_flags,
                     enum compact_result compact_result,
@@ -3221,7 +3175,6 @@ should_compact_retry(struct alloc_context *ac, unsigned int order, int alloc_fla
        }
        return false;
 }
-#endif /* CONFIG_COMPACTION */
 /* Perform direct synchronous page reclaim */
 static int
@@ -4407,7 +4360,7 @@ static int build_zonelists_node(pg_data_t *pgdat, struct zonelist *zonelist,
        do {
                zone_type--;
                zone = pgdat->node_zones + zone_type;
-                if (populated_zone(zone)) {
+                if (managed_zone(zone)) {
                        zoneref_set_zone(zone,
                                &zonelist->_zonerefs[nr_zones++]);
                        check_highest_zone(zone_type);
@@ -4645,7 +4598,7 @@ static void build_zonelists_in_zone_order(pg_data_t *pgdat, int nr_nodes)
                for (j = 0; j < nr_nodes; j++) {
                        node = node_order[j];
                        z = &NODE_DATA(node)->node_zones[zone_type];
-                        if (populated_zone(z)) {
+                        if (managed_zone(z)) {
                                zoneref_set_zone(z,
                                        &zonelist->_zonerefs[pos++]);
                                check_highest_zone(zone_type);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 374d95d04178..b1e12a1ea9cf 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1665,7 +1665,7 @@ static bool inactive_reclaimable_pages(struct lruvec *lruvec,
        for (zid = sc->reclaim_idx; zid >= 0; zid--) {
                zone = &pgdat->node_zones[zid];
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                        continue;
                if (zone_page_state_snapshot(zone, NR_ZONE_LRU_BASE +
@@ -2036,7 +2036,7 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
                struct zone *zone = &pgdat->node_zones[zid];
                unsigned long inactive_zone, active_zone;
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                        continue;
                inactive_zone = zone_page_state(zone,
@@ -2171,7 +2171,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg,
                for (z = 0; z < MAX_NR_ZONES; z++) {
                        struct zone *zone = &pgdat->node_zones[z];
-                        if (!populated_zone(zone))
+                        if (!managed_zone(zone))
                                continue;
                        total_high_wmark += high_wmark_pages(zone);
@@ -2510,7 +2510,7 @@ static inline bool should_continue_reclaim(struct pglist_data *pgdat,
        /* If compaction would go ahead or the allocation would succeed, stop */
        for (z = 0; z <= sc->reclaim_idx; z++) {
                struct zone *zone = &pgdat->node_zones[z];
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                        continue;
                switch (compaction_suitable(zone, sc->order, 0, sc->reclaim_idx)) {
@@ -2840,7 +2840,7 @@ static bool pfmemalloc_watermark_ok(pg_data_t *pgdat)
        for (i = 0; i <= ZONE_NORMAL; i++) {
                zone = &pgdat->node_zones[i];
-                if (!populated_zone(zone) ||
+                if (!managed_zone(zone) ||
                    pgdat_reclaimable_pages(pgdat) == 0)
                        continue;
@@ -3141,7 +3141,7 @@ static bool prepare_kswapd_sleep(pg_data_t *pgdat, int order, int classzone_idx)
        for (i = 0; i <= classzone_idx; i++) {
                struct zone *zone = pgdat->node_zones + i;
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                        continue;
                if (!zone_balanced(zone, order, classzone_idx))
@@ -3169,7 +3169,7 @@ static bool kswapd_shrink_node(pg_data_t *pgdat,
        sc->nr_to_reclaim = 0;
        for (z = 0; z <= sc->reclaim_idx; z++) {
                zone = pgdat->node_zones + z;
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                        continue;
                sc->nr_to_reclaim += max(high_wmark_pages(zone), SWAP_CLUSTER_MAX);
@@ -3242,7 +3242,7 @@ static int balance_pgdat(pg_data_t *pgdat, int order, int classzone_idx)
                if (buffer_heads_over_limit) {
                        for (i = MAX_NR_ZONES - 1; i >= 0; i--) {
                                zone = pgdat->node_zones + i;
-                                if (!populated_zone(zone))
+                                if (!managed_zone(zone))
                                        continue;
                                sc.reclaim_idx = i;
@@ -3262,7 +3262,7 @@ static int balance_pgdat(pg_data_t *pgdat, int order, int classzone_idx)
                 */
                for (i = classzone_idx; i >= 0; i--) {
                        zone = pgdat->node_zones + i;
-                        if (!populated_zone(zone))
+                        if (!managed_zone(zone))
                                continue;
                        if (zone_balanced(zone, sc.order, classzone_idx))
