117 files changed, 1011 insertions, 596 deletions
diff --git a/.mailmap b/.mailmap
index ada8ad696b2e..d357e1bd2a43 100644
--- a/.mailmap
+++ b/.mailmap
@@ -51,6 +51,7 @@ Greg Kroah-Hartman <gregkh@suse.de>
 Greg Kroah-Hartman <greg@kroah.com>
 Henk Vergonet <Henk.Vergonet@gmail.com>
 Henrik Kretzschmar <henne@nachtwindheim.de>
+Henrik Rydberg <rydberg@bitmath.org>
 Herbert Xu <herbert@gondor.apana.org.au>
 Jacob Shin <Jacob.Shin@amd.com>
 James Bottomley <jejb@mulgrave.(none)>
diff --git a/MAINTAINERS b/MAINTAINERS
index ddb9ac8d32b3..3589d67437f8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -724,15 +724,15 @@ F:	include/uapi/linux/apm_bios.h
 F:      drivers/char/apm-emulation.c
 APPLE BCM5974 MULTITOUCH DRIVER
-M:      Henrik Rydberg <rydberg@euromail.se>
+M:      Henrik Rydberg <rydberg@bitmath.org>
 L:      linux-input@vger.kernel.org
-S:      Maintained
+S:      Odd fixes
 F:      drivers/input/mouse/bcm5974.c
 APPLE SMC DRIVER
-M:      Henrik Rydberg <rydberg@euromail.se>
+M:      Henrik Rydberg <rydberg@bitmath.org>
 L:      lm-sensors@lm-sensors.org
-S:      Maintained
+S:      Odd fixes
 F:      drivers/hwmon/applesmc.c
 APPLETALK NETWORK LAYER
@@ -2259,6 +2259,7 @@ F:	drivers/gpio/gpio-bt8xx.c
 BTRFS FILE SYSTEM
 M:      Chris Mason <clm@fb.com>
 M:      Josef Bacik <jbacik@fb.com>
+M:      David Sterba <dsterba@suse.cz>
 L:      linux-btrfs@vger.kernel.org
 W:      http://btrfs.wiki.kernel.org/
 Q:      http://patchwork.kernel.org/project/linux-btrfs/list/
@@ -4940,10 +4941,10 @@ F:	include/uapi/linux/input.h
 F:      include/linux/input/
 INPUT MULTITOUCH (MT) PROTOCOL
-M:      Henrik Rydberg <rydberg@euromail.se>
+M:      Henrik Rydberg <rydberg@bitmath.org>
 L:      linux-input@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rydberg/input-mt.git
-S:      Maintained
+S:      Odd fixes
 F:      Documentation/input/multi-touch-protocol.txt
 F:      drivers/input/input-mt.c
 K:      \b(ABS|SYN)_MT_
diff --git a/Makefile b/Makefile
index ef748e17702f..87f0c052b0ac 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 19
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Diseased Newt
 # *DOCUMENTATION*
@@ -391,6 +391,7 @@ USERINCLUDE    := \
 # Needed to be compatible with the O= option
 LINUXINCLUDE    := \
                -I$(srctree)/arch/$(hdr-arch)/include \
+                -Iarch/$(hdr-arch)/include/generated/uapi \
                -Iarch/$(hdr-arch)/include/generated \
                $(if $(KBUILD_SRC), -I$(srctree)/include) \
                -Iinclude \
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index f9c863911038..715ae19bc7c8 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -1046,6 +1046,15 @@ static int c_show(struct seq_file *m, void *v)
                seq_printf(m, "model name\t: %s rev %d (%s)\n",
                           cpu_name, cpuid & 15, elf_platform);
+#if defined(CONFIG_SMP)
+                seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
+                           per_cpu(cpu_data, i).loops_per_jiffy / (500000UL/HZ),
+                           (per_cpu(cpu_data, i).loops_per_jiffy / (5000UL/HZ)) % 100);
+#else
+                seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
+                           loops_per_jiffy / (500000/HZ),
+                           (loops_per_jiffy / (5000/HZ)) % 100);
+#endif
                /* dump out the processor features */
                seq_puts(m, "Features\t: ");
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 5e6052e18850..86ef244c5a24 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -387,6 +387,18 @@ asmlinkage void secondary_start_kernel(void)
 void __init smp_cpus_done(unsigned int max_cpus)
 {
+        int cpu;
+        unsigned long bogosum = 0;
+        for_each_online_cpu(cpu)
+                bogosum += per_cpu(cpu_data, cpu).loops_per_jiffy;
+        printk(KERN_INFO "SMP: Total of %d processors activated "
+               "(%lu.%02lu BogoMIPS).\n",
+               num_online_cpus(),
+               bogosum / (500000/HZ),
+               (bogosum / (5000/HZ)) % 100);
        hyp_mode_check();
 }
diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
index b1fa4e614718..fbe0ca31a99c 100644
--- a/arch/arm64/include/asm/arch_timer.h
+++ b/arch/arm64/include/asm/arch_timer.h
@@ -21,6 +21,7 @@
 #include <asm/barrier.h>
+#include <linux/bug.h>
 #include <linux/init.h>
 #include <linux/types.h>
diff --git a/arch/arm64/include/asm/cpu.h b/arch/arm64/include/asm/cpu.h
index ace70682499b..8e797b2fcc01 100644
--- a/arch/arm64/include/asm/cpu.h
+++ b/arch/arm64/include/asm/cpu.h
@@ -39,6 +39,7 @@ struct cpuinfo_arm64 {
        u64             reg_id_aa64pfr0;
        u64             reg_id_aa64pfr1;
+        u32             reg_id_dfr0;
        u32             reg_id_isar0;
        u32             reg_id_isar1;
        u32             reg_id_isar2;
@@ -51,6 +52,10 @@ struct cpuinfo_arm64 {
        u32             reg_id_mmfr3;
        u32             reg_id_pfr0;
        u32             reg_id_pfr1;
+        u32             reg_mvfr0;
+        u32             reg_mvfr1;
+        u32             reg_mvfr2;
 };
 DECLARE_PER_CPU(struct cpuinfo_arm64, cpu_data);
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index 286b1bec547c..f9be30ea1cbd 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -31,6 +31,7 @@
 #include <asm/fpsimd.h>
 #include <asm/hw_breakpoint.h>
+#include <asm/pgtable-hwdef.h>
 #include <asm/ptrace.h>
 #include <asm/types.h>
@@ -123,9 +124,6 @@ struct task_struct;
 /* Free all resources held by a thread. */
 extern void release_thread(struct task_struct *);
-/* Prepare to copy thread state - unlazy all lazy status */
-#define prepare_to_copy(tsk)    do { } while (0)
 unsigned long get_wchan(struct task_struct *p);
 #define cpu_relax()                     barrier()
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index 49c9aefd24a5..b780c6c76eec 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -44,7 +44,7 @@
 #define __ARM_NR_compat_cacheflush      (__ARM_NR_COMPAT_BASE+2)
 #define __ARM_NR_compat_set_tls         (__ARM_NR_COMPAT_BASE+5)
-#define __NR_compat_syscalls            386
+#define __NR_compat_syscalls            387
 #endif
 #define __ARCH_WANT_SYS_CLONE
diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
index 57b641747534..07d435cf2eea 100644
--- a/arch/arm64/kernel/cpuinfo.c
+++ b/arch/arm64/kernel/cpuinfo.c
@@ -147,6 +147,7 @@ static void cpuinfo_sanity_check(struct cpuinfo_arm64 *cur)
         * If we have AArch32, we care about 32-bit features for compat. These
         * registers should be RES0 otherwise.
         */
+        diff |= CHECK(id_dfr0, boot, cur, cpu);
        diff |= CHECK(id_isar0, boot, cur, cpu);
        diff |= CHECK(id_isar1, boot, cur, cpu);
        diff |= CHECK(id_isar2, boot, cur, cpu);
@@ -165,6 +166,10 @@ static void cpuinfo_sanity_check(struct cpuinfo_arm64 *cur)
        diff |= CHECK(id_pfr0, boot, cur, cpu);
        diff |= CHECK(id_pfr1, boot, cur, cpu);
+        diff |= CHECK(mvfr0, boot, cur, cpu);
+        diff |= CHECK(mvfr1, boot, cur, cpu);
+        diff |= CHECK(mvfr2, boot, cur, cpu);
        /*
         * Mismatched CPU features are a recipe for disaster. Don't even
         * pretend to support them.
@@ -189,6 +194,7 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info)
        info->reg_id_aa64pfr0 = read_cpuid(ID_AA64PFR0_EL1);
        info->reg_id_aa64pfr1 = read_cpuid(ID_AA64PFR1_EL1);
+        info->reg_id_dfr0 = read_cpuid(ID_DFR0_EL1);
        info->reg_id_isar0 = read_cpuid(ID_ISAR0_EL1);
        info->reg_id_isar1 = read_cpuid(ID_ISAR1_EL1);
        info->reg_id_isar2 = read_cpuid(ID_ISAR2_EL1);
@@ -202,6 +208,10 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info)
        info->reg_id_pfr0 = read_cpuid(ID_PFR0_EL1);
        info->reg_id_pfr1 = read_cpuid(ID_PFR1_EL1);
+        info->reg_mvfr0 = read_cpuid(MVFR0_EL1);
+        info->reg_mvfr1 = read_cpuid(MVFR1_EL1);
+        info->reg_mvfr2 = read_cpuid(MVFR2_EL1);
        cpuinfo_detect_icache_policy(info);
        check_local_cpu_errata();
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 6fac253bc783..2bb4347d0edf 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -326,6 +326,7 @@ void __init efi_idmap_init(void)
        /* boot time idmap_pg_dir is incomplete, so fill in missing parts */
        efi_setup_idmap();
+        early_memunmap(memmap.map, memmap.map_end - memmap.map);
 }
 static int __init remap_region(efi_memory_desc_t *md, void **new)
@@ -380,7 +381,6 @@ static int __init arm64_enter_virtual_mode(void)
        }
        mapsize = memmap.map_end - memmap.map;
-        early_memunmap(memmap.map, mapsize);
        if (efi_runtime_disabled()) {
                pr_info("EFI runtime services will be disabled.\n");
diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
index fd027b101de5..9b6f71db2709 100644
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -25,6 +25,7 @@
 #include <linux/mm.h>
 #include <linux/moduleloader.h>
 #include <linux/vmalloc.h>
+#include <asm/alternative.h>
 #include <asm/insn.h>
 #include <asm/sections.h>
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index b80991166754..20fe2932ad0c 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -402,6 +402,7 @@ void __init setup_arch(char **cmdline_p)
        request_standard_resources();
        efi_idmap_init();
+        early_ioremap_reset();
        unflatten_device_tree();
diff --git a/arch/arm64/kernel/smp_spin_table.c b/arch/arm64/kernel/smp_spin_table.c
index 4f93c67e63de..14944e5b28da 100644
--- a/arch/arm64/kernel/smp_spin_table.c
+++ b/arch/arm64/kernel/smp_spin_table.c
@@ -25,6 +25,7 @@
 #include <asm/cacheflush.h>
 #include <asm/cpu_ops.h>
 #include <asm/cputype.h>
+#include <asm/io.h>
 #include <asm/smp_plat.h>
 extern void secondary_holding_pen(void);
diff --git a/arch/blackfin/mach-bf533/boards/stamp.c b/arch/blackfin/mach-bf533/boards/stamp.c
index 6f4bac969bf7..23eada79439c 100644
--- a/arch/blackfin/mach-bf533/boards/stamp.c
+++ b/arch/blackfin/mach-bf533/boards/stamp.c
@@ -7,6 +7,7 @@
 */
 #include <linux/device.h>
+#include <linux/delay.h>
 #include <linux/platform_device.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
index f3b51b57740a..95c39b95e97e 100644
--- a/arch/ia64/include/asm/unistd.h
+++ b/arch/ia64/include/asm/unistd.h
@@ -11,7 +11,7 @@
-#define NR_syscalls                     318 /* length of syscall table */
+#define NR_syscalls                     319 /* length of syscall table */
 /*
 * The following defines stop scripts/checksyscalls.sh from complaining about
diff --git a/arch/ia64/include/uapi/asm/unistd.h b/arch/ia64/include/uapi/asm/unistd.h
index 4c2240c1b0cb..461079560c78 100644
--- a/arch/ia64/include/uapi/asm/unistd.h
+++ b/arch/ia64/include/uapi/asm/unistd.h
@@ -331,5 +331,6 @@
 #define __NR_getrandom                  1339
 #define __NR_memfd_create               1340
 #define __NR_bpf                        1341
+#define __NR_execveat                   1342
 #endif /* _UAPI_ASM_IA64_UNISTD_H */
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index 615ef81def49..e795cb848154 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -893,13 +893,13 @@ static int _acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
 }
 /* wrapper to silence section mismatch warning */
-int __ref acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
+int __ref acpi_map_cpu(acpi_handle handle, int physid, int *pcpu)
 {
        return _acpi_map_lsapic(handle, physid, pcpu);
 }
-EXPORT_SYMBOL(acpi_map_lsapic);
+EXPORT_SYMBOL(acpi_map_cpu);
-int acpi_unmap_lsapic(int cpu)
+int acpi_unmap_cpu(int cpu)
 {
        ia64_cpu_to_sapicid[cpu] = -1;
        set_cpu_present(cpu, false);
@@ -910,8 +910,7 @@ int acpi_unmap_lsapic(int cpu)
        return (0);
 }
+EXPORT_SYMBOL(acpi_unmap_cpu);
-EXPORT_SYMBOL(acpi_unmap_lsapic);
 #endif                          /* CONFIG_ACPI_HOTPLUG_CPU */
 #ifdef CONFIG_ACPI_NUMA
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index f5e96dffc63c..fcf8b8cbca0b 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1779,6 +1779,7 @@ sys_call_table:
        data8 sys_getrandom
        data8 sys_memfd_create                  // 1340
        data8 sys_bpf
+        data8 sys_execveat
        .org sys_call_table + 8*NR_syscalls     // guard against failures to increase NR_syscalls
 #endif /* __IA64_ASM_PARAVIRTUALIZED_NATIVE */
diff --git a/arch/powerpc/include/asm/kexec.h b/arch/powerpc/include/asm/kexec.h
index 19c36cba37c4..a46f5f45570c 100644
--- a/arch/powerpc/include/asm/kexec.h
+++ b/arch/powerpc/include/asm/kexec.h
@@ -86,6 +86,11 @@ extern int overlaps_crashkernel(unsigned long start, unsigned long size);
 extern void reserve_crashkernel(void);
 extern void machine_kexec_mask_interrupts(void);
+static inline bool kdump_in_progress(void)
+{
+        return crashing_cpu >= 0;
+}
 #else /* !CONFIG_KEXEC */
 static inline void crash_kexec_secondary(struct pt_regs *regs) { }
@@ -106,6 +111,11 @@ static inline int crash_shutdown_unregister(crash_shutdown_t handler)
        return 0;
 }
+static inline bool kdump_in_progress(void)
+{
+        return false;
+}
 #endif /* CONFIG_KEXEC */
 #endif /* ! __ASSEMBLY__ */
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index ce9577d693be..91062eef582f 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -366,3 +366,4 @@ SYSCALL_SPU(seccomp)
 SYSCALL_SPU(getrandom)
 SYSCALL_SPU(memfd_create)
 SYSCALL_SPU(bpf)
+COMPAT_SYS(execveat)
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index e0da021caa00..36b79c31eedd 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
-#define __NR_syscalls           362
+#define __NR_syscalls           363
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index f55351f2e66e..ef5b5b1f3123 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -384,5 +384,6 @@
 #define __NR_getrandom          359
 #define __NR_memfd_create       360
 #define __NR_bpf                361
+#define __NR_execveat           362
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index 879b3aacac32..f96d1ec24189 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -330,7 +330,7 @@ void default_machine_kexec(struct kimage *image)
        * using debugger IPI.
        */
-        if (crashing_cpu == -1)
+        if (!kdump_in_progress())
                kexec_prepare_cpus();
        pr_debug("kexec: Starting switchover sequence.\n");
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 8ec017cb4446..8b2d2dc8ef10 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -700,6 +700,7 @@ void start_secondary(void *unused)
        smp_store_cpu_info(cpu);
        set_dec(tb_ticks_per_jiffy);
        preempt_disable();
+        cpu_callin_map[cpu] = 1;
        if (smp_ops->setup_cpu)
                smp_ops->setup_cpu(cpu);
@@ -738,14 +739,6 @@ void start_secondary(void *unused)
        notify_cpu_starting(cpu);
        set_cpu_online(cpu, true);
-        /*
-         * CPU must be marked active and online before we signal back to the
-         * master, because the scheduler needs to see the cpu_online and
-         * cpu_active bits set.
-         */
-        smp_wmb();
-        cpu_callin_map[cpu] = 1;
        local_irq_enable();
        cpu_startup_entry(CPUHP_ONLINE);
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 469751d92004..b5682fd6c984 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -43,6 +43,7 @@
 #include <asm/trace.h>
 #include <asm/firmware.h>
 #include <asm/plpar_wrappers.h>
+#include <asm/kexec.h>
 #include <asm/fadump.h>
 #include "pseries.h"
@@ -267,8 +268,13 @@ static void pSeries_lpar_hptab_clear(void)
                 * out to the user, but at least this will stop us from
                 * continuing on further and creating an even more
                 * difficult to debug situation.
+                 *
+                 * There is a known problem when kdump'ing, if cpus are offline
+                 * the above call will fail. Rather than panicking again, keep
+                 * going and hope the kdump kernel is also little endian, which
+                 * it usually is.
