590 files changed, 5467 insertions, 2560 deletions

diff --git a/Documentation/devicetree/bindings/ata/sata_rcar.txt b/Documentation/devicetree/bindings/ata/sata_rcar.txt
index 1e6111333fa8..80ae87a0784b 100644
--- a/Documentation/devicetree/bindings/ata/sata_rcar.txt
+++ b/Documentation/devicetree/bindings/ata/sata_rcar.txt
@@ -3,8 +3,10 @@
 Required properties:
 - compatible            : should contain one of the following:
                           - "renesas,sata-r8a7779" for R-Car H1
-                          - "renesas,sata-r8a7790" for R-Car H2
-                          - "renesas,sata-r8a7791" for R-Car M2
+                          - "renesas,sata-r8a7790-es1" for R-Car H2 ES1
+                          - "renesas,sata-r8a7790" for R-Car H2 other than ES1
+                          - "renesas,sata-r8a7791" for R-Car M2-W
+                          - "renesas,sata-r8a7793" for R-Car M2-N
 - reg                   : address and length of the SATA registers;
 - interrupts            : must consist of one interrupt specifier.
 
diff --git a/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt b/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt
index ce6a1a072028..8a3c40829899 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt
@@ -30,10 +30,6 @@ should only be used when a device has multiple interrupt parents.
   Example:
         interrupts-extended = <&intc1 5 1>, <&intc2 1 0>;
 
-A device node may contain either "interrupts" or "interrupts-extended", but not
-both. If both properties are present, then the operating system should log an
-error and use only the data in "interrupts".
-
 2) Interrupt controller nodes
 -----------------------------
 
diff --git a/Documentation/devicetree/bindings/pci/pci.txt b/Documentation/devicetree/bindings/pci/pci.txt
index 41aeed38926d..f8fbe9af7b2f 100644
--- a/Documentation/devicetree/bindings/pci/pci.txt
+++ b/Documentation/devicetree/bindings/pci/pci.txt
@@ -7,3 +7,14 @@ And for the interrupt mapping part:
 
 Open Firmware Recommended Practice: Interrupt Mapping
 http://www.openfirmware.org/1275/practice/imap/imap0_9d.pdf
+
+Additionally to the properties specified in the above standards a host bridge
+driver implementation may support the following properties:
+
+- linux,pci-domain:
+   If present this property assigns a fixed PCI domain number to a host bridge,
+   otherwise an unstable (across boots) unique number will be assigned.
+   It is required to either not set this property at all or set it for all
+   host bridges in the system, otherwise potentially conflicting domain numbers
+   may be assigned to root buses behind different host bridges.  The domain
+   number for each host bridge in the system must be unique.
diff --git a/Documentation/devicetree/bindings/pinctrl/img,tz1090-pdc-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/img,tz1090-pdc-pinctrl.txt
index a186181c402b..51b943cc9770 100644
--- a/Documentation/devicetree/bindings/pinctrl/img,tz1090-pdc-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/img,tz1090-pdc-pinctrl.txt
@@ -9,7 +9,7 @@ Please refer to pinctrl-bindings.txt in this directory for details of the
 common pinctrl bindings used by client devices, including the meaning of the
 phrase "pin configuration node".
 
-TZ1090-PDC's pin configuration nodes act as a container for an abitrary number
+TZ1090-PDC's pin configuration nodes act as a container for an arbitrary number
 of subnodes. Each of these subnodes represents some desired configuration for a
 pin, a group, or a list of pins or groups. This configuration can include the
 mux function to select on those pin(s)/group(s), and various pin configuration
diff --git a/Documentation/devicetree/bindings/pinctrl/img,tz1090-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/img,tz1090-pinctrl.txt
index 4b27c99f7f9d..49d0e6050940 100644
--- a/Documentation/devicetree/bindings/pinctrl/img,tz1090-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/img,tz1090-pinctrl.txt
@@ -9,7 +9,7 @@ Please refer to pinctrl-bindings.txt in this directory for details of the
 common pinctrl bindings used by client devices, including the meaning of the
 phrase "pin configuration node".
 
-TZ1090's pin configuration nodes act as a container for an abitrary number of
+TZ1090's pin configuration nodes act as a container for an arbitrary number of
 subnodes. Each of these subnodes represents some desired configuration for a
 pin, a group, or a list of pins or groups. This configuration can include the
 mux function to select on those pin(s)/group(s), and various pin configuration
diff --git a/Documentation/devicetree/bindings/pinctrl/lantiq,falcon-pinumx.txt b/Documentation/devicetree/bindings/pinctrl/lantiq,falcon-pinumx.txt
index daa768956069..ac4da9fe07bd 100644
--- a/Documentation/devicetree/bindings/pinctrl/lantiq,falcon-pinumx.txt
+++ b/Documentation/devicetree/bindings/pinctrl/lantiq,falcon-pinumx.txt
@@ -9,7 +9,7 @@ Please refer to pinctrl-bindings.txt in this directory for details of the
 common pinctrl bindings used by client devices, including the meaning of the
 phrase "pin configuration node".
 
-Lantiq's pin configuration nodes act as a container for an abitrary number of
+Lantiq's pin configuration nodes act as a container for an arbitrary number of
 subnodes. Each of these subnodes represents some desired configuration for a
 pin, a group, or a list of pins or groups. This configuration can include the
 mux function to select on those group(s), and two pin configuration parameters:
diff --git a/Documentation/devicetree/bindings/pinctrl/lantiq,xway-pinumx.txt b/Documentation/devicetree/bindings/pinctrl/lantiq,xway-pinumx.txt
index b5469db1d7ad..e89b4677567d 100644
--- a/Documentation/devicetree/bindings/pinctrl/lantiq,xway-pinumx.txt
+++ b/Documentation/devicetree/bindings/pinctrl/lantiq,xway-pinumx.txt
@@ -9,7 +9,7 @@ Please refer to pinctrl-bindings.txt in this directory for details of the
 common pinctrl bindings used by client devices, including the meaning of the
 phrase "pin configuration node".
 
-Lantiq's pin configuration nodes act as a container for an abitrary number of
+Lantiq's pin configuration nodes act as a container for an arbitrary number of
 subnodes. Each of these subnodes represents some desired configuration for a
 pin, a group, or a list of pins or groups. This configuration can include the
 mux function to select on those group(s), and two pin configuration parameters:
diff --git a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
index 61e73cde9ae9..3c8ce28baad6 100644
--- a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
+++ b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
@@ -9,7 +9,7 @@ Please refer to pinctrl-bindings.txt in this directory for details of the
 common pinctrl bindings used by client devices, including the meaning of the
 phrase "pin configuration node".
 
-Tegra's pin configuration nodes act as a container for an abitrary number of
+Tegra's pin configuration nodes act as a container for an arbitrary number of
 subnodes. Each of these subnodes represents some desired configuration for a
 pin, a group, or a list of pins or groups. This configuration can include the
 mux function to select on those pin(s)/group(s), and various pin configuration
diff --git a/Documentation/devicetree/bindings/pinctrl/pinctrl-sirf.txt b/Documentation/devicetree/bindings/pinctrl/pinctrl-sirf.txt
index c596a6ad3285..5f55be59d914 100644
--- a/Documentation/devicetree/bindings/pinctrl/pinctrl-sirf.txt
+++ b/Documentation/devicetree/bindings/pinctrl/pinctrl-sirf.txt
@@ -13,7 +13,7 @@ Optional properties:
 Please refer to pinctrl-bindings.txt in this directory for details of the common
 pinctrl bindings used by client devices.
 
-SiRFprimaII's pinmux nodes act as a container for an abitrary number of subnodes.
+SiRFprimaII's pinmux nodes act as a container for an arbitrary number of subnodes.
 Each of these subnodes represents some desired configuration for a group of pins.
 
 Required subnode-properties:
diff --git a/Documentation/devicetree/bindings/pinctrl/pinctrl_spear.txt b/Documentation/devicetree/bindings/pinctrl/pinctrl_spear.txt
index b4480d5c3aca..458615596946 100644
--- a/Documentation/devicetree/bindings/pinctrl/pinctrl_spear.txt
+++ b/Documentation/devicetree/bindings/pinctrl/pinctrl_spear.txt
@@ -32,7 +32,7 @@ Required properties:
 Please refer to pinctrl-bindings.txt in this directory for details of the common
 pinctrl bindings used by client devices.
 
-SPEAr's pinmux nodes act as a container for an abitrary number of subnodes. Each
+SPEAr's pinmux nodes act as a container for an arbitrary number of subnodes. Each
 of these subnodes represents muxing for a pin, a group, or a list of pins or
 groups.
 
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,apq8064-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/qcom,apq8064-pinctrl.txt
index 2fb90b37aa09..a7bde64798c7 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,apq8064-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,apq8064-pinctrl.txt
@@ -18,7 +18,7 @@ Please refer to pinctrl-bindings.txt in this directory for details of the
 common pinctrl bindings used by client devices, including the meaning of the
 phrase "pin configuration node".
 
-Qualcomm's pin configuration nodes act as a container for an abitrary number of
+Qualcomm's pin configuration nodes act as a container for an arbitrary number of
 subnodes. Each of these subnodes represents some desired configuration for a
 pin, a group, or a list of pins or groups. This configuration can include the
 mux function to select on those pin(s)/group(s), and various pin configuration
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,apq8084-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/qcom,apq8084-pinctrl.txt
index ffafa1990a30..c4ea61ac56f2 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,apq8084-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,apq8084-pinctrl.txt
@@ -47,7 +47,7 @@ Please refer to pinctrl-bindings.txt in this directory for details of the
 common pinctrl bindings used by client devices, including the meaning of the
 phrase "pin configuration node".
 
-The pin configuration nodes act as a container for an abitrary number of
+The pin configuration nodes act as a container for an arbitrary number of
 subnodes. Each of these subnodes represents some desired configuration for a
 pin, a group, or a list of pins or groups. This configuration can include the
 mux function to select on those pin(s)/group(s), and various pin configuration
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,ipq8064-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/qcom,ipq8064-pinctrl.txt
index e33e4dcdce79..6e88e91feb11 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,ipq8064-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,ipq8064-pinctrl.txt
@@ -18,7 +18,7 @@ Please refer to pinctrl-bindings.txt in this directory for details of the
 common pinctrl bindings used by client devices, including the meaning of the
 phrase "pin configuration node".
 
-Qualcomm's pin configuration nodes act as a container for an abitrary number of
+Qualcomm's pin configuration nodes act as a container for an arbitrary number of
 subnodes. Each of these subnodes represents some desired configuration for a
 pin, a group, or a list of pins or groups. This configuration can include the
 mux function to select on those pin(s)/group(s), and various pin configuration
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,msm8960-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/qcom,msm8960-pinctrl.txt
index 93b7de91b9f6..eb8d8aa41f20 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,msm8960-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,msm8960-pinctrl.txt
@@ -47,7 +47,7 @@ Please refer to pinctrl-bindings.txt in this directory for details of the
 common pinctrl bindings used by client devices, including the meaning of the
 phrase "pin configuration node".
 
-The pin configuration nodes act as a container for an abitrary number of
+The pin configuration nodes act as a container for an arbitrary number of
 subnodes. Each of these subnodes represents some desired configuration for a
 pin, a group, or a list of pins or groups. This configuration can include the
 mux function to select on those pin(s)/group(s), and various pin configuration
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,msm8974-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/qcom,msm8974-pinctrl.txt
index d2ea80dc43eb..e4d6a9d20f7d 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,msm8974-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,msm8974-pinctrl.txt
@@ -18,7 +18,7 @@ Please refer to pinctrl-bindings.txt in this directory for details of the
 common pinctrl bindings used by client devices, including the meaning of the
 phrase "pin configuration node".
 
-Qualcomm's pin configuration nodes act as a container for an abitrary number of
+Qualcomm's pin configuration nodes act as a container for an arbitrary number of
 subnodes. Each of these subnodes represents some desired configuration for a
 pin, a group, or a list of pins or groups. This configuration can include the
 mux function to select on those pin(s)/group(s), and various pin configuration
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 0b2fc732f1f3..78efebbf2788 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -34,6 +34,7 @@ chipidea	Chipidea, Inc
 chrp    Common Hardware Reference Platform
 chunghwa        Chunghwa Picture Tubes Ltd.
 cirrus  Cirrus Logic, Inc.
+cnm     Chips&Media, Inc.
 cortina Cortina Systems, Inc.
 crystalfontz    Crystalfontz America, Inc.
 dallas  Maxim Integrated Products (formerly Dallas Semiconductor)
@@ -94,6 +95,7 @@ maxim	Maxim Integrated Products
 mediatek        MediaTek Inc.
 micrel  Micrel Inc.
 microchip       Microchip Technology Inc.
+micron  Micron Technology Inc.
 mitsubishi      Mitsubishi Electric Corporation
 mosaixtech      Mosaix Technologies, Inc.
 moxa    Moxa
@@ -129,6 +131,7 @@ renesas	Renesas Electronics Corporation
 ricoh   Ricoh Co. Ltd.
 rockchip        Fuzhou Rockchip Electronics Co., Ltd
 samsung Samsung Semiconductor
+sandisk Sandisk Corporation
 sbs     Smart Battery System
 schindler       Schindler
 seagate Seagate Technology PLC
@@ -140,7 +143,7 @@ silergy	Silergy Corp.
 sirf    SiRF Technology, Inc.
 sitronix        Sitronix Technology Corporation
 smsc    Standard Microsystems Corporation
-snps    Synopsys, Inc.
+snps    Synopsys, Inc.
 solidrun        SolidRun
 sony    Sony Corporation
 spansion        Spansion Inc.
diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
index 530850a72735..a27c950ece61 100644
--- a/Documentation/filesystems/overlayfs.txt
+++ b/Documentation/filesystems/overlayfs.txt
@@ -64,7 +64,7 @@ is formed.
 At mount time, the two directories given as mount options "lowerdir" and
 "upperdir" are combined into a merged directory:
 
-  mount -t overlayfs overlayfs -olowerdir=/lower,upperdir=/upper,\
+  mount -t overlay overlay -olowerdir=/lower,upperdir=/upper,\
 workdir=/work /merged
 
 The "workdir" needs to be an empty directory on the same filesystem
diff --git a/Documentation/input/elantech.txt b/Documentation/input/elantech.txt
index e1ae127ed099..1ec0db7879d3 100644
--- a/Documentation/input/elantech.txt
+++ b/Documentation/input/elantech.txt
@@ -38,22 +38,38 @@ Contents
         7.2.1 Status packet
         7.2.2 Head packet
         7.2.3 Motion packet
+ 8. Trackpoint (for Hardware version 3 and 4)
+    8.1 Registers
+    8.2 Native relative mode 6 byte packet format
+        8.2.1 Status Packet
 
 
 
 1. Introduction
    ~~~~~~~~~~~~
 
-Currently the Linux Elantech touchpad driver is aware of two different
-hardware versions unimaginatively called version 1 and version 2. Version 1
-is found in "older" laptops and uses 4 bytes per packet. Version 2 seems to
-be introduced with the EeePC and uses 6 bytes per packet, and provides
-additional features such as position of two fingers, and width of the touch.
+Currently the Linux Elantech touchpad driver is aware of four different
+hardware versions unimaginatively called version 1,version 2, version 3
+and version 4. Version 1 is found in "older" laptops and uses 4 bytes per
+packet. Version 2 seems to be introduced with the EeePC and uses 6 bytes
+per packet, and provides additional features such as position of two fingers,
+and width of the touch.  Hardware version 3 uses 6 bytes per packet (and
+for 2 fingers the concatenation of two 6 bytes packets) and allows tracking
+of up to 3 fingers. Hardware version 4 uses 6 bytes per packet, and can
+combine a status packet with multiple head or motion packets. Hardware version
+4 allows tracking up to 5 fingers.
+
+Some Hardware version 3 and version 4 also have a trackpoint which uses a
+separate packet format. It is also 6 bytes per packet.
 
 The driver tries to support both hardware versions and should be compatible
 with the Xorg Synaptics touchpad driver and its graphical configuration
 utilities.
 
+Note that a mouse button is also associated with either the touchpad or the
+trackpoint when a trackpoint is available.  Disabling the Touchpad in xorg
+(TouchPadOff=0) will also disable the buttons associated with the touchpad.
+
 Additionally the operation of the touchpad can be altered by adjusting the
 contents of some of its internal registers. These registers are represented
 by the driver as sysfs entries under /sys/bus/serio/drivers/psmouse/serio?
@@ -78,7 +94,7 @@ completeness sake.
 2. Extra knobs
    ~~~~~~~~~~~
 
-Currently the Linux Elantech touchpad driver provides two extra knobs under
+Currently the Linux Elantech touchpad driver provides three extra knobs under
 /sys/bus/serio/drivers/psmouse/serio? for the user.
 
 * debug
@@ -112,6 +128,20 @@ Currently the Linux Elantech touchpad driver provides two extra knobs under
    data consistency checking can be done. For now checking is disabled by
    default. Currently even turning it on will do nothing.
 
+* crc_enabled
+
+   Sets crc_enabled to 0/1. The name "crc_enabled" is the official name of
+   this integrity check, even though it is not an actual cyclic redundancy
+   check.
+
+   Depending on the state of crc_enabled, certain basic data integrity
+   verification is done by the driver on hardware version 3 and 4. The
+   driver will reject any packet that appears corrupted. Using this knob,
+   The state of crc_enabled can be altered with this knob.
+
+   Reading the crc_enabled value will show the active value. Echoing
+   "0" or "1" to this file will set the state to "0" or "1".
+
 /////////////////////////////////////////////////////////////////////////////
 
 3. Differentiating hardware versions
@@ -746,3 +776,42 @@ byte 5:
 
         byte 0 ~ 2 for one finger
         byte 3 ~ 5 for another
+
+
+8. Trackpoint (for Hardware version 3 and 4)
+   =========================================
+8.1 Registers
+    ~~~~~~~~~
+No special registers have been identified.
+
+8.2 Native relative mode 6 byte packet format
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+8.2.1 Status Packet
+      ~~~~~~~~~~~~~
+
+byte 0:
+   bit   7   6   5   4   3   2   1   0
+         0   0  sx  sy   0   M   R   L
+byte 1:
+   bit   7   6   5   4   3   2   1   0
+       ~sx   0   0   0   0   0   0   0
+byte 2:
+   bit   7   6   5   4   3   2   1   0
+       ~sy   0   0   0   0   0   0   0
+byte 3:
+   bit   7   6   5   4   3   2   1   0
+         0   0 ~sy ~sx   0   1   1   0
+byte 4:
+   bit   7   6   5   4   3   2   1   0
+        x7  x6  x5  x4  x3  x2  x1  x0
+byte 5:
+   bit   7   6   5   4   3   2   1   0
+        y7  y6  y5  y4  y3  y2  y1  y0
+
+
+         x and y are written in two's complement spread
+             over 9 bits with sx/sy the relative top bit and
+             x7..x0 and y7..y0 the lower bits.
+         ~sx is the inverse of sx, ~sy is the inverse of sy.
+         The sign of y is opposite to what the input driver
+             expects for a relative movement
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 0307e2875f21..a476b08a43e0 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -56,6 +56,13 @@ ip_forward_use_pmtu - BOOLEAN
         0 - disabled
         1 - enabled
 
+fwmark_reflect - BOOLEAN
+        Controls the fwmark of kernel-generated IPv4 reply packets that are not
+        associated with a socket for example, TCP RSTs or ICMP echo replies).
+        If unset, these packets have a fwmark of zero. If set, they have the
+        fwmark of the packet they are replying to.
+        Default: 0
+
 route/max_size - INTEGER
         Maximum number of routes allowed in the kernel.  Increase
         this when using large numbers of interfaces and/or routes.
@@ -1201,6 +1208,13 @@ conf/all/forwarding - BOOLEAN
 proxy_ndp - BOOLEAN
         Do proxy ndp.
 
+fwmark_reflect - BOOLEAN
+        Controls the fwmark of kernel-generated IPv6 reply packets that are not
+        associated with a socket for example, TCP RSTs or ICMPv6 echo replies).
+        If unset, these packets have a fwmark of zero. If set, they have the
+        fwmark of the packet they are replying to.
+        Default: 0
+
 conf/interface/*:
         Change special settings per interface.
 
diff --git a/Documentation/networking/timestamping.txt b/Documentation/networking/timestamping.txt
index 412f45ca2d73..1d6d02d6ba52 100644
--- a/Documentation/networking/timestamping.txt
+++ b/Documentation/networking/timestamping.txt
@@ -136,7 +136,7 @@ SOF_TIMESTAMPING_OPT_ID:
 
   This option is implemented only for transmit timestamps. There, the
   timestamp is always looped along with a struct sock_extended_err.
-  The option modifies field ee_info to pass an id that is unique
+  The option modifies field ee_data to pass an id that is unique
   among all possibly concurrently outstanding timestamp requests for
   that socket. In practice, it is a monotonically increasing u32
   (that wraps).
diff --git a/MAINTAINERS b/MAINTAINERS
index b29325d4a072..55d3e9b93338 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2754,6 +2754,13 @@ W:	http://www.chelsio.com
 S:      Supported
 F:      drivers/net/ethernet/chelsio/cxgb3/
 
+CXGB3 ISCSI DRIVER (CXGB3I)
+M:      Karen Xie <kxie@chelsio.com>
+L:      linux-scsi@vger.kernel.org
+W:      http://www.chelsio.com
+S:      Supported
+F:      drivers/scsi/cxgbi/cxgb3i
+
 CXGB3 IWARP RNIC DRIVER (IW_CXGB3)
 M:      Steve Wise <swise@chelsio.com>
 L:      linux-rdma@vger.kernel.org
@@ -2768,6 +2775,13 @@ W:	http://www.chelsio.com
 S:      Supported
 F:      drivers/net/ethernet/chelsio/cxgb4/
 
+CXGB4 ISCSI DRIVER (CXGB4I)
+M:      Karen Xie <kxie@chelsio.com>
+L:      linux-scsi@vger.kernel.org
+W:      http://www.chelsio.com
+S:      Supported
+F:      drivers/scsi/cxgbi/cxgb4i
+
 CXGB4 IWARP RNIC DRIVER (IW_CXGB4)
 M:      Steve Wise <swise@chelsio.com>
 L:      linux-rdma@vger.kernel.org
@@ -4733,6 +4747,7 @@ L:	linux-iio@vger.kernel.org
 S:      Maintained
 F:      drivers/iio/
 F:      drivers/staging/iio/
+F:      include/linux/iio/
 
 IKANOS/ADI EAGLE ADSL USB DRIVER
 M:      Matthieu Castet <castet.matthieu@free.fr>
@@ -6613,6 +6628,23 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap.git
 S:      Maintained
 F:      arch/arm/*omap*/
 F:      drivers/i2c/busses/i2c-omap.c
+F:      drivers/irqchip/irq-omap-intc.c
+F:      drivers/mfd/*omap*.c
+F:      drivers/mfd/menelaus.c
+F:      drivers/mfd/palmas.c
+F:      drivers/mfd/tps65217.c
+F:      drivers/mfd/tps65218.c
+F:      drivers/mfd/tps65910.c
+F:      drivers/mfd/twl-core.[ch]
+F:      drivers/mfd/twl4030*.c
+F:      drivers/mfd/twl6030*.c
+F:      drivers/mfd/twl6040*.c
+F:      drivers/regulator/palmas-regulator*.c
+F:      drivers/regulator/pbias-regulator.c
+F:      drivers/regulator/tps65217-regulator.c
+F:      drivers/regulator/tps65218-regulator.c
+F:      drivers/regulator/tps65910-regulator.c
+F:      drivers/regulator/twl-regulator.c
 F:      include/linux/i2c-omap.h
 
 OMAP DEVICE TREE SUPPORT
@@ -6623,6 +6655,9 @@ L:	devicetree@vger.kernel.org
 S:      Maintained
 F:      arch/arm/boot/dts/*omap*
 F:      arch/arm/boot/dts/*am3*
+F:      arch/arm/boot/dts/*am4*
+F:      arch/arm/boot/dts/*am5*
+F:      arch/arm/boot/dts/*dra7*
 
 OMAP CLOCK FRAMEWORK SUPPORT
 M:      Paul Walmsley <paul@pwsan.com>
@@ -6870,11 +6905,12 @@ F:	drivers/scsi/osd/
 F:      include/scsi/osd_*
 F:      fs/exofs/
 
-OVERLAYFS FILESYSTEM
+OVERLAY FILESYSTEM
 M:      Miklos Szeredi <miklos@szeredi.hu>
-L:      linux-fsdevel@vger.kernel.org
+L:      linux-unionfs@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs.git
 S:      Supported
-F:      fs/overlayfs/*
+F:      fs/overlayfs/
 F:      Documentation/filesystems/overlayfs.txt
 
 P54 WIRELESS DRIVER
diff --git a/Makefile b/Makefile
index bc7eb6ada966..ce70361f766e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 18
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc7
 NAME = Diseased Newt
 
 # *DOCUMENTATION*
@@ -297,7 +297,7 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
 
 HOSTCC       = gcc
 HOSTCXX      = g++
-HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
+HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -std=gnu89
 HOSTCXXFLAGS = -O2
 
 ifeq ($(shell $(HOSTCC) -v 2>&1 | grep -c "clang version"), 1)
@@ -401,7 +401,8 @@ KBUILD_CPPFLAGS := -D__KERNEL__
 KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
                    -fno-strict-aliasing -fno-common \
                    -Werror-implicit-function-declaration \
-                   -Wno-format-security
+                   -Wno-format-security \
+                   -std=gnu89
 
 KBUILD_AFLAGS_KERNEL :=
 KBUILD_CFLAGS_KERNEL :=
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 413fd94b5301..68be9017593d 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -397,8 +397,7 @@ dtb_check_done:
                 add     sp, sp, r6
 #endif
 
-                tst     r4, #1
-                bleq    cache_clean_flush
+                bl      cache_clean_flush
 
                 adr     r0, BSYM(restart)
                 add     r0, r0, r6
@@ -1047,6 +1046,8 @@ cache_clean_flush:
                 b       call_cache_fn
 
 __armv4_mpu_cache_flush:
+                tst     r4, #1
+                movne   pc, lr
                 mov     r2, #1
                 mov     r3, #0
                 mcr     p15, 0, ip, c7, c6, 0   @ invalidate D cache
@@ -1064,6 +1065,8 @@ __armv4_mpu_cache_flush:
                 mov     pc, lr
                 
 __fa526_cache_flush:
+                tst     r4, #1
+                movne   pc, lr
                 mov     r1, #0
                 mcr     p15, 0, r1, c7, c14, 0  @ clean and invalidate D cache
                 mcr     p15, 0, r1, c7, c5, 0   @ flush I cache
@@ -1072,13 +1075,16 @@ __fa526_cache_flush:
 
 __armv6_mmu_cache_flush:
                 mov     r1, #0
-                mcr     p15, 0, r1, c7, c14, 0  @ clean+invalidate D
+                tst     r4, #1
+                mcreq   p15, 0, r1, c7, c14, 0  @ clean+invalidate D
                 mcr     p15, 0, r1, c7, c5, 0   @ invalidate I+BTB
-                mcr     p15, 0, r1, c7, c15, 0  @ clean+invalidate unified
+                mcreq   p15, 0, r1, c7, c15, 0  @ clean+invalidate unified
                 mcr     p15, 0, r1, c7, c10, 4  @ drain WB
                 mov     pc, lr
 
 __armv7_mmu_cache_flush:
+                tst     r4, #1
+                bne     iflush
                 mrc     p15, 0, r10, c0, c1, 5  @ read ID_MMFR1
                 tst     r10, #0xf << 16         @ hierarchical cache (ARMv7)
                 mov     r10, #0
@@ -1139,6 +1145,8 @@ iflush:
                 mov     pc, lr
 
 __armv5tej_mmu_cache_flush:
+                tst     r4, #1
+                movne   pc, lr
 1:              mrc     p15, 0, r15, c7, c14, 3 @ test,clean,invalidate D cache
                 bne     1b
                 mcr     p15, 0, r0, c7, c5, 0   @ flush I cache
@@ -1146,6 +1154,8 @@ __armv5tej_mmu_cache_flush:
                 mov     pc, lr
 
 __armv4_mmu_cache_flush:
+                tst     r4, #1
+                movne   pc, lr
                 mov     r2, #64*1024            @ default: 32K dcache size (*2)
                 mov     r11, #32                @ default: 32 byte line size
                 mrc     p15, 0, r3, c0, c0, 1   @ read cache type
@@ -1179,6 +1189,8 @@ no_cache_id:
 
 __armv3_mmu_cache_flush:
 __armv3_mpu_cache_flush:
+                tst     r4, #1
+                movne   pc, lr
                 mov     r1, #0
                 mcr     p15, 0, r1, c7, c0, 0   @ invalidate whole cache v3
                 mov     pc, lr
diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
index e2156a583de7..c4b968f0feb5 100644
--- a/arch/arm/boot/dts/am335x-evm.dts
+++ b/arch/arm/boot/dts/am335x-evm.dts
@@ -489,7 +489,7 @@
                         reg = <0x00060000 0x00020000>;
                 };
                 partition@4 {
-                        label = "NAND.u-boot-spl";
+                        label = "NAND.u-boot-spl-os";
                         reg = <0x00080000 0x00040000>;
                 };
                 partition@5 {
diff --git a/arch/arm/boot/dts/am437x-gp-evm.dts b/arch/arm/boot/dts/am437x-gp-evm.dts
index e7ac47fa6615..a521ac0a7d5a 100644
--- a/arch/arm/boot/dts/am437x-gp-evm.dts
+++ b/arch/arm/boot/dts/am437x-gp-evm.dts
@@ -291,8 +291,8 @@
                 dcdc3: regulator-dcdc3 {
                         compatible = "ti,tps65218-dcdc3";
                         regulator-name = "vdcdc3";
-                        regulator-min-microvolt = <1350000>;
-                        regulator-max-microvolt = <1350000>;
+                        regulator-min-microvolt = <1500000>;
+                        regulator-max-microvolt = <1500000>;
                         regulator-boot-on;
                         regulator-always-on;
                 };
diff --git a/arch/arm/boot/dts/am437x-sk-evm.dts b/arch/arm/boot/dts/am437x-sk-evm.dts
index 859ff3d620ee..87aa4f3b8b3d 100644
--- a/arch/arm/boot/dts/am437x-sk-evm.dts
+++ b/arch/arm/boot/dts/am437x-sk-evm.dts
@@ -363,8 +363,8 @@
                 dcdc3: regulator-dcdc3 {
                         compatible = "ti,tps65218-dcdc3";
                         regulator-name = "vdds_ddr";
-                        regulator-min-microvolt = <1350000>;
-                        regulator-max-microvolt = <1350000>;
+                        regulator-min-microvolt = <1500000>;
+                        regulator-max-microvolt = <1500000>;
                         regulator-boot-on;
                         regulator-always-on;
                 };
diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
index ac3e4859935f..f7e9bba10bd6 100644
--- a/arch/arm/boot/dts/am43x-epos-evm.dts
+++ b/arch/arm/boot/dts/am43x-epos-evm.dts
@@ -358,8 +358,8 @@
                 dcdc3: regulator-dcdc3 {
                         compatible = "ti,tps65218-dcdc3";
                         regulator-name = "vdcdc3";
-                        regulator-min-microvolt = <1350000>;
-                        regulator-max-microvolt = <1350000>;
+                        regulator-min-microvolt = <1500000>;
+                        regulator-max-microvolt = <1500000>;
                         regulator-boot-on;
                         regulator-always-on;
                 };
diff --git a/arch/arm/boot/dts/exynos5250-snow.dts b/arch/arm/boot/dts/exynos5250-snow.dts
index e51fcef884a4..60429ad1c5d8 100644
--- a/arch/arm/boot/dts/exynos5250-snow.dts
+++ b/arch/arm/boot/dts/exynos5250-snow.dts
@@ -624,4 +624,8 @@
         num-cs = <1>;
 };
 
+&usbdrd_dwc3 {
+        dr_mode = "host";
+};
+
 #include "cros-ec-keyboard.dtsi"
diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
index f21b9aa00fbb..d55c1a2eb798 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -555,7 +555,7 @@
                 #size-cells = <1>;
                 ranges;
 
-                dwc3 {
+                usbdrd_dwc3: dwc3 {
                         compatible = "synopsys,dwc3";
                         reg = <0x12000000 0x10000>;
                         interrupts = <0 72 0>;
diff --git a/arch/arm/boot/dts/r8a7740.dtsi b/arch/arm/boot/dts/r8a7740.dtsi
index d46c213a17ad..eed697a6bd6b 100644
--- a/arch/arm/boot/dts/r8a7740.dtsi
+++ b/arch/arm/boot/dts/r8a7740.dtsi
@@ -433,7 +433,7 @@
                         clocks = <&cpg_clocks R8A7740_CLK_S>,
                                  <&cpg_clocks R8A7740_CLK_S>, <&sub_clk>,
                                  <&cpg_clocks R8A7740_CLK_B>,
-                                 <&sub_clk>, <&sub_clk>,
+                                 <&cpg_clocks R8A7740_CLK_HPP>, <&sub_clk>,
                                  <&cpg_clocks R8A7740_CLK_B>;
                         #clock-cells = <1>;
                         renesas,clock-indices = <
diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi
index b7c59b7b06b0..0c20c90d8c06 100644
--- a/arch/arm/boot/dts/r8a7790.dtsi
+++ b/arch/arm/boot/dts/r8a7790.dtsi
@@ -756,9 +756,9 @@
                         #clock-cells = <0>;
                         clock-output-names = "sd2";
                 };
-                sd3_clk: sd3_clk@e615007c {
+                sd3_clk: sd3_clk@e615026c {
                         compatible = "renesas,r8a7790-div6-clock", "renesas,cpg-div6-clock";
-                        reg = <0 0xe615007c 0 4>;
+                        reg = <0 0xe615026c 0 4>;
                         clocks = <&pll1_div2_clk>;
                         #clock-cells = <0>;
                         clock-output-names = "sd3";
diff --git a/arch/arm/boot/dts/sama5d31.dtsi b/arch/arm/boot/dts/sama5d31.dtsi
index 7997dc9863ed..883878b32971 100644
--- a/arch/arm/boot/dts/sama5d31.dtsi
+++ b/arch/arm/boot/dts/sama5d31.dtsi
@@ -12,5 +12,5 @@
 #include "sama5d3_uart.dtsi"
 
 / {
-        compatible = "atmel,samad31", "atmel,sama5d3", "atmel,sama5";
+        compatible = "atmel,sama5d31", "atmel,sama5d3", "atmel,sama5";
 };
diff --git a/arch/arm/boot/dts/sama5d33.dtsi b/arch/arm/boot/dts/sama5d33.dtsi
index 39f832253caf..4b4434aca351 100644
--- a/arch/arm/boot/dts/sama5d33.dtsi
+++ b/arch/arm/boot/dts/sama5d33.dtsi
@@ -10,5 +10,5 @@
 #include "sama5d3_gmac.dtsi"
 
 / {
-        compatible = "atmel,samad33", "atmel,sama5d3", "atmel,sama5";
+        compatible = "atmel,sama5d33", "atmel,sama5d3", "atmel,sama5";
 };
diff --git a/arch/arm/boot/dts/sama5d34.dtsi b/arch/arm/boot/dts/sama5d34.dtsi
index 89cda2c0da39..aa01573fdee9 100644
--- a/arch/arm/boot/dts/sama5d34.dtsi
+++ b/arch/arm/boot/dts/sama5d34.dtsi
@@ -12,5 +12,5 @@
 #include "sama5d3_mci2.dtsi"
 
 / {
-        compatible = "atmel,samad34", "atmel,sama5d3", "atmel,sama5";
+        compatible = "atmel,sama5d34", "atmel,sama5d3", "atmel,sama5";
 };
diff --git a/arch/arm/boot/dts/sama5d35.dtsi b/arch/arm/boot/dts/sama5d35.dtsi
index d20cd71b5f0e..16c39f4c96a4 100644
--- a/arch/arm/boot/dts/sama5d35.dtsi
+++ b/arch/arm/boot/dts/sama5d35.dtsi
@@ -14,5 +14,5 @@
 #include "sama5d3_tcb1.dtsi"
 
 / {
-        compatible = "atmel,samad35", "atmel,sama5d3", "atmel,sama5";
+        compatible = "atmel,sama5d35", "atmel,sama5d3", "atmel,sama5";
 };
diff --git a/arch/arm/boot/dts/sama5d36.dtsi b/arch/arm/boot/dts/sama5d36.dtsi
index db58cad6acd3..e85139ef40af 100644
--- a/arch/arm/boot/dts/sama5d36.dtsi
+++ b/arch/arm/boot/dts/sama5d36.dtsi
@@ -16,5 +16,5 @@
 #include "sama5d3_uart.dtsi"
 
 / {
-        compatible = "atmel,samad36", "atmel,sama5d3", "atmel,sama5";
+        compatible = "atmel,sama5d36", "atmel,sama5d3", "atmel,sama5";
 };
diff --git a/arch/arm/boot/dts/sama5d3xcm.dtsi b/arch/arm/boot/dts/sama5d3xcm.dtsi
index 962dc28dc37b..cfcd200b0c17 100644
--- a/arch/arm/boot/dts/sama5d3xcm.dtsi
+++ b/arch/arm/boot/dts/sama5d3xcm.dtsi
@@ -8,7 +8,7 @@
  */
 
 / {
-        compatible = "atmel,samad3xcm", "atmel,sama5d3", "atmel,sama5";
+        compatible = "atmel,sama5d3xcm", "atmel,sama5d3", "atmel,sama5";
 
         chosen {
                 bootargs = "console=ttyS0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs";
diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
index 543f895d18d3..2e652e2339e9 100644
--- a/arch/arm/boot/dts/sun6i-a31.dtsi
+++ b/arch/arm/boot/dts/sun6i-a31.dtsi
@@ -361,6 +361,10 @@
                         clocks = <&ahb1_gates 6>;
                         resets = <&ahb1_rst 6>;
                         #dma-cells = <1>;
+
+                        /* DMA controller requires AHB1 clocked from PLL6 */
+                        assigned-clocks = <&ahb1_mux>;
+                        assigned-clock-parents = <&pll6>;
                 };
 
                 mmc0: mmc@01c0f000 {
diff --git a/arch/arm/boot/dts/tegra114-dalmore.dts b/arch/arm/boot/dts/tegra114-dalmore.dts
index 5c21d216515a..8b7aa0dcdc6e 100644
--- a/arch/arm/boot/dts/tegra114-dalmore.dts
+++ b/arch/arm/boot/dts/tegra114-dalmore.dts
@@ -15,6 +15,7 @@
         aliases {
                 rtc0 = "/i2c@7000d000/tps65913@58";
                 rtc1 = "/rtc@7000e000";
+                serial0 = &uartd;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra114-roth.dts b/arch/arm/boot/dts/tegra114-roth.dts
index c7c6825f11fb..38acf78d7815 100644
--- a/arch/arm/boot/dts/tegra114-roth.dts
+++ b/arch/arm/boot/dts/tegra114-roth.dts
@@ -15,6 +15,10 @@
                 linux,initrd-end = <0x82800000>;
         };
 
+        aliases {
+                serial0 = &uartd;
+        };
+
         firmware {
                 trusted-foundations {
                         compatible = "tlm,trusted-foundations";
@@ -916,8 +920,6 @@
                                                 regulator-name = "vddio-sdmmc3";
                                                 regulator-min-microvolt = <1800000>;
                                                 regulator-max-microvolt = <3300000>;
-                                                regulator-always-on;
-                                                regulator-boot-on;
                                         };
 
                                         ldousb {
@@ -962,7 +964,7 @@
         sdhci@78000400 {
                 status = "okay";
                 bus-width = <4>;
-                vmmc-supply = <&vddio_sdmmc3>;
+                vqmmc-supply = <&vddio_sdmmc3>;
                 cd-gpios = <&gpio TEGRA_GPIO(V, 2) GPIO_ACTIVE_LOW>;
                 power-gpios = <&gpio TEGRA_GPIO(H, 0) GPIO_ACTIVE_HIGH>;
         };
@@ -971,7 +973,6 @@
         sdhci@78000600 {
                 status = "okay";
                 bus-width = <8>;
-                vmmc-supply = <&vdd_1v8>;
                 non-removable;
         };
 
diff --git a/arch/arm/boot/dts/tegra114-tn7.dts b/arch/arm/boot/dts/tegra114-tn7.dts
index 963662145635..f91c2c9b2f94 100644
--- a/arch/arm/boot/dts/tegra114-tn7.dts
+++ b/arch/arm/boot/dts/tegra114-tn7.dts
@@ -15,6 +15,10 @@
                 linux,initrd-end = <0x82800000>;
         };
 
+        aliases {
+                serial0 = &uartd;
+        };
+
         firmware {
                 trusted-foundations {
                         compatible = "tlm,trusted-foundations";
@@ -240,7 +244,6 @@
         sdhci@78000600 {
                 status = "okay";
                 bus-width = <8>;
-                vmmc-supply = <&vdd_1v8>;
                 non-removable;
         };
 
diff --git a/arch/arm/boot/dts/tegra114.dtsi b/arch/arm/boot/dts/tegra114.dtsi
index 2ca9c1807f72..222f3b3f4dd5 100644
--- a/arch/arm/boot/dts/tegra114.dtsi
+++ b/arch/arm/boot/dts/tegra114.dtsi
@@ -9,13 +9,6 @@
         compatible = "nvidia,tegra114";
         interrupt-parent = <&gic>;
 
-        aliases {
-                serial0 = &uarta;
-                serial1 = &uartb;
-                serial2 = &uartc;
-                serial3 = &uartd;
-        };
-
         host1x@50000000 {
                 compatible = "nvidia,tegra114-host1x", "simple-bus";
                 reg = <0x50000000 0x00028000>;
diff --git a/arch/arm/boot/dts/tegra124-jetson-tk1.dts b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
index 029c9a021541..51b373ff1065 100644
--- a/arch/arm/boot/dts/tegra124-jetson-tk1.dts
+++ b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
@@ -10,6 +10,7 @@
         aliases {
                 rtc0 = "/i2c@0,7000d000/pmic@40";
                 rtc1 = "/rtc@0,7000e000";
+                serial0 = &uartd;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra124-nyan-big.dts b/arch/arm/boot/dts/tegra124-nyan-big.dts
index 7d0784ce4c74..53181d310247 100644
--- a/arch/arm/boot/dts/tegra124-nyan-big.dts
+++ b/arch/arm/boot/dts/tegra124-nyan-big.dts
@@ -10,6 +10,7 @@
         aliases {
                 rtc0 = "/i2c@0,7000d000/pmic@40";
                 rtc1 = "/rtc@0,7000e000";
+                serial0 = &uarta;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra124-venice2.dts b/arch/arm/boot/dts/tegra124-venice2.dts
index 13008858e967..5c3f7813360d 100644
--- a/arch/arm/boot/dts/tegra124-venice2.dts
+++ b/arch/arm/boot/dts/tegra124-venice2.dts
@@ -10,6 +10,7 @@
         aliases {
                 rtc0 = "/i2c@0,7000d000/pmic@40";
                 rtc1 = "/rtc@0,7000e000";
+                serial0 = &uarta;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra124.dtsi b/arch/arm/boot/dts/tegra124.dtsi
index 478c555ebd96..df2b06b29985 100644
--- a/arch/arm/boot/dts/tegra124.dtsi
+++ b/arch/arm/boot/dts/tegra124.dtsi
@@ -286,7 +286,7 @@
          * the APB DMA based serial driver, the comptible is
          * "nvidia,tegra124-hsuart", "nvidia,tegra30-hsuart".
          */
-        serial@0,70006000 {
+        uarta: serial@0,70006000 {
                 compatible = "nvidia,tegra124-uart", "nvidia,tegra20-uart";
                 reg = <0x0 0x70006000 0x0 0x40>;
                 reg-shift = <2>;
@@ -299,7 +299,7 @@
                 status = "disabled";
         };
 
-        serial@0,70006040 {
+        uartb: serial@0,70006040 {
                 compatible = "nvidia,tegra124-uart", "nvidia,tegra20-uart";
                 reg = <0x0 0x70006040 0x0 0x40>;
                 reg-shift = <2>;
@@ -312,7 +312,7 @@
                 status = "disabled";
         };
 
-        serial@0,70006200 {
+        uartc: serial@0,70006200 {
                 compatible = "nvidia,tegra124-uart", "nvidia,tegra20-uart";
                 reg = <0x0 0x70006200 0x0 0x40>;
                 reg-shift = <2>;
@@ -325,7 +325,7 @@
                 status = "disabled";
         };
 
-        serial@0,70006300 {
+        uartd: serial@0,70006300 {
                 compatible = "nvidia,tegra124-uart", "nvidia,tegra20-uart";
                 reg = <0x0 0x70006300 0x0 0x40>;
                 reg-shift = <2>;
diff --git a/arch/arm/boot/dts/tegra20-harmony.dts b/arch/arm/boot/dts/tegra20-harmony.dts
index a37279af687c..b926a07b9443 100644
--- a/arch/arm/boot/dts/tegra20-harmony.dts
+++ b/arch/arm/boot/dts/tegra20-harmony.dts
@@ -10,6 +10,7 @@
         aliases {
                 rtc0 = "/i2c@7000d000/tps6586x@34";
                 rtc1 = "/rtc@7000e000";
+                serial0 = &uartd;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra20-iris-512.dts b/arch/arm/boot/dts/tegra20-iris-512.dts
index 8cfb83f42e1f..1dd7d7bfdfcc 100644
--- a/arch/arm/boot/dts/tegra20-iris-512.dts
+++ b/arch/arm/boot/dts/tegra20-iris-512.dts
@@ -6,6 +6,11 @@
         model = "Toradex Colibri T20 512MB on Iris";
         compatible = "toradex,iris", "toradex,colibri_t20-512", "nvidia,tegra20";
 
+        aliases {
+                serial0 = &uarta;
+                serial1 = &uartd;
+        };
+
         host1x@50000000 {
                 hdmi@54280000 {
                         status = "okay";
diff --git a/arch/arm/boot/dts/tegra20-medcom-wide.dts b/arch/arm/boot/dts/tegra20-medcom-wide.dts
index 1b7c56b33aca..9b87526ab0b7 100644
--- a/arch/arm/boot/dts/tegra20-medcom-wide.dts
+++ b/arch/arm/boot/dts/tegra20-medcom-wide.dts
@@ -6,6 +6,10 @@
         model = "Avionic Design Medcom-Wide board";
         compatible = "ad,medcom-wide", "ad,tamonten", "nvidia,tegra20";
 
+        aliases {
+                serial0 = &uartd;
+        };
+
         pwm@7000a000 {
                 status = "okay";
         };
diff --git a/arch/arm/boot/dts/tegra20-paz00.dts b/arch/arm/boot/dts/tegra20-paz00.dts
index d4438e30de45..ed7e1009326c 100644
--- a/arch/arm/boot/dts/tegra20-paz00.dts
+++ b/arch/arm/boot/dts/tegra20-paz00.dts
@@ -10,6 +10,8 @@
         aliases {
                 rtc0 = "/i2c@7000d000/tps6586x@34";
                 rtc1 = "/rtc@7000e000";
+                serial0 = &uarta;
+                serial1 = &uartc;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra20-seaboard.dts b/arch/arm/boot/dts/tegra20-seaboard.dts
index a1d4bf9895d7..ea282c7c0ca5 100644
--- a/arch/arm/boot/dts/tegra20-seaboard.dts
+++ b/arch/arm/boot/dts/tegra20-seaboard.dts
@@ -10,6 +10,7 @@
         aliases {
                 rtc0 = "/i2c@7000d000/tps6586x@34";
                 rtc1 = "/rtc@7000e000";
+                serial0 = &uartd;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi
index 80e7d386ce34..13d4e6185275 100644
--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi
+++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi
@@ -7,6 +7,7 @@
         aliases {
                 rtc0 = "/i2c@7000d000/tps6586x@34";
                 rtc1 = "/rtc@7000e000";
+                serial0 = &uartd;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra20-trimslice.dts b/arch/arm/boot/dts/tegra20-trimslice.dts
index 5ad87979ab13..d99af4ef9c64 100644
--- a/arch/arm/boot/dts/tegra20-trimslice.dts
+++ b/arch/arm/boot/dts/tegra20-trimslice.dts
@@ -10,6 +10,7 @@
         aliases {
                 rtc0 = "/i2c@7000c500/rtc@56";
                 rtc1 = "/rtc@7000e000";
+                serial0 = &uarta;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra20-ventana.dts b/arch/arm/boot/dts/tegra20-ventana.dts
index ca8484cccddc..04c58e9ca490 100644
--- a/arch/arm/boot/dts/tegra20-ventana.dts
+++ b/arch/arm/boot/dts/tegra20-ventana.dts
@@ -10,6 +10,7 @@
         aliases {
                 rtc0 = "/i2c@7000d000/tps6586x@34";
                 rtc1 = "/rtc@7000e000";
+                serial0 = &uartd;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra20-whistler.dts b/arch/arm/boot/dts/tegra20-whistler.dts
index 1843725785c9..340d81108df1 100644
--- a/arch/arm/boot/dts/tegra20-whistler.dts
+++ b/arch/arm/boot/dts/tegra20-whistler.dts
@@ -10,6 +10,7 @@
         aliases {
                 rtc0 = "/i2c@7000d000/max8907@3c";
                 rtc1 = "/rtc@7000e000";
+                serial0 = &uarta;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi
index 3b374c49d04d..8acf5d85c99d 100644
--- a/arch/arm/boot/dts/tegra20.dtsi
+++ b/arch/arm/boot/dts/tegra20.dtsi
@@ -9,14 +9,6 @@
         compatible = "nvidia,tegra20";
         interrupt-parent = <&intc>;
 
-        aliases {
-                serial0 = &uarta;
-                serial1 = &uartb;
-                serial2 = &uartc;
-                serial3 = &uartd;
-                serial4 = &uarte;
-        };
-
         host1x@50000000 {
                 compatible = "nvidia,tegra20-host1x", "simple-bus";
                 reg = <0x50000000 0x00024000>;
diff --git a/arch/arm/boot/dts/tegra30-apalis-eval.dts b/arch/arm/boot/dts/tegra30-apalis-eval.dts
index 45d40f024585..6236bdecb48b 100644
--- a/arch/arm/boot/dts/tegra30-apalis-eval.dts
+++ b/arch/arm/boot/dts/tegra30-apalis-eval.dts
@@ -11,6 +11,10 @@
                 rtc0 = "/i2c@7000c000/rtc@68";
                 rtc1 = "/i2c@7000d000/tps65911@2d";
                 rtc2 = "/rtc@7000e000";
+                serial0 = &uarta;
+                serial1 = &uartb;
+                serial2 = &uartc;
+                serial3 = &uartd;
         };
 
         pcie-controller@00003000 {
diff --git a/arch/arm/boot/dts/tegra30-beaver.dts b/arch/arm/boot/dts/tegra30-beaver.dts
index cee8f2246fdb..6b157eeabcc5 100644
--- a/arch/arm/boot/dts/tegra30-beaver.dts
+++ b/arch/arm/boot/dts/tegra30-beaver.dts
@@ -9,6 +9,7 @@
         aliases {
                 rtc0 = "/i2c@7000d000/tps65911@2d";
                 rtc1 = "/rtc@7000e000";
+                serial0 = &uarta;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra30-cardhu.dtsi b/arch/arm/boot/dts/tegra30-cardhu.dtsi
index 206379546244..a1b682ea01bd 100644
--- a/arch/arm/boot/dts/tegra30-cardhu.dtsi
+++ b/arch/arm/boot/dts/tegra30-cardhu.dtsi
@@ -30,6 +30,8 @@
         aliases {
                 rtc0 = "/i2c@7000d000/tps65911@2d";
                 rtc1 = "/rtc@7000e000";
+                serial0 = &uarta;
+                serial1 = &uartc;
         };
 
         memory {
diff --git a/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts b/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
index 7793abd5bef1..4d3ddc585641 100644
--- a/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
+++ b/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
@@ -10,6 +10,9 @@
                 rtc0 = "/i2c@7000c000/rtc@68";
                 rtc1 = "/i2c@7000d000/tps65911@2d";
                 rtc2 = "/rtc@7000e000";
+                serial0 = &uarta;
+                serial1 = &uartb;
+                serial2 = &uartd;
         };
 
         host1x@50000000 {
diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
index aa6ccea13d30..b270b9e3d455 100644
--- a/arch/arm/boot/dts/tegra30.dtsi
+++ b/arch/arm/boot/dts/tegra30.dtsi
@@ -9,14 +9,6 @@
         compatible = "nvidia,tegra30";
         interrupt-parent = <&intc>;
 
-        aliases {
-                serial0 = &uarta;
-                serial1 = &uartb;
-                serial2 = &uartc;
-                serial3 = &uartd;
-                serial4 = &uarte;
-        };
-
         pcie-controller@00003000 {
                 compatible = "nvidia,tegra30-pcie";
                 device_type = "pci";
diff --git a/arch/arm/configs/exynos_defconfig b/arch/arm/configs/exynos_defconfig
index 72058b8a6f4d..e21ef830a483 100644
--- a/arch/arm/configs/exynos_defconfig
+++ b/arch/arm/configs/exynos_defconfig
@@ -142,11 +142,13 @@ CONFIG_MMC_DW_IDMAC=y
 CONFIG_MMC_DW_EXYNOS=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
+CONFIG_RTC_DRV_MAX77802=y
 CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_S3C=y
 CONFIG_DMADEVICES=y
 CONFIG_PL330_DMA=y
 CONFIG_COMMON_CLK_MAX77686=y
+CONFIG_COMMON_CLK_MAX77802=y
 CONFIG_COMMON_CLK_S2MPS11=y
 CONFIG_EXYNOS_IOMMU=y
 CONFIG_IIO=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 3487046d8a78..9d7a32f93fcf 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -217,6 +217,7 @@ CONFIG_I2C_CADENCE=y
 CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_EXYNOS5=y
 CONFIG_I2C_MV64XXX=y
+CONFIG_I2C_S3C2410=y
 CONFIG_I2C_SIRF=y
 CONFIG_I2C_TEGRA=y
 CONFIG_I2C_ST=y
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index fc44d3761f9e..ce73ab635414 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -44,16 +44,6 @@ struct cpu_context_save {
         __u32   extra[2];               /* Xscale 'acc' register, etc */
 };
 
-struct arm_restart_block {
-        union {
-                /* For user cache flushing */
-                struct {
-                        unsigned long start;
-                        unsigned long end;
-                } cache;
-        };
-};
-
 /*
  * low level task data that entry.S needs immediate access to.
  * __switch_to() assumes cpu_context follows immediately after cpu_domain.
@@ -79,7 +69,6 @@ struct thread_info {
         unsigned long           thumbee_state;  /* ThumbEE Handler Base register */
 #endif
         struct restart_block    restart_block;
-        struct arm_restart_block        arm_restart_block;
 };
 
 #define INIT_THREAD_INFO(tsk)                                           \
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 0c8b10801d36..9f5d81881eb6 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -533,8 +533,6 @@ static int bad_syscall(int n, struct pt_regs *regs)
         return regs->ARM_r0;
 }
 
-static long do_cache_op_restart(struct restart_block *);
-
 static inline int
 __do_cache_op(unsigned long start, unsigned long end)
 {
@@ -543,24 +541,8 @@ __do_cache_op(unsigned long start, unsigned long end)
         do {
                 unsigned long chunk = min(PAGE_SIZE, end - start);
 
-                if (signal_pending(current)) {
-                        struct thread_info *ti = current_thread_info();
-
-                        ti->restart_block = (struct restart_block) {
-                                .fn     = do_cache_op_restart,
-                        };
-
-                        ti->arm_restart_block = (struct arm_restart_block) {
-                                {
-                                        .cache = {
-                                                .start  = start,
-                                                .end    = end,
-                                        },
-                                },
-                        };
-
-                        return -ERESTART_RESTARTBLOCK;
-                }
+                if (fatal_signal_pending(current))
+                        return 0;
 
                 ret = flush_cache_user_range(start, start + chunk);
                 if (ret)
@@ -573,15 +555,6 @@ __do_cache_op(unsigned long start, unsigned long end)
         return 0;
 }
 