@@ -3508,7 +3508,7 @@ void wakeup_kswapd(struct zone *zone, int order, enum zone_type classzone_idx)
        pg_data_t *pgdat;
        int z;
-        if (!populated_zone(zone))
+        if (!managed_zone(zone))
                return;
        if (!cpuset_zone_allowed(zone, GFP_KERNEL | __GFP_HARDWALL))
@@ -3522,7 +3522,7 @@ void wakeup_kswapd(struct zone *zone, int order, enum zone_type classzone_idx)
        /* Only wake kswapd if all zones are unbalanced */
        for (z = 0; z <= classzone_idx; z++) {
                zone = pgdat->node_zones + z;
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                        continue;
                if (zone_balanced(zone, order, classzone_idx))
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index ece45e0683fd..0b5f729d08d2 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -250,7 +250,7 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
        skb_free_datagram(sk, skb);
-        if (msg->msg_flags & MSG_TRUNC)
+        if (flags & MSG_TRUNC)
                copied = skblen;
        return err ? : copied;
diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index c045b3c54768..b0e23dfc5c34 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -262,6 +262,8 @@ int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
                break;
        }
+        kfree_skb(hdev->req_skb);
+        hdev->req_skb = NULL;
        hdev->req_status = hdev->req_result = 0;
        BT_DBG("%s end: err %d", hdev->name, err);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 6ef8a01a9ad4..96f04b7b9556 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1091,7 +1091,7 @@ static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg,
        skb_free_datagram(sk, skb);
-        if (msg->msg_flags & MSG_TRUNC)
+        if (flags & MSG_TRUNC)
                copied = skblen;
        return err ? : copied;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 54ceb1f2cc9a..d4cad29b033f 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -32,6 +32,7 @@
 #include <linux/debugfs.h>
 #include <linux/crc16.h>
+#include <linux/filter.h>
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -5835,6 +5836,9 @@ static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
                if (chan->sdu)
                        break;
+                if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
+                        break;
                chan->sdu_len = get_unaligned_le16(skb->data);
                skb_pull(skb, L2CAP_SDULEN_SIZE);
@@ -6610,6 +6614,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
                goto drop;
        }
+        if ((chan->mode == L2CAP_MODE_ERTM ||
+             chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
+                goto drop;
        if (!control->sframe) {
                int err;
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 1842141baedb..a8ba752732c9 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1019,7 +1019,7 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
                goto done;
        if (pi->rx_busy_skb) {
-                if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
+                if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
                        pi->rx_busy_skb = NULL;
                else
                        goto done;
@@ -1270,7 +1270,17 @@ static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
                goto done;
        }
-        err = sock_queue_rcv_skb(sk, skb);
+        if (chan->mode != L2CAP_MODE_ERTM &&
+            chan->mode != L2CAP_MODE_STREAMING) {
+                /* Even if no filter is attached, we could potentially
+                 * get errors from security modules, etc.
+                 */
+                err = sk_filter(sk, skb);
+                if (err)
+                        goto done;
+        }
+        err = __sock_queue_rcv_skb(sk, skb);
        /* For ERTM, handle one skb that doesn't fit into the recv
         * buffer.  This is important to do because the data frames
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index febca0f1008c..e2ffc2a5c7db 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -249,7 +249,7 @@ static inline unsigned long get_index(t_key key, struct key_vector *kv)
 * index into the parent's child array. That is, they will be used to find
 * 'n' among tp's children.
 *
- * The bits from (n->pos + n->bits) to (tn->pos - 1) - "S" - are skipped bits
+ * The bits from (n->pos + n->bits) to (tp->pos - 1) - "S" - are skipped bits
 * for the node n.
 *
 * All the bits we have seen so far are significant to the node n. The rest
@@ -258,7 +258,7 @@ static inline unsigned long get_index(t_key key, struct key_vector *kv)
 * The bits from (n->pos) to (n->pos + n->bits - 1) - "C" - are the index into
 * n's child array, and will of course be different for each child.