                 */
-                if (rc)
+                if (rc && !kdump_in_progress())
                        panic("Could not enable big endian exceptions");
        }
 #endif
diff --git a/arch/um/Kconfig.common b/arch/um/Kconfig.common
index 87bc86821bc9..d195a87ca542 100644
--- a/arch/um/Kconfig.common
+++ b/arch/um/Kconfig.common
@@ -3,6 +3,7 @@ config UML
        default y
        select HAVE_ARCH_AUDITSYSCALL
        select HAVE_UID16
+        select HAVE_FUTEX_CMPXCHG if FUTEX
        select GENERIC_IRQ_SHOW
        select GENERIC_CPU_DEVICES
        select GENERIC_IO
diff --git a/arch/x86/crypto/Makefile b/arch/x86/crypto/Makefile
index fd0f848938cc..5a4a089e8b1f 100644
--- a/arch/x86/crypto/Makefile
+++ b/arch/x86/crypto/Makefile
@@ -26,7 +26,6 @@ obj-$(CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL) += ghash-clmulni-intel.o
 obj-$(CONFIG_CRYPTO_CRC32C_INTEL) += crc32c-intel.o
 obj-$(CONFIG_CRYPTO_SHA1_SSSE3) += sha1-ssse3.o
-obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
 obj-$(CONFIG_CRYPTO_CRC32_PCLMUL) += crc32-pclmul.o
 obj-$(CONFIG_CRYPTO_SHA256_SSSE3) += sha256-ssse3.o
 obj-$(CONFIG_CRYPTO_SHA512_SSSE3) += sha512-ssse3.o
@@ -46,6 +45,7 @@ endif
 ifeq ($(avx2_supported),yes)
        obj-$(CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64) += camellia-aesni-avx2.o
        obj-$(CONFIG_CRYPTO_SERPENT_AVX2_X86_64) += serpent-avx2.o
+        obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
 endif
 aes-i586-y := aes-i586-asm_32.o aes_glue.o
diff --git a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
index 2df2a0298f5a..a916c4a61165 100644
--- a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
+++ b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
@@ -208,7 +208,7 @@ ddq_add_8:
        .if (klen == KEY_128)
                .if (load_keys)
-                        vmovdqa 3*16(p_keys), xkeyA
+                        vmovdqa 3*16(p_keys), xkey4
                .endif
        .else
                vmovdqa 3*16(p_keys), xkeyA
@@ -224,7 +224,7 @@ ddq_add_8:
        add     $(16*by), p_in
        .if (klen == KEY_128)
-                vmovdqa 4*16(p_keys), xkey4
+                vmovdqa 4*16(p_keys), xkeyB
        .else
                .if (load_keys)
                        vmovdqa 4*16(p_keys), xkey4
@@ -234,7 +234,12 @@ ddq_add_8:
        .set i, 0
        .rept by
                club XDATA, i
-                vaesenc xkeyA, var_xdata, var_xdata             /* key 3 */
+                /* key 3 */
+                .if (klen == KEY_128)
+                        vaesenc xkey4, var_xdata, var_xdata
+                .else
+                        vaesenc xkeyA, var_xdata, var_xdata
+                .endif
                .set i, (i +1)
        .endr
@@ -243,13 +248,18 @@ ddq_add_8:
        .set i, 0
        .rept by
                club XDATA, i
-                vaesenc xkey4, var_xdata, var_xdata             /* key 4 */
+                /* key 4 */
+                .if (klen == KEY_128)
+                        vaesenc xkeyB, var_xdata, var_xdata
+                .else
+                        vaesenc xkey4, var_xdata, var_xdata
+                .endif
                .set i, (i +1)
        .endr
        .if (klen == KEY_128)
                .if (load_keys)
-                        vmovdqa 6*16(p_keys), xkeyB
+                        vmovdqa 6*16(p_keys), xkey8
                .endif
        .else
                vmovdqa 6*16(p_keys), xkeyB
@@ -267,12 +277,17 @@ ddq_add_8:
        .set i, 0
        .rept by
                club XDATA, i
-                vaesenc xkeyB, var_xdata, var_xdata             /* key 6 */
+                /* key 6 */
+                .if (klen == KEY_128)
+                        vaesenc xkey8, var_xdata, var_xdata
+                .else
+                        vaesenc xkeyB, var_xdata, var_xdata
+                .endif
                .set i, (i +1)
        .endr
        .if (klen == KEY_128)
-                vmovdqa 8*16(p_keys), xkey8
+                vmovdqa 8*16(p_keys), xkeyB
        .else
                .if (load_keys)
                        vmovdqa 8*16(p_keys), xkey8
@@ -288,7 +303,7 @@ ddq_add_8:
        .if (klen == KEY_128)
                .if (load_keys)
-                        vmovdqa 9*16(p_keys), xkeyA
+                        vmovdqa 9*16(p_keys), xkey12
                .endif
        .else
                vmovdqa 9*16(p_keys), xkeyA
@@ -297,7 +312,12 @@ ddq_add_8:
        .set i, 0
        .rept by
                club XDATA, i
-                vaesenc xkey8, var_xdata, var_xdata             /* key 8 */
+                /* key 8 */
+                .if (klen == KEY_128)
+                        vaesenc xkeyB, var_xdata, var_xdata
+                .else
+                        vaesenc xkey8, var_xdata, var_xdata
+                .endif
                .set i, (i +1)
        .endr
@@ -306,7 +326,12 @@ ddq_add_8:
        .set i, 0
        .rept by
                club XDATA, i
-                vaesenc xkeyA, var_xdata, var_xdata             /* key 9 */
+                /* key 9 */
+                .if (klen == KEY_128)
+                        vaesenc xkey12, var_xdata, var_xdata
+                .else
+                        vaesenc xkeyA, var_xdata, var_xdata
+                .endif
                .set i, (i +1)
        .endr
@@ -412,7 +437,6 @@ ddq_add_8:
 /* main body of aes ctr load */
 .macro do_aes_ctrmain key_len
        cmp     $16, num_bytes
        jb      .Ldo_return2\key_len
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 4433a4be8171..d1626364a28a 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -750,13 +750,13 @@ static int _acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
 }
 /* wrapper to silence section mismatch warning */
-int __ref acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
+int __ref acpi_map_cpu(acpi_handle handle, int physid, int *pcpu)
 {
        return _acpi_map_lsapic(handle, physid, pcpu);
 }
-EXPORT_SYMBOL(acpi_map_lsapic);
+EXPORT_SYMBOL(acpi_map_cpu);
-int acpi_unmap_lsapic(int cpu)
+int acpi_unmap_cpu(int cpu)
 {
 #ifdef CONFIG_ACPI_NUMA
        set_apicid_to_node(per_cpu(x86_cpu_to_apicid, cpu), NUMA_NO_NODE);
@@ -768,8 +768,7 @@ int acpi_unmap_lsapic(int cpu)
        return (0);
 }
+EXPORT_SYMBOL(acpi_unmap_cpu);
-EXPORT_SYMBOL(acpi_unmap_lsapic);
 #endif                          /* CONFIG_ACPI_HOTPLUG_CPU */
 int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base)
diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
index 531d4269e2e3..bd16d6c370ec 100644
--- a/arch/x86/um/sys_call_table_32.c
+++ b/arch/x86/um/sys_call_table_32.c
@@ -34,7 +34,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void);
 extern asmlinkage void sys_ni_syscall(void);
-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
+const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
        /*
         * Smells like a compiler bug -- it doesn't work
         * when the & below is removed.
diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c
index 20c3649d0691..5cdfa9db2217 100644
--- a/arch/x86/um/sys_call_table_64.c
+++ b/arch/x86/um/sys_call_table_64.c
@@ -47,7 +47,7 @@ typedef void (*sys_call_ptr_t)(void);
 extern void sys_ni_syscall(void);
-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
+const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
        /*
         * Smells like a compiler bug -- it doesn't work
         * when the & below is removed.
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index 1fdf5e07a1c7..1020b1b53a17 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -170,7 +170,7 @@ static int acpi_processor_hotadd_init(struct acpi_processor *pr)
        acpi_status status;
        int ret;
-        if (pr->apic_id == -1)
+        if (pr->phys_id == -1)
                return -ENODEV;
        status = acpi_evaluate_integer(pr->handle, "_STA", NULL, &sta);
@@ -180,13 +180,13 @@ static int acpi_processor_hotadd_init(struct acpi_processor *pr)
        cpu_maps_update_begin();
        cpu_hotplug_begin();
-        ret = acpi_map_lsapic(pr->handle, pr->apic_id, &pr->id);
+        ret = acpi_map_cpu(pr->handle, pr->phys_id, &pr->id);
        if (ret)
                goto out;
        ret = arch_register_cpu(pr->id);
        if (ret) {
-                acpi_unmap_lsapic(pr->id);
+                acpi_unmap_cpu(pr->id);
                goto out;
        }
@@ -215,7 +215,7 @@ static int acpi_processor_get_info(struct acpi_device *device)
        union acpi_object object = { 0 };
        struct acpi_buffer buffer = { sizeof(union acpi_object), &object };
        struct acpi_processor *pr = acpi_driver_data(device);
-        int apic_id, cpu_index, device_declaration = 0;
+        int phys_id, cpu_index, device_declaration = 0;
        acpi_status status = AE_OK;
        static int cpu0_initialized;
        unsigned long long value;
@@ -262,15 +262,18 @@ static int acpi_processor_get_info(struct acpi_device *device)
                pr->acpi_id = value;
        }
-        apic_id = acpi_get_apicid(pr->handle, device_declaration, pr->acpi_id);
+        phys_id = acpi_get_phys_id(pr->handle, device_declaration, pr->acpi_id);
-        if (apic_id < 0)
+        if (phys_id < 0)
-                acpi_handle_debug(pr->handle, "failed to get CPU APIC ID.\n");
+                acpi_handle_debug(pr->handle, "failed to get CPU physical ID.\n");
-        pr->apic_id = apic_id;
+        pr->phys_id = phys_id;
-        cpu_index = acpi_map_cpuid(pr->apic_id, pr->acpi_id);
+        cpu_index = acpi_map_cpuid(pr->phys_id, pr->acpi_id);
        if (!cpu0_initialized && !acpi_has_cpu_in_madt()) {
                cpu0_initialized = 1;
-                /* Handle UP system running SMP kernel, with no LAPIC in MADT */
+                /*
+                 * Handle UP system running SMP kernel, with no CPU
+                 * entry in MADT
+                 */
                if ((cpu_index == -1) && (num_online_cpus() == 1))
                        cpu_index = 0;
        }
@@ -458,7 +461,7 @@ static void acpi_processor_remove(struct acpi_device *device)
        /* Remove the CPU. */
        arch_unregister_cpu(pr->id);
-        acpi_unmap_lsapic(pr->id);
+        acpi_unmap_cpu(pr->id);
        cpu_hotplug_done();
        cpu_maps_update_done();
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index c2daa85fc9f7..c0d44d394ca3 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -257,7 +257,7 @@ int acpi_bus_init_power(struct acpi_device *device)
        device->power.state = ACPI_STATE_UNKNOWN;
        if (!acpi_device_is_present(device))
-                return 0;
+                return -ENXIO;
        result = acpi_device_get_power(device, &state);
        if (result)
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 342942f90a10..02e48394276c 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -69,7 +69,7 @@ static int map_madt_entry(int type, u32 acpi_id)
        unsigned long madt_end, entry;
        static struct acpi_table_madt *madt;
        static int read_madt;
-        int apic_id = -1;
+        int phys_id = -1;       /* CPU hardware ID */
        if (!read_madt) {
                if (ACPI_FAILURE(acpi_get_table(ACPI_SIG_MADT, 0,
@@ -79,7 +79,7 @@ static int map_madt_entry(int type, u32 acpi_id)
        }
        if (!madt)
-                return apic_id;
+                return phys_id;
        entry = (unsigned long)madt;
        madt_end = entry + madt->header.length;
@@ -91,18 +91,18 @@ static int map_madt_entry(int type, u32 acpi_id)
                struct acpi_subtable_header *header =
                        (struct acpi_subtable_header *)entry;
                if (header->type == ACPI_MADT_TYPE_LOCAL_APIC) {
-                        if (!map_lapic_id(header, acpi_id, &apic_id))
+                        if (!map_lapic_id(header, acpi_id, &phys_id))
                                break;
                } else if (header->type == ACPI_MADT_TYPE_LOCAL_X2APIC) {
-                        if (!map_x2apic_id(header, type, acpi_id, &apic_id))
+                        if (!map_x2apic_id(header, type, acpi_id, &phys_id))
                                break;
                } else if (header->type == ACPI_MADT_TYPE_LOCAL_SAPIC) {
-                        if (!map_lsapic_id(header, type, acpi_id, &apic_id))
+                        if (!map_lsapic_id(header, type, acpi_id, &phys_id))
                                break;
                }
                entry += header->length;
        }
-        return apic_id;
+        return phys_id;
 }
 static int map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
@@ -110,7 +110,7 @@ static int map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
        union acpi_object *obj;
        struct acpi_subtable_header *header;
-        int apic_id = -1;
+        int phys_id = -1;
        if (ACPI_FAILURE(acpi_evaluate_object(handle, "_MAT", NULL, &buffer)))
                goto exit;
@@ -126,38 +126,38 @@ static int map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
        header = (struct acpi_subtable_header *)obj->buffer.pointer;
        if (header->type == ACPI_MADT_TYPE_LOCAL_APIC)
-                map_lapic_id(header, acpi_id, &apic_id);
+                map_lapic_id(header, acpi_id, &phys_id);
        else if (header->type == ACPI_MADT_TYPE_LOCAL_SAPIC)
-                map_lsapic_id(header, type, acpi_id, &apic_id);
+                map_lsapic_id(header, type, acpi_id, &phys_id);
        else if (header->type == ACPI_MADT_TYPE_LOCAL_X2APIC)
-                map_x2apic_id(header, type, acpi_id, &apic_id);
+                map_x2apic_id(header, type, acpi_id, &phys_id);
 exit:
        kfree(buffer.pointer);
-        return apic_id;
+        return phys_id;
 }
-int acpi_get_apicid(acpi_handle handle, int type, u32 acpi_id)
+int acpi_get_phys_id(acpi_handle handle, int type, u32 acpi_id)
 {
-        int apic_id;
+        int phys_id;
-        apic_id = map_mat_entry(handle, type, acpi_id);
+        phys_id = map_mat_entry(handle, type, acpi_id);
-        if (apic_id == -1)
+        if (phys_id == -1)
-                apic_id = map_madt_entry(type, acpi_id);
+                phys_id = map_madt_entry(type, acpi_id);
-        return apic_id;
+        return phys_id;
 }
-int acpi_map_cpuid(int apic_id, u32 acpi_id)
+int acpi_map_cpuid(int phys_id, u32 acpi_id)
 {
 #ifdef CONFIG_SMP
        int i;
 #endif
-        if (apic_id == -1) {
+        if (phys_id == -1) {
                /*
                 * On UP processor, there is no _MAT or MADT table.
-                 * So above apic_id is always set to -1.
+                 * So above phys_id is always set to -1.
                 *
                 * BIOS may define multiple CPU handles even for UP processor.
                 * For example,
@@ -170,7 +170,7 @@ int acpi_map_cpuid(int apic_id, u32 acpi_id)
                 *     Processor (CPU3, 0x03, 0x00000410, 0x06) {}
                 * }
                 *
-                 * Ignores apic_id and always returns 0 for the processor
+                 * Ignores phys_id and always returns 0 for the processor
                 * handle with acpi id 0 if nr_cpu_ids is 1.
                 * This should be the case if SMP tables are not found.
                 * Return -1 for other CPU's handle.
@@ -178,28 +178,28 @@ int acpi_map_cpuid(int apic_id, u32 acpi_id)
                if (nr_cpu_ids <= 1 && acpi_id == 0)
                        return acpi_id;
                else
-                        return apic_id;
+                        return phys_id;
        }
 #ifdef CONFIG_SMP
        for_each_possible_cpu(i) {
-                if (cpu_physical_id(i) == apic_id)
+                if (cpu_physical_id(i) == phys_id)
                        return i;
        }
 #else
        /* In UP kernel, only processor 0 is valid */
-        if (apic_id == 0)
+        if (phys_id == 0)
-                return apic_id;
+                return phys_id;
 #endif
        return -1;
 }
 int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
 {
-        int apic_id;
+        int phys_id;
-        apic_id = acpi_get_apicid(handle, type, acpi_id);
+        phys_id = acpi_get_phys_id(handle, type, acpi_id);
-        return acpi_map_cpuid(apic_id, acpi_id);
+        return acpi_map_cpuid(phys_id, acpi_id);
 }
 EXPORT_SYMBOL_GPL(acpi_get_cpuid);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 16914cc30882..dc4d8960684a 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1001,7 +1001,7 @@ static void acpi_free_power_resources_lists(struct acpi_device *device)
        if (device->wakeup.flags.valid)
                acpi_power_resources_list_free(&device->wakeup.resources);
-        if (!device->flags.power_manageable)
+        if (!device->power.flags.power_resources)
                return;
        for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3_HOT; i++) {
@@ -1744,10 +1744,8 @@ static void acpi_bus_get_power_flags(struct acpi_device *device)
                        device->power.flags.power_resources)
                device->power.states[ACPI_STATE_D3_COLD].flags.os_accessible = 1;
-        if (acpi_bus_init_power(device)) {
+        if (acpi_bus_init_power(device))
-                acpi_free_power_resources_lists(device);
                device->flags.power_manageable = 0;
-        }
 }
 static void acpi_bus_get_flags(struct acpi_device *device)
@@ -2371,13 +2369,18 @@ static void acpi_bus_attach(struct acpi_device *device)
        /* Skip devices that are not present. */
        if (!acpi_device_is_present(device)) {
                device->flags.visited = false;
+                device->flags.power_manageable = 0;
                return;
        }
        if (device->handler)
                goto ok;
        if (!device->flags.initialized) {
-                acpi_bus_update_power(device, NULL);
+                device->flags.power_manageable =
+                        device->power.states[ACPI_STATE_D0].flags.valid;
+                if (acpi_bus_init_power(device))
+                        device->flags.power_manageable = 0;
                device->flags.initialized = true;
        }
        device->flags.visited = false;
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index c72e79d2c5ad..032db459370f 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -522,6 +522,16 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                DMI_MATCH(DMI_PRODUCT_NAME, "370R4E/370R4V/370R5E/3570RE/370R5V"),
                },
        },
+        {
+         /* https://bugzilla.redhat.com/show_bug.cgi?id=1163574 */
+         .callback = video_disable_native_backlight,
+         .ident = "Dell XPS15 L521X",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "XPS L521X"),
+                },
+        },
        {}
 };
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index fd5a5e85d7dc..982b96323f82 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -969,7 +969,8 @@ static void sender(void                *send_info,
                do_gettimeofday(&t);
                pr_info("**Enqueue %02x %02x: %ld.%6.6ld\n",
-                       msg->data[0], msg->data[1], t.tv_sec, t.tv_usec);
+                       msg->data[0], msg->data[1],
+                       (long) t.tv_sec, (long) t.tv_usec);
        }
 }
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 1232336b960e..40dfbc0444c0 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4029,14 +4029,6 @@ static int device_notifier(struct notifier_block *nb,
        if (action != BUS_NOTIFY_REMOVED_DEVICE)
                return 0;
-        /*
-         * If the device is still attached to a device driver we can't
-         * tear down the domain yet as DMA mappings may still be in use.
-         * Wait for the BUS_NOTIFY_UNBOUND_DRIVER event to do that.