-static long do_cache_op_restart(struct restart_block *unused)
-{
-        struct arm_restart_block *restart_block;
-
-        restart_block = &current_thread_info()->arm_restart_block;
-        return __do_cache_op(restart_block->cache.start,
-                             restart_block->cache.end);
-}
-
 static inline int
 do_cache_op(unsigned long start, unsigned long end, int flags)
 {
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 57a403a5c22b..8664ff17cbbe 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -197,7 +197,8 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
         pgd = pgdp + pgd_index(addr);
         do {
                 next = kvm_pgd_addr_end(addr, end);
-                unmap_puds(kvm, pgd, addr, next);
+                if (!pgd_none(*pgd))
+                        unmap_puds(kvm, pgd, addr, next);
         } while (pgd++, addr = next, addr != end);
 }
 
@@ -834,6 +835,11 @@ static bool kvm_is_write_fault(struct kvm_vcpu *vcpu)
         return kvm_vcpu_dabt_iswrite(vcpu);
 }
 
+static bool kvm_is_device_pfn(unsigned long pfn)
+{
+        return !pfn_valid(pfn);
+}
+
 static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
                           struct kvm_memory_slot *memslot, unsigned long hva,
                           unsigned long fault_status)
@@ -904,7 +910,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
         if (is_error_pfn(pfn))
                 return -EFAULT;
 
-        if (kvm_is_mmio_pfn(pfn))
+        if (kvm_is_device_pfn(pfn))
                 mem_type = PAGE_S2_DEVICE;
 
         spin_lock(&kvm->mmu_lock);
diff --git a/arch/arm/mach-mvebu/board-v7.c b/arch/arm/mach-mvebu/board-v7.c
index 6478626e3ff6..d0d39f150fab 100644
--- a/arch/arm/mach-mvebu/board-v7.c
+++ b/arch/arm/mach-mvebu/board-v7.c
@@ -188,7 +188,7 @@ static void __init thermal_quirk(void)
 
 static void __init mvebu_dt_init(void)
 {
-        if (of_machine_is_compatible("plathome,openblocks-ax3-4"))
+        if (of_machine_is_compatible("marvell,armadaxp"))
                 i2c_quirk();
         if (of_machine_is_compatible("marvell,a375-db")) {
                 external_abort_quirk();
diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
index 2bdc3233abe2..044b51185fcc 100644
--- a/arch/arm/mach-mvebu/coherency.c
+++ b/arch/arm/mach-mvebu/coherency.c
@@ -400,6 +400,8 @@ int __init coherency_init(void)
                  type == COHERENCY_FABRIC_TYPE_ARMADA_380)
                 armada_375_380_coherency_init(np);
 
+        of_node_put(np);
+
         return 0;
 }
 
diff --git a/arch/arm/mach-shmobile/clock-r8a7740.c b/arch/arm/mach-shmobile/clock-r8a7740.c
index 969e85dad09b..9cac8247c72b 100644
--- a/arch/arm/mach-shmobile/clock-r8a7740.c
+++ b/arch/arm/mach-shmobile/clock-r8a7740.c
@@ -451,7 +451,7 @@ enum {
         MSTP128, MSTP127, MSTP125,
         MSTP116, MSTP111, MSTP100, MSTP117,
 
-        MSTP230,
+        MSTP230, MSTP229,
         MSTP222,
         MSTP218, MSTP217, MSTP216, MSTP214,
         MSTP207, MSTP206, MSTP204, MSTP203, MSTP202, MSTP201, MSTP200,
@@ -470,11 +470,12 @@ static struct clk mstp_clks[MSTP_NR] = {
         [MSTP127] = SH_CLK_MSTP32(&div4_clks[DIV4_S],   SMSTPCR1, 27, 0), /* CEU20 */
         [MSTP125] = SH_CLK_MSTP32(&div6_clks[DIV6_SUB], SMSTPCR1, 25, 0), /* TMU0 */
         [MSTP117] = SH_CLK_MSTP32(&div4_clks[DIV4_B],   SMSTPCR1, 17, 0), /* LCDC1 */
-        [MSTP116] = SH_CLK_MSTP32(&div6_clks[DIV6_SUB], SMSTPCR1, 16, 0), /* IIC0 */
+        [MSTP116] = SH_CLK_MSTP32(&div4_clks[DIV4_HPP], SMSTPCR1, 16, 0), /* IIC0 */
         [MSTP111] = SH_CLK_MSTP32(&div6_clks[DIV6_SUB], SMSTPCR1, 11, 0), /* TMU1 */
         [MSTP100] = SH_CLK_MSTP32(&div4_clks[DIV4_B],   SMSTPCR1,  0, 0), /* LCDC0 */
 
         [MSTP230] = SH_CLK_MSTP32(&div6_clks[DIV6_SUB], SMSTPCR2, 30, 0), /* SCIFA6 */
+        [MSTP229] = SH_CLK_MSTP32(&div4_clks[DIV4_HP],  SMSTPCR2, 29, 0), /* INTCA */
         [MSTP222] = SH_CLK_MSTP32(&div6_clks[DIV6_SUB], SMSTPCR2, 22, 0), /* SCIFA7 */
         [MSTP218] = SH_CLK_MSTP32(&div4_clks[DIV4_HP],  SMSTPCR2, 18, 0), /* DMAC1 */
         [MSTP217] = SH_CLK_MSTP32(&div4_clks[DIV4_HP],  SMSTPCR2, 17, 0), /* DMAC2 */
@@ -571,6 +572,10 @@ static struct clk_lookup lookups[] = {
         CLKDEV_DEV_ID("sh-dma-engine.0",        &mstp_clks[MSTP218]),
         CLKDEV_DEV_ID("sh-sci.7",               &mstp_clks[MSTP222]),
         CLKDEV_DEV_ID("e6cd0000.serial",        &mstp_clks[MSTP222]),
+        CLKDEV_DEV_ID("renesas_intc_irqpin.0",  &mstp_clks[MSTP229]),
+        CLKDEV_DEV_ID("renesas_intc_irqpin.1",  &mstp_clks[MSTP229]),
+        CLKDEV_DEV_ID("renesas_intc_irqpin.2",  &mstp_clks[MSTP229]),
+        CLKDEV_DEV_ID("renesas_intc_irqpin.3",  &mstp_clks[MSTP229]),
         CLKDEV_DEV_ID("sh-sci.6",               &mstp_clks[MSTP230]),
         CLKDEV_DEV_ID("e6cc0000.serial",        &mstp_clks[MSTP230]),
 
diff --git a/arch/arm/mach-shmobile/clock-r8a7790.c b/arch/arm/mach-shmobile/clock-r8a7790.c
index c395ff194254..f9bbc5f0a9a1 100644
--- a/arch/arm/mach-shmobile/clock-r8a7790.c
+++ b/arch/arm/mach-shmobile/clock-r8a7790.c
@@ -64,7 +64,7 @@
 
 #define SDCKCR          0xE6150074
 #define SD2CKCR         0xE6150078
-#define SD3CKCR         0xE615007C
+#define SD3CKCR         0xE615026C
 #define MMC0CKCR        0xE6150240
 #define MMC1CKCR        0xE6150244
 #define SSPCKCR         0xE6150248
diff --git a/arch/arm/mach-shmobile/setup-sh73a0.c b/arch/arm/mach-shmobile/setup-sh73a0.c
index 1c8172dc2c6c..f2e01dc22a08 100644
--- a/arch/arm/mach-shmobile/setup-sh73a0.c
+++ b/arch/arm/mach-shmobile/setup-sh73a0.c
@@ -22,6 +22,7 @@
 #include <linux/of_platform.h>
 #include <linux/delay.h>
 #include <linux/input.h>
+#include <linux/i2c/i2c-sh_mobile.h>
 #include <linux/io.h>
 #include <linux/serial_sci.h>
 #include <linux/sh_dma.h>
@@ -188,11 +189,18 @@ static struct resource i2c4_resources[] = {
         },
 };
 
+static struct i2c_sh_mobile_platform_data i2c_platform_data = {
+        .clks_per_count = 2,
+};
+
 static struct platform_device i2c0_device = {
         .name           = "i2c-sh_mobile",
         .id             = 0,
         .resource       = i2c0_resources,
         .num_resources  = ARRAY_SIZE(i2c0_resources),
+        .dev            = {
+                .platform_data  = &i2c_platform_data,
+        },
 };
 
 static struct platform_device i2c1_device = {
@@ -200,6 +208,9 @@ static struct platform_device i2c1_device = {
         .id             = 1,
         .resource       = i2c1_resources,
         .num_resources  = ARRAY_SIZE(i2c1_resources),
+        .dev            = {
+                .platform_data  = &i2c_platform_data,
+        },
 };
 
 static struct platform_device i2c2_device = {
@@ -207,6 +218,9 @@ static struct platform_device i2c2_device = {
         .id             = 2,
         .resource       = i2c2_resources,
         .num_resources  = ARRAY_SIZE(i2c2_resources),
+        .dev            = {
+                .platform_data  = &i2c_platform_data,
+        },
 };
 
 static struct platform_device i2c3_device = {
@@ -214,6 +228,9 @@ static struct platform_device i2c3_device = {
         .id             = 3,
         .resource       = i2c3_resources,
         .num_resources  = ARRAY_SIZE(i2c3_resources),
+        .dev            = {
+                .platform_data  = &i2c_platform_data,
+        },
 };
 
 static struct platform_device i2c4_device = {
@@ -221,6 +238,9 @@ static struct platform_device i2c4_device = {
         .id             = 4,
         .resource       = i2c4_resources,
         .num_resources  = ARRAY_SIZE(i2c4_resources),
+        .dev            = {
+                .platform_data  = &i2c_platform_data,
+        },
 };
 
 static const struct sh_dmae_slave_config sh73a0_dmae_slaves[] = {
diff --git a/arch/arm/mach-tegra/irq.c b/arch/arm/mach-tegra/irq.c
index da7be13aecce..ab95f5391a2b 100644
--- a/arch/arm/mach-tegra/irq.c
+++ b/arch/arm/mach-tegra/irq.c
@@ -99,42 +99,42 @@ static inline void tegra_irq_write_mask(unsigned int irq, unsigned long reg)
 
 static void tegra_mask(struct irq_data *d)
 {
-        if (d->irq < FIRST_LEGACY_IRQ)
+        if (d->hwirq < FIRST_LEGACY_IRQ)
                 return;
 
-        tegra_irq_write_mask(d->irq, ICTLR_CPU_IER_CLR);
+        tegra_irq_write_mask(d->hwirq, ICTLR_CPU_IER_CLR);
 }
 
 static void tegra_unmask(struct irq_data *d)
 {
-        if (d->irq < FIRST_LEGACY_IRQ)
+        if (d->hwirq < FIRST_LEGACY_IRQ)
                 return;
 
-        tegra_irq_write_mask(d->irq, ICTLR_CPU_IER_SET);
+        tegra_irq_write_mask(d->hwirq, ICTLR_CPU_IER_SET);
 }
 
 static void tegra_ack(struct irq_data *d)
 {
-        if (d->irq < FIRST_LEGACY_IRQ)
+        if (d->hwirq < FIRST_LEGACY_IRQ)
                 return;
 
-        tegra_irq_write_mask(d->irq, ICTLR_CPU_IEP_FIR_CLR);
+        tegra_irq_write_mask(d->hwirq, ICTLR_CPU_IEP_FIR_CLR);
 }
 
 static void tegra_eoi(struct irq_data *d)
 {
-        if (d->irq < FIRST_LEGACY_IRQ)
+        if (d->hwirq < FIRST_LEGACY_IRQ)
                 return;
 
-        tegra_irq_write_mask(d->irq, ICTLR_CPU_IEP_FIR_CLR);
+        tegra_irq_write_mask(d->hwirq, ICTLR_CPU_IEP_FIR_CLR);
 }
 
 static int tegra_retrigger(struct irq_data *d)
 {
-        if (d->irq < FIRST_LEGACY_IRQ)
+        if (d->hwirq < FIRST_LEGACY_IRQ)
                 return 0;
 
-        tegra_irq_write_mask(d->irq, ICTLR_CPU_IEP_FIR_SET);
+        tegra_irq_write_mask(d->hwirq, ICTLR_CPU_IEP_FIR_SET);
 
         return 1;
 }
@@ -142,7 +142,7 @@ static int tegra_retrigger(struct irq_data *d)
 #ifdef CONFIG_PM_SLEEP
 static int tegra_set_wake(struct irq_data *d, unsigned int enable)
 {
-        u32 irq = d->irq;
+        u32 irq = d->hwirq;
         u32 index, mask;
 
         if (irq < FIRST_LEGACY_IRQ ||
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index ae69809a9e47..7eb94e6fc376 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -798,6 +798,7 @@ config NEED_KUSER_HELPERS
 
 config KUSER_HELPERS
         bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS
+        depends on MMU
         default y
         help
           Warning: disabling this option may break user programs.
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index b3a947863ac7..22ac2a6fbfe3 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -270,7 +270,6 @@ __v7_pj4b_setup:
 /* Auxiliary Debug Modes Control 1 Register */
 #define PJ4B_STATIC_BP (1 << 2) /* Enable Static BP */
 #define PJ4B_INTER_PARITY (1 << 8) /* Disable Internal Parity Handling */
-#define PJ4B_BCK_OFF_STREX (1 << 5) /* Enable the back off of STREX instr */
 #define PJ4B_CLEAN_LINE (1 << 16) /* Disable data transfer for clean line */
 
 /* Auxiliary Debug Modes Control 2 Register */
@@ -293,7 +292,6 @@ __v7_pj4b_setup:
         /* Auxiliary Debug Modes Control 1 Register */
         mrc     p15, 1, r0, c15, c1, 1
         orr     r0, r0, #PJ4B_CLEAN_LINE
-        orr     r0, r0, #PJ4B_BCK_OFF_STREX
         orr     r0, r0, #PJ4B_INTER_PARITY
         bic     r0, r0, #PJ4B_STATIC_BP
         mcr     p15, 1, r0, c15, c1, 1
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index 23259f104c66..afa2b3c4df4a 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -535,7 +535,7 @@ ENTRY(cpu_xscale_do_suspend)
         mrc     p15, 0, r5, c15, c1, 0  @ CP access reg
         mrc     p15, 0, r6, c13, c0, 0  @ PID
         mrc     p15, 0, r7, c3, c0, 0   @ domain ID
-        mrc     p15, 0, r8, c1, c1, 0   @ auxiliary control reg
+        mrc     p15, 0, r8, c1, c0, 1   @ auxiliary control reg
         mrc     p15, 0, r9, c1, c0, 0   @ control reg
         bic     r4, r4, #2              @ clear frequency change bit
         stmia   r0, {r4 - r9}           @ store cp regs
@@ -552,7 +552,7 @@ ENTRY(cpu_xscale_do_resume)
         mcr     p15, 0, r6, c13, c0, 0  @ PID
         mcr     p15, 0, r7, c3, c0, 0   @ domain ID
         mcr     p15, 0, r1, c2, c0, 0   @ translation table base addr
-        mcr     p15, 0, r8, c1, c1, 0   @ auxiliary control reg
+        mcr     p15, 0, r8, c1, c0, 1   @ auxiliary control reg
         mov     r0, r9                  @ control register
         b       cpu_resume_mmu
 ENDPROC(cpu_xscale_do_resume)
diff --git a/arch/arm/plat-orion/gpio.c b/arch/arm/plat-orion/gpio.c
index b61a3bcc2fa8..e048f6198d68 100644
--- a/arch/arm/plat-orion/gpio.c
+++ b/arch/arm/plat-orion/gpio.c
@@ -497,6 +497,34 @@ static void orion_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
 #define orion_gpio_dbg_show NULL
 #endif
 
+static void orion_gpio_unmask_irq(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        struct irq_chip_type *ct = irq_data_get_chip_type(d);
+        u32 reg_val;
+        u32 mask = d->mask;
+
+        irq_gc_lock(gc);
+        reg_val = irq_reg_readl(gc->reg_base + ct->regs.mask);
+        reg_val |= mask;
+        irq_reg_writel(reg_val, gc->reg_base + ct->regs.mask);
+        irq_gc_unlock(gc);
+}
+
+static void orion_gpio_mask_irq(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        struct irq_chip_type *ct = irq_data_get_chip_type(d);
+        u32 mask = d->mask;
+        u32 reg_val;
+
+        irq_gc_lock(gc);
+        reg_val = irq_reg_readl(gc->reg_base + ct->regs.mask);
+        reg_val &= ~mask;
+        irq_reg_writel(reg_val, gc->reg_base + ct->regs.mask);
+        irq_gc_unlock(gc);
+}
+
 void __init orion_gpio_init(struct device_node *np,
                             int gpio_base, int ngpio,
                             void __iomem *base, int mask_offset,
@@ -565,8 +593,8 @@ void __init orion_gpio_init(struct device_node *np,
         ct = gc->chip_types;
         ct->regs.mask = ochip->mask_offset + GPIO_LEVEL_MASK_OFF;
         ct->type = IRQ_TYPE_LEVEL_HIGH | IRQ_TYPE_LEVEL_LOW;
-        ct->chip.irq_mask = irq_gc_mask_clr_bit;
-        ct->chip.irq_unmask = irq_gc_mask_set_bit;
+        ct->chip.irq_mask = orion_gpio_mask_irq;
+        ct->chip.irq_unmask = orion_gpio_unmask_irq;
         ct->chip.irq_set_type = gpio_irq_set_type;
         ct->chip.name = ochip->chip.label;
 
@@ -575,8 +603,8 @@ void __init orion_gpio_init(struct device_node *np,
         ct->regs.ack = GPIO_EDGE_CAUSE_OFF;
         ct->type = IRQ_TYPE_EDGE_RISING | IRQ_TYPE_EDGE_FALLING;
         ct->chip.irq_ack = irq_gc_ack_clr_bit;
-        ct->chip.irq_mask = irq_gc_mask_clr_bit;
-        ct->chip.irq_unmask = irq_gc_mask_set_bit;
+        ct->chip.irq_mask = orion_gpio_mask_irq;
+        ct->chip.irq_unmask = orion_gpio_unmask_irq;
         ct->chip.irq_set_type = gpio_irq_set_type;
         ct->handler = handle_edge_irq;
         ct->chip.name = ochip->chip.label;
diff --git a/arch/arm64/boot/dts/apm-storm.dtsi b/arch/arm64/boot/dts/apm-storm.dtsi
index 295c72d52a1f..f1ad9c2ab2e9 100644
--- a/arch/arm64/boot/dts/apm-storm.dtsi
+++ b/arch/arm64/boot/dts/apm-storm.dtsi
@@ -599,7 +599,7 @@
                         compatible = "apm,xgene-enet";
                         status = "disabled";
                         reg = <0x0 0x17020000 0x0 0xd100>,
-                              <0x0 0X17030000 0x0 0X400>,
+                              <0x0 0X17030000 0x0 0Xc300>,
                               <0x0 0X10000000 0x0 0X200>;
                         reg-names = "enet_csr", "ring_csr", "ring_cmd";
                         interrupts = <0x0 0x3c 0x4>;
@@ -624,9 +624,9 @@
                 sgenet0: ethernet@1f210000 {
                         compatible = "apm,xgene-enet";
                         status = "disabled";
-                        reg = <0x0 0x1f210000 0x0 0x10000>,
-                              <0x0 0x1f200000 0x0 0X10000>,
-                              <0x0 0x1B000000 0x0 0X20000>;
+                        reg = <0x0 0x1f210000 0x0 0xd100>,
+                              <0x0 0x1f200000 0x0 0Xc300>,
+                              <0x0 0x1B000000 0x0 0X200>;
                         reg-names = "enet_csr", "ring_csr", "ring_cmd";
                         interrupts = <0x0 0xA0 0x4>;
                         dma-coherent;
@@ -639,7 +639,7 @@
                         compatible = "apm,xgene-enet";
                         status = "disabled";
                         reg = <0x0 0x1f610000 0x0 0xd100>,
-                              <0x0 0x1f600000 0x0 0X400>,
+                              <0x0 0x1f600000 0x0 0Xc300>,
                               <0x0 0x18000000 0x0 0X200>;
                         reg-names = "enet_csr", "ring_csr", "ring_cmd";
                         interrupts = <0x0 0x60 0x4>;
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index ccc7087d3c4e..a62cd077457b 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -142,7 +142,7 @@ static inline void *phys_to_virt(phys_addr_t x)
  *  virt_to_page(k)     convert a _valid_ virtual address to struct page *
  *  virt_addr_valid(k)  indicates whether a virtual address is valid
  */
-#define ARCH_PFN_OFFSET         PHYS_PFN_OFFSET
+#define ARCH_PFN_OFFSET         ((unsigned long)PHYS_PFN_OFFSET)
 
 #define virt_to_page(kaddr)     pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
 #define virt_addr_valid(kaddr)  pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
diff --git a/arch/arm64/kernel/efi-entry.S b/arch/arm64/kernel/efi-entry.S
index 619b1dd7bcde..d18a44940968 100644
--- a/arch/arm64/kernel/efi-entry.S
+++ b/arch/arm64/kernel/efi-entry.S
@@ -54,18 +54,17 @@ ENTRY(efi_stub_entry)
         b.eq    efi_load_fail
 
         /*
-         * efi_entry() will have relocated the kernel image if necessary
-         * and we return here with device tree address in x0 and the kernel
-         * entry point stored at *image_addr. Save those values in registers
-         * which are callee preserved.
+         * efi_entry() will have copied the kernel image if necessary and we
+         * return here with device tree address in x0 and the kernel entry
+         * point stored at *image_addr. Save those values in registers which
+         * are callee preserved.
          */
         mov     x20, x0         // DTB address
         ldr     x0, [sp, #16]   // relocated _text address
         mov     x21, x0
 
         /*
-         * Flush dcache covering current runtime addresses
-         * of kernel text/data. Then flush all of icache.
+         * Calculate size of the kernel Image (same for original and copy).
          */
         adrp    x1, _text
         add     x1, x1, #:lo12:_text
@@ -73,9 +72,24 @@ ENTRY(efi_stub_entry)
         add     x2, x2, #:lo12:_edata
         sub     x1, x2, x1
 
+        /*
+         * Flush the copied Image to the PoC, and ensure it is not shadowed by
+         * stale icache entries from before relocation.
+         */
         bl      __flush_dcache_area
         ic      ialluis
 
+        /*
+         * Ensure that the rest of this function (in the original Image) is
+         * visible when the caches are disabled. The I-cache can't have stale
+         * entries for the VA range of the current image, so no maintenance is
+         * necessary.
+         */
+        adr     x0, efi_stub_entry
+        adr     x1, efi_stub_entry_end
+        sub     x1, x1, x0
+        bl      __flush_dcache_area
+
         /* Turn off Dcache and MMU */
         mrs     x0, CurrentEL
         cmp     x0, #CurrentEL_EL2
@@ -105,4 +119,5 @@ efi_load_fail:
         ldp     x29, x30, [sp], #32
         ret
 
+efi_stub_entry_end:
 ENDPROC(efi_stub_entry)
diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
index e007714ded04..8cd27fedc8b6 100644
--- a/arch/arm64/kernel/insn.c
+++ b/arch/arm64/kernel/insn.c
@@ -163,9 +163,10 @@ static int __kprobes aarch64_insn_patch_text_cb(void *arg)
                  * which ends with "dsb; isb" pair guaranteeing global
                  * visibility.
                  */
-                atomic_set(&pp->cpu_count, -1);
+                /* Notify other processors with an additional increment. */
+                atomic_inc(&pp->cpu_count);
         } else {
-                while (atomic_read(&pp->cpu_count) != -1)
+                while (atomic_read(&pp->cpu_count) <= num_online_cpus())
                         cpu_relax();
                 isb();
         }
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 4cc3b719208e..3d7c2df89946 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -424,6 +424,11 @@ static const struct sys_reg_desc sys_reg_descs[] = {
         /* VBAR_EL1 */
         { Op0(0b11), Op1(0b000), CRn(0b1100), CRm(0b0000), Op2(0b000),
           NULL, reset_val, VBAR_EL1, 0 },
+
+        /* ICC_SRE_EL1 */
+        { Op0(0b11), Op1(0b000), CRn(0b1100), CRm(0b1100), Op2(0b101),
+          trap_raz_wi },
+
         /* CONTEXTIDR_EL1 */
         { Op0(0b11), Op1(0b000), CRn(0b1101), CRm(0b0000), Op2(0b001),
           access_vm_reg, reset_val, CONTEXTIDR_EL1, 0 },
@@ -690,6 +695,10 @@ static const struct sys_reg_desc cp15_regs[] = {
         { Op1( 0), CRn(10), CRm( 2), Op2( 1), access_vm_reg, NULL, c10_NMRR },
         { Op1( 0), CRn(10), CRm( 3), Op2( 0), access_vm_reg, NULL, c10_AMAIR0 },
         { Op1( 0), CRn(10), CRm( 3), Op2( 1), access_vm_reg, NULL, c10_AMAIR1 },
+
+        /* ICC_SRE */
+        { Op1( 0), CRn(12), CRm(12), Op2( 5), trap_raz_wi },
+
         { Op1( 0), CRn(13), CRm( 0), Op2( 1), access_vm_reg, NULL, c13_CID },
 };
 
diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S
index 6e0ed93d51fe..c17967fdf5f6 100644
--- a/arch/arm64/lib/clear_user.S
+++ b/arch/arm64/lib/clear_user.S
@@ -46,7 +46,7 @@ USER(9f, strh	wzr, [x0], #2	)
         sub     x1, x1, #2
 4:      adds    x1, x1, #1
         b.mi    5f
-        strb    wzr, [x0]
+USER(9f, strb   wzr, [x0]       )
 5:      mov     x0, #0
         ret
 ENDPROC(__clear_user)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 0bf90d26e745..f4f8b500f74c 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -202,7 +202,7 @@ static void __init alloc_init_pmd(pud_t *pud, unsigned long addr,
 }
 
 static void __init alloc_init_pud(pgd_t *pgd, unsigned long addr,
-                                  unsigned long end, unsigned long phys,
+                                  unsigned long end, phys_addr_t phys,
                                   int map_io)
 {
         pud_t *pud;
diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
index ec6b9acb6bea..dbe46f43884d 100644
--- a/arch/ia64/kvm/kvm-ia64.c
+++ b/arch/ia64/kvm/kvm-ia64.c
@@ -1563,7 +1563,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
 
         for (i = 0; i < npages; i++) {
                 pfn = gfn_to_pfn(kvm, base_gfn + i);
-                if (!kvm_is_mmio_pfn(pfn)) {
+                if (!kvm_is_reserved_pfn(pfn)) {
                         kvm_set_pmt_entry(kvm, base_gfn + i,
                                         pfn << PAGE_SHIFT,
                                 _PAGE_AR_RWX | _PAGE_MA_WB);
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index f43aa536c517..9536ef912f59 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -2101,9 +2101,17 @@ config 64BIT_PHYS_ADDR
 config ARCH_PHYS_ADDR_T_64BIT
        def_bool 64BIT_PHYS_ADDR
 
+choice
+        prompt "SmartMIPS or microMIPS ASE support"
+
+config CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS
+        bool "None"
+        help
+          Select this if you want neither microMIPS nor SmartMIPS support
+
 config CPU_HAS_SMARTMIPS
         depends on SYS_SUPPORTS_SMARTMIPS
-        bool "Support for the SmartMIPS ASE"
+        bool "SmartMIPS"
         help
           SmartMIPS is a extension of the MIPS32 architecture aimed at
           increased security at both hardware and software level for
@@ -2115,11 +2123,13 @@ config CPU_HAS_SMARTMIPS
 
 config CPU_MICROMIPS
         depends on SYS_SUPPORTS_MICROMIPS
-        bool "Build kernel using microMIPS ISA"
+        bool "microMIPS"
         help
           When this option is enabled the kernel will be built using the
           microMIPS ISA
 
+endchoice
+
 config CPU_HAS_MSA
         bool "Support for the MIPS SIMD Architecture (EXPERIMENTAL)"
         depends on CPU_SUPPORTS_MSA
diff --git a/arch/mips/include/asm/jump_label.h b/arch/mips/include/asm/jump_label.h
index e194f957ca8c..fdbff44e5482 100644
--- a/arch/mips/include/asm/jump_label.h
+++ b/arch/mips/include/asm/jump_label.h
@@ -20,9 +20,15 @@
 #define WORD_INSN ".word"
 #endif
 
+#ifdef CONFIG_CPU_MICROMIPS
+#define NOP_INSN "nop32"
+#else
+#define NOP_INSN "nop"
+#endif
+
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm_volatile_goto("1:\tnop\n\t"
+        asm_volatile_goto("1:\t" NOP_INSN "\n\t"
                 "nop\n\t"
                 ".pushsection __jump_table,  \"aw\"\n\t"
                 WORD_INSN " 1b, %l[l_yes], %0\n\t"
diff --git a/arch/mips/include/asm/mach-loongson/cpu-feature-overrides.h b/arch/mips/include/asm/mach-loongson/cpu-feature-overrides.h
index 7d28f95b0512..6d69332f21ec 100644
--- a/arch/mips/include/asm/mach-loongson/cpu-feature-overrides.h
+++ b/arch/mips/include/asm/mach-loongson/cpu-feature-overrides.h
@@ -41,10 +41,8 @@
 #define cpu_has_mcheck          0
 #define cpu_has_mdmx            0
 #define cpu_has_mips16          0
-#define cpu_has_mips32r1        0
 #define cpu_has_mips32r2        0
 #define cpu_has_mips3d          0
-#define cpu_has_mips64r1        0
 #define cpu_has_mips64r2        0
 #define cpu_has_mipsmt          0
 #define cpu_has_prefetch        0
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index b46cd220a018..22a135ac91de 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -661,6 +661,8 @@
 #define MIPS_CONF6_SYND         (_ULCAST_(1) << 13)
 /* proAptiv FTLB on/off bit */
 #define MIPS_CONF6_FTLBEN       (_ULCAST_(1) << 15)
+/* FTLB probability bits */
+#define MIPS_CONF6_FTLBP_SHIFT  (16)
 
 #define MIPS_CONF7_WII          (_ULCAST_(1) << 31)
 
diff --git a/arch/mips/include/asm/r4kcache.h b/arch/mips/include/asm/r4kcache.h
index 4520adc8699b..cd6e0afc6833 100644
--- a/arch/mips/include/asm/r4kcache.h
+++ b/arch/mips/include/asm/r4kcache.h
@@ -257,7 +257,11 @@ static inline void protected_flush_icache_line(unsigned long addr)
  */
 static inline void protected_writeback_dcache_line(unsigned long addr)
 {
+#ifdef CONFIG_EVA
+        protected_cachee_op(Hit_Writeback_Inv_D, addr);
+#else
         protected_cache_op(Hit_Writeback_Inv_D, addr);
+#endif
 }
 
 static inline void protected_writeback_scache_line(unsigned long addr)
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index a10951090234..22a5624e2fd2 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -301,7 +301,8 @@ do {									\
                         __get_kernel_common((x), size, __gu_ptr);       \
                 else                                                    \
                         __get_user_common((x), size, __gu_ptr);         \
-        }                                                               \
+        } else                                                          \
+                (x) = 0;                                                \
                                                                         \
         __gu_err;                                                       \
 })
@@ -316,6 +317,7 @@ do {									\
         "       .insn                                           \n"     \
         "       .section .fixup,\"ax\"                          \n"     \
         "3:     li      %0, %4                                  \n"     \
+        "       move    %1, $0                                  \n"     \
         "       j       2b                                      \n"     \
         "       .previous                                       \n"     \
         "       .section __ex_table,\"a\"                       \n"     \
@@ -630,6 +632,7 @@ do {									\
         "       .insn                                           \n"     \
         "       .section .fixup,\"ax\"                          \n"     \
         "3:     li      %0, %4                                  \n"     \
+        "       move    %1, $0                                  \n"     \
         "       j       2b                                      \n"     \
         "       .previous                                       \n"     \
         "       .section __ex_table,\"a\"                       \n"     \
@@ -773,10 +776,11 @@ extern void __put_user_unaligned_unknown(void);
         "jal\t" #destination "\n\t"
 #endif
 
-#ifndef CONFIG_CPU_DADDI_WORKAROUNDS
-#define DADDI_SCRATCH "$0"
-#else
+#if defined(CONFIG_CPU_DADDI_WORKAROUNDS) || (defined(CONFIG_EVA) &&    \
+                                              defined(CONFIG_CPU_HAS_PREFETCH))
 #define DADDI_SCRATCH "$3"
+#else
+#define DADDI_SCRATCH "$0"
 #endif
 
 extern size_t __copy_user(void *__to, const void *__from, size_t __n);
@@ -1418,7 +1422,7 @@ static inline long __strnlen_user(const char __user *s, long n)
 }
 
 /*
- * strlen_user: - Get the size of a string in user space.
+ * strnlen_user: - Get the size of a string in user space.
  * @str: The string to measure.
  *
  * Context: User context only.  This function may sleep.
@@ -1427,9 +1431,7 @@ static inline long __strnlen_user(const char __user *s, long n)
  *
  * Returns the size of the string INCLUDING the terminating NUL.
  * On exception, returns 0.
- *
- * If there is a limit on the length of a valid string, you may wish to
- * consider using strnlen_user() instead.
+ * If the string is too long, returns a value greater than @n.
  */
 static inline long strnlen_user(const char __user *s, long n)
 {
diff --git a/arch/mips/include/uapi/asm/unistd.h b/arch/mips/include/uapi/asm/unistd.h
index 9dc58568f230..d001bb1ad177 100644
--- a/arch/mips/include/uapi/asm/unistd.h
+++ b/arch/mips/include/uapi/asm/unistd.h
@@ -1045,7 +1045,7 @@
 #define __NR_seccomp                    (__NR_Linux + 316)
 #define __NR_getrandom                  (__NR_Linux + 317)
 #define __NR_memfd_create               (__NR_Linux + 318)
-#define __NR_memfd_create               (__NR_Linux + 319)
+#define __NR_bpf                        (__NR_Linux + 319)
 
 /*
  * Offset of the last N32 flavoured syscall
diff --git a/arch/mips/kernel/bmips_vec.S b/arch/mips/kernel/bmips_vec.S
index 290c23b51678..86495072a922 100644
--- a/arch/mips/kernel/bmips_vec.S
+++ b/arch/mips/kernel/bmips_vec.S
@@ -208,7 +208,6 @@ bmips_reset_nmi_vec_end:
 END(bmips_reset_nmi_vec)
 
         .set    pop
-        .previous
 
 /***********************************************************************
  * CPU1 warm restart vector (used for second and subsequent boots).
@@ -281,5 +280,3 @@ LEAF(bmips_enable_xks01)
         jr      ra
 
 END(bmips_enable_xks01)
-
-        .previous
diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
index e6e97d2a5c9e..0384b05ab5a0 100644
--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -229,6 +229,7 @@ LEAF(mips_cps_core_init)
          nop
 
         .set    push
+        .set    mips32r2
         .set    mt
 
         /* Only allow 1 TC per VPE to execute... */
@@ -345,6 +346,7 @@ LEAF(mips_cps_boot_vpes)
          nop
 
         .set    push
+        .set    mips32r2
         .set    mt
 
 1:      /* Enter VPE configuration state */
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 94c4a0c0a577..dc49cf30c2db 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -193,6 +193,32 @@ static void set_isa(struct cpuinfo_mips *c, unsigned int isa)
 static char unknown_isa[] = KERN_ERR \
         "Unsupported ISA type, c0.config0: %d.";
 
+static unsigned int calculate_ftlb_probability(struct cpuinfo_mips *c)
+{
+
+        unsigned int probability = c->tlbsize / c->tlbsizevtlb;
+
+        /*
+         * 0 = All TLBWR instructions go to FTLB
+         * 1 = 15:1: For every 16 TBLWR instructions, 15 go to the
+         * FTLB and 1 goes to the VTLB.
+         * 2 = 7:1: As above with 7:1 ratio.
+         * 3 = 3:1: As above with 3:1 ratio.
+         *
+         * Use the linear midpoint as the probability threshold.
+         */
+        if (probability >= 12)
+                return 1;
+        else if (probability >= 6)
+                return 2;
+        else
+                /*
+                 * So FTLB is less than 4 times bigger than VTLB.
+                 * A 3:1 ratio can still be useful though.
+                 */
+                return 3;
+}
+
 static void set_ftlb_enable(struct cpuinfo_mips *c, int enable)
 {
         unsigned int config6;
@@ -203,9 +229,14 @@ static void set_ftlb_enable(struct cpuinfo_mips *c, int enable)
         case CPU_P5600:
                 /* proAptiv & related cores use Config6 to enable the FTLB */
                 config6 = read_c0_config6();
+                /* Clear the old probability value */
+                config6 &= ~(3 << MIPS_CONF6_FTLBP_SHIFT);
                 if (enable)
                         /* Enable FTLB */
-                        write_c0_config6(config6 | MIPS_CONF6_FTLBEN);
+                        write_c0_config6(config6 |
+                                         (calculate_ftlb_probability(c)
+                                          << MIPS_CONF6_FTLBP_SHIFT)
+                                         | MIPS_CONF6_FTLBEN);
                 else
                         /* Disable FTLB */
                         write_c0_config6(config6 &  ~MIPS_CONF6_FTLBEN);
@@ -757,31 +788,34 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
                         c->cputype = CPU_LOONGSON2;
                         __cpu_name[cpu] = "ICT Loongson-2";
                         set_elf_platform(cpu, "loongson2e");
+                        set_isa(c, MIPS_CPU_ISA_III);
                         break;
                 case PRID_REV_LOONGSON2F:
                         c->cputype = CPU_LOONGSON2;
                         __cpu_name[cpu] = "ICT Loongson-2";
                         set_elf_platform(cpu, "loongson2f");
+                        set_isa(c, MIPS_CPU_ISA_III);
                         break;
                 case PRID_REV_LOONGSON3A:
                         c->cputype = CPU_LOONGSON3;
-                        c->writecombine = _CACHE_UNCACHED_ACCELERATED;
                         __cpu_name[cpu] = "ICT Loongson-3";
                         set_elf_platform(cpu, "loongson3a");
+                        set_isa(c, MIPS_CPU_ISA_M64R1);
                         break;
                 case PRID_REV_LOONGSON3B_R1:
                 case PRID_REV_LOONGSON3B_R2:
                         c->cputype = CPU_LOONGSON3;
                         __cpu_name[cpu] = "ICT Loongson-3";
                         set_elf_platform(cpu, "loongson3b");
+                        set_isa(c, MIPS_CPU_ISA_M64R1);
                         break;
                 }
 
-                set_isa(c, MIPS_CPU_ISA_III);
                 c->options = R4K_OPTS |
                              MIPS_CPU_FPU | MIPS_CPU_LLSC |
                              MIPS_CPU_32FPR;
                 c->tlbsize = 64;
+                c->writecombine = _CACHE_UNCACHED_ACCELERATED;
                 break;
         case PRID_IMP_LOONGSON_32:  /* Loongson-1 */
                 decode_configs(c);
diff --git a/arch/mips/kernel/jump_label.c b/arch/mips/kernel/jump_label.c
index 6001610cfe55..dda800e9e731 100644
--- a/arch/mips/kernel/jump_label.c
+++ b/arch/mips/kernel/jump_label.c
@@ -18,31 +18,53 @@
 
 #ifdef HAVE_JUMP_LABEL
 
-#define J_RANGE_MASK ((1ul << 28) - 1)
+/*
+ * Define parameters for the standard MIPS and the microMIPS jump
+ * instruction encoding respectively:
+ *
+ * - the ISA bit of the target, either 0 or 1 respectively,
+ *
+ * - the amount the jump target address is shifted right to fit in the
+ *   immediate field of the machine instruction, either 2 or 1,
+ *
+ * - the mask determining the size of the jump region relative to the
+ *   delay-slot instruction, either 256MB or 128MB,
+ *
+ * - the jump target alignment, either 4 or 2 bytes.
+ */
+#define J_ISA_BIT       IS_ENABLED(CONFIG_CPU_MICROMIPS)
+#define J_RANGE_SHIFT   (2 - J_ISA_BIT)
+#define J_RANGE_MASK    ((1ul << (26 + J_RANGE_SHIFT)) - 1)
+#define J_ALIGN_MASK    ((1ul << J_RANGE_SHIFT) - 1)
 
 void arch_jump_label_transform(struct jump_entry *e,
                                enum jump_label_type type)
 {
+        union mips_instruction *insn_p;
         union mips_instruction insn;
-        union mips_instruction *insn_p =
-                (union mips_instruction *)(unsigned long)e->code;
 
-        /* Jump only works within a 256MB aligned region. */
-        BUG_ON((e->target & ~J_RANGE_MASK) != (e->code & ~J_RANGE_MASK));
+        insn_p = (union mips_instruction *)msk_isa16_mode(e->code);
+
+        /* Jump only works within an aligned region its delay slot is in. */
+        BUG_ON((e->target & ~J_RANGE_MASK) != ((e->code + 4) & ~J_RANGE_MASK));
 
-        /* Target must have 4 byte alignment. */
-        BUG_ON((e->target & 3) != 0);
+        /* Target must have the right alignment and ISA must be preserved. */
+        BUG_ON((e->target & J_ALIGN_MASK) != J_ISA_BIT);
 
         if (type == JUMP_LABEL_ENABLE) {
-                insn.j_format.opcode = j_op;
-                insn.j_format.target = (e->target & J_RANGE_MASK) >> 2;
+                insn.j_format.opcode = J_ISA_BIT ? mm_j32_op : j_op;
+                insn.j_format.target = e->target >> J_RANGE_SHIFT;
         } else {
                 insn.word = 0; /* nop */
         }
 
         get_online_cpus();
         mutex_lock(&text_mutex);
-        *insn_p = insn;
+        if (IS_ENABLED(CONFIG_CPU_MICROMIPS)) {
+                insn_p->halfword[0] = insn.word >> 16;
+                insn_p->halfword[1] = insn.word;
+        } else
+                *insn_p = insn;
 
         flush_icache_range((unsigned long)insn_p,
                            (unsigned long)insn_p + sizeof(*insn_p));
diff --git a/arch/mips/kernel/rtlx.c b/arch/mips/kernel/rtlx.c
index 31b1b763cb29..c5c4fd54d797 100644
--- a/arch/mips/kernel/rtlx.c
+++ b/arch/mips/kernel/rtlx.c
@@ -94,12 +94,12 @@ int rtlx_open(int index, int can_sleep)
         int ret = 0;
 
         if (index >= RTLX_CHANNELS) {
-                pr_debug(KERN_DEBUG "rtlx_open index out of range\n");
+                pr_debug("rtlx_open index out of range\n");
                 return -ENOSYS;
         }
 
         if (atomic_inc_return(&channel_wqs[index].in_open) > 1) {
-                pr_debug(KERN_DEBUG "rtlx_open channel %d already opened\n", index);
+                pr_debug("rtlx_open channel %d already opened\n", index);
                 ret = -EBUSY;
                 goto out_fail;
         }
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index d21ec57b6e95..f3b635f86c39 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -485,7 +485,7 @@ static void __init bootmem_init(void)
  * NOTE: historically plat_mem_setup did the entire platform initialization.
  *       This was rather impractical because it meant plat_mem_setup had to
  * get away without any kind of memory allocator.  To keep old code from
- * breaking plat_setup was just renamed to plat_setup and a second platform
+ * breaking plat_setup was just renamed to plat_mem_setup and a second platform
  * initialization hook for anything else was introduced.
  */
 
@@ -493,7 +493,7 @@ static int usermem __initdata;
 
 static int __init early_parse_mem(char *p)
 {
-        unsigned long start, size;
+        phys_t start, size;
 
         /*
          * If a user specifies memory size, we
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 1d57605e4615..16f1e4f2bf3c 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -658,13 +658,13 @@ static int signal_setup(void)
                 save_fp_context = _save_fp_context;
                 restore_fp_context = _restore_fp_context;
         } else {
-                save_fp_context = copy_fp_from_sigcontext;
-                restore_fp_context = copy_fp_to_sigcontext;
+                save_fp_context = copy_fp_to_sigcontext;
+                restore_fp_context = copy_fp_from_sigcontext;
         }
 #endif /* CONFIG_SMP */
 #else
-        save_fp_context = copy_fp_from_sigcontext;;
-        restore_fp_context = copy_fp_to_sigcontext;
+        save_fp_context = copy_fp_to_sigcontext;
+        restore_fp_context = copy_fp_from_sigcontext;
 #endif
 
         return 0;
diff --git a/arch/mips/lib/memcpy.S b/arch/mips/lib/memcpy.S
index c17ef80cf65a..5d3238af9b5c 100644
--- a/arch/mips/lib/memcpy.S
+++ b/arch/mips/lib/memcpy.S
@@ -503,6 +503,7 @@
         STOREB(t0, NBYTES-2(dst), .Ls_exc_p1\@)
 .Ldone\@:
         jr      ra
+         nop
         .if __memcpy == 1
         END(memcpy)
         .set __memcpy, 0
diff --git a/arch/mips/loongson/common/Makefile b/arch/mips/loongson/common/Makefile
index 0bb9cc9dc621..d87e03330b29 100644
--- a/arch/mips/loongson/common/Makefile
+++ b/arch/mips/loongson/common/Makefile
@@ -11,7 +11,8 @@ obj-$(CONFIG_PCI) += pci.o
 # Serial port support
 #
 obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
-obj-$(CONFIG_SERIAL_8250) += serial.o
+loongson-serial-$(CONFIG_SERIAL_8250) := serial.o
+obj-y += $(loongson-serial-m) $(loongson-serial-y)
 obj-$(CONFIG_LOONGSON_UART_BASE) += uart_base.o
 obj-$(CONFIG_LOONGSON_MC146818) += rtc.o
 
diff --git a/arch/mips/loongson/loongson-3/numa.c b/arch/mips/loongson/loongson-3/numa.c
index 37ed184398c6..42323bcc5d28 100644
--- a/arch/mips/loongson/loongson-3/numa.c
+++ b/arch/mips/loongson/loongson-3/numa.c
@@ -33,6 +33,7 @@
 
 static struct node_data prealloc__node_data[MAX_NUMNODES];
 unsigned char __node_distances[MAX_NUMNODES][MAX_NUMNODES];
+EXPORT_SYMBOL(__node_distances);
 struct node_data *__node_data[MAX_NUMNODES];
 EXPORT_SYMBOL(__node_data);
 
diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index fa6ebd4bc9e9..c3917e251f59 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -299,6 +299,7 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
 
         local_irq_save(flags);
 
+        htw_stop();
         pid = read_c0_entryhi() & ASID_MASK;
         address &= (PAGE_MASK << 1);
         write_c0_entryhi(address | pid);
@@ -346,6 +347,7 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
                         tlb_write_indexed();
         }
         tlbw_use_hazard();
+        htw_start();
         flush_itlb_vm(vma);
         local_irq_restore(flags);
 }
@@ -422,6 +424,7 @@ __init int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
 
         local_irq_save(flags);
         /* Save old context and create impossible VPN2 value */
+        htw_stop();
         old_ctx = read_c0_entryhi();
         old_pagemask = read_c0_pagemask();
         wired = read_c0_wired();
@@ -443,6 +446,7 @@ __init int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
 
         write_c0_entryhi(old_ctx);
         write_c0_pagemask(old_pagemask);
+        htw_start();
 out:
         local_irq_restore(flags);
         return ret;
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index b5f228e7eae6..e3328a96e809 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -1872,8 +1872,16 @@ build_r4000_tlbchange_handler_head(u32 **p, struct uasm_label **l,
         uasm_l_smp_pgtable_change(l, *p);
 #endif
         iPTE_LW(p, wr.r1, wr.r2); /* get even pte */
-        if (!m4kc_tlbp_war())
+        if (!m4kc_tlbp_war()) {
                 build_tlb_probe_entry(p);
+                if (cpu_has_htw) {
+                        /* race condition happens, leaving */
+                        uasm_i_ehb(p);
+                        uasm_i_mfc0(p, wr.r3, C0_INDEX);
+                        uasm_il_bltz(p, r, wr.r3, label_leave);
+                        uasm_i_nop(p);
+                }
+        }
         return wr;
 }
 
diff --git a/arch/mips/mti-sead3/sead3-leds.c b/arch/mips/mti-sead3/sead3-leds.c
index 20102a6d4141..c427c5778186 100644
--- a/arch/mips/mti-sead3/sead3-leds.c
+++ b/arch/mips/mti-sead3/sead3-leds.c
@@ -5,7 +5,7 @@
  *
  * Copyright (C) 2012 MIPS Technologies, Inc.  All rights reserved.
  */
-#include <linux/module.h>
+#include <linux/init.h>
 #include <linux/leds.h>
 #include <linux/platform_device.h>
 
@@ -76,8 +76,4 @@ static int __init led_init(void)
         return platform_device_register(&fled_device);
 }
 
-module_init(led_init);
-
-MODULE_AUTHOR("Chris Dearman <chris@mips.com>");
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("LED probe driver for SEAD-3");
+device_initcall(led_init);
diff --git a/arch/mips/netlogic/xlp/Makefile b/arch/mips/netlogic/xlp/Makefile
index be358a8050c5..6b43af0a34d9 100644
--- a/arch/mips/netlogic/xlp/Makefile
+++ b/arch/mips/netlogic/xlp/Makefile
@@ -1,6 +1,10 @@
 obj-y                           += setup.o nlm_hal.o cop2-ex.o dt.o
 obj-$(CONFIG_SMP)               += wakeup.o
-obj-$(CONFIG_USB)               += usb-init.o
-obj-$(CONFIG_USB)               += usb-init-xlp2.o
-obj-$(CONFIG_SATA_AHCI)         += ahci-init.o
-obj-$(CONFIG_SATA_AHCI)         += ahci-init-xlp2.o
+ifdef CONFIG_USB
+obj-y                           += usb-init.o
+obj-y                           += usb-init-xlp2.o
+endif
+ifdef CONFIG_SATA_AHCI
+obj-y                           += ahci-init.o
+obj-y                           += ahci-init-xlp2.o
+endif
diff --git a/arch/mips/oprofile/backtrace.c b/arch/mips/oprofile/backtrace.c
index 6854ed5097d2..83a1dfd8f0e3 100644
--- a/arch/mips/oprofile/backtrace.c
+++ b/arch/mips/oprofile/backtrace.c
@@ -92,7 +92,7 @@ static inline int unwind_user_frame(struct stackframe *old_frame,
                                 /* This marks the end of the previous function,
                                    which means we overran. */
                                 break;
-                        stack_size = (unsigned) stack_adjustment;
+                        stack_size = (unsigned long) stack_adjustment;
                 } else if (is_ra_save_ins(&ip)) {
                         int ra_slot = ip.i_format.simmediate;
                         if (ra_slot < 0)
diff --git a/arch/mips/sgi-ip27/ip27-memory.c b/arch/mips/sgi-ip27/ip27-memory.c
index a95c00f5fb96..a304bcc37e4f 100644
--- a/arch/mips/sgi-ip27/ip27-memory.c
+++ b/arch/mips/sgi-ip27/ip27-memory.c
@@ -107,6 +107,7 @@ static void router_recurse(klrou_t *router_a, klrou_t *router_b, int depth)
 }
 
 unsigned char __node_distances[MAX_COMPACT_NODES][MAX_COMPACT_NODES];
+EXPORT_SYMBOL(__node_distances);
 
 static int __init compute_node_distance(nasid_t nasid_a, nasid_t nasid_b)
 {
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index 4006964d8e12..a5cb070b54bf 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -9,6 +9,8 @@
 #include <asm/errno.h>
 #include <asm-generic/uaccess-unaligned.h>
 
+#include <linux/bug.h>
+
 #define VERIFY_READ 0
 #define VERIFY_WRITE 1
 
@@ -28,11 +30,6 @@
  * that put_user is the same as __put_user, etc.
  */
 
-extern int __get_kernel_bad(void);
-extern int __get_user_bad(void);
-extern int __put_kernel_bad(void);
-extern int __put_user_bad(void);
-
 static inline long access_ok(int type, const void __user * addr,
                 unsigned long size)
 {
@@ -43,8 +40,8 @@ static inline long access_ok(int type, const void __user * addr,
 #define get_user __get_user
 
 #if !defined(CONFIG_64BIT)
-#define LDD_KERNEL(ptr)         __get_kernel_bad();
-#define LDD_USER(ptr)           __get_user_bad();
+#define LDD_KERNEL(ptr)         BUILD_BUG()
+#define LDD_USER(ptr)           BUILD_BUG()
 #define STD_KERNEL(x, ptr)      __put_kernel_asm64(x,ptr)
 #define STD_USER(x, ptr)        __put_user_asm64(x,ptr)
 #define ASM_WORD_INSN           ".word\t"
@@ -94,7 +91,7 @@ struct exception_data {
             case 2: __get_kernel_asm("ldh",ptr); break; \
             case 4: __get_kernel_asm("ldw",ptr); break; \
             case 8: LDD_KERNEL(ptr); break;             \
-            default: __get_kernel_bad(); break;         \
+            default: BUILD_BUG(); break;                \
             }                                           \
         }                                               \
         else {                                          \
@@ -103,7 +100,7 @@ struct exception_data {
             case 2: __get_user_asm("ldh",ptr); break;   \
             case 4: __get_user_asm("ldw",ptr); break;   \
             case 8: LDD_USER(ptr);  break;              \
-            default: __get_user_bad(); break;           \
+            default: BUILD_BUG(); break;                \
             }                                           \
         }                                               \
                                                         \
@@ -136,7 +133,7 @@ struct exception_data {
             case 2: __put_kernel_asm("sth",__x,ptr); break;     \
             case 4: __put_kernel_asm("stw",__x,ptr); break;     \
             case 8: STD_KERNEL(__x,ptr); break;                 \
-            default: __put_kernel_bad(); break;                 \
+            default: BUILD_BUG(); break;                        \
             }                                                   \
         }                                                       \
         else {                                                  \
@@ -145,7 +142,7 @@ struct exception_data {
             case 2: __put_user_asm("sth",__x,ptr); break;       \
             case 4: __put_user_asm("stw",__x,ptr); break;       \
             case 8: STD_USER(__x,ptr); break;                   \
-            default: __put_user_bad(); break;                   \
+            default: BUILD_BUG(); break;                        \
             }                                                   \
         }                                                       \
                                                                 \
diff --git a/arch/parisc/include/uapi/asm/bitsperlong.h b/arch/parisc/include/uapi/asm/bitsperlong.h
index 75196b415d3f..e0a23c7bdd43 100644
--- a/arch/parisc/include/uapi/asm/bitsperlong.h
+++ b/arch/parisc/include/uapi/asm/bitsperlong.h
@@ -1,13 +1,7 @@
 #ifndef __ASM_PARISC_BITSPERLONG_H
 #define __ASM_PARISC_BITSPERLONG_H
 
-/*
- * using CONFIG_* outside of __KERNEL__ is wrong,
- * __LP64__ was also removed from headers, so what
- * is the right approach on parisc?
- *      -arnd
- */
-#if (defined(__KERNEL__) && defined(CONFIG_64BIT)) || defined (__LP64__)
+#if defined(__LP64__)
 #define __BITS_PER_LONG 64
 #define SHIFT_PER_LONG 6
 #else
diff --git a/arch/parisc/include/uapi/asm/msgbuf.h b/arch/parisc/include/uapi/asm/msgbuf.h
index fe88f2649418..342138983914 100644
--- a/arch/parisc/include/uapi/asm/msgbuf.h
+++ b/arch/parisc/include/uapi/asm/msgbuf.h
@@ -1,6 +1,8 @@
 #ifndef _PARISC_MSGBUF_H
 #define _PARISC_MSGBUF_H
 