 *
- * The rest of the bits, from 0 to (n->pos + n->bits), are completely unknown
+ * The rest of the bits, from 0 to (n->pos -1) - "u" - are completely unknown
 * at this point.
 */
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 9d847c302551..0f227db0e9ac 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -73,9 +73,11 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
        skb_dst_set(skb, &rt->dst);
        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
-        if (skb_iif && proto == IPPROTO_UDP) {
+        if (skb_iif && !(df & htons(IP_DF))) {
-                /* Arrived from an ingress interface and got udp encapuslated.
+                /* Arrived from an ingress interface, got encapsulated, with
-                 * The encapsulated network segment length may exceed dst mtu.
+                 * fragmentation of encapulating frames allowed.
+                 * If skb is gso, the resulting encapsulated network segments
+                 * may exceed dst mtu.
                 * Allow IP Fragmentation of segments.
                 */
                IPCB(skb)->flags |= IPSKB_FRAG_SEGS;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 032a96d78c99..ffbb218de520 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3193,7 +3193,6 @@ int tcp_abort(struct sock *sk, int err)
                        local_bh_enable();
                        return 0;
                }
-                sock_gen_put(sk);
                return -EOPNOTSUPP;
        }
@@ -3222,7 +3221,6 @@ int tcp_abort(struct sock *sk, int err)
        bh_unlock_sock(sk);
        local_bh_enable();
        release_sock(sk);
-        sock_put(sk);
        return 0;
 }
 EXPORT_SYMBOL_GPL(tcp_abort);
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 4d610934fb39..a748c74aa8b7 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -54,11 +54,16 @@ static int tcp_diag_destroy(struct sk_buff *in_skb,
 {
        struct net *net = sock_net(in_skb->sk);
        struct sock *sk = inet_diag_find_one_icsk(net, &tcp_hashinfo, req);
+        int err;
        if (IS_ERR(sk))
                return PTR_ERR(sk);
-        return sock_diag_destroy(sk, ECONNABORTED);
+        err = sock_diag_destroy(sk, ECONNABORTED);
+        sock_gen_put(sk);
+        return err;
 }
 #endif
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 32b048e524d6..7158d4f8dae4 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -814,8 +814,14 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
        u32 seq = (sk->sk_state == TCP_LISTEN) ? tcp_rsk(req)->snt_isn + 1 :
                                             tcp_sk(sk)->snd_nxt;
+        /* RFC 7323 2.3
+         * The window field (SEG.WND) of every outgoing segment, with the
+         * exception of <SYN> segments, MUST be right-shifted by
+         * Rcv.Wind.Shift bits:
+         */
        tcp_v4_send_ack(sock_net(sk), skb, seq,
-                        tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
+                        tcp_rsk(req)->rcv_nxt,
+                        req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
                        tcp_time_stamp,
                        req->ts_recent,
                        0,
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index e61f7cd65d08..5fdcb8d108d4 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1182,13 +1182,13 @@ out:
 *      @sk: socket
 *
 *      Drops all bad checksum frames, until a valid one is found.
- *      Returns the length of found skb, or 0 if none is found.
+ *      Returns the length of found skb, or -1 if none is found.