-         */
-        if (action == BUS_NOTIFY_DEL_DEVICE && dev->driver != NULL)
-                return 0;
        domain = find_domain(dev);
        if (!domain)
                return 0;
@@ -4428,6 +4420,10 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
                                domain_remove_one_dev_info(old_domain, dev);
                        else
                                domain_remove_dev_info(old_domain);
+                        if (!domain_type_is_vm_or_si(old_domain) &&
+                             list_empty(&old_domain->devices))
+                                domain_exit(old_domain);
                }
        }
diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
index 68dfb0fd5ee9..748693192c20 100644
--- a/drivers/iommu/ipmmu-vmsa.c
+++ b/drivers/iommu/ipmmu-vmsa.c
@@ -558,7 +558,7 @@ static pmd_t *ipmmu_alloc_pmd(struct ipmmu_vmsa_device *mmu, pgd_t *pgd,
 static u64 ipmmu_page_prot(unsigned int prot, u64 type)
 {
-        u64 pgprot = ARM_VMSA_PTE_XN | ARM_VMSA_PTE_nG | ARM_VMSA_PTE_AF
+        u64 pgprot = ARM_VMSA_PTE_nG | ARM_VMSA_PTE_AF
                   | ARM_VMSA_PTE_SH_IS | ARM_VMSA_PTE_AP_UNPRIV
                   | ARM_VMSA_PTE_NS | type;
@@ -568,8 +568,8 @@ static u64 ipmmu_page_prot(unsigned int prot, u64 type)
        if (prot & IOMMU_CACHE)
                pgprot |= IMMAIR_ATTR_IDX_WBRWA << ARM_VMSA_PTE_ATTRINDX_SHIFT;
-        if (prot & IOMMU_EXEC)
+        if (prot & IOMMU_NOEXEC)
-                pgprot &= ~ARM_VMSA_PTE_XN;
+                pgprot |= ARM_VMSA_PTE_XN;
        else if (!(prot & (IOMMU_READ | IOMMU_WRITE)))
                /* If no access create a faulting entry to avoid TLB fills. */
                pgprot &= ~ARM_VMSA_PTE_PAGE;
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index b2023af384b9..6a8b1ec4a48a 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1009,7 +1009,6 @@ static struct platform_driver rk_iommu_driver = {
        .remove = rk_iommu_remove,
        .driver = {
                   .name = "rk_iommu",
-                   .owner = THIS_MODULE,
                   .of_match_table = of_match_ptr(rk_iommu_dt_ids),
        },
 };
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 1fcd5568a352..f3470d96837a 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -850,8 +850,10 @@ static int emac_probe(struct platform_device *pdev)
        }
        db->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(db->clk))
+        if (IS_ERR(db->clk)) {
+                ret = PTR_ERR(db->clk);
                goto out;
+        }
        clk_prepare_enable(db->clk);
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index 3498760dc22a..760c72c6e2ac 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -1170,10 +1170,6 @@ tx_request_irq_error:
 init_error:
        free_skbufs(dev);
 alloc_skbuf_error:
-        if (priv->phydev) {
-                phy_disconnect(priv->phydev);
-                priv->phydev = NULL;
-        }
 phy_error:
        return ret;
 }
@@ -1186,12 +1182,9 @@ static int tse_shutdown(struct net_device *dev)
        int ret;
        unsigned long int flags;
-        /* Stop and disconnect the PHY */
+        /* Stop the PHY */
-        if (priv->phydev) {
+        if (priv->phydev)
                phy_stop(priv->phydev);
-                phy_disconnect(priv->phydev);
-                priv->phydev = NULL;
-        }
        netif_stop_queue(dev);
        napi_disable(&priv->napi);
@@ -1525,6 +1518,10 @@ err_free_netdev:
 static int altera_tse_remove(struct platform_device *pdev)
 {
        struct net_device *ndev = platform_get_drvdata(pdev);
+        struct altera_tse_private *priv = netdev_priv(ndev);
+        if (priv->phydev)
+                phy_disconnect(priv->phydev);
        platform_set_drvdata(pdev, NULL);
        altera_tse_mdio_destroy(ndev);
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 705f334ebb85..b29e027c476e 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1616,7 +1616,7 @@ static int enic_open(struct net_device *netdev)
                if (vnic_rq_desc_used(&enic->rq[i]) == 0) {
                        netdev_err(netdev, "Unable to alloc receive buffers\n");
                        err = -ENOMEM;
-                        goto err_out_notify_unset;
+                        goto err_out_free_rq;
                }
        }
@@ -1649,7 +1649,9 @@ static int enic_open(struct net_device *netdev)
        return 0;
-err_out_notify_unset:
+err_out_free_rq:
+        for (i = 0; i < enic->rq_count; i++)
+                vnic_rq_clean(&enic->rq[i], enic_free_rq_buf);
        enic_dev_notify_unset(enic);
 err_out_free_intr:
        enic_free_intr(enic);
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index 781065eb5431..e9c3a87e5b11 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -1543,7 +1543,7 @@ static int e100_phy_init(struct nic *nic)
                mdio_write(netdev, nic->mii.phy_id, MII_BMCR, bmcr);
        } else if ((nic->mac >= mac_82550_D102) || ((nic->flags & ich) &&
           (mdio_read(netdev, nic->mii.phy_id, MII_TPISTATUS) & 0x8000) &&
-                !(nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) {
+                (nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) {
                /* enable/disable MDI/MDI-X auto-switching. */
                mdio_write(netdev, nic->mii.phy_id, MII_NCONFIG,
                                nic->mii.force_media ? 0 : NCONFIG_AUTO_SWITCH);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
index 433a55886ad2..cb0de455683e 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
@@ -829,7 +829,7 @@ static void i40e_dbg_dump_desc(int cnt, int vsi_seid, int ring_id, int desc_n,
                if (desc_n >= ring->count || desc_n < 0) {
                        dev_info(&pf->pdev->dev,
                                 "descriptor %d not found\n", desc_n);
-                        return;
+                        goto out;
                }
                if (!is_rx_ring) {
                        txd = I40E_TX_DESC(ring, desc_n);
@@ -855,6 +855,8 @@ static void i40e_dbg_dump_desc(int cnt, int vsi_seid, int ring_id, int desc_n,
        } else {
                dev_info(&pf->pdev->dev, "dump desc rx/tx <vsi_seid> <ring_id> [<desc_n>]\n");
        }
+out:
        kfree(ring);
 }
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index 051ea94bdcd3..0f69ef81751a 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -1125,7 +1125,7 @@ static s32 igb_acquire_swfw_sync_82575(struct e1000_hw *hw, u16 mask)
        u32 swmask = mask;
        u32 fwmask = mask << 16;
        s32 ret_val = 0;
-        s32 i = 0, timeout = 200; /* FIXME: find real value to use here */
+        s32 i = 0, timeout = 200;
        while (i < timeout) {
                if (igb_get_hw_semaphore(hw)) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 943cbd47d832..03e9eb0dc761 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1829,7 +1829,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                err = mlx4_dev_cap(dev, &dev_cap);
                if (err) {
                        mlx4_err(dev, "QUERY_DEV_CAP command failed, aborting\n");
-                        goto err_stop_fw;
+                        return err;
                }
                choose_steering_mode(dev, &dev_cap);
@@ -1860,7 +1860,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                                             &init_hca);
                if ((long long) icm_size < 0) {
                        err = icm_size;
-                        goto err_stop_fw;
+                        return err;
                }
                dev->caps.max_fmr_maps = (1 << (32 - ilog2(dev->caps.num_mpts))) - 1;
@@ -1874,7 +1874,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                err = mlx4_init_icm(dev, &dev_cap, &init_hca, icm_size);
                if (err)
-                        goto err_stop_fw;
+                        return err;
                err = mlx4_INIT_HCA(dev, &init_hca);
                if (err) {
@@ -1886,7 +1886,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                        err = mlx4_query_func(dev, &dev_cap);
                        if (err < 0) {
                                mlx4_err(dev, "QUERY_FUNC command failed, aborting.\n");
-                                goto err_stop_fw;
+                                goto err_close;
                        } else if (err & MLX4_QUERY_FUNC_NUM_SYS_EQS) {
                                dev->caps.num_eqs = dev_cap.max_eqs;
                                dev->caps.reserved_eqs = dev_cap.reserved_eqs;
@@ -2006,11 +2006,6 @@ err_free_icm:
        if (!mlx4_is_slave(dev))
                mlx4_free_icms(dev);
-err_stop_fw:
-        if (!mlx4_is_slave(dev)) {
-                mlx4_UNMAP_FA(dev);
-                mlx4_free_icm(dev, priv->fw.fw_icm, 0);
-        }
        return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index d6f549685c0f..7094a9c70fd5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -584,6 +584,7 @@ EXPORT_SYMBOL_GPL(mlx4_mr_free);
 void mlx4_mr_rereg_mem_cleanup(struct mlx4_dev *dev, struct mlx4_mr *mr)
 {
        mlx4_mtt_cleanup(dev, &mr->mtt);
+        mr->mtt.order = -1;
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_rereg_mem_cleanup);
@@ -593,14 +594,14 @@ int mlx4_mr_rereg_mem_write(struct mlx4_dev *dev, struct mlx4_mr *mr,
 {
        int err;
-        mpt_entry->start       = cpu_to_be64(iova);
-        mpt_entry->length      = cpu_to_be64(size);
-        mpt_entry->entity_size = cpu_to_be32(page_shift);
        err = mlx4_mtt_init(dev, npages, page_shift, &mr->mtt);
        if (err)
                return err;
+        mpt_entry->start       = cpu_to_be64(mr->iova);
+        mpt_entry->length      = cpu_to_be64(mr->size);
+        mpt_entry->entity_size = cpu_to_be32(mr->mtt.page_shift);
        mpt_entry->pd_flags &= cpu_to_be32(MLX4_MPT_PD_MASK |
                                           MLX4_MPT_PD_FLAG_EN_INV);
        mpt_entry->flags    &= cpu_to_be32(MLX4_MPT_FLAG_FREE |
diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
index af099057f0e9..71af98bb72cb 100644
--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
@@ -4033,8 +4033,10 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        (void)pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
        mgp->cmd = dma_alloc_coherent(&pdev->dev, sizeof(*mgp->cmd),
                                      &mgp->cmd_bus, GFP_KERNEL);
-        if (mgp->cmd == NULL)
+        if (!mgp->cmd) {
+                status = -ENOMEM;
                goto abort_with_enabled;
+        }
        mgp->board_span = pci_resource_len(pdev, 0);
        mgp->iomem_base = pci_resource_start(pdev, 0);
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index c2f09af5c25b..4847713211ca 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -146,10 +146,7 @@ static int ql_wait_for_drvr_lock(struct ql3_adapter *qdev)
 {
        int i = 0;
-        while (i < 10) {
+        do {
-                if (i)
-                        ssleep(1);
                if (ql_sem_lock(qdev,
                                QL_DRVR_SEM_MASK,
                                (QL_RESOURCE_BITS_BASE_CODE | (qdev->mac_index)
@@ -158,7 +155,8 @@ static int ql_wait_for_drvr_lock(struct ql3_adapter *qdev)
                                      "driver lock acquired\n");
                        return 1;
                }
-        }
+                ssleep(1);
+        } while (++i < 10);
        netdev_err(qdev->ndev, "Timed out waiting for driver lock...\n");
        return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 9929b97cfb36..2528c3fb6b90 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -2605,6 +2605,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        } else {
                dev_err(&pdev->dev,
                        "%s: failed. Please Reboot\n", __func__);
+                err = -ENODEV;
                goto err_out_free_hw;
        }
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index c560f9aeb55d..e61ee8351272 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -757,6 +757,14 @@ requeue:
 static irqreturn_t cpsw_interrupt(int irq, void *dev_id)
 {
        struct cpsw_priv *priv = dev_id;
+        int value = irq - priv->irqs_table[0];
+        /* NOTICE: Ending IRQ here. The trick with the 'value' variable above
+         * is to make sure we will always write the correct value to the EOI
+         * register. Namely 0 for RX_THRESH Interrupt, 1 for RX Interrupt, 2
+         * for TX Interrupt and 3 for MISC Interrupt.
+         */
+        cpdma_ctlr_eoi(priv->dma, value);
        cpsw_intr_disable(priv);
        if (priv->irq_enabled == true) {
@@ -786,8 +794,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
        int                     num_tx, num_rx;
        num_tx = cpdma_chan_process(priv->txch, 128);
-        if (num_tx)
-                cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
        num_rx = cpdma_chan_process(priv->rxch, budget);
        if (num_rx < budget) {
@@ -795,7 +801,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
                napi_complete(napi);
                cpsw_intr_enable(priv);
-                cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
                prim_cpsw = cpsw_get_slave_priv(priv, 0);
                if (prim_cpsw->irq_enabled == false) {
                        prim_cpsw->irq_enabled = true;
@@ -1310,8 +1315,6 @@ static int cpsw_ndo_open(struct net_device *ndev)
        napi_enable(&priv->napi);
        cpdma_ctlr_start(priv->dma);
        cpsw_intr_enable(priv);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
        prim_cpsw = cpsw_get_slave_priv(priv, 0);
        if (prim_cpsw->irq_enabled == false) {
@@ -1578,9 +1581,6 @@ static void cpsw_ndo_tx_timeout(struct net_device *ndev)
        cpdma_chan_start(priv->txch);
        cpdma_ctlr_int_ctrl(priv->dma, true);
        cpsw_intr_enable(priv);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
 }
 static int cpsw_ndo_set_mac_address(struct net_device *ndev, void *p)
@@ -1620,9 +1620,6 @@ static void cpsw_ndo_poll_controller(struct net_device *ndev)
        cpsw_interrupt(ndev->irq, priv);
        cpdma_ctlr_int_ctrl(priv->dma, true);
        cpsw_intr_enable(priv);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
 }
 #endif
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 9c2d91ea0af4..dbcbf0c5bcfa 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -1043,6 +1043,7 @@ static int temac_of_probe(struct platform_device *op)
        lp->regs = of_iomap(op->dev.of_node, 0);
        if (!lp->regs) {
                dev_err(&op->dev, "could not map temac regs.\n");
+                rc = -ENOMEM;
                goto nodev;
        }
@@ -1062,6 +1063,7 @@ static int temac_of_probe(struct platform_device *op)
        np = of_parse_phandle(op->dev.of_node, "llink-connected", 0);
        if (!np) {
                dev_err(&op->dev, "could not find DMA node\n");
+                rc = -ENODEV;
                goto err_iounmap;
        }
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index c18a0c637c44..a6d2860b712c 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1501,6 +1501,7 @@ static int axienet_of_probe(struct platform_device *op)
        lp->regs = of_iomap(op->dev.of_node, 0);
        if (!lp->regs) {
                dev_err(&op->dev, "could not map Axi Ethernet regs.\n");
+                ret = -ENOMEM;
                goto nodev;
        }
        /* Setup checksum offload, but default to off if not specified */
@@ -1563,6 +1564,7 @@ static int axienet_of_probe(struct platform_device *op)
        np = of_parse_phandle(op->dev.of_node, "axistream-connected", 0);
        if (!np) {
                dev_err(&op->dev, "could not find DMA node\n");
+                ret = -ENODEV;
                goto err_iounmap;
        }
        lp->dma_regs = of_iomap(np, 0);
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 24858799c204..9d4ce388510a 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -1109,6 +1109,7 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
        res = platform_get_resource(ofdev, IORESOURCE_IRQ, 0);
        if (!res) {
                dev_err(dev, "no IRQ found\n");
+                rc = -ENXIO;
                goto error;
        }
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index b8a82b86f909..602dc6668c3a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -56,6 +56,8 @@ struct qmi_wwan_state {
 /* default ethernet address used by the modem */
 static const u8 default_modem_addr[ETH_ALEN] = {0x02, 0x50, 0xf3};
+static const u8 buggy_fw_addr[ETH_ALEN] = {0x00, 0xa0, 0xc6, 0x00, 0x00, 0x00};
 /* Make up an ethernet header if the packet doesn't have one.
 *
 * A firmware bug common among several devices cause them to send raw
@@ -332,10 +334,12 @@ next_desc:
                usb_driver_release_interface(driver, info->data);
        }
-        /* Never use the same address on both ends of the link, even
+        /* Never use the same address on both ends of the link, even if the
-         * if the buggy firmware told us to.
+         * buggy firmware told us to. Or, if device is assigned the well-known
+         * buggy firmware MAC address, replace it with a random address,
         */
-        if (ether_addr_equal(dev->net->dev_addr, default_modem_addr))
+        if (ether_addr_equal(dev->net->dev_addr, default_modem_addr) ||
+            ether_addr_equal(dev->net->dev_addr, buggy_fw_addr))
                eth_hw_addr_random(dev->net);
        /* make MAC addr easily distinguishable from an IP header */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 2d1c77e81836..57ec23e8ccfa 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1897,6 +1897,22 @@ static void _rtl8152_set_rx_mode(struct net_device *netdev)
        netif_wake_queue(netdev);
 }
+static netdev_features_t
+rtl8152_features_check(struct sk_buff *skb, struct net_device *dev,
+                       netdev_features_t features)
+{
+        u32 mss = skb_shinfo(skb)->gso_size;
+        int max_offset = mss ? GTTCPHO_MAX : TCPHO_MAX;
+        int offset = skb_transport_offset(skb);
+        if ((mss || skb->ip_summed == CHECKSUM_PARTIAL) && offset > max_offset)
+                features &= ~(NETIF_F_ALL_CSUM | NETIF_F_GSO_MASK);
+        else if ((skb->len + sizeof(struct tx_desc)) > agg_buf_sz)
+                features &= ~NETIF_F_GSO_MASK;
+        return features;
+}
 static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb,
                                      struct net_device *netdev)
 {
@@ -3706,6 +3722,7 @@ static const struct net_device_ops rtl8152_netdev_ops = {
        .ndo_set_mac_address    = rtl8152_set_mac_address,
        .ndo_change_mtu         = rtl8152_change_mtu,
        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_features_check     = rtl8152_features_check,
 };
 static void r8152b_get_version(struct r8152 *tp)
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index efbaf2ae1999..794204e34fba 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -737,6 +737,7 @@ static void connect(struct backend_info *be)
                }
                queue->remaining_credit = credit_bytes;
+                queue->credit_usec = credit_usec;
                err = connect_rings(be, queue);
                if (err) {
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index ba74f0aa60c7..3c22dbebc80f 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -89,6 +89,7 @@ struct rockchip_iomux {
 * @reg_pull: optional separate register for additional pull settings
 * @clk: clock of the gpio bank
 * @irq: interrupt of the gpio bank
+ * @saved_enables: Saved content of GPIO_INTEN at suspend time.