+#include <asm/bitsperlong.h>
+
 /* 
  * The msqid64_ds structure for parisc architecture, copied from sparc.
  * Note extra padding because this structure is passed back and forth
@@ -13,15 +15,15 @@
 
 struct msqid64_ds {
         struct ipc64_perm msg_perm;
-#ifndef CONFIG_64BIT
+#if __BITS_PER_LONG != 64
         unsigned int   __pad1;
 #endif
         __kernel_time_t msg_stime;      /* last msgsnd time */
-#ifndef CONFIG_64BIT
+#if __BITS_PER_LONG != 64
         unsigned int   __pad2;
 #endif
         __kernel_time_t msg_rtime;      /* last msgrcv time */
-#ifndef CONFIG_64BIT
+#if __BITS_PER_LONG != 64
         unsigned int   __pad3;
 #endif
         __kernel_time_t msg_ctime;      /* last change time */
diff --git a/arch/parisc/include/uapi/asm/sembuf.h b/arch/parisc/include/uapi/asm/sembuf.h
index 1e59ffd3bd1e..f01d89e30d73 100644
--- a/arch/parisc/include/uapi/asm/sembuf.h
+++ b/arch/parisc/include/uapi/asm/sembuf.h
@@ -1,6 +1,8 @@
 #ifndef _PARISC_SEMBUF_H
 #define _PARISC_SEMBUF_H
 
+#include <asm/bitsperlong.h>
+
 /* 
  * The semid64_ds structure for parisc architecture.
  * Note extra padding because this structure is passed back and forth
@@ -13,11 +15,11 @@
 
 struct semid64_ds {
         struct ipc64_perm sem_perm;             /* permissions .. see ipc.h */
-#ifndef CONFIG_64BIT
+#if __BITS_PER_LONG != 64
         unsigned int    __pad1;
 #endif
         __kernel_time_t sem_otime;              /* last semop time */
-#ifndef CONFIG_64BIT
+#if __BITS_PER_LONG != 64
         unsigned int    __pad2;
 #endif
         __kernel_time_t sem_ctime;              /* last change time */
diff --git a/arch/parisc/include/uapi/asm/shmbuf.h b/arch/parisc/include/uapi/asm/shmbuf.h
index 0a3eada1863b..8496c38560c6 100644
--- a/arch/parisc/include/uapi/asm/shmbuf.h
+++ b/arch/parisc/include/uapi/asm/shmbuf.h
@@ -1,6 +1,8 @@
 #ifndef _PARISC_SHMBUF_H
 #define _PARISC_SHMBUF_H
 
+#include <asm/bitsperlong.h>
+
 /* 
  * The shmid64_ds structure for parisc architecture.
  * Note extra padding because this structure is passed back and forth
@@ -13,19 +15,19 @@
 
 struct shmid64_ds {
         struct ipc64_perm       shm_perm;       /* operation perms */
-#ifndef CONFIG_64BIT
+#if __BITS_PER_LONG != 64
         unsigned int            __pad1;
 #endif
         __kernel_time_t         shm_atime;      /* last attach time */
-#ifndef CONFIG_64BIT
+#if __BITS_PER_LONG != 64
         unsigned int            __pad2;
 #endif
         __kernel_time_t         shm_dtime;      /* last detach time */
-#ifndef CONFIG_64BIT
+#if __BITS_PER_LONG != 64
         unsigned int            __pad3;
 #endif
         __kernel_time_t         shm_ctime;      /* last change time */
-#ifndef CONFIG_64BIT
+#if __BITS_PER_LONG != 64
         unsigned int            __pad4;
 #endif
         size_t                  shm_segsz;      /* size of segment (bytes) */
@@ -36,23 +38,16 @@ struct shmid64_ds {
         unsigned int            __unused2;
 };
 
-#ifdef CONFIG_64BIT
-/* The 'unsigned int' (formerly 'unsigned long') data types below will
- * ensure that a 32-bit app calling shmctl(*,IPC_INFO,*) will work on
- * a wide kernel, but if some of these values are meant to contain pointers
- * they may need to be 'long long' instead. -PB XXX FIXME
- */
-#endif
 struct shminfo64 {
-        unsigned int    shmmax;
-        unsigned int    shmmin;
-        unsigned int    shmmni;
-        unsigned int    shmseg;
-        unsigned int    shmall;
-        unsigned int    __unused1;
-        unsigned int    __unused2;
-        unsigned int    __unused3;
-        unsigned int    __unused4;
+        unsigned long   shmmax;
+        unsigned long   shmmin;
+        unsigned long   shmmni;
+        unsigned long   shmseg;
+        unsigned long   shmall;
+        unsigned long   __unused1;
+        unsigned long   __unused2;
+        unsigned long   __unused3;
+        unsigned long   __unused4;
 };
 
 #endif /* _PARISC_SHMBUF_H */
diff --git a/arch/parisc/include/uapi/asm/signal.h b/arch/parisc/include/uapi/asm/signal.h
index 10df7079f4cd..e26043b73f5d 100644
--- a/arch/parisc/include/uapi/asm/signal.h
+++ b/arch/parisc/include/uapi/asm/signal.h
@@ -85,7 +85,7 @@
 struct siginfo;
 
 /* Type of a signal handler.  */
-#ifdef CONFIG_64BIT
+#if defined(__LP64__)
 /* function pointers on 64-bit parisc are pointers to little structs and the
  * compiler doesn't support code which changes or tests the address of
  * the function in the little struct.  This is really ugly -PB
diff --git a/arch/parisc/include/uapi/asm/unistd.h b/arch/parisc/include/uapi/asm/unistd.h
index 8667f18be238..5f5c0373de63 100644
--- a/arch/parisc/include/uapi/asm/unistd.h
+++ b/arch/parisc/include/uapi/asm/unistd.h
@@ -833,8 +833,9 @@
 #define __NR_seccomp            (__NR_Linux + 338)
 #define __NR_getrandom          (__NR_Linux + 339)
 #define __NR_memfd_create       (__NR_Linux + 340)
+#define __NR_bpf                (__NR_Linux + 341)
 
-#define __NR_Linux_syscalls     (__NR_memfd_create + 1)
+#define __NR_Linux_syscalls     (__NR_bpf + 1)
 
 
 #define __IGNORE_select         /* newselect */
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index b563d9c8268b..fe4f0b89bf8f 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -286,11 +286,11 @@
         ENTRY_COMP(msgsnd)
         ENTRY_COMP(msgrcv)
         ENTRY_SAME(msgget)              /* 190 */
-        ENTRY_SAME(msgctl)
-        ENTRY_SAME(shmat)
+        ENTRY_COMP(msgctl)
+        ENTRY_COMP(shmat)
         ENTRY_SAME(shmdt)
         ENTRY_SAME(shmget)
-        ENTRY_SAME(shmctl)              /* 195 */
+        ENTRY_COMP(shmctl)              /* 195 */
         ENTRY_SAME(ni_syscall)          /* streams1 */
         ENTRY_SAME(ni_syscall)          /* streams2 */
         ENTRY_SAME(lstat64)
@@ -323,7 +323,7 @@
         ENTRY_SAME(epoll_ctl)           /* 225 */
         ENTRY_SAME(epoll_wait)
         ENTRY_SAME(remap_file_pages)
-        ENTRY_SAME(semtimedop)
+        ENTRY_COMP(semtimedop)
         ENTRY_COMP(mq_open)
         ENTRY_SAME(mq_unlink)           /* 230 */
         ENTRY_COMP(mq_timedsend)
@@ -436,6 +436,7 @@
         ENTRY_SAME(seccomp)
         ENTRY_SAME(getrandom)
         ENTRY_SAME(memfd_create)        /* 340 */
+        ENTRY_SAME(bpf)
 
         /* Nothing yet */
 
diff --git a/arch/powerpc/include/asm/pci-bridge.h b/arch/powerpc/include/asm/pci-bridge.h
index 4ca90a39d6d0..725247beebec 100644
--- a/arch/powerpc/include/asm/pci-bridge.h
+++ b/arch/powerpc/include/asm/pci-bridge.h
@@ -159,8 +159,6 @@ struct pci_dn {
 
         int     pci_ext_config_space;   /* for pci devices */
 
-        bool    force_32bit_msi;
-
         struct  pci_dev *pcidev;        /* back-pointer to the pci device */
 #ifdef CONFIG_EEH
         struct eeh_dev *edev;           /* eeh device */
diff --git a/arch/powerpc/kernel/eeh_sysfs.c b/arch/powerpc/kernel/eeh_sysfs.c
index f19b1e5cb060..1ceecdda810b 100644
--- a/arch/powerpc/kernel/eeh_sysfs.c
+++ b/arch/powerpc/kernel/eeh_sysfs.c
@@ -65,7 +65,7 @@ static ssize_t eeh_pe_state_show(struct device *dev,
                 return -ENODEV;
 
         state = eeh_ops->get_state(edev->pe, NULL);
-        return sprintf(buf, "%0x08x %0x08x\n",
+        return sprintf(buf, "0x%08x 0x%08x\n",
                        state, edev->pe->state);
 }
 
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index 155013da27e0..b15194e2c5fc 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -266,13 +266,3 @@ int pcibus_to_node(struct pci_bus *bus)
 }
 EXPORT_SYMBOL(pcibus_to_node);
 #endif
-
-static void quirk_radeon_32bit_msi(struct pci_dev *dev)
-{
-        struct pci_dn *pdn = pci_get_pdn(dev);
-
-        if (pdn)
-                pdn->force_32bit_msi = true;
-}
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x68f2, quirk_radeon_32bit_msi);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0xaa68, quirk_radeon_32bit_msi);
diff --git a/arch/powerpc/kernel/vdso32/getcpu.S b/arch/powerpc/kernel/vdso32/getcpu.S
index 23eb9a9441bd..c62be60c7274 100644
--- a/arch/powerpc/kernel/vdso32/getcpu.S
+++ b/arch/powerpc/kernel/vdso32/getcpu.S
@@ -30,8 +30,8 @@
 V_FUNCTION_BEGIN(__kernel_getcpu)
   .cfi_startproc
         mfspr   r5,SPRN_SPRG_VDSO_READ
-        cmpdi   cr0,r3,0
-        cmpdi   cr1,r4,0
+        cmpwi   cr0,r3,0
+        cmpwi   cr1,r4,0
         clrlwi  r6,r5,16
         rlwinm  r7,r5,16,31-15,31-0
         beq     cr0,1f
diff --git a/arch/powerpc/platforms/powernv/opal-hmi.c b/arch/powerpc/platforms/powernv/opal-hmi.c
index 5e1ed1575aab..b322bfb51343 100644
--- a/arch/powerpc/platforms/powernv/opal-hmi.c
+++ b/arch/powerpc/platforms/powernv/opal-hmi.c
@@ -57,7 +57,7 @@ static void print_hmi_event_info(struct OpalHMIEvent *hmi_evt)
         };
 
         /* Print things out */
-        if (hmi_evt->version != OpalHMIEvt_V1) {
+        if (hmi_evt->version < OpalHMIEvt_V1) {
                 pr_err("HMI Interrupt, Unknown event version %d !\n",
                         hmi_evt->version);
                 return;
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 468a0f23c7f2..3ba435ec3dcd 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -1509,7 +1509,6 @@ static int pnv_pci_ioda_msi_setup(struct pnv_phb *phb, struct pci_dev *dev,
                                   unsigned int is_64, struct msi_msg *msg)
 {
         struct pnv_ioda_pe *pe = pnv_ioda_get_pe(dev);
-        struct pci_dn *pdn = pci_get_pdn(dev);
         unsigned int xive_num = hwirq - phb->msi_base;
         __be32 data;
         int rc;
@@ -1523,7 +1522,7 @@ static int pnv_pci_ioda_msi_setup(struct pnv_phb *phb, struct pci_dev *dev,
                 return -ENXIO;
 
         /* Force 32-bit MSI on some broken devices */
-        if (pdn && pdn->force_32bit_msi)
+        if (dev->no_64bit_msi)
                 is_64 = 0;
 
         /* Assign XIVE to PE */
@@ -1997,7 +1996,7 @@ static void __init pnv_pci_init_ioda_phb(struct device_node *np,
         if (is_kdump_kernel()) {
                 pr_info("  Issue PHB reset ...\n");
                 ioda_eeh_phb_reset(hose, EEH_RESET_FUNDAMENTAL);
-                ioda_eeh_phb_reset(hose, OPAL_DEASSERT_RESET);
+                ioda_eeh_phb_reset(hose, EEH_RESET_DEACTIVATE);
         }
 
         /* Configure M64 window */
diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index b2187d0068b8..4b20f2c6b3b2 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -50,7 +50,6 @@ static int pnv_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
 {
         struct pci_controller *hose = pci_bus_to_host(pdev->bus);
         struct pnv_phb *phb = hose->private_data;
-        struct pci_dn *pdn = pci_get_pdn(pdev);
         struct msi_desc *entry;
         struct msi_msg msg;
         int hwirq;
@@ -60,7 +59,7 @@ static int pnv_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
         if (WARN_ON(!phb) || !phb->msi_bmp.bitmap)
                 return -ENODEV;
 
-        if (pdn && pdn->force_32bit_msi && !phb->msi32_support)
+        if (pdev->no_64bit_msi && !phb->msi32_support)
                 return -ENODEV;
 
         list_for_each_entry(entry, &pdev->msi_list, list) {
diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c
index 8ab5add4ac82..8b909e94fd9a 100644
--- a/arch/powerpc/platforms/pseries/msi.c
+++ b/arch/powerpc/platforms/pseries/msi.c
@@ -420,7 +420,7 @@ static int rtas_setup_msi_irqs(struct pci_dev *pdev, int nvec_in, int type)
          */
 again:
         if (type == PCI_CAP_ID_MSI) {
-                if (pdn->force_32bit_msi) {
+                if (pdev->no_64bit_msi) {
                         rc = rtas_change_msi(pdn, RTAS_CHANGE_32MSI_FN, nvec);
                         if (rc < 0) {
                                 /*
diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c
index de40b48b460e..da08ed088157 100644
--- a/arch/powerpc/sysdev/fsl_msi.c
+++ b/arch/powerpc/sysdev/fsl_msi.c
@@ -361,7 +361,7 @@ static int fsl_msi_setup_hwirq(struct fsl_msi *msi, struct platform_device *dev,
         cascade_data->virq = virt_msir;
         msi->cascade_array[irq_index] = cascade_data;
 
-        ret = request_irq(virt_msir, fsl_msi_cascade, 0,
+        ret = request_irq(virt_msir, fsl_msi_cascade, IRQF_NO_THREAD,
                           "fsl-msi-cascade", cascade_data);
         if (ret) {
                 dev_err(&dev->dev, "failed to request_irq(%d), ret = %d\n",
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index b988b5addf86..c8efbb37d6e0 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -293,10 +293,10 @@ static inline void disable_surveillance(void)
         args.token = rtas_token("set-indicator");
         if (args.token == RTAS_UNKNOWN_SERVICE)
                 return;
-        args.nargs = 3;
-        args.nret = 1;
+        args.nargs = cpu_to_be32(3);
+        args.nret = cpu_to_be32(1);
         args.rets = &args.args[3];
-        args.args[0] = SURVEILLANCE_TOKEN;
+        args.args[0] = cpu_to_be32(SURVEILLANCE_TOKEN);
         args.args[1] = 0;
         args.args[2] = 0;
         enter_rtas(__pa(&args));
diff --git a/arch/sparc/include/asm/atomic_32.h b/arch/sparc/include/asm/atomic_32.h
index 765c1776ec9f..0e69b7e7a439 100644
--- a/arch/sparc/include/asm/atomic_32.h
+++ b/arch/sparc/include/asm/atomic_32.h
@@ -22,7 +22,7 @@
 
 int atomic_add_return(int, atomic_t *);
 int atomic_cmpxchg(atomic_t *, int, int);
-#define atomic_xchg(v, new) (xchg(&((v)->counter), new))
+int atomic_xchg(atomic_t *, int);
 int __atomic_add_unless(atomic_t *, int, int);
 void atomic_set(atomic_t *, int);
 
diff --git a/arch/sparc/include/asm/cmpxchg_32.h b/arch/sparc/include/asm/cmpxchg_32.h
index 32c29a133f9d..d38b52dca216 100644
--- a/arch/sparc/include/asm/cmpxchg_32.h
+++ b/arch/sparc/include/asm/cmpxchg_32.h
@@ -11,22 +11,14 @@
 #ifndef __ARCH_SPARC_CMPXCHG__
 #define __ARCH_SPARC_CMPXCHG__
 
-static inline unsigned long xchg_u32(__volatile__ unsigned long *m, unsigned long val)
-{
-        __asm__ __volatile__("swap [%2], %0"
-                             : "=&r" (val)
-                             : "0" (val), "r" (m)
-                             : "memory");
-        return val;
-}
-
+unsigned long __xchg_u32(volatile u32 *m, u32 new);
 void __xchg_called_with_bad_pointer(void);
 
 static inline unsigned long __xchg(unsigned long x, __volatile__ void * ptr, int size)
 {
         switch (size) {
         case 4:
-                return xchg_u32(ptr, x);
+                return __xchg_u32(ptr, x);
         }
         __xchg_called_with_bad_pointer();
         return x;
diff --git a/arch/sparc/include/asm/dma-mapping.h b/arch/sparc/include/asm/dma-mapping.h
index 5b1b52a04ad6..7e064c68c5ec 100644
--- a/arch/sparc/include/asm/dma-mapping.h
+++ b/arch/sparc/include/asm/dma-mapping.h
@@ -12,6 +12,14 @@ int dma_supported(struct device *dev, u64 mask);
 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
 
+static inline void dma_cache_sync(struct device *dev, void *vaddr, size_t size,
+                                  enum dma_data_direction dir)
+{
+        /* Since dma_{alloc,free}_noncoherent() allocated coherent memory, this
+         * routine can be a nop.
+         */
+}
+
 extern struct dma_map_ops *dma_ops;
 extern struct dma_map_ops *leon_dma_ops;
 extern struct dma_map_ops pci32_dma_ops;
diff --git a/arch/sparc/include/uapi/asm/swab.h b/arch/sparc/include/uapi/asm/swab.h
index a34ad079487e..4c7c12d69bea 100644
--- a/arch/sparc/include/uapi/asm/swab.h
+++ b/arch/sparc/include/uapi/asm/swab.h
@@ -9,9 +9,9 @@ static inline __u16 __arch_swab16p(const __u16 *addr)
 {
         __u16 ret;
 
-        __asm__ __volatile__ ("lduha [%1] %2, %0"
+        __asm__ __volatile__ ("lduha [%2] %3, %0"
                               : "=r" (ret)
-                              : "r" (addr), "i" (ASI_PL));
+                              : "m" (*addr), "r" (addr), "i" (ASI_PL));
         return ret;
 }
 #define __arch_swab16p __arch_swab16p
@@ -20,9 +20,9 @@ static inline __u32 __arch_swab32p(const __u32 *addr)
 {
         __u32 ret;
 
-        __asm__ __volatile__ ("lduwa [%1] %2, %0"
+        __asm__ __volatile__ ("lduwa [%2] %3, %0"
                               : "=r" (ret)
-                              : "r" (addr), "i" (ASI_PL));
+                              : "m" (*addr), "r" (addr), "i" (ASI_PL));
         return ret;
 }
 #define __arch_swab32p __arch_swab32p
@@ -31,9 +31,9 @@ static inline __u64 __arch_swab64p(const __u64 *addr)
 {
         __u64 ret;
 
-        __asm__ __volatile__ ("ldxa [%1] %2, %0"
+        __asm__ __volatile__ ("ldxa [%2] %3, %0"
                               : "=r" (ret)
-                              : "r" (addr), "i" (ASI_PL));
+                              : "m" (*addr), "r" (addr), "i" (ASI_PL));
         return ret;
 }
 #define __arch_swab64p __arch_swab64p
diff --git a/arch/sparc/kernel/pci_schizo.c b/arch/sparc/kernel/pci_schizo.c
index 8f76f23dac38..f9c6813c132d 100644
--- a/arch/sparc/kernel/pci_schizo.c
+++ b/arch/sparc/kernel/pci_schizo.c
@@ -581,7 +581,7 @@ static irqreturn_t schizo_pcierr_intr_other(struct pci_pbm_info *pbm)
 {
         unsigned long csr_reg, csr, csr_error_bits;
         irqreturn_t ret = IRQ_NONE;
-        u16 stat;
+        u32 stat;
 
         csr_reg = pbm->pbm_regs + SCHIZO_PCI_CTRL;
         csr = upa_readq(csr_reg);
@@ -617,7 +617,7 @@ static irqreturn_t schizo_pcierr_intr_other(struct pci_pbm_info *pbm)
                                pbm->name);
                 ret = IRQ_HANDLED;
         }
-        pci_read_config_word(pbm->pci_bus->self, PCI_STATUS, &stat);
+        pbm->pci_ops->read(pbm->pci_bus, 0, PCI_STATUS, 2, &stat);
         if (stat & (PCI_STATUS_PARITY |
                     PCI_STATUS_SIG_TARGET_ABORT |
                     PCI_STATUS_REC_TARGET_ABORT |
@@ -625,7 +625,7 @@ static irqreturn_t schizo_pcierr_intr_other(struct pci_pbm_info *pbm)
                     PCI_STATUS_SIG_SYSTEM_ERROR)) {
                 printk("%s: PCI bus error, PCI_STATUS[%04x]\n",
                        pbm->name, stat);
-                pci_write_config_word(pbm->pci_bus->self, PCI_STATUS, 0xffff);
+                pbm->pci_ops->write(pbm->pci_bus, 0, PCI_STATUS, 2, 0xffff);
                 ret = IRQ_HANDLED;
         }
         return ret;
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index 302c476413d5..da6f1a7fc4db 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -816,13 +816,17 @@ void arch_send_call_function_single_ipi(int cpu)
 void __irq_entry smp_call_function_client(int irq, struct pt_regs *regs)
 {
         clear_softint(1 << irq);
+        irq_enter();
         generic_smp_call_function_interrupt();
+        irq_exit();
 }
 
 void __irq_entry smp_call_function_single_client(int irq, struct pt_regs *regs)
 {
         clear_softint(1 << irq);
+        irq_enter();
         generic_smp_call_function_single_interrupt();
+        irq_exit();
 }
 
 static void tsb_sync(void *info)
diff --git a/arch/sparc/lib/atomic32.c b/arch/sparc/lib/atomic32.c
index a7c418ac26af..71cd65ab200c 100644
--- a/arch/sparc/lib/atomic32.c
+++ b/arch/sparc/lib/atomic32.c
@@ -45,6 +45,19 @@ ATOMIC_OP(add, +=)
 
 #undef ATOMIC_OP
 
+int atomic_xchg(atomic_t *v, int new)
+{
+        int ret;
+        unsigned long flags;
+
+        spin_lock_irqsave(ATOMIC_HASH(v), flags);
+        ret = v->counter;
+        v->counter = new;
+        spin_unlock_irqrestore(ATOMIC_HASH(v), flags);
+        return ret;
+}
+EXPORT_SYMBOL(atomic_xchg);
+
 int atomic_cmpxchg(atomic_t *v, int old, int new)
 {
         int ret;
@@ -137,3 +150,17 @@ unsigned long __cmpxchg_u32(volatile u32 *ptr, u32 old, u32 new)
         return (unsigned long)prev;
 }
 EXPORT_SYMBOL(__cmpxchg_u32);
+
+unsigned long __xchg_u32(volatile u32 *ptr, u32 new)
+{
+        unsigned long flags;
+        u32 prev;
+
+        spin_lock_irqsave(ATOMIC_HASH(ptr), flags);
+        prev = *ptr;
+        *ptr = new;
+        spin_unlock_irqrestore(ATOMIC_HASH(ptr), flags);
+
+        return (unsigned long)prev;
+}
+EXPORT_SYMBOL(__xchg_u32);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ded8a6774ac9..41a503c15862 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -144,7 +144,7 @@ config INSTRUCTION_DECODER
 
 config PERF_EVENTS_INTEL_UNCORE
         def_bool y
-        depends on PERF_EVENTS && SUP_SUP_INTEL && PCI
+        depends on PERF_EVENTS && CPU_SUP_INTEL && PCI
 
 config OUTPUT_FORMAT
         string
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 704f58aa79cd..be1e07d4b596 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -76,8 +76,10 @@ suffix-$(CONFIG_KERNEL_XZ)	:= xz
 suffix-$(CONFIG_KERNEL_LZO)     := lzo
 suffix-$(CONFIG_KERNEL_LZ4)     := lz4
 
+RUN_SIZE = $(shell objdump -h vmlinux | \
+             perl $(srctree)/arch/x86/tools/calc_run_size.pl)
 quiet_cmd_mkpiggy = MKPIGGY $@
-      cmd_mkpiggy = $(obj)/mkpiggy $< > $@ || ( rm -f $@ ; false )
+      cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false )
 
 targets += piggy.S
 $(obj)/piggy.S: $(obj)/vmlinux.bin.$(suffix-y) $(obj)/mkpiggy FORCE
diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
index cbed1407a5cd..1d7fbbcc196d 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -207,7 +207,8 @@ relocated:
  * Do the decompression, and jump to the new kernel..
  */
                                 /* push arguments for decompress_kernel: */
-        pushl   $z_output_len   /* decompressed length */
+        pushl   $z_run_size     /* size of kernel with .bss and .brk */
+        pushl   $z_output_len   /* decompressed length, end of relocs */
         leal    z_extract_offset_negative(%ebx), %ebp
         pushl   %ebp            /* output address */
         pushl   $z_input_len    /* input_len */
@@ -217,7 +218,7 @@ relocated:
         pushl   %eax            /* heap area */
         pushl   %esi            /* real mode pointer */
         call    decompress_kernel /* returns kernel location in %eax */
-        addl    $24, %esp
+        addl    $28, %esp
 
 /*
  * Jump to the decompressed kernel.
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index 2884e0c3e8a5..6b1766c6c082 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -402,13 +402,16 @@ relocated:
  * Do the decompression, and jump to the new kernel..
  */
         pushq   %rsi                    /* Save the real mode argument */
+        movq    $z_run_size, %r9        /* size of kernel with .bss and .brk */
+        pushq   %r9
         movq    %rsi, %rdi              /* real mode address */
         leaq    boot_heap(%rip), %rsi   /* malloc area for uncompression */
         leaq    input_data(%rip), %rdx  /* input_data */
         movl    $z_input_len, %ecx      /* input_len */
         movq    %rbp, %r8               /* output target address */
-        movq    $z_output_len, %r9      /* decompressed length */
+        movq    $z_output_len, %r9      /* decompressed length, end of relocs */
         call    decompress_kernel       /* returns kernel location in %rax */
+        popq    %r9
         popq    %rsi
 
 /*
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 57ab74df7eea..30dd59a9f0b4 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -358,7 +358,8 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
                                   unsigned char *input_data,
                                   unsigned long input_len,
                                   unsigned char *output,
-                                  unsigned long output_len)
+                                  unsigned long output_len,
+                                  unsigned long run_size)
 {
         real_mode = rmode;
 
@@ -381,8 +382,14 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
         free_mem_ptr     = heap;        /* Heap */
         free_mem_end_ptr = heap + BOOT_HEAP_SIZE;
 
-        output = choose_kernel_location(input_data, input_len,
-                                        output, output_len);
+        /*
+         * The memory hole needed for the kernel is the larger of either
+         * the entire decompressed kernel plus relocation table, or the
+         * entire decompressed kernel plus .bss and .brk sections.
+         */
+        output = choose_kernel_location(input_data, input_len, output,
+                                        output_len > run_size ? output_len
+                                                              : run_size);
 
         /* Validate memory location choices. */
         if ((unsigned long)output & (MIN_KERNEL_ALIGN - 1))
diff --git a/arch/x86/boot/compressed/mkpiggy.c b/arch/x86/boot/compressed/mkpiggy.c
index b669ab65bf6c..d8222f213182 100644
--- a/arch/x86/boot/compressed/mkpiggy.c
+++ b/arch/x86/boot/compressed/mkpiggy.c
@@ -36,11 +36,13 @@ int main(int argc, char *argv[])
         uint32_t olen;
         long ilen;
         unsigned long offs;
+        unsigned long run_size;
         FILE *f = NULL;
         int retval = 1;
 
-        if (argc < 2) {
-                fprintf(stderr, "Usage: %s compressed_file\n", argv[0]);
+        if (argc < 3) {
+                fprintf(stderr, "Usage: %s compressed_file run_size\n",
+                                argv[0]);
                 goto bail;
         }
 
@@ -74,6 +76,7 @@ int main(int argc, char *argv[])
         offs += olen >> 12;     /* Add 8 bytes for each 32K block */
         offs += 64*1024 + 128;  /* Add 64K + 128 bytes slack */
         offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
+        run_size = atoi(argv[2]);
 
         printf(".section \".rodata..compressed\",\"a\",@progbits\n");
         printf(".globl z_input_len\n");
@@ -85,6 +88,8 @@ int main(int argc, char *argv[])
         /* z_extract_offset_negative allows simplification of head_32.S */
         printf(".globl z_extract_offset_negative\n");
         printf("z_extract_offset_negative = -0x%lx\n", offs);
+        printf(".globl z_run_size\n");
+        printf("z_run_size = %lu\n", run_size);
 
         printf(".globl input_data, input_data_end\n");
         printf("input_data:\n");
diff --git a/arch/x86/include/asm/page_32_types.h b/arch/x86/include/asm/page_32_types.h
index f48b17df4224..3a52ee0e726d 100644
--- a/arch/x86/include/asm/page_32_types.h
+++ b/arch/x86/include/asm/page_32_types.h
@@ -20,7 +20,6 @@
 #define THREAD_SIZE_ORDER       1
 #define THREAD_SIZE             (PAGE_SIZE << THREAD_SIZE_ORDER)
 
-#define STACKFAULT_STACK 0
 #define DOUBLEFAULT_STACK 1
 #define NMI_STACK 0
 #define DEBUG_STACK 0
diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
index 678205195ae1..75450b2c7be4 100644
--- a/arch/x86/include/asm/page_64_types.h
+++ b/arch/x86/include/asm/page_64_types.h
@@ -14,12 +14,11 @@
 #define IRQ_STACK_ORDER 2
 #define IRQ_STACK_SIZE (PAGE_SIZE << IRQ_STACK_ORDER)
 
-#define STACKFAULT_STACK 1
-#define DOUBLEFAULT_STACK 2
-#define NMI_STACK 3
-#define DEBUG_STACK 4
-#define MCE_STACK 5
-#define N_EXCEPTION_STACKS 5  /* hw limit: 7 */
+#define DOUBLEFAULT_STACK 1
+#define NMI_STACK 2
+#define DEBUG_STACK 3
+#define MCE_STACK 4
+#define N_EXCEPTION_STACKS 4  /* hw limit: 7 */
 
 #define PUD_PAGE_SIZE           (_AC(1, UL) << PUD_SHIFT)
 #define PUD_PAGE_MASK           (~(PUD_PAGE_SIZE-1))
diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
index 8cd27e08e23c..8cd1cc3bc835 100644
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -150,6 +150,7 @@ static inline void arch_send_call_function_ipi_mask(const struct cpumask *mask)
 }
 
 void cpu_disable_common(void);
+void cpu_die_common(unsigned int cpu);
 void native_smp_prepare_boot_cpu(void);
 void native_smp_prepare_cpus(unsigned int max_cpus);
 void native_smp_cpus_done(unsigned int max_cpus);
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index 854053889d4d..547e344a6dc6 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -141,7 +141,7 @@ struct thread_info {
 /* Only used for 64 bit */
 #define _TIF_DO_NOTIFY_MASK                                             \
         (_TIF_SIGPENDING | _TIF_MCE_NOTIFY | _TIF_NOTIFY_RESUME |       \
-         _TIF_USER_RETURN_NOTIFY)
+         _TIF_USER_RETURN_NOTIFY | _TIF_UPROBE)
 
 /* flags to check in __switch_to() */
 #define _TIF_WORK_CTXSW                                                 \
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index bc8352e7010a..707adc6549d8 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -39,6 +39,7 @@ asmlinkage void simd_coprocessor_error(void);
 
 #ifdef CONFIG_TRACING
 asmlinkage void trace_page_fault(void);
+#define trace_stack_segment stack_segment
 #define trace_divide_error divide_error
 #define trace_bounds bounds
 #define trace_invalid_op invalid_op
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 4b4f78c9ba19..cfa9b5b2c27a 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -146,6 +146,8 @@ EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
 
 static int __init x86_xsave_setup(char *s)
 {
+        if (strlen(s))
+                return 0;
         setup_clear_cpu_cap(X86_FEATURE_XSAVE);
         setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
         setup_clear_cpu_cap(X86_FEATURE_XSAVES);
diff --git a/arch/x86/kernel/cpu/microcode/amd_early.c b/arch/x86/kernel/cpu/microcode/amd_early.c
index 7aa1acc79789..06674473b0e6 100644
--- a/arch/x86/kernel/cpu/microcode/amd_early.c
+++ b/arch/x86/kernel/cpu/microcode/amd_early.c
@@ -108,12 +108,13 @@ static size_t compute_container_size(u8 *data, u32 total_size)
  * load_microcode_amd() to save equivalent cpu table and microcode patches in
  * kernel heap memory.
  */
-static void apply_ucode_in_initrd(void *ucode, size_t size)
+static void apply_ucode_in_initrd(void *ucode, size_t size, bool save_patch)
 {
         struct equiv_cpu_entry *eq;
         size_t *cont_sz;
         u32 *header;
         u8  *data, **cont;
+        u8 (*patch)[PATCH_MAX_SIZE];
         u16 eq_id = 0;
         int offset, left;
         u32 rev, eax, ebx, ecx, edx;
@@ -123,10 +124,12 @@ static void apply_ucode_in_initrd(void *ucode, size_t size)
         new_rev = (u32 *)__pa_nodebug(&ucode_new_rev);
         cont_sz = (size_t *)__pa_nodebug(&container_size);
         cont    = (u8 **)__pa_nodebug(&container);
+        patch   = (u8 (*)[PATCH_MAX_SIZE])__pa_nodebug(&amd_ucode_patch);
 #else
         new_rev = &ucode_new_rev;
         cont_sz = &container_size;
         cont    = &container;
+        patch   = &amd_ucode_patch;
 #endif
 
         data   = ucode;
@@ -213,9 +216,9 @@ static void apply_ucode_in_initrd(void *ucode, size_t size)
                                 rev = mc->hdr.patch_id;
                                 *new_rev = rev;
 
-                                /* save ucode patch */
-                                memcpy(amd_ucode_patch, mc,
-                                       min_t(u32, header[1], PATCH_MAX_SIZE));
+                                if (save_patch)
+                                        memcpy(patch, mc,
+                                               min_t(u32, header[1], PATCH_MAX_SIZE));
                         }
                 }
 
@@ -246,7 +249,7 @@ void __init load_ucode_amd_bsp(void)
         *data = cp.data;
         *size = cp.size;
 
-        apply_ucode_in_initrd(cp.data, cp.size);
+        apply_ucode_in_initrd(cp.data, cp.size, true);
 }
 
 #ifdef CONFIG_X86_32
@@ -263,7 +266,7 @@ void load_ucode_amd_ap(void)
         size_t *usize;
         void **ucode;
 
-        mc = (struct microcode_amd *)__pa(amd_ucode_patch);
+        mc = (struct microcode_amd *)__pa_nodebug(amd_ucode_patch);
         if (mc->hdr.patch_id && mc->hdr.processor_rev_id) {
                 __apply_microcode_amd(mc);
                 return;
@@ -275,7 +278,7 @@ void load_ucode_amd_ap(void)
         if (!*ucode || !*usize)
                 return;
 
-        apply_ucode_in_initrd(*ucode, *usize);
+        apply_ucode_in_initrd(*ucode, *usize, false);
 }
 
 static void __init collect_cpu_sig_on_bsp(void *arg)
@@ -339,7 +342,7 @@ void load_ucode_amd_ap(void)
                  * AP has a different equivalence ID than BSP, looks like
                  * mixed-steppings silicon so go through the ucode blob anew.
                  */
-                apply_ucode_in_initrd(ucode_cpio.data, ucode_cpio.size);
+                apply_ucode_in_initrd(ucode_cpio.data, ucode_cpio.size, false);
         }
 }
 #endif
@@ -347,7 +350,9 @@ void load_ucode_amd_ap(void)
 int __init save_microcode_in_initrd_amd(void)
 {
         unsigned long cont;
+        int retval = 0;
         enum ucode_state ret;
+        u8 *cont_va;
         u32 eax;
 
         if (!container)
@@ -355,13 +360,15 @@ int __init save_microcode_in_initrd_amd(void)
 
 #ifdef CONFIG_X86_32
         get_bsp_sig();
-        cont = (unsigned long)container;
+        cont    = (unsigned long)container;
+        cont_va = __va(container);
 #else
         /*
          * We need the physical address of the container for both bitness since
          * boot_params.hdr.ramdisk_image is a physical address.
          */
-        cont = __pa(container);
+        cont    = __pa(container);
+        cont_va = container;
 #endif
 
         /*
@@ -372,6 +379,8 @@ int __init save_microcode_in_initrd_amd(void)
         if (relocated_ramdisk)
                 container = (u8 *)(__va(relocated_ramdisk) +
                              (cont - boot_params.hdr.ramdisk_image));
+        else
+                container = cont_va;
 
         if (ucode_new_rev)
                 pr_info("microcode: updated early to new patch_level=0x%08x\n",
@@ -382,7 +391,7 @@ int __init save_microcode_in_initrd_amd(void)
 
         ret = load_microcode_amd(eax, container, container_size);
         if (ret != UCODE_OK)
-                return -EINVAL;
+                retval = -EINVAL;
 
         /*
          * This will be freed any msec now, stash patches for the current
@@ -391,5 +400,5 @@ int __init save_microcode_in_initrd_amd(void)
         container = NULL;
         container_size = 0;
 
-        return 0;
+        return retval;
 }
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index dd9d6190b08d..2ce9051174e6 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -465,6 +465,14 @@ static void mc_bp_resume(void)
 
         if (uci->valid && uci->mc)
                 microcode_ops->apply_microcode(cpu);
+        else if (!uci->mc)
+                /*
+                 * We might resume and not have applied late microcode but still
+                 * have a newer patch stashed from the early loader. We don't
+                 * have it in uci->mc so we have to load it the same way we're
+                 * applying patches early on the APs.
+                 */
+                load_ucode_ap();
 }
 
 static struct syscore_ops mc_syscore_ops = {
diff --git a/arch/x86/kernel/cpu/microcode/core_early.c b/arch/x86/kernel/cpu/microcode/core_early.c
index 5f28a64e71ea..2c017f242a78 100644
--- a/arch/x86/kernel/cpu/microcode/core_early.c
+++ b/arch/x86/kernel/cpu/microcode/core_early.c
@@ -124,7 +124,7 @@ void __init load_ucode_bsp(void)
 static bool check_loader_disabled_ap(void)
 {
 #ifdef CONFIG_X86_32
-        return __pa_nodebug(dis_ucode_ldr);
+        return *((bool *)__pa_nodebug(&dis_ucode_ldr));
 #else
         return dis_ucode_ldr;
 #endif
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
index adf138eac85c..f9ed429d6e4f 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
@@ -486,14 +486,17 @@ static struct attribute_group snbep_uncore_qpi_format_group = {
         .attrs = snbep_uncore_qpi_formats_attr,
 };
 
-#define SNBEP_UNCORE_MSR_OPS_COMMON_INIT()                      \
-        .init_box       = snbep_uncore_msr_init_box,            \
+#define __SNBEP_UNCORE_MSR_OPS_COMMON_INIT()                    \
         .disable_box    = snbep_uncore_msr_disable_box,         \
         .enable_box     = snbep_uncore_msr_enable_box,          \
         .disable_event  = snbep_uncore_msr_disable_event,       \
         .enable_event   = snbep_uncore_msr_enable_event,        \
         .read_counter   = uncore_msr_read_counter
 
+#define SNBEP_UNCORE_MSR_OPS_COMMON_INIT()                      \
+        __SNBEP_UNCORE_MSR_OPS_COMMON_INIT(),                   \
+        .init_box       = snbep_uncore_msr_init_box             \
+
 static struct intel_uncore_ops snbep_uncore_msr_ops = {
         SNBEP_UNCORE_MSR_OPS_COMMON_INIT(),
 };
@@ -1919,6 +1922,30 @@ static struct intel_uncore_type hswep_uncore_cbox = {
         .format_group           = &hswep_uncore_cbox_format_group,
 };
 
+/*
+ * Write SBOX Initialization register bit by bit to avoid spurious #GPs
+ */
+static void hswep_uncore_sbox_msr_init_box(struct intel_uncore_box *box)
+{
+        unsigned msr = uncore_msr_box_ctl(box);
+
+        if (msr) {
+                u64 init = SNBEP_PMON_BOX_CTL_INT;
+                u64 flags = 0;
+                int i;
+
+                for_each_set_bit(i, (unsigned long *)&init, 64) {
+                        flags |= (1ULL << i);
+                        wrmsrl(msr, flags);
+                }
+        }
+}
+
+static struct intel_uncore_ops hswep_uncore_sbox_msr_ops = {
+        __SNBEP_UNCORE_MSR_OPS_COMMON_INIT(),
+        .init_box               = hswep_uncore_sbox_msr_init_box
+};
+
 static struct attribute *hswep_uncore_sbox_formats_attr[] = {
         &format_attr_event.attr,
         &format_attr_umask.attr,
@@ -1944,7 +1971,7 @@ static struct intel_uncore_type hswep_uncore_sbox = {
         .event_mask             = HSWEP_S_MSR_PMON_RAW_EVENT_MASK,
         .box_ctl                = HSWEP_S0_MSR_PMON_BOX_CTL,
         .msr_offset             = HSWEP_SBOX_MSR_OFFSET,
-        .ops                    = &snbep_uncore_msr_ops,
+        .ops                    = &hswep_uncore_sbox_msr_ops,
         .format_group           = &hswep_uncore_sbox_format_group,
 };
 
@@ -2025,13 +2052,27 @@ static struct intel_uncore_type hswep_uncore_imc = {
         SNBEP_UNCORE_PCI_COMMON_INIT(),
 };
 
+static unsigned hswep_uncore_irp_ctrs[] = {0xa0, 0xa8, 0xb0, 0xb8};
+
+static u64 hswep_uncore_irp_read_counter(struct intel_uncore_box *box, struct perf_event *event)
+{
+        struct pci_dev *pdev = box->pci_dev;
+        struct hw_perf_event *hwc = &event->hw;
+        u64 count = 0;
+
+        pci_read_config_dword(pdev, hswep_uncore_irp_ctrs[hwc->idx], (u32 *)&count);
+        pci_read_config_dword(pdev, hswep_uncore_irp_ctrs[hwc->idx] + 4, (u32 *)&count + 1);
+
+        return count;
+}
+
 static struct intel_uncore_ops hswep_uncore_irp_ops = {
         .init_box       = snbep_uncore_pci_init_box,
         .disable_box    = snbep_uncore_pci_disable_box,
         .enable_box     = snbep_uncore_pci_enable_box,
         .disable_event  = ivbep_uncore_irp_disable_event,
         .enable_event   = ivbep_uncore_irp_enable_event,
-        .read_counter   = ivbep_uncore_irp_read_counter,
+        .read_counter   = hswep_uncore_irp_read_counter,
 };
 
 static struct intel_uncore_type hswep_uncore_irp = {
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index 1abcb50b48ae..ff86f19b5758 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -24,7 +24,6 @@ static char x86_stack_ids[][8] = {
                 [ DEBUG_STACK-1                 ]       = "#DB",
                 [ NMI_STACK-1                   ]       = "NMI",
                 [ DOUBLEFAULT_STACK-1           ]       = "#DF",
-                [ STACKFAULT_STACK-1            ]       = "#SS",
                 [ MCE_STACK-1                   ]       = "#MC",
 #if DEBUG_STKSZ > EXCEPTION_STKSZ
                 [ N_EXCEPTION_STACKS ...
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index df088bb03fb3..c0226ab54106 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -828,9 +828,15 @@ ENTRY(native_iret)
         jnz native_irq_return_ldt
 #endif
 
+.global native_irq_return_iret
 native_irq_return_iret:
+        /*
+         * This may fault.  Non-paranoid faults on return to userspace are
+         * handled by fixup_bad_iret.  These include #SS, #GP, and #NP.
+         * Double-faults due to espfix64 are handled in do_double_fault.
+         * Other faults here are fatal.
+         */
         iretq
-        _ASM_EXTABLE(native_irq_return_iret, bad_iret)
 
 #ifdef CONFIG_X86_ESPFIX64
 native_irq_return_ldt:
@@ -858,25 +864,6 @@ native_irq_return_ldt:
         jmp native_irq_return_iret
 #endif
 
-        .section .fixup,"ax"
-bad_iret:
-        /*
-         * The iret traps when the %cs or %ss being restored is bogus.
-         * We've lost the original trap vector and error code.
-         * #GPF is the most likely one to get for an invalid selector.
-         * So pretend we completed the iret and took the #GPF in user mode.
-         *
-         * We are now running with the kernel GS after exception recovery.
-         * But error_entry expects us to have user GS to match the user %cs,
-         * so swap back.
-         */
-        pushq $0
-
-        SWAPGS
-        jmp general_protection
-
-        .previous
-
         /* edi: workmask, edx: work */
 retint_careful:
         CFI_RESTORE_STATE
@@ -922,37 +909,6 @@ ENTRY(retint_kernel)
         CFI_ENDPROC
 END(common_interrupt)
 
-        /*
-         * If IRET takes a fault on the espfix stack, then we
-         * end up promoting it to a doublefault.  In that case,
-         * modify the stack to make it look like we just entered
-         * the #GP handler from user space, similar to bad_iret.
-         */
-#ifdef CONFIG_X86_ESPFIX64
-        ALIGN
-__do_double_fault:
-        XCPT_FRAME 1 RDI+8
-        movq RSP(%rdi),%rax             /* Trap on the espfix stack? */
-        sarq $PGDIR_SHIFT,%rax
-        cmpl $ESPFIX_PGD_ENTRY,%eax
-        jne do_double_fault             /* No, just deliver the fault */
-        cmpl $__KERNEL_CS,CS(%rdi)
-        jne do_double_fault
-        movq RIP(%rdi),%rax
-        cmpq $native_irq_return_iret,%rax
-        jne do_double_fault             /* This shouldn't happen... */
-        movq PER_CPU_VAR(kernel_stack),%rax
-        subq $(6*8-KERNEL_STACK_OFFSET),%rax    /* Reset to original stack */
-        movq %rax,RSP(%rdi)
-        movq $0,(%rax)                  /* Missing (lost) #GP error code */
-        movq $general_protection,RIP(%rdi)
-        retq
-        CFI_ENDPROC
-END(__do_double_fault)
-#else
-# define __do_double_fault do_double_fault
-#endif
-
 /*
  * APIC interrupts.
  */
@@ -1124,7 +1080,7 @@ idtentry overflow do_overflow has_error_code=0
 idtentry bounds do_bounds has_error_code=0
 idtentry invalid_op do_invalid_op has_error_code=0
 idtentry device_not_available do_device_not_available has_error_code=0
-idtentry double_fault __do_double_fault has_error_code=1 paranoid=1
+idtentry double_fault do_double_fault has_error_code=1 paranoid=1
 idtentry coprocessor_segment_overrun do_coprocessor_segment_overrun has_error_code=0
 idtentry invalid_TSS do_invalid_TSS has_error_code=1
 idtentry segment_not_present do_segment_not_present has_error_code=1
@@ -1289,7 +1245,7 @@ apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
 
 idtentry debug do_debug has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK
 idtentry int3 do_int3 has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK
-idtentry stack_segment do_stack_segment has_error_code=1 paranoid=1
+idtentry stack_segment do_stack_segment has_error_code=1
 #ifdef CONFIG_XEN
 idtentry xen_debug do_debug has_error_code=0
 idtentry xen_int3 do_int3 has_error_code=0
@@ -1399,17 +1355,16 @@ error_sti:
 
 /*
  * There are two places in the kernel that can potentially fault with
- * usergs. Handle them here. The exception handlers after iret run with
- * kernel gs again, so don't set the user space flag. B stepping K8s
- * sometimes report an truncated RIP for IRET exceptions returning to
- * compat mode. Check for these here too.
+ * usergs. Handle them here.  B stepping K8s sometimes report a
+ * truncated RIP for IRET exceptions returning to compat mode. Check
+ * for these here too.
  */
 error_kernelspace:
         CFI_REL_OFFSET rcx, RCX+8
         incl %ebx
         leaq native_irq_return_iret(%rip),%rcx
         cmpq %rcx,RIP+8(%rsp)
-        je error_swapgs
+        je error_bad_iret
         movl %ecx,%eax  /* zero extend */
         cmpq %rax,RIP+8(%rsp)
         je bstep_iret
@@ -1420,7 +1375,15 @@ error_kernelspace:
 bstep_iret:
         /* Fix truncated RIP */
         movq %rcx,RIP+8(%rsp)
-        jmp error_swapgs
+        /* fall through */
+
+error_bad_iret:
+        SWAPGS
+        mov %rsp,%rdi
+        call fixup_bad_iret
+        mov %rax,%rsp
+        decl %ebx       /* Return to usergs */
+        jmp error_sti
         CFI_ENDPROC
 END(error_entry)
 
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 749b0e423419..e510618b2e91 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1484,7 +1484,7 @@ unsigned long syscall_trace_enter_phase1(struct pt_regs *regs, u32 arch)
          */
         if (work & _TIF_NOHZ) {
                 user_exit();
-                work &= ~TIF_NOHZ;
+                work &= ~_TIF_NOHZ;
         }
 
 #ifdef CONFIG_SECCOMP
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 4d2128ac70bd..668d8f2a8781 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1303,10 +1303,14 @@ static void __ref remove_cpu_from_maps(int cpu)
         numa_remove_cpu(cpu);
 }
 
+static DEFINE_PER_CPU(struct completion, die_complete);
+
 void cpu_disable_common(void)
 {
         int cpu = smp_processor_id();
 
+        init_completion(&per_cpu(die_complete, smp_processor_id()));
+
         remove_siblinginfo(cpu);
 
         /* It's now safe to remove this processor from the online map */
@@ -1316,8 +1320,6 @@ void cpu_disable_common(void)
         fixup_irqs();
 }
 
-static DEFINE_PER_CPU(struct completion, die_complete);
-
 int native_cpu_disable(void)
 {
         int ret;
@@ -1327,16 +1329,21 @@ int native_cpu_disable(void)
                 return ret;
 
         clear_local_APIC();
-        init_completion(&per_cpu(die_complete, smp_processor_id()));
         cpu_disable_common();
 
         return 0;
 }
 
+void cpu_die_common(unsigned int cpu)
+{
+        wait_for_completion_timeout(&per_cpu(die_complete, cpu), HZ);
+}
+
 void native_cpu_die(unsigned int cpu)
 {
         /* We don't do anything here: idle task is faking death itself. */
-        wait_for_completion_timeout(&per_cpu(die_complete, cpu), HZ);
+
+        cpu_die_common(cpu);
 
         /* They ack this in play_dead() by setting CPU_DEAD */
         if (per_cpu(cpu_state, cpu) == CPU_DEAD) {
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 0d0e922fafc1..de801f22128a 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -233,32 +233,40 @@ DO_ERROR(X86_TRAP_UD,     SIGILL,  "invalid opcode",		invalid_op)
 DO_ERROR(X86_TRAP_OLD_MF, SIGFPE,  "coprocessor segment overrun",coprocessor_segment_overrun)
 DO_ERROR(X86_TRAP_TS,     SIGSEGV, "invalid TSS",               invalid_TSS)
 DO_ERROR(X86_TRAP_NP,     SIGBUS,  "segment not present",       segment_not_present)
-#ifdef CONFIG_X86_32
 DO_ERROR(X86_TRAP_SS,     SIGBUS,  "stack segment",             stack_segment)
-#endif
 DO_ERROR(X86_TRAP_AC,     SIGBUS,  "alignment check",           alignment_check)
 
 #ifdef CONFIG_X86_64
 /* Runs on IST stack */
-dotraplinkage void do_stack_segment(struct pt_regs *regs, long error_code)
-{
-        enum ctx_state prev_state;
-
-        prev_state = exception_enter();
-        if (notify_die(DIE_TRAP, "stack segment", regs, error_code,
-                       X86_TRAP_SS, SIGBUS) != NOTIFY_STOP) {
-                preempt_conditional_sti(regs);
-                do_trap(X86_TRAP_SS, SIGBUS, "stack segment", regs, error_code, NULL);
-                preempt_conditional_cli(regs);
-        }
-        exception_exit(prev_state);
-}
-
 dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
 {
         static const char str[] = "double fault";
         struct task_struct *tsk = current;
 
+#ifdef CONFIG_X86_ESPFIX64
+        extern unsigned char native_irq_return_iret[];
+
+        /*
+         * If IRET takes a non-IST fault on the espfix64 stack, then we
+         * end up promoting it to a doublefault.  In that case, modify
+         * the stack to make it look like we just entered the #GP
+         * handler from user space, similar to bad_iret.
+         */
+        if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY &&
+                regs->cs == __KERNEL_CS &&
+                regs->ip == (unsigned long)native_irq_return_iret)
+        {
+                struct pt_regs *normal_regs = task_pt_regs(current);
+
+                /* Fake a #GP(0) from userspace. */
+                memmove(&normal_regs->ip, (void *)regs->sp, 5*8);
+                normal_regs->orig_ax = 0;  /* Missing (lost) #GP error code */
+                regs->ip = (unsigned long)general_protection;
+                regs->sp = (unsigned long)&normal_regs->orig_ax;
+                return;
+        }
+#endif
+
         exception_enter();
         /* Return not checked because double check cannot be ignored */
         notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);
@@ -399,6 +407,35 @@ asmlinkage __visible struct pt_regs *sync_regs(struct pt_regs *eregs)
         return regs;
 }
 NOKPROBE_SYMBOL(sync_regs);
+
+struct bad_iret_stack {
+        void *error_entry_ret;
+        struct pt_regs regs;
+};
+
+asmlinkage __visible
+struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
+{
+        /*
+         * This is called from entry_64.S early in handling a fault
+         * caused by a bad iret to user mode.  To handle the fault
+         * correctly, we want move our stack frame to task_pt_regs
+         * and we want to pretend that the exception came from the
+         * iret target.
+         */
+        struct bad_iret_stack *new_stack =
+                container_of(task_pt_regs(current),
+                             struct bad_iret_stack, regs);
+
+        /* Copy the IRET target to the new stack. */
+        memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
+
+        /* Copy the remainder of the stack from the current stack. */
+        memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip));
+
+        BUG_ON(!user_mode_vm(&new_stack->regs));
+        return new_stack;
+}
 #endif
 