 */
-static unsigned int first_packet_length(struct sock *sk)
+static int first_packet_length(struct sock *sk)
 {
        struct sk_buff_head list_kill, *rcvq = &sk->sk_receive_queue;
        struct sk_buff *skb;
-        unsigned int res;
+        int res;
        __skb_queue_head_init(&list_kill);
@@ -1203,7 +1203,7 @@ static unsigned int first_packet_length(struct sock *sk)
                __skb_unlink(skb, rcvq);
                __skb_queue_tail(&list_kill, skb);
        }
-        res = skb ? skb->len : 0;
+        res = skb ? skb->len : -1;
        spin_unlock_bh(&rcvq->lock);
        if (!skb_queue_empty(&list_kill)) {
@@ -1232,7 +1232,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
        case SIOCINQ:
        {
-                unsigned int amount = first_packet_length(sk);
+                int amount = max_t(int, 0, first_packet_length(sk));
                return put_user(amount, (int __user *)arg);
        }
@@ -2184,7 +2184,7 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
        /* Check for false positives due to checksum errors */
        if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
-            !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk))
+            !(sk->sk_shutdown & RCV_SHUTDOWN) && first_packet_length(sk) == -1)
                mask &= ~(POLLIN | POLLRDNORM);
        return mask;
@@ -2216,7 +2216,6 @@ struct proto udp_prot = {
        .sysctl_wmem       = &sysctl_udp_wmem_min,
        .sysctl_rmem       = &sysctl_udp_rmem_min,
        .obj_size          = sizeof(struct udp_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
        .h.udp_table       = &udp_table,
 #ifdef CONFIG_COMPAT
        .compat_setsockopt = compat_udp_setsockopt,
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 3b3efbda48e1..2eea073e27ef 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -55,7 +55,6 @@ struct proto 	udplite_prot = {
        .unhash            = udp_lib_unhash,
        .get_port          = udp_v4_get_port,
        .obj_size          = sizeof(struct udp_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
        .h.udp_table       = &udplite_table,
 #ifdef CONFIG_COMPAT
        .compat_setsockopt = compat_udp_setsockopt,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index df8425fcbc2c..f418d2eaeddd 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1872,7 +1872,6 @@ static int addrconf_dad_end(struct inet6_ifaddr *ifp)
 void addrconf_dad_failure(struct inet6_ifaddr *ifp)
 {
-        struct in6_addr addr;
        struct inet6_dev *idev = ifp->idev;
        struct net *net = dev_net(ifp->idev->dev);
@@ -1934,18 +1933,6 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                in6_ifa_put(ifp2);
 lock_errdad:
                spin_lock_bh(&ifp->lock);
-        } else if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6) {
-                addr.s6_addr32[0] = htonl(0xfe800000);
-                addr.s6_addr32[1] = 0;
-                if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
-                    ipv6_addr_equal(&ifp->addr, &addr)) {
-                        /* DAD failed for link-local based on MAC address */
-                        idev->cnf.disable_ipv6 = 1;
-                        pr_info("%s: IPv6 being disabled!\n",
-                                ifp->idev->dev->name);
-                }
        }
 errdad:
@@ -3821,6 +3808,7 @@ static void addrconf_dad_work(struct work_struct *w)
                                                dad_work);
        struct inet6_dev *idev = ifp->idev;
        struct in6_addr mcaddr;
+        bool disable_ipv6 = false;
        enum {
                DAD_PROCESS,
@@ -3837,6 +3825,24 @@ static void addrconf_dad_work(struct work_struct *w)
        } else if (ifp->state == INET6_IFADDR_STATE_ERRDAD) {
                action = DAD_ABORT;
                ifp->state = INET6_IFADDR_STATE_POSTDAD;
+                if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6 &&
+                    !(ifp->flags & IFA_F_STABLE_PRIVACY)) {
+                        struct in6_addr addr;
+                        addr.s6_addr32[0] = htonl(0xfe800000);
+                        addr.s6_addr32[1] = 0;
+                        if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
+                            ipv6_addr_equal(&ifp->addr, &addr)) {
+                                /* DAD failed for link-local based on MAC */
+                                idev->cnf.disable_ipv6 = 1;
+                                pr_info("%s: IPv6 being disabled!\n",
+                                        ifp->idev->dev->name);
+                                disable_ipv6 = true;
+                        }
+                }
        }
        spin_unlock_bh(&ifp->lock);
@@ -3845,6 +3851,8 @@ static void addrconf_dad_work(struct work_struct *w)
                goto out;
        } else if (action == DAD_ABORT) {
                addrconf_dad_stop(ifp, 1);
+                if (disable_ipv6)
+                        addrconf_ifdown(idev->dev, 0);
                goto out;
        }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 33df8b8575cc..94f4f89d73e7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -944,9 +944,15 @@ static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
        /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
         * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
         */
+        /* RFC 7323 2.3