 * @pin_base: first pin number
 * @nr_pins: number of pins in this bank
 * @name: name of the bank
@@ -107,6 +108,7 @@ struct rockchip_pin_bank {
        struct regmap                   *regmap_pull;
        struct clk                      *clk;
        int                             irq;
+        u32                             saved_enables;
        u32                             pin_base;
        u8                              nr_pins;
        char                            *name;
@@ -1543,6 +1545,51 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type)
        return 0;
 }
+static void rockchip_irq_suspend(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        struct rockchip_pin_bank *bank = gc->private;
+        bank->saved_enables = irq_reg_readl(gc, GPIO_INTEN);
+        irq_reg_writel(gc, gc->wake_active, GPIO_INTEN);
+}
+static void rockchip_irq_resume(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        struct rockchip_pin_bank *bank = gc->private;
+        irq_reg_writel(gc, bank->saved_enables, GPIO_INTEN);
+}
+static void rockchip_irq_disable(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        u32 val;
+        irq_gc_lock(gc);
+        val = irq_reg_readl(gc, GPIO_INTEN);
+        val &= ~d->mask;
+        irq_reg_writel(gc, val, GPIO_INTEN);
+        irq_gc_unlock(gc);
+}
+static void rockchip_irq_enable(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        u32 val;
+        irq_gc_lock(gc);
+        val = irq_reg_readl(gc, GPIO_INTEN);
+        val |= d->mask;
+        irq_reg_writel(gc, val, GPIO_INTEN);
+        irq_gc_unlock(gc);
+}
 static int rockchip_interrupts_register(struct platform_device *pdev,
                                                struct rockchip_pinctrl *info)
 {
@@ -1581,12 +1628,16 @@ static int rockchip_interrupts_register(struct platform_device *pdev,
                gc = irq_get_domain_generic_chip(bank->domain, 0);
                gc->reg_base = bank->reg_base;
                gc->private = bank;
-                gc->chip_types[0].regs.mask = GPIO_INTEN;
+                gc->chip_types[0].regs.mask = GPIO_INTMASK;
                gc->chip_types[0].regs.ack = GPIO_PORTS_EOI;
                gc->chip_types[0].chip.irq_ack = irq_gc_ack_set_bit;
-                gc->chip_types[0].chip.irq_mask = irq_gc_mask_clr_bit;
+                gc->chip_types[0].chip.irq_mask = irq_gc_mask_set_bit;
-                gc->chip_types[0].chip.irq_unmask = irq_gc_mask_set_bit;
+                gc->chip_types[0].chip.irq_unmask = irq_gc_mask_clr_bit;
+                gc->chip_types[0].chip.irq_enable = rockchip_irq_enable;
+                gc->chip_types[0].chip.irq_disable = rockchip_irq_disable;
                gc->chip_types[0].chip.irq_set_wake = irq_gc_set_wake;
+                gc->chip_types[0].chip.irq_suspend = rockchip_irq_suspend;
+                gc->chip_types[0].chip.irq_resume = rockchip_irq_resume;
                gc->chip_types[0].chip.irq_set_type = rockchip_irq_set_type;
                gc->wake_enabled = IRQ_MSK(bank->nr_pins);
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index 7c9d51382248..9e5ec00084bb 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -1012,8 +1012,10 @@ static void st_pinconf_dbg_show(struct pinctrl_dev *pctldev,
                                   struct seq_file *s, unsigned pin_id)
 {
        unsigned long config;
-        st_pinconf_get(pctldev, pin_id, &config);
+        mutex_unlock(&pctldev->mutex);
+        st_pinconf_get(pctldev, pin_id, &config);
+        mutex_lock(&pctldev->mutex);
        seq_printf(s, "[OE:%ld,PU:%ld,OD:%ld]\n"
                "\t\t[retime:%ld,invclk:%ld,clknotdat:%ld,"
                "de:%ld,rt-clk:%ld,rt-delay:%ld]",
@@ -1443,6 +1445,7 @@ static struct gpio_chip st_gpio_template = {
 static struct irq_chip st_gpio_irqchip = {
        .name           = "GPIO",
+        .irq_disable    = st_gpio_irq_mask,
        .irq_mask       = st_gpio_irq_mask,
        .irq_unmask     = st_gpio_irq_unmask,
        .irq_set_type   = st_gpio_irq_set_type,
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 14419a8ccbb6..d415d69dc237 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -538,7 +538,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
                ++headcount;
                seg += in;
        }
-        heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen);
+        heads[headcount - 1].len = cpu_to_vhost32(vq, len + datalen);
        *iovcount = seg;
        if (unlikely(log))
                *log_num = nlogs;
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 2ef9529809d8..9756f21b809e 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -282,6 +282,7 @@ void vp_del_vqs(struct virtio_device *vdev)
        vp_free_vectors(vdev);
        kfree(vp_dev->vqs);
+        vp_dev->vqs = NULL;
 }
 static int vp_try_to_find_vqs(struct virtio_device *vdev, unsigned nvqs,
@@ -421,15 +422,6 @@ int vp_set_vq_affinity(struct virtqueue *vq, int cpu)
        return 0;
 }
-void virtio_pci_release_dev(struct device *_d)
-{
-        /*
-         * No need for a release method as we allocate/free
-         * all devices together with the pci devices.
-         * Provide an empty one to avoid getting a warning from core.
-         */
-}
 #ifdef CONFIG_PM_SLEEP
 static int virtio_pci_freeze(struct device *dev)
 {
diff --git a/drivers/virtio/virtio_pci_common.h b/drivers/virtio/virtio_pci_common.h
index adddb647b21d..5a497289b7e9 100644
--- a/drivers/virtio/virtio_pci_common.h
+++ b/drivers/virtio/virtio_pci_common.h
@@ -126,7 +126,6 @@ const char *vp_bus_name(struct virtio_device *vdev);
 * - ignore the affinity request if we're using INTX
 */
 int vp_set_vq_affinity(struct virtqueue *vq, int cpu);
-void virtio_pci_release_dev(struct device *);
 int virtio_pci_legacy_probe(struct pci_dev *pci_dev,
                            const struct pci_device_id *id);
diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
index 6c76f0f5658c..a5486e65e04b 100644
--- a/drivers/virtio/virtio_pci_legacy.c
+++ b/drivers/virtio/virtio_pci_legacy.c
@@ -211,6 +211,17 @@ static const struct virtio_config_ops virtio_pci_config_ops = {
        .set_vq_affinity = vp_set_vq_affinity,
 };
+static void virtio_pci_release_dev(struct device *_d)
+{
+        struct virtio_device *vdev = dev_to_virtio(_d);
+        struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+        /* As struct device is a kobject, it's not safe to
+         * free the memory (including the reference counter itself)
+         * until it's release callback. */
+        kfree(vp_dev);
+}
 /* the PCI probing function */
 int virtio_pci_legacy_probe(struct pci_dev *pci_dev,
                            const struct pci_device_id *id)
@@ -302,5 +313,4 @@ void virtio_pci_legacy_remove(struct pci_dev *pci_dev)
        pci_iounmap(pci_dev, vp_dev->ioaddr);
        pci_release_regions(pci_dev);
        pci_disable_device(pci_dev);
-        kfree(vp_dev);
 }
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 2d3e32ebfd15..8729cf68d2fe 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1552,7 +1552,6 @@ int tree_backref_for_extent(unsigned long *ptr, struct extent_buffer *eb,
 {
        int ret;
        int type;
-        struct btrfs_tree_block_info *info;
        struct btrfs_extent_inline_ref *eiref;
        if (*ptr == (unsigned long)-1)
@@ -1573,9 +1572,17 @@ int tree_backref_for_extent(unsigned long *ptr, struct extent_buffer *eb,
        }
        /* we can treat both ref types equally here */
-        info = (struct btrfs_tree_block_info *)(ei + 1);
        *out_root = btrfs_extent_inline_ref_offset(eb, eiref);
-        *out_level = btrfs_tree_block_level(eb, info);
+        if (key->type == BTRFS_EXTENT_ITEM_KEY) {
+                struct btrfs_tree_block_info *info;
+                info = (struct btrfs_tree_block_info *)(ei + 1);
+                *out_level = btrfs_tree_block_level(eb, info);
+        } else {
+                ASSERT(key->type == BTRFS_METADATA_ITEM_KEY);
+                *out_level = (u8)key->offset;
+        }
        if (ret == 1)
                *ptr = (unsigned long)-1;
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 054577bddaf2..de4e70fb3cbb 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -1857,6 +1857,14 @@ int btrfs_delayed_delete_inode_ref(struct inode *inode)
 {
        struct btrfs_delayed_node *delayed_node;
+        /*
+         * we don't do delayed inode updates during log recovery because it
+         * leads to enospc problems.  This means we also can't do
+         * delayed inode refs
+         */
+        if (BTRFS_I(inode)->root->fs_info->log_root_recovering)
+                return -EAGAIN;
        delayed_node = btrfs_get_or_create_delayed_node(inode);
        if (IS_ERR(delayed_node))
                return PTR_ERR(delayed_node);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index a80b97100d90..15116585e714 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3139,9 +3139,11 @@ static int write_one_cache_group(struct btrfs_trans_handle *trans,
        struct extent_buffer *leaf;
        ret = btrfs_search_slot(trans, extent_root, &cache->key, path, 0, 1);
-        if (ret < 0)
+        if (ret) {
+                if (ret > 0)
+                        ret = -ENOENT;
                goto fail;
-        BUG_ON(ret); /* Corruption */
+        }
        leaf = path->nodes[0];
        bi = btrfs_item_ptr_offset(leaf, path->slots[0]);
@@ -3149,11 +3151,9 @@ static int write_one_cache_group(struct btrfs_trans_handle *trans,
        btrfs_mark_buffer_dirty(leaf);
        btrfs_release_path(path);
 fail:
-        if (ret) {
+        if (ret)
                btrfs_abort_transaction(trans, root, ret);
-                return ret;
+        return ret;
-        }
-        return 0;
 }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index e687bb0dc73a..8bf326affb94 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6255,8 +6255,10 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
 out_fail:
        btrfs_end_transaction(trans, root);
-        if (drop_on_err)
+        if (drop_on_err) {
+                inode_dec_link_count(inode);
                iput(inode);
+        }
        btrfs_balance_delayed_items(root);
        btrfs_btree_balance_dirty(root);
        return err;
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index f2bb13a23f86..9e1569ffbf6e 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -2607,9 +2607,9 @@ static int scrub_extent_for_parity(struct scrub_parity *sparity,
                ret = scrub_pages_for_parity(sparity, logical, l, physical, dev,
                                             flags, gen, mirror_num,
                                             have_csum ? csum : NULL);
-skip:
                if (ret)
                        return ret;
+skip:
                len -= l;
                logical += l;
                physical += l;
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index f5013d92a7e6..c81c0e004588 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -1416,7 +1416,7 @@ void ceph_fill_inline_data(struct inode *inode, struct page *locked_page,
                }
        }
-        dout("fill_inline_data %p %llx.%llx len %lu locked_page %p\n",
+        dout("fill_inline_data %p %llx.%llx len %zu locked_page %p\n",
             inode, ceph_vinop(inode), len, locked_page);
        if (len > 0) {
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index e5d3eadf47b1..bed43081720f 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -5166,8 +5166,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
        /* fallback to generic here if not in extents fmt */
        if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
-                return __generic_block_fiemap(inode, fieinfo, start, len,
+                return generic_block_fiemap(inode, fieinfo, start, len,
-                                              ext4_get_block);
+                        ext4_get_block);
        if (fiemap_check_flags(fieinfo, EXT4_FIEMAP_FLAGS))
                return -EBADR;
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 513c12cf444c..8131be8c0af3 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -273,19 +273,24 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
 * we determine this extent as a data or a hole according to whether the
 * page cache has data or not.
 */
-static int ext4_find_unwritten_pgoff(struct inode *inode, int whence,
+static int ext4_find_unwritten_pgoff(struct inode *inode,
-                                     loff_t endoff, loff_t *offset)
+                                     int whence,
+                                     struct ext4_map_blocks *map,
+                                     loff_t *offset)
 {
        struct pagevec pvec;
+        unsigned int blkbits;
        pgoff_t index;
        pgoff_t end;
+        loff_t endoff;
        loff_t startoff;
        loff_t lastoff;
        int found = 0;
+        blkbits = inode->i_sb->s_blocksize_bits;
        startoff = *offset;
        lastoff = startoff;
+        endoff = (loff_t)(map->m_lblk + map->m_len) << blkbits;
        index = startoff >> PAGE_CACHE_SHIFT;
        end = endoff >> PAGE_CACHE_SHIFT;
@@ -403,144 +408,147 @@ out:
 static loff_t ext4_seek_data(struct file *file, loff_t offset, loff_t maxsize)
 {
        struct inode *inode = file->f_mapping->host;
-        struct fiemap_extent_info fie;
+        struct ext4_map_blocks map;
-        struct fiemap_extent ext[2];
+        struct extent_status es;
-        loff_t next;
+        ext4_lblk_t start, last, end;
-        int i, ret = 0;
+        loff_t dataoff, isize;
+        int blkbits;
+        int ret = 0;
        mutex_lock(&inode->i_mutex);
-        if (offset >= inode->i_size) {
+        isize = i_size_read(inode);
+        if (offset >= isize) {
                mutex_unlock(&inode->i_mutex);
                return -ENXIO;
        }
-        fie.fi_flags = 0;
-        fie.fi_extents_max = 2;
+        blkbits = inode->i_sb->s_blocksize_bits;
-        fie.fi_extents_start = (struct fiemap_extent __user *) &ext;
+        start = offset >> blkbits;
-        while (1) {
+        last = start;
-                mm_segment_t old_fs = get_fs();
+        end = isize >> blkbits;
+        dataoff = offset;
-                fie.fi_extents_mapped = 0;
-                memset(ext, 0, sizeof(*ext) * fie.fi_extents_max);
+        do {
+                map.m_lblk = last;
-                set_fs(get_ds());
+                map.m_len = end - last + 1;
-                ret = ext4_fiemap(inode, &fie, offset, maxsize - offset);
+                ret = ext4_map_blocks(NULL, inode, &map, 0);
-                set_fs(old_fs);
+                if (ret > 0 && !(map.m_flags & EXT4_MAP_UNWRITTEN)) {
-                if (ret)
+                        if (last != start)
+                                dataoff = (loff_t)last << blkbits;
                        break;
+                }
-                /* No extents found, EOF */
+                /*
-                if (!fie.fi_extents_mapped) {
+                 * If there is a delay extent at this offset,
-                        ret = -ENXIO;
+                 * it will be as a data.
+                 */
+                ext4_es_find_delayed_extent_range(inode, last, last, &es);
+                if (es.es_len != 0 && in_range(last, es.es_lblk, es.es_len)) {
+                        if (last != start)
+                                dataoff = (loff_t)last << blkbits;
                        break;
                }
-                for (i = 0; i < fie.fi_extents_mapped; i++) {
-                        next = (loff_t)(ext[i].fe_length + ext[i].fe_logical);
-                        if (offset < (loff_t)ext[i].fe_logical)
+                /*
-                                offset = (loff_t)ext[i].fe_logical;
+                 * If there is a unwritten extent at this offset,
-                        /*
+                 * it will be as a data or a hole according to page
-                         * If extent is not unwritten, then it contains valid
+                 * cache that has data or not.
-                         * data, mapped or delayed.
+                 */
-                         */
+                if (map.m_flags & EXT4_MAP_UNWRITTEN) {
-                        if (!(ext[i].fe_flags & FIEMAP_EXTENT_UNWRITTEN))
+                        int unwritten;
-                                goto out;
+                        unwritten = ext4_find_unwritten_pgoff(inode, SEEK_DATA,
+                                                              &map, &dataoff);
+                        if (unwritten)
+                                break;
+                }
-                        /*
+                last++;
-                         * If there is a unwritten extent at this offset,
+                dataoff = (loff_t)last << blkbits;
-                         * it will be as a data or a hole according to page
+        } while (last <= end);
-                         * cache that has data or not.
-                         */
-                        if (ext4_find_unwritten_pgoff(inode, SEEK_DATA,
-                                                      next, &offset))
-                                goto out;
-                        if (ext[i].fe_flags & FIEMAP_EXTENT_LAST) {
-                                ret = -ENXIO;
-                                goto out;
-                        }
-                        offset = next;
-                }
-        }
-        if (offset > inode->i_size)
-                offset = inode->i_size;
-out:
        mutex_unlock(&inode->i_mutex);
-        if (ret)
-                return ret;
-        return vfs_setpos(file, offset, maxsize);
+        if (dataoff > isize)
+                return -ENXIO;
+        return vfs_setpos(file, dataoff, maxsize);
 }
 /*
- * ext4_seek_hole() retrieves the offset for SEEK_HOLE
+ * ext4_seek_hole() retrieves the offset for SEEK_HOLE.
 */
 static loff_t ext4_seek_hole(struct file *file, loff_t offset, loff_t maxsize)
 {
        struct inode *inode = file->f_mapping->host;
-        struct fiemap_extent_info fie;
+        struct ext4_map_blocks map;
-        struct fiemap_extent ext[2];
+        struct extent_status es;
-        loff_t next;
+        ext4_lblk_t start, last, end;
-        int i, ret = 0;
+        loff_t holeoff, isize;
+        int blkbits;
+        int ret = 0;
        mutex_lock(&inode->i_mutex);
-        if (offset >= inode->i_size) {
+        isize = i_size_read(inode);
+        if (offset >= isize) {
                mutex_unlock(&inode->i_mutex);
                return -ENXIO;
        }
-        fie.fi_flags = 0;
+        blkbits = inode->i_sb->s_blocksize_bits;
-        fie.fi_extents_max = 2;
+        start = offset >> blkbits;
-        fie.fi_extents_start = (struct fiemap_extent __user *)&ext;
+        last = start;
-        while (1) {
+        end = isize >> blkbits;
-                mm_segment_t old_fs = get_fs();
+        holeoff = offset;
-                fie.fi_extents_mapped = 0;
-                memset(ext, 0, sizeof(*ext));
-                set_fs(get_ds());
+        do {
-                ret = ext4_fiemap(inode, &fie, offset, maxsize - offset);
+                map.m_lblk = last;
-                set_fs(old_fs);
+                map.m_len = end - last + 1;
-                if (ret)
+                ret = ext4_map_blocks(NULL, inode, &map, 0);
-                        break;
+                if (ret > 0 && !(map.m_flags & EXT4_MAP_UNWRITTEN)) {
+                        last += ret;
+                        holeoff = (loff_t)last << blkbits;
+                        continue;
+                }
-                /* No extents found */
+                /*
-                if (!fie.fi_extents_mapped)
+                 * If there is a delay extent at this offset,
-                        break;
+                 * we will skip this extent.
+                 */
+                ext4_es_find_delayed_extent_range(inode, last, last, &es);
+                if (es.es_len != 0 && in_range(last, es.es_lblk, es.es_len)) {
+                        last = es.es_lblk + es.es_len;
+                        holeoff = (loff_t)last << blkbits;
+                        continue;
+                }
-                for (i = 0; i < fie.fi_extents_mapped; i++) {
+                /*
-                        next = (loff_t)(ext[i].fe_logical + ext[i].fe_length);
+                 * If there is a unwritten extent at this offset,
-                        /*
+                 * it will be as a data or a hole according to page
-                         * If extent is not unwritten, then it contains valid
+                 * cache that has data or not.
-                         * data, mapped or delayed.
+                 */
-                         */
+                if (map.m_flags & EXT4_MAP_UNWRITTEN) {
-                        if (!(ext[i].fe_flags & FIEMAP_EXTENT_UNWRITTEN)) {
+                        int unwritten;
-                                if (offset < (loff_t)ext[i].fe_logical)
+                        unwritten = ext4_find_unwritten_pgoff(inode, SEEK_HOLE,
-                                        goto out;
+                                                              &map, &holeoff);
-                                offset = next;
+                        if (!unwritten) {
+                                last += ret;
+                                holeoff = (loff_t)last << blkbits;
                                continue;
                        }
-                        /*
-                         * If there is a unwritten extent at this offset,
-                         * it will be as a data or a hole according to page
-                         * cache that has data or not.