 /*
@@ -778,7 +815,7 @@ void __init trap_init(void)
         set_intr_gate(X86_TRAP_OLD_MF, coprocessor_segment_overrun);
         set_intr_gate(X86_TRAP_TS, invalid_TSS);
         set_intr_gate(X86_TRAP_NP, segment_not_present);
-        set_intr_gate_ist(X86_TRAP_SS, &stack_segment, STACKFAULT_STACK);
+        set_intr_gate(X86_TRAP_SS, stack_segment);
         set_intr_gate(X86_TRAP_GP, general_protection);
         set_intr_gate(X86_TRAP_SPURIOUS, spurious_interrupt_bug);
         set_intr_gate(X86_TRAP_MF, coprocessor_error);
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 5edf088ca51e..9f8a2faf5040 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4287,6 +4287,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
                 fetch_register_operand(op);
                 break;
         case OpCL:
+                op->type = OP_IMM;
                 op->bytes = 1;
                 op->val = reg_read(ctxt, VCPU_REGS_RCX) & 0xff;
                 break;
@@ -4294,6 +4295,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
                 rc = decode_imm(ctxt, op, 1, true);
                 break;
         case OpOne:
+                op->type = OP_IMM;
                 op->bytes = 1;
                 op->val = 1;
                 break;
@@ -4352,21 +4354,27 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
                 ctxt->memop.bytes = ctxt->op_bytes + 2;
                 goto mem_common;
         case OpES:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_ES;
                 break;
         case OpCS:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_CS;
                 break;
         case OpSS:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_SS;
                 break;
         case OpDS:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_DS;
                 break;
         case OpFS:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_FS;
                 break;
         case OpGS:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_GS;
                 break;
         case OpImplicit:
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index ac1c4de3a484..978f402006ee 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -630,7 +630,7 @@ static int mmu_spte_clear_track_bits(u64 *sptep)
          * kvm mmu, before reclaiming the page, we should
          * unmap it from mmu first.
          */
-        WARN_ON(!kvm_is_mmio_pfn(pfn) && !page_count(pfn_to_page(pfn)));
+        WARN_ON(!kvm_is_reserved_pfn(pfn) && !page_count(pfn_to_page(pfn)));
 
         if (!shadow_accessed_mask || old_spte & shadow_accessed_mask)
                 kvm_set_pfn_accessed(pfn);
@@ -2461,7 +2461,7 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
                 spte |= PT_PAGE_SIZE_MASK;
         if (tdp_enabled)
                 spte |= kvm_x86_ops->get_mt_mask(vcpu, gfn,
-                        kvm_is_mmio_pfn(pfn));
+                        kvm_is_reserved_pfn(pfn));
 
         if (host_writable)
                 spte |= SPTE_HOST_WRITEABLE;
@@ -2737,7 +2737,7 @@ static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
          * PT_PAGE_TABLE_LEVEL and there would be no adjustment done
          * here.
          */
-        if (!is_error_noslot_pfn(pfn) && !kvm_is_mmio_pfn(pfn) &&
+        if (!is_error_noslot_pfn(pfn) && !kvm_is_reserved_pfn(pfn) &&
             level == PT_PAGE_TABLE_LEVEL &&
             PageTransCompound(pfn_to_page(pfn)) &&
             !has_wrprotected_page(vcpu->kvm, gfn, PT_DIRECTORY_LEVEL)) {
diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
index 7609e0e421ec..1318f75d56e4 100644
--- a/arch/x86/lib/csum-wrappers_64.c
+++ b/arch/x86/lib/csum-wrappers_64.c
@@ -41,9 +41,8 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
                 while (((unsigned long)src & 6) && len >= 2) {
                         __u16 val16;
 
-                        *errp = __get_user(val16, (const __u16 __user *)src);
-                        if (*errp)
-                                return isum;
+                        if (__get_user(val16, (const __u16 __user *)src))
+                                goto out_err;
 
                         *(__u16 *)dst = val16;
                         isum = (__force __wsum)add32_with_carry(
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 4cb8763868fc..4e5dfec750fc 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1123,7 +1123,7 @@ void mark_rodata_ro(void)
         unsigned long end = (unsigned long) &__end_rodata_hpage_align;
         unsigned long text_end = PFN_ALIGN(&__stop___ex_table);
         unsigned long rodata_end = PFN_ALIGN(&__end_rodata);
-        unsigned long all_end = PFN_ALIGN(&_end);
+        unsigned long all_end;
 
         printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n",
                (end - start) >> 10);
@@ -1134,7 +1134,16 @@ void mark_rodata_ro(void)
         /*
          * The rodata/data/bss/brk section (but not the kernel text!)
          * should also be not-executable.
+         *
+         * We align all_end to PMD_SIZE because the existing mapping
+         * is a full PMD. If we would align _brk_end to PAGE_SIZE we
+         * split the PMD and the reminder between _brk_end and the end
+         * of the PMD will remain mapped executable.
+         *
+         * Any PMD which was setup after the one which covers _brk_end
+         * has been zapped already via cleanup_highmem().
          */
+        all_end = roundup((unsigned long)_brk_end, PMD_SIZE);
         set_memory_nx(rodata_start, (all_end - rodata_start) >> PAGE_SHIFT);
 
         rodata_test();
diff --git a/arch/x86/tools/calc_run_size.pl b/arch/x86/tools/calc_run_size.pl
new file mode 100644
index 000000000000..23210baade2d
--- /dev/null
+++ b/arch/x86/tools/calc_run_size.pl
@@ -0,0 +1,39 @@
+#!/usr/bin/perl
+#
+# Calculate the amount of space needed to run the kernel, including room for
+# the .bss and .brk sections.
+#
+# Usage:
+# objdump -h a.out | perl calc_run_size.pl
+use strict;
+
+my $mem_size = 0;
+my $file_offset = 0;
+
+my $sections=" *[0-9]+ \.(?:bss|brk) +";
+while (<>) {
+        if (/^$sections([0-9a-f]+) +(?:[0-9a-f]+ +){2}([0-9a-f]+)/) {
+                my $size = hex($1);
+                my $offset = hex($2);
+                $mem_size += $size;
+                if ($file_offset == 0) {
+                        $file_offset = $offset;
+                } elsif ($file_offset != $offset) {
+                        # BFD linker shows the same file offset in ELF.
+                        # Gold linker shows them as consecutive.
+                        next if ($file_offset + $mem_size == $offset + $size);
+
+                        printf STDERR "file_offset: 0x%lx\n", $file_offset;
+                        printf STDERR "mem_size: 0x%lx\n", $mem_size;
+                        printf STDERR "offset: 0x%lx\n", $offset;
+                        printf STDERR "size: 0x%lx\n", $size;
+
+                        die ".bss and .brk are non-contiguous\n";
+                }
+        }
+}
+
+if ($file_offset == 0) {
+        die "Never found .bss or .brk file offset\n";
+}
+printf("%d\n", $mem_size + $file_offset);
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 8650cdb53209..4c071aeb8417 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -510,6 +510,9 @@ static void xen_cpu_die(unsigned int cpu)
                 current->state = TASK_UNINTERRUPTIBLE;
                 schedule_timeout(HZ/10);
         }
+
+        cpu_die_common(cpu);
+
         xen_smp_intr_free(cpu);
         xen_uninit_lock_cpu(cpu);
         xen_teardown_timer(cpu);
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 49c6c3d94449..81f57e8c8f1b 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -319,8 +319,8 @@ config XTENSA_PLATFORM_S6105
 
 config XTENSA_PLATFORM_XTFPGA
         bool "XTFPGA"
+        select ETHOC if ETHERNET
         select SERIAL_CONSOLE
-        select ETHOC
         select XTENSA_CALIBRATE_CCOUNT
         help
           XTFPGA is the name of Tensilica board family (LX60, LX110, LX200, ML605).
@@ -367,7 +367,7 @@ config BUILTIN_DTB
 config BLK_DEV_SIMDISK
         tristate "Host file-based simulated block device support"
         default n
-        depends on XTENSA_PLATFORM_ISS
+        depends on XTENSA_PLATFORM_ISS && BLOCK
         help
           Create block devices that map to files in the host file system.
           Device binding to host file may be changed at runtime via proc
diff --git a/arch/xtensa/boot/dts/lx200mx.dts b/arch/xtensa/boot/dts/lx200mx.dts
new file mode 100644
index 000000000000..249822b99bd6
--- /dev/null
+++ b/arch/xtensa/boot/dts/lx200mx.dts
@@ -0,0 +1,16 @@
+/dts-v1/;
+/include/ "xtfpga.dtsi"
+/include/ "xtfpga-flash-16m.dtsi"
+
+/ {
+        compatible = "cdns,xtensa-lx200";
+        memory@0 {
+                device_type = "memory";
+                reg = <0x00000000 0x06000000>;
+        };
+        pic: pic {
+                compatible = "cdns,xtensa-mx";
+                #interrupt-cells = <2>;
+                interrupt-controller;
+        };
+};
diff --git a/arch/xtensa/configs/generic_kc705_defconfig b/arch/xtensa/configs/generic_kc705_defconfig
new file mode 100644
index 000000000000..f4b7b3888da8
--- /dev/null
+++ b/arch/xtensa/configs/generic_kc705_defconfig
@@ -0,0 +1,131 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_FHANDLE=y
+CONFIG_IRQ_DOMAIN_DEBUG=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_CGROUP_DEBUG=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_RESOURCE_COUNTERS=y
+CONFIG_MEMCG=y
+CONFIG_NAMESPACES=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_RELAY=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EXPERT=y
+CONFIG_SYSCTL_SYSCALL=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_OPROFILE=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_IOSCHED_DEADLINE is not set
+# CONFIG_IOSCHED_CFQ is not set
+CONFIG_XTENSA_VARIANT_DC233C=y
+CONFIG_XTENSA_UNALIGNED_USER=y
+CONFIG_PREEMPT=y
+CONFIG_HIGHMEM=y
+# CONFIG_PCI is not set
+CONFIG_XTENSA_PLATFORM_XTFPGA=y
+CONFIG_CMDLINE_BOOL=y
+CONFIG_CMDLINE="earlycon=uart8250,mmio32,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug"
+CONFIG_USE_OF=y
+CONFIG_BUILTIN_DTB="kc705"
+# CONFIG_COMPACTION is not set
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_RARP=y
+# CONFIG_IPV6 is not set
+CONFIG_NETFILTER=y
+# CONFIG_WIRELESS is not set
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+# CONFIG_STANDALONE is not set
+CONFIG_MTD=y
+CONFIG_MTD_CFI=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_CFI_INTELEXT=y
+CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_PHYSMAP_OF=y
+CONFIG_MTD_UBI=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_SCSI=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_NETDEVICES=y
+# CONFIG_NET_VENDOR_ARC is not set
+# CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_VENDOR_INTEL is not set
+# CONFIG_NET_VENDOR_MARVELL is not set
+# CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_SAMSUNG is not set
+# CONFIG_NET_VENDOR_SEEQ is not set
+# CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
+# CONFIG_NET_VENDOR_WIZNET is not set
+CONFIG_MARVELL_PHY=y
+# CONFIG_WLAN is not set
+# CONFIG_INPUT_MOUSEDEV is not set
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_SERIO is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_HW_RANDOM=y
+# CONFIG_HWMON is not set
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_SOFT_WATCHDOG=y
+# CONFIG_VGA_CONSOLE is not set
+# CONFIG_USB_SUPPORT is not set
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_VFAT_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_UBIFS_FS=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_SWAP=y
+CONFIG_ROOT_NFS=y
+CONFIG_SUNRPC_DEBUG=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_PRINTK_TIME=y
+CONFIG_DYNAMIC_DEBUG=y
+CONFIG_DEBUG_INFO=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_LOCKUP_DETECTOR=y
+# CONFIG_SCHED_DEBUG is not set
+CONFIG_SCHEDSTATS=y
+CONFIG_TIMER_STATS=y
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_ATOMIC_SLEEP=y
+CONFIG_STACKTRACE=y
+CONFIG_RCU_TRACE=y
+# CONFIG_FTRACE is not set
+CONFIG_LD_NO_RELAX=y
+# CONFIG_S32C1I_SELFTEST is not set
+CONFIG_CRYPTO_ANSI_CPRNG=y
diff --git a/arch/xtensa/configs/smp_lx200_defconfig b/arch/xtensa/configs/smp_lx200_defconfig
new file mode 100644
index 000000000000..22eeacba37cc
--- /dev/null
+++ b/arch/xtensa/configs/smp_lx200_defconfig
@@ -0,0 +1,135 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_FHANDLE=y
+CONFIG_IRQ_DOMAIN_DEBUG=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_CGROUP_DEBUG=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_RESOURCE_COUNTERS=y
+CONFIG_MEMCG=y
+CONFIG_NAMESPACES=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_RELAY=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EXPERT=y
+CONFIG_SYSCTL_SYSCALL=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_OPROFILE=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_IOSCHED_DEADLINE is not set
+# CONFIG_IOSCHED_CFQ is not set
+CONFIG_XTENSA_VARIANT_CUSTOM=y
+CONFIG_XTENSA_VARIANT_CUSTOM_NAME="test_mmuhifi_c3"
+CONFIG_XTENSA_UNALIGNED_USER=y
+CONFIG_PREEMPT=y
+CONFIG_HAVE_SMP=y
+CONFIG_SMP=y
+CONFIG_HOTPLUG_CPU=y
+# CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set
+# CONFIG_PCI is not set
+CONFIG_XTENSA_PLATFORM_XTFPGA=y
+CONFIG_CMDLINE_BOOL=y
+CONFIG_CMDLINE="earlycon=uart8250,mmio32,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug"
+CONFIG_USE_OF=y
+CONFIG_BUILTIN_DTB="lx200mx"
+# CONFIG_COMPACTION is not set
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_RARP=y
+# CONFIG_IPV6 is not set
+CONFIG_NETFILTER=y
+# CONFIG_WIRELESS is not set
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+# CONFIG_STANDALONE is not set
+CONFIG_MTD=y
+CONFIG_MTD_CFI=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_CFI_INTELEXT=y
+CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_PHYSMAP_OF=y
+CONFIG_MTD_UBI=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_SCSI=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_NETDEVICES=y
+# CONFIG_NET_VENDOR_ARC is not set
+# CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_VENDOR_INTEL is not set
+# CONFIG_NET_VENDOR_MARVELL is not set
+# CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_SAMSUNG is not set
+# CONFIG_NET_VENDOR_SEEQ is not set
+# CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
+# CONFIG_NET_VENDOR_WIZNET is not set
+CONFIG_MARVELL_PHY=y
+# CONFIG_WLAN is not set
+# CONFIG_INPUT_MOUSEDEV is not set
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_SERIO is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_HW_RANDOM=y
+# CONFIG_HWMON is not set
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_SOFT_WATCHDOG=y
+# CONFIG_VGA_CONSOLE is not set
+# CONFIG_USB_SUPPORT is not set
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_VFAT_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_UBIFS_FS=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_SWAP=y
+CONFIG_ROOT_NFS=y
+CONFIG_SUNRPC_DEBUG=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_PRINTK_TIME=y
+CONFIG_DYNAMIC_DEBUG=y
+CONFIG_DEBUG_INFO=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_VM=y
+CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SCHEDSTATS=y
+CONFIG_TIMER_STATS=y
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_ATOMIC_SLEEP=y
+CONFIG_STACKTRACE=y
+CONFIG_RCU_TRACE=y
+# CONFIG_FTRACE is not set
+CONFIG_LD_NO_RELAX=y
+# CONFIG_S32C1I_SELFTEST is not set
+CONFIG_CRYPTO_ANSI_CPRNG=y
diff --git a/arch/xtensa/include/asm/pgtable.h b/arch/xtensa/include/asm/pgtable.h
index b2173e5da601..0383aed59121 100644
--- a/arch/xtensa/include/asm/pgtable.h
+++ b/arch/xtensa/include/asm/pgtable.h
@@ -277,6 +277,8 @@ static inline pte_t pte_mkwrite(pte_t pte)
 static inline pte_t pte_mkspecial(pte_t pte)
         { return pte; }
 
+#define pgprot_noncached(prot) (__pgprot(pgprot_val(prot) & ~_PAGE_CA_MASK))
+
 /*
  * Conversion functions: convert a page and protection to a page entry,
  * and a page entry and page directory to the page they refer to.
diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h
index 8883fc877c5c..db5bb72e2f4e 100644
--- a/arch/xtensa/include/uapi/asm/unistd.h
+++ b/arch/xtensa/include/uapi/asm/unistd.h
@@ -384,7 +384,8 @@ __SYSCALL(174, sys_chroot, 1)
 #define __NR_pivot_root                         175
 __SYSCALL(175, sys_pivot_root, 2)
 #define __NR_umount                             176
-__SYSCALL(176, sys_umount, 2)
+__SYSCALL(176, sys_oldumount, 1)
+#define __ARCH_WANT_SYS_OLDUMOUNT
 #define __NR_swapoff                            177
 __SYSCALL(177, sys_swapoff, 1)
 #define __NR_sync                               178
@@ -742,7 +743,14 @@ __SYSCALL(335, sys_sched_getattr, 3)
 #define __NR_renameat2                          336
 __SYSCALL(336, sys_renameat2, 5)
 
-#define __NR_syscall_count                      337
+#define __NR_seccomp                            337
+__SYSCALL(337, sys_seccomp, 3)
+#define __NR_getrandom                          338
+__SYSCALL(338, sys_getrandom, 3)
+#define __NR_memfd_create                       339
+__SYSCALL(339, sys_memfd_create, 2)
+
+#define __NR_syscall_count                      340
 
 /*
  * sysxtensa syscall handler
diff --git a/block/blk-merge.c b/block/blk-merge.c
index b3ac40aef46b..89b97b5e0881 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -97,19 +97,22 @@ void blk_recalc_rq_segments(struct request *rq)
 
 void blk_recount_segments(struct request_queue *q, struct bio *bio)
 {
-        bool no_sg_merge = !!test_bit(QUEUE_FLAG_NO_SG_MERGE,
-                        &q->queue_flags);
-        bool merge_not_need = bio->bi_vcnt < queue_max_segments(q);
+        unsigned short seg_cnt;
+
+        /* estimate segment number by bi_vcnt for non-cloned bio */
+        if (bio_flagged(bio, BIO_CLONED))
+                seg_cnt = bio_segments(bio);
+        else
+                seg_cnt = bio->bi_vcnt;
 
-        if (no_sg_merge && !bio_flagged(bio, BIO_CLONED) &&
-                        merge_not_need)
-                bio->bi_phys_segments = bio->bi_vcnt;
+        if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags) &&
+                        (seg_cnt < queue_max_segments(q)))
+                bio->bi_phys_segments = seg_cnt;
         else {
                 struct bio *nxt = bio->bi_next;
 
                 bio->bi_next = NULL;
-                bio->bi_phys_segments = __blk_recalc_rq_segments(q, bio,
-                                no_sg_merge && merge_not_need);
+                bio->bi_phys_segments = __blk_recalc_rq_segments(q, bio, false);
                 bio->bi_next = nxt;
         }
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 68929bad9a6a..1d016fc9a8b6 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -107,11 +107,7 @@ static void blk_mq_usage_counter_release(struct percpu_ref *ref)
         wake_up_all(&q->mq_freeze_wq);
 }
 
-/*
- * Guarantee no request is in use, so we can change any data structure of
- * the queue afterward.
- */
-void blk_mq_freeze_queue(struct request_queue *q)
+static void blk_mq_freeze_queue_start(struct request_queue *q)
 {
         bool freeze;
 
@@ -123,9 +119,23 @@ void blk_mq_freeze_queue(struct request_queue *q)
                 percpu_ref_kill(&q->mq_usage_counter);
                 blk_mq_run_queues(q, false);
         }
+}
+
+static void blk_mq_freeze_queue_wait(struct request_queue *q)
+{
         wait_event(q->mq_freeze_wq, percpu_ref_is_zero(&q->mq_usage_counter));
 }
 
+/*
+ * Guarantee no request is in use, so we can change any data structure of
+ * the queue afterward.
+ */
+void blk_mq_freeze_queue(struct request_queue *q)
+{
+        blk_mq_freeze_queue_start(q);
+        blk_mq_freeze_queue_wait(q);
+}
+
 static void blk_mq_unfreeze_queue(struct request_queue *q)
 {
         bool wake;
@@ -1921,7 +1931,7 @@ void blk_mq_free_queue(struct request_queue *q)
 /* Basically redo blk_mq_init_queue with queue frozen */
 static void blk_mq_queue_reinit(struct request_queue *q)
 {
-        blk_mq_freeze_queue(q);
+        WARN_ON_ONCE(!q->mq_freeze_depth);
 
         blk_mq_sysfs_unregister(q);
 
@@ -1936,8 +1946,6 @@ static void blk_mq_queue_reinit(struct request_queue *q)
         blk_mq_map_swqueue(q);
 
         blk_mq_sysfs_register(q);
-
-        blk_mq_unfreeze_queue(q);
 }
 
 static int blk_mq_queue_reinit_notify(struct notifier_block *nb,
@@ -1956,8 +1964,25 @@ static int blk_mq_queue_reinit_notify(struct notifier_block *nb,
                 return NOTIFY_OK;
 
         mutex_lock(&all_q_mutex);
+
+        /*
+         * We need to freeze and reinit all existing queues.  Freezing
+         * involves synchronous wait for an RCU grace period and doing it
+         * one by one may take a long time.  Start freezing all queues in
+         * one swoop and then wait for the completions so that freezing can
+         * take place in parallel.
+         */
+        list_for_each_entry(q, &all_q_list, all_q_node)
+                blk_mq_freeze_queue_start(q);
+        list_for_each_entry(q, &all_q_list, all_q_node)
+                blk_mq_freeze_queue_wait(q);
+
         list_for_each_entry(q, &all_q_list, all_q_node)
                 blk_mq_queue_reinit(q);
+
+        list_for_each_entry(q, &all_q_list, all_q_node)
+                blk_mq_unfreeze_queue(q);
+
         mutex_unlock(&all_q_mutex);
         return NOTIFY_OK;
 }
diff --git a/block/ioprio.c b/block/ioprio.c
index e50170ca7c33..31666c92b46a 100644
--- a/block/ioprio.c
+++ b/block/ioprio.c
@@ -157,14 +157,16 @@ out:
 
 int ioprio_best(unsigned short aprio, unsigned short bprio)
 {
-        unsigned short aclass = IOPRIO_PRIO_CLASS(aprio);
-        unsigned short bclass = IOPRIO_PRIO_CLASS(bprio);
+        unsigned short aclass;
+        unsigned short bclass;
 
-        if (aclass == IOPRIO_CLASS_NONE)
-                aclass = IOPRIO_CLASS_BE;
-        if (bclass == IOPRIO_CLASS_NONE)
-                bclass = IOPRIO_CLASS_BE;
+        if (!ioprio_valid(aprio))
+                aprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, IOPRIO_NORM);
+        if (!ioprio_valid(bprio))
+                bprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, IOPRIO_NORM);
 
+        aclass = IOPRIO_PRIO_CLASS(aprio);
+        bclass = IOPRIO_PRIO_CLASS(bprio);
         if (aclass == bclass)
                 return min(aprio, bprio);
         if (aclass > bclass)
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 1e053d911240..b0c2a616c8f9 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -458,7 +458,7 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
         rq = blk_get_request(q, in_len ? WRITE : READ, __GFP_WAIT);
         if (IS_ERR(rq)) {
                 err = PTR_ERR(rq);
-                goto error;
+                goto error_free_buffer;
         }
         blk_rq_set_block_pc(rq);
 
@@ -531,9 +531,11 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
         }
         
 error:
+        blk_put_request(rq);
+
+error_free_buffer:
         kfree(buffer);
-        if (rq)
-                blk_put_request(rq);
+
         return err;
 }
 EXPORT_SYMBOL_GPL(sg_scsi_ioctl);
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index ed122e17636e..7556e7c4a055 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -290,6 +290,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                     DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3446"),
                 },
         },
+        {
+        .callback = dmi_disable_osi_win8,
+        .ident = "Dell Vostro 3546",
+        .matches = {
+                    DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                    DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3546"),
+                },
+        },
 
         /*
          * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 143ec6ea1468..7db193160766 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -878,7 +878,7 @@ int acpi_dev_suspend_late(struct device *dev)
                 return 0;
 
         target_state = acpi_target_system_state();
-        wakeup = device_may_wakeup(dev);
+        wakeup = device_may_wakeup(dev) && acpi_device_can_wakeup(adev);
         error = acpi_device_wakeup(adev, target_state, wakeup);
         if (wakeup && error)
                 return error;
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 5f039f191067..e45f83789809 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -60,6 +60,7 @@ enum board_ids {
         /* board IDs by feature in alphabetical order */
         board_ahci,
         board_ahci_ign_iferr,
+        board_ahci_nomsi,
         board_ahci_noncq,
         board_ahci_nosntf,
         board_ahci_yes_fbs,
@@ -121,6 +122,13 @@ static const struct ata_port_info ahci_port_info[] = {
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &ahci_ops,
         },
+        [board_ahci_nomsi] = {
+                AHCI_HFLAGS     (AHCI_HFLAG_NO_MSI),
+                .flags          = AHCI_FLAG_COMMON,
+                .pio_mask       = ATA_PIO4,
+                .udma_mask      = ATA_UDMA6,
+                .port_ops       = &ahci_ops,
+        },
         [board_ahci_noncq] = {
                 AHCI_HFLAGS     (AHCI_HFLAG_NO_NCQ),
                 .flags          = AHCI_FLAG_COMMON,
@@ -313,6 +321,11 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
         { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
         { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
+        { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
+        { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
@@ -475,10 +488,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1062 */
 
         /*
-         * Samsung SSDs found on some macbooks.  NCQ times out.
-         * https://bugzilla.kernel.org/show_bug.cgi?id=60731
+         * Samsung SSDs found on some macbooks.  NCQ times out if MSI is
+         * enabled.  https://bugzilla.kernel.org/show_bug.cgi?id=60731
          */
-        { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_noncq },
+        { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi },
 
         /* Enmotus */
         { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
@@ -514,12 +527,9 @@ MODULE_PARM_DESC(marvell_enable, "Marvell SATA via AHCI (1 = enabled)");
 static void ahci_pci_save_initial_config(struct pci_dev *pdev,
                                          struct ahci_host_priv *hpriv)
 {
-        unsigned int force_port_map = 0;
-        unsigned int mask_port_map = 0;
-
         if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) {
                 dev_info(&pdev->dev, "JMB361 has only one port\n");
-                force_port_map = 1;
+                hpriv->force_port_map = 1;
         }
 
         /*
@@ -529,9 +539,9 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
          */
         if (hpriv->flags & AHCI_HFLAG_MV_PATA) {
                 if (pdev->device == 0x6121)
-                        mask_port_map = 0x3;
+                        hpriv->mask_port_map = 0x3;
                 else
-                        mask_port_map = 0xf;
+                        hpriv->mask_port_map = 0xf;
                 dev_info(&pdev->dev,
                           "Disabling your PATA port. Use the boot option 'ahci.marvell_enable=0' to avoid this.\n");
         }
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 5eb61c9e63da..97683e45ab04 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -1778,16 +1778,15 @@ static void ahci_handle_port_interrupt(struct ata_port *ap,
         }
 }
 
-static void ahci_update_intr_status(struct ata_port *ap)
+static void ahci_port_intr(struct ata_port *ap)
 {
         void __iomem *port_mmio = ahci_port_base(ap);
-        struct ahci_port_priv *pp = ap->private_data;
         u32 status;
 
         status = readl(port_mmio + PORT_IRQ_STAT);
         writel(status, port_mmio + PORT_IRQ_STAT);
 
-        atomic_or(status, &pp->intr_status);
+        ahci_handle_port_interrupt(ap, port_mmio, status);
 }
 
 static irqreturn_t ahci_port_thread_fn(int irq, void *dev_instance)
@@ -1808,34 +1807,6 @@ static irqreturn_t ahci_port_thread_fn(int irq, void *dev_instance)
         return IRQ_HANDLED;
 }
 
-irqreturn_t ahci_thread_fn(int irq, void *dev_instance)
-{
-        struct ata_host *host = dev_instance;
-        struct ahci_host_priv *hpriv = host->private_data;
-        u32 irq_masked = hpriv->port_map;
-        unsigned int i;
-
-        for (i = 0; i < host->n_ports; i++) {
-                struct ata_port *ap;
-
-                if (!(irq_masked & (1 << i)))
-                        continue;
-
-                ap = host->ports[i];
-                if (ap) {
-                        ahci_port_thread_fn(irq, ap);
-                        VPRINTK("port %u\n", i);
-                } else {
-                        VPRINTK("port %u (no irq)\n", i);
-                        if (ata_ratelimit())
-                                dev_warn(host->dev,
-                                         "interrupt on disabled port %u\n", i);
-                }
-        }
-
-        return IRQ_HANDLED;
-}
-
 static irqreturn_t ahci_multi_irqs_intr(int irq, void *dev_instance)
 {
         struct ata_port *ap = dev_instance;
@@ -1875,6 +1846,8 @@ static irqreturn_t ahci_single_irq_intr(int irq, void *dev_instance)
 
         irq_masked = irq_stat & hpriv->port_map;
 
+        spin_lock(&host->lock);
+
         for (i = 0; i < host->n_ports; i++) {
                 struct ata_port *ap;
 
@@ -1883,7 +1856,7 @@ static irqreturn_t ahci_single_irq_intr(int irq, void *dev_instance)
 
                 ap = host->ports[i];
                 if (ap) {
-                        ahci_update_intr_status(ap);
+                        ahci_port_intr(ap);
                         VPRINTK("port %u\n", i);
                 } else {
                         VPRINTK("port %u (no irq)\n", i);
@@ -1906,9 +1879,11 @@ static irqreturn_t ahci_single_irq_intr(int irq, void *dev_instance)
          */
         writel(irq_stat, mmio + HOST_IRQ_STAT);
 
+        spin_unlock(&host->lock);
+
         VPRINTK("EXIT\n");
 
-        return handled ? IRQ_WAKE_THREAD : IRQ_NONE;
+        return IRQ_RETVAL(handled);
 }
 
 unsigned int ahci_qc_issue(struct ata_queued_cmd *qc)
@@ -2320,8 +2295,13 @@ static int ahci_port_start(struct ata_port *ap)
          */
         pp->intr_mask = DEF_PORT_IRQ;
 
-        spin_lock_init(&pp->lock);
-        ap->lock = &pp->lock;
+        /*
+         * Switch to per-port locking in case each port has its own MSI vector.
+         */
+        if ((hpriv->flags & AHCI_HFLAG_MULTI_MSI)) {
+                spin_lock_init(&pp->lock);
+                ap->lock = &pp->lock;
+        }
 
         ap->private_data = pp;
 
@@ -2482,31 +2462,6 @@ out_free_irqs:
         return rc;
 }
 
-static int ahci_host_activate_single_irq(struct ata_host *host, int irq,
-                                         struct scsi_host_template *sht)
-{
-        int i, rc;
-
-        rc = ata_host_start(host);
-        if (rc)
-                return rc;
-
-        rc = devm_request_threaded_irq(host->dev, irq, ahci_single_irq_intr,
-                                       ahci_thread_fn, IRQF_SHARED,
-                                       dev_driver_string(host->dev), host);
-        if (rc)
-                return rc;
-
-        for (i = 0; i < host->n_ports; i++)
-                ata_port_desc(host->ports[i], "irq %d", irq);
-
-        rc = ata_host_register(host, sht);
-        if (rc)
-                devm_free_irq(host->dev, irq, host);
-
-        return rc;
-}
-
 /**
  *      ahci_host_activate - start AHCI host, request IRQs and register it
  *      @host: target ATA host
@@ -2532,7 +2487,8 @@ int ahci_host_activate(struct ata_host *host, int irq,
         if (hpriv->flags & AHCI_HFLAG_MULTI_MSI)
                 rc = ahci_host_activate_multi_irqs(host, irq, sht);
         else
-                rc = ahci_host_activate_single_irq(host, irq, sht);
+                rc = ata_host_activate(host, irq, ahci_single_irq_intr,
+                                       IRQF_SHARED, sht);
         return rc;
 }
 EXPORT_SYMBOL_GPL(ahci_host_activate);
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 61eb6d77dac7..ea1fbc1d4c5f 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -146,6 +146,7 @@
 enum sata_rcar_type {
         RCAR_GEN1_SATA,
         RCAR_GEN2_SATA,
+        RCAR_R8A7790_ES1_SATA,
 };
 
 struct sata_rcar_priv {
@@ -763,6 +764,9 @@ static void sata_rcar_setup_port(struct ata_host *host)
         ap->udma_mask   = ATA_UDMA6;
         ap->flags       |= ATA_FLAG_SATA;
 
+        if (priv->type == RCAR_R8A7790_ES1_SATA)
+                ap->flags       |= ATA_FLAG_NO_DIPM;
+
         ioaddr->cmd_addr = base + SDATA_REG;
         ioaddr->ctl_addr = base + SSDEVCON_REG;
         ioaddr->scr_addr = base + SCRSSTS_REG;
@@ -792,6 +796,7 @@ static void sata_rcar_init_controller(struct ata_host *host)
                 sata_rcar_gen1_phy_init(priv);
                 break;
         case RCAR_GEN2_SATA:
+        case RCAR_R8A7790_ES1_SATA:
                 sata_rcar_gen2_phy_init(priv);
                 break;
         default:
@@ -838,9 +843,17 @@ static struct of_device_id sata_rcar_match[] = {
                 .data = (void *)RCAR_GEN2_SATA
         },
         {
+                .compatible = "renesas,sata-r8a7790-es1",
+                .data = (void *)RCAR_R8A7790_ES1_SATA
+        },
+        {
                 .compatible = "renesas,sata-r8a7791",
                 .data = (void *)RCAR_GEN2_SATA
         },
+        {
+                .compatible = "renesas,sata-r8a7793",
+                .data = (void *)RCAR_GEN2_SATA
+        },
         { },
 };
 MODULE_DEVICE_TABLE(of, sata_rcar_match);
@@ -849,7 +862,9 @@ static const struct platform_device_id sata_rcar_id_table[] = {
         { "sata_rcar", RCAR_GEN1_SATA }, /* Deprecated by "sata-r8a7779" */
         { "sata-r8a7779", RCAR_GEN1_SATA },
         { "sata-r8a7790", RCAR_GEN2_SATA },
+        { "sata-r8a7790-es1", RCAR_R8A7790_ES1_SATA },
         { "sata-r8a7791", RCAR_GEN2_SATA },
+        { "sata-r8a7793", RCAR_GEN2_SATA },
         { },
 };
 MODULE_DEVICE_TABLE(platform, sata_rcar_id_table);
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 7652e8dc188f..21b0bc6a9c96 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1225,11 +1225,13 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
         card->config_regs = pci_iomap(dev, 0, CONFIG_RAM_SIZE);
         if (!card->config_regs) {
                 dev_warn(&dev->dev, "Failed to ioremap config registers\n");
+                err = -ENOMEM;
                 goto out_release_regions;
         }
         card->buffers = pci_iomap(dev, 1, DATA_RAM_SIZE);
         if (!card->buffers) {
                 dev_warn(&dev->dev, "Failed to ioremap data buffers\n");
+                err = -ENOMEM;
                 goto out_unmap_config;
         }
 
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 40bc2f4072cc..fb83d4acd400 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -361,9 +361,19 @@ static int __pm_genpd_save_device(struct pm_domain_data *pdd,
         struct device *dev = pdd->dev;
         int ret = 0;
 
-        if (gpd_data->need_restore)
+        if (gpd_data->need_restore > 0)
                 return 0;
 
+        /*
+         * If the value of the need_restore flag is still unknown at this point,
+         * we trust that pm_genpd_poweroff() has verified that the device is
+         * already runtime PM suspended.
+         */
+        if (gpd_data->need_restore < 0) {
+                gpd_data->need_restore = 1;
+                return 0;
+        }
+
         mutex_unlock(&genpd->lock);
 
         genpd_start_dev(genpd, dev);
@@ -373,7 +383,7 @@ static int __pm_genpd_save_device(struct pm_domain_data *pdd,
         mutex_lock(&genpd->lock);
 
         if (!ret)
-                gpd_data->need_restore = true;
+                gpd_data->need_restore = 1;
 
         return ret;
 }
@@ -389,12 +399,17 @@ static void __pm_genpd_restore_device(struct pm_domain_data *pdd,
 {
         struct generic_pm_domain_data *gpd_data = to_gpd_data(pdd);
         struct device *dev = pdd->dev;
-        bool need_restore = gpd_data->need_restore;
+        int need_restore = gpd_data->need_restore;
 
-        gpd_data->need_restore = false;
+        gpd_data->need_restore = 0;
         mutex_unlock(&genpd->lock);
 
         genpd_start_dev(genpd, dev);
+
+        /*
+         * Call genpd_restore_dev() for recently added devices too (need_restore
+         * is negative then).
+         */
         if (need_restore)
                 genpd_restore_dev(genpd, dev);
 
@@ -603,6 +618,7 @@ static void genpd_power_off_work_fn(struct work_struct *work)
 static int pm_genpd_runtime_suspend(struct device *dev)
 {
         struct generic_pm_domain *genpd;
+        struct generic_pm_domain_data *gpd_data;
         bool (*stop_ok)(struct device *__dev);
         int ret;
 
@@ -628,6 +644,16 @@ static int pm_genpd_runtime_suspend(struct device *dev)
                 return 0;
 
         mutex_lock(&genpd->lock);
+
+        /*
+         * If we have an unknown state of the need_restore flag, it means none
+         * of the runtime PM callbacks has been invoked yet. Let's update the
+         * flag to reflect that the current state is active.
+         */
+        gpd_data = to_gpd_data(dev->power.subsys_data->domain_data);
+        if (gpd_data->need_restore < 0)
+                gpd_data->need_restore = 0;
+
         genpd->in_progress++;
         pm_genpd_poweroff(genpd);
         genpd->in_progress--;
@@ -1437,12 +1463,12 @@ int __pm_genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
         spin_unlock_irq(&dev->power.lock);
 
         if (genpd->attach_dev)
-                genpd->attach_dev(dev);
+                genpd->attach_dev(genpd, dev);
 
         mutex_lock(&gpd_data->lock);
         gpd_data->base.dev = dev;
         list_add_tail(&gpd_data->base.list_node, &genpd->dev_list);
-        gpd_data->need_restore = genpd->status == GPD_STATE_POWER_OFF;
+        gpd_data->need_restore = -1;
         gpd_data->td.constraint_changed = true;
         gpd_data->td.effective_constraint_ns = -1;
         mutex_unlock(&gpd_data->lock);
@@ -1499,7 +1525,7 @@ int pm_genpd_remove_device(struct generic_pm_domain *genpd,
         genpd->max_off_time_changed = true;
 
         if (genpd->detach_dev)
-                genpd->detach_dev(dev);
+                genpd->detach_dev(genpd, dev);
 
         spin_lock_irq(&dev->power.lock);
 
@@ -1546,7 +1572,7 @@ void pm_genpd_dev_need_restore(struct device *dev, bool val)
 
         psd = dev_to_psd(dev);
         if (psd && psd->domain_data)
-                to_gpd_data(psd->domain_data)->need_restore = val;
+                to_gpd_data(psd->domain_data)->need_restore = val ? 1 : 0;
 
         spin_unlock_irqrestore(&dev->power.lock, flags);
 }
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 2ad0b5bce44b..3920ee45aa59 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -560,7 +560,8 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
         }
 
         if (page_zero_filled(uncmem)) {
-                kunmap_atomic(user_mem);
+                if (user_mem)
+                        kunmap_atomic(user_mem);
                 /* Free memory associated with this sector now. */
                 bit_spin_lock(ZRAM_ACCESS, &meta->table[index].value);
                 zram_free_page(zram, index);
diff --git a/drivers/char/hw_random/pseries-rng.c b/drivers/char/hw_random/pseries-rng.c
index 6226aa08c36a..bcf86f91800a 100644
--- a/drivers/char/hw_random/pseries-rng.c
+++ b/drivers/char/hw_random/pseries-rng.c
@@ -25,18 +25,21 @@
 #include <asm/vio.h>
 
 
-static int pseries_rng_data_read(struct hwrng *rng, u32 *data)
+static int pseries_rng_read(struct hwrng *rng, void *data, size_t max, bool wait)
 {
+        u64 buffer[PLPAR_HCALL_BUFSIZE];
+        size_t size = max < 8 ? max : 8;
         int rc;
 
-        rc = plpar_hcall(H_RANDOM, (unsigned long *)data);
+        rc = plpar_hcall(H_RANDOM, (unsigned long *)buffer);
         if (rc != H_SUCCESS) {
                 pr_err_ratelimited("H_RANDOM call failed %d\n", rc);
                 return -EIO;
         }
+        memcpy(data, buffer, size);
 
         /* The hypervisor interface returns 64 bits */
-        return 8;
+        return size;
 }
 
 /**
@@ -55,7 +58,7 @@ static unsigned long pseries_rng_get_desired_dma(struct vio_dev *vdev)
 
 static struct hwrng pseries_rng = {
         .name           = KBUILD_MODNAME,
-        .data_read      = pseries_rng_data_read,
+        .read           = pseries_rng_read,
 };
 
 static int __init pseries_rng_probe(struct vio_dev *dev,
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index bfa640023e64..cf7a561fad7c 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1449,8 +1449,6 @@ static int add_port(struct ports_device *portdev, u32 id)
         spin_lock_init(&port->outvq_lock);
         init_waitqueue_head(&port->waitqueue);
 
-        virtio_device_ready(portdev->vdev);
-
         /* Fill the in_vq with buffers so the host can send us data. */
         nr_added_bufs = fill_queue(port->in_vq, &port->inbuf_lock);
         if (!nr_added_bufs) {
@@ -2026,6 +2024,8 @@ static int virtcons_probe(struct virtio_device *vdev)
         spin_lock_init(&portdev->ports_lock);
         INIT_LIST_HEAD(&portdev->ports);
 
+        virtio_device_ready(portdev->vdev);
+
         if (multiport) {
                 unsigned int nr_added_bufs;
 
diff --git a/drivers/clk/at91/clk-usb.c b/drivers/clk/at91/clk-usb.c
index 24b5b020753a..a23ac0c724f0 100644
--- a/drivers/clk/at91/clk-usb.c
+++ b/drivers/clk/at91/clk-usb.c
@@ -52,29 +52,26 @@ static unsigned long at91sam9x5_clk_usb_recalc_rate(struct clk_hw *hw,
 
         tmp = pmc_read(pmc, AT91_PMC_USB);
         usbdiv = (tmp & AT91_PMC_OHCIUSBDIV) >> SAM9X5_USB_DIV_SHIFT;
-        return parent_rate / (usbdiv + 1);
+
+        return DIV_ROUND_CLOSEST(parent_rate, (usbdiv + 1));
 }
 
 static long at91sam9x5_clk_usb_round_rate(struct clk_hw *hw, unsigned long rate,
                                           unsigned long *parent_rate)
 {
         unsigned long div;
-        unsigned long bestrate;
-        unsigned long tmp;
+
+        if (!rate)
+                return -EINVAL;
 
         if (rate >= *parent_rate)
                 return *parent_rate;
 
-        div = *parent_rate / rate;
-        if (div >= SAM9X5_USB_MAX_DIV)
-                return *parent_rate / (SAM9X5_USB_MAX_DIV + 1);
-
-        bestrate = *parent_rate / div;
-        tmp = *parent_rate / (div + 1);
-        if (bestrate - rate > rate - tmp)
-                bestrate = tmp;
+        div = DIV_ROUND_CLOSEST(*parent_rate, rate);
+        if (div > SAM9X5_USB_MAX_DIV + 1)
+                div = SAM9X5_USB_MAX_DIV + 1;
 
-        return bestrate;
+        return DIV_ROUND_CLOSEST(*parent_rate, div);
 }
 
 static int at91sam9x5_clk_usb_set_parent(struct clk_hw *hw, u8 index)
@@ -106,9 +103,13 @@ static int at91sam9x5_clk_usb_set_rate(struct clk_hw *hw, unsigned long rate,
         u32 tmp;
         struct at91sam9x5_clk_usb *usb = to_at91sam9x5_clk_usb(hw);
         struct at91_pmc *pmc = usb->pmc;
-        unsigned long div = parent_rate / rate;
+        unsigned long div;
+
+        if (!rate)
+                return -EINVAL;
 
-        if (parent_rate % rate || div < 1 || div >= SAM9X5_USB_MAX_DIV)
+        div = DIV_ROUND_CLOSEST(parent_rate, rate);
+        if (div > SAM9X5_USB_MAX_DIV + 1 || !div)
                 return -EINVAL;
 
         tmp = pmc_read(pmc, AT91_PMC_USB) & ~AT91_PMC_OHCIUSBDIV;
@@ -253,7 +254,7 @@ static long at91rm9200_clk_usb_round_rate(struct clk_hw *hw, unsigned long rate,
 
                 tmp_parent_rate = rate * usb->divisors[i];
                 tmp_parent_rate = __clk_round_rate(parent, tmp_parent_rate);
-                tmprate = tmp_parent_rate / usb->divisors[i];
+                tmprate = DIV_ROUND_CLOSEST(tmp_parent_rate, usb->divisors[i]);
                 if (tmprate < rate)
                         tmpdiff = rate - tmprate;
                 else
@@ -281,10 +282,10 @@ static int at91rm9200_clk_usb_set_rate(struct clk_hw *hw, unsigned long rate,
         struct at91_pmc *pmc = usb->pmc;
         unsigned long div;
 
-        if (!rate || parent_rate % rate)
+        if (!rate)
                 return -EINVAL;
 
-        div = parent_rate / rate;
+        div = DIV_ROUND_CLOSEST(parent_rate, rate);
 
         for (i = 0; i < RM9200_USB_DIV_TAB_SIZE; i++) {
                 if (usb->divisors[i] == div) {
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index 18a9de29df0e..c0a842b335c5 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -263,6 +263,14 @@ static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
         if (!rate)
                 rate = 1;
 
+        /* if read only, just return current value */
+        if (divider->flags & CLK_DIVIDER_READ_ONLY) {
+                bestdiv = readl(divider->reg) >> divider->shift;
+                bestdiv &= div_mask(divider);
+                bestdiv = _get_div(divider, bestdiv);
+                return bestdiv;
+        }
+
         maxdiv = _get_maxdiv(divider);
 
         if (!(__clk_get_flags(hw->clk) & CLK_SET_RATE_PARENT)) {
@@ -361,11 +369,6 @@ const struct clk_ops clk_divider_ops = {
 };
 EXPORT_SYMBOL_GPL(clk_divider_ops);
 
-const struct clk_ops clk_divider_ro_ops = {
-        .recalc_rate = clk_divider_recalc_rate,
-};
-EXPORT_SYMBOL_GPL(clk_divider_ro_ops);
-
 static struct clk *_register_divider(struct device *dev, const char *name,
                 const char *parent_name, unsigned long flags,
                 void __iomem *reg, u8 shift, u8 width,
@@ -391,10 +394,7 @@ static struct clk *_register_divider(struct device *dev, const char *name,
         }
 
         init.name = name;
-        if (clk_divider_flags & CLK_DIVIDER_READ_ONLY)
-                init.ops = &clk_divider_ro_ops;
-        else
-                init.ops = &clk_divider_ops;
+        init.ops = &clk_divider_ops;
         init.flags = flags | CLK_IS_BASIC;
         init.parent_names = (parent_name ? &parent_name: NULL);
         init.num_parents = (parent_name ? 1 : 0);
diff --git a/drivers/clk/pxa/clk-pxa27x.c b/drivers/clk/pxa/clk-pxa27x.c
index b345cc791e5d..88b9fe13fa44 100644
--- a/drivers/clk/pxa/clk-pxa27x.c
+++ b/drivers/clk/pxa/clk-pxa27x.c
@@ -322,7 +322,7 @@ static unsigned long clk_pxa27x_memory_get_rate(struct clk_hw *hw,
         unsigned long ccsr = CCSR;
 
         osc_forced = ccsr & (1 << CCCR_CPDIS_BIT);
-        a = cccr & CCCR_A_BIT;
+        a = cccr & (1 << CCCR_A_BIT);
         l  = ccsr & CCSR_L_MASK;
 
         if (osc_forced || a)
@@ -341,7 +341,7 @@ static u8 clk_pxa27x_memory_get_parent(struct clk_hw *hw)
         unsigned long ccsr = CCSR;
 
         osc_forced = ccsr & (1 << CCCR_CPDIS_BIT);
-        a = cccr & CCCR_A_BIT;
+        a = cccr & (1 << CCCR_A_BIT);
         if (osc_forced)
                 return PXA_MEM_13Mhz;
         if (a)
diff --git a/drivers/clk/qcom/mmcc-apq8084.c b/drivers/clk/qcom/mmcc-apq8084.c
index dab988ab8cf1..157139a5c1ca 100644
--- a/drivers/clk/qcom/mmcc-apq8084.c
+++ b/drivers/clk/qcom/mmcc-apq8084.c
@@ -3122,7 +3122,7 @@ static struct clk_regmap *mmcc_apq8084_clocks[] = {
         [ESC1_CLK_SRC] = &esc1_clk_src.clkr,
         [HDMI_CLK_SRC] = &hdmi_clk_src.clkr,
         [VSYNC_CLK_SRC] = &vsync_clk_src.clkr,
-        [RBCPR_CLK_SRC] = &rbcpr_clk_src.clkr,
+        [MMSS_RBCPR_CLK_SRC] = &rbcpr_clk_src.clkr,
         [RBBMTIMER_CLK_SRC] = &rbbmtimer_clk_src.clkr,
         [MAPLE_CLK_SRC] = &maple_clk_src.clkr,
         [VDP_CLK_SRC] = &vdp_clk_src.clkr,
diff --git a/drivers/clk/rockchip/clk.c b/drivers/clk/rockchip/clk.c
index 1e68bff481b8..880a266f0143 100644
--- a/drivers/clk/rockchip/clk.c
+++ b/drivers/clk/rockchip/clk.c
@@ -90,9 +90,7 @@ static struct clk *rockchip_clk_register_branch(const char *name,
                 div->width = div_width;
                 div->lock = lock;
                 div->table = div_table;
-                div_ops = (div_flags & CLK_DIVIDER_READ_ONLY)
-                                                ? &clk_divider_ro_ops
-                                                : &clk_divider_ops;
+                div_ops = &clk_divider_ops;
         }
 
         clk = clk_register_composite(NULL, name, parent_names, num_parents,
diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
index efb17c3ee120..f4a9c0058b4d 100644
--- a/drivers/clocksource/sun4i_timer.c
+++ b/drivers/clocksource/sun4i_timer.c
@@ -182,6 +182,12 @@ static void __init sun4i_timer_init(struct device_node *node)
         /* Make sure timer is stopped before playing with interrupts */
         sun4i_clkevt_time_stop(0);
 
+        sun4i_clockevent.cpumask = cpu_possible_mask;
+        sun4i_clockevent.irq = irq;
+
+        clockevents_config_and_register(&sun4i_clockevent, rate,
+                                        TIMER_SYNC_TICKS, 0xffffffff);
+
         ret = setup_irq(irq, &sun4i_timer_irq);
         if (ret)
                 pr_warn("failed to setup irq %d\n", irq);
@@ -189,12 +195,6 @@ static void __init sun4i_timer_init(struct device_node *node)
         /* Enable timer0 interrupt */
         val = readl(timer_base + TIMER_IRQ_EN_REG);
         writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
-
-        sun4i_clockevent.cpumask = cpu_possible_mask;
-        sun4i_clockevent.irq = irq;
-
-        clockevents_config_and_register(&sun4i_clockevent, rate,
-                                        TIMER_SYNC_TICKS, 0xffffffff);
 }
 CLOCKSOURCE_OF_DECLARE(sun4i, "allwinner,sun4i-a10-timer",
                        sun4i_timer_init);
diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
index 23aaf40cf37f..f657c571b18e 100644
--- a/drivers/cpufreq/cpufreq-dt.c
+++ b/drivers/cpufreq/cpufreq-dt.c
@@ -166,8 +166,8 @@ try_again:
                 if (ret == -EPROBE_DEFER)
                         dev_dbg(cpu_dev, "cpu%d clock not ready, retry\n", cpu);
                 else
-                        dev_err(cpu_dev, "failed to get cpu%d clock: %d\n", ret,
-                                cpu);
+                        dev_err(cpu_dev, "failed to get cpu%d clock: %d\n", cpu,
+                                ret);
         } else {
                 *cdev = cpu_dev;
                 *creg = cpu_reg;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 644b54e1e7d1..4473eba1d6b0 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1022,7 +1022,8 @@ static struct cpufreq_policy *cpufreq_policy_restore(unsigned int cpu)
 
         read_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
-        policy->governor = NULL;
+        if (policy)
+                policy->governor = NULL;
 
         return policy;
 }
diff --git a/drivers/crypto/caam/key_gen.c b/drivers/crypto/caam/key_gen.c
index 871703c49d2c..e1eaf4ff9762 100644
--- a/drivers/crypto/caam/key_gen.c
+++ b/drivers/crypto/caam/key_gen.c
@@ -48,23 +48,29 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
         u32 *desc;
         struct split_key_result result;
         dma_addr_t dma_addr_in, dma_addr_out;
-        int ret = 0;
+        int ret = -ENOMEM;
 
         desc = kmalloc(CAAM_CMD_SZ * 6 + CAAM_PTR_SZ * 2, GFP_KERNEL | GFP_DMA);
         if (!desc) {
                 dev_err(jrdev, "unable to allocate key input memory\n");
-                return -ENOMEM;
+                return ret;
         }
 
-        init_job_desc(desc, 0);
-
         dma_addr_in = dma_map_single(jrdev, (void *)key_in, keylen,
                                      DMA_TO_DEVICE);
         if (dma_mapping_error(jrdev, dma_addr_in)) {
                 dev_err(jrdev, "unable to map key input memory\n");
-                kfree(desc);
-                return -ENOMEM;
+                goto out_free;
         }
+
+        dma_addr_out = dma_map_single(jrdev, key_out, split_key_pad_len,
+                                      DMA_FROM_DEVICE);
+        if (dma_mapping_error(jrdev, dma_addr_out)) {
+                dev_err(jrdev, "unable to map key output memory\n");
+                goto out_unmap_in;
+        }
+
+        init_job_desc(desc, 0);
         append_key(desc, dma_addr_in, keylen, CLASS_2 | KEY_DEST_CLASS_REG);
 
         /* Sets MDHA up into an HMAC-INIT */
@@ -81,13 +87,6 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
          * FIFO_STORE with the explicit split-key content store
          * (0x26 output type)
          */
-        dma_addr_out = dma_map_single(jrdev, key_out, split_key_pad_len,
-                                      DMA_FROM_DEVICE);
-        if (dma_mapping_error(jrdev, dma_addr_out)) {
-                dev_err(jrdev, "unable to map key output memory\n");
-                kfree(desc);
-                return -ENOMEM;
-        }
         append_fifo_store(desc, dma_addr_out, split_key_len,
                           LDST_CLASS_2_CCB | FIFOST_TYPE_SPLIT_KEK);
 
@@ -115,10 +114,10 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
 
         dma_unmap_single(jrdev, dma_addr_out, split_key_pad_len,
                          DMA_FROM_DEVICE);
+out_unmap_in:
         dma_unmap_single(jrdev, dma_addr_in, keylen, DMA_TO_DEVICE);
-
+out_free:
         kfree(desc);
-
         return ret;
 }
 EXPORT_SYMBOL(gen_split_key);
diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
index 9282381b03ce..fe7b3f06f6e6 100644
--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
+++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
@@ -198,8 +198,7 @@ struct adf_accel_dev {
         struct dentry *debugfs_dir;
         struct list_head list;
         struct module *owner;
-        uint8_t accel_id;
-        uint8_t numa_node;
         struct adf_accel_pci accel_pci_dev;
+        uint8_t accel_id;
 } __packed;
 #endif
diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c
index 5f3fa45348b4..9dd2cb72a4e8 100644
--- a/drivers/crypto/qat/qat_common/adf_transport.c
+++ b/drivers/crypto/qat/qat_common/adf_transport.c
@@ -419,9 +419,10 @@ static int adf_init_bank(struct adf_accel_dev *accel_dev,
                 WRITE_CSR_RING_BASE(csr_addr, bank_num, i, 0);
                 ring = &bank->rings[i];
                 if (hw_data->tx_rings_mask & (1 << i)) {
-                        ring->inflights = kzalloc_node(sizeof(atomic_t),
-                                                       GFP_KERNEL,
-                                                       accel_dev->numa_node);
+                        ring->inflights =
+                                kzalloc_node(sizeof(atomic_t),
+                                             GFP_KERNEL,
+                                             dev_to_node(&GET_DEV(accel_dev)));
                         if (!ring->inflights)
                                 goto err;
                 } else {
@@ -469,13 +470,14 @@ int adf_init_etr_data(struct adf_accel_dev *accel_dev)
         int i, ret;
 
         etr_data = kzalloc_node(sizeof(*etr_data), GFP_KERNEL,
-                                accel_dev->numa_node);
+                                dev_to_node(&GET_DEV(accel_dev)));
         if (!etr_data)
                 return -ENOMEM;
 
         num_banks = GET_MAX_BANKS(accel_dev);
         size = num_banks * sizeof(struct adf_etr_bank_data);
-        etr_data->banks = kzalloc_node(size, GFP_KERNEL, accel_dev->numa_node);
+        etr_data->banks = kzalloc_node(size, GFP_KERNEL,
+                                       dev_to_node(&GET_DEV(accel_dev)));
         if (!etr_data->banks) {
                 ret = -ENOMEM;
                 goto err_bank;
diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
index f2e2f158cfbe..9e9619cd4a79 100644
--- a/drivers/crypto/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_algs.c
@@ -596,7 +596,8 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
         if (unlikely(!n))
                 return -EINVAL;
 