+         * The window field (SEG.WND) of every outgoing segment, with the
+         * exception of <SYN> segments, MUST be right-shifted by
+         * Rcv.Wind.Shift bits:
+         */
        tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
                        tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
-                        tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
+                        tcp_rsk(req)->rcv_nxt,
+                        req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
                        tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
                        tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
                        0, 0);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 81e2f98b958d..19ac3a1c308d 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1460,7 +1460,6 @@ struct proto udpv6_prot = {
        .sysctl_wmem       = &sysctl_udp_wmem_min,
        .sysctl_rmem       = &sysctl_udp_rmem_min,
        .obj_size          = sizeof(struct udp6_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
        .h.udp_table       = &udp_table,
 #ifdef CONFIG_COMPAT
        .compat_setsockopt = compat_udpv6_setsockopt,
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 9cf097e206e9..fd6ef414899b 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -50,7 +50,6 @@ struct proto udplitev6_prot = {
        .unhash            = udp_lib_unhash,
        .get_port          = udp_v6_get_port,
        .obj_size          = sizeof(struct udp6_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
        .h.udp_table       = &udplite_table,
 #ifdef CONFIG_COMPAT
        .compat_setsockopt = compat_udpv6_setsockopt,
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index d9560aa2dba3..232cb92033e8 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -856,7 +856,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
        error = -ENOTCONN;
        if (sk == NULL)
                goto end;
-        if (sk->sk_state != PPPOX_CONNECTED)
+        if (!(sk->sk_state & PPPOX_CONNECTED))
                goto end;
        error = -EBADF;
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 958a1455ca7f..9f267c3ffb39 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -205,6 +205,7 @@ static int ct_seq_show(struct seq_file *s, void *v)
        struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
        const struct nf_conntrack_l3proto *l3proto;
        const struct nf_conntrack_l4proto *l4proto;
+        struct net *net = seq_file_net(s);
        int ret = 0;
        NF_CT_ASSERT(ct);
@@ -215,6 +216,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
        if (NF_CT_DIRECTION(hash))
                goto release;
+        if (!net_eq(nf_ct_net(ct), net))
+                goto release;
        l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
        NF_CT_ASSERT(l3proto);
        l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 1b4de4bd6958..70eb2f6a3b01 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -326,14 +326,14 @@ static int nfnl_acct_try_del(struct nf_acct *cur)
 {
        int ret = 0;
-        /* we want to avoid races with nfnl_acct_find_get. */
+        /* We want to avoid races with nfnl_acct_put. So only when the current
-        if (atomic_dec_and_test(&cur->refcnt)) {
+         * refcnt is 1, we decrease it to 0.
+         */
+        if (atomic_cmpxchg(&cur->refcnt, 1, 0) == 1) {
                /* We are protected by nfnl mutex. */
                list_del_rcu(&cur->head);
                kfree_rcu(cur, rcu_head);
        } else {
-                /* still in use, restore reference counter. */
-                atomic_inc(&cur->refcnt);
                ret = -EBUSY;
        }
        return ret;
@@ -443,7 +443,7 @@ void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct)
 }
 EXPORT_SYMBOL_GPL(nfnl_acct_update);
-static void nfnl_overquota_report(struct nf_acct *nfacct)
+static void nfnl_overquota_report(struct net *net, struct nf_acct *nfacct)
 {
        int ret;
        struct sk_buff *skb;
@@ -458,11 +458,12 @@ static void nfnl_overquota_report(struct nf_acct *nfacct)
                kfree_skb(skb);
                return;
        }
-        netlink_broadcast(init_net.nfnl, skb, 0, NFNLGRP_ACCT_QUOTA,
+        netlink_broadcast(net->nfnl, skb, 0, NFNLGRP_ACCT_QUOTA,
                          GFP_ATOMIC);
 }
-int nfnl_acct_overquota(const struct sk_buff *skb, struct nf_acct *nfacct)
+int nfnl_acct_overquota(struct net *net, const struct sk_buff *skb,
+                        struct nf_acct *nfacct)
 {
        u64 now;
        u64 *quota;
@@ -480,7 +481,7 @@ int nfnl_acct_overquota(const struct sk_buff *skb, struct nf_acct *nfacct)
        if (now >= *quota &&
            !test_and_set_bit(NFACCT_OVERQUOTA_BIT, &nfacct->flags)) {
-                nfnl_overquota_report(nfacct);
+                nfnl_overquota_report(net, nfacct);
        }
        return ret;
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 4cdcd969b64c..68216cdc7083 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -330,16 +330,16 @@ static int ctnl_timeout_try_del(struct net *net, struct ctnl_timeout *timeout)
 {
        int ret = 0;
-        /* we want to avoid races with nf_ct_timeout_find_get. */
+        /* We want to avoid races with ctnl_timeout_put. So only when the
-        if (atomic_dec_and_test(&timeout->refcnt)) {
+         * current refcnt is 1, we decrease it to 0.