-                         */
-                        if (ext4_find_unwritten_pgoff(inode, SEEK_HOLE,
-                                                      next, &offset))
-                                goto out;
-                        offset = next;
-                        if (ext[i].fe_flags & FIEMAP_EXTENT_LAST)
-                                goto out;
                }
-        }
-        if (offset > inode->i_size)
+                /* find a hole */
-                offset = inode->i_size;
+                break;
-out:
+        } while (last <= end);
        mutex_unlock(&inode->i_mutex);
-        if (ret)
-                return ret;
-        return vfs_setpos(file, offset, maxsize);
+        if (holeoff > isize)
+                holeoff = isize;
+        return vfs_setpos(file, holeoff, maxsize);
 }
 /*
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index bf76f405a5f9..8a8ec6293b19 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -24,6 +24,18 @@ int ext4_resize_begin(struct super_block *sb)
                return -EPERM;
        /*
+         * If we are not using the primary superblock/GDT copy don't resize,
+         * because the user tools have no way of handling this.  Probably a
+         * bad time to do it anyways.
+         */
+        if (EXT4_SB(sb)->s_sbh->b_blocknr !=
+            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
+                ext4_warning(sb, "won't resize using backup superblock at %llu",
+                        (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
+                return -EPERM;
+        }
+        /*
         * We are not allowed to do online-resizing on a filesystem mounted
         * with error, because it can destroy the filesystem easily.
         */
@@ -758,18 +770,6 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
                       "EXT4-fs: ext4_add_new_gdb: adding group block %lu\n",
                       gdb_num);
-        /*
-         * If we are not using the primary superblock/GDT copy don't resize,
-         * because the user tools have no way of handling this.  Probably a
-         * bad time to do it anyways.
-         */
-        if (EXT4_SB(sb)->s_sbh->b_blocknr !=
-            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
-                ext4_warning(sb, "won't resize using backup superblock at %llu",
-                        (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
-                return -EPERM;
-        }
        gdb_bh = sb_bread(sb, gdblock);
        if (!gdb_bh)
                return -EIO;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 43c92b1685cb..74c5f53595fb 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3482,7 +3482,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
        if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
                                       EXT4_FEATURE_RO_COMPAT_METADATA_CSUM) &&
            EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_GDT_CSUM))
-                ext4_warning(sb, KERN_INFO "metadata_csum and uninit_bg are "
+                ext4_warning(sb, "metadata_csum and uninit_bg are "
                             "redundant flags; please run fsck.");
        /* Check for a known checksum algorithm */
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 99d440a4a6ba..ee85cd4e136a 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -740,14 +740,15 @@ static int __init fcntl_init(void)
         * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
         * is defined as O_NONBLOCK on some platforms and not on others.
         */
-        BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
+        BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
                O_RDONLY        | O_WRONLY      | O_RDWR        |
                O_CREAT         | O_EXCL        | O_NOCTTY      |
                O_TRUNC         | O_APPEND      | /* O_NONBLOCK | */
                __O_SYNC        | O_DSYNC       | FASYNC        |
                O_DIRECT        | O_LARGEFILE   | O_DIRECTORY   |
                O_NOFOLLOW      | O_NOATIME     | O_CLOEXEC     |
-                __FMODE_EXEC    | O_PATH        | __O_TMPFILE
+                __FMODE_EXEC    | O_PATH        | __O_TMPFILE   |
+                __FMODE_NONOTIFY
                ));
        fasync_cache = kmem_cache_create("fasync_cache",
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 3550a9c87616..c06a1ba80d73 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3897,11 +3897,11 @@ nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
                status = nfs4_setlease(dp);
                goto out;
        }
-        atomic_inc(&fp->fi_delegees);
        if (fp->fi_had_conflict) {
                status = -EAGAIN;
                goto out_unlock;
        }
+        atomic_inc(&fp->fi_delegees);
        hash_delegation_locked(dp, fp);
        status = 0;
 out_unlock:
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 79b5af5e6a7b..cecd875653e4 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -2023,11 +2023,8 @@ leave:
        dlm_lockres_drop_inflight_ref(dlm, res);
        spin_unlock(&res->spinlock);
-        if (ret < 0) {
+        if (ret < 0)
                mlog_errno(ret);
-                if (newlock)
-                        dlm_lock_put(newlock);
-        }
        return ret;
 }
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index b931e04e3388..914c121ec890 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -94,6 +94,14 @@ static int ocfs2_create_symlink_data(struct ocfs2_super *osb,
                                     struct inode *inode,
                                     const char *symname);
+static int ocfs2_double_lock(struct ocfs2_super *osb,
+                             struct buffer_head **bh1,
+                             struct inode *inode1,
+                             struct buffer_head **bh2,
+                             struct inode *inode2,
+                             int rename);
+static void ocfs2_double_unlock(struct inode *inode1, struct inode *inode2);
 /* An orphan dir name is an 8 byte value, printed as a hex string */
 #define OCFS2_ORPHAN_NAMELEN ((int)(2 * sizeof(u64)))
@@ -678,8 +686,10 @@ static int ocfs2_link(struct dentry *old_dentry,
 {
        handle_t *handle;
        struct inode *inode = old_dentry->d_inode;
+        struct inode *old_dir = old_dentry->d_parent->d_inode;
        int err;
        struct buffer_head *fe_bh = NULL;
+        struct buffer_head *old_dir_bh = NULL;
        struct buffer_head *parent_fe_bh = NULL;
        struct ocfs2_dinode *fe = NULL;
        struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
@@ -696,19 +706,33 @@ static int ocfs2_link(struct dentry *old_dentry,
        dquot_initialize(dir);
-        err = ocfs2_inode_lock_nested(dir, &parent_fe_bh, 1, OI_LS_PARENT);
+        err = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
+                        &parent_fe_bh, dir, 0);
        if (err < 0) {
                if (err != -ENOENT)
                        mlog_errno(err);
                return err;
        }
+        /* make sure both dirs have bhs
+         * get an extra ref on old_dir_bh if old==new */
+        if (!parent_fe_bh) {
+                if (old_dir_bh) {
+                        parent_fe_bh = old_dir_bh;
+                        get_bh(parent_fe_bh);
+                } else {
+                        mlog(ML_ERROR, "%s: no old_dir_bh!\n", osb->uuid_str);
+                        err = -EIO;
+                        goto out;
+                }
+        }
        if (!dir->i_nlink) {
                err = -ENOENT;
                goto out;
        }
-        err = ocfs2_lookup_ino_from_name(dir, old_dentry->d_name.name,
+        err = ocfs2_lookup_ino_from_name(old_dir, old_dentry->d_name.name,
                        old_dentry->d_name.len, &old_de_ino);
        if (err) {
                err = -ENOENT;
@@ -801,10 +825,11 @@ out_unlock_inode:
        ocfs2_inode_unlock(inode, 1);
 out:
-        ocfs2_inode_unlock(dir, 1);
+        ocfs2_double_unlock(old_dir, dir);
        brelse(fe_bh);
        brelse(parent_fe_bh);
+        brelse(old_dir_bh);
        ocfs2_free_dir_lookup_result(&lookup);
@@ -1072,14 +1097,15 @@ static int ocfs2_check_if_ancestor(struct ocfs2_super *osb,
 }
 /*
- * The only place this should be used is rename!
+ * The only place this should be used is rename and link!
 * if they have the same id, then the 1st one is the only one locked.
 */
 static int ocfs2_double_lock(struct ocfs2_super *osb,
                             struct buffer_head **bh1,
                             struct inode *inode1,
                             struct buffer_head **bh2,
-                             struct inode *inode2)
+                             struct inode *inode2,
+                             int rename)
 {
        int status;
        int inode1_is_ancestor, inode2_is_ancestor;
@@ -1127,7 +1153,7 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
                }
                /* lock id2 */
                status = ocfs2_inode_lock_nested(inode2, bh2, 1,
-                                                 OI_LS_RENAME1);
+                                rename == 1 ? OI_LS_RENAME1 : OI_LS_PARENT);
                if (status < 0) {
                        if (status != -ENOENT)
                                mlog_errno(status);
@@ -1136,7 +1162,8 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
        }
        /* lock id1 */
-        status = ocfs2_inode_lock_nested(inode1, bh1, 1, OI_LS_RENAME2);
+        status = ocfs2_inode_lock_nested(inode1, bh1, 1,
+                        rename == 1 ?  OI_LS_RENAME2 : OI_LS_PARENT);
        if (status < 0) {
                /*
                 * An error return must mean that no cluster locks
@@ -1252,7 +1279,7 @@ static int ocfs2_rename(struct inode *old_dir,
        /* if old and new are the same, this'll just do one lock. */
        status = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
-                                   &new_dir_bh, new_dir);
+                                   &new_dir_bh, new_dir, 1);
        if (status < 0) {
                mlog_errno(status);
                goto bail;
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index 3ca9b751f122..b95dc32a6e6b 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -196,8 +196,8 @@ struct acpi_processor_flags {
 struct acpi_processor {
        acpi_handle handle;
        u32 acpi_id;
-        u32 apic_id;
+        u32 phys_id;    /* CPU hardware ID such as APIC ID for x86 */
-        u32 id;
+        u32 id;         /* CPU logical ID allocated by OS */
        u32 pblk;
        int performance_platform_limit;
        int throttling_platform_limit;
@@ -310,8 +310,8 @@ static inline int acpi_processor_get_bios_limit(int cpu, unsigned int *limit)
 #endif                          /* CONFIG_CPU_FREQ */
 /* in processor_core.c */
-int acpi_get_apicid(acpi_handle, int type, u32 acpi_id);
+int acpi_get_phys_id(acpi_handle, int type, u32 acpi_id);
-int acpi_map_cpuid(int apic_id, u32 acpi_id);
+int acpi_map_cpuid(int phys_id, u32 acpi_id);
 int acpi_get_cpuid(acpi_handle, int type, u32 acpi_id);
 /* in processor_pdc.c */
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 856d381b1d5b..d459cd17b477 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -147,8 +147,8 @@ void acpi_numa_arch_fixup(void);
 #ifdef CONFIG_ACPI_HOTPLUG_CPU
 /* Arch dependent functions for cpu hotplug support */
-int acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu);
+int acpi_map_cpu(acpi_handle handle, int physid, int *pcpu);
-int acpi_unmap_lsapic(int cpu);
+int acpi_unmap_cpu(int cpu);
 #endif /* CONFIG_ACPI_HOTPLUG_CPU */
 int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base);
diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h
index 5d86416d35f2..61b19c46bdb3 100644
--- a/include/linux/ceph/osd_client.h
+++ b/include/linux/ceph/osd_client.h
@@ -87,8 +87,8 @@ struct ceph_osd_req_op {
                        struct ceph_osd_data osd_data;
                } extent;
                struct {
-                        __le32 name_len;
+                        u32 name_len;
-                        __le32 value_len;
+                        u32 value_len;
                        __u8 cmp_op;       /* CEPH_OSD_CMPXATTR_OP_* */
                        __u8 cmp_mode;     /* CEPH_OSD_CMPXATTR_MODE_* */
                        struct ceph_osd_data osd_data;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index f90c0282c114..42efe13077b6 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -135,7 +135,7 @@ typedef void (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
 #define FMODE_CAN_WRITE         ((__force fmode_t)0x40000)
 /* File was opened by fanotify and shouldn't generate fanotify events */
-#define FMODE_NONOTIFY          ((__force fmode_t)0x1000000)
+#define FMODE_NONOTIFY          ((__force fmode_t)0x4000000)
 /*
 * Flag for rw_copy_check_uvector and compat_rw_copy_check_uvector
diff --git a/include/linux/kdb.h b/include/linux/kdb.h
index 290db1269c4c..75ae2e2631fc 100644
--- a/include/linux/kdb.h
+++ b/include/linux/kdb.h
@@ -13,11 +13,54 @@
 * Copyright (C) 2009 Jason Wessel <jason.wessel@windriver.com>
 */
+/* Shifted versions of the command enable bits are be used if the command
+ * has no arguments (see kdb_check_flags). This allows commands, such as
+ * go, to have different permissions depending upon whether it is called
+ * with an argument.
+ */
+#define KDB_ENABLE_NO_ARGS_SHIFT 10
 typedef enum {
-        KDB_REPEAT_NONE = 0,    /* Do not repeat this command */
+        KDB_ENABLE_ALL = (1 << 0), /* Enable everything */
-        KDB_REPEAT_NO_ARGS,     /* Repeat the command without arguments */
+        KDB_ENABLE_MEM_READ = (1 << 1),
-        KDB_REPEAT_WITH_ARGS,   /* Repeat the command including its arguments */
+        KDB_ENABLE_MEM_WRITE = (1 << 2),
-} kdb_repeat_t;
+        KDB_ENABLE_REG_READ = (1 << 3),
+        KDB_ENABLE_REG_WRITE = (1 << 4),
+        KDB_ENABLE_INSPECT = (1 << 5),
+        KDB_ENABLE_FLOW_CTRL = (1 << 6),
+        KDB_ENABLE_SIGNAL = (1 << 7),
+        KDB_ENABLE_REBOOT = (1 << 8),
+        /* User exposed values stop here, all remaining flags are
+         * exclusively used to describe a commands behaviour.
+         */
+        KDB_ENABLE_ALWAYS_SAFE = (1 << 9),
+        KDB_ENABLE_MASK = (1 << KDB_ENABLE_NO_ARGS_SHIFT) - 1,
+        KDB_ENABLE_ALL_NO_ARGS = KDB_ENABLE_ALL << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_MEM_READ_NO_ARGS = KDB_ENABLE_MEM_READ
+                                      << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_MEM_WRITE_NO_ARGS = KDB_ENABLE_MEM_WRITE
+                                       << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_REG_READ_NO_ARGS = KDB_ENABLE_REG_READ
+                                      << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_REG_WRITE_NO_ARGS = KDB_ENABLE_REG_WRITE
+                                       << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_INSPECT_NO_ARGS = KDB_ENABLE_INSPECT
+                                     << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_FLOW_CTRL_NO_ARGS = KDB_ENABLE_FLOW_CTRL
+                                       << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_SIGNAL_NO_ARGS = KDB_ENABLE_SIGNAL
+                                    << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_REBOOT_NO_ARGS = KDB_ENABLE_REBOOT
+                                    << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_ALWAYS_SAFE_NO_ARGS = KDB_ENABLE_ALWAYS_SAFE
+                                         << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_MASK_NO_ARGS = KDB_ENABLE_MASK << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_REPEAT_NO_ARGS = 0x40000000, /* Repeat the command w/o arguments */
+        KDB_REPEAT_WITH_ARGS = 0x80000000, /* Repeat the command with args */
+} kdb_cmdflags_t;
 typedef int (*kdb_func_t)(int, const char **);
@@ -62,6 +105,7 @@ extern atomic_t kdb_event;
 #define KDB_BADLENGTH   (-19)
 #define KDB_NOBP        (-20)
 #define KDB_BADADDR     (-21)
+#define KDB_NOPERM      (-22)
 /*
 * kdb_diemsg
@@ -146,17 +190,17 @@ static inline const char *kdb_walk_kallsyms(loff_t *pos)
 /* Dynamic kdb shell command registration */
 extern int kdb_register(char *, kdb_func_t, char *, char *, short);
-extern int kdb_register_repeat(char *, kdb_func_t, char *, char *,
+extern int kdb_register_flags(char *, kdb_func_t, char *, char *,
-                               short, kdb_repeat_t);
+                              short, kdb_cmdflags_t);
 extern int kdb_unregister(char *);
 #else /* ! CONFIG_KGDB_KDB */
 static inline __printf(1, 2) int kdb_printf(const char *fmt, ...) { return 0; }
 static inline void kdb_init(int level) {}
 static inline int kdb_register(char *cmd, kdb_func_t func, char *usage,
                               char *help, short minlen) { return 0; }
-static inline int kdb_register_repeat(char *cmd, kdb_func_t func, char *usage,
+static inline int kdb_register_flags(char *cmd, kdb_func_t func, char *usage,
-                                      char *help, short minlen,
+                                     char *help, short minlen,
-                                      kdb_repeat_t repeat) { return 0; }
+                                     kdb_cmdflags_t flags) { return 0; }
 static inline int kdb_unregister(char *cmd) { return 0; }
 #endif  /* CONFIG_KGDB_KDB */
 enum {
diff --git a/include/linux/mm.h b/include/linux/mm.h
index f80d0194c9bc..80fc92a49649 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1952,7 +1952,7 @@ extern int expand_downwards(struct vm_area_struct *vma,
 #if VM_GROWSUP
 extern int expand_upwards(struct vm_area_struct *vma, unsigned long address);
 #else
-  #define expand_upwards(vma, address) do { } while (0)
+  #define expand_upwards(vma, address) (0)
 #endif
 /* Look up the first VMA which satisfies  addr < vm_end,  NULL if none. */
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index c0c2bce6b0b7..d9d7e7e56352 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -37,6 +37,16 @@ struct anon_vma {
        atomic_t refcount;
        /*
+         * Count of child anon_vmas and VMAs which points to this anon_vma.
+         *
+         * This counter is used for making decision about reusing anon_vma
+         * instead of forking new one. See comments in function anon_vma_clone.
+         */
+        unsigned degree;
+        struct anon_vma *parent;        /* Parent of this anon_vma */
+        /*
         * NOTE: the LSB of the rb_root.rb_node is set by
         * mm_take_all_locks() _after_ taking the above lock. So the
         * rb_root must only be read/written after taking the above lock
diff --git a/include/linux/writeback.h b/include/linux/writeback.h
index a219be961c0a..00048339c23e 100644
--- a/include/linux/writeback.h
+++ b/include/linux/writeback.h
@@ -177,7 +177,6 @@ int write_cache_pages(struct address_space *mapping,
                      struct writeback_control *wbc, writepage_t writepage,
                      void *data);
 int do_writepages(struct address_space *mapping, struct writeback_control *wbc);
-void set_page_dirty_balance(struct page *page);
 void writeback_set_ratelimit(void);
 void tag_pages_for_writeback(struct address_space *mapping,
                             pgoff_t start, pgoff_t end);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 58d719ddaa60..29c7be8808d5 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1270,8 +1270,7 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
 *
 * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
 *      driver to indicate that it requires IV generation for this
- *      particular key. Setting this flag does not necessarily mean that SKBs
+ *      particular key.
- *      will have sufficient tailroom for ICV or MIC.
 * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by
 *      the driver for a TKIP key if it requires Michael MIC
 *      generation in software.
@@ -1283,9 +1282,7 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
 * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
 *      if space should be prepared for the IV, but the IV
 *      itself should not be generated. Do not set together with
- *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key. Setting this flag does
+ *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
- *      not necessarily mean that SKBs will have sufficient tailroom for ICV or
- *      MIC.
 * @IEEE80211_KEY_FLAG_RX_MGMT: This key will be used to decrypt received
 *      management frames. The flag can help drivers that have a hardware
 *      crypto implementation that doesn't deal with management frames
diff --git a/include/uapi/asm-generic/fcntl.h b/include/uapi/asm-generic/fcntl.h
index 7543b3e51331..e063effe0cc1 100644
--- a/include/uapi/asm-generic/fcntl.h
+++ b/include/uapi/asm-generic/fcntl.h
@@ -5,7 +5,7 @@
 /*
 * FMODE_EXEC is 0x20
- * FMODE_NONOTIFY is 0x1000000
+ * FMODE_NONOTIFY is 0x4000000
 * These cannot be used by userspace O_* until internal and external open
 * flags are split.