-        bufl = kmalloc_node(sz, GFP_ATOMIC, inst->accel_dev->numa_node);
+        bufl = kmalloc_node(sz, GFP_ATOMIC,
+                            dev_to_node(&GET_DEV(inst->accel_dev)));
         if (unlikely(!bufl))
                 return -ENOMEM;
 
@@ -605,6 +606,8 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
                 goto err;
 
         for_each_sg(assoc, sg, assoc_n, i) {
+                if (!sg->length)
+                        continue;
                 bufl->bufers[bufs].addr = dma_map_single(dev,
                                                          sg_virt(sg),
                                                          sg->length,
@@ -640,7 +643,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
                 struct qat_alg_buf *bufers;
 
                 buflout = kmalloc_node(sz, GFP_ATOMIC,
-                                       inst->accel_dev->numa_node);
+                                       dev_to_node(&GET_DEV(inst->accel_dev)));
                 if (unlikely(!buflout))
                         goto err;
                 bloutp = dma_map_single(dev, buflout, sz, DMA_TO_DEVICE);
diff --git a/drivers/crypto/qat/qat_common/qat_crypto.c b/drivers/crypto/qat/qat_common/qat_crypto.c
index 0d59bcb50de1..828f2a686aab 100644
--- a/drivers/crypto/qat/qat_common/qat_crypto.c
+++ b/drivers/crypto/qat/qat_common/qat_crypto.c
@@ -109,12 +109,14 @@ struct qat_crypto_instance *qat_crypto_get_instance_node(int node)
 
         list_for_each(itr, adf_devmgr_get_head()) {
                 accel_dev = list_entry(itr, struct adf_accel_dev, list);
-                if (accel_dev->numa_node == node && adf_dev_started(accel_dev))
+                if ((node == dev_to_node(&GET_DEV(accel_dev)) ||
+                        dev_to_node(&GET_DEV(accel_dev)) < 0)
+                                && adf_dev_started(accel_dev))
                         break;
                 accel_dev = NULL;
         }
         if (!accel_dev) {
-                pr_err("QAT: Could not find device on give node\n");
+                pr_err("QAT: Could not find device on node %d\n", node);
                 accel_dev = adf_devmgr_get_first();
         }
         if (!accel_dev || !adf_dev_started(accel_dev))
@@ -164,7 +166,7 @@ static int qat_crypto_create_instances(struct adf_accel_dev *accel_dev)
 
         for (i = 0; i < num_inst; i++) {
                 inst = kzalloc_node(sizeof(*inst), GFP_KERNEL,
-                                    accel_dev->numa_node);
+                                    dev_to_node(&GET_DEV(accel_dev)));
                 if (!inst)
                         goto err;
 
diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_admin.c b/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
index 978d6c56639d..53c491b59f07 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
@@ -108,7 +108,7 @@ int adf_init_admin_comms(struct adf_accel_dev *accel_dev)
         uint64_t reg_val;
 
         admin = kzalloc_node(sizeof(*accel_dev->admin), GFP_KERNEL,
-                             accel_dev->numa_node);
+                             dev_to_node(&GET_DEV(accel_dev)));
         if (!admin)
                 return -ENOMEM;
         admin->virt_addr = dma_zalloc_coherent(&GET_DEV(accel_dev), PAGE_SIZE,
diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
index 0d0435a41be9..948f66be262b 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
@@ -119,21 +119,6 @@ static void adf_cleanup_accel(struct adf_accel_dev *accel_dev)
         kfree(accel_dev);
 }
 
-static uint8_t adf_get_dev_node_id(struct pci_dev *pdev)
-{
-        unsigned int bus_per_cpu = 0;
-        struct cpuinfo_x86 *c = &cpu_data(num_online_cpus() - 1);
-
-        if (!c->phys_proc_id)
-                return 0;
-
-        bus_per_cpu = 256 / (c->phys_proc_id + 1);
-
-        if (bus_per_cpu != 0)
-                return pdev->bus->number / bus_per_cpu;
-        return 0;
-}
-
 static int qat_dev_start(struct adf_accel_dev *accel_dev)
 {
         int cpus = num_online_cpus();
@@ -235,7 +220,6 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         void __iomem *pmisc_bar_addr = NULL;
         char name[ADF_DEVICE_NAME_LENGTH];
         unsigned int i, bar_nr;
-        uint8_t node;
         int ret;
 
         switch (ent->device) {
@@ -246,12 +230,19 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENODEV;
         }
 
-        node = adf_get_dev_node_id(pdev);
-        accel_dev = kzalloc_node(sizeof(*accel_dev), GFP_KERNEL, node);
+        if (num_possible_nodes() > 1 && dev_to_node(&pdev->dev) < 0) {
+                /* If the accelerator is connected to a node with no memory
+                 * there is no point in using the accelerator since the remote
+                 * memory transaction will be very slow. */
+                dev_err(&pdev->dev, "Invalid NUMA configuration.\n");
+                return -EINVAL;
+        }
+
+        accel_dev = kzalloc_node(sizeof(*accel_dev), GFP_KERNEL,
+                                 dev_to_node(&pdev->dev));
         if (!accel_dev)
                 return -ENOMEM;
 
-        accel_dev->numa_node = node;
         INIT_LIST_HEAD(&accel_dev->crypto_list);
 
         /* Add accel device to accel table.
@@ -264,7 +255,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         accel_dev->owner = THIS_MODULE;
         /* Allocate and configure device configuration structure */
-        hw_data = kzalloc_node(sizeof(*hw_data), GFP_KERNEL, node);
+        hw_data = kzalloc_node(sizeof(*hw_data), GFP_KERNEL,
+                               dev_to_node(&pdev->dev));
         if (!hw_data) {
                 ret = -ENOMEM;
                 goto out_err;
diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
index 67ec61e51185..d96ee21b9b77 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
@@ -168,7 +168,7 @@ static int adf_isr_alloc_msix_entry_table(struct adf_accel_dev *accel_dev)
         uint32_t msix_num_entries = hw_data->num_banks + 1;
 
         entries = kzalloc_node(msix_num_entries * sizeof(*entries),
-                               GFP_KERNEL, accel_dev->numa_node);
+                               GFP_KERNEL, dev_to_node(&GET_DEV(accel_dev)));
         if (!entries)
                 return -ENOMEM;
 
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 4839bfa74a10..19a99743cf52 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -271,7 +271,7 @@ struct pl330_config {
 #define DMAC_MODE_NS    (1 << 0)
         unsigned int    mode;
         unsigned int    data_bus_width:10; /* In number of bits */
-        unsigned int    data_buf_dep:10;
+        unsigned int    data_buf_dep:11;
         unsigned int    num_chan:4;
         unsigned int    num_peri:6;
         u32             peri_ns;
@@ -2336,7 +2336,7 @@ static inline int get_burst_len(struct dma_pl330_desc *desc, size_t len)
         int burst_len;
 
         burst_len = pl330->pcfg.data_bus_width / 8;
-        burst_len *= pl330->pcfg.data_buf_dep;
+        burst_len *= pl330->pcfg.data_buf_dep / pl330->pcfg.num_chan;
         burst_len >>= desc->rqcfg.brst_size;
 
         /* src/dst_burst_len can't be more than 16 */
@@ -2459,16 +2459,25 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
         /* Select max possible burst size */
         burst = pl330->pcfg.data_bus_width / 8;
 
-        while (burst > 1) {
-                if (!(len % burst))
-                        break;
+        /*
+         * Make sure we use a burst size that aligns with all the memcpy
+         * parameters because our DMA programming algorithm doesn't cope with
+         * transfers which straddle an entry in the DMA device's MFIFO.
+         */
+        while ((src | dst | len) & (burst - 1))
                 burst /= 2;
-        }
 
         desc->rqcfg.brst_size = 0;
         while (burst != (1 << desc->rqcfg.brst_size))
                 desc->rqcfg.brst_size++;
 
+        /*
+         * If burst size is smaller than bus width then make sure we only
+         * transfer one at a time to avoid a burst stradling an MFIFO entry.
+         */
+        if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
+                desc->rqcfg.brst_len = 1;
+
         desc->rqcfg.brst_len = get_burst_len(desc, len);
 
         desc->txd.flags = flags;
@@ -2732,7 +2741,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
 
 
         dev_info(&adev->dev,
-                "Loaded driver for PL330 DMAC-%d\n", adev->periphid);
+                "Loaded driver for PL330 DMAC-%x\n", adev->periphid);
         dev_info(&adev->dev,
                 "\tDBUFF-%ux%ubytes Num_Chans-%u Num_Peri-%u Num_Events-%u\n",
                 pcfg->data_buf_dep, pcfg->data_bus_width / 8, pcfg->num_chan,
diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
index 3aa10b328254..91292f5513ff 100644
--- a/drivers/dma/sun6i-dma.c
+++ b/drivers/dma/sun6i-dma.c
@@ -230,30 +230,25 @@ static inline void sun6i_dma_dump_chan_regs(struct sun6i_dma_dev *sdev,
                 readl(pchan->base + DMA_CHAN_CUR_PARA));
 }
 
-static inline int convert_burst(u32 maxburst, u8 *burst)
+static inline s8 convert_burst(u32 maxburst)
 {
         switch (maxburst) {
         case 1:
-                *burst = 0;
-                break;
+                return 0;
         case 8:
-                *burst = 2;
-                break;
+                return 2;
         default:
                 return -EINVAL;
         }
-
-        return 0;
 }
 
-static inline int convert_buswidth(enum dma_slave_buswidth addr_width, u8 *width)
+static inline s8 convert_buswidth(enum dma_slave_buswidth addr_width)
 {
         if ((addr_width < DMA_SLAVE_BUSWIDTH_1_BYTE) ||
             (addr_width > DMA_SLAVE_BUSWIDTH_4_BYTES))
                 return -EINVAL;
 
-        *width = addr_width >> 1;
-        return 0;
+        return addr_width >> 1;
 }
 
 static void *sun6i_dma_lli_add(struct sun6i_dma_lli *prev,
@@ -284,26 +279,25 @@ static inline int sun6i_dma_cfg_lli(struct sun6i_dma_lli *lli,
                                     struct dma_slave_config *config)
 {
         u8 src_width, dst_width, src_burst, dst_burst;
-        int ret;
 
         if (!config)
                 return -EINVAL;
 
-        ret = convert_burst(config->src_maxburst, &src_burst);
-        if (ret)
-                return ret;
+        src_burst = convert_burst(config->src_maxburst);
+        if (src_burst)
+                return src_burst;
 
-        ret = convert_burst(config->dst_maxburst, &dst_burst);
-        if (ret)
-                return ret;
+        dst_burst = convert_burst(config->dst_maxburst);
+        if (dst_burst)
+                return dst_burst;
 
-        ret = convert_buswidth(config->src_addr_width, &src_width);
-        if (ret)
-                return ret;
+        src_width = convert_buswidth(config->src_addr_width);
+        if (src_width)
+                return src_width;
 
-        ret = convert_buswidth(config->dst_addr_width, &dst_width);
-        if (ret)
-                return ret;
+        dst_width = convert_buswidth(config->dst_addr_width);
+        if (dst_width)
+                return dst_width;
 
         lli->cfg = DMA_CHAN_CFG_SRC_BURST(src_burst) |
                 DMA_CHAN_CFG_SRC_WIDTH(src_width) |
@@ -542,11 +536,10 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_memcpy(
 {
         struct sun6i_dma_dev *sdev = to_sun6i_dma_dev(chan->device);
         struct sun6i_vchan *vchan = to_sun6i_vchan(chan);
-        struct dma_slave_config *sconfig = &vchan->cfg;
         struct sun6i_dma_lli *v_lli;
         struct sun6i_desc *txd;
         dma_addr_t p_lli;
-        int ret;
+        s8 burst, width;
 
         dev_dbg(chan2dev(chan),
                 "%s; chan: %d, dest: %pad, src: %pad, len: %zu. flags: 0x%08lx\n",
@@ -565,14 +558,21 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_memcpy(
                 goto err_txd_free;
         }
 
-        ret = sun6i_dma_cfg_lli(v_lli, src, dest, len, sconfig);
-        if (ret)
-                goto err_dma_free;
+        v_lli->src = src;
+        v_lli->dst = dest;
+        v_lli->len = len;
+        v_lli->para = NORMAL_WAIT;
 
+        burst = convert_burst(8);
+        width = convert_buswidth(DMA_SLAVE_BUSWIDTH_4_BYTES);
         v_lli->cfg |= DMA_CHAN_CFG_SRC_DRQ(DRQ_SDRAM) |
                 DMA_CHAN_CFG_DST_DRQ(DRQ_SDRAM) |
                 DMA_CHAN_CFG_DST_LINEAR_MODE |
-                DMA_CHAN_CFG_SRC_LINEAR_MODE;
+                DMA_CHAN_CFG_SRC_LINEAR_MODE |
+                DMA_CHAN_CFG_SRC_BURST(burst) |
+                DMA_CHAN_CFG_SRC_WIDTH(width) |
+                DMA_CHAN_CFG_DST_BURST(burst) |
+                DMA_CHAN_CFG_DST_WIDTH(width);
 
         sun6i_dma_lli_add(NULL, v_lli, p_lli, txd);
 
@@ -580,8 +580,6 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_memcpy(
 
         return vchan_tx_prep(&vchan->vc, &txd->vd, flags);
 
-err_dma_free:
-        dma_pool_free(sdev->pool, v_lli, p_lli);
 err_txd_free:
         kfree(txd);
         return NULL;
@@ -915,6 +913,7 @@ static int sun6i_dma_probe(struct platform_device *pdev)
         sdc->slave.device_prep_dma_memcpy       = sun6i_dma_prep_dma_memcpy;
         sdc->slave.device_control               = sun6i_dma_control;
         sdc->slave.chancnt                      = NR_MAX_VCHANS;
+        sdc->slave.copy_align                   = 4;
 
         sdc->slave.dev = &pdev->dev;
 
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 5d997a33907e..2a3973a7c441 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -1637,8 +1637,7 @@ static int dispatch_ioctl(struct client *client,
             _IOC_SIZE(cmd) > sizeof(buffer))
                 return -ENOTTY;
 
-        if (_IOC_DIR(cmd) == _IOC_READ)
-                memset(&buffer, 0, _IOC_SIZE(cmd));
+        memset(&buffer, 0, sizeof(buffer));
 
         if (_IOC_DIR(cmd) & _IOC_WRITE)
                 if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index d71fb54582d2..25ba3628960a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -646,6 +646,18 @@ static int exynos_drm_init(void)
         if (!is_exynos)
                 return -ENODEV;
 
+        /*
+         * Register device object only in case of Exynos SoC.
+         *
+         * Below codes resolves temporarily infinite loop issue incurred
+         * by Exynos drm driver when using multi-platform kernel.
+         * So these codes will be replaced with more generic way later.
+         */
+        if (!of_machine_is_compatible("samsung,exynos3") &&
+                        !of_machine_is_compatible("samsung,exynos4") &&
+                        !of_machine_is_compatible("samsung,exynos5"))
+                return -ENODEV;
+
         exynos_drm_pdev = platform_device_register_simple("exynos-drm", -1,
                                                                 NULL, 0);
         if (IS_ERR(exynos_drm_pdev))
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 9a7353302b3f..7a966f3c9950 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1663,15 +1663,17 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                 goto out_regs;
 
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                ret = i915_kick_out_vgacon(dev_priv);
+                /* WARNING: Apparently we must kick fbdev drivers before vgacon,
+                 * otherwise the vga fbdev driver falls over. */
+                ret = i915_kick_out_firmware_fb(dev_priv);
                 if (ret) {
-                        DRM_ERROR("failed to remove conflicting VGA console\n");
+                        DRM_ERROR("failed to remove conflicting framebuffer drivers\n");
                         goto out_gtt;
                 }
 
-                ret = i915_kick_out_firmware_fb(dev_priv);
+                ret = i915_kick_out_vgacon(dev_priv);
                 if (ret) {
-                        DRM_ERROR("failed to remove conflicting framebuffer drivers\n");
+                        DRM_ERROR("failed to remove conflicting VGA console\n");
                         goto out_gtt;
                 }
         }
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index de12017c809b..c1cf3329108c 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1920,6 +1920,22 @@ static void bdw_setup_private_ppat(struct drm_i915_private *dev_priv)
               GEN8_PPAT(6, GEN8_PPAT_WB | GEN8_PPAT_LLCELLC | GEN8_PPAT_AGE(2)) |
               GEN8_PPAT(7, GEN8_PPAT_WB | GEN8_PPAT_LLCELLC | GEN8_PPAT_AGE(3));
 
+        if (!USES_PPGTT(dev_priv->dev))
+                /* Spec: "For GGTT, there is NO pat_sel[2:0] from the entry,
+                 * so RTL will always use the value corresponding to
+                 * pat_sel = 000".
+                 * So let's disable cache for GGTT to avoid screen corruptions.
+                 * MOCS still can be used though.
+                 * - System agent ggtt writes (i.e. cpu gtt mmaps) already work
+                 * before this patch, i.e. the same uncached + snooping access
+                 * like on gen6/7 seems to be in effect.
+                 * - So this just fixes blitter/render access. Again it looks
+                 * like it's not just uncached access, but uncached + snooping.
+                 * So we can still hold onto all our assumptions wrt cpu
+                 * clflushing on LLC machines.
+                 */
+                pat = GEN8_PPAT(0, GEN8_PPAT_UC);
+
         /* XXX: spec defines this as 2 distinct registers. It's unclear if a 64b
          * write would work. */
         I915_WRITE(GEN8_PRIVATE_PAT, pat);
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 749ab485569e..cd7f4734c9f8 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -375,22 +375,9 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                  * has to also include the unfenced register the GPU uses
                  * whilst executing a fenced command for an untiled object.
                  */
-
-                obj->map_and_fenceable =
-                        !i915_gem_obj_ggtt_bound(obj) ||
-                        (i915_gem_obj_ggtt_offset(obj) +
-                         obj->base.size <= dev_priv->gtt.mappable_end &&
-                         i915_gem_object_fence_ok(obj, args->tiling_mode));
-
-                /* Rebind if we need a change of alignment */
-                if (!obj->map_and_fenceable) {
-                        u32 unfenced_align =
-                                i915_gem_get_gtt_alignment(dev, obj->base.size,
-                                                            args->tiling_mode,
-                                                            false);
-                        if (i915_gem_obj_ggtt_offset(obj) & (unfenced_align - 1))
-                                ret = i915_gem_object_ggtt_unbind(obj);
-                }
+                if (obj->map_and_fenceable &&
+                    !i915_gem_object_fence_ok(obj, args->tiling_mode))
+                        ret = i915_gem_object_ggtt_unbind(obj);
 
                 if (ret == 0) {
                         obj->fence_dirty =
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 947144985700..e9a0df8a437b 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9066,6 +9066,10 @@ static bool page_flip_finished(struct intel_crtc *crtc)
         struct drm_device *dev = crtc->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
 
+        if (i915_reset_in_progress(&dev_priv->gpu_error) ||
+            crtc->reset_counter != atomic_read(&dev_priv->gpu_error.reset_counter))
+                return true;
+
         /*
          * The relevant registers doen't exist on pre-ctg.
          * As the flip done interrupt doesn't trigger for mmio
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index ceb528f07c25..49288437e52a 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -4686,6 +4686,7 @@ static void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder)
          * vdd might still be enabled do to the delayed vdd off.
          * Make sure vdd is actually turned off here.
          */
+        cancel_delayed_work_sync(&intel_dp->panel_vdd_work);
         pps_lock(intel_dp);
         edp_panel_vdd_off_sync(intel_dp);
         pps_unlock(intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index e18b3f49074c..b001c90312e7 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -1094,12 +1094,25 @@ static u32 get_backlight_min_vbt(struct intel_connector *connector)
         struct drm_device *dev = connector->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_panel *panel = &connector->panel;
+        int min;
 
         WARN_ON(panel->backlight.max == 0);
 
+        /*
+         * XXX: If the vbt value is 255, it makes min equal to max, which leads
+         * to problems. There are such machines out there. Either our
+         * interpretation is wrong or the vbt has bogus data. Or both. Safeguard
+         * against this by letting the minimum be at most (arbitrarily chosen)
+         * 25% of the max.
+         */
+        min = clamp_t(int, dev_priv->vbt.backlight.min_brightness, 0, 64);
+        if (min != dev_priv->vbt.backlight.min_brightness) {
+                DRM_DEBUG_KMS("clamping VBT min backlight %d/255 to %d/255\n",
+                              dev_priv->vbt.backlight.min_brightness, min);
+        }
+
         /* vbt value is a coefficient in range [0..255] */
-        return scale(dev_priv->vbt.backlight.min_brightness, 0, 255,
-                     0, panel->backlight.max);
+        return scale(min, 0, 255, 0, panel->backlight.max);
 }
 
 static int bdw_setup_backlight(struct intel_connector *connector)
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 300d7e503f96..8a0788dcf106 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -6533,11 +6533,6 @@ static void gen6_init_clock_gating(struct drm_device *dev)
         I915_WRITE(_3D_CHICKEN,
                    _MASKED_BIT_ENABLE(_3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB));
 
-        /* WaSetupGtModeTdRowDispatch:snb */
-        if (IS_SNB_GT1(dev))
-                I915_WRITE(GEN6_GT_MODE,
-                           _MASKED_BIT_ENABLE(GEN6_TD_FOUR_ROW_DISPATCH_DISABLE));
-
         /* WaDisable_RenderCache_OperationalFlush:snb */
         I915_WRITE(CACHE_MODE_0, _MASKED_BIT_DISABLE(RC_OP_FLUSH_ENABLE));
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c b/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c
index a16024a74771..fde42e4d1b56 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c
@@ -27,6 +27,20 @@ struct gk20a_fb_priv {
 };
 
 static int
+gk20a_fb_init(struct nouveau_object *object)
+{
+        struct gk20a_fb_priv *priv = (void *)object;
+        int ret;
+
+        ret = nouveau_fb_init(&priv->base);
+        if (ret)
+                return ret;
+
+        nv_mask(priv, 0x100c80, 0x00000001, 0x00000000); /* 128KiB lpg */
+        return 0;
+}
+
+static int
 gk20a_fb_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
              struct nouveau_oclass *oclass, void *data, u32 size,
              struct nouveau_object **pobject)
@@ -48,7 +62,7 @@ gk20a_fb_oclass = &(struct nouveau_fb_impl) {
         .base.ofuncs = &(struct nouveau_ofuncs) {
                 .ctor = gk20a_fb_ctor,
                 .dtor = _nouveau_fb_dtor,
-                .init = _nouveau_fb_init,
+                .init = gk20a_fb_init,
                 .fini = _nouveau_fb_fini,
         },
         .memtype = nvc0_fb_memtype_valid,
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 76b8c4f980ea..5beae7596f62 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -792,6 +792,22 @@ nv50_crtc_set_scale(struct nouveau_crtc *nv_crtc, bool update)
 }
 
 static int
+nv50_crtc_set_raster_vblank_dmi(struct nouveau_crtc *nv_crtc, u32 usec)
+{
+        struct nv50_mast *mast = nv50_mast(nv_crtc->base.dev);
+        u32 *push;
+
+        push = evo_wait(mast, 8);
+        if (!push)
+                return -ENOMEM;
+
+        evo_mthd(push, 0x0828 + (nv_crtc->index * 0x400), 1);
+        evo_data(push, usec);
+        evo_kick(push, mast);
+        return 0;
+}
+
+static int
 nv50_crtc_set_color_vibrance(struct nouveau_crtc *nv_crtc, bool update)
 {
         struct nv50_mast *mast = nv50_mast(nv_crtc->base.dev);
@@ -1105,14 +1121,14 @@ nv50_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *umode,
                         evo_mthd(push, 0x0804 + (nv_crtc->index * 0x400), 2);
                         evo_data(push, 0x00800000 | mode->clock);
                         evo_data(push, (ilace == 2) ? 2 : 0);
-                        evo_mthd(push, 0x0810 + (nv_crtc->index * 0x400), 8);
+                        evo_mthd(push, 0x0810 + (nv_crtc->index * 0x400), 6);
                         evo_data(push, 0x00000000);
                         evo_data(push, (vactive << 16) | hactive);
                         evo_data(push, ( vsynce << 16) | hsynce);
                         evo_data(push, (vblanke << 16) | hblanke);
                         evo_data(push, (vblanks << 16) | hblanks);
                         evo_data(push, (vblan2e << 16) | vblan2s);
-                        evo_data(push, vblankus);
+                        evo_mthd(push, 0x082c + (nv_crtc->index * 0x400), 1);
                         evo_data(push, 0x00000000);
                         evo_mthd(push, 0x0900 + (nv_crtc->index * 0x400), 2);
                         evo_data(push, 0x00000311);
@@ -1142,6 +1158,11 @@ nv50_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *umode,
         nv_connector = nouveau_crtc_connector_get(nv_crtc);
         nv50_crtc_set_dither(nv_crtc, false);
         nv50_crtc_set_scale(nv_crtc, false);
+
+        /* G94 only accepts this after setting scale */
+        if (nv50_vers(mast) < GF110_DISP_CORE_CHANNEL_DMA)
+                nv50_crtc_set_raster_vblank_dmi(nv_crtc, vblankus);
+
         nv50_crtc_set_color_vibrance(nv_crtc, false);
         nv50_crtc_set_image(nv_crtc, crtc->primary->fb, x, y, false);
         return 0;
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 15da7ef344a4..ec1593a6a561 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -1217,7 +1217,7 @@ free:
         return ret;
 }
 
-int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+int atom_execute_table_scratch_unlocked(struct atom_context *ctx, int index, uint32_t * params)
 {
         int r;
 
@@ -1238,6 +1238,15 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
         return r;
 }
 
+int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+{
+        int r;
+        mutex_lock(&ctx->scratch_mutex);
+        r = atom_execute_table_scratch_unlocked(ctx, index, params);
+        mutex_unlock(&ctx->scratch_mutex);
+        return r;
+}
+
 static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 };
 
 static void atom_index_iio(struct atom_context *ctx, int base)
diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
index feba6b8d36b3..6d014ddb6b78 100644
--- a/drivers/gpu/drm/radeon/atom.h
+++ b/drivers/gpu/drm/radeon/atom.h
@@ -125,6 +125,7 @@ struct card_info {
 struct atom_context {
         struct card_info *card;
         struct mutex mutex;
+        struct mutex scratch_mutex;
         void *bios;
         uint32_t cmd_table, data_table;
         uint16_t *iio;
@@ -145,6 +146,7 @@ extern int atom_debug;
 
 struct atom_context *atom_parse(struct card_info *, void *);
 int atom_execute_table(struct atom_context *, int, uint32_t *);
+int atom_execute_table_scratch_unlocked(struct atom_context *, int, uint32_t *);
 int atom_asic_init(struct atom_context *);
 void atom_destroy(struct atom_context *);
 bool atom_parse_data_header(struct atom_context *ctx, int index, uint16_t *size,
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 95d5d4ab3335..11ba9d21b89b 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -100,6 +100,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
         memset(&args, 0, sizeof(args));
 
         mutex_lock(&chan->mutex);
+        mutex_lock(&rdev->mode_info.atom_context->scratch_mutex);
 
         base = (unsigned char *)(rdev->mode_info.atom_context->scratch + 1);
 
@@ -113,7 +114,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
         if (ASIC_IS_DCE4(rdev))
                 args.v2.ucHPD_ID = chan->rec.hpd;
 
-        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+        atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args);
 
         *ack = args.v1.ucReplyStatus;
 
@@ -147,6 +148,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
 
         r = recv_bytes;
 done:
+        mutex_unlock(&rdev->mode_info.atom_context->scratch_mutex);
         mutex_unlock(&chan->mutex);
 
         return r;
diff --git a/drivers/gpu/drm/radeon/atombios_i2c.c b/drivers/gpu/drm/radeon/atombios_i2c.c
index 9c570fb15b8c..4157780585a0 100644
--- a/drivers/gpu/drm/radeon/atombios_i2c.c
+++ b/drivers/gpu/drm/radeon/atombios_i2c.c
@@ -48,6 +48,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
         memset(&args, 0, sizeof(args));
 
         mutex_lock(&chan->mutex);
+        mutex_lock(&rdev->mode_info.atom_context->scratch_mutex);
 
         base = (unsigned char *)rdev->mode_info.atom_context->scratch;
 
@@ -82,7 +83,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
         args.ucSlaveAddr = slave_addr << 1;
         args.ucLineNumber = chan->rec.i2c_id;
 
-        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+        atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args);
 
         /* error */
         if (args.ucStatus != HW_ASSISTED_I2C_STATUS_SUCCESS) {
@@ -95,6 +96,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
                 radeon_atom_copy_swap(buf, base, num, false);
 
 done:
+        mutex_unlock(&rdev->mode_info.atom_context->scratch_mutex);
         mutex_unlock(&chan->mutex);
 
         return r;
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 3deeed33322f..6dcde3798b45 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -4333,8 +4333,8 @@ static int cik_cp_gfx_start(struct radeon_device *rdev)
         /* init the CE partitions.  CE only used for gfx on CIK */
         radeon_ring_write(ring, PACKET3(PACKET3_SET_BASE, 2));
         radeon_ring_write(ring, PACKET3_BASE_INDEX(CE_PARTITION_BASE));
-        radeon_ring_write(ring, 0xc000);
-        radeon_ring_write(ring, 0xc000);
+        radeon_ring_write(ring, 0x8000);
+        radeon_ring_write(ring, 0x8000);
 
         /* setup clear context state */
         radeon_ring_write(ring, PACKET3(PACKET3_PREAMBLE_CNTL, 0));
@@ -9417,6 +9417,9 @@ void dce8_bandwidth_update(struct radeon_device *rdev)
         u32 num_heads = 0, lb_size;
         int i;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         for (i = 0; i < rdev->num_crtc; i++) {
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 54b98379188d..dde5c7e29eb2 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -663,17 +663,20 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
 {
         struct radeon_ib ib;
         unsigned i;
+        unsigned index;
         int r;
-        void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
         u32 tmp = 0;
+        u64 gpu_addr;
 
-        if (!ptr) {
-                DRM_ERROR("invalid vram scratch pointer\n");
-                return -EINVAL;
-        }
+        if (ring->idx == R600_RING_TYPE_DMA_INDEX)
+                index = R600_WB_DMA_RING_TEST_OFFSET;
+        else
+                index = CAYMAN_WB_DMA1_RING_TEST_OFFSET;
+
+        gpu_addr = rdev->wb.gpu_addr + index;
 
         tmp = 0xCAFEDEAD;
-        writel(tmp, ptr);
+        rdev->wb.wb[index/4] = cpu_to_le32(tmp);
 
         r = radeon_ib_get(rdev, ring->idx, &ib, NULL, 256);
         if (r) {
@@ -682,8 +685,8 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         }
 
         ib.ptr[0] = SDMA_PACKET(SDMA_OPCODE_WRITE, SDMA_WRITE_SUB_OPCODE_LINEAR, 0);
-        ib.ptr[1] = rdev->vram_scratch.gpu_addr & 0xfffffffc;
-        ib.ptr[2] = upper_32_bits(rdev->vram_scratch.gpu_addr);
+        ib.ptr[1] = lower_32_bits(gpu_addr);
+        ib.ptr[2] = upper_32_bits(gpu_addr);
         ib.ptr[3] = 1;
         ib.ptr[4] = 0xDEADBEEF;
         ib.length_dw = 5;
@@ -700,7 +703,7 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
                 return r;
         }
         for (i = 0; i < rdev->usec_timeout; i++) {
-                tmp = readl(ptr);
+                tmp = le32_to_cpu(rdev->wb.wb[index/4]);
                 if (tmp == 0xDEADBEEF)
                         break;
                 DRM_UDELAY(1);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index f37d39d2bbbc..85995b4e3338 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2345,6 +2345,9 @@ void evergreen_bandwidth_update(struct radeon_device *rdev)
         u32 num_heads = 0, lb_size;
         int i;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         for (i = 0; i < rdev->num_crtc; i++) {
@@ -2552,6 +2555,7 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
                                         WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
                                         tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
                                         WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i], tmp);
+                                        WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
                                 }
                         } else {
                                 tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 10f8be0ee173..b53b31a7b76f 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -3207,6 +3207,9 @@ void r100_bandwidth_update(struct radeon_device *rdev)
         uint32_t pixel_bytes1 = 0;
         uint32_t pixel_bytes2 = 0;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled) {
diff --git a/drivers/gpu/drm/radeon/r600_dma.c b/drivers/gpu/drm/radeon/r600_dma.c
index 3a58b8073f49..d2dd29ab24fa 100644
--- a/drivers/gpu/drm/radeon/r600_dma.c
+++ b/drivers/gpu/drm/radeon/r600_dma.c
@@ -338,17 +338,17 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
 {
         struct radeon_ib ib;
         unsigned i;
+        unsigned index;
         int r;
-        void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
         u32 tmp = 0;
+        u64 gpu_addr;
 
-        if (!ptr) {
-                DRM_ERROR("invalid vram scratch pointer\n");
-                return -EINVAL;
-        }
+        if (ring->idx == R600_RING_TYPE_DMA_INDEX)
+                index = R600_WB_DMA_RING_TEST_OFFSET;
+        else
+                index = CAYMAN_WB_DMA1_RING_TEST_OFFSET;
 
-        tmp = 0xCAFEDEAD;
-        writel(tmp, ptr);
+        gpu_addr = rdev->wb.gpu_addr + index;
 
         r = radeon_ib_get(rdev, ring->idx, &ib, NULL, 256);
         if (r) {
@@ -357,8 +357,8 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         }
 
         ib.ptr[0] = DMA_PACKET(DMA_PACKET_WRITE, 0, 0, 1);
-        ib.ptr[1] = rdev->vram_scratch.gpu_addr & 0xfffffffc;
-        ib.ptr[2] = upper_32_bits(rdev->vram_scratch.gpu_addr) & 0xff;
+        ib.ptr[1] = lower_32_bits(gpu_addr);
+        ib.ptr[2] = upper_32_bits(gpu_addr) & 0xff;
         ib.ptr[3] = 0xDEADBEEF;
         ib.length_dw = 4;
 
@@ -374,7 +374,7 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
                 return r;
         }
         for (i = 0; i < rdev->usec_timeout; i++) {
-                tmp = readl(ptr);
+                tmp = le32_to_cpu(rdev->wb.wb[index/4]);
                 if (tmp == 0xDEADBEEF)
                         break;
                 DRM_UDELAY(1);
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index 76c6a17eeb2d..843b65f46ece 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -1265,7 +1265,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
                                         (mode_info->atom_context->bios + data_offset +
                                          le16_to_cpu(ext_hdr->usPowerTuneTableOffset));
                                 rdev->pm.dpm.dyn_state.cac_tdp_table->maximum_power_delivery_limit =
-                                        ppt->usMaximumPowerDeliveryLimit;
+                                        le16_to_cpu(ppt->usMaximumPowerDeliveryLimit);
                                 pt = &ppt->power_tune_table;
                         } else {
                                 ATOM_PPLIB_POWERTUNE_Table *ppt = (ATOM_PPLIB_POWERTUNE_Table *)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 300c4b3d4669..26baa9c05f6c 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -322,6 +322,12 @@ static void radeon_connector_get_edid(struct drm_connector *connector)
         }
 
         if (!radeon_connector->edid) {
+                /* don't fetch the edid from the vbios if ddc fails and runpm is
+                 * enabled so we report disconnected.
+                 */
+                if ((rdev->flags & RADEON_IS_PX) && (radeon_runtime_pm != 0))
+                        return;
+
                 if (rdev->is_atom_bios) {
                         /* some laptops provide a hardcoded edid in rom for LCDs */
                         if (((connector->connector_type == DRM_MODE_CONNECTOR_LVDS) ||
@@ -826,6 +832,8 @@ static int radeon_lvds_mode_valid(struct drm_connector *connector,
 static enum drm_connector_status
 radeon_lvds_detect(struct drm_connector *connector, bool force)
 {
+        struct drm_device *dev = connector->dev;
+        struct radeon_device *rdev = dev->dev_private;
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
         struct drm_encoder *encoder = radeon_best_single_encoder(connector);
         enum drm_connector_status ret = connector_status_disconnected;
@@ -842,7 +850,11 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)
                 /* check if panel is valid */
                 if (native_mode->hdisplay >= 320 && native_mode->vdisplay >= 240)
                         ret = connector_status_connected;
-
+                /* don't fetch the edid from the vbios if ddc fails and runpm is
+                 * enabled so we report disconnected.
+                 */
+                if ((rdev->flags & RADEON_IS_PX) && (radeon_runtime_pm != 0))
+                        ret = connector_status_disconnected;
         }
 
         /* check for edid as well */
@@ -1589,6 +1601,11 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
                         /* check if panel is valid */
                         if (native_mode->hdisplay >= 320 && native_mode->vdisplay >= 240)
                                 ret = connector_status_connected;
+                        /* don't fetch the edid from the vbios if ddc fails and runpm is
+                         * enabled so we report disconnected.
+                         */
+                        if ((rdev->flags & RADEON_IS_PX) && (radeon_runtime_pm != 0))
+                                ret = connector_status_disconnected;
                 }
                 /* eDP is always DP */
                 radeon_dig_connector->dp_sink_type = CONNECTOR_OBJECT_ID_DISPLAYPORT;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index ae87310fd96e..0ec65168f331 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -983,6 +983,7 @@ int radeon_atombios_init(struct radeon_device *rdev)
         }
 
         mutex_init(&rdev->mode_info.atom_context->mutex);
+        mutex_init(&rdev->mode_info.atom_context->scratch_mutex);
         radeon_atom_initialize_bios_scratch_regs(rdev->ddev);
         atom_allocate_fb_scratch(rdev->mode_info.atom_context);
         return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 9a19e52cc655..6b670b0bc47b 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -179,6 +179,9 @@ static void radeon_encoder_add_backlight(struct radeon_encoder *radeon_encoder,
                     (rdev->pdev->subsystem_vendor == 0x1734) &&
                     (rdev->pdev->subsystem_device == 0x1107))
                         use_bl = false;
+                /* disable native backlight control on older asics */
+                else if (rdev->family < CHIP_R600)
+                        use_bl = false;
                 else
                         use_bl = true;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index 7784911d78ef..00fc59762e0d 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -185,6 +185,16 @@ static bool radeon_msi_ok(struct radeon_device *rdev)
         if (rdev->flags & RADEON_IS_AGP)
                 return false;
 
+        /*
+         * Older chips have a HW limitation, they can only generate 40 bits
+         * of address for "64-bit" MSIs which breaks on some platforms, notably
+         * IBM POWER servers, so we limit them
+         */
+        if (rdev->family < CHIP_BONAIRE) {
+                dev_info(rdev->dev, "radeon: MSI limited to 32-bit\n");
+                rdev->pdev->no_64bit_msi = 1;
+        }
+
         /* force MSI on */
         if (radeon_msi == 1)
                 return true;
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 5f6db4629aaa..9acb1c3c005b 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -879,6 +879,9 @@ void rs600_bandwidth_update(struct radeon_device *rdev)
         u32 d1mode_priority_a_cnt, d2mode_priority_a_cnt;
         /* FIXME: implement full support */
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 3462b64369bf..0a2d36e81108 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -579,6 +579,9 @@ void rs690_bandwidth_update(struct radeon_device *rdev)
         u32 d1mode_priority_a_cnt, d1mode_priority_b_cnt;
         u32 d2mode_priority_a_cnt, d2mode_priority_b_cnt;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled)
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 8a477bf1fdb3..c55d653aaf5f 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -1277,6 +1277,9 @@ void rv515_bandwidth_update(struct radeon_device *rdev)
         struct drm_display_mode *mode0 = NULL;
         struct drm_display_mode *mode1 = NULL;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled)
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 14896ce76324..60df444bd075 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2384,6 +2384,9 @@ void dce6_bandwidth_update(struct radeon_device *rdev)
         u32 num_heads = 0, lb_size;
         int i;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         for (i = 0; i < rdev->num_crtc; i++) {
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index b957908aec73..3367960286a6 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -906,7 +906,7 @@ static void tegra_crtc_disable(struct drm_crtc *crtc)
                 }
         }
 
-        drm_vblank_off(drm, dc->pipe);
+        drm_crtc_vblank_off(crtc);
         tegra_dc_commit(dc);
 }
 
@@ -996,8 +996,6 @@ static int tegra_crtc_mode_set(struct drm_crtc *crtc,
         u32 value;
         int err;
 
-        drm_vblank_pre_modeset(crtc->dev, dc->pipe);
-
         err = tegra_crtc_setup_clk(crtc, mode);
         if (err) {
                 dev_err(dc->dev, "failed to setup clock for CRTC: %d\n", err);
@@ -1051,6 +1049,8 @@ static void tegra_crtc_prepare(struct drm_crtc *crtc)
         unsigned int syncpt;
         unsigned long value;
 
+        drm_crtc_vblank_off(crtc);
+
         /* hardware initialization */
         reset_control_deassert(dc->rst);
         usleep_range(10000, 20000);
@@ -1091,7 +1091,7 @@ static void tegra_crtc_commit(struct drm_crtc *crtc)
 {
         struct tegra_dc *dc = to_tegra_dc(crtc);
 
-        drm_vblank_post_modeset(crtc->dev, dc->pipe);
+        drm_crtc_vblank_on(crtc);
         tegra_dc_commit(dc);
 }
 
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 73bd9e2e42bc..3402033fa52a 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1659,6 +1659,7 @@ void hid_disconnect(struct hid_device *hdev)
                 hdev->hiddev_disconnect(hdev);
         if (hdev->claimed & HID_CLAIMED_HIDRAW)
                 hidraw_disconnect(hdev);
+        hdev->claimed = 0;
 }
 EXPORT_SYMBOL_GPL(hid_disconnect);
 
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index e23ab8b30626..7c863738e419 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -299,6 +299,7 @@
 #define USB_VENDOR_ID_ELAN              0x04f3
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN  0x0089
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B     0x009b
+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103     0x0103
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F     0x016f
 
 #define USB_VENDOR_ID_ELECOM            0x056e
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 5014bb567b29..552671ee7c5d 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -72,6 +72,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
index fcdbde4ec692..3057dfc7e3bc 100644
--- a/drivers/hwmon/fam15h_power.c
+++ b/drivers/hwmon/fam15h_power.c
@@ -234,7 +234,7 @@ static const struct pci_device_id fam15h_power_id_table[] = {
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
-        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F4) },
         {}
 };
 MODULE_DEVICE_TABLE(pci, fam15h_power_id_table);
diff --git a/drivers/hwmon/g762.c b/drivers/hwmon/g762.c
index 6aac695b1688..9b55e673b67c 100644
--- a/drivers/hwmon/g762.c
+++ b/drivers/hwmon/g762.c
@@ -1084,10 +1084,8 @@ static int g762_probe(struct i2c_client *client, const struct i2c_device_id *id)
         if (ret)
                 goto clock_dis;
 
-        data->hwmon_dev = devm_hwmon_device_register_with_groups(dev,
-                                                                 client->name,
-                                                                 data,
-                                                                 g762_groups);
+        data->hwmon_dev = hwmon_device_register_with_groups(dev, client->name,
+                                                            data, g762_groups);
         if (IS_ERR(data->hwmon_dev)) {
                 ret = PTR_ERR(data->hwmon_dev);
                 goto clock_dis;
diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
index d2bf2c97ae70..6a30eeea94be 100644
--- a/drivers/hwmon/ibmpowernv.c
+++ b/drivers/hwmon/ibmpowernv.c
@@ -181,7 +181,7 @@ static int __init populate_attr_groups(struct platform_device *pdev)
 
         opal = of_find_node_by_path("/ibm,opal/sensors");
         if (!opal) {
-                dev_err(&pdev->dev, "Opal node 'sensors' not found\n");
+                dev_dbg(&pdev->dev, "Opal node 'sensors' not found\n");
                 return -ENODEV;
         }
 
@@ -335,7 +335,9 @@ static int __init ibmpowernv_init(void)
 
         err = platform_driver_probe(&ibmpowernv_driver, ibmpowernv_probe);
         if (err) {
-                pr_err("Platfrom driver probe failed\n");
+                if (err != -ENODEV)
+                        pr_err("Platform driver probe failed (%d)\n", err);
+
                 goto exit_device_del;
         }
 
diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
index 823c877a1ec0..1991d9032c38 100644
--- a/drivers/hwmon/pwm-fan.c
+++ b/drivers/hwmon/pwm-fan.c
@@ -161,10 +161,17 @@ static int pwm_fan_suspend(struct device *dev)
 static int pwm_fan_resume(struct device *dev)
 {
         struct pwm_fan_ctx *ctx = dev_get_drvdata(dev);
+        unsigned long duty;
+        int ret;
 
-        if (ctx->pwm_value)
-                return pwm_enable(ctx->pwm);
-        return 0;
+        if (ctx->pwm_value == 0)
+                return 0;
+
+        duty = DIV_ROUND_UP(ctx->pwm_value * (ctx->pwm->period - 1), MAX_PWM);
+        ret = pwm_config(ctx->pwm, duty, ctx->pwm->period);
+        if (ret)
+                return ret;
+        return pwm_enable(ctx->pwm);
 }
 #endif
 
diff --git a/drivers/iio/accel/bmc150-accel.c b/drivers/iio/accel/bmc150-accel.c
index 22c096ce39ad..513bd6d14293 100644
--- a/drivers/iio/accel/bmc150-accel.c
+++ b/drivers/iio/accel/bmc150-accel.c
@@ -44,6 +44,9 @@
 
 #define BMC150_ACCEL_REG_INT_STATUS_2           0x0B
 #define BMC150_ACCEL_ANY_MOTION_MASK            0x07
+#define BMC150_ACCEL_ANY_MOTION_BIT_X           BIT(0)
+#define BMC150_ACCEL_ANY_MOTION_BIT_Y           BIT(1)
+#define BMC150_ACCEL_ANY_MOTION_BIT_Z           BIT(2)
 #define BMC150_ACCEL_ANY_MOTION_BIT_SIGN        BIT(3)
 
 #define BMC150_ACCEL_REG_PMU_LPW                0x11
@@ -92,9 +95,9 @@
 #define BMC150_ACCEL_SLOPE_THRES_MASK           0xFF
 
 /* Slope duration in terms of number of samples */
-#define BMC150_ACCEL_DEF_SLOPE_DURATION 2
+#define BMC150_ACCEL_DEF_SLOPE_DURATION         1
 /* in terms of multiples of g's/LSB, based on range */
-#define BMC150_ACCEL_DEF_SLOPE_THRESHOLD        5
+#define BMC150_ACCEL_DEF_SLOPE_THRESHOLD        1
 
 #define BMC150_ACCEL_REG_XOUT_L         0x02
 
@@ -536,6 +539,9 @@ static int bmc150_accel_set_power_state(struct bmc150_accel_data *data, bool on)
         if (ret < 0) {
                 dev_err(&data->client->dev,
                         "Failed: bmc150_accel_set_power_state for %d\n", on);
+                if (on)
+                        pm_runtime_put_noidle(&data->client->dev);
+
                 return ret;
         }
 
@@ -811,6 +817,7 @@ static int bmc150_accel_write_event_config(struct iio_dev *indio_dev,
 
         ret =  bmc150_accel_setup_any_motion_interrupt(data, state);
         if (ret < 0) {
+                bmc150_accel_set_power_state(data, false);
                 mutex_unlock(&data->mutex);
                 return ret;
         }
@@ -846,7 +853,7 @@ static const struct attribute_group bmc150_accel_attrs_group = {
 
 static const struct iio_event_spec bmc150_accel_event = {
                 .type = IIO_EV_TYPE_ROC,
-                .dir = IIO_EV_DIR_RISING | IIO_EV_DIR_FALLING,
+                .dir = IIO_EV_DIR_EITHER,
                 .mask_separate = BIT(IIO_EV_INFO_VALUE) |
                                  BIT(IIO_EV_INFO_ENABLE) |
                                  BIT(IIO_EV_INFO_PERIOD)
@@ -1054,6 +1061,7 @@ static int bmc150_accel_data_rdy_trigger_set_state(struct iio_trigger *trig,
         else
                 ret = bmc150_accel_setup_new_data_interrupt(data, state);
         if (ret < 0) {
+                bmc150_accel_set_power_state(data, false);
                 mutex_unlock(&data->mutex);
                 return ret;
         }
@@ -1092,12 +1100,26 @@ static irqreturn_t bmc150_accel_event_handler(int irq, void *private)
         else
                 dir = IIO_EV_DIR_RISING;
 
-        if (ret & BMC150_ACCEL_ANY_MOTION_MASK)
+        if (ret & BMC150_ACCEL_ANY_MOTION_BIT_X)
+                iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ACCEL,
+                                                        0,
+                                                        IIO_MOD_X,
+                                                        IIO_EV_TYPE_ROC,
+                                                        dir),
+                                                        data->timestamp);
+        if (ret & BMC150_ACCEL_ANY_MOTION_BIT_Y)
                 iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ACCEL,
                                                         0,
-                                                        IIO_MOD_X_OR_Y_OR_Z,
+                                                        IIO_MOD_Y,
                                                         IIO_EV_TYPE_ROC,
-                                                        IIO_EV_DIR_EITHER),
+                                                        dir),
+                                                        data->timestamp);
+        if (ret & BMC150_ACCEL_ANY_MOTION_BIT_Z)
+                iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ACCEL,
+                                                        0,
+                                                        IIO_MOD_Z,
+                                                        IIO_EV_TYPE_ROC,
+                                                        dir),
                                                         data->timestamp);
 ack_intr_status:
         if (!data->dready_trigger_on)
@@ -1354,10 +1376,14 @@ static int bmc150_accel_runtime_suspend(struct device *dev)
 {
         struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
         struct bmc150_accel_data *data = iio_priv(indio_dev);
+        int ret;
 
         dev_dbg(&data->client->dev,  __func__);
+        ret = bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_SUSPEND, 0);
+        if (ret < 0)
+                return -EAGAIN;
 
-        return bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_SUSPEND, 0);
+        return 0;
 }
 
 static int bmc150_accel_runtime_resume(struct device *dev)
diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index a23e58c4ed99..320aa72c0349 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -269,6 +269,8 @@ static int kxcjk1013_set_range(struct kxcjk1013_data *data, int range_index)
                 return ret;
         }
 
+        ret &= ~(KXCJK1013_REG_CTRL1_BIT_GSEL0 |
+                 KXCJK1013_REG_CTRL1_BIT_GSEL1);
         ret |= (KXCJK1013_scale_table[range_index].gsel_0 << 3);
         ret |= (KXCJK1013_scale_table[range_index].gsel_1 << 4);
 
diff --git a/drivers/iio/adc/men_z188_adc.c b/drivers/iio/adc/men_z188_adc.c
index b58d6302521f..d095efe1ba14 100644
--- a/drivers/iio/adc/men_z188_adc.c
+++ b/drivers/iio/adc/men_z188_adc.c
@@ -152,6 +152,7 @@ static void men_z188_remove(struct mcb_device *dev)
 
 static const struct mcb_device_id men_z188_ids[] = {
         { .device = 0xbc },
+        { }
 };
 MODULE_DEVICE_TABLE(mcb, men_z188_ids);
 
diff --git a/drivers/iio/gyro/bmg160.c b/drivers/iio/gyro/bmg160.c
index 1f967e0d688e..d2fa526740ca 100644
--- a/drivers/iio/gyro/bmg160.c
+++ b/drivers/iio/gyro/bmg160.c
@@ -67,6 +67,9 @@
 #define BMG160_REG_INT_EN_0             0x15
 #define BMG160_DATA_ENABLE_INT          BIT(7)
 
+#define BMG160_REG_INT_EN_1             0x16
+#define BMG160_INT1_BIT_OD              BIT(1)
+
 #define BMG160_REG_XOUT_L               0x02
 #define BMG160_AXIS_TO_REG(axis)        (BMG160_REG_XOUT_L + (axis * 2))
 
@@ -82,6 +85,9 @@
 
 #define BMG160_REG_INT_STATUS_2 0x0B
 #define BMG160_ANY_MOTION_MASK          0x07
+#define BMG160_ANY_MOTION_BIT_X         BIT(0)
+#define BMG160_ANY_MOTION_BIT_Y         BIT(1)
+#define BMG160_ANY_MOTION_BIT_Z         BIT(2)
 
 #define BMG160_REG_TEMP         0x08
 #define BMG160_TEMP_CENTER_VAL          23
@@ -222,6 +228,19 @@ static int bmg160_chip_init(struct bmg160_data *data)
         data->slope_thres = ret;
 
         /* Set default interrupt mode */
+        ret = i2c_smbus_read_byte_data(data->client, BMG160_REG_INT_EN_1);
+        if (ret < 0) {
+                dev_err(&data->client->dev, "Error reading reg_int_en_1\n");
+                return ret;
+        }
+        ret &= ~BMG160_INT1_BIT_OD;
+        ret = i2c_smbus_write_byte_data(data->client,
+                                        BMG160_REG_INT_EN_1, ret);
+        if (ret < 0) {
+                dev_err(&data->client->dev, "Error writing reg_int_en_1\n");
+                return ret;
+        }
+
         ret = i2c_smbus_write_byte_data(data->client,
                                         BMG160_REG_INT_RST_LATCH,
                                         BMG160_INT_MODE_LATCH_INT |
@@ -250,6 +269,9 @@ static int bmg160_set_power_state(struct bmg160_data *data, bool on)
         if (ret < 0) {
                 dev_err(&data->client->dev,
                         "Failed: bmg160_set_power_state for %d\n", on);
+                if (on)
+                        pm_runtime_put_noidle(&data->client->dev);
+
                 return ret;
         }
 #endif
@@ -705,6 +727,7 @@ static int bmg160_write_event_config(struct iio_dev *indio_dev,
 
         ret =  bmg160_setup_any_motion_interrupt(data, state);
         if (ret < 0) {
+                bmg160_set_power_state(data, false);
                 mutex_unlock(&data->mutex);
                 return ret;
         }
@@ -743,7 +766,7 @@ static const struct attribute_group bmg160_attrs_group = {
 
 static const struct iio_event_spec bmg160_event = {
                 .type = IIO_EV_TYPE_ROC,
-                .dir = IIO_EV_DIR_RISING | IIO_EV_DIR_FALLING,
+                .dir = IIO_EV_DIR_EITHER,
                 .mask_shared_by_type = BIT(IIO_EV_INFO_VALUE) |
                                        BIT(IIO_EV_INFO_ENABLE)
 };
@@ -871,6 +894,7 @@ static int bmg160_data_rdy_trigger_set_state(struct iio_trigger *trig,
         else
                 ret = bmg160_setup_new_data_interrupt(data, state);
         if (ret < 0) {
+                bmg160_set_power_state(data, false);
                 mutex_unlock(&data->mutex);
                 return ret;
         }
@@ -908,10 +932,24 @@ static irqreturn_t bmg160_event_handler(int irq, void *private)
         else
                 dir = IIO_EV_DIR_FALLING;
 
-        if (ret & BMG160_ANY_MOTION_MASK)
+        if (ret & BMG160_ANY_MOTION_BIT_X)
                 iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ANGL_VEL,
                                                         0,
-                                                        IIO_MOD_X_OR_Y_OR_Z,
+                                                        IIO_MOD_X,
+                                                        IIO_EV_TYPE_ROC,
+                                                        dir),
+                                                        data->timestamp);
+        if (ret & BMG160_ANY_MOTION_BIT_Y)
+                iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ANGL_VEL,
+                                                        0,
+                                                        IIO_MOD_Y,
+                                                        IIO_EV_TYPE_ROC,
+                                                        dir),
+                                                        data->timestamp);
+        if (ret & BMG160_ANY_MOTION_BIT_Z)
+                iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ANGL_VEL,
+                                                        0,
+                                                        IIO_MOD_Z,
                                                         IIO_EV_TYPE_ROC,
                                                         dir),
                                                         data->timestamp);
@@ -1169,8 +1207,15 @@ static int bmg160_runtime_suspend(struct device *dev)
 {
         struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
         struct bmg160_data *data = iio_priv(indio_dev);
+        int ret;
+
+        ret = bmg160_set_mode(data, BMG160_MODE_SUSPEND);
+        if (ret < 0) {
+                dev_err(&data->client->dev, "set mode failed\n");
+                return -EAGAIN;
+        }
 