+         */
+        if (atomic_cmpxchg(&timeout->refcnt, 1, 0) == 1) {
                /* We are protected by nfnl mutex. */
                list_del_rcu(&timeout->head);
                nf_ct_l4proto_put(timeout->l4proto);
                ctnl_untimeout(net, timeout);
                kfree_rcu(timeout, rcu_head);
        } else {
-                /* still in use, restore reference counter. */
-                atomic_inc(&timeout->refcnt);
                ret = -EBUSY;
        }
        return ret;
@@ -543,7 +543,9 @@ err:
 static void ctnl_timeout_put(struct ctnl_timeout *timeout)
 {
-        atomic_dec(&timeout->refcnt);
+        if (atomic_dec_and_test(&timeout->refcnt))
+                kfree_rcu(timeout, rcu_head);
        module_put(THIS_MODULE);
 }
 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
@@ -591,7 +593,9 @@ static void __net_exit cttimeout_net_exit(struct net *net)
        list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list, head) {
                list_del_rcu(&cur->head);
                nf_ct_l4proto_put(cur->l4proto);
-                kfree_rcu(cur, rcu_head);
+                if (atomic_dec_and_test(&cur->refcnt))
+                        kfree_rcu(cur, rcu_head);
        }
 }
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index cbcfdfb586a6..6577db524ef6 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -1147,6 +1147,7 @@ MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ULOG);
 MODULE_ALIAS_NF_LOGGER(AF_INET, 1);
 MODULE_ALIAS_NF_LOGGER(AF_INET6, 1);
 MODULE_ALIAS_NF_LOGGER(AF_BRIDGE, 1);
+MODULE_ALIAS_NF_LOGGER(3, 1); /* NFPROTO_ARP */
 module_init(nfnetlink_log_init);
 module_exit(nfnetlink_log_fini);
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 7f4414d26a66..663c4c3c9072 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -127,6 +127,8 @@ nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
                                                    daddr, dport,
                                                    in->ifindex);
+                        if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
+                                sk = NULL;
                        /* NOTE: we return listeners even if bound to
                         * 0.0.0.0, those are filtered out in
                         * xt_socket, since xt_TPROXY needs 0 bound
@@ -195,6 +197,8 @@ nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
                                                   daddr, ntohs(dport),
                                                   in->ifindex);
+                        if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
+                                sk = NULL;
                        /* NOTE: we return listeners even if bound to
                         * 0.0.0.0, those are filtered out in
                         * xt_socket, since xt_TPROXY needs 0 bound
diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
index 3048a7e3a90a..cf327593852a 100644
--- a/net/netfilter/xt_nfacct.c
+++ b/net/netfilter/xt_nfacct.c
@@ -26,7 +26,7 @@ static bool nfacct_mt(const struct sk_buff *skb, struct xt_action_param *par)
        nfnl_acct_update(skb, info->nfacct);
-        overquota = nfnl_acct_overquota(skb, info->nfacct);
+        overquota = nfnl_acct_overquota(par->net, skb, info->nfacct);
        return overquota == NFACCT_UNDERQUOTA ? false : true;
 }
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 141a06eeb1e5..e87cd81315e1 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -53,7 +53,7 @@ int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen, const void *dval)
        u32 *tlv = (u32 *)(skbdata);
        u16 totlen = nla_total_size(dlen);      /*alignment + hdr */
        char *dptr = (char *)tlv + NLA_HDRLEN;
-        u32 htlv = attrtype << 16 | totlen;
+        u32 htlv = attrtype << 16 | dlen;
        *tlv = htonl(htlv);
        memset(dptr, 0, totlen - NLA_HDRLEN);
@@ -135,7 +135,7 @@ EXPORT_SYMBOL_GPL(ife_release_meta_gen);
 int ife_validate_meta_u32(void *val, int len)
 {
-        if (len == 4)
+        if (len == sizeof(u32))
                return 0;
        return -EINVAL;
@@ -144,8 +144,8 @@ EXPORT_SYMBOL_GPL(ife_validate_meta_u32);
 int ife_validate_meta_u16(void *val, int len)
 {
-        /* length will include padding */
+        /* length will not include padding */
-        if (len == NLA_ALIGN(2))
+        if (len == sizeof(u16))
                return 0;
        return -EINVAL;
@@ -652,12 +652,14 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