 * -Eric Paris
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 1adf62b39b96..07ce18ca71e0 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -27,6 +27,9 @@
 * version 2. This program is licensed "as is" without any warranty of any
 * kind, whether express or implied.
 */
+#define pr_fmt(fmt) "KGDB: " fmt
 #include <linux/pid_namespace.h>
 #include <linux/clocksource.h>
 #include <linux/serial_core.h>
@@ -196,8 +199,8 @@ int __weak kgdb_validate_break_address(unsigned long addr)
                return err;
        err = kgdb_arch_remove_breakpoint(&tmp);
        if (err)
-                printk(KERN_ERR "KGDB: Critical breakpoint error, kernel "
+                pr_err("Critical breakpoint error, kernel memory destroyed at: %lx\n",
-                   "memory destroyed at: %lx", addr);
+                       addr);
        return err;
 }
@@ -256,8 +259,8 @@ int dbg_activate_sw_breakpoints(void)
                error = kgdb_arch_set_breakpoint(&kgdb_break[i]);
                if (error) {
                        ret = error;
-                        printk(KERN_INFO "KGDB: BP install failed: %lx",
+                        pr_info("BP install failed: %lx\n",
-                               kgdb_break[i].bpt_addr);
+                                kgdb_break[i].bpt_addr);
                        continue;
                }
@@ -319,8 +322,8 @@ int dbg_deactivate_sw_breakpoints(void)
                        continue;
                error = kgdb_arch_remove_breakpoint(&kgdb_break[i]);
                if (error) {
-                        printk(KERN_INFO "KGDB: BP remove failed: %lx\n",
+                        pr_info("BP remove failed: %lx\n",
-                               kgdb_break[i].bpt_addr);
+                                kgdb_break[i].bpt_addr);
                        ret = error;
                }
@@ -367,7 +370,7 @@ int dbg_remove_all_break(void)
                        goto setundefined;
                error = kgdb_arch_remove_breakpoint(&kgdb_break[i]);
                if (error)
-                        printk(KERN_ERR "KGDB: breakpoint remove failed: %lx\n",
+                        pr_err("breakpoint remove failed: %lx\n",
                               kgdb_break[i].bpt_addr);
 setundefined:
                kgdb_break[i].state = BP_UNDEFINED;
@@ -400,9 +403,9 @@ static int kgdb_io_ready(int print_wait)
        if (print_wait) {
 #ifdef CONFIG_KGDB_KDB
                if (!dbg_kdb_mode)
-                        printk(KERN_CRIT "KGDB: waiting... or $3#33 for KDB\n");
+                        pr_crit("waiting... or $3#33 for KDB\n");
 #else
-                printk(KERN_CRIT "KGDB: Waiting for remote debugger\n");
+                pr_crit("Waiting for remote debugger\n");
 #endif
        }
        return 1;
@@ -430,8 +433,7 @@ static int kgdb_reenter_check(struct kgdb_state *ks)
                exception_level = 0;
                kgdb_skipexception(ks->ex_vector, ks->linux_regs);
                dbg_activate_sw_breakpoints();
-                printk(KERN_CRIT "KGDB: re-enter error: breakpoint removed %lx\n",
+                pr_crit("re-enter error: breakpoint removed %lx\n", addr);
-                        addr);
                WARN_ON_ONCE(1);
                return 1;
@@ -444,7 +446,7 @@ static int kgdb_reenter_check(struct kgdb_state *ks)
                panic("Recursive entry to debugger");
        }
-        printk(KERN_CRIT "KGDB: re-enter exception: ALL breakpoints killed\n");
+        pr_crit("re-enter exception: ALL breakpoints killed\n");
 #ifdef CONFIG_KGDB_KDB
        /* Allow kdb to debug itself one level */
        return 0;
@@ -471,6 +473,7 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs,
        int cpu;
        int trace_on = 0;
        int online_cpus = num_online_cpus();
+        u64 time_left;
        kgdb_info[ks->cpu].enter_kgdb++;
        kgdb_info[ks->cpu].exception_state |= exception_state;
@@ -595,9 +598,13 @@ return_normal:
        /*
         * Wait for the other CPUs to be notified and be waiting for us:
         */
-        while (kgdb_do_roundup && (atomic_read(&masters_in_kgdb) +
+        time_left = loops_per_jiffy * HZ;
-                                atomic_read(&slaves_in_kgdb)) != online_cpus)
+        while (kgdb_do_roundup && --time_left &&
+               (atomic_read(&masters_in_kgdb) + atomic_read(&slaves_in_kgdb)) !=
+                   online_cpus)
                cpu_relax();
+        if (!time_left)
+                pr_crit("KGDB: Timed out waiting for secondary CPUs.\n");
        /*
         * At this point the primary processor is completely
@@ -795,15 +802,15 @@ static struct console kgdbcons = {
 static void sysrq_handle_dbg(int key)
 {
        if (!dbg_io_ops) {
-                printk(KERN_CRIT "ERROR: No KGDB I/O module available\n");
+                pr_crit("ERROR: No KGDB I/O module available\n");
                return;
        }
        if (!kgdb_connected) {
 #ifdef CONFIG_KGDB_KDB
                if (!dbg_kdb_mode)
-                        printk(KERN_CRIT "KGDB or $3#33 for KDB\n");
+                        pr_crit("KGDB or $3#33 for KDB\n");
 #else
-                printk(KERN_CRIT "Entering KGDB\n");
+                pr_crit("Entering KGDB\n");
 #endif
        }
@@ -945,7 +952,7 @@ static void kgdb_initial_breakpoint(void)
 {
        kgdb_break_asap = 0;
-        printk(KERN_CRIT "kgdb: Waiting for connection from remote gdb...\n");
+        pr_crit("Waiting for connection from remote gdb...\n");
        kgdb_breakpoint();
 }
@@ -964,8 +971,7 @@ int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
        if (dbg_io_ops) {
                spin_unlock(&kgdb_registration_lock);
-                printk(KERN_ERR "kgdb: Another I/O driver is already "
+                pr_err("Another I/O driver is already registered with KGDB\n");
-                                "registered with KGDB.\n");
                return -EBUSY;
        }
@@ -981,8 +987,7 @@ int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
        spin_unlock(&kgdb_registration_lock);
-        printk(KERN_INFO "kgdb: Registered I/O driver %s.\n",
+        pr_info("Registered I/O driver %s\n", new_dbg_io_ops->name);
-               new_dbg_io_ops->name);
        /* Arm KGDB now. */
        kgdb_register_callbacks();
@@ -1017,8 +1022,7 @@ void kgdb_unregister_io_module(struct kgdb_io *old_dbg_io_ops)
        spin_unlock(&kgdb_registration_lock);
-        printk(KERN_INFO
+        pr_info("Unregistered I/O driver %s, debugger disabled\n",
-                "kgdb: Unregistered I/O driver %s, debugger disabled.\n",
                old_dbg_io_ops->name);
 }
 EXPORT_SYMBOL_GPL(kgdb_unregister_io_module);
diff --git a/kernel/debug/kdb/kdb_bp.c b/kernel/debug/kdb/kdb_bp.c
index b20d544f20c2..e1dbf4a2c69e 100644
--- a/kernel/debug/kdb/kdb_bp.c
+++ b/kernel/debug/kdb/kdb_bp.c
@@ -531,22 +531,29 @@ void __init kdb_initbptab(void)
        for (i = 0, bp = kdb_breakpoints; i < KDB_MAXBPT; i++, bp++)
                bp->bp_free = 1;
-        kdb_register_repeat("bp", kdb_bp, "[<vaddr>]",
+        kdb_register_flags("bp", kdb_bp, "[<vaddr>]",
-                "Set/Display breakpoints", 0, KDB_REPEAT_NO_ARGS);
+                "Set/Display breakpoints", 0,
-        kdb_register_repeat("bl", kdb_bp, "[<vaddr>]",
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
-                "Display breakpoints", 0, KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("bl", kdb_bp, "[<vaddr>]",
+                "Display breakpoints", 0,
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
        if (arch_kgdb_ops.flags & KGDB_HW_BREAKPOINT)
-                kdb_register_repeat("bph", kdb_bp, "[<vaddr>]",
+                kdb_register_flags("bph", kdb_bp, "[<vaddr>]",
-                "[datar [length]|dataw [length]]   Set hw brk", 0, KDB_REPEAT_NO_ARGS);
+                "[datar [length]|dataw [length]]   Set hw brk", 0,
-        kdb_register_repeat("bc", kdb_bc, "<bpnum>",
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
-                "Clear Breakpoint", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("bc", kdb_bc, "<bpnum>",
-        kdb_register_repeat("be", kdb_bc, "<bpnum>",
+                "Clear Breakpoint", 0,
-                "Enable Breakpoint", 0, KDB_REPEAT_NONE);
+                KDB_ENABLE_FLOW_CTRL);
-        kdb_register_repeat("bd", kdb_bc, "<bpnum>",
+        kdb_register_flags("be", kdb_bc, "<bpnum>",
-                "Disable Breakpoint", 0, KDB_REPEAT_NONE);
+                "Enable Breakpoint", 0,
+                KDB_ENABLE_FLOW_CTRL);
-        kdb_register_repeat("ss", kdb_ss, "",
+        kdb_register_flags("bd", kdb_bc, "<bpnum>",
-                "Single Step", 1, KDB_REPEAT_NO_ARGS);
+                "Disable Breakpoint", 0,
+                KDB_ENABLE_FLOW_CTRL);
+        kdb_register_flags("ss", kdb_ss, "",
+                "Single Step", 1,
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
        /*
         * Architecture dependent initialization.
         */
diff --git a/kernel/debug/kdb/kdb_debugger.c b/kernel/debug/kdb/kdb_debugger.c
index 8859ca34dcfe..15e1a7af5dd0 100644
--- a/kernel/debug/kdb/kdb_debugger.c
+++ b/kernel/debug/kdb/kdb_debugger.c
@@ -129,6 +129,10 @@ int kdb_stub(struct kgdb_state *ks)
                ks->pass_exception = 1;
                KDB_FLAG_SET(CATASTROPHIC);
        }
+        /* set CATASTROPHIC if the system contains unresponsive processors */
+        for_each_online_cpu(i)
+                if (!kgdb_info[i].enter_kgdb)
+                        KDB_FLAG_SET(CATASTROPHIC);
        if (KDB_STATE(SSBPT) && reason == KDB_REASON_SSTEP) {
                KDB_STATE_CLEAR(SSBPT);
                KDB_STATE_CLEAR(DOING_SS);
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 379650b984f8..f191bddf64b8 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -12,6 +12,7 @@
 */
 #include <linux/ctype.h>
+#include <linux/types.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/kmsg_dump.h>
@@ -23,6 +24,7 @@
 #include <linux/vmalloc.h>
 #include <linux/atomic.h>
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/kallsyms.h>
@@ -42,6 +44,12 @@
 #include <linux/slab.h>
 #include "kdb_private.h"
+#undef  MODULE_PARAM_PREFIX
+#define MODULE_PARAM_PREFIX "kdb."
+static int kdb_cmd_enabled = CONFIG_KDB_DEFAULT_ENABLE;
+module_param_named(cmd_enable, kdb_cmd_enabled, int, 0600);
 #define GREP_LEN 256
 char kdb_grep_string[GREP_LEN];
 int kdb_grepping_flag;
@@ -121,6 +129,7 @@ static kdbmsg_t kdbmsgs[] = {
        KDBMSG(BADLENGTH, "Invalid length field"),
        KDBMSG(NOBP, "No Breakpoint exists"),
        KDBMSG(BADADDR, "Invalid address"),
+        KDBMSG(NOPERM, "Permission denied"),
 };
 #undef KDBMSG
@@ -188,6 +197,26 @@ struct task_struct *kdb_curr_task(int cpu)
 }
 /*
+ * Check whether the flags of the current command and the permissions
+ * of the kdb console has allow a command to be run.
+ */
+static inline bool kdb_check_flags(kdb_cmdflags_t flags, int permissions,
+                                   bool no_args)
+{
+        /* permissions comes from userspace so needs massaging slightly */
+        permissions &= KDB_ENABLE_MASK;
+        permissions |= KDB_ENABLE_ALWAYS_SAFE;
+        /* some commands change group when launched with no arguments */
+        if (no_args)
+                permissions |= permissions << KDB_ENABLE_NO_ARGS_SHIFT;
+        flags |= KDB_ENABLE_ALL;
+        return permissions & flags;
+}
+/*
 * kdbgetenv - This function will return the character string value of
 *      an environment variable.
 * Parameters:
@@ -476,6 +505,15 @@ int kdbgetaddrarg(int argc, const char **argv, int *nextarg,
        kdb_symtab_t symtab;
        /*
+         * If the enable flags prohibit both arbitrary memory access
+         * and flow control then there are no reasonable grounds to
+         * provide symbol lookup.
+         */
+        if (!kdb_check_flags(KDB_ENABLE_MEM_READ | KDB_ENABLE_FLOW_CTRL,
+                             kdb_cmd_enabled, false))
+                return KDB_NOPERM;
+        /*
         * Process arguments which follow the following syntax:
         *
         *  symbol | numeric-address [+/- numeric-offset]
@@ -641,8 +679,13 @@ static int kdb_defcmd2(const char *cmdstr, const char *argv0)
                if (!s->count)
                        s->usable = 0;
                if (s->usable)
-                        kdb_register(s->name, kdb_exec_defcmd,
+                        /* macros are always safe because when executed each
-                                     s->usage, s->help, 0);
+                         * internal command re-enters kdb_parse() and is
+                         * safety checked individually.
+                         */
+                        kdb_register_flags(s->name, kdb_exec_defcmd, s->usage,
+                                           s->help, 0,
+                                           KDB_ENABLE_ALWAYS_SAFE);
                return 0;
        }
        if (!s->usable)
@@ -1003,25 +1046,22 @@ int kdb_parse(const char *cmdstr)
        if (i < kdb_max_commands) {
                int result;
+                if (!kdb_check_flags(tp->cmd_flags, kdb_cmd_enabled, argc <= 1))
+                        return KDB_NOPERM;
                KDB_STATE_SET(CMD);
                result = (*tp->cmd_func)(argc-1, (const char **)argv);
                if (result && ignore_errors && result > KDB_CMD_GO)
                        result = 0;
                KDB_STATE_CLEAR(CMD);
-                switch (tp->cmd_repeat) {
-                case KDB_REPEAT_NONE:
+                if (tp->cmd_flags & KDB_REPEAT_WITH_ARGS)
-                        argc = 0;
+                        return result;
-                        if (argv[0])
-                                *(argv[0]) = '\0';
+                argc = tp->cmd_flags & KDB_REPEAT_NO_ARGS ? 1 : 0;
-                        break;
+                if (argv[argc])
-                case KDB_REPEAT_NO_ARGS:
+                        *(argv[argc]) = '\0';
-                        argc = 1;
-                        if (argv[1])
-                                *(argv[1]) = '\0';
-                        break;
-                case KDB_REPEAT_WITH_ARGS:
-                        break;
-                }
                return result;
        }
@@ -1921,10 +1961,14 @@ static int kdb_rm(int argc, const char **argv)
 */
 static int kdb_sr(int argc, const char **argv)
 {
+        bool check_mask =
+            !kdb_check_flags(KDB_ENABLE_ALL, kdb_cmd_enabled, false);
        if (argc != 1)
                return KDB_ARGCOUNT;
        kdb_trap_printk++;
-        __handle_sysrq(*argv[1], false);
+        __handle_sysrq(*argv[1], check_mask);
        kdb_trap_printk--;
        return 0;
@@ -2157,6 +2201,8 @@ static void kdb_cpu_status(void)
        for (start_cpu = -1, i = 0; i < NR_CPUS; i++) {
                if (!cpu_online(i)) {
                        state = 'F';    /* cpu is offline */
+                } else if (!kgdb_info[i].enter_kgdb) {
+                        state = 'D';    /* cpu is online but unresponsive */
                } else {
                        state = ' ';    /* cpu is responding to kdb */
                        if (kdb_task_state_char(KDB_TSK(i)) == 'I')
@@ -2210,7 +2256,7 @@ static int kdb_cpu(int argc, const char **argv)
        /*
         * Validate cpunum
         */
-        if ((cpunum > NR_CPUS) || !cpu_online(cpunum))
+        if ((cpunum > NR_CPUS) || !kgdb_info[cpunum].enter_kgdb)
                return KDB_BADCPUNUM;
        dbg_switch_cpu = cpunum;
@@ -2375,6 +2421,8 @@ static int kdb_help(int argc, const char **argv)
                        return 0;
                if (!kt->cmd_name)
                        continue;
+                if (!kdb_check_flags(kt->cmd_flags, kdb_cmd_enabled, true))
+                        continue;
                if (strlen(kt->cmd_usage) > 20)
                        space = "\n                                    ";
                kdb_printf("%-15.15s %-20s%s%s\n", kt->cmd_name,
@@ -2629,7 +2677,7 @@ static int kdb_grep_help(int argc, const char **argv)
 }
 /*
- * kdb_register_repeat - This function is used to register a kernel
+ * kdb_register_flags - This function is used to register a kernel
 *      debugger command.
 * Inputs:
 *      cmd     Command name
@@ -2641,12 +2689,12 @@ static int kdb_grep_help(int argc, const char **argv)
 *      zero for success, one if a duplicate command.
 */
 #define kdb_command_extend 50   /* arbitrary */
-int kdb_register_repeat(char *cmd,
+int kdb_register_flags(char *cmd,
-                        kdb_func_t func,
+                       kdb_func_t func,
-                        char *usage,
+                       char *usage,
-                        char *help,
+                       char *help,
-                        short minlen,
+                       short minlen,
-                        kdb_repeat_t repeat)
+                       kdb_cmdflags_t flags)
 {
        int i;
        kdbtab_t *kp;
@@ -2694,19 +2742,18 @@ int kdb_register_repeat(char *cmd,
        kp->cmd_func   = func;
        kp->cmd_usage  = usage;
        kp->cmd_help   = help;
-        kp->cmd_flags  = 0;
        kp->cmd_minlen = minlen;
-        kp->cmd_repeat = repeat;
+        kp->cmd_flags  = flags;
        return 0;
 }
-EXPORT_SYMBOL_GPL(kdb_register_repeat);
+EXPORT_SYMBOL_GPL(kdb_register_flags);
 /*
 * kdb_register - Compatibility register function for commands that do
 *      not need to specify a repeat state.  Equivalent to
- *      kdb_register_repeat with KDB_REPEAT_NONE.
+ *      kdb_register_flags with flags set to 0.