-        return bmg160_set_mode(data, BMG160_MODE_SUSPEND);
+        return 0;
 }
 
 static int bmg160_runtime_resume(struct device *dev)
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 3effa931fce2..10641b7816f4 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -115,9 +115,12 @@ isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id,
         attr.cap.max_recv_wr = ISERT_QP_MAX_RECV_DTOS;
         /*
          * FIXME: Use devattr.max_sge - 2 for max_send_sge as
-         * work-around for RDMA_READ..
+         * work-around for RDMA_READs with ConnectX-2.
+         *
+         * Also, still make sure to have at least two SGEs for
+         * outgoing control PDU responses.
          */
-        attr.cap.max_send_sge = device->dev_attr.max_sge - 2;
+        attr.cap.max_send_sge = max(2, device->dev_attr.max_sge - 2);
         isert_conn->max_sge = attr.cap.max_send_sge;
 
         attr.cap.max_recv_sge = 1;
@@ -225,12 +228,16 @@ isert_create_device_ib_res(struct isert_device *device)
         struct isert_cq_desc *cq_desc;
         struct ib_device_attr *dev_attr;
         int ret = 0, i, j;
+        int max_rx_cqe, max_tx_cqe;
 
         dev_attr = &device->dev_attr;
         ret = isert_query_device(ib_dev, dev_attr);
         if (ret)
                 return ret;
 
+        max_rx_cqe = min(ISER_MAX_RX_CQ_LEN, dev_attr->max_cqe);
+        max_tx_cqe = min(ISER_MAX_TX_CQ_LEN, dev_attr->max_cqe);
+
         /* asign function handlers */
         if (dev_attr->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS &&
             dev_attr->device_cap_flags & IB_DEVICE_SIGNATURE_HANDOVER) {
@@ -272,7 +279,7 @@ isert_create_device_ib_res(struct isert_device *device)
                                                 isert_cq_rx_callback,
                                                 isert_cq_event_callback,
                                                 (void *)&cq_desc[i],
-                                                ISER_MAX_RX_CQ_LEN, i);
+                                                max_rx_cqe, i);
                 if (IS_ERR(device->dev_rx_cq[i])) {
                         ret = PTR_ERR(device->dev_rx_cq[i]);
                         device->dev_rx_cq[i] = NULL;
@@ -284,7 +291,7 @@ isert_create_device_ib_res(struct isert_device *device)
                                                 isert_cq_tx_callback,
                                                 isert_cq_event_callback,
                                                 (void *)&cq_desc[i],
-                                                ISER_MAX_TX_CQ_LEN, i);
+                                                max_tx_cqe, i);
                 if (IS_ERR(device->dev_tx_cq[i])) {
                         ret = PTR_ERR(device->dev_tx_cq[i]);
                         device->dev_tx_cq[i] = NULL;
@@ -803,14 +810,25 @@ wake_up:
         complete(&isert_conn->conn_wait);
 }
 
-static void
+static int
 isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect)
 {
-        struct isert_conn *isert_conn = (struct isert_conn *)cma_id->context;
+        struct isert_conn *isert_conn;
+
+        if (!cma_id->qp) {
+                struct isert_np *isert_np = cma_id->context;
+
+                isert_np->np_cm_id = NULL;
+                return -1;
+        }
+
+        isert_conn = (struct isert_conn *)cma_id->context;
 
         isert_conn->disconnect = disconnect;
         INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work);
         schedule_work(&isert_conn->conn_logout_work);
+
+        return 0;
 }
 
 static int
@@ -825,6 +843,9 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         switch (event->event) {
         case RDMA_CM_EVENT_CONNECT_REQUEST:
                 ret = isert_connect_request(cma_id, event);
+                if (ret)
+                        pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
+                                event->event, ret);
                 break;
         case RDMA_CM_EVENT_ESTABLISHED:
                 isert_connected_handler(cma_id);
@@ -834,7 +855,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
                 disconnect = true;
         case RDMA_CM_EVENT_TIMEWAIT_EXIT:  /* FALLTHRU */
-                isert_disconnected_handler(cma_id, disconnect);
+                ret = isert_disconnected_handler(cma_id, disconnect);
                 break;
         case RDMA_CM_EVENT_CONNECT_ERROR:
         default:
@@ -842,12 +863,6 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                 break;
         }
 
-        if (ret != 0) {
-                pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
-                       event->event, ret);
-                dump_stack();
-        }
-
         return ret;
 }
 
@@ -3190,7 +3205,8 @@ isert_free_np(struct iscsi_np *np)
 {
         struct isert_np *isert_np = (struct isert_np *)np->np_context;
 
-        rdma_destroy_id(isert_np->np_cm_id);
+        if (isert_np->np_cm_id)
+                rdma_destroy_id(isert_np->np_cm_id);
 
         np->np_context = NULL;
         kfree(isert_np);
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 7206547c13ce..dc829682701a 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -2092,6 +2092,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
         if (!qp_init)
                 goto out;
 
+retry:
         ch->cq = ib_create_cq(sdev->device, srpt_completion, NULL, ch,
                               ch->rq_size + srp_sq_size, 0);
         if (IS_ERR(ch->cq)) {
@@ -2115,6 +2116,13 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
         ch->qp = ib_create_qp(sdev->pd, qp_init);
         if (IS_ERR(ch->qp)) {
                 ret = PTR_ERR(ch->qp);
+                if (ret == -ENOMEM) {
+                        srp_sq_size /= 2;
+                        if (srp_sq_size >= MIN_SRPT_SQ_SIZE) {
+                                ib_destroy_cq(ch->cq);
+                                goto retry;
+                        }
+                }
                 printk(KERN_ERR "failed to create_qp ret= %d\n", ret);
                 goto err_destroy_cq;
         }
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 2ed7905a068f..fc55f0d15b70 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -1179,9 +1179,19 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
                 }
 
                 ep_irq_in = &intf->cur_altsetting->endpoint[1].desc;
-                usb_fill_bulk_urb(xpad->bulk_out, udev,
-                                usb_sndbulkpipe(udev, ep_irq_in->bEndpointAddress),
-                                xpad->bdata, XPAD_PKT_LEN, xpad_bulk_out, xpad);
+                if (usb_endpoint_is_bulk_out(ep_irq_in)) {
+                        usb_fill_bulk_urb(xpad->bulk_out, udev,
+                                          usb_sndbulkpipe(udev,
+                                                          ep_irq_in->bEndpointAddress),
+                                          xpad->bdata, XPAD_PKT_LEN,
+                                          xpad_bulk_out, xpad);
+                } else {
+                        usb_fill_int_urb(xpad->bulk_out, udev,
+                                         usb_sndintpipe(udev,
+                                                        ep_irq_in->bEndpointAddress),
+                                         xpad->bdata, XPAD_PKT_LEN,
+                                         xpad_bulk_out, xpad, 0);
+                }
 
                 /*
                  * Submit the int URB immediately rather than waiting for open
diff --git a/drivers/input/misc/twl4030-pwrbutton.c b/drivers/input/misc/twl4030-pwrbutton.c
index fb3b63b2f85c..8400a1a34d87 100644
--- a/drivers/input/misc/twl4030-pwrbutton.c
+++ b/drivers/input/misc/twl4030-pwrbutton.c
@@ -85,6 +85,7 @@ static int twl4030_pwrbutton_probe(struct platform_device *pdev)
         }
 
         platform_set_drvdata(pdev, pwr);
+        device_init_wakeup(&pdev->dev, true);
 
         return 0;
 }
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 2b0ae8cc8e51..d125a019383f 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1156,7 +1156,13 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
 {
         struct alps_data *priv = psmouse->private;
 
-        if ((psmouse->packet[0] & 0xc8) == 0x08) { /* PS/2 packet */
+        /*
+         * Check if we are dealing with a bare PS/2 packet, presumably from
+         * a device connected to the external PS/2 port. Because bare PS/2
+         * protocol does not have enough constant bits to self-synchronize
+         * properly we only do this if the device is fully synchronized.
+         */
+        if (!psmouse->out_of_sync_cnt && (psmouse->packet[0] & 0xc8) == 0x08) {
                 if (psmouse->pktcnt == 3) {
                         alps_report_bare_ps2_packet(psmouse, psmouse->packet,
                                                     true);
@@ -1180,12 +1186,27 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
         }
 
         /* Bytes 2 - pktsize should have 0 in the highest bit */
-        if ((priv->proto_version < ALPS_PROTO_V5) &&
+        if (priv->proto_version < ALPS_PROTO_V5 &&
             psmouse->pktcnt >= 2 && psmouse->pktcnt <= psmouse->pktsize &&
             (psmouse->packet[psmouse->pktcnt - 1] & 0x80)) {
                 psmouse_dbg(psmouse, "refusing packet[%i] = %x\n",
                             psmouse->pktcnt - 1,
                             psmouse->packet[psmouse->pktcnt - 1]);
+
+                if (priv->proto_version == ALPS_PROTO_V3 &&
+                    psmouse->pktcnt == psmouse->pktsize) {
+                        /*
+                         * Some Dell boxes, such as Latitude E6440 or E7440
+                         * with closed lid, quite often smash last byte of
+                         * otherwise valid packet with 0xff. Given that the
+                         * next packet is very likely to be valid let's
+                         * report PSMOUSE_FULL_PACKET but not process data,
+                         * rather than reporting PSMOUSE_BAD_DATA and
+                         * filling the logs.
+                         */
+                        return PSMOUSE_FULL_PACKET;
+                }
+
                 return PSMOUSE_BAD_DATA;
         }
 
@@ -2389,6 +2410,9 @@ int alps_init(struct psmouse *psmouse)
         /* We are having trouble resyncing ALPS touchpads so disable it for now */
         psmouse->resync_time = 0;
 
+        /* Allow 2 invalid packets without resetting device */
+        psmouse->resetafter = psmouse->pktsize * 2;
+
         return 0;
 
 init_fail:
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 06fc6e76ffbe..f2b978026407 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -428,14 +428,6 @@ static void elantech_report_trackpoint(struct psmouse *psmouse,
         int x, y;
         u32 t;
 
-        if (dev_WARN_ONCE(&psmouse->ps2dev.serio->dev,
-                          !tp_dev,
-                          psmouse_fmt("Unexpected trackpoint message\n"))) {
-                if (etd->debug == 1)
-                        elantech_packet_dump(psmouse);
-                return;
-        }
-
         t = get_unaligned_le32(&packet[0]);
 
         switch (t & ~7U) {
@@ -563,6 +555,7 @@ static void elantech_input_sync_v4(struct psmouse *psmouse)
         } else {
                 input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
                 input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
+                input_report_key(dev, BTN_MIDDLE, packet[0] & 0x04);
         }
 
         input_mt_report_pointer_emulation(dev, true);
@@ -792,6 +785,9 @@ static int elantech_packet_check_v4(struct psmouse *psmouse)
         unsigned char packet_type = packet[3] & 0x03;
         bool sanity_check;
 
+        if (etd->tp_dev && (packet[3] & 0x0f) == 0x06)
+                return PACKET_TRACKPOINT;
+
         /*
          * Sanity check based on the constant bits of a packet.
          * The constant bits change depending on the value of
@@ -877,10 +873,19 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
 
         case 4:
                 packet_type = elantech_packet_check_v4(psmouse);
-                if (packet_type == PACKET_UNKNOWN)
+                switch (packet_type) {
+                case PACKET_UNKNOWN:
                         return PSMOUSE_BAD_DATA;
 
-                elantech_report_absolute_v4(psmouse, packet_type);
+                case PACKET_TRACKPOINT:
+                        elantech_report_trackpoint(psmouse, packet_type);
+                        break;
+
+                default:
+                        elantech_report_absolute_v4(psmouse, packet_type);
+                        break;
+                }
+
                 break;
         }
 
@@ -1120,6 +1125,22 @@ static void elantech_set_buttonpad_prop(struct psmouse *psmouse)
 }
 
 /*
+ * Some hw_version 4 models do have a middle button
+ */
+static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+        {
+                /* Fujitsu H730 has a middle button */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
+                },
+        },
+#endif
+        { }
+};
+
+/*
  * Set the appropriate event bits for the input subsystem
  */
 static int elantech_set_input_params(struct psmouse *psmouse)
@@ -1138,6 +1159,8 @@ static int elantech_set_input_params(struct psmouse *psmouse)
         __clear_bit(EV_REL, dev->evbit);
 
         __set_bit(BTN_LEFT, dev->keybit);
+        if (dmi_check_system(elantech_dmi_has_middle_button))
+                __set_bit(BTN_MIDDLE, dev->keybit);
         __set_bit(BTN_RIGHT, dev->keybit);
 
         __set_bit(BTN_TOUCH, dev->keybit);
@@ -1299,6 +1322,7 @@ ELANTECH_INT_ATTR(reg_25, 0x25);
 ELANTECH_INT_ATTR(reg_26, 0x26);
 ELANTECH_INT_ATTR(debug, 0);
 ELANTECH_INT_ATTR(paritycheck, 0);
+ELANTECH_INT_ATTR(crc_enabled, 0);
 
 static struct attribute *elantech_attrs[] = {
         &psmouse_attr_reg_07.dattr.attr,
@@ -1313,6 +1337,7 @@ static struct attribute *elantech_attrs[] = {
         &psmouse_attr_reg_26.dattr.attr,
         &psmouse_attr_debug.dattr.attr,
         &psmouse_attr_paritycheck.dattr.attr,
+        &psmouse_attr_crc_enabled.dattr.attr,
         NULL
 };
 
@@ -1439,6 +1464,22 @@ static int elantech_reconnect(struct psmouse *psmouse)
 }
 
 /*
+ * Some hw_version 4 models do not work with crc_disabled
+ */
+static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+        {
+                /* Fujitsu H730 does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
+                },
+        },
+#endif
+        { }
+};
+
+/*
  * Some hw_version 3 models go into error state when we try to set
  * bit 3 and/or bit 1 of r10.
  */
@@ -1513,7 +1554,8 @@ static int elantech_set_properties(struct elantech_data *etd)
          * The signatures of v3 and v4 packets change depending on the
          * value of this hardware flag.
          */
-        etd->crc_enabled = ((etd->fw_version & 0x4000) == 0x4000);
+        etd->crc_enabled = (etd->fw_version & 0x4000) == 0x4000 ||
+                           dmi_check_system(elantech_dmi_force_crc_enabled);
 
         /* Enable real hardware resolution on hw_version 3 ? */
         etd->set_hw_resolution = !dmi_check_system(no_hw_res_dmi_table);
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 9031a0a28ea4..f9472920d986 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -135,14 +135,18 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
                 1232, 5710, 1156, 4696
         },
         {
-                (const char * const []){"LEN0034", "LEN0036", "LEN2002",
-                                        "LEN2004", NULL},
+                (const char * const []){"LEN0034", "LEN0036", "LEN0039",
+                                        "LEN2002", "LEN2004", NULL},
                 1024, 5112, 2024, 4832
         },
         {
                 (const char * const []){"LEN2001", NULL},
                 1024, 5022, 2508, 4832
         },
+        {
+                (const char * const []){"LEN2006", NULL},
+                1264, 5675, 1171, 4688
+        },
         { }
 };
 
@@ -163,6 +167,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
         "LEN0036", /* T440 */
         "LEN0037",
         "LEN0038",
+        "LEN0039", /* T440s */
         "LEN0041",
         "LEN0042", /* Yoga */
         "LEN0045",
diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
index 6ae3cdee0681..cc4f9d80122e 100644
--- a/drivers/irqchip/irq-atmel-aic-common.c
+++ b/drivers/irqchip/irq-atmel-aic-common.c
@@ -217,8 +217,9 @@ struct irq_domain *__init aic_common_of_init(struct device_node *node,
         }
 
         ret = irq_alloc_domain_generic_chips(domain, 32, 1, name,
-                                             handle_level_irq, 0, 0,
-                                             IRQCHIP_SKIP_SET_WAKE);
+                                             handle_fasteoi_irq,
+                                             IRQ_NOREQUEST | IRQ_NOPROBE |
+                                             IRQ_NOAUTOEN, 0, 0);
         if (ret)
                 goto err_domain_remove;
 
@@ -230,7 +231,6 @@ struct irq_domain *__init aic_common_of_init(struct device_node *node,
                 gc->unused = 0;
                 gc->wake_enabled = ~0;
                 gc->chip_types[0].type = IRQ_TYPE_SENSE_MASK;
-                gc->chip_types[0].handler = handle_fasteoi_irq;
                 gc->chip_types[0].chip.irq_eoi = irq_gc_eoi;
                 gc->chip_types[0].chip.irq_set_wake = irq_gc_set_wake;
                 gc->chip_types[0].chip.irq_shutdown = aic_common_shutdown;
diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
index b9f4fb808e49..5fb38a2ac226 100644
--- a/drivers/irqchip/irq-bcm7120-l2.c
+++ b/drivers/irqchip/irq-bcm7120-l2.c
@@ -101,9 +101,9 @@ static int bcm7120_l2_intc_init_one(struct device_node *dn,
         int parent_irq;
 
         parent_irq = irq_of_parse_and_map(dn, irq);
-        if (parent_irq < 0) {
+        if (!parent_irq) {
                 pr_err("failed to map interrupt %d\n", irq);
-                return parent_irq;
+                return -EINVAL;
         }
 
         data->irq_map_mask |= be32_to_cpup(map_mask + irq);
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index c15c840987d2..14691a4cb84c 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -135,9 +135,9 @@ int __init brcmstb_l2_intc_of_init(struct device_node *np,
         __raw_writel(0xffffffff, data->base + CPU_CLEAR);
 
         data->parent_irq = irq_of_parse_and_map(np, 0);
-        if (data->parent_irq < 0) {
+        if (!data->parent_irq) {
                 pr_err("failed to find parent interrupt\n");
-                ret = data->parent_irq;
+                ret = -EINVAL;
                 goto out_unmap;
         }
 
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 825ca1f87639..afe79719ea32 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1434,9 +1434,9 @@ static void drop_buffers(struct dm_bufio_client *c)
 
 /*
  * Test if the buffer is unused and too old, and commit it.
- * At if noio is set, we must not do any I/O because we hold
- * dm_bufio_clients_lock and we would risk deadlock if the I/O gets rerouted to
- * different bufio client.
+ * And if GFP_NOFS is used, we must not do any I/O because we hold
+ * dm_bufio_clients_lock and we would risk deadlock if the I/O gets
+ * rerouted to different bufio client.
  */
 static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp,
                                 unsigned long max_jiffies)
@@ -1444,7 +1444,7 @@ static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp,
         if (jiffies - b->last_accessed < max_jiffies)
                 return 0;
 
-        if (!(gfp & __GFP_IO)) {
+        if (!(gfp & __GFP_FS)) {
                 if (test_bit(B_READING, &b->state) ||
                     test_bit(B_WRITING, &b->state) ||
                     test_bit(B_DIRTY, &b->state))
@@ -1486,7 +1486,7 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
         unsigned long freed;
 
         c = container_of(shrink, struct dm_bufio_client, shrinker);
-        if (sc->gfp_mask & __GFP_IO)
+        if (sc->gfp_mask & __GFP_FS)
                 dm_bufio_lock(c);
         else if (!dm_bufio_trylock(c))
                 return SHRINK_STOP;
@@ -1503,7 +1503,7 @@ dm_bufio_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
         unsigned long count;
 
         c = container_of(shrink, struct dm_bufio_client, shrinker);
-        if (sc->gfp_mask & __GFP_IO)
+        if (sc->gfp_mask & __GFP_FS)
                 dm_bufio_lock(c);
         else if (!dm_bufio_trylock(c))
                 return 0;
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 4857fa4a5484..07c0fa0fa284 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -789,8 +789,7 @@ struct dm_raid_superblock {
         __le32 layout;
         __le32 stripe_sectors;
 
-        __u8 pad[452];          /* Round struct to 512 bytes. */
-                                /* Always set to 0 when writing. */
+        /* Remainder of a logical block is zero-filled when writing (see super_sync()). */
 } __packed;
 
 static int read_disk_sb(struct md_rdev *rdev, int size)
@@ -827,7 +826,7 @@ static void super_sync(struct mddev *mddev, struct md_rdev *rdev)
                     test_bit(Faulty, &(rs->dev[i].rdev.flags)))
                         failed_devices |= (1ULL << i);
 
-        memset(sb, 0, sizeof(*sb));
+        memset(sb + 1, 0, rdev->sb_size - sizeof(*sb));
 
         sb->magic = cpu_to_le32(DM_RAID_MAGIC);
         sb->features = cpu_to_le32(0);  /* No features yet */
@@ -862,7 +861,11 @@ static int super_load(struct md_rdev *rdev, struct md_rdev *refdev)
         uint64_t events_sb, events_refsb;
 
         rdev->sb_start = 0;
-        rdev->sb_size = sizeof(*sb);
+        rdev->sb_size = bdev_logical_block_size(rdev->meta_bdev);
+        if (rdev->sb_size < sizeof(*sb) || rdev->sb_size > PAGE_SIZE) {
+                DMERR("superblock size of a logical block is no longer valid");
+                return -EINVAL;
+        }
 
         ret = read_disk_sb(rdev, rdev->sb_size);
         if (ret)
@@ -1169,8 +1172,12 @@ static void configure_discard_support(struct dm_target *ti, struct raid_set *rs)
         raid456 = (rs->md.level == 4 || rs->md.level == 5 || rs->md.level == 6);
 
         for (i = 0; i < rs->md.raid_disks; i++) {
-                struct request_queue *q = bdev_get_queue(rs->dev[i].rdev.bdev);
+                struct request_queue *q;
+
+                if (!rs->dev[i].rdev.bdev)
+                        continue;
 
+                q = bdev_get_queue(rs->dev[i].rdev.bdev);
                 if (!q || !blk_queue_discard(q))
                         return;
 
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index d1600d2aa2e2..f8b37d4c05d8 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -159,8 +159,10 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 sc->stripes_shift = __ffs(stripes);
 
         r = dm_set_target_max_io_len(ti, chunk_size);
-        if (r)
+        if (r) {
+                kfree(sc);
                 return r;
+        }
 
         ti->num_flush_bios = stripes;
         ti->num_discard_bios = stripes;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 4843801173fe..0f86d802b533 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1936,6 +1936,14 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                 return DM_MAPIO_SUBMITTED;
         }
 
+        /*
+         * We must hold the virtual cell before doing the lookup, otherwise
+         * there's a race with discard.
+         */
+        build_virtual_key(tc->td, block, &key);
+        if (dm_bio_detain(tc->pool->prison, &key, bio, &cell1, &cell_result))
+                return DM_MAPIO_SUBMITTED;
+
         r = dm_thin_find_block(td, block, 0, &result);
 
         /*
@@ -1959,13 +1967,10 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                          * shared flag will be set in their case.
                          */
                         thin_defer_bio(tc, bio);
+                        cell_defer_no_holder_no_free(tc, &cell1);
                         return DM_MAPIO_SUBMITTED;
                 }
 
-                build_virtual_key(tc->td, block, &key);
-                if (dm_bio_detain(tc->pool->prison, &key, bio, &cell1, &cell_result))
-                        return DM_MAPIO_SUBMITTED;
-
                 build_data_key(tc->td, result.block, &key);
                 if (dm_bio_detain(tc->pool->prison, &key, bio, &cell2, &cell_result)) {
                         cell_defer_no_holder_no_free(tc, &cell1);
@@ -1986,6 +1991,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                          * of doing so.
                          */
                         handle_unserviceable_bio(tc->pool, bio);
+                        cell_defer_no_holder_no_free(tc, &cell1);
                         return DM_MAPIO_SUBMITTED;
                 }
                 /* fall through */
@@ -1996,6 +2002,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                  * provide the hint to load the metadata into cache.
                  */
                 thin_defer_bio(tc, bio);
+                cell_defer_no_holder_no_free(tc, &cell1);
                 return DM_MAPIO_SUBMITTED;
 
         default:
@@ -2005,6 +2012,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                  * pool is switched to fail-io mode.
                  */
                 bio_io_error(bio);
+                cell_defer_no_holder_no_free(tc, &cell1);
                 return DM_MAPIO_SUBMITTED;
         }
 }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 4dfa15da9cb8..9233c71138f1 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5121,6 +5121,7 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
                 printk("md: %s still in use.\n",mdname(mddev));
                 if (did_freeze) {
                         clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                        set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                         md_wakeup_thread(mddev->thread);
                 }
                 err = -EBUSY;
@@ -5135,6 +5136,8 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
                 mddev->ro = 1;
                 set_disk_ro(mddev->gendisk, 1);
                 clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+                md_wakeup_thread(mddev->thread);
                 sysfs_notify_dirent_safe(mddev->sysfs_state);
                 err = 0;
         }
@@ -5178,6 +5181,7 @@ static int do_md_stop(struct mddev *mddev, int mode,
                 mutex_unlock(&mddev->open_mutex);
                 if (did_freeze) {
                         clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                        set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                         md_wakeup_thread(mddev->thread);
                 }
                 return -EBUSY;
diff --git a/drivers/md/persistent-data/dm-btree-internal.h b/drivers/md/persistent-data/dm-btree-internal.h
index 37d367bb9aa8..bf2b80d5c470 100644
--- a/drivers/md/persistent-data/dm-btree-internal.h
+++ b/drivers/md/persistent-data/dm-btree-internal.h
@@ -42,6 +42,12 @@ struct btree_node {
 } __packed;
 
 
+/*
+ * Locks a block using the btree node validator.
+ */
+int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
+                 struct dm_block **result);
+
 void inc_children(struct dm_transaction_manager *tm, struct btree_node *n,
                   struct dm_btree_value_type *vt);
 
diff --git a/drivers/md/persistent-data/dm-btree-spine.c b/drivers/md/persistent-data/dm-btree-spine.c
index cf9fd676ae44..1b5e13ec7f96 100644
--- a/drivers/md/persistent-data/dm-btree-spine.c
+++ b/drivers/md/persistent-data/dm-btree-spine.c
@@ -92,7 +92,7 @@ struct dm_block_validator btree_node_validator = {
 
 /*----------------------------------------------------------------*/
 
-static int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
+int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
                  struct dm_block **result)
 {
         return dm_tm_read_lock(info->tm, b, &btree_node_validator, result);
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index 416060c25709..200ac12a1d40 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -847,22 +847,26 @@ EXPORT_SYMBOL_GPL(dm_btree_find_lowest_key);
  * FIXME: We shouldn't use a recursive algorithm when we have limited stack
  * space.  Also this only works for single level trees.
  */
-static int walk_node(struct ro_spine *s, dm_block_t block,
+static int walk_node(struct dm_btree_info *info, dm_block_t block,
                      int (*fn)(void *context, uint64_t *keys, void *leaf),
                      void *context)
 {
         int r;
         unsigned i, nr;
+        struct dm_block *node;
         struct btree_node *n;
         uint64_t keys;
 
-        r = ro_step(s, block);
-        n = ro_node(s);
+        r = bn_read_lock(info, block, &node);
+        if (r)
+                return r;
+
+        n = dm_block_data(node);
 
         nr = le32_to_cpu(n->header.nr_entries);
         for (i = 0; i < nr; i++) {
                 if (le32_to_cpu(n->header.flags) & INTERNAL_NODE) {
-                        r = walk_node(s, value64(n, i), fn, context);
+                        r = walk_node(info, value64(n, i), fn, context);
                         if (r)
                                 goto out;
                 } else {
@@ -874,7 +878,7 @@ static int walk_node(struct ro_spine *s, dm_block_t block,
         }
 
 out:
-        ro_pop(s);
+        dm_tm_unlock(info->tm, node);
         return r;
 }
 
@@ -882,15 +886,7 @@ int dm_btree_walk(struct dm_btree_info *info, dm_block_t root,
                   int (*fn)(void *context, uint64_t *keys, void *leaf),
                   void *context)
 {
-        int r;
-        struct ro_spine spine;
-
         BUG_ON(info->levels > 1);
-
-        init_ro_spine(&spine, info);
-        r = walk_node(&spine, root, fn, context);
-        exit_ro_spine(&spine);
-
-        return r;
+        return walk_node(info, root, fn, context);
 }
 EXPORT_SYMBOL_GPL(dm_btree_walk);
diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c
index cf008f45968c..711773e8e64b 100644
--- a/drivers/mfd/max77693.c
+++ b/drivers/mfd/max77693.c
@@ -240,7 +240,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
                 goto err_irq_charger;
         }
 
-        ret = regmap_add_irq_chip(max77693->regmap, max77693->irq,
+        ret = regmap_add_irq_chip(max77693->regmap_muic, max77693->irq,
                                 IRQF_ONESHOT | IRQF_SHARED |
                                 IRQF_TRIGGER_FALLING, 0,
                                 &max77693_muic_irq_chip,
@@ -250,6 +250,17 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
                 goto err_irq_muic;
         }
 
+        /* Unmask interrupts from all blocks in interrupt source register */
+        ret = regmap_update_bits(max77693->regmap,
+                                MAX77693_PMIC_REG_INTSRC_MASK,
+                                SRC_IRQ_ALL, (unsigned int)~SRC_IRQ_ALL);
+        if (ret < 0) {
+                dev_err(max77693->dev,
+                        "Could not unmask interrupts in INTSRC: %d\n",
+                        ret);
+                goto err_intsrc;
+        }
+
         pm_runtime_set_active(max77693->dev);
 
         ret = mfd_add_devices(max77693->dev, -1, max77693_devs,
@@ -261,6 +272,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
 
 err_mfd:
         mfd_remove_devices(max77693->dev);
+err_intsrc:
         regmap_del_irq_chip(max77693->irq, max77693->irq_data_muic);
 err_irq_muic:
         regmap_del_irq_chip(max77693->irq, max77693->irq_data_charger);
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index f2643c221d34..30f7ca89a0e6 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -947,6 +947,7 @@ static void rtsx_pci_idle_work(struct work_struct *work)
         mutex_unlock(&pcr->pcr_mutex);
 }
 
+#ifdef CONFIG_PM
 static void rtsx_pci_power_off(struct rtsx_pcr *pcr, u8 pm_state)
 {
         if (pcr->ops->turn_off_led)
@@ -961,6 +962,7 @@ static void rtsx_pci_power_off(struct rtsx_pcr *pcr, u8 pm_state)
         if (pcr->ops->force_power_down)
                 pcr->ops->force_power_down(pcr, pm_state);
 }
+#endif
 
 static int rtsx_pci_init_hw(struct rtsx_pcr *pcr)
 {
diff --git a/drivers/mfd/stmpe.h b/drivers/mfd/stmpe.h
index 2d045f26f193..bee0abf82040 100644
--- a/drivers/mfd/stmpe.h
+++ b/drivers/mfd/stmpe.h
@@ -269,7 +269,7 @@ int stmpe_remove(struct stmpe *stmpe);
 #define STMPE24XX_REG_CHIP_ID           0x80
 #define STMPE24XX_REG_IEGPIOR_LSB       0x18
 #define STMPE24XX_REG_ISGPIOR_MSB       0x19
-#define STMPE24XX_REG_GPMR_LSB          0xA5
+#define STMPE24XX_REG_GPMR_LSB          0xA4
 #define STMPE24XX_REG_GPSR_LSB          0x85
 #define STMPE24XX_REG_GPCR_LSB          0x88
 #define STMPE24XX_REG_GPDR_LSB          0x8B
diff --git a/drivers/mfd/twl4030-power.c b/drivers/mfd/twl4030-power.c
index cf92a6d1c532..50f9091bcd38 100644
--- a/drivers/mfd/twl4030-power.c
+++ b/drivers/mfd/twl4030-power.c
@@ -44,6 +44,15 @@ static u8 twl4030_start_script_address = 0x2b;
 #define PWR_DEVSLP              BIT(1)
 #define PWR_DEVOFF              BIT(0)
 
+/* Register bits for CFG_P1_TRANSITION (also for P2 and P3) */
+#define STARTON_SWBUG           BIT(7)  /* Start on watchdog */
+#define STARTON_VBUS            BIT(5)  /* Start on VBUS */
+#define STARTON_VBAT            BIT(4)  /* Start on battery insert */
+#define STARTON_RTC             BIT(3)  /* Start on RTC */
+#define STARTON_USB             BIT(2)  /* Start on USB host */
+#define STARTON_CHG             BIT(1)  /* Start on charger */
+#define STARTON_PWON            BIT(0)  /* Start on PWRON button */
+
 #define SEQ_OFFSYNC             (1 << 0)
 
 #define PHY_TO_OFF_PM_MASTER(p)         (p - 0x36)
@@ -606,6 +615,44 @@ twl4030_power_configure_resources(const struct twl4030_power_data *pdata)
         return 0;
 }
 
+static int twl4030_starton_mask_and_set(u8 bitmask, u8 bitvalues)
+{
+        u8 regs[3] = { TWL4030_PM_MASTER_CFG_P1_TRANSITION,
+                       TWL4030_PM_MASTER_CFG_P2_TRANSITION,
+                       TWL4030_PM_MASTER_CFG_P3_TRANSITION, };
+        u8 val;
+        int i, err;
+
+        err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER, TWL4030_PM_MASTER_KEY_CFG1,
+                               TWL4030_PM_MASTER_PROTECT_KEY);
+        if (err)
+                goto relock;
+        err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
+                               TWL4030_PM_MASTER_KEY_CFG2,
+                               TWL4030_PM_MASTER_PROTECT_KEY);
+        if (err)
+                goto relock;
+
+        for (i = 0; i < sizeof(regs); i++) {
+                err = twl_i2c_read_u8(TWL_MODULE_PM_MASTER,
+                                      &val, regs[i]);
+                if (err)
+                        break;
+                val = (~bitmask & val) | (bitmask & bitvalues);
+                err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
+                                       val, regs[i]);
+                if (err)
+                        break;
+        }
+
+        if (err)
+                pr_err("TWL4030 Register access failed: %i\n", err);
+
+relock:
+        return twl_i2c_write_u8(TWL_MODULE_PM_MASTER, 0,
+                                TWL4030_PM_MASTER_PROTECT_KEY);
+}
+
 /*
  * In master mode, start the power off sequence.
  * After a successful execution, TWL shuts down the power to the SoC
@@ -615,6 +662,11 @@ void twl4030_power_off(void)
 {
         int err;
 
+        /* Disable start on charger or VBUS as it can break poweroff */
+        err = twl4030_starton_mask_and_set(STARTON_VBUS | STARTON_CHG, 0);
+        if (err)
+                pr_err("TWL4030 Unable to configure start-up\n");
+
         err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER, PWR_DEVOFF,
                                TWL4030_PM_MASTER_P1_SW_EVENTS);
         if (err)
diff --git a/drivers/mfd/viperboard.c b/drivers/mfd/viperboard.c
index e00f5340ed87..3c2b8f9e3c84 100644
--- a/drivers/mfd/viperboard.c
+++ b/drivers/mfd/viperboard.c
@@ -93,8 +93,9 @@ static int vprbrd_probe(struct usb_interface *interface,
                  version >> 8, version & 0xff,
                  vb->usb_dev->bus->busnum, vb->usb_dev->devnum);
 
-        ret = mfd_add_devices(&interface->dev, -1, vprbrd_devs,
-                                ARRAY_SIZE(vprbrd_devs), NULL, 0, NULL);
+        ret = mfd_add_devices(&interface->dev, PLATFORM_DEVID_AUTO,
+                                vprbrd_devs, ARRAY_SIZE(vprbrd_devs), NULL, 0,
+                                NULL);
         if (ret != 0) {
                 dev_err(&interface->dev, "Failed to add mfd devices to core.");
                 goto error;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c9ac06cfe6b7..a5115fb7cf33 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2471,7 +2471,8 @@ static void bond_loadbalance_arp_mon(struct work_struct *work)
                         bond_slave_state_change(bond);
                         if (BOND_MODE(bond) == BOND_MODE_XOR)
                                 bond_update_slave_arr(bond, NULL);
-                } else if (do_failover) {
+                }
+                if (do_failover) {
                         block_netpoll_tx();
                         bond_select_active_slave(bond);
                         unblock_netpoll_tx();
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 02492d241e4c..2cfe5012e4e5 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -110,7 +110,7 @@ static int can_calc_bittiming(struct net_device *dev, struct can_bittiming *bt,
         long rate;
         u64 v64;
 
-        /* Use CIA recommended sample points */
+        /* Use CiA recommended sample points */
         if (bt->sample_point) {
                 sampl_pt = bt->sample_point;
         } else {
@@ -382,7 +382,7 @@ void can_free_echo_skb(struct net_device *dev, unsigned int idx)
         BUG_ON(idx >= priv->echo_skb_max);
 
         if (priv->echo_skb[idx]) {
-                kfree_skb(priv->echo_skb[idx]);
+                dev_kfree_skb_any(priv->echo_skb[idx]);
                 priv->echo_skb[idx] = NULL;
         }
 }
diff --git a/drivers/net/can/m_can/Kconfig b/drivers/net/can/m_can/Kconfig
index fca5482c09ac..04f20dd39007 100644
--- a/drivers/net/can/m_can/Kconfig
+++ b/drivers/net/can/m_can/Kconfig
@@ -1,4 +1,5 @@
 config CAN_M_CAN
+        depends on HAS_IOMEM
         tristate "Bosch M_CAN devices"
         ---help---
           Say Y here if you want to support for Bosch M_CAN controller.
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 10d571eaed85..d7bc462aafdc 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -105,14 +105,36 @@ enum m_can_mram_cfg {
         MRAM_CFG_NUM,
 };
 
+/* Fast Bit Timing & Prescaler Register (FBTP) */
+#define FBTR_FBRP_MASK          0x1f
+#define FBTR_FBRP_SHIFT         16
+#define FBTR_FTSEG1_SHIFT       8
+#define FBTR_FTSEG1_MASK        (0xf << FBTR_FTSEG1_SHIFT)
+#define FBTR_FTSEG2_SHIFT       4
+#define FBTR_FTSEG2_MASK        (0x7 << FBTR_FTSEG2_SHIFT)
+#define FBTR_FSJW_SHIFT         0
+#define FBTR_FSJW_MASK          0x3
+
 /* Test Register (TEST) */
 #define TEST_LBCK       BIT(4)
 
 /* CC Control Register(CCCR) */
-#define CCCR_TEST       BIT(7)
-#define CCCR_MON        BIT(5)
-#define CCCR_CCE        BIT(1)
-#define CCCR_INIT       BIT(0)
+#define CCCR_TEST               BIT(7)
+#define CCCR_CMR_MASK           0x3
+#define CCCR_CMR_SHIFT          10
+#define CCCR_CMR_CANFD          0x1
+#define CCCR_CMR_CANFD_BRS      0x2
+#define CCCR_CMR_CAN            0x3
+#define CCCR_CME_MASK           0x3
+#define CCCR_CME_SHIFT          8
+#define CCCR_CME_CAN            0
+#define CCCR_CME_CANFD          0x1
+#define CCCR_CME_CANFD_BRS      0x2
+#define CCCR_TEST               BIT(7)
+#define CCCR_MON                BIT(5)
+#define CCCR_CCE                BIT(1)
+#define CCCR_INIT               BIT(0)
+#define CCCR_CANFD              0x10
 
 /* Bit Timing & Prescaler Register (BTP) */
 #define BTR_BRP_MASK            0x3ff
@@ -204,6 +226,7 @@ enum m_can_mram_cfg {
 
 /* Rx Buffer / FIFO Element Size Configuration (RXESC) */
 #define M_CAN_RXESC_8BYTES      0x0
+#define M_CAN_RXESC_64BYTES     0x777
 
 /* Tx Buffer Configuration(TXBC) */
 #define TXBC_NDTB_OFF           16
@@ -211,6 +234,7 @@ enum m_can_mram_cfg {
 
 /* Tx Buffer Element Size Configuration(TXESC) */
 #define TXESC_TBDS_8BYTES       0x0
+#define TXESC_TBDS_64BYTES      0x7
 
 /* Tx Event FIFO Con.guration (TXEFC) */
 #define TXEFC_EFS_OFF           16
@@ -219,11 +243,11 @@ enum m_can_mram_cfg {
 /* Message RAM Configuration (in bytes) */
 #define SIDF_ELEMENT_SIZE       4
 #define XIDF_ELEMENT_SIZE       8
-#define RXF0_ELEMENT_SIZE       16
-#define RXF1_ELEMENT_SIZE       16
+#define RXF0_ELEMENT_SIZE       72
+#define RXF1_ELEMENT_SIZE       72
 #define RXB_ELEMENT_SIZE        16
 #define TXE_ELEMENT_SIZE        8
-#define TXB_ELEMENT_SIZE        16
+#define TXB_ELEMENT_SIZE        72
 
 /* Message RAM Elements */
 #define M_CAN_FIFO_ID           0x0
@@ -231,11 +255,17 @@ enum m_can_mram_cfg {
 #define M_CAN_FIFO_DATA(n)      (0x8 + ((n) << 2))
 
 /* Rx Buffer Element */
+/* R0 */
 #define RX_BUF_ESI              BIT(31)
 #define RX_BUF_XTD              BIT(30)
 #define RX_BUF_RTR              BIT(29)
+/* R1 */
+#define RX_BUF_ANMF             BIT(31)
+#define RX_BUF_EDL              BIT(21)
+#define RX_BUF_BRS              BIT(20)
 
 /* Tx Buffer Element */
+/* R0 */
 #define TX_BUF_XTD              BIT(30)
 #define TX_BUF_RTR              BIT(29)
 
@@ -296,6 +326,7 @@ static inline void m_can_config_endisable(const struct m_can_priv *priv,
         if (enable) {
                 /* enable m_can configuration */
                 m_can_write(priv, M_CAN_CCCR, cccr | CCCR_INIT);
+                udelay(5);
                 /* CCCR.CCE can only be set/reset while CCCR.INIT = '1' */
                 m_can_write(priv, M_CAN_CCCR, cccr | CCCR_INIT | CCCR_CCE);
         } else {
@@ -326,41 +357,67 @@ static inline void m_can_disable_all_interrupts(const struct m_can_priv *priv)
         m_can_write(priv, M_CAN_ILE, 0x0);
 }
 
-static void m_can_read_fifo(const struct net_device *dev, struct can_frame *cf,
-                            u32 rxfs)
+static void m_can_read_fifo(struct net_device *dev, u32 rxfs)
 {
+        struct net_device_stats *stats = &dev->stats;
         struct m_can_priv *priv = netdev_priv(dev);
-        u32 id, fgi;
+        struct canfd_frame *cf;
+        struct sk_buff *skb;
+        u32 id, fgi, dlc;
+        int i;
 
         /* calculate the fifo get index for where to read data */
         fgi = (rxfs & RXFS_FGI_MASK) >> RXFS_FGI_OFF;
+        dlc = m_can_fifo_read(priv, fgi, M_CAN_FIFO_DLC);
+        if (dlc & RX_BUF_EDL)
+                skb = alloc_canfd_skb(dev, &cf);
+        else
+                skb = alloc_can_skb(dev, (struct can_frame **)&cf);
+        if (!skb) {
+                stats->rx_dropped++;
+                return;
+        }
+
+        if (dlc & RX_BUF_EDL)
+                cf->len = can_dlc2len((dlc >> 16) & 0x0F);
+        else
+                cf->len = get_can_dlc((dlc >> 16) & 0x0F);
+
         id = m_can_fifo_read(priv, fgi, M_CAN_FIFO_ID);
         if (id & RX_BUF_XTD)
                 cf->can_id = (id & CAN_EFF_MASK) | CAN_EFF_FLAG;
         else
                 cf->can_id = (id >> 18) & CAN_SFF_MASK;
 
-        if (id & RX_BUF_RTR) {
+        if (id & RX_BUF_ESI) {
+                cf->flags |= CANFD_ESI;
+                netdev_dbg(dev, "ESI Error\n");
+        }
+
+        if (!(dlc & RX_BUF_EDL) && (id & RX_BUF_RTR)) {
                 cf->can_id |= CAN_RTR_FLAG;
         } else {
-                id = m_can_fifo_read(priv, fgi, M_CAN_FIFO_DLC);
-                cf->can_dlc = get_can_dlc((id >> 16) & 0x0F);
-                *(u32 *)(cf->data + 0) = m_can_fifo_read(priv, fgi,
-                                                         M_CAN_FIFO_DATA(0));
-                *(u32 *)(cf->data + 4) = m_can_fifo_read(priv, fgi,
-                                                         M_CAN_FIFO_DATA(1));
+                if (dlc & RX_BUF_BRS)
+                        cf->flags |= CANFD_BRS;
+
+                for (i = 0; i < cf->len; i += 4)
+                        *(u32 *)(cf->data + i) =
+                                m_can_fifo_read(priv, fgi,
+                                                M_CAN_FIFO_DATA(i / 4));
         }
 
         /* acknowledge rx fifo 0 */
         m_can_write(priv, M_CAN_RXF0A, fgi);
+
+        stats->rx_packets++;
+        stats->rx_bytes += cf->len;
+
+        netif_receive_skb(skb);
 }
 
 static int m_can_do_rx_poll(struct net_device *dev, int quota)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        struct net_device_stats *stats = &dev->stats;
-        struct sk_buff *skb;
-        struct can_frame *frame;
         u32 pkts = 0;
         u32 rxfs;
 
@@ -374,18 +431,7 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota)
                 if (rxfs & RXFS_RFL)
                         netdev_warn(dev, "Rx FIFO 0 Message Lost\n");
 
-                skb = alloc_can_skb(dev, &frame);
-                if (!skb) {
-                        stats->rx_dropped++;
-                        return pkts;
-                }
-
-                m_can_read_fifo(dev, frame, rxfs);
-
-                stats->rx_packets++;
-                stats->rx_bytes += frame->can_dlc;
-
-                netif_receive_skb(skb);
+                m_can_read_fifo(dev, rxfs);
 
                 quota--;
                 pkts++;
@@ -481,11 +527,23 @@ static int m_can_handle_lec_err(struct net_device *dev,
         return 1;
 }
 
+static int __m_can_get_berr_counter(const struct net_device *dev,
+                                    struct can_berr_counter *bec)
+{
+        struct m_can_priv *priv = netdev_priv(dev);
+        unsigned int ecr;
+
+        ecr = m_can_read(priv, M_CAN_ECR);
+        bec->rxerr = (ecr & ECR_REC_MASK) >> ECR_REC_SHIFT;
+        bec->txerr = ecr & ECR_TEC_MASK;
+
+        return 0;
+}
+
 static int m_can_get_berr_counter(const struct net_device *dev,
                                   struct can_berr_counter *bec)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        unsigned int ecr;
         int err;
 
         err = clk_prepare_enable(priv->hclk);
@@ -498,9 +556,7 @@ static int m_can_get_berr_counter(const struct net_device *dev,
                 return err;
         }
 
-        ecr = m_can_read(priv, M_CAN_ECR);
-        bec->rxerr = (ecr & ECR_REC_MASK) >> ECR_REC_SHIFT;
-        bec->txerr = ecr & ECR_TEC_MASK;
+        __m_can_get_berr_counter(dev, bec);
 
         clk_disable_unprepare(priv->cclk);
         clk_disable_unprepare(priv->hclk);
@@ -544,7 +600,7 @@ static int m_can_handle_state_change(struct net_device *dev,
         if (unlikely(!skb))
                 return 0;
 
-        m_can_get_berr_counter(dev, &bec);
+        __m_can_get_berr_counter(dev, &bec);
 
         switch (new_state) {
         case CAN_STATE_ERROR_ACTIVE:
@@ -596,14 +652,14 @@ static int m_can_handle_state_errors(struct net_device *dev, u32 psr)
 
         if ((psr & PSR_EP) &&
             (priv->can.state != CAN_STATE_ERROR_PASSIVE)) {
-                netdev_dbg(dev, "entered error warning state\n");
+                netdev_dbg(dev, "entered error passive state\n");
                 work_done += m_can_handle_state_change(dev,
                                                        CAN_STATE_ERROR_PASSIVE);
         }
 
         if ((psr & PSR_BO) &&
             (priv->can.state != CAN_STATE_BUS_OFF)) {
-                netdev_dbg(dev, "entered error warning state\n");
+                netdev_dbg(dev, "entered error bus off state\n");
                 work_done += m_can_handle_state_change(dev,
                                                        CAN_STATE_BUS_OFF);
         }
@@ -615,7 +671,7 @@ static void m_can_handle_other_err(struct net_device *dev, u32 irqstatus)
 {
         if (irqstatus & IR_WDI)
                 netdev_err(dev, "Message RAM Watchdog event due to missing READY\n");
-        if (irqstatus & IR_BEU)
+        if (irqstatus & IR_ELO)
                 netdev_err(dev, "Error Logging Overflow\n");
         if (irqstatus & IR_BEU)
                 netdev_err(dev, "Bit Error Uncorrected\n");
@@ -733,10 +789,23 @@ static const struct can_bittiming_const m_can_bittiming_const = {
         .brp_inc = 1,
 };
 
+static const struct can_bittiming_const m_can_data_bittiming_const = {
+        .name = KBUILD_MODNAME,
+        .tseg1_min = 2,         /* Time segment 1 = prop_seg + phase_seg1 */
+        .tseg1_max = 16,
+        .tseg2_min = 1,         /* Time segment 2 = phase_seg2 */
+        .tseg2_max = 8,
+        .sjw_max = 4,
+        .brp_min = 1,
+        .brp_max = 32,
+        .brp_inc = 1,
+};
+
 static int m_can_set_bittiming(struct net_device *dev)
 {
         struct m_can_priv *priv = netdev_priv(dev);
         const struct can_bittiming *bt = &priv->can.bittiming;
+        const struct can_bittiming *dbt = &priv->can.data_bittiming;
         u16 brp, sjw, tseg1, tseg2;
         u32 reg_btp;
 
@@ -747,7 +816,17 @@ static int m_can_set_bittiming(struct net_device *dev)
         reg_btp = (brp << BTR_BRP_SHIFT) | (sjw << BTR_SJW_SHIFT) |
                         (tseg1 << BTR_TSEG1_SHIFT) | (tseg2 << BTR_TSEG2_SHIFT);
         m_can_write(priv, M_CAN_BTP, reg_btp);
-        netdev_dbg(dev, "setting BTP 0x%x\n", reg_btp);
+
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {
+                brp = dbt->brp - 1;
+                sjw = dbt->sjw - 1;
+                tseg1 = dbt->prop_seg + dbt->phase_seg1 - 1;
+                tseg2 = dbt->phase_seg2 - 1;
+                reg_btp = (brp << FBTR_FBRP_SHIFT) | (sjw << FBTR_FSJW_SHIFT) |
+                                (tseg1 << FBTR_FTSEG1_SHIFT) |
+                                (tseg2 << FBTR_FTSEG2_SHIFT);
+                m_can_write(priv, M_CAN_FBTP, reg_btp);
+        }
 
         return 0;
 }
@@ -767,8 +846,8 @@ static void m_can_chip_config(struct net_device *dev)
 
         m_can_config_endisable(priv, true);
 
-        /* RX Buffer/FIFO Element Size 8 bytes data field */
-        m_can_write(priv, M_CAN_RXESC, M_CAN_RXESC_8BYTES);
+        /* RX Buffer/FIFO Element Size 64 bytes data field */
+        m_can_write(priv, M_CAN_RXESC, M_CAN_RXESC_64BYTES);
 
         /* Accept Non-matching Frames Into FIFO 0 */
         m_can_write(priv, M_CAN_GFC, 0x0);
@@ -777,8 +856,8 @@ static void m_can_chip_config(struct net_device *dev)
         m_can_write(priv, M_CAN_TXBC, (1 << TXBC_NDTB_OFF) |
                     priv->mcfg[MRAM_TXB].off);
 
-        /* only support 8 bytes firstly */
-        m_can_write(priv, M_CAN_TXESC, TXESC_TBDS_8BYTES);
+        /* support 64 bytes payload */
+        m_can_write(priv, M_CAN_TXESC, TXESC_TBDS_64BYTES);
 
         m_can_write(priv, M_CAN_TXEFC, (1 << TXEFC_EFS_OFF) |
                     priv->mcfg[MRAM_TXE].off);
@@ -793,7 +872,8 @@ static void m_can_chip_config(struct net_device *dev)
                     RXFC_FWM_1 | priv->mcfg[MRAM_RXF1].off);
 
         cccr = m_can_read(priv, M_CAN_CCCR);
-        cccr &= ~(CCCR_TEST | CCCR_MON);
+        cccr &= ~(CCCR_TEST | CCCR_MON | (CCCR_CMR_MASK << CCCR_CMR_SHIFT) |
+                (CCCR_CME_MASK << CCCR_CME_SHIFT));
         test = m_can_read(priv, M_CAN_TEST);
         test &= ~TEST_LBCK;
 
@@ -805,6 +885,9 @@ static void m_can_chip_config(struct net_device *dev)
                 test |= TEST_LBCK;
         }
 
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD)
+                cccr |= CCCR_CME_CANFD_BRS << CCCR_CME_SHIFT;
+
         m_can_write(priv, M_CAN_CCCR, cccr);
         m_can_write(priv, M_CAN_TEST, test);
 
@@ -869,11 +952,13 @@ static struct net_device *alloc_m_can_dev(void)
 
         priv->dev = dev;
         priv->can.bittiming_const = &m_can_bittiming_const;
+        priv->can.data_bittiming_const = &m_can_data_bittiming_const;
         priv->can.do_set_mode = m_can_set_mode;
         priv->can.do_get_berr_counter = m_can_get_berr_counter;
         priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK |
                                         CAN_CTRLMODE_LISTENONLY |
-                                        CAN_CTRLMODE_BERR_REPORTING;
+                                        CAN_CTRLMODE_BERR_REPORTING |
+                                        CAN_CTRLMODE_FD;
 
         return dev;
 }
@@ -956,8 +1041,9 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,
                                     struct net_device *dev)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        struct can_frame *cf = (struct can_frame *)skb->data;
-        u32 id;
+        struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+        u32 id, cccr;
+        int i;
 
         if (can_dropped_invalid_skb(dev, skb))
                 return NETDEV_TX_OK;
@@ -976,11 +1062,28 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,
 
         /* message ram configuration */
         m_can_fifo_write(priv, 0, M_CAN_FIFO_ID, id);
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DLC, cf->can_dlc << 16);
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(0), *(u32 *)(cf->data + 0));
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(1), *(u32 *)(cf->data + 4));
+        m_can_fifo_write(priv, 0, M_CAN_FIFO_DLC, can_len2dlc(cf->len) << 16);
+
+        for (i = 0; i < cf->len; i += 4)
+                m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(i / 4),
+                                 *(u32 *)(cf->data + i));
+
         can_put_echo_skb(skb, dev, 0);
 
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {
+                cccr = m_can_read(priv, M_CAN_CCCR);
+                cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT);
+                if (can_is_canfd_skb(skb)) {
+                        if (cf->flags & CANFD_BRS)
+                                cccr |= CCCR_CMR_CANFD_BRS << CCCR_CMR_SHIFT;
+                        else
+                                cccr |= CCCR_CMR_CANFD << CCCR_CMR_SHIFT;
+                } else {
+                        cccr |= CCCR_CMR_CAN << CCCR_CMR_SHIFT;
+                }
+                m_can_write(priv, M_CAN_CCCR, cccr);
+        }
+
         /* enable first TX buffer to start transfer  */
         m_can_write(priv, M_CAN_TXBTIE, 0x1);
         m_can_write(priv, M_CAN_TXBAR, 0x1);
@@ -992,6 +1095,7 @@ static const struct net_device_ops m_can_netdev_ops = {
         .ndo_open = m_can_open,
         .ndo_stop = m_can_close,
         .ndo_start_xmit = m_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static int register_m_can_dev(struct net_device *dev)
@@ -1009,7 +1113,7 @@ static int m_can_of_parse_mram(struct platform_device *pdev,
         struct resource *res;
         void __iomem *addr;
         u32 out_val[MRAM_CFG_LEN];
-        int ret;
+        int i, start, end, ret;
 
         /* message ram could be shared */
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "message_ram");
@@ -1060,6 +1164,15 @@ static int m_can_of_parse_mram(struct platform_device *pdev,
                 priv->mcfg[MRAM_TXE].off, priv->mcfg[MRAM_TXE].num,
                 priv->mcfg[MRAM_TXB].off, priv->mcfg[MRAM_TXB].num);
 