                u8 *tlvdata = (u8 *)tlv;
                u16 mtype = tlv->type;
                u16 mlen = tlv->len;
+                u16 alen;
                mtype = ntohs(mtype);
                mlen = ntohs(mlen);
+                alen = NLA_ALIGN(mlen);
-                if (find_decode_metaid(skb, ife, mtype, (mlen - 4),
+                if (find_decode_metaid(skb, ife, mtype, (mlen - NLA_HDRLEN),
-                                       (void *)(tlvdata + 4))) {
+                                       (void *)(tlvdata + NLA_HDRLEN))) {
                        /* abuse overlimits to count when we receive metadata
                         * but dont have an ops for it
                         */
@@ -666,8 +668,8 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
                        ife->tcf_qstats.overlimits++;
                }
-                tlvdata += mlen;
+                tlvdata += alen;
-                ifehdrln -= mlen;
+                ifehdrln -= alen;
                tlv = (struct meta_tlvhdr *)tlvdata;
        }
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index e95b67cd5718..657c13362b19 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -643,18 +643,19 @@ struct Qdisc *qdisc_create_dflt(struct netdev_queue *dev_queue,
        struct Qdisc *sch;
        if (!try_module_get(ops->owner))
-                goto errout;
+                return NULL;
        sch = qdisc_alloc(dev_queue, ops);
-        if (IS_ERR(sch))
+        if (IS_ERR(sch)) {
-                goto errout;
+                module_put(ops->owner);
+                return NULL;
+        }
        sch->parent = parentid;
        if (!ops->init || ops->init(sch, NULL) == 0)
                return sch;
        qdisc_destroy(sch);
-errout:
        return NULL;
 }
 EXPORT_SYMBOL(qdisc_create_dflt);
diff --git a/net/sctp/input.c b/net/sctp/input.c
index c182db7d691f..69444d32ecda 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -119,7 +119,13 @@ int sctp_rcv(struct sk_buff *skb)
                       skb_transport_offset(skb))
                goto discard_it;
-        if (!pskb_may_pull(skb, sizeof(struct sctphdr)))
+        /* If the packet is fragmented and we need to do crc checking,
+         * it's better to just linearize it otherwise crc computing
+         * takes longer.
+         */
+        if ((!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) &&
+             skb_linearize(skb)) ||
+            !pskb_may_pull(skb, sizeof(struct sctphdr)))
                goto discard_it;
        /* Pull up the IP header. */
@@ -1177,9 +1183,6 @@ static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
        if ((skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP)
                return NULL;
-        if (skb_linearize(skb))
-                return NULL;
        ch = (sctp_chunkhdr_t *) skb->data;
        /* The code below will attempt to walk the chunk and extract
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index c30ddb0f3190..6437aa97cfd7 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -170,19 +170,6 @@ next_chunk:
                chunk = list_entry(entry, struct sctp_chunk, list);
-                /* Linearize if it's not GSO */
-                if ((skb_shinfo(chunk->skb)->gso_type & SKB_GSO_SCTP) != SKB_GSO_SCTP &&
-                    skb_is_nonlinear(chunk->skb)) {
-                        if (skb_linearize(chunk->skb)) {
-                                __SCTP_INC_STATS(dev_net(chunk->skb->dev), SCTP_MIB_IN_PKT_DISCARDS);
-                                sctp_chunk_free(chunk);
-                                goto next_chunk;
-                        }
-                        /* Update sctp_hdr as it probably changed */
-                        chunk->sctp_hdr = sctp_hdr(chunk->skb);
-                }
                if ((skb_shinfo(chunk->skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP) {
                        /* GSO-marked skbs but without frags, handle
                         * them normally
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index bb691538adc8..f3508aa75815 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -424,11 +424,13 @@ static int sctp_diag_dump_one(struct sk_buff *in_skb,
                paddr.v4.sin_family = AF_INET;
        } else {
                laddr.v6.sin6_port = req->id.idiag_sport;
-                memcpy(&laddr.v6.sin6_addr, req->id.idiag_src, 64);
+                memcpy(&laddr.v6.sin6_addr, req->id.idiag_src,
+                       sizeof(laddr.v6.sin6_addr));
                laddr.v6.sin6_family = AF_INET6;