 * Inputs:
 *      cmd     Command name
 *      func    Function to execute the command
@@ -2721,8 +2768,7 @@ int kdb_register(char *cmd,
             char *help,
             short minlen)
 {
-        return kdb_register_repeat(cmd, func, usage, help, minlen,
+        return kdb_register_flags(cmd, func, usage, help, minlen, 0);
-                                   KDB_REPEAT_NONE);
 }
 EXPORT_SYMBOL_GPL(kdb_register);
@@ -2764,80 +2810,109 @@ static void __init kdb_inittab(void)
        for_each_kdbcmd(kp, i)
                kp->cmd_name = NULL;
-        kdb_register_repeat("md", kdb_md, "<vaddr>",
+        kdb_register_flags("md", kdb_md, "<vaddr>",
          "Display Memory Contents, also mdWcN, e.g. md8c1", 1,
-                            KDB_REPEAT_NO_ARGS);
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("mdr", kdb_md, "<vaddr> <bytes>",
+        kdb_register_flags("mdr", kdb_md, "<vaddr> <bytes>",
-          "Display Raw Memory", 0, KDB_REPEAT_NO_ARGS);
+          "Display Raw Memory", 0,
-        kdb_register_repeat("mdp", kdb_md, "<paddr> <bytes>",
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
-          "Display Physical Memory", 0, KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("mdp", kdb_md, "<paddr> <bytes>",
-        kdb_register_repeat("mds", kdb_md, "<vaddr>",
+          "Display Physical Memory", 0,
-          "Display Memory Symbolically", 0, KDB_REPEAT_NO_ARGS);
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("mm", kdb_mm, "<vaddr> <contents>",
+        kdb_register_flags("mds", kdb_md, "<vaddr>",
-          "Modify Memory Contents", 0, KDB_REPEAT_NO_ARGS);
+          "Display Memory Symbolically", 0,
-        kdb_register_repeat("go", kdb_go, "[<vaddr>]",
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
-          "Continue Execution", 1, KDB_REPEAT_NONE);
+        kdb_register_flags("mm", kdb_mm, "<vaddr> <contents>",
-        kdb_register_repeat("rd", kdb_rd, "",
+          "Modify Memory Contents", 0,
-          "Display Registers", 0, KDB_REPEAT_NONE);
+          KDB_ENABLE_MEM_WRITE | KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("rm", kdb_rm, "<reg> <contents>",
+        kdb_register_flags("go", kdb_go, "[<vaddr>]",
-          "Modify Registers", 0, KDB_REPEAT_NONE);
+          "Continue Execution", 1,
-        kdb_register_repeat("ef", kdb_ef, "<vaddr>",
+          KDB_ENABLE_REG_WRITE | KDB_ENABLE_ALWAYS_SAFE_NO_ARGS);
-          "Display exception frame", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("rd", kdb_rd, "",
-        kdb_register_repeat("bt", kdb_bt, "[<vaddr>]",
+          "Display Registers", 0,
-          "Stack traceback", 1, KDB_REPEAT_NONE);
+          KDB_ENABLE_REG_READ);
-        kdb_register_repeat("btp", kdb_bt, "<pid>",
+        kdb_register_flags("rm", kdb_rm, "<reg> <contents>",
-          "Display stack for process <pid>", 0, KDB_REPEAT_NONE);
+          "Modify Registers", 0,
-        kdb_register_repeat("bta", kdb_bt, "[D|R|S|T|C|Z|E|U|I|M|A]",
+          KDB_ENABLE_REG_WRITE);
-          "Backtrace all processes matching state flag", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("ef", kdb_ef, "<vaddr>",
-        kdb_register_repeat("btc", kdb_bt, "",
+          "Display exception frame", 0,
-          "Backtrace current process on each cpu", 0, KDB_REPEAT_NONE);
+          KDB_ENABLE_MEM_READ);
-        kdb_register_repeat("btt", kdb_bt, "<vaddr>",
+        kdb_register_flags("bt", kdb_bt, "[<vaddr>]",
+          "Stack traceback", 1,
+          KDB_ENABLE_MEM_READ | KDB_ENABLE_INSPECT_NO_ARGS);
+        kdb_register_flags("btp", kdb_bt, "<pid>",
+          "Display stack for process <pid>", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("bta", kdb_bt, "[D|R|S|T|C|Z|E|U|I|M|A]",
+          "Backtrace all processes matching state flag", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("btc", kdb_bt, "",
+          "Backtrace current process on each cpu", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("btt", kdb_bt, "<vaddr>",
          "Backtrace process given its struct task address", 0,
-                            KDB_REPEAT_NONE);
+          KDB_ENABLE_MEM_READ | KDB_ENABLE_INSPECT_NO_ARGS);
-        kdb_register_repeat("env", kdb_env, "",
+        kdb_register_flags("env", kdb_env, "",
-          "Show environment variables", 0, KDB_REPEAT_NONE);
+          "Show environment variables", 0,
-        kdb_register_repeat("set", kdb_set, "",
+          KDB_ENABLE_ALWAYS_SAFE);
-          "Set environment variables", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("set", kdb_set, "",
-        kdb_register_repeat("help", kdb_help, "",
+          "Set environment variables", 0,
-          "Display Help Message", 1, KDB_REPEAT_NONE);
+          KDB_ENABLE_ALWAYS_SAFE);
-        kdb_register_repeat("?", kdb_help, "",
+        kdb_register_flags("help", kdb_help, "",
-          "Display Help Message", 0, KDB_REPEAT_NONE);
+          "Display Help Message", 1,
-        kdb_register_repeat("cpu", kdb_cpu, "<cpunum>",
+          KDB_ENABLE_ALWAYS_SAFE);
-          "Switch to new cpu", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("?", kdb_help, "",
-        kdb_register_repeat("kgdb", kdb_kgdb, "",
+          "Display Help Message", 0,
-          "Enter kgdb mode", 0, KDB_REPEAT_NONE);
+          KDB_ENABLE_ALWAYS_SAFE);
-        kdb_register_repeat("ps", kdb_ps, "[<flags>|A]",
+        kdb_register_flags("cpu", kdb_cpu, "<cpunum>",
-          "Display active task list", 0, KDB_REPEAT_NONE);
+          "Switch to new cpu", 0,
-        kdb_register_repeat("pid", kdb_pid, "<pidnum>",
+          KDB_ENABLE_ALWAYS_SAFE_NO_ARGS);
-          "Switch to another task", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("kgdb", kdb_kgdb, "",
-        kdb_register_repeat("reboot", kdb_reboot, "",
+          "Enter kgdb mode", 0, 0);
-          "Reboot the machine immediately", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("ps", kdb_ps, "[<flags>|A]",
+          "Display active task list", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("pid", kdb_pid, "<pidnum>",
+          "Switch to another task", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("reboot", kdb_reboot, "",
+          "Reboot the machine immediately", 0,
+          KDB_ENABLE_REBOOT);
 #if defined(CONFIG_MODULES)
-        kdb_register_repeat("lsmod", kdb_lsmod, "",
+        kdb_register_flags("lsmod", kdb_lsmod, "",
-          "List loaded kernel modules", 0, KDB_REPEAT_NONE);
+          "List loaded kernel modules", 0,
+          KDB_ENABLE_INSPECT);
 #endif
 #if defined(CONFIG_MAGIC_SYSRQ)
-        kdb_register_repeat("sr", kdb_sr, "<key>",
+        kdb_register_flags("sr", kdb_sr, "<key>",
-          "Magic SysRq key", 0, KDB_REPEAT_NONE);
+          "Magic SysRq key", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
 #endif
 #if defined(CONFIG_PRINTK)
-        kdb_register_repeat("dmesg", kdb_dmesg, "[lines]",
+        kdb_register_flags("dmesg", kdb_dmesg, "[lines]",
-          "Display syslog buffer", 0, KDB_REPEAT_NONE);
+          "Display syslog buffer", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
 #endif
        if (arch_kgdb_ops.enable_nmi) {
-                kdb_register_repeat("disable_nmi", kdb_disable_nmi, "",
+                kdb_register_flags("disable_nmi", kdb_disable_nmi, "",
-                  "Disable NMI entry to KDB", 0, KDB_REPEAT_NONE);
+                  "Disable NMI entry to KDB", 0,
-        }
+                  KDB_ENABLE_ALWAYS_SAFE);
-        kdb_register_repeat("defcmd", kdb_defcmd, "name \"usage\" \"help\"",
+        }
-          "Define a set of commands, down to endefcmd", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("defcmd", kdb_defcmd, "name \"usage\" \"help\"",
-        kdb_register_repeat("kill", kdb_kill, "<-signal> <pid>",
+          "Define a set of commands, down to endefcmd", 0,
-          "Send a signal to a process", 0, KDB_REPEAT_NONE);
+          KDB_ENABLE_ALWAYS_SAFE);
-        kdb_register_repeat("summary", kdb_summary, "",
+        kdb_register_flags("kill", kdb_kill, "<-signal> <pid>",
-          "Summarize the system", 4, KDB_REPEAT_NONE);
+          "Send a signal to a process", 0,
-        kdb_register_repeat("per_cpu", kdb_per_cpu, "<sym> [<bytes>] [<cpu>]",
+          KDB_ENABLE_SIGNAL);
-          "Display per_cpu variables", 3, KDB_REPEAT_NONE);
+        kdb_register_flags("summary", kdb_summary, "",
-        kdb_register_repeat("grephelp", kdb_grep_help, "",
+          "Summarize the system", 4,
-          "Display help on | grep", 0, KDB_REPEAT_NONE);
+          KDB_ENABLE_ALWAYS_SAFE);
+        kdb_register_flags("per_cpu", kdb_per_cpu, "<sym> [<bytes>] [<cpu>]",
+          "Display per_cpu variables", 3,
+          KDB_ENABLE_MEM_READ);
+        kdb_register_flags("grephelp", kdb_grep_help, "",
+          "Display help on | grep", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
 }
 /* Execute any commands defined in kdb_cmds.  */
diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
index 7afd3c8c41d5..eaacd1693954 100644
--- a/kernel/debug/kdb/kdb_private.h
+++ b/kernel/debug/kdb/kdb_private.h
@@ -172,10 +172,9 @@ typedef struct _kdbtab {
        kdb_func_t cmd_func;            /* Function to execute command */
        char    *cmd_usage;             /* Usage String for this command */
        char    *cmd_help;              /* Help message for this command */
-        short    cmd_flags;             /* Parsing flags */
        short    cmd_minlen;            /* Minimum legal # command
                                         * chars required */
-        kdb_repeat_t cmd_repeat;        /* Does command auto repeat on enter? */
+        kdb_cmdflags_t cmd_flags;       /* Command behaviour flags */
 } kdbtab_t;
 extern int kdb_bt(int, const char **);  /* KDB display back trace */
diff --git a/kernel/exit.c b/kernel/exit.c
index 1ea4369890a3..6806c55475ee 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1287,9 +1287,15 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
 static int wait_consider_task(struct wait_opts *wo, int ptrace,
                                struct task_struct *p)
 {
+        /*
+         * We can race with wait_task_zombie() from another thread.
+         * Ensure that EXIT_ZOMBIE -> EXIT_DEAD/EXIT_TRACE transition
+         * can't confuse the checks below.
+         */
+        int exit_state = ACCESS_ONCE(p->exit_state);
        int ret;
-        if (unlikely(p->exit_state == EXIT_DEAD))
+        if (unlikely(exit_state == EXIT_DEAD))
                return 0;
        ret = eligible_child(wo, p);
@@ -1310,7 +1316,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
                return 0;
        }
-        if (unlikely(p->exit_state == EXIT_TRACE)) {
+        if (unlikely(exit_state == EXIT_TRACE)) {
                /*
                 * ptrace == 0 means we are the natural parent. In this case
                 * we should clear notask_error, debugger will notify us.
@@ -1337,7 +1343,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
        }
        /* slay zombie? */
-        if (p->exit_state == EXIT_ZOMBIE) {
+        if (exit_state == EXIT_ZOMBIE) {
                /* we don't reap group leaders with subthreads */
                if (!delay_group_leader(p)) {
                        /*
diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c
index b0b1c44e923a..3ccf5c2c1320 100644
--- a/kernel/trace/trace_kdb.c
+++ b/kernel/trace/trace_kdb.c
@@ -132,8 +132,8 @@ static int kdb_ftdump(int argc, const char **argv)
 static __init int kdb_ftrace_register(void)
 {
-        kdb_register_repeat("ftdump", kdb_ftdump, "[skip_#lines] [cpu]",
+        kdb_register_flags("ftdump", kdb_ftdump, "[skip_#lines] [cpu]",
-                            "Dump ftrace log", 0, KDB_REPEAT_NONE);
+                            "Dump ftrace log", 0, KDB_ENABLE_ALWAYS_SAFE);
        return 0;
 }
diff --git a/lib/Kconfig.kgdb b/lib/Kconfig.kgdb
index 358eb81fa28d..c635a107a7de 100644
--- a/lib/Kconfig.kgdb
+++ b/lib/Kconfig.kgdb
@@ -73,6 +73,31 @@ config KGDB_KDB
        help
          KDB frontend for kernel
+config KDB_DEFAULT_ENABLE
+        hex "KDB: Select kdb command functions to be enabled by default"
+        depends on KGDB_KDB
+        default 0x1
+        help
+          Specifiers which kdb commands are enabled by default. This may
+          be set to 1 or 0 to enable all commands or disable almost all
+          commands.
+          Alternatively the following bitmask applies:
+            0x0002 - allow arbitrary reads from memory and symbol lookup
+            0x0004 - allow arbitrary writes to memory
+            0x0008 - allow current register state to be inspected
+            0x0010 - allow current register state to be modified
+            0x0020 - allow passive inspection (backtrace, process list, lsmod)
+            0x0040 - allow flow control management (breakpoint, single step)
+            0x0080 - enable signalling of processes
+            0x0100 - allow machine to be rebooted
+          The config option merely sets the default at boot time. Both
+          issuing 'echo X > /sys/module/kdb/parameters/cmd_enable' or
+          setting with kdb.cmd_enable=X kernel command line option will
+          override the default settings.
 config KDB_KEYBOARD
        bool "KGDB_KDB: keyboard as input device"
        depends on VT && KGDB_KDB
diff --git a/lib/assoc_array.c b/lib/assoc_array.c
index 2404d03e251a..03dd576e6773 100644
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -11,6 +11,7 @@
 * 2 of the Licence, or (at your option) any later version.
 */
 //#define DEBUG
+#include <linux/rcupdate.h>
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/assoc_array_priv.h>
diff --git a/mm/Kconfig.debug b/mm/Kconfig.debug
index 56badfc4810a..957d3da53ddd 100644
--- a/mm/Kconfig.debug
+++ b/mm/Kconfig.debug
@@ -14,7 +14,6 @@ config DEBUG_PAGEALLOC
        depends on !KMEMCHECK
        select PAGE_EXTENSION
        select PAGE_POISONING if !ARCH_SUPPORTS_DEBUG_PAGEALLOC
-        select PAGE_GUARD if ARCH_SUPPORTS_DEBUG_PAGEALLOC
        ---help---
          Unmap pages from the kernel linear mapping after free_pages().
          This results in a large slowdown, but helps to find certain types
@@ -27,13 +26,5 @@ config DEBUG_PAGEALLOC
          that would result in incorrect warnings of memory corruption after
          a resume because free pages are not saved to the suspend image.
-config WANT_PAGE_DEBUG_FLAGS
-        bool
 config PAGE_POISONING
        bool
-        select WANT_PAGE_DEBUG_FLAGS
-config PAGE_GUARD
-        bool
-        select WANT_PAGE_DEBUG_FLAGS
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index ef91e856c7e4..851924fa5170 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3043,18 +3043,6 @@ static int mem_cgroup_move_swap_account(swp_entry_t entry,
        if (swap_cgroup_cmpxchg(entry, old_id, new_id) == old_id) {
                mem_cgroup_swap_statistics(from, false);
                mem_cgroup_swap_statistics(to, true);
-                /*
-                 * This function is only called from task migration context now.
-                 * It postpones page_counter and refcount handling till the end
-                 * of task migration(mem_cgroup_clear_mc()) for performance
-                 * improvement. But we cannot postpone css_get(to)  because if
-                 * the process that has been moved to @to does swap-in, the
-                 * refcount of @to might be decreased to 0.
-                 *
-                 * We are in attach() phase, so the cgroup is guaranteed to be
-                 * alive, so we can just call css_get().
-                 */
-                css_get(&to->css);
                return 0;
        }
        return -EINVAL;
@@ -4679,6 +4667,7 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
        if (parent_css == NULL) {
                root_mem_cgroup = memcg;
                page_counter_init(&memcg->memory, NULL);
+                memcg->soft_limit = PAGE_COUNTER_MAX;
                page_counter_init(&memcg->memsw, NULL);
                page_counter_init(&memcg->kmem, NULL);
        }
@@ -4724,6 +4713,7 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css)
        if (parent->use_hierarchy) {
                page_counter_init(&memcg->memory, &parent->memory);
+                memcg->soft_limit = PAGE_COUNTER_MAX;
                page_counter_init(&memcg->memsw, &parent->memsw);
                page_counter_init(&memcg->kmem, &parent->kmem);
@@ -4733,6 +4723,7 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css)
                 */
        } else {
                page_counter_init(&memcg->memory, NULL);
+                memcg->soft_limit = PAGE_COUNTER_MAX;
                page_counter_init(&memcg->memsw, NULL);
                page_counter_init(&memcg->kmem, NULL);
                /*
@@ -4807,7 +4798,7 @@ static void mem_cgroup_css_reset(struct cgroup_subsys_state *css)
        mem_cgroup_resize_limit(memcg, PAGE_COUNTER_MAX);
        mem_cgroup_resize_memsw_limit(memcg, PAGE_COUNTER_MAX);
        memcg_update_kmem_limit(memcg, PAGE_COUNTER_MAX);
-        memcg->soft_limit = 0;
+        memcg->soft_limit = PAGE_COUNTER_MAX;
 }
 #ifdef CONFIG_MMU
diff --git a/mm/memory.c b/mm/memory.c
index ca920d1fd314..c6565f00fb38 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2137,17 +2137,24 @@ reuse:
                if (!dirty_page)
                        return ret;
-                /*
-                 * Yes, Virginia, this is actually required to prevent a race
-                 * with clear_page_dirty_for_io() from clearing the page dirty
-                 * bit after it clear all dirty ptes, but before a racing
-                 * do_wp_page installs a dirty pte.
-                 *
-                 * do_shared_fault is protected similarly.