+        /* initialize the entire Message RAM in use to avoid possible
+         * ECC/parity checksum errors when reading an uninitialized buffer
+         */
+        start = priv->mcfg[MRAM_SIDF].off;
+        end = priv->mcfg[MRAM_TXB].off +
+                priv->mcfg[MRAM_TXB].num * TXB_ELEMENT_SIZE;
+        for (i = start; i < end; i += 4)
+                writel(0x0, priv->mram_base + i);
+
         return 0;
 }
 
diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
index 1abe133d1594..9718248e55f1 100644
--- a/drivers/net/can/rcar_can.c
+++ b/drivers/net/can/rcar_can.c
@@ -628,6 +628,7 @@ static const struct net_device_ops rcar_can_netdev_ops = {
         .ndo_open = rcar_can_open,
         .ndo_stop = rcar_can_close,
         .ndo_start_xmit = rcar_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static void rcar_can_rx_pkt(struct rcar_can_priv *priv)
diff --git a/drivers/net/can/sja1000/kvaser_pci.c b/drivers/net/can/sja1000/kvaser_pci.c
index 8ff3424d5147..15c00faeec61 100644
--- a/drivers/net/can/sja1000/kvaser_pci.c
+++ b/drivers/net/can/sja1000/kvaser_pci.c
@@ -214,7 +214,7 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         struct net_device *dev;
         struct sja1000_priv *priv;
         struct kvaser_pci *board;
-        int err, init_step;
+        int err;
 
         dev = alloc_sja1000dev(sizeof(struct kvaser_pci));
         if (dev == NULL)
@@ -235,7 +235,6 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         if (channel == 0) {
                 board->xilinx_ver =
                         ioread8(board->res_addr + XILINX_VERINT) >> 4;
-                init_step = 2;
 
                 /* Assert PTADR# - we're in passive mode so the other bits are
                    not important */
@@ -264,8 +263,6 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         priv->irq_flags = IRQF_SHARED;
         dev->irq = pdev->irq;
 
-        init_step = 4;
-
         dev_info(&pdev->dev, "reg_base=%p conf_addr=%p irq=%d\n",
                  priv->reg_base, board->conf_addr, dev->irq);
 
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 00f2534dde73..29d3f0938eb8 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -434,10 +434,9 @@ static void ems_usb_read_bulk_callback(struct urb *urb)
         if (urb->actual_length > CPC_HEADER_SIZE) {
                 struct ems_cpc_msg *msg;
                 u8 *ibuf = urb->transfer_buffer;
-                u8 msg_count, again, start;
+                u8 msg_count, start;
 
                 msg_count = ibuf[0] & ~0x80;
-                again = ibuf[0] & 0x80;
 
                 start = CPC_HEADER_SIZE;
 
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index b7c9e8b11460..c063a54ab8dd 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -464,7 +464,6 @@ static void esd_usb2_write_bulk_callback(struct urb *urb)
 {
         struct esd_tx_urb_context *context = urb->context;
         struct esd_usb2_net_priv *priv;
-        struct esd_usb2 *dev;
         struct net_device *netdev;
         size_t size = sizeof(struct esd_usb2_msg);
 
@@ -472,7 +471,6 @@ static void esd_usb2_write_bulk_callback(struct urb *urb)
 
         priv = context->priv;
         netdev = priv->netdev;
-        dev = priv->usb2;
 
         /* free up our allocated buffer */
         usb_free_coherent(urb->dev, size,
@@ -1143,6 +1141,7 @@ static void esd_usb2_disconnect(struct usb_interface *intf)
                         }
                 }
                 unlink_all_urbs(dev);
+                kfree(dev);
         }
 }
 
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 04b0f84612f0..009acc8641fc 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -718,6 +718,7 @@ static const struct net_device_ops gs_usb_netdev_ops = {
         .ndo_open = gs_can_open,
         .ndo_stop = gs_can_close,
         .ndo_start_xmit = gs_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static struct gs_can *gs_make_candev(unsigned int channel, struct usb_interface *intf)
diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
index 5e8b5609c067..8a998e3884ce 100644
--- a/drivers/net/can/xilinx_can.c
+++ b/drivers/net/can/xilinx_can.c
@@ -300,7 +300,8 @@ static int xcan_set_bittiming(struct net_device *ndev)
 static int xcan_chip_start(struct net_device *ndev)
 {
         struct xcan_priv *priv = netdev_priv(ndev);
-        u32 err, reg_msr, reg_sr_mask;
+        u32 reg_msr, reg_sr_mask;
+        int err;
         unsigned long timeout;
 
         /* Check if it is in reset mode */
@@ -961,6 +962,7 @@ static const struct net_device_ops xcan_netdev_ops = {
         .ndo_open       = xcan_open,
         .ndo_stop       = xcan_close,
         .ndo_start_xmit = xcan_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 /**
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index b9625968daac..4f4c2a7888e5 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -377,6 +377,29 @@ static irqreturn_t bcm_sf2_switch_1_isr(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
+static int bcm_sf2_sw_rst(struct bcm_sf2_priv *priv)
+{
+        unsigned int timeout = 1000;
+        u32 reg;
+
+        reg = core_readl(priv, CORE_WATCHDOG_CTRL);
+        reg |= SOFTWARE_RESET | EN_CHIP_RST | EN_SW_RESET;
+        core_writel(priv, reg, CORE_WATCHDOG_CTRL);
+
+        do {
+                reg = core_readl(priv, CORE_WATCHDOG_CTRL);
+                if (!(reg & SOFTWARE_RESET))
+                        break;
+
+                usleep_range(1000, 2000);
+        } while (timeout-- > 0);
+
+        if (timeout == 0)
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
 static int bcm_sf2_sw_setup(struct dsa_switch *ds)
 {
         const char *reg_names[BCM_SF2_REGS_NUM] = BCM_SF2_REGS_NAME;
@@ -404,11 +427,18 @@ static int bcm_sf2_sw_setup(struct dsa_switch *ds)
                 *base = of_iomap(dn, i);
                 if (*base == NULL) {
                         pr_err("unable to find register: %s\n", reg_names[i]);
-                        return -ENODEV;
+                        ret = -ENOMEM;
+                        goto out_unmap;
                 }
                 base++;
         }
 
+        ret = bcm_sf2_sw_rst(priv);
+        if (ret) {
+                pr_err("unable to software reset switch: %d\n", ret);
+                goto out_unmap;
+        }
+
         /* Disable all interrupts and request them */
         intrl2_0_writel(priv, 0xffffffff, INTRL2_CPU_MASK_SET);
         intrl2_0_writel(priv, 0xffffffff, INTRL2_CPU_CLEAR);
@@ -484,7 +514,8 @@ out_free_irq0:
 out_unmap:
         base = &priv->core;
         for (i = 0; i < BCM_SF2_REGS_NUM; i++) {
-                iounmap(*base);
+                if (*base)
+                        iounmap(*base);
                 base++;
         }
         return ret;
@@ -733,29 +764,6 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds)
         return 0;
 }
 
-static int bcm_sf2_sw_rst(struct bcm_sf2_priv *priv)
-{
-        unsigned int timeout = 1000;
-        u32 reg;
-
-        reg = core_readl(priv, CORE_WATCHDOG_CTRL);
-        reg |= SOFTWARE_RESET | EN_CHIP_RST | EN_SW_RESET;
-        core_writel(priv, reg, CORE_WATCHDOG_CTRL);
-
-        do {
-                reg = core_readl(priv, CORE_WATCHDOG_CTRL);
-                if (!(reg & SOFTWARE_RESET))
-                        break;
-
-                usleep_range(1000, 2000);
-        } while (timeout-- > 0);
-
-        if (timeout == 0)
-                return -ETIMEDOUT;
-
-        return 0;
-}
-
 static int bcm_sf2_sw_resume(struct dsa_switch *ds)
 {
         struct bcm_sf2_priv *priv = ds_to_priv(ds);
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index 63ea1941e973..7ba83ffb08ac 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -575,10 +575,24 @@ static void xgene_gmac_tx_disable(struct xgene_enet_pdata *pdata)
         xgene_enet_wr_mcx_mac(pdata, MAC_CONFIG_1_ADDR, data & ~TX_EN);
 }
 
-static void xgene_enet_reset(struct xgene_enet_pdata *pdata)
+bool xgene_ring_mgr_init(struct xgene_enet_pdata *p)
+{
+        if (!ioread32(p->ring_csr_addr + CLKEN_ADDR))
+                return false;
+
+        if (ioread32(p->ring_csr_addr + SRST_ADDR))
+                return false;
+
+        return true;
+}
+
+static int xgene_enet_reset(struct xgene_enet_pdata *pdata)
 {
         u32 val;
 
+        if (!xgene_ring_mgr_init(pdata))
+                return -ENODEV;
+
         clk_prepare_enable(pdata->clk);
         clk_disable_unprepare(pdata->clk);
         clk_prepare_enable(pdata->clk);
@@ -590,6 +604,8 @@ static void xgene_enet_reset(struct xgene_enet_pdata *pdata)
         val |= SCAN_AUTO_INCR;
         MGMT_CLOCK_SEL_SET(&val, 1);
         xgene_enet_wr_mcx_mac(pdata, MII_MGMT_CONFIG_ADDR, val);
+
+        return 0;
 }
 
 static void xgene_gport_shutdown(struct xgene_enet_pdata *pdata)
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
index 38558584080e..ec45f3256f0e 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
@@ -104,6 +104,9 @@ enum xgene_enet_rm {
 #define BLOCK_ETH_MAC_OFFSET            0x0000
 #define BLOCK_ETH_MAC_CSR_OFFSET        0x2800
 
+#define CLKEN_ADDR                      0xc208
+#define SRST_ADDR                       0xc200
+
 #define MAC_ADDR_REG_OFFSET             0x00
 #define MAC_COMMAND_REG_OFFSET          0x04
 #define MAC_WRITE_REG_OFFSET            0x08
@@ -318,6 +321,7 @@ void xgene_enet_parse_error(struct xgene_enet_desc_ring *ring,
 
 int xgene_enet_mdio_config(struct xgene_enet_pdata *pdata);
 void xgene_enet_mdio_remove(struct xgene_enet_pdata *pdata);
+bool xgene_ring_mgr_init(struct xgene_enet_pdata *p);
 
 extern struct xgene_mac_ops xgene_gmac_ops;
 extern struct xgene_port_ops xgene_gport_ops;
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 3c208cc6f6bb..123669696184 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -639,9 +639,9 @@ static int xgene_enet_create_desc_rings(struct net_device *ndev)
         struct device *dev = ndev_to_dev(ndev);
         struct xgene_enet_desc_ring *rx_ring, *tx_ring, *cp_ring;
         struct xgene_enet_desc_ring *buf_pool = NULL;
-        u8 cpu_bufnum = 0, eth_bufnum = 0;
-        u8 bp_bufnum = 0x20;
-        u16 ring_id, ring_num = 0;
+        u8 cpu_bufnum = 0, eth_bufnum = START_ETH_BUFNUM;
+        u8 bp_bufnum = START_BP_BUFNUM;
+        u16 ring_id, ring_num = START_RING_NUM;
         int ret;
 
         /* allocate rx descriptor ring */
@@ -852,7 +852,9 @@ static int xgene_enet_init_hw(struct xgene_enet_pdata *pdata)
         u16 dst_ring_num;
         int ret;
 
-        pdata->port_ops->reset(pdata);
+        ret = pdata->port_ops->reset(pdata);
+        if (ret)
+                return ret;
 
         ret = xgene_enet_create_desc_rings(ndev);
         if (ret) {
@@ -954,6 +956,7 @@ static int xgene_enet_probe(struct platform_device *pdev)
 
         return ret;
 err:
+        unregister_netdev(ndev);
         free_netdev(ndev);
         return ret;
 }
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.h b/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
index 874e5a01161f..f9958fae6ffd 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
@@ -38,6 +38,9 @@
 #define SKB_BUFFER_SIZE         (XGENE_ENET_MAX_MTU - NET_IP_ALIGN)
 #define NUM_PKT_BUF     64
 #define NUM_BUFPOOL     32
+#define START_ETH_BUFNUM        2
+#define START_BP_BUFNUM         0x22
+#define START_RING_NUM          8
 
 #define PHY_POLL_LINK_ON        (10 * HZ)
 #define PHY_POLL_LINK_OFF       (PHY_POLL_LINK_ON / 5)
@@ -83,7 +86,7 @@ struct xgene_mac_ops {
 };
 
 struct xgene_port_ops {
-        void (*reset)(struct xgene_enet_pdata *pdata);
+        int (*reset)(struct xgene_enet_pdata *pdata);
         void (*cle_bypass)(struct xgene_enet_pdata *pdata,
                            u32 dst_ring_num, u16 bufpool_id);
         void (*shutdown)(struct xgene_enet_pdata *pdata);
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c b/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
index c22f32622fa9..f5d4f68c288c 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
@@ -311,14 +311,19 @@ static void xgene_sgmac_tx_disable(struct xgene_enet_pdata *p)
         xgene_sgmac_rxtx(p, TX_EN, false);
 }
 
-static void xgene_enet_reset(struct xgene_enet_pdata *p)
+static int xgene_enet_reset(struct xgene_enet_pdata *p)
 {
+        if (!xgene_ring_mgr_init(p))
+                return -ENODEV;
+
         clk_prepare_enable(p->clk);
         clk_disable_unprepare(p->clk);
         clk_prepare_enable(p->clk);
 
         xgene_enet_ecc_init(p);
         xgene_enet_config_ring_if_assoc(p);
+
+        return 0;
 }
 
 static void xgene_enet_cle_bypass(struct xgene_enet_pdata *p,
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c b/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c
index 67d07206b3c7..a18a9d1f1143 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c
@@ -252,14 +252,19 @@ static void xgene_xgmac_tx_disable(struct xgene_enet_pdata *pdata)
         xgene_enet_wr_mac(pdata, AXGMAC_CONFIG_1, data & ~HSTTFEN);
 }
 
-static void xgene_enet_reset(struct xgene_enet_pdata *pdata)
+static int xgene_enet_reset(struct xgene_enet_pdata *pdata)
 {
+        if (!xgene_ring_mgr_init(pdata))
+                return -ENODEV;
+
         clk_prepare_enable(pdata->clk);
         clk_disable_unprepare(pdata->clk);
         clk_prepare_enable(pdata->clk);
 
         xgene_enet_ecc_init(pdata);
         xgene_enet_config_ring_if_assoc(pdata);
+
+        return 0;
 }
 
 static void xgene_enet_xgcle_bypass(struct xgene_enet_pdata *pdata,
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 3a6778a667f4..531bb7c57531 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1110,7 +1110,8 @@ static int bcm_sysport_init_tx_ring(struct bcm_sysport_priv *priv,
         /* We just need one DMA descriptor which is DMA-able, since writing to
          * the port will allocate a new descriptor in its internal linked-list
          */
-        p = dma_zalloc_coherent(kdev, 1, &ring->desc_dma, GFP_KERNEL);
+        p = dma_zalloc_coherent(kdev, sizeof(struct dma_desc), &ring->desc_dma,
+                                GFP_KERNEL);
         if (!p) {
                 netif_err(priv, hw, priv->netdev, "DMA alloc failed\n");
                 return -ENOMEM;
@@ -1174,6 +1175,13 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv,
         if (!(reg & TDMA_DISABLED))
                 netdev_warn(priv->netdev, "TDMA not stopped!\n");
 
+        /* ring->cbs is the last part in bcm_sysport_init_tx_ring which could
+         * fail, so by checking this pointer we know whether the TX ring was
+         * fully initialized or not.
+         */
+        if (!ring->cbs)
+                return;
+
         napi_disable(&ring->napi);
         netif_napi_del(&ring->napi);
 
@@ -1183,7 +1191,8 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv,
         ring->cbs = NULL;
 
         if (ring->desc_dma) {
-                dma_free_coherent(kdev, 1, ring->desc_cpu, ring->desc_dma);
+                dma_free_coherent(kdev, sizeof(struct dma_desc),
+                                  ring->desc_cpu, ring->desc_dma);
                 ring->desc_dma = 0;
         }
         ring->size = 0;
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index fdc9ec09e453..da1a2500c91c 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2140,6 +2140,12 @@ static int bcmgenet_open(struct net_device *dev)
                 goto err_irq0;
         }
 
+        /* Re-configure the port multiplexer towards the PHY device */
+        bcmgenet_mii_config(priv->dev, false);
+
+        phy_connect_direct(dev, priv->phydev, bcmgenet_mii_setup,
+                           priv->phy_interface);
+
         bcmgenet_netif_start(dev);
 
         return 0;
@@ -2184,6 +2190,9 @@ static int bcmgenet_close(struct net_device *dev)
 
         bcmgenet_netif_stop(dev);
 
+        /* Really kill the PHY state machine and disconnect from it */
+        phy_disconnect(priv->phydev);
+
         /* Disable MAC receive */
         umac_enable_set(priv, CMD_RX_EN, false);
 
@@ -2685,7 +2694,7 @@ static int bcmgenet_resume(struct device *d)
 
         phy_init_hw(priv->phydev);
         /* Speed settings must be restored */
-        bcmgenet_mii_config(priv->dev);
+        bcmgenet_mii_config(priv->dev, false);
 
         /* disable ethernet MAC while updating its registers */
         umac_enable_set(priv, CMD_TX_EN | CMD_RX_EN, false);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index dbf524ea3b19..31b2da5f9b82 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -617,9 +617,10 @@ GENET_IO_MACRO(rbuf, GENET_RBUF_OFF);
 
 /* MDIO routines */
 int bcmgenet_mii_init(struct net_device *dev);
-int bcmgenet_mii_config(struct net_device *dev);
+int bcmgenet_mii_config(struct net_device *dev, bool init);
 void bcmgenet_mii_exit(struct net_device *dev);
 void bcmgenet_mii_reset(struct net_device *dev);
+void bcmgenet_mii_setup(struct net_device *dev);
 
 /* Wake-on-LAN routines */
 void bcmgenet_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 9ff799a9f801..933cd7e7cd33 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -77,7 +77,7 @@ static int bcmgenet_mii_write(struct mii_bus *bus, int phy_id,
 /* setup netdev link state when PHY link status change and
  * update UMAC and RGMII block when link up
  */
-static void bcmgenet_mii_setup(struct net_device *dev)
+void bcmgenet_mii_setup(struct net_device *dev)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
         struct phy_device *phydev = priv->phydev;
@@ -211,7 +211,7 @@ static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)
         bcmgenet_sys_writel(priv, reg, SYS_PORT_CTRL);
 }
 
-int bcmgenet_mii_config(struct net_device *dev)
+int bcmgenet_mii_config(struct net_device *dev, bool init)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
         struct phy_device *phydev = priv->phydev;
@@ -298,7 +298,8 @@ int bcmgenet_mii_config(struct net_device *dev)
                 return -EINVAL;
         }
 
-        dev_info(kdev, "configuring instance for %s\n", phy_name);
+        if (init)
+                dev_info(kdev, "configuring instance for %s\n", phy_name);
 
         return 0;
 }
@@ -350,7 +351,7 @@ static int bcmgenet_mii_probe(struct net_device *dev)
          * PHY speed which is needed for bcmgenet_mii_config() to configure
          * things appropriately.
          */
-        ret = bcmgenet_mii_config(dev);
+        ret = bcmgenet_mii_config(dev, true);
         if (ret) {
                 phy_disconnect(priv->phydev);
                 return ret;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index dbb41c1923e6..77f8f836cbbe 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -8563,7 +8563,8 @@ static int tg3_init_rings(struct tg3 *tp)
                 if (tnapi->rx_rcb)
                         memset(tnapi->rx_rcb, 0, TG3_RX_RCB_RING_BYTES(tp));
 
-                if (tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
+                if (tnapi->prodring.rx_std &&
+                    tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
                         tg3_free_rings(tp);
                         return -ENOMEM;
                 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
index 6fe300e316c3..4fe33606f372 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
@@ -79,8 +79,9 @@ static void cxgb4_dcb_cleanup_apps(struct net_device *dev)
                 app.protocol = dcb->app_priority[i].protocolid;
 
                 if (dcb->dcb_version == FW_PORT_DCB_VER_IEEE) {
+                        app.priority = dcb->app_priority[i].user_prio_map;
                         app.selector = dcb->app_priority[i].sel_field + 1;
-                        err = dcb_ieee_setapp(dev, &app);
+                        err = dcb_ieee_delapp(dev, &app);
                 } else {
                         app.selector = !!(dcb->app_priority[i].sel_field);
                         err = dcb_setapp(dev, &app);
@@ -122,7 +123,11 @@ void cxgb4_dcb_state_fsm(struct net_device *dev,
                 case CXGB4_DCB_INPUT_FW_ENABLED: {
                         /* we're going to use Firmware DCB */
                         dcb->state = CXGB4_DCB_STATE_FW_INCOMPLETE;
-                        dcb->supported = CXGB4_DCBX_FW_SUPPORT;
+                        dcb->supported = DCB_CAP_DCBX_LLD_MANAGED;
+                        if (dcb->dcb_version == FW_PORT_DCB_VER_IEEE)
+                                dcb->supported |= DCB_CAP_DCBX_VER_IEEE;
+                        else
+                                dcb->supported |= DCB_CAP_DCBX_VER_CEE;
                         break;
                 }
 
@@ -436,14 +441,17 @@ static void cxgb4_getpgtccfg(struct net_device *dev, int tc,
         *up_tc_map = (1 << tc);
 
         /* prio_type is link strict */
-        *prio_type = 0x2;
+        if (*pgid != 0xF)
+                *prio_type = 0x2;
 }
 
 static void cxgb4_getpgtccfg_tx(struct net_device *dev, int tc,
                                 u8 *prio_type, u8 *pgid, u8 *bw_per,
                                 u8 *up_tc_map)
 {
-        return cxgb4_getpgtccfg(dev, tc, prio_type, pgid, bw_per, up_tc_map, 1);
+        /* tc 0 is written at MSB position */
+        return cxgb4_getpgtccfg(dev, (7 - tc), prio_type, pgid, bw_per,
+                                up_tc_map, 1);
 }
 
 
@@ -451,7 +459,9 @@ static void cxgb4_getpgtccfg_rx(struct net_device *dev, int tc,
                                 u8 *prio_type, u8 *pgid, u8 *bw_per,
                                 u8 *up_tc_map)
 {
-        return cxgb4_getpgtccfg(dev, tc, prio_type, pgid, bw_per, up_tc_map, 0);
+        /* tc 0 is written at MSB position */
+        return cxgb4_getpgtccfg(dev, (7 - tc), prio_type, pgid, bw_per,
+                                up_tc_map, 0);
 }
 
 static void cxgb4_setpgtccfg_tx(struct net_device *dev, int tc,
@@ -461,6 +471,7 @@ static void cxgb4_setpgtccfg_tx(struct net_device *dev, int tc,
         struct fw_port_cmd pcmd;
         struct port_info *pi = netdev2pinfo(dev);
         struct adapter *adap = pi->adapter;
+        int fw_tc = 7 - tc;
         u32 _pgid;
         int err;
 
@@ -479,8 +490,8 @@ static void cxgb4_setpgtccfg_tx(struct net_device *dev, int tc,
         }
 
         _pgid = be32_to_cpu(pcmd.u.dcb.pgid.pgid);
-        _pgid &= ~(0xF << (tc * 4));
-        _pgid |= pgid << (tc * 4);
+        _pgid &= ~(0xF << (fw_tc * 4));
+        _pgid |= pgid << (fw_tc * 4);
         pcmd.u.dcb.pgid.pgid = cpu_to_be32(_pgid);
 
         INIT_PORT_DCB_WRITE_CMD(pcmd, pi->port_id);
@@ -593,7 +604,7 @@ static void cxgb4_getpfccfg(struct net_device *dev, int priority, u8 *pfccfg)
             priority >= CXGB4_MAX_PRIORITY)
                 *pfccfg = 0;
         else
-                *pfccfg = (pi->dcb.pfcen >> priority) & 1;
+                *pfccfg = (pi->dcb.pfcen >> (7 - priority)) & 1;
 }
 
 /* Enable/disable Priority Pause Frames for the specified Traffic Class
@@ -618,9 +629,9 @@ static void cxgb4_setpfccfg(struct net_device *dev, int priority, u8 pfccfg)
         pcmd.u.dcb.pfc.pfcen = pi->dcb.pfcen;
 
         if (pfccfg)
-                pcmd.u.dcb.pfc.pfcen |= (1 << priority);
+                pcmd.u.dcb.pfc.pfcen |= (1 << (7 - priority));
         else
-                pcmd.u.dcb.pfc.pfcen &= (~(1 << priority));
+                pcmd.u.dcb.pfc.pfcen &= (~(1 << (7 - priority)));
 
         err = t4_wr_mbox(adap, adap->mbox, &pcmd, sizeof(pcmd), &pcmd);
         if (err != FW_PORT_DCB_CFG_SUCCESS) {
@@ -1071,7 +1082,7 @@ static int cxgb4_cee_peer_getpg(struct net_device *dev, struct cee_pg *pg)
         pgid = be32_to_cpu(pcmd.u.dcb.pgid.pgid);
 
         for (i = 0; i < CXGB4_MAX_PRIORITY; i++)
-                pg->prio_pg[i] = (pgid >> (i * 4)) & 0xF;
+                pg->prio_pg[7 - i] = (pgid >> (i * 4)) & 0xF;
 
         INIT_PORT_DCB_READ_PEER_CMD(pcmd, pi->port_id);
         pcmd.u.dcb.pgrate.type = FW_PORT_DCB_TYPE_PGRATE;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 5e1b314e11af..39f2b13e66c7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2914,7 +2914,8 @@ static int t4_sge_init_hard(struct adapter *adap)
 int t4_sge_init(struct adapter *adap)
 {
         struct sge *s = &adap->sge;
-        u32 sge_control, sge_conm_ctrl;
+        u32 sge_control, sge_control2, sge_conm_ctrl;
+        unsigned int ingpadboundary, ingpackboundary;
         int ret, egress_threshold;
 
         /*
@@ -2924,8 +2925,31 @@ int t4_sge_init(struct adapter *adap)
         sge_control = t4_read_reg(adap, SGE_CONTROL);
         s->pktshift = PKTSHIFT_GET(sge_control);
         s->stat_len = (sge_control & EGRSTATUSPAGESIZE_MASK) ? 128 : 64;
-        s->fl_align = 1 << (INGPADBOUNDARY_GET(sge_control) +
-                            X_INGPADBOUNDARY_SHIFT);
+
+        /* T4 uses a single control field to specify both the PCIe Padding and
+         * Packing Boundary.  T5 introduced the ability to specify these
+         * separately.  The actual Ingress Packet Data alignment boundary
+         * within Packed Buffer Mode is the maximum of these two
+         * specifications.
+         */
+        ingpadboundary = 1 << (INGPADBOUNDARY_GET(sge_control) +
+                               X_INGPADBOUNDARY_SHIFT);
+        if (is_t4(adap->params.chip)) {
+                s->fl_align = ingpadboundary;
+        } else {
+                /* T5 has a different interpretation of one of the PCIe Packing
+                 * Boundary values.
+                 */
+                sge_control2 = t4_read_reg(adap, SGE_CONTROL2_A);
+                ingpackboundary = INGPACKBOUNDARY_G(sge_control2);
+                if (ingpackboundary == INGPACKBOUNDARY_16B_X)
+                        ingpackboundary = 16;
+                else
+                        ingpackboundary = 1 << (ingpackboundary +
+                                                INGPACKBOUNDARY_SHIFT_X);
+
+                s->fl_align = max(ingpadboundary, ingpackboundary);
+        }
 
         if (adap->flags & USING_SOFT_PARAMS)
                 ret = t4_sge_init_soft(adap);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index a9d9d74e4f09..163a2a14948c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3129,12 +3129,51 @@ int t4_fixup_host_params(struct adapter *adap, unsigned int page_size,
                      HOSTPAGESIZEPF6(sge_hps) |
                      HOSTPAGESIZEPF7(sge_hps));
 
-        t4_set_reg_field(adap, SGE_CONTROL,
-                         INGPADBOUNDARY_MASK |
-                         EGRSTATUSPAGESIZE_MASK,
-                         INGPADBOUNDARY(fl_align_log - 5) |
-                         EGRSTATUSPAGESIZE(stat_len != 64));
-
+        if (is_t4(adap->params.chip)) {
+                t4_set_reg_field(adap, SGE_CONTROL,
+                                 INGPADBOUNDARY_MASK |
+                                 EGRSTATUSPAGESIZE_MASK,
+                                 INGPADBOUNDARY(fl_align_log - 5) |
+                                 EGRSTATUSPAGESIZE(stat_len != 64));
+        } else {
+                /* T5 introduced the separation of the Free List Padding and
+                 * Packing Boundaries.  Thus, we can select a smaller Padding
+                 * Boundary to avoid uselessly chewing up PCIe Link and Memory
+                 * Bandwidth, and use a Packing Boundary which is large enough
+                 * to avoid false sharing between CPUs, etc.
+                 *
+                 * For the PCI Link, the smaller the Padding Boundary the
+                 * better.  For the Memory Controller, a smaller Padding
+                 * Boundary is better until we cross under the Memory Line
+                 * Size (the minimum unit of transfer to/from Memory).  If we
+                 * have a Padding Boundary which is smaller than the Memory
+                 * Line Size, that'll involve a Read-Modify-Write cycle on the
+                 * Memory Controller which is never good.  For T5 the smallest
+                 * Padding Boundary which we can select is 32 bytes which is
+                 * larger than any known Memory Controller Line Size so we'll
+                 * use that.
+                 *
+                 * T5 has a different interpretation of the "0" value for the
+                 * Packing Boundary.  This corresponds to 16 bytes instead of
+                 * the expected 32 bytes.  We never have a Packing Boundary
+                 * less than 32 bytes so we can't use that special value but
+                 * on the other hand, if we wanted 32 bytes, the best we can
+                 * really do is 64 bytes.
+                */
+                if (fl_align <= 32) {
+                        fl_align = 64;
+                        fl_align_log = 6;
+                }
+                t4_set_reg_field(adap, SGE_CONTROL,
+                                 INGPADBOUNDARY_MASK |
+                                 EGRSTATUSPAGESIZE_MASK,
+                                 INGPADBOUNDARY(INGPCIEBOUNDARY_32B_X) |
+                                 EGRSTATUSPAGESIZE(stat_len != 64));
+                t4_set_reg_field(adap, SGE_CONTROL2_A,
+                                 INGPACKBOUNDARY_V(INGPACKBOUNDARY_M),
+                                 INGPACKBOUNDARY_V(fl_align_log -
+                                                 INGPACKBOUNDARY_SHIFT_X));
+        }
         /*
          * Adjust various SGE Free List Host Buffer Sizes.
          *
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index a1024db5dc13..8d2de1006b08 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -95,6 +95,7 @@
 #define X_INGPADBOUNDARY_SHIFT 5
 
 #define SGE_CONTROL 0x1008
+#define SGE_CONTROL2_A          0x1124
 #define  DCASYSTYPE             0x00080000U
 #define  RXPKTCPLMODE_MASK      0x00040000U
 #define  RXPKTCPLMODE_SHIFT     18
@@ -106,6 +107,7 @@
 #define  PKTSHIFT_SHIFT         10
 #define  PKTSHIFT(x)            ((x) << PKTSHIFT_SHIFT)
 #define  PKTSHIFT_GET(x)        (((x) & PKTSHIFT_MASK) >> PKTSHIFT_SHIFT)
+#define  INGPCIEBOUNDARY_32B_X  0
 #define  INGPCIEBOUNDARY_MASK   0x00000380U
 #define  INGPCIEBOUNDARY_SHIFT  7
 #define  INGPCIEBOUNDARY(x)     ((x) << INGPCIEBOUNDARY_SHIFT)
@@ -114,6 +116,14 @@
 #define  INGPADBOUNDARY(x)      ((x) << INGPADBOUNDARY_SHIFT)
 #define  INGPADBOUNDARY_GET(x)  (((x) & INGPADBOUNDARY_MASK) \
                                  >> INGPADBOUNDARY_SHIFT)
+#define  INGPACKBOUNDARY_16B_X  0
+#define  INGPACKBOUNDARY_SHIFT_X 5
+
+#define  INGPACKBOUNDARY_S      16
+#define  INGPACKBOUNDARY_M      0x7U
+#define  INGPACKBOUNDARY_V(x)   ((x) << INGPACKBOUNDARY_S)
+#define  INGPACKBOUNDARY_G(x)   (((x) >> INGPACKBOUNDARY_S) \
+                                 & INGPACKBOUNDARY_M)
 #define  EGRPCIEBOUNDARY_MASK   0x0000000eU
 #define  EGRPCIEBOUNDARY_SHIFT  1
 #define  EGRPCIEBOUNDARY(x)     ((x) << EGRPCIEBOUNDARY_SHIFT)
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index 68eaa9c88c7d..3d06e77d7121 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -299,6 +299,14 @@ struct sge {
         u16 timer_val[SGE_NTIMERS];     /* interrupt holdoff timer array */
         u8 counter_val[SGE_NCOUNTERS];  /* interrupt RX threshold array */
 
+        /* Decoded Adapter Parameters.
+         */
+        u32 fl_pg_order;                /* large page allocation size */
+        u32 stat_len;                   /* length of status page at ring end */
+        u32 pktshift;                   /* padding between CPL & packet data */
+        u32 fl_align;                   /* response queue message alignment */
+        u32 fl_starve_thres;            /* Free List starvation threshold */
+
         /*
          * Reverse maps from Absolute Queue IDs to associated queue pointers.
          * The absolute Queue IDs are in a compact range which start at a
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index 85036e6b42c4..fdd078d7d82c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -51,14 +51,6 @@
 #include "../cxgb4/t4_msg.h"
 
 /*
- * Decoded Adapter Parameters.
- */
-static u32 FL_PG_ORDER;         /* large page allocation size */
-static u32 STAT_LEN;            /* length of status page at ring end */
-static u32 PKTSHIFT;            /* padding between CPL and packet data */
-static u32 FL_ALIGN;            /* response queue message alignment */
-
-/*
  * Constants ...
  */
 enum {
@@ -102,12 +94,6 @@ enum {
         MAX_TIMER_TX_RECLAIM = 100,
 
         /*
-         * An FL with <= FL_STARVE_THRES buffers is starving and a periodic
-         * timer will attempt to refill it.
-         */
-        FL_STARVE_THRES = 4,
-
-        /*
          * Suspend an Ethernet TX queue with fewer available descriptors than
          * this.  We always want to have room for a maximum sized packet:
          * inline immediate data + MAX_SKB_FRAGS. This is the same as
@@ -264,15 +250,19 @@ static inline unsigned int fl_cap(const struct sge_fl *fl)
 
 /**
  *      fl_starving - return whether a Free List is starving.
+ *      @adapter: pointer to the adapter
  *      @fl: the Free List
  *
  *      Tests specified Free List to see whether the number of buffers
  *      available to the hardware has falled below our "starvation"
  *      threshold.
  */
-static inline bool fl_starving(const struct sge_fl *fl)
+static inline bool fl_starving(const struct adapter *adapter,
+                               const struct sge_fl *fl)
 {
-        return fl->avail - fl->pend_cred <= FL_STARVE_THRES;
+        const struct sge *s = &adapter->sge;
+
+        return fl->avail - fl->pend_cred <= s->fl_starve_thres;
 }
 
 /**
@@ -457,13 +447,16 @@ static inline void reclaim_completed_tx(struct adapter *adapter,
 
 /**
  *      get_buf_size - return the size of an RX Free List buffer.
+ *      @adapter: pointer to the associated adapter
  *      @sdesc: pointer to the software buffer descriptor
  */
-static inline int get_buf_size(const struct rx_sw_desc *sdesc)
+static inline int get_buf_size(const struct adapter *adapter,
+                               const struct rx_sw_desc *sdesc)
 {
-        return FL_PG_ORDER > 0 && (sdesc->dma_addr & RX_LARGE_BUF)
-                ? (PAGE_SIZE << FL_PG_ORDER)
-                : PAGE_SIZE;
+        const struct sge *s = &adapter->sge;
+
+        return (s->fl_pg_order > 0 && (sdesc->dma_addr & RX_LARGE_BUF)
+                ? (PAGE_SIZE << s->fl_pg_order) : PAGE_SIZE);
 }
 
 /**
@@ -483,7 +476,8 @@ static void free_rx_bufs(struct adapter *adapter, struct sge_fl *fl, int n)
 
                 if (is_buf_mapped(sdesc))
                         dma_unmap_page(adapter->pdev_dev, get_buf_addr(sdesc),
-                                       get_buf_size(sdesc), PCI_DMA_FROMDEVICE);
+                                       get_buf_size(adapter, sdesc),
+                                       PCI_DMA_FROMDEVICE);
                 put_page(sdesc->page);
                 sdesc->page = NULL;
                 if (++fl->cidx == fl->size)
@@ -511,7 +505,8 @@ static void unmap_rx_buf(struct adapter *adapter, struct sge_fl *fl)
 
         if (is_buf_mapped(sdesc))
                 dma_unmap_page(adapter->pdev_dev, get_buf_addr(sdesc),
-                               get_buf_size(sdesc), PCI_DMA_FROMDEVICE);
+                               get_buf_size(adapter, sdesc),
+                               PCI_DMA_FROMDEVICE);
         sdesc->page = NULL;
         if (++fl->cidx == fl->size)
                 fl->cidx = 0;
@@ -589,6 +584,7 @@ static inline void poison_buf(struct page *page, size_t sz)
 static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
                               int n, gfp_t gfp)
 {
+        struct sge *s = &adapter->sge;
         struct page *page;
         dma_addr_t dma_addr;
         unsigned int cred = fl->avail;
@@ -608,12 +604,12 @@ static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
          * If we don't support large pages, drop directly into the small page
          * allocation code.
          */
-        if (FL_PG_ORDER == 0)
+        if (s->fl_pg_order == 0)
                 goto alloc_small_pages;
 
         while (n) {
                 page = alloc_pages(gfp | __GFP_COMP | __GFP_NOWARN,
-                                   FL_PG_ORDER);
+                                   s->fl_pg_order);
                 if (unlikely(!page)) {
                         /*
                          * We've failed inour attempt to allocate a "large
@@ -623,10 +619,10 @@ static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
                         fl->large_alloc_failed++;
                         break;
                 }
-                poison_buf(page, PAGE_SIZE << FL_PG_ORDER);
+                poison_buf(page, PAGE_SIZE << s->fl_pg_order);
 
                 dma_addr = dma_map_page(adapter->pdev_dev, page, 0,
-                                        PAGE_SIZE << FL_PG_ORDER,
+                                        PAGE_SIZE << s->fl_pg_order,
                                         PCI_DMA_FROMDEVICE);
                 if (unlikely(dma_mapping_error(adapter->pdev_dev, dma_addr))) {
                         /*
@@ -637,7 +633,7 @@ static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
                          * because DMA mapping resources are typically
                          * critical resources once they become scarse.
                          */
-                        __free_pages(page, FL_PG_ORDER);
+                        __free_pages(page, s->fl_pg_order);
                         goto out;
                 }
                 dma_addr |= RX_LARGE_BUF;
@@ -693,7 +689,7 @@ out:
         fl->pend_cred += cred;
         ring_fl_db(adapter, fl);
 
-        if (unlikely(fl_starving(fl))) {
+        if (unlikely(fl_starving(adapter, fl))) {
                 smp_wmb();
                 set_bit(fl->cntxt_id, adapter->sge.starving_fl);
         }
@@ -1468,6 +1464,8 @@ static void t4vf_pktgl_free(const struct pkt_gl *gl)
 static void do_gro(struct sge_eth_rxq *rxq, const struct pkt_gl *gl,
                    const struct cpl_rx_pkt *pkt)
 {
+        struct adapter *adapter = rxq->rspq.adapter;
+        struct sge *s = &adapter->sge;
         int ret;
         struct sk_buff *skb;
 
@@ -1478,8 +1476,8 @@ static void do_gro(struct sge_eth_rxq *rxq, const struct pkt_gl *gl,
                 return;
         }
 
-        copy_frags(skb, gl, PKTSHIFT);
-        skb->len = gl->tot_len - PKTSHIFT;
+        copy_frags(skb, gl, s->pktshift);
+        skb->len = gl->tot_len - s->pktshift;
         skb->data_len = skb->len;
         skb->truesize += skb->data_len;
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1516,6 +1514,8 @@ int t4vf_ethrx_handler(struct sge_rspq *rspq, const __be64 *rsp,
         bool csum_ok = pkt->csum_calc && !pkt->err_vec &&
                        (rspq->netdev->features & NETIF_F_RXCSUM);
         struct sge_eth_rxq *rxq = container_of(rspq, struct sge_eth_rxq, rspq);
+        struct adapter *adapter = rspq->adapter;
+        struct sge *s = &adapter->sge;
 
         /*
          * If this is a good TCP packet and we have Generic Receive Offload
@@ -1537,7 +1537,7 @@ int t4vf_ethrx_handler(struct sge_rspq *rspq, const __be64 *rsp,
                 rxq->stats.rx_drops++;
                 return 0;
         }
-        __skb_pull(skb, PKTSHIFT);
+        __skb_pull(skb, s->pktshift);
         skb->protocol = eth_type_trans(skb, rspq->netdev);
         skb_record_rx_queue(skb, rspq->idx);
         rxq->stats.pkts++;
@@ -1648,6 +1648,8 @@ static inline void rspq_next(struct sge_rspq *rspq)
 static int process_responses(struct sge_rspq *rspq, int budget)
 {
         struct sge_eth_rxq *rxq = container_of(rspq, struct sge_eth_rxq, rspq);
+        struct adapter *adapter = rspq->adapter;
+        struct sge *s = &adapter->sge;
         int budget_left = budget;
 
         while (likely(budget_left)) {
@@ -1697,7 +1699,7 @@ static int process_responses(struct sge_rspq *rspq, int budget)
                                 BUG_ON(frag >= MAX_SKB_FRAGS);
                                 BUG_ON(rxq->fl.avail == 0);
                                 sdesc = &rxq->fl.sdesc[rxq->fl.cidx];
-                                bufsz = get_buf_size(sdesc);
+                                bufsz = get_buf_size(adapter, sdesc);
                                 fp->page = sdesc->page;
                                 fp->offset = rspq->offset;
                                 fp->size = min(bufsz, len);
@@ -1726,7 +1728,7 @@ static int process_responses(struct sge_rspq *rspq, int budget)
                          */
                         ret = rspq->handler(rspq, rspq->cur_desc, &gl);
                         if (likely(ret == 0))
-                                rspq->offset += ALIGN(fp->size, FL_ALIGN);
+                                rspq->offset += ALIGN(fp->size, s->fl_align);
                         else
                                 restore_rx_bufs(&gl, &rxq->fl, frag);
                 } else if (likely(rsp_type == RSP_TYPE_CPL)) {
@@ -1963,7 +1965,7 @@ static void sge_rx_timer_cb(unsigned long data)
                          * schedule napi but the FL is no longer starving.
                          * No biggie.
                          */
-                        if (fl_starving(fl)) {
+                        if (fl_starving(adapter, fl)) {
                                 struct sge_eth_rxq *rxq;
 
                                 rxq = container_of(fl, struct sge_eth_rxq, fl);
@@ -2047,6 +2049,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                        int intr_dest,
                        struct sge_fl *fl, rspq_handler_t hnd)
 {
+        struct sge *s = &adapter->sge;
         struct port_info *pi = netdev_priv(dev);
         struct fw_iq_cmd cmd, rpl;
         int ret, iqandst, flsz = 0;
@@ -2117,7 +2120,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                 fl->size = roundup(fl->size, FL_PER_EQ_UNIT);
                 fl->desc = alloc_ring(adapter->pdev_dev, fl->size,
                                       sizeof(__be64), sizeof(struct rx_sw_desc),
-                                      &fl->addr, &fl->sdesc, STAT_LEN);
+                                      &fl->addr, &fl->sdesc, s->stat_len);
                 if (!fl->desc) {
                         ret = -ENOMEM;
                         goto err;
@@ -2129,7 +2132,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                  * free list ring) in Egress Queue Units.
                  */
                 flsz = (fl->size / FL_PER_EQ_UNIT +
-                        STAT_LEN / EQ_UNIT);
+                        s->stat_len / EQ_UNIT);
 
                 /*
                  * Fill in all the relevant firmware Ingress Queue Command
@@ -2217,6 +2220,7 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
                            struct net_device *dev, struct netdev_queue *devq,
                            unsigned int iqid)
 {
+        struct sge *s = &adapter->sge;
         int ret, nentries;
         struct fw_eq_eth_cmd cmd, rpl;
         struct port_info *pi = netdev_priv(dev);
@@ -2225,7 +2229,7 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
          * Calculate the size of the hardware TX Queue (including the Status
          * Page on the end of the TX Queue) in units of TX Descriptors.
          */
-        nentries = txq->q.size + STAT_LEN / sizeof(struct tx_desc);
+        nentries = txq->q.size + s->stat_len / sizeof(struct tx_desc);
 
         /*
          * Allocate the hardware ring for the TX ring (with space for its
@@ -2234,7 +2238,7 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
         txq->q.desc = alloc_ring(adapter->pdev_dev, txq->q.size,
                                  sizeof(struct tx_desc),
                                  sizeof(struct tx_sw_desc),
-                                 &txq->q.phys_addr, &txq->q.sdesc, STAT_LEN);
+                                 &txq->q.phys_addr, &txq->q.sdesc, s->stat_len);
         if (!txq->q.desc)
                 return -ENOMEM;
 
@@ -2307,8 +2311,10 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
  */
 static void free_txq(struct adapter *adapter, struct sge_txq *tq)
 {
+        struct sge *s = &adapter->sge;
+
         dma_free_coherent(adapter->pdev_dev,
-                          tq->size * sizeof(*tq->desc) + STAT_LEN,
+                          tq->size * sizeof(*tq->desc) + s->stat_len,
                           tq->desc, tq->phys_addr);
         tq->cntxt_id = 0;
         tq->sdesc = NULL;
@@ -2322,6 +2328,7 @@ static void free_txq(struct adapter *adapter, struct sge_txq *tq)
 static void free_rspq_fl(struct adapter *adapter, struct sge_rspq *rspq,
                          struct sge_fl *fl)
 {
+        struct sge *s = &adapter->sge;
         unsigned int flid = fl ? fl->cntxt_id : 0xffff;
 
         t4vf_iq_free(adapter, FW_IQ_TYPE_FL_INT_CAP,
@@ -2337,7 +2344,7 @@ static void free_rspq_fl(struct adapter *adapter, struct sge_rspq *rspq,
         if (fl) {
                 free_rx_bufs(adapter, fl, fl->avail);
                 dma_free_coherent(adapter->pdev_dev,
-                                  fl->size * sizeof(*fl->desc) + STAT_LEN,
+                                  fl->size * sizeof(*fl->desc) + s->stat_len,
                                   fl->desc, fl->addr);
                 kfree(fl->sdesc);
                 fl->sdesc = NULL;
@@ -2423,6 +2430,7 @@ int t4vf_sge_init(struct adapter *adapter)
         u32 fl0 = sge_params->sge_fl_buffer_size[0];
         u32 fl1 = sge_params->sge_fl_buffer_size[1];
         struct sge *s = &adapter->sge;
+        unsigned int ingpadboundary, ingpackboundary;
 
         /*
          * Start by vetting the basic SGE parameters which have been set up by
@@ -2443,12 +2451,48 @@ int t4vf_sge_init(struct adapter *adapter)
          * Now translate the adapter parameters into our internal forms.
          */
         if (fl1)
-                FL_PG_ORDER = ilog2(fl1) - PAGE_SHIFT;
-        STAT_LEN = ((sge_params->sge_control & EGRSTATUSPAGESIZE_MASK)
-                    ? 128 : 64);
-        PKTSHIFT = PKTSHIFT_GET(sge_params->sge_control);
-        FL_ALIGN = 1 << (INGPADBOUNDARY_GET(sge_params->sge_control) +
-                         SGE_INGPADBOUNDARY_SHIFT);
+                s->fl_pg_order = ilog2(fl1) - PAGE_SHIFT;
+        s->stat_len = ((sge_params->sge_control & EGRSTATUSPAGESIZE_MASK)
+                        ? 128 : 64);
+        s->pktshift = PKTSHIFT_GET(sge_params->sge_control);
+
+        /* T4 uses a single control field to specify both the PCIe Padding and
+         * Packing Boundary.  T5 introduced the ability to specify these
+         * separately.  The actual Ingress Packet Data alignment boundary
+         * within Packed Buffer Mode is the maximum of these two
+         * specifications.  (Note that it makes no real practical sense to
+         * have the Pading Boudary be larger than the Packing Boundary but you
+         * could set the chip up that way and, in fact, legacy T4 code would
+         * end doing this because it would initialize the Padding Boundary and
+         * leave the Packing Boundary initialized to 0 (16 bytes).)
+         */
+        ingpadboundary = 1 << (INGPADBOUNDARY_GET(sge_params->sge_control) +
+                               X_INGPADBOUNDARY_SHIFT);
+        if (is_t4(adapter->params.chip)) {
+                s->fl_align = ingpadboundary;
+        } else {
+                /* T5 has a different interpretation of one of the PCIe Packing
+                 * Boundary values.
+                 */
+                ingpackboundary = INGPACKBOUNDARY_G(sge_params->sge_control2);
+                if (ingpackboundary == INGPACKBOUNDARY_16B_X)
+                        ingpackboundary = 16;
+                else
+                        ingpackboundary = 1 << (ingpackboundary +
+                                                INGPACKBOUNDARY_SHIFT_X);
+
+                s->fl_align = max(ingpadboundary, ingpackboundary);
+        }
+
+        /* A FL with <= fl_starve_thres buffers is starving and a periodic
+         * timer will attempt to refill it.  This needs to be larger than the
+         * SGE's Egress Congestion Threshold.  If it isn't, then we can get
+         * stuck waiting for new packets while the SGE is waiting for us to
+         * give it more Free List entries.  (Note that the SGE's Egress
+         * Congestion Threshold is in units of 2 Free List pointers.)
+         */
+        s->fl_starve_thres
+                = EGRTHRESHOLD_GET(sge_params->sge_congestion_control)*2 + 1;
 
         /*
          * Set up tasklet timers.
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
index 95df61dcb4ce..4b6a6d14d86d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
@@ -134,11 +134,13 @@ struct dev_params {
  */
 struct sge_params {
         u32 sge_control;                /* padding, boundaries, lengths, etc. */
+        u32 sge_control2;               /* T5: more of the same */
         u32 sge_host_page_size;         /* RDMA page sizes */
         u32 sge_queues_per_page;        /* RDMA queues/page */
         u32 sge_user_mode_limits;       /* limits for BAR2 user mode accesses */
         u32 sge_fl_buffer_size[16];     /* free list buffer sizes */
         u32 sge_ingress_rx_threshold;   /* RX counter interrupt threshold[4] */
+        u32 sge_congestion_control;     /* congestion thresholds, etc. */
         u32 sge_timer_value_0_and_1;    /* interrupt coalescing timer values */
         u32 sge_timer_value_2_and_3;
         u32 sge_timer_value_4_and_5;
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
index e984fdc48ba2..1e896b923234 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
@@ -468,12 +468,38 @@ int t4vf_get_sge_params(struct adapter *adapter)
         sge_params->sge_timer_value_2_and_3 = vals[5];
         sge_params->sge_timer_value_4_and_5 = vals[6];
 
+        /* T4 uses a single control field to specify both the PCIe Padding and
+         * Packing Boundary.  T5 introduced the ability to specify these
+         * separately with the Padding Boundary in SGE_CONTROL and and Packing
+         * Boundary in SGE_CONTROL2.  So for T5 and later we need to grab
+         * SGE_CONTROL in order to determine how ingress packet data will be
+         * laid out in Packed Buffer Mode.  Unfortunately, older versions of
+         * the firmware won't let us retrieve SGE_CONTROL2 so if we get a
+         * failure grabbing it we throw an error since we can't figure out the
+         * right value.
+         */
+        if (!is_t4(adapter->params.chip)) {
+                params[0] = (FW_PARAMS_MNEM(FW_PARAMS_MNEM_REG) |
+                             FW_PARAMS_PARAM_XYZ(SGE_CONTROL2_A));
+                v = t4vf_query_params(adapter, 1, params, vals);
+                if (v != FW_SUCCESS) {
+                        dev_err(adapter->pdev_dev,
+                                "Unable to get SGE Control2; "
+                                "probably old firmware.\n");
+                        return v;
+                }
+                sge_params->sge_control2 = vals[0];
+        }
+
         params[0] = (FW_PARAMS_MNEM(FW_PARAMS_MNEM_REG) |
                      FW_PARAMS_PARAM_XYZ(SGE_INGRESS_RX_THRESHOLD));
-        v = t4vf_query_params(adapter, 1, params, vals);
+        params[1] = (FW_PARAMS_MNEM(FW_PARAMS_MNEM_REG) |
+                     FW_PARAMS_PARAM_XYZ(SGE_CONM_CTRL));
+        v = t4vf_query_params(adapter, 2, params, vals);
         if (v)
                 return v;
         sge_params->sge_ingress_rx_threshold = vals[0];
+        sge_params->sge_congestion_control = vals[1];
 
         return 0;
 }
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 180e53fa628f..73cf1653a4a3 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -940,18 +940,8 @@ static int enic_rq_alloc_buf(struct vnic_rq *rq)
         struct vnic_rq_buf *buf = rq->to_use;
 
         if (buf->os_buf) {
-                buf = buf->next;
-                rq->to_use = buf;
-                rq->ring.desc_avail--;
-                if ((buf->index & VNIC_RQ_RETURN_RATE) == 0) {
-                        /* Adding write memory barrier prevents compiler and/or
-                         * CPU reordering, thus avoiding descriptor posting
-                         * before descriptor is initialized. Otherwise, hardware
-                         * can read stale descriptor fields.
-                         */
-                        wmb();
-                        iowrite32(buf->index, &rq->ctrl->posted_index);
-                }
+                enic_queue_rq_desc(rq, buf->os_buf, os_buf_index, buf->dma_addr,
+                                   buf->len);
 
                 return 0;
         }
@@ -1037,7 +1027,10 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                                 enic->rq_truncated_pkts++;
                 }
 
+                pci_unmap_single(enic->pdev, buf->dma_addr, buf->len,
+                                 PCI_DMA_FROMDEVICE);
                 dev_kfree_skb_any(skb);
+                buf->os_buf = NULL;
 
                 return;
         }
@@ -1088,7 +1081,10 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                 /* Buffer overflow
                  */
 
+                pci_unmap_single(enic->pdev, buf->dma_addr, buf->len,
+                                 PCI_DMA_FROMDEVICE);
                 dev_kfree_skb_any(skb);
+                buf->os_buf = NULL;
         }
 }
 
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 9a18e7930b31..597c463e384d 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -4309,11 +4309,16 @@ static int be_ndo_bridge_setlink(struct net_device *dev, struct nlmsghdr *nlh)
                 return -EOPNOTSUPP;
 
         br_spec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC);
+        if (!br_spec)
+                return -EINVAL;
 
         nla_for_each_nested(attr, br_spec, rem) {
                 if (nla_type(attr) != IFLA_BRIDGE_MODE)
                         continue;
 
+                if (nla_len(attr) < sizeof(mode))
+                        return -EINVAL;
+
                 mode = nla_get_u16(attr);
                 if (mode != BRIDGE_MODE_VEPA && mode != BRIDGE_MODE_VEB)
                         return -EINVAL;
@@ -4421,6 +4426,11 @@ static void be_del_vxlan_port(struct net_device *netdev, sa_family_t sa_family,
                  "Disabled VxLAN offloads for UDP port %d\n",
                  be16_to_cpu(port));
 }
+
+static bool be_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops be_netdev_ops = {
@@ -4450,6 +4460,7 @@ static const struct net_device_ops be_netdev_ops = {
 #ifdef CONFIG_BE2NET_VXLAN
         .ndo_add_vxlan_port     = be_add_vxlan_port,
         .ndo_del_vxlan_port     = be_del_vxlan_port,
+        .ndo_gso_check          = be_gso_check,
 #endif
 };
 