                paddr.v6.sin6_port = req->id.idiag_dport;
-                memcpy(&paddr.v6.sin6_addr, req->id.idiag_dst, 64);
+                memcpy(&paddr.v6.sin6_addr, req->id.idiag_dst,
+                       sizeof(paddr.v6.sin6_addr));
                paddr.v6.sin6_family = AF_INET6;
        }
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 7f79fb7dc6a0..66f23b376fa0 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -453,7 +453,7 @@ static struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
        struct rpc_xprt_switch *xps;
        if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) {
-                WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+                WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
                xps = args->bc_xprt->xpt_bc_xps;
                xprt_switch_get(xps);
        } else {
@@ -520,7 +520,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
        char servername[48];
        if (args->bc_xprt) {
-                WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+                WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
                xprt = args->bc_xprt->xpt_bc_xprt;
                if (xprt) {
                        xprt_get(xprt);
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index b016c011970b..ae7e14cae085 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -396,10 +396,13 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
        tuncfg.encap_destroy = NULL;
        setup_udp_tunnel_sock(net, ub->ubsock, &tuncfg);
-        if (enable_mcast(ub, remote))
+        err = enable_mcast(ub, remote);
+        if (err)
                goto err;
        return 0;
 err:
+        if (ub->ubsock)
+                udp_tunnel_sock_release(ub->ubsock);
        kfree(ub);
        return err;
 }
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 4de3cc42fc50..206a6b346a8d 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3570,15 +3570,6 @@ sub process {
                        }
                }
-# check for uses of DEFINE_PCI_DEVICE_TABLE
-                if ($line =~ /\bDEFINE_PCI_DEVICE_TABLE\s*\(\s*(\w+)\s*\)\s*=/) {
-                        if (WARN("DEFINE_PCI_DEVICE_TABLE",
-                                 "Prefer struct pci_device_id over deprecated DEFINE_PCI_DEVICE_TABLE\n" . $herecurr) &&
-                            $fix) {
-                                $fixed[$fixlinenr] =~ s/\b(?:static\s+|)DEFINE_PCI_DEVICE_TABLE\s*\(\s*(\w+)\s*\)\s*=\s*/static const struct pci_device_id $1\[\] = /;
-                        }
-                }
 # check for new typedefs, only function parameters and sparse annotations
 # make sense.
                if ($line =~ /\btypedef\s/ &&
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index e1c09e2f9be7..8ea9fd2b6573 100755
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -332,7 +332,9 @@ if grep -q '^CONFIG_STACK_VALIDATION=y' $KCONFIG_CONFIG ; then
        (cd $objtree; find tools/objtool -type f -executable) >> "$objtree/debian/hdrobjfiles"
 fi
 (cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f) >> "$objtree/debian/hdrobjfiles"
-(cd $objtree; find scripts/gcc-plugins -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
+if grep -q '^CONFIG_GCC_PLUGINS=y' $KCONFIG_CONFIG ; then
+        (cd $objtree; find scripts/gcc-plugins -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
+fi
 destdir=$kernel_headers_dir/usr/src/linux-headers-$version
 mkdir -p "$destdir"
 (cd $srctree; tar -c -f - -T -) < "$objtree/debian/hdrsrcfiles" | (cd $destdir; tar -xf -)
diff --git a/scripts/tags.sh b/scripts/tags.sh
index ed7eef24ef89..b3775a9604ea 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -206,7 +206,6 @@ regex_c=(
        '/\<DEFINE_PER_CPU_SHARED_ALIGNED([^,]*, *\([[:alnum:]_]*\)/\1/v/'
        '/\<DECLARE_WAIT_QUEUE_HEAD(\([[:alnum:]_]*\)/\1/v/'
        '/\<DECLARE_\(TASKLET\|WORK\|DELAYED_WORK\)(\([[:alnum:]_]*\)/\2/v/'
-        '/\<DEFINE_PCI_DEVICE_TABLE(\([[:alnum:]_]*\)/\1/v/'
        '/\(^\s\)OFFSET(\([[:alnum:]_]*\)/\2/v/'
        '/\(^\s\)DEFINE(\([[:alnum:]_]*\)/\2/v/'
        '/\<DEFINE_HASHTABLE(\([[:alnum:]_]*\)/\1/v/'
diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index 0e8a1f7a292d..ae68bf0e2d51 100644
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -348,7 +348,7 @@ int main(int argc, char **argv)
        int notrigger = 0;
        char *dummy;
-        struct iio_channel_info *channels;
+        struct iio_channel_info *channels = NULL;
        register_cleanup();