-                 */
                if (!page_mkwrite) {
-                        wait_on_page_locked(dirty_page);
+                        struct address_space *mapping;
-                        set_page_dirty_balance(dirty_page);
+                        int dirtied;
+                        lock_page(dirty_page);
+                        dirtied = set_page_dirty(dirty_page);
+                        VM_BUG_ON_PAGE(PageAnon(dirty_page), dirty_page);
+                        mapping = dirty_page->mapping;
+                        unlock_page(dirty_page);
+                        if (dirtied && mapping) {
+                                /*
+                                 * Some device drivers do not set page.mapping
+                                 * but still dirty their pages
+                                 */
+                                balance_dirty_pages_ratelimited(mapping);
+                        }
                        /* file_update_time outside page_lock */
                        if (vma->vm_file)
                                file_update_time(vma->vm_file);
@@ -2593,7 +2600,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
                if (prev && prev->vm_end == address)
                        return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
-                expand_downwards(vma, address - PAGE_SIZE);
+                return expand_downwards(vma, address - PAGE_SIZE);
        }
        if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
                struct vm_area_struct *next = vma->vm_next;
@@ -2602,7 +2609,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
                if (next && next->vm_start == address + PAGE_SIZE)
                        return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
-                expand_upwards(vma, address + PAGE_SIZE);
+                return expand_upwards(vma, address + PAGE_SIZE);
        }
        return 0;
 }
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index d5d81f5384d1..6f4335238e33 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1541,16 +1541,6 @@ pause:
                bdi_start_background_writeback(bdi);
 }
-void set_page_dirty_balance(struct page *page)
-{
-        if (set_page_dirty(page)) {
-                struct address_space *mapping = page_mapping(page);
-                if (mapping)
-                        balance_dirty_pages_ratelimited(mapping);
-        }
-}
 static DEFINE_PER_CPU(int, bdp_ratelimits);
 /*
@@ -2123,32 +2113,25 @@ EXPORT_SYMBOL(account_page_dirtied);
 * page dirty in that case, but not all the buffers.  This is a "bottom-up"
 * dirtying, whereas __set_page_dirty_buffers() is a "top-down" dirtying.
 *
- * Most callers have locked the page, which pins the address_space in memory.
+ * The caller must ensure this doesn't race with truncation.  Most will simply
- * But zap_pte_range() does not lock the page, however in that case the
+ * hold the page lock, but e.g. zap_pte_range() calls with the page mapped and
- * mapping is pinned by the vma's ->vm_file reference.
+ * the pte lock held, which also locks out truncation.
- *
- * We take care to handle the case where the page was truncated from the
- * mapping by re-checking page_mapping() inside tree_lock.
 */
 int __set_page_dirty_nobuffers(struct page *page)
 {
        if (!TestSetPageDirty(page)) {
                struct address_space *mapping = page_mapping(page);
-                struct address_space *mapping2;
                unsigned long flags;
                if (!mapping)
                        return 1;
                spin_lock_irqsave(&mapping->tree_lock, flags);
-                mapping2 = page_mapping(page);
+                BUG_ON(page_mapping(page) != mapping);
-                if (mapping2) { /* Race with truncate? */
+                WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
-                        BUG_ON(mapping2 != mapping);
+                account_page_dirtied(page, mapping);
-                        WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
+                radix_tree_tag_set(&mapping->page_tree, page_index(page),
-                        account_page_dirtied(page, mapping);
+                                   PAGECACHE_TAG_DIRTY);
-                        radix_tree_tag_set(&mapping->page_tree,
-                                page_index(page), PAGECACHE_TAG_DIRTY);
-                }
                spin_unlock_irqrestore(&mapping->tree_lock, flags);
                if (mapping->host) {
                        /* !PageAnon && !swapper_space */
@@ -2305,12 +2288,10 @@ int clear_page_dirty_for_io(struct page *page)
                /*
                 * We carefully synchronise fault handlers against
                 * installing a dirty pte and marking the page dirty
-                 * at this point. We do this by having them hold the
+                 * at this point.  We do this by having them hold the
-                 * page lock at some point after installing their
+                 * page lock while dirtying the page, and pages are
-                 * pte, but before marking the page dirty.
+                 * always locked coming in here, so we get the desired
-                 * Pages are always locked coming in here, so we get
+                 * exclusion.
-                 * the desired exclusion. See mm/memory.c:do_wp_page()
-                 * for more comments.
                 */
                if (TestClearPageDirty(page)) {
                        dec_zone_page_state(page, NR_FILE_DIRTY);
diff --git a/mm/rmap.c b/mm/rmap.c
index c5bc241127b2..71cd5bd0c17d 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -72,6 +72,8 @@ static inline struct anon_vma *anon_vma_alloc(void)
        anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
        if (anon_vma) {
                atomic_set(&anon_vma->refcount, 1);
+                anon_vma->degree = 1;   /* Reference for first vma */
+                anon_vma->parent = anon_vma;
                /*
                 * Initialise the anon_vma root to point to itself. If called
                 * from fork, the root will be reset to the parents anon_vma.
@@ -188,6 +190,8 @@ int anon_vma_prepare(struct vm_area_struct *vma)
                if (likely(!vma->anon_vma)) {
                        vma->anon_vma = anon_vma;
                        anon_vma_chain_link(vma, avc, anon_vma);
+                        /* vma reference or self-parent link for new root */
+                        anon_vma->degree++;
                        allocated = NULL;
                        avc = NULL;
                }
@@ -236,6 +240,14 @@ static inline void unlock_anon_vma_root(struct anon_vma *root)
 /*
 * Attach the anon_vmas from src to dst.
 * Returns 0 on success, -ENOMEM on failure.
+ *
+ * If dst->anon_vma is NULL this function tries to find and reuse existing
+ * anon_vma which has no vmas and only one child anon_vma. This prevents
+ * degradation of anon_vma hierarchy to endless linear chain in case of
+ * constantly forking task. On the other hand, an anon_vma with more than one
+ * child isn't reused even if there was no alive vma, thus rmap walker has a
+ * good chance of avoiding scanning the whole hierarchy when it searches where
+ * page is mapped.
 */
 int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
 {
@@ -256,7 +268,21 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
                anon_vma = pavc->anon_vma;
                root = lock_anon_vma_root(root, anon_vma);
                anon_vma_chain_link(dst, avc, anon_vma);
+                /*
+                 * Reuse existing anon_vma if its degree lower than two,
+                 * that means it has no vma and only one anon_vma child.
+                 *
+                 * Do not chose parent anon_vma, otherwise first child
+                 * will always reuse it. Root anon_vma is never reused:
+                 * it has self-parent reference and at least one child.
+                 */
+                if (!dst->anon_vma && anon_vma != src->anon_vma &&
+                                anon_vma->degree < 2)
+                        dst->anon_vma = anon_vma;
        }
+        if (dst->anon_vma)
+                dst->anon_vma->degree++;
        unlock_anon_vma_root(root);
        return 0;
@@ -280,6 +306,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
        if (!pvma->anon_vma)
                return 0;
+        /* Drop inherited anon_vma, we'll reuse existing or allocate new. */
+        vma->anon_vma = NULL;
        /*
         * First, attach the new VMA to the parent VMA's anon_vmas,
         * so rmap can find non-COWed pages in child processes.
@@ -288,6 +317,10 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
        if (error)
                return error;
+        /* An existing anon_vma has been reused, all done then. */
+        if (vma->anon_vma)
+                return 0;
        /* Then add our own anon_vma. */
        anon_vma = anon_vma_alloc();
        if (!anon_vma)
@@ -301,6 +334,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
         * lock any of the anon_vmas in this anon_vma tree.
         */
        anon_vma->root = pvma->anon_vma->root;
+        anon_vma->parent = pvma->anon_vma;
        /*
         * With refcounts, an anon_vma can stay around longer than the
         * process it belongs to. The root anon_vma needs to be pinned until
@@ -311,6 +345,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
        vma->anon_vma = anon_vma;
        anon_vma_lock_write(anon_vma);
        anon_vma_chain_link(vma, avc, anon_vma);
+        anon_vma->parent->degree++;
        anon_vma_unlock_write(anon_vma);
        return 0;
@@ -341,12 +376,16 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
                 * Leave empty anon_vmas on the list - we'll need
                 * to free them outside the lock.
                 */
-                if (RB_EMPTY_ROOT(&anon_vma->rb_root))
+                if (RB_EMPTY_ROOT(&anon_vma->rb_root)) {
+                        anon_vma->parent->degree--;
                        continue;
+                }
                list_del(&avc->same_vma);
                anon_vma_chain_free(avc);
        }
+        if (vma->anon_vma)
+                vma->anon_vma->degree--;
        unlock_anon_vma_root(root);
        /*
@@ -357,6 +396,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
        list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
                struct anon_vma *anon_vma = avc->anon_vma;
+                BUG_ON(anon_vma->degree);
                put_anon_vma(anon_vma);
                list_del(&avc->same_vma);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index bd9a72bc4a1b..ab2505c3ef54 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2921,18 +2921,20 @@ static bool prepare_kswapd_sleep(pg_data_t *pgdat, int order, long remaining,
                return false;
        /*
-         * There is a potential race between when kswapd checks its watermarks
+         * The throttled processes are normally woken up in balance_pgdat() as
-         * and a process gets throttled. There is also a potential race if
+         * soon as pfmemalloc_watermark_ok() is true. But there is a potential
-         * processes get throttled, kswapd wakes, a large process exits therby
+         * race between when kswapd checks the watermarks and a process gets
-         * balancing the zones that causes kswapd to miss a wakeup. If kswapd
+         * throttled. There is also a potential race if processes get
-         * is going to sleep, no process should be sleeping on pfmemalloc_wait
+         * throttled, kswapd wakes, a large process exits thereby balancing the
-         * so wake them now if necessary. If necessary, processes will wake
+         * zones, which causes kswapd to exit balance_pgdat() before reaching
-         * kswapd and get throttled again
+         * the wake up checks. If kswapd is going to sleep, no process should
+         * be sleeping on pfmemalloc_wait, so wake them now if necessary. If
+         * the wake up is premature, processes will wake kswapd and get
+         * throttled again. The difference from wake ups in balance_pgdat() is
+         * that here we are under prepare_to_wait().
         */
-        if (waitqueue_active(&pgdat->pfmemalloc_wait)) {
+        if (waitqueue_active(&pgdat->pfmemalloc_wait))
-                wake_up(&pgdat->pfmemalloc_wait);
+                wake_up_all(&pgdat->pfmemalloc_wait);
-                return false;
-        }
        return pgdat_balanced(pgdat, order, classzone_idx);
 }
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index ab6bb2af1d45..b24e4bb64fb5 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -685,11 +685,13 @@ static void batadv_mcast_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
                if (orig_initialized)
                        atomic_dec(&bat_priv->mcast.num_disabled);
                orig->capabilities |= BATADV_ORIG_CAPA_HAS_MCAST;
-        /* If mcast support is being switched off increase the disabled
+        /* If mcast support is being switched off or if this is an initial
-         * mcast node counter.
+         * OGM without mcast support then increase the disabled mcast
+         * node counter.
         */
        } else if (!orig_mcast_enabled &&
-                   orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) {
+                   (orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST ||
+                    !orig_initialized)) {
                atomic_inc(&bat_priv->mcast.num_disabled);
                orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_MCAST;
        }
@@ -738,7 +740,8 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig)
 {
        struct batadv_priv *bat_priv = orig->bat_priv;
-        if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST))
+        if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) &&
+            orig->capa_initialized & BATADV_ORIG_CAPA_HAS_MCAST)
                atomic_dec(&bat_priv->mcast.num_disabled);
        batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index 8d04d174669e..fab47f1f3ef9 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -133,7 +133,7 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
        if (!bat_priv->nc.decoding_hash)
                goto err;
-        batadv_hash_set_lock_class(bat_priv->nc.coding_hash,
+        batadv_hash_set_lock_class(bat_priv->nc.decoding_hash,
                                   &batadv_nc_decoding_hash_lock_class_key);
        INIT_DELAYED_WORK(&bat_priv->nc.work, batadv_nc_worker);
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 6a484514cd3e..bea8198d0198 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -570,9 +570,6 @@ static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
        batadv_frag_purge_orig(orig_node, NULL);
-        batadv_tt_global_del_orig(orig_node->bat_priv, orig_node, -1,
-                                  "originator timed out");
        if (orig_node->bat_priv->bat_algo_ops->bat_orig_free)
                orig_node->bat_priv->bat_algo_ops->bat_orig_free(orig_node);
@@ -678,6 +675,7 @@ struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
        atomic_set(&orig_node->last_ttvn, 0);
        orig_node->tt_buff = NULL;
        orig_node->tt_buff_len = 0;
+        orig_node->last_seen = jiffies;
        reset_time = jiffies - 1 - msecs_to_jiffies(BATADV_RESET_PROTECTION_MS);
        orig_node->bcast_seqno_reset = reset_time;
 #ifdef CONFIG_BATMAN_ADV_MCAST
@@ -977,6 +975,9 @@ static void _batadv_purge_orig(struct batadv_priv *bat_priv)
                        if (batadv_purge_orig_node(bat_priv, orig_node)) {
                                batadv_gw_node_delete(bat_priv, orig_node);
                                hlist_del_rcu(&orig_node->hash_entry);
+                                batadv_tt_global_del_orig(orig_node->bat_priv,
+                                                          orig_node, -1,
+                                                          "originator timed out");
                                batadv_orig_node_free_ref(orig_node);
                                continue;
                        }
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 35f76f2f7824..6648f321864d 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -443,11 +443,13 @@ batadv_find_router(struct batadv_priv *bat_priv,
        router = batadv_orig_router_get(orig_node, recv_if);
+        if (!router)
+                return router;
        /* only consider bonding for recv_if == BATADV_IF_DEFAULT (first hop)
         * and if activated.
         */
-        if (recv_if == BATADV_IF_DEFAULT || !atomic_read(&bat_priv->bonding) ||
+        if (!(recv_if == BATADV_IF_DEFAULT && atomic_read(&bat_priv->bonding)))
-            !router)
                return router;
        /* bonding: loop through the list of possible routers found
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 15845814a0f2..ba6eb17226da 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -676,7 +676,7 @@ static int calcu_signature(struct ceph_x_authorizer *au,
        int ret;
        char tmp_enc[40];
        __le32 tmp[5] = {
-                16u, msg->hdr.crc, msg->footer.front_crc,
+                cpu_to_le32(16), msg->hdr.crc, msg->footer.front_crc,
                msg->footer.middle_crc, msg->footer.data_crc,
        };
        ret = ceph_x_encrypt(&au->session_key, &tmp, sizeof(tmp),
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index a83062ceeec9..f2148e22b148 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -717,7 +717,7 @@ static int get_poolop_reply_buf(const char *src, size_t src_len,
        if (src_len != sizeof(u32) + dst_len)
                return -EINVAL;
-        buf_len = le32_to_cpu(*(u32 *)src);
+        buf_len = le32_to_cpu(*(__le32 *)src);
        if (buf_len != dst_len)
                return -EINVAL;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7f18262e2326..65caf8b95e17 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2019,7 +2019,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
                        break;
-                if (tso_segs == 1) {
+                if (tso_segs == 1 || !max_segs) {
                        if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
                                                     (tcp_skb_is_last(sk, skb) ?
                                                      nonagle : TCP_NAGLE_PUSH))))
@@ -2032,7 +2032,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                }
                limit = mss_now;
-                if (tso_segs > 1 && !tcp_urg_mode(tp))
+                if (tso_segs > 1 && max_segs && !tcp_urg_mode(tp))
                        limit = tcp_mss_split_point(sk, skb, mss_now,
                                                    min_t(unsigned int,
                                                          cwnd_quota,
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 0bb7038121ac..bd4e46ec32bd 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -140,7 +140,9 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
        if (!ret) {
                key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                        sdata->crypto_tx_tailroom_needed_cnt--;
                WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
@@ -188,7 +190,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
        sta = key->sta;
        sdata = key->sdata;
-        if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+        if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+              (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+              (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                increment_tailroom_need_count(sdata);
        ret = drv_set_key(key->local, DISABLE_KEY, sdata,
@@ -884,7 +888,9 @@ void ieee80211_remove_key(struct ieee80211_key_conf *keyconf)
        if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                        increment_tailroom_need_count(key->sdata);
        }
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 70bef2ab7f2b..da2fae0873a5 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -70,6 +70,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
 {
        struct flow_stats *stats;
        int node = numa_node_id();
+        int len = skb->len + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
        stats = rcu_dereference(flow->stats[node]);
@@ -105,7 +106,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
                                if (likely(new_stats)) {
                                        new_stats->used = jiffies;
                                        new_stats->packet_count = 1;
-                                        new_stats->byte_count = skb->len;
+                                        new_stats->byte_count = len;
                                        new_stats->tcp_flags = tcp_flags;
                                        spin_lock_init(&new_stats->lock);
@@ -120,7 +121,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
        stats->used = jiffies;
        stats->packet_count++;
-        stats->byte_count += skb->len;
+        stats->byte_count += len;
        stats->tcp_flags |= tcp_flags;
 unlock:
        spin_unlock(&stats->lock);
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 53f3ebbfceab..2034c6d9cb5a 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -480,7 +480,7 @@ void ovs_vport_receive(struct vport *vport, struct sk_buff *skb,
        stats = this_cpu_ptr(vport->percpu_stats);
        u64_stats_update_begin(&stats->syncp);
        stats->rx_packets++;
-        stats->rx_bytes += skb->len;
+        stats->rx_bytes += skb->len + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
        u64_stats_update_end(&stats->syncp);
        OVS_CB(skb)->input_vport = vport;
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 1cb61242e55e..4439ac4c1b53 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -606,7 +606,7 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
        struct kvec *head = buf->head;
        struct kvec *tail = buf->tail;
        int fraglen;
-        int new, old;
+        int new;
        if (len > buf->len) {
                WARN_ON_ONCE(1);
@@ -629,8 +629,8 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
        buf->len -= fraglen;
        new = buf->page_base + buf->page_len;
-        old = new + fraglen;
-        xdr->page_ptr -= (old >> PAGE_SHIFT) - (new >> PAGE_SHIFT);
+        xdr->page_ptr = buf->pages + (new >> PAGE_SHIFT);
        if (buf->page_len) {
                xdr->p = page_address(*xdr->page_ptr);
diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
index 1bca180db8ad..627f8cbbedb8 100644
--- a/scripts/Makefile.clean
+++ b/scripts/Makefile.clean
@@ -42,19 +42,19 @@ __clean-files	:= $(extra-y) $(extra-m) $(extra-)       \
 __clean-files   := $(filter-out $(no-clean-files), $(__clean-files))
-# as clean-files is given relative to the current directory, this adds
+# clean-files is given relative to the current directory, unless it
-# a $(obj) prefix, except for absolute paths
+# starts with $(objtree)/ (which means "./", so do not add "./" unless
+# you want to delete a file from the toplevel object directory).
 __clean-files   := $(wildcard                                               \
-                   $(addprefix $(obj)/, $(filter-out /%, $(__clean-files))) \
+                   $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(__clean-files))) \
-                   $(filter /%, $(__clean-files)))
+                   $(filter $(objtree)/%, $(__clean-files)))
-# as clean-dirs is given relative to the current directory, this adds
+# same as clean-files
-# a $(obj) prefix, except for absolute paths
 __clean-dirs    := $(wildcard                                               \
-                   $(addprefix $(obj)/, $(filter-out /%, $(clean-dirs)))    \
+                   $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(clean-dirs)))    \
-                   $(filter /%, $(clean-dirs)))
+                   $(filter $(objtree)/%, $(clean-dirs)))
 # ==========================================================================
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 9609a7f0faea..c7952375ac53 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -148,12 +148,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
                if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
                        atomic_dec(&key->user->nikeys);
-                key_user_put(key->user);
                /* now throw away the key memory */
                if (key->type->destroy)
                        key->type->destroy(key);
+                key_user_put(key->user);
                kfree(key->description);
 #ifdef KEY_DEBUGGING