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 50a851db2852..3dca494797bd 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -298,6 +298,16 @@ static void *swap_buffer(void *bufaddr, int len)
         return bufaddr;
 }
 
+static void swap_buffer2(void *dst_buf, void *src_buf, int len)
+{
+        int i;
+        unsigned int *src = src_buf;
+        unsigned int *dst = dst_buf;
+
+        for (i = 0; i < len; i += 4, src++, dst++)
+                *dst = swab32p(src);
+}
+
 static void fec_dump(struct net_device *ndev)
 {
         struct fec_enet_private *fep = netdev_priv(ndev);
@@ -1307,7 +1317,7 @@ fec_enet_new_rxbdp(struct net_device *ndev, struct bufdesc *bdp, struct sk_buff
 }
 
 static bool fec_enet_copybreak(struct net_device *ndev, struct sk_buff **skb,
-                               struct bufdesc *bdp, u32 length)
+                               struct bufdesc *bdp, u32 length, bool swap)
 {
         struct  fec_enet_private *fep = netdev_priv(ndev);
         struct sk_buff *new_skb;
@@ -1322,7 +1332,10 @@ static bool fec_enet_copybreak(struct net_device *ndev, struct sk_buff **skb,
         dma_sync_single_for_cpu(&fep->pdev->dev, bdp->cbd_bufaddr,
                                 FEC_ENET_RX_FRSIZE - fep->rx_align,
                                 DMA_FROM_DEVICE);
-        memcpy(new_skb->data, (*skb)->data, length);
+        if (!swap)
+                memcpy(new_skb->data, (*skb)->data, length);
+        else
+                swap_buffer2(new_skb->data, (*skb)->data, length);
         *skb = new_skb;
 
         return true;
@@ -1352,6 +1365,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
         u16     vlan_tag;
         int     index = 0;
         bool    is_copybreak;
+        bool    need_swap = id_entry->driver_data & FEC_QUIRK_SWAP_FRAME;
 
 #ifdef CONFIG_M532x
         flush_cache_all();
@@ -1415,7 +1429,8 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
                  * include that when passing upstream as it messes up
                  * bridging applications.
                  */
-                is_copybreak = fec_enet_copybreak(ndev, &skb, bdp, pkt_len - 4);
+                is_copybreak = fec_enet_copybreak(ndev, &skb, bdp, pkt_len - 4,
+                                                  need_swap);
                 if (!is_copybreak) {
                         skb_new = netdev_alloc_skb(ndev, FEC_ENET_RX_FRSIZE);
                         if (unlikely(!skb_new)) {
@@ -1430,7 +1445,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
                 prefetch(skb->data - NET_IP_ALIGN);
                 skb_put(skb, pkt_len - 4);
                 data = skb->data;
-                if (id_entry->driver_data & FEC_QUIRK_SWAP_FRAME)
+                if (!is_copybreak && need_swap)
                         swap_buffer(data, pkt_len);
 
                 /* Extract the enhanced buffer descriptor */
@@ -3343,12 +3358,11 @@ static int __maybe_unused fec_suspend(struct device *dev)
                 netif_device_detach(ndev);
                 netif_tx_unlock_bh(ndev);
                 fec_stop(ndev);
+                fec_enet_clk_enable(ndev, false);
+                pinctrl_pm_select_sleep_state(&fep->pdev->dev);
         }
         rtnl_unlock();
 
-        fec_enet_clk_enable(ndev, false);
-        pinctrl_pm_select_sleep_state(&fep->pdev->dev);
-
         if (fep->reg_phy)
                 regulator_disable(fep->reg_phy);
 
@@ -3367,13 +3381,14 @@ static int __maybe_unused fec_resume(struct device *dev)
                         return ret;
         }
 
-        pinctrl_pm_select_default_state(&fep->pdev->dev);
-        ret = fec_enet_clk_enable(ndev, true);
-        if (ret)
-                goto failed_clk;
-
         rtnl_lock();
         if (netif_running(ndev)) {
+                pinctrl_pm_select_default_state(&fep->pdev->dev);
+                ret = fec_enet_clk_enable(ndev, true);
+                if (ret) {
+                        rtnl_unlock();
+                        goto failed_clk;
+                }
                 fec_restart(ndev);
                 netif_tx_lock_bh(ndev);
                 netif_device_attach(ndev);
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index a2d72a87cbde..487cd9c4ac0d 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1012,7 +1012,8 @@ static void igb_free_q_vector(struct igb_adapter *adapter, int v_idx)
         /* igb_get_stats64() might access the rings on this vector,
          * we must wait a grace period before freeing it.
          */
-        kfree_rcu(q_vector, rcu);
+        if (q_vector)
+                kfree_rcu(q_vector, rcu);
 }
 
 /**
@@ -1792,8 +1793,10 @@ void igb_down(struct igb_adapter *adapter)
         adapter->flags &= ~IGB_FLAG_NEED_LINK_UPDATE;
 
         for (i = 0; i < adapter->num_q_vectors; i++) {
-                napi_synchronize(&(adapter->q_vector[i]->napi));
-                napi_disable(&(adapter->q_vector[i]->napi));
+                if (adapter->q_vector[i]) {
+                        napi_synchronize(&adapter->q_vector[i]->napi);
+                        napi_disable(&adapter->q_vector[i]->napi);
+                }
         }
 
 
@@ -3717,7 +3720,8 @@ static void igb_free_all_tx_resources(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_tx_queues; i++)
-                igb_free_tx_resources(adapter->tx_ring[i]);
+                if (adapter->tx_ring[i])
+                        igb_free_tx_resources(adapter->tx_ring[i]);
 }
 
 void igb_unmap_and_free_tx_resource(struct igb_ring *ring,
@@ -3782,7 +3786,8 @@ static void igb_clean_all_tx_rings(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_tx_queues; i++)
-                igb_clean_tx_ring(adapter->tx_ring[i]);
+                if (adapter->tx_ring[i])
+                        igb_clean_tx_ring(adapter->tx_ring[i]);
 }
 
 /**
@@ -3819,7 +3824,8 @@ static void igb_free_all_rx_resources(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_rx_queues; i++)
-                igb_free_rx_resources(adapter->rx_ring[i]);
+                if (adapter->rx_ring[i])
+                        igb_free_rx_resources(adapter->rx_ring[i]);
 }
 
 /**
@@ -3874,7 +3880,8 @@ static void igb_clean_all_rx_rings(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_rx_queues; i++)
-                igb_clean_rx_ring(adapter->rx_ring[i]);
+                if (adapter->rx_ring[i])
+                        igb_clean_rx_ring(adapter->rx_ring[i]);
 }
 
 /**
@@ -7404,6 +7411,8 @@ static int igb_resume(struct device *dev)
         pci_restore_state(pdev);
         pci_save_state(pdev);
 
+        if (!pci_device_is_present(pdev))
+                return -ENODEV;
         err = pci_enable_device_mem(pdev);
         if (err) {
                 dev_err(&pdev->dev,
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index d2df4e3d1032..cc51554c9e99 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -3936,8 +3936,8 @@ void ixgbe_set_rx_mode(struct net_device *netdev)
                  * if SR-IOV and VMDQ are disabled - otherwise ensure
                  * that hardware VLAN filters remain enabled.
                  */
-                if (!(adapter->flags & (IXGBE_FLAG_VMDQ_ENABLED |
-                                        IXGBE_FLAG_SRIOV_ENABLED)))
+                if (adapter->flags & (IXGBE_FLAG_VMDQ_ENABLED |
+                                      IXGBE_FLAG_SRIOV_ENABLED))
                         vlnctrl |= (IXGBE_VLNCTRL_VFE | IXGBE_VLNCTRL_CFIEN);
         } else {
                 if (netdev->flags & IFF_ALLMULTI) {
@@ -7669,6 +7669,8 @@ static int ixgbe_ndo_bridge_setlink(struct net_device *dev,
                 return -EOPNOTSUPP;
 
         br_spec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC);
+        if (!br_spec)
+                return -EINVAL;
 
         nla_for_each_nested(attr, br_spec, rem) {
                 __u16 mode;
@@ -7677,6 +7679,9 @@ static int ixgbe_ndo_bridge_setlink(struct net_device *dev,
                 if (nla_type(attr) != IFLA_BRIDGE_MODE)
                         continue;
 
+                if (nla_len(attr) < sizeof(mode))
+                        return -EINVAL;
+
                 mode = nla_get_u16(attr);
                 if (mode == BRIDGE_MODE_VEPA) {
                         reg = 0;
@@ -7979,6 +7984,7 @@ static int ixgbe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         int i, err, pci_using_dac, expected_gts;
         unsigned int indices = MAX_TX_QUEUES;
         u8 part_str[IXGBE_PBANUM_LENGTH];
+        bool disable_dev = false;
 #ifdef IXGBE_FCOE
         u16 device_caps;
 #endif
@@ -8369,13 +8375,14 @@ err_sw_init:
         iounmap(adapter->io_addr);
         kfree(adapter->mac_table);
 err_ioremap:
+        disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
         free_netdev(netdev);
 err_alloc_etherdev:
         pci_release_selected_regions(pdev,
                                      pci_select_bars(pdev, IORESOURCE_MEM));
 err_pci_reg:
 err_dma:
-        if (!adapter || !test_and_set_bit(__IXGBE_DISABLED, &adapter->state))
+        if (!adapter || disable_dev)
                 pci_disable_device(pdev);
         return err;
 }
@@ -8393,6 +8400,7 @@ static void ixgbe_remove(struct pci_dev *pdev)
 {
         struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
         struct net_device *netdev = adapter->netdev;
+        bool disable_dev;
 
         ixgbe_dbg_adapter_exit(adapter);
 
@@ -8442,11 +8450,12 @@ static void ixgbe_remove(struct pci_dev *pdev)
         e_dev_info("complete\n");
 
         kfree(adapter->mac_table);
+        disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
         free_netdev(netdev);
 
         pci_disable_pcie_error_reporting(pdev);
 
-        if (!test_and_set_bit(__IXGBE_DISABLED, &adapter->state))
+        if (disable_dev)
                 pci_disable_device(pdev);
 }
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index d47b19f27c35..28b81ae09b5a 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -635,7 +635,6 @@ s32 ixgbe_check_phy_link_tnx(struct ixgbe_hw *hw, ixgbe_link_speed *speed,
  **/
 s32 ixgbe_setup_phy_link_tnx(struct ixgbe_hw *hw)
 {
-        s32 status;
         u16 autoneg_reg = IXGBE_MII_AUTONEG_REG;
         bool autoneg = false;
         ixgbe_link_speed speed;
@@ -700,8 +699,7 @@ s32 ixgbe_setup_phy_link_tnx(struct ixgbe_hw *hw)
 
         hw->phy.ops.write_reg(hw, MDIO_CTRL1,
                               MDIO_MMD_AN, autoneg_reg);
-
-        return status;
+        return 0;
 }
 
 /**
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index b151a949f352..d44560d1d268 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -1047,7 +1047,6 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 int tx_index;
                 struct tx_desc *desc;
                 u32 cmd_sts;
-                struct sk_buff *skb;
 
                 tx_index = txq->tx_used_desc;
                 desc = &txq->tx_desc_area[tx_index];
@@ -1066,19 +1065,22 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 reclaimed++;
                 txq->tx_desc_count--;
 
-                skb = NULL;
-                if (cmd_sts & TX_LAST_DESC)
-                        skb = __skb_dequeue(&txq->tx_skb);
+                if (!IS_TSO_HEADER(txq, desc->buf_ptr))
+                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
+                                         desc->byte_cnt, DMA_TO_DEVICE);
+
+                if (cmd_sts & TX_ENABLE_INTERRUPT) {
+                        struct sk_buff *skb = __skb_dequeue(&txq->tx_skb);
+
+                        if (!WARN_ON(!skb))
+                                dev_kfree_skb(skb);
+                }
 
                 if (cmd_sts & ERROR_SUMMARY) {
                         netdev_info(mp->dev, "tx error\n");
                         mp->dev->stats.tx_errors++;
                 }
 
-                if (!IS_TSO_HEADER(txq, desc->buf_ptr))
-                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
-                                         desc->byte_cnt, DMA_TO_DEVICE);
-                dev_kfree_skb(skb);
         }
 
         __netif_tx_unlock_bh(nq);
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index ece83f101526..fdf3e382e464 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -1692,6 +1692,7 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
 {
         struct mvpp2_prs_entry *pe;
         int tid_aux, tid;
+        int ret = 0;
 
         pe = mvpp2_prs_vlan_find(priv, tpid, ai);
 
@@ -1723,8 +1724,10 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
                                 break;
                 }
 
-                if (tid <= tid_aux)
-                        return -EINVAL;
+                if (tid <= tid_aux) {
+                        ret = -EINVAL;
+                        goto error;
+                }
 
                 memset(pe, 0 , sizeof(struct mvpp2_prs_entry));
                 mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_VLAN);
@@ -1756,9 +1759,10 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
 
         mvpp2_prs_hw_write(priv, pe);
 
+error:
         kfree(pe);
 
-        return 0;
+        return ret;
 }
 
 /* Get first free double vlan ai number */
@@ -1821,7 +1825,7 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
                                      unsigned int port_map)
 {
         struct mvpp2_prs_entry *pe;
-        int tid_aux, tid, ai;
+        int tid_aux, tid, ai, ret = 0;
 
         pe = mvpp2_prs_double_vlan_find(priv, tpid1, tpid2);
 
@@ -1838,8 +1842,10 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
 
                 /* Set ai value for new double vlan entry */
                 ai = mvpp2_prs_double_vlan_ai_free_get(priv);
-                if (ai < 0)
-                        return ai;
+                if (ai < 0) {
+                        ret = ai;
+                        goto error;
+                }
 
                 /* Get first single/triple vlan tid */
                 for (tid_aux = MVPP2_PE_FIRST_FREE_TID;
@@ -1859,8 +1865,10 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
                                 break;
                 }
 
-                if (tid >= tid_aux)
-                        return -ERANGE;
+                if (tid >= tid_aux) {
+                        ret = -ERANGE;
+                        goto error;
+                }
 
                 memset(pe, 0, sizeof(struct mvpp2_prs_entry));
                 mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_VLAN);
@@ -1887,8 +1895,9 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
         mvpp2_prs_tcam_port_map_set(pe, port_map);
         mvpp2_prs_hw_write(priv, pe);
 
+error:
         kfree(pe);
-        return 0;
+        return ret;
 }
 
 /* IPv4 header parsing for fragmentation and L4 offset */
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index f3032fec8fce..4d69e382b4e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1693,7 +1693,7 @@ int mlx4_en_start_port(struct net_device *dev)
         mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
 
 #ifdef CONFIG_MLX4_EN_VXLAN
-        if (priv->mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_VXLAN_OFFLOADS)
+        if (priv->mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                 vxlan_get_rx_port(dev);
 #endif
         priv->port_up = true;
@@ -2281,8 +2281,16 @@ static void mlx4_en_add_vxlan_offloads(struct work_struct *work)
         ret = mlx4_SET_PORT_VXLAN(priv->mdev->dev, priv->port,
                                   VXLAN_STEER_BY_OUTER_MAC, 1);
 out:
-        if (ret)
+        if (ret) {
                 en_err(priv, "failed setting L2 tunnel configuration ret %d\n", ret);
+                return;
+        }
+
+        /* set offloads */
+        priv->dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
+                                      NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL;
+        priv->dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
+        priv->dev->features    |= NETIF_F_GSO_UDP_TUNNEL;
 }
 
 static void mlx4_en_del_vxlan_offloads(struct work_struct *work)
@@ -2290,6 +2298,11 @@ static void mlx4_en_del_vxlan_offloads(struct work_struct *work)
         int ret;
         struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
                                                  vxlan_del_task);
+        /* unset offloads */
+        priv->dev->hw_enc_features &= ~(NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
+                                      NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL);
+        priv->dev->hw_features &= ~NETIF_F_GSO_UDP_TUNNEL;
+        priv->dev->features    &= ~NETIF_F_GSO_UDP_TUNNEL;
 
         ret = mlx4_SET_PORT_VXLAN(priv->mdev->dev, priv->port,
                                   VXLAN_STEER_BY_OUTER_MAC, 0);
@@ -2342,6 +2355,11 @@ static void mlx4_en_del_vxlan_port(struct  net_device *dev,
 
         queue_work(priv->mdev->workqueue, &priv->vxlan_del_task);
 }
+
+static bool mlx4_en_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops mlx4_netdev_ops = {
@@ -2373,6 +2391,7 @@ static const struct net_device_ops mlx4_netdev_ops = {
 #ifdef CONFIG_MLX4_EN_VXLAN
         .ndo_add_vxlan_port     = mlx4_en_add_vxlan_port,
         .ndo_del_vxlan_port     = mlx4_en_del_vxlan_port,
+        .ndo_gso_check          = mlx4_en_gso_check,
 #endif
 };
 
@@ -2403,6 +2422,11 @@ static const struct net_device_ops mlx4_netdev_ops_master = {
         .ndo_rx_flow_steer      = mlx4_en_filter_rfs,
 #endif
         .ndo_get_phys_port_id   = mlx4_en_get_phys_port_id,
+#ifdef CONFIG_MLX4_EN_VXLAN
+        .ndo_add_vxlan_port     = mlx4_en_add_vxlan_port,
+        .ndo_del_vxlan_port     = mlx4_en_del_vxlan_port,
+        .ndo_gso_check          = mlx4_en_gso_check,
+#endif
 };
 
 int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
@@ -2568,13 +2592,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         if (mdev->dev->caps.steering_mode != MLX4_STEERING_MODE_A0)
                 dev->priv_flags |= IFF_UNICAST_FLT;
 
-        if (mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN) {
-                dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
-                                        NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL;
-                dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
-                dev->features    |= NETIF_F_GSO_UDP_TUNNEL;
-        }
-
         mdev->pndev[port] = dev;
 
         netif_carrier_off(dev);
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 5d2498dcf536..cd5cf6d957c7 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -1546,7 +1546,7 @@ static int qp_alloc_res(struct mlx4_dev *dev, int slave, int op, int cmd,
 
         switch (op) {
         case RES_OP_RESERVE:
-                count = get_param_l(&in_param);
+                count = get_param_l(&in_param) & 0xffffff;
                 align = get_param_h(&in_param);
                 err = mlx4_grant_resource(dev, slave, RES_QP, count, 0);
                 if (err)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index a278238a2db6..ad2c96a02a53 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -374,15 +374,14 @@ int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
         snprintf(eq->name, MLX5_MAX_EQ_NAME, "%s@pci:%s",
                  name, pci_name(dev->pdev));
         eq->eqn = out.eq_number;
+        eq->irqn = vecidx;
+        eq->dev = dev;
+        eq->doorbell = uar->map + MLX5_EQ_DOORBEL_OFFSET;
         err = request_irq(table->msix_arr[vecidx].vector, mlx5_msix_handler, 0,
                           eq->name, eq);
         if (err)
                 goto err_eq;
 
-        eq->irqn = vecidx;
-        eq->dev = dev;
-        eq->doorbell = uar->map + MLX5_EQ_DOORBEL_OFFSET;
-
         err = mlx5_debug_eq_add(dev, eq);
         if (err)
                 goto err_irq;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 3d8e8e489b2d..71b10b210792 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -864,14 +864,14 @@ static int init_one(struct pci_dev *pdev,
         dev->profile = &profile[prof_sel];
         dev->event = mlx5_core_event;
 
+        INIT_LIST_HEAD(&priv->ctx_list);
+        spin_lock_init(&priv->ctx_lock);
         err = mlx5_dev_init(dev, pdev);
         if (err) {
                 dev_err(&pdev->dev, "mlx5_dev_init failed %d\n", err);
                 goto out;
         }
 
-        INIT_LIST_HEAD(&priv->ctx_list);
-        spin_lock_init(&priv->ctx_lock);
         err = mlx5_register_device(dev);
         if (err) {
                 dev_err(&pdev->dev, "mlx5_register_device failed %d\n", err);
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 0b2a1ccd276d..613037584d08 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -2762,7 +2762,8 @@ netxen_fw_poll_work(struct work_struct *work)
         if (test_bit(__NX_RESETTING, &adapter->state))
                 goto reschedule;
 
-        if (test_bit(__NX_DEV_UP, &adapter->state)) {
+        if (test_bit(__NX_DEV_UP, &adapter->state) &&
+            !(adapter->capabilities & NX_FW_CAPABILITY_LINK_NOTIFICATION)) {
                 if (!adapter->has_link_events) {
 
                         netxen_nic_handle_phy_intr(adapter);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index f5e29f7bdae3..a913b3ad2f89 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -503,6 +503,11 @@ static void qlcnic_del_vxlan_port(struct net_device *netdev,
 
         adapter->flags |= QLCNIC_DEL_VXLAN_PORT;
 }
+
+static bool qlcnic_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops qlcnic_netdev_ops = {
@@ -526,6 +531,7 @@ static const struct net_device_ops qlcnic_netdev_ops = {
 #ifdef CONFIG_QLCNIC_VXLAN
         .ndo_add_vxlan_port     = qlcnic_add_vxlan_port,
         .ndo_del_vxlan_port     = qlcnic_del_vxlan_port,
+        .ndo_gso_check          = qlcnic_gso_check,
 #endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = qlcnic_poll_controller,
diff --git a/drivers/net/ethernet/qualcomm/Kconfig b/drivers/net/ethernet/qualcomm/Kconfig
index f3a47147937d..9a49f42ac2ba 100644
--- a/drivers/net/ethernet/qualcomm/Kconfig
+++ b/drivers/net/ethernet/qualcomm/Kconfig
@@ -5,7 +5,6 @@
 config NET_VENDOR_QUALCOMM
         bool "Qualcomm devices"
         default y
-        depends on SPI_MASTER && OF_GPIO
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
           and read the Ethernet-HOWTO, available from
@@ -20,7 +19,7 @@ if NET_VENDOR_QUALCOMM
 
 config QCA7000
         tristate "Qualcomm Atheros QCA7000 support"
-        depends on SPI_MASTER && OF_GPIO
+        depends on SPI_MASTER && OF
         ---help---
           This SPI protocol driver supports the Qualcomm Atheros QCA7000.
 
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 002d4cdc319f..a77f05ce8325 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -180,7 +180,8 @@ static int efx_ef10_probe(struct efx_nic *efx)
                       EFX_MAX_CHANNELS,
                       resource_size(&efx->pci_dev->resource[EFX_MEM_BAR]) /
                       (EFX_VI_PAGE_SIZE * EFX_TXQ_TYPES));
-        BUG_ON(efx->max_channels == 0);
+        if (WARN_ON(efx->max_channels == 0))
+                return -EIO;
 
         nic_data = kzalloc(sizeof(*nic_data), GFP_KERNEL);
         if (!nic_data)
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 2c62208077fe..6cc3cf6f17c8 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2243,9 +2243,10 @@ static int smc_drv_probe(struct platform_device *pdev)
         const struct of_device_id *match = NULL;
         struct smc_local *lp;
         struct net_device *ndev;
-        struct resource *res, *ires;
+        struct resource *res;
         unsigned int __iomem *addr;
         unsigned long irq_flags = SMC_IRQ_FLAGS;
+        unsigned long irq_resflags;
         int ret;
 
         ndev = alloc_etherdev(sizeof(struct smc_local));
@@ -2337,16 +2338,19 @@ static int smc_drv_probe(struct platform_device *pdev)
                 goto out_free_netdev;
         }
 
-        ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-        if (!ires) {
+        ndev->irq = platform_get_irq(pdev, 0);
+        if (ndev->irq <= 0) {
                 ret = -ENODEV;
                 goto out_release_io;
         }
-
-        ndev->irq = ires->start;
-
-        if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
-                irq_flags = ires->flags & IRQF_TRIGGER_MASK;
+        /*
+         * If this platform does not specify any special irqflags, or if
+         * the resource supplies a trigger, override the irqflags with
+         * the trigger flags from the resource.
+         */
+        irq_resflags = irqd_get_trigger_type(irq_get_irq_data(ndev->irq));
+        if (irq_flags == -1 || irq_resflags & IRQF_TRIGGER_MASK)
+                irq_flags = irq_resflags & IRQF_TRIGGER_MASK;
 
         ret = smc_request_attrib(pdev, ndev);
         if (ret)
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index affb29da353e..77ed74561e5f 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -1342,6 +1342,42 @@ static void smsc911x_rx_multicast_update_workaround(struct smsc911x_data *pdata)
         spin_unlock(&pdata->mac_lock);
 }
 
+static int smsc911x_phy_general_power_up(struct smsc911x_data *pdata)
+{
+        int rc = 0;
+
+        if (!pdata->phy_dev)
+                return rc;
+
+        /* If the internal PHY is in General Power-Down mode, all, except the
+         * management interface, is powered-down and stays in that condition as
+         * long as Phy register bit 0.11 is HIGH.
+         *
+         * In that case, clear the bit 0.11, so the PHY powers up and we can
+         * access to the phy registers.
+         */
+        rc = phy_read(pdata->phy_dev, MII_BMCR);
+        if (rc < 0) {
+                SMSC_WARN(pdata, drv, "Failed reading PHY control reg");
+                return rc;
+        }
+
+        /* If the PHY general power-down bit is not set is not necessary to
+         * disable the general power down-mode.
+         */
+        if (rc & BMCR_PDOWN) {
+                rc = phy_write(pdata->phy_dev, MII_BMCR, rc & ~BMCR_PDOWN);
+                if (rc < 0) {
+                        SMSC_WARN(pdata, drv, "Failed writing PHY control reg");
+                        return rc;
+                }
+
+                usleep_range(1000, 1500);
+        }
+
+        return 0;
+}
+
 static int smsc911x_phy_disable_energy_detect(struct smsc911x_data *pdata)
 {
         int rc = 0;
@@ -1356,12 +1392,8 @@ static int smsc911x_phy_disable_energy_detect(struct smsc911x_data *pdata)
                 return rc;
         }
 
-        /*
-         * If energy is detected the PHY is already awake so is not necessary
-         * to disable the energy detect power-down mode.
-         */
-        if ((rc & MII_LAN83C185_EDPWRDOWN) &&
-            !(rc & MII_LAN83C185_ENERGYON)) {
+        /* Only disable if energy detect mode is already enabled */
+        if (rc & MII_LAN83C185_EDPWRDOWN) {
                 /* Disable energy detect mode for this SMSC Transceivers */
                 rc = phy_write(pdata->phy_dev, MII_LAN83C185_CTRL_STATUS,
                                rc & (~MII_LAN83C185_EDPWRDOWN));
@@ -1370,8 +1402,8 @@ static int smsc911x_phy_disable_energy_detect(struct smsc911x_data *pdata)
                         SMSC_WARN(pdata, drv, "Failed writing PHY control reg");
                         return rc;
                 }
-
-                mdelay(1);
+                /* Allow PHY to wakeup */
+                mdelay(2);
         }
 
         return 0;
@@ -1393,7 +1425,6 @@ static int smsc911x_phy_enable_energy_detect(struct smsc911x_data *pdata)
 
         /* Only enable if energy detect mode is already disabled */
         if (!(rc & MII_LAN83C185_EDPWRDOWN)) {
-                mdelay(100);
                 /* Enable energy detect mode for this SMSC Transceivers */
                 rc = phy_write(pdata->phy_dev, MII_LAN83C185_CTRL_STATUS,
                                rc | MII_LAN83C185_EDPWRDOWN);
@@ -1402,8 +1433,6 @@ static int smsc911x_phy_enable_energy_detect(struct smsc911x_data *pdata)
                         SMSC_WARN(pdata, drv, "Failed writing PHY control reg");
                         return rc;
                 }
-
-                mdelay(1);
         }
         return 0;
 }
@@ -1415,6 +1444,16 @@ static int smsc911x_soft_reset(struct smsc911x_data *pdata)
         int ret;
 
         /*
+         * Make sure to power-up the PHY chip before doing a reset, otherwise
+         * the reset fails.
+         */
+        ret = smsc911x_phy_general_power_up(pdata);
+        if (ret) {
+                SMSC_WARN(pdata, drv, "Failed to power-up the PHY chip");
+                return ret;
+        }
+
+        /*
          * LAN9210/LAN9211/LAN9220/LAN9221 chips have an internal PHY that
          * are initialized in a Energy Detect Power-Down mode that prevents
          * the MAC chip to be software reseted. So we have to wakeup the PHY
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 6f77a46c7e2c..18c46bb0f3bf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -276,6 +276,7 @@ static void stmmac_eee_ctrl_timer(unsigned long arg)
 bool stmmac_eee_init(struct stmmac_priv *priv)
 {
         char *phy_bus_name = priv->plat->phy_bus_name;
+        unsigned long flags;
         bool ret = false;
 
         /* Using PCS we cannot dial with the phy registers at this stage
@@ -300,6 +301,7 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                          * changed).
                          * In that case the driver disable own timers.
                          */
+                        spin_lock_irqsave(&priv->lock, flags);
                         if (priv->eee_active) {
                                 pr_debug("stmmac: disable EEE\n");
                                 del_timer_sync(&priv->eee_ctrl_timer);
@@ -307,9 +309,11 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                                                              tx_lpi_timer);
                         }
                         priv->eee_active = 0;
+                        spin_unlock_irqrestore(&priv->lock, flags);
                         goto out;
                 }
                 /* Activate the EEE and start timers */
+                spin_lock_irqsave(&priv->lock, flags);
                 if (!priv->eee_active) {
                         priv->eee_active = 1;
                         init_timer(&priv->eee_ctrl_timer);
@@ -325,9 +329,10 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                 /* Set HW EEE according to the speed */
                 priv->hw->mac->set_eee_pls(priv->hw, priv->phydev->link);
 
-                pr_debug("stmmac: Energy-Efficient Ethernet initialized\n");
-
                 ret = true;
+                spin_unlock_irqrestore(&priv->lock, flags);
+
+                pr_debug("stmmac: Energy-Efficient Ethernet initialized\n");
         }
 out:
         return ret;
@@ -760,12 +765,12 @@ static void stmmac_adjust_link(struct net_device *dev)
         if (new_state && netif_msg_link(priv))
                 phy_print_status(phydev);
 
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         /* At this stage, it could be needed to setup the EEE or adjust some
          * MAC related HW registers.
          */
         priv->eee_enabled = stmmac_eee_init(priv);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 /**
@@ -959,12 +964,12 @@ static void stmmac_clear_descriptors(struct stmmac_priv *priv)
 }
 
 static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
-                                  int i)
+                                  int i, gfp_t flags)
 {
         struct sk_buff *skb;
 
         skb = __netdev_alloc_skb(priv->dev, priv->dma_buf_sz + NET_IP_ALIGN,
-                                 GFP_KERNEL);
+                                 flags);
         if (!skb) {
                 pr_err("%s: Rx init fails; skb is NULL\n", __func__);
                 return -ENOMEM;
@@ -1006,7 +1011,7 @@ static void stmmac_free_rx_buffers(struct stmmac_priv *priv, int i)
  * and allocates the socket buffers. It suppors the chained and ring
  * modes.
  */
-static int init_dma_desc_rings(struct net_device *dev)
+static int init_dma_desc_rings(struct net_device *dev, gfp_t flags)
 {
         int i;
         struct stmmac_priv *priv = netdev_priv(dev);
@@ -1041,7 +1046,7 @@ static int init_dma_desc_rings(struct net_device *dev)
                 else
                         p = priv->dma_rx + i;
 
-                ret = stmmac_init_rx_buffers(priv, p, i);
+                ret = stmmac_init_rx_buffers(priv, p, i, flags);
                 if (ret)
                         goto err_init_rx_buffers;
 
@@ -1647,11 +1652,6 @@ static int stmmac_hw_setup(struct net_device *dev)
         struct stmmac_priv *priv = netdev_priv(dev);
         int ret;
 
-        ret = init_dma_desc_rings(dev);
-        if (ret < 0) {
-                pr_err("%s: DMA descriptors initialization failed\n", __func__);
-                return ret;
-        }
         /* DMA initialization and SW reset */
         ret = stmmac_init_dma_engine(priv);
         if (ret < 0) {
@@ -1705,10 +1705,6 @@ static int stmmac_hw_setup(struct net_device *dev)
         }
         priv->tx_lpi_timer = STMMAC_DEFAULT_TWT_LS;
 
-        priv->eee_enabled = stmmac_eee_init(priv);
-
-        stmmac_init_tx_coalesce(priv);
-
         if ((priv->use_riwt) && (priv->hw->dma->rx_watchdog)) {
                 priv->rx_riwt = MAX_DMA_RIWT;
                 priv->hw->dma->rx_watchdog(priv->ioaddr, MAX_DMA_RIWT);
@@ -1761,12 +1757,20 @@ static int stmmac_open(struct net_device *dev)
                 goto dma_desc_error;
         }
 
+        ret = init_dma_desc_rings(dev, GFP_KERNEL);
+        if (ret < 0) {
+                pr_err("%s: DMA descriptors initialization failed\n", __func__);
+                goto init_error;
+        }
+
         ret = stmmac_hw_setup(dev);
         if (ret < 0) {
                 pr_err("%s: Hw setup failed\n", __func__);
                 goto init_error;
         }
 
+        stmmac_init_tx_coalesce(priv);
+
         if (priv->phydev)
                 phy_start(priv->phydev);
 
@@ -1894,7 +1898,10 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         unsigned int nopaged_len = skb_headlen(skb);
         unsigned int enh_desc = priv->plat->enh_desc;
 
+        spin_lock(&priv->tx_lock);
+
         if (unlikely(stmmac_tx_avail(priv) < nfrags + 1)) {
+                spin_unlock(&priv->tx_lock);
                 if (!netif_queue_stopped(dev)) {
                         netif_stop_queue(dev);
                         /* This is a hard error, log it. */
@@ -1903,8 +1910,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
-        spin_lock(&priv->tx_lock);
-
         if (priv->tx_path_in_lpi_mode)
                 stmmac_disable_eee_mode(priv);
 
@@ -2025,6 +2030,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         return NETDEV_TX_OK;
 
 dma_map_err:
+        spin_unlock(&priv->tx_lock);
         dev_err(priv->device, "Tx dma map failed\n");
         dev_kfree_skb(skb);
         priv->dev->stats.tx_dropped++;
@@ -2281,9 +2287,7 @@ static void stmmac_set_rx_mode(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
 
-        spin_lock(&priv->lock);
         priv->hw->mac->set_filter(priv->hw, dev);
-        spin_unlock(&priv->lock);
 }
 
 /**
@@ -2950,7 +2954,7 @@ int stmmac_suspend(struct net_device *ndev)
                 stmmac_set_mac(priv->ioaddr, false);
                 pinctrl_pm_select_sleep_state(priv->device);
                 /* Disable clock in case of PWM is off */
-                clk_disable_unprepare(priv->stmmac_clk);
+                clk_disable(priv->stmmac_clk);
         }
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -2982,7 +2986,7 @@ int stmmac_resume(struct net_device *ndev)
         } else {
                 pinctrl_pm_select_default_state(priv->device);
                 /* enable the clk prevously disabled */
-                clk_prepare_enable(priv->stmmac_clk);
+                clk_enable(priv->stmmac_clk);
                 /* reset the phy so that it's ready */
                 if (priv->mii)
                         stmmac_mdio_reset(priv->mii);
@@ -2990,7 +2994,9 @@ int stmmac_resume(struct net_device *ndev)
 
         netif_device_attach(ndev);
 
+        init_dma_desc_rings(ndev, GFP_ATOMIC);
         stmmac_hw_setup(ndev);
+        stmmac_init_tx_coalesce(priv);
 
         napi_enable(&priv->napi);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index db56fa7ce8f9..5b0da3986216 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -177,12 +177,6 @@ static int stmmac_probe_config_dt(struct platform_device *pdev,
          */
         plat->maxmtu = JUMBO_LEN;
 
-        /* Set default value for multicast hash bins */
-        plat->multicast_filter_bins = HASH_TABLE_SIZE;
-
-        /* Set default value for unicast filter entries */
-        plat->unicast_filter_entries = 1;
-
         /*
          * Currently only the properties needed on SPEAr600
          * are provided. All other properties should be added
@@ -270,6 +264,13 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
                 return PTR_ERR(addr);
 
         plat_dat = dev_get_platdata(&pdev->dev);
+
+        /* Set default value for multicast hash bins */
+        plat_dat->multicast_filter_bins = HASH_TABLE_SIZE;
+
+        /* Set default value for unicast filter entries */
+        plat_dat->unicast_filter_entries = 1;
+
         if (pdev->dev.of_node) {
                 if (!plat_dat)
                         plat_dat = devm_kzalloc(&pdev->dev,
diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index 72c8525d5457..9c014803b03b 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -1262,6 +1262,7 @@ static void happy_meal_init_rings(struct happy_meal *hp)
         HMD(("init rxring, "));
         for (i = 0; i < RX_RING_SIZE; i++) {
                 struct sk_buff *skb;
+                u32 mapping;
 
                 skb = happy_meal_alloc_skb(RX_BUF_ALLOC_SIZE, GFP_ATOMIC);
                 if (!skb) {
@@ -1272,10 +1273,16 @@ static void happy_meal_init_rings(struct happy_meal *hp)
 
                 /* Because we reserve afterwards. */
                 skb_put(skb, (ETH_FRAME_LEN + RX_OFFSET + 4));
+                mapping = dma_map_single(hp->dma_dev, skb->data, RX_BUF_ALLOC_SIZE,
+                                         DMA_FROM_DEVICE);
+                if (dma_mapping_error(hp->dma_dev, mapping)) {
+                        dev_kfree_skb_any(skb);
+                        hme_write_rxd(hp, &hb->happy_meal_rxd[i], 0, 0);
+                        continue;
+                }
                 hme_write_rxd(hp, &hb->happy_meal_rxd[i],
                               (RXFLAG_OWN | ((RX_BUF_ALLOC_SIZE - RX_OFFSET) << 16)),
-                              dma_map_single(hp->dma_dev, skb->data, RX_BUF_ALLOC_SIZE,
-                                             DMA_FROM_DEVICE));
+                              mapping);
                 skb_reserve(skb, RX_OFFSET);
         }
 
@@ -2020,6 +2027,7 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev)
                 skb = hp->rx_skbs[elem];
                 if (len > RX_COPY_THRESHOLD) {
                         struct sk_buff *new_skb;
+                        u32 mapping;
 
                         /* Now refill the entry, if we can. */
                         new_skb = happy_meal_alloc_skb(RX_BUF_ALLOC_SIZE, GFP_ATOMIC);
@@ -2027,13 +2035,21 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev)
                                 drops++;
                                 goto drop_it;
                         }
+                        skb_put(new_skb, (ETH_FRAME_LEN + RX_OFFSET + 4));
+                        mapping = dma_map_single(hp->dma_dev, new_skb->data,
+                                                 RX_BUF_ALLOC_SIZE,
+                                                 DMA_FROM_DEVICE);
+                        if (unlikely(dma_mapping_error(hp->dma_dev, mapping))) {
+                                dev_kfree_skb_any(new_skb);
+                                drops++;
+                                goto drop_it;
+                        }
+
                         dma_unmap_single(hp->dma_dev, dma_addr, RX_BUF_ALLOC_SIZE, DMA_FROM_DEVICE);
                         hp->rx_skbs[elem] = new_skb;
-                        skb_put(new_skb, (ETH_FRAME_LEN + RX_OFFSET + 4));
                         hme_write_rxd(hp, this,
                                       (RXFLAG_OWN|((RX_BUF_ALLOC_SIZE-RX_OFFSET)<<16)),
-                                      dma_map_single(hp->dma_dev, new_skb->data, RX_BUF_ALLOC_SIZE,
-                                                     DMA_FROM_DEVICE));
+                                      mapping);
                         skb_reserve(new_skb, RX_OFFSET);
 
                         /* Trim the original skb for the netif. */
@@ -2248,6 +2264,25 @@ static void happy_meal_tx_timeout(struct net_device *dev)
         netif_wake_queue(dev);
 }
 
+static void unmap_partial_tx_skb(struct happy_meal *hp, u32 first_mapping,
+                                 u32 first_len, u32 first_entry, u32 entry)
+{
+        struct happy_meal_txd *txbase = &hp->happy_block->happy_meal_txd[0];
+
+        dma_unmap_single(hp->dma_dev, first_mapping, first_len, DMA_TO_DEVICE);
+
+        first_entry = NEXT_TX(first_entry);
+        while (first_entry != entry) {
+                struct happy_meal_txd *this = &txbase[first_entry];
+                u32 addr, len;
+
+                addr = hme_read_desc32(hp, &this->tx_addr);
+                len = hme_read_desc32(hp, &this->tx_flags);
+                len &= TXFLAG_SIZE;
+                dma_unmap_page(hp->dma_dev, addr, len, DMA_TO_DEVICE);
+        }
+}
+
 static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
                                          struct net_device *dev)
 {
@@ -2284,6 +2319,8 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
 
                 len = skb->len;
                 mapping = dma_map_single(hp->dma_dev, skb->data, len, DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(hp->dma_dev, mapping)))
+                        goto out_dma_error;
                 tx_flags |= (TXFLAG_SOP | TXFLAG_EOP);
                 hme_write_txd(hp, &hp->happy_block->happy_meal_txd[entry],
                               (tx_flags | (len & TXFLAG_SIZE)),
@@ -2299,6 +2336,8 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
                 first_len = skb_headlen(skb);
                 first_mapping = dma_map_single(hp->dma_dev, skb->data, first_len,
                                                DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(hp->dma_dev, first_mapping)))
+                        goto out_dma_error;
                 entry = NEXT_TX(entry);
 
                 for (frag = 0; frag < skb_shinfo(skb)->nr_frags; frag++) {
@@ -2308,6 +2347,11 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
                         len = skb_frag_size(this_frag);
                         mapping = skb_frag_dma_map(hp->dma_dev, this_frag,
                                                    0, len, DMA_TO_DEVICE);
+                        if (unlikely(dma_mapping_error(hp->dma_dev, mapping))) {
+                                unmap_partial_tx_skb(hp, first_mapping, first_len,
+                                                     first_entry, entry);
+                                goto out_dma_error;
+                        }
                         this_txflags = tx_flags;
                         if (frag == skb_shinfo(skb)->nr_frags - 1)
                                 this_txflags |= TXFLAG_EOP;
@@ -2333,6 +2377,14 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
 
         tx_add_log(hp, TXLOG_ACTION_TXMIT, 0);
         return NETDEV_TX_OK;
+
+out_dma_error:
+        hp->tx_skbs[hp->tx_new] = NULL;
+        spin_unlock_irq(&hp->happy_lock);
+
+        dev_kfree_skb_any(skb);
+        dev->stats.tx_dropped++;
+        return NETDEV_TX_OK;
 }
 
 static struct net_device_stats *happy_meal_get_stats(struct net_device *dev)
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index d8794488f80a..c560f9aeb55d 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -129,9 +129,9 @@ do {								\
 #define CPSW_VLAN_AWARE         BIT(1)
 #define CPSW_ALE_VLAN_AWARE     1
 
-#define CPSW_FIFO_NORMAL_MODE           (0 << 15)
-#define CPSW_FIFO_DUAL_MAC_MODE         (1 << 15)
-#define CPSW_FIFO_RATE_LIMIT_MODE       (2 << 15)
+#define CPSW_FIFO_NORMAL_MODE           (0 << 16)
+#define CPSW_FIFO_DUAL_MAC_MODE         (1 << 16)
+#define CPSW_FIFO_RATE_LIMIT_MODE       (2 << 16)
 
 #define CPSW_INTPACEEN          (0x3f << 16)
 #define CPSW_INTPRESCALE_MASK   (0x7FF << 0)
diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
index 3ae83879a75f..097ebe7077ac 100644
--- a/drivers/net/ethernet/ti/cpsw_ale.c
+++ b/drivers/net/ethernet/ti/cpsw_ale.c
@@ -785,7 +785,6 @@ int cpsw_ale_destroy(struct cpsw_ale *ale)
 {
         if (!ale)
                 return -EINVAL;
-        cpsw_ale_stop(ale);
         cpsw_ale_control_set(ale, 0, ALE_ENABLE, 0);
         kfree(ale);
         return 0;
diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
index ab92f67da035..4a4388b813ac 100644
--- a/drivers/net/ethernet/ti/cpts.c
+++ b/drivers/net/ethernet/ti/cpts.c
@@ -264,7 +264,7 @@ static int cpts_match(struct sk_buff *skb, unsigned int ptp_class,
 
         switch (ptp_class & PTP_CLASS_PMASK) {
         case PTP_CLASS_IPV4:
-                offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
+                offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
                 break;
         case PTP_CLASS_IPV6:
                 offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
diff --git a/drivers/net/ieee802154/fakehard.c b/drivers/net/ieee802154/fakehard.c
index 9ce854f43917..6cbc56ad9ff4 100644
--- a/drivers/net/ieee802154/fakehard.c
+++ b/drivers/net/ieee802154/fakehard.c
@@ -377,17 +377,20 @@ static int ieee802154fake_probe(struct platform_device *pdev)
 
         err = wpan_phy_register(phy);
         if (err)
-                goto out;
+                goto err_phy_reg;
 
         err = register_netdev(dev);
-        if (err < 0)
-                goto out;
+        if (err)
+                goto err_netdev_reg;
 
         dev_info(&pdev->dev, "Added ieee802154 HardMAC hardware\n");
         return 0;
 
-out:
-        unregister_netdev(dev);
+err_netdev_reg:
+        wpan_phy_unregister(phy);
+err_phy_reg:
+        free_netdev(dev);
+        wpan_phy_free(phy);
         return err;
 }
 
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 6f226de655a4..880cc090dc44 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -629,6 +629,8 @@ static void macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 vnet_hdr->flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
                 vnet_hdr->csum_start = skb_checksum_start_offset(skb);
+                if (vlan_tx_tag_present(skb))
+                        vnet_hdr->csum_start += VLAN_HLEN;
                 vnet_hdr->csum_offset = skb->csum_offset;
         } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
                 vnet_hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID;
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 2954052706e8..e22e602beef3 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -791,7 +791,7 @@ static int match(struct sk_buff *skb, unsigned int type, struct rxts *rxts)
 
         switch (type & PTP_CLASS_PMASK) {
         case PTP_CLASS_IPV4:
-                offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
+                offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
                 break;
         case PTP_CLASS_IPV6:
                 offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
@@ -934,7 +934,7 @@ static int is_sync(struct sk_buff *skb, int type)
 
         switch (type & PTP_CLASS_PMASK) {
         case PTP_CLASS_IPV4:
-                offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
+                offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
                 break;
         case PTP_CLASS_IPV6:
                 offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 1dfffdc9dfc3..767cd110f496 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -352,6 +352,7 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
 {
         struct mii_ioctl_data *mii_data = if_mii(ifr);
         u16 val = mii_data->val_in;
+        bool change_autoneg = false;
 
         switch (cmd) {
         case SIOCGMIIPHY:
@@ -367,22 +368,29 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
                 if (mii_data->phy_id == phydev->addr) {
                         switch (mii_data->reg_num) {
                         case MII_BMCR:
-                                if ((val & (BMCR_RESET | BMCR_ANENABLE)) == 0)
+                                if ((val & (BMCR_RESET | BMCR_ANENABLE)) == 0) {
+                                        if (phydev->autoneg == AUTONEG_ENABLE)
+                                                change_autoneg = true;
                                         phydev->autoneg = AUTONEG_DISABLE;
-                                else
+                                        if (val & BMCR_FULLDPLX)
+                                                phydev->duplex = DUPLEX_FULL;
+                                        else
+                                                phydev->duplex = DUPLEX_HALF;
+                                        if (val & BMCR_SPEED1000)
+                                                phydev->speed = SPEED_1000;
+                                        else if (val & BMCR_SPEED100)
+                                                phydev->speed = SPEED_100;
+                                        else phydev->speed = SPEED_10;
+                                }
+                                else {
+                                        if (phydev->autoneg == AUTONEG_DISABLE)
+                                                change_autoneg = true;
                                         phydev->autoneg = AUTONEG_ENABLE;
-                                if (!phydev->autoneg && (val & BMCR_FULLDPLX))
-                                        phydev->duplex = DUPLEX_FULL;
-                                else
-                                        phydev->duplex = DUPLEX_HALF;
-                                if (!phydev->autoneg && (val & BMCR_SPEED1000))
-                                        phydev->speed = SPEED_1000;
-                                else if (!phydev->autoneg &&
-                                         (val & BMCR_SPEED100))
-                                        phydev->speed = SPEED_100;
+                                }
                                 break;
                         case MII_ADVERTISE:
-                                phydev->advertising = val;
+                                phydev->advertising = mii_adv_to_ethtool_adv_t(val);
+                                change_autoneg = true;
                                 break;
                         default:
                                 /* do nothing */
@@ -396,6 +404,10 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
                 if (mii_data->reg_num == MII_BMCR &&
                     val & BMCR_RESET)
                         return phy_init_hw(phydev);
+
+                if (change_autoneg)
+                        return phy_start_aneg(phydev);
+
                 return 0;
 
         case SIOCSHWTSTAMP:
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 68c3a3f4e0ab..794a47329368 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -755,23 +755,23 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
                 err = get_filter(argp, &code);
                 if (err >= 0) {
+                        struct bpf_prog *pass_filter = NULL;
                         struct sock_fprog_kern fprog = {
                                 .len = err,
                                 .filter = code,
                         };
 
-                        ppp_lock(ppp);
-                        if (ppp->pass_filter) {
-                                bpf_prog_destroy(ppp->pass_filter);
-                                ppp->pass_filter = NULL;
+                        err = 0;
+                        if (fprog.filter)
+                                err = bpf_prog_create(&pass_filter, &fprog);
+                        if (!err) {
+                                ppp_lock(ppp);
+                                if (ppp->pass_filter)
+                                        bpf_prog_destroy(ppp->pass_filter);
+                                ppp->pass_filter = pass_filter;
+                                ppp_unlock(ppp);
                         }
-                        if (fprog.filter != NULL)
-                                err = bpf_prog_create(&ppp->pass_filter,
-                                                      &fprog);
-                        else
-                                err = 0;
                         kfree(code);
-                        ppp_unlock(ppp);
                 }
                 break;
         }
@@ -781,23 +781,23 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
                 err = get_filter(argp, &code);
                 if (err >= 0) {
+                        struct bpf_prog *active_filter = NULL;
                         struct sock_fprog_kern fprog = {
                                 .len = err,
                                 .filter = code,
                         };
 
-                        ppp_lock(ppp);
-                        if (ppp->active_filter) {
-                                bpf_prog_destroy(ppp->active_filter);
-                                ppp->active_filter = NULL;
+                        err = 0;
+                        if (fprog.filter)
+                                err = bpf_prog_create(&active_filter, &fprog);
+                        if (!err) {
+                                ppp_lock(ppp);
+                                if (ppp->active_filter)
+                                        bpf_prog_destroy(ppp->active_filter);
+                                ppp->active_filter = active_filter;
+                                ppp_unlock(ppp);
                         }
-                        if (fprog.filter != NULL)
-                                err = bpf_prog_create(&ppp->active_filter,
-                                                      &fprog);
-                        else
-                                err = 0;
                         kfree(code);
-                        ppp_unlock(ppp);
                 }
                 break;
         }
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 1aff970be33e..1dc628ffce2b 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -506,7 +506,9 @@ static int pptp_getname(struct socket *sock, struct sockaddr *uaddr,
         int len = sizeof(struct sockaddr_pppox);
         struct sockaddr_pppox sp;
 
-        sp.sa_family      = AF_PPPOX;
+        memset(&sp.sa_addr, 0, sizeof(sp.sa_addr));
+
+        sp.sa_family    = AF_PPPOX;
         sp.sa_protocol  = PX_PROTO_PPTP;
         sp.sa_addr.pptp = pppox_sk(sock->sk)->proto.pptp.src_addr;
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7302398f0b1f..9dd3746994a4 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1235,12 +1235,20 @@ static ssize_t tun_put_user(struct tun_struct *tun,
         struct tun_pi pi = { 0, skb->protocol };
         ssize_t total = 0;
         int vlan_offset = 0, copied;
+        int vlan_hlen = 0;
+        int vnet_hdr_sz = 0;
+
+        if (vlan_tx_tag_present(skb))
+                vlan_hlen = VLAN_HLEN;
+
+        if (tun->flags & TUN_VNET_HDR)
+                vnet_hdr_sz = tun->vnet_hdr_sz;
 
         if (!(tun->flags & TUN_NO_PI)) {
                 if ((len -= sizeof(pi)) < 0)
                         return -EINVAL;
 
-                if (len < skb->len) {
+                if (len < skb->len + vlan_hlen + vnet_hdr_sz) {
                         /* Packet will be striped */
                         pi.flags |= TUN_PKT_STRIP;
                 }
@@ -1250,9 +1258,9 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 total += sizeof(pi);
         }
 
-        if (tun->flags & TUN_VNET_HDR) {
+        if (vnet_hdr_sz) {
                 struct virtio_net_hdr gso = { 0 }; /* no info leak */
-                if ((len -= tun->vnet_hdr_sz) < 0)
+                if ((len -= vnet_hdr_sz) < 0)
                         return -EINVAL;
 
                 if (skb_is_gso(skb)) {
@@ -1284,7 +1292,8 @@ static ssize_t tun_put_user(struct tun_struct *tun,
 
                 if (skb->ip_summed == CHECKSUM_PARTIAL) {
                         gso.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
-                        gso.csum_start = skb_checksum_start_offset(skb);
+                        gso.csum_start = skb_checksum_start_offset(skb) +
+                                         vlan_hlen;
                         gso.csum_offset = skb->csum_offset;
                 } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
                         gso.flags = VIRTIO_NET_HDR_F_DATA_VALID;
@@ -1293,14 +1302,13 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 if (unlikely(memcpy_toiovecend(iv, (void *)&gso, total,
                                                sizeof(gso))))
                         return -EFAULT;
-                total += tun->vnet_hdr_sz;
+                total += vnet_hdr_sz;
         }
 
         copied = total;
-        total += skb->len;
-        if (!vlan_tx_tag_present(skb)) {
-                len = min_t(int, skb->len, len);
-        } else {
+        len = min_t(int, skb->len + vlan_hlen, len);
+        total += skb->len + vlan_hlen;
+        if (vlan_hlen) {
                 int copy, ret;
                 struct {
                         __be16 h_vlan_proto;
@@ -1311,8 +1319,6 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 veth.h_vlan_TCI = htons(vlan_tx_tag_get(skb));
 
                 vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);
-                len = min_t(int, skb->len + VLAN_HLEN, len);
-                total += VLAN_HLEN;
 
                 copy = min_t(int, vlan_offset, len);
                 ret = skb_copy_datagram_const_iovec(skb, 0, iv, copied, copy);
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 2c05f6cdb12f..816d511e34d3 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -465,19 +465,7 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
                 return ret;
         }
 
-        ret = asix_sw_reset(dev, AX_SWRESET_IPPD | AX_SWRESET_PRL);
-        if (ret < 0)
-                return ret;
-
-        msleep(150);
-
-        ret = asix_sw_reset(dev, AX_SWRESET_CLEAR);
-        if (ret < 0)
-                return ret;
-
-        msleep(150);
-
-        ret = asix_sw_reset(dev, embd_phy ? AX_SWRESET_IPRL : AX_SWRESET_PRTE);
+        ax88772_reset(dev);
 
         /* Read PHYID register *AFTER* the PHY was reset properly */
         phyid = asix_get_phyid(dev);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 22756db53dca..b8a82b86f909 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -780,6 +780,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x413c, 0x81a4, 8)},    /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81a8, 8)},    /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x03f0, 0x581d, 4)},    /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */
 
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index ec2a8b41ed41..b0bc8ead47de 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1673,6 +1673,40 @@ static const struct attribute_group virtio_net_mrg_rx_group = {
 };
 #endif
 
+static bool virtnet_fail_on_feature(struct virtio_device *vdev,
+                                    unsigned int fbit,
+                                    const char *fname, const char *dname)
+{
+        if (!virtio_has_feature(vdev, fbit))
+                return false;
+
+        dev_err(&vdev->dev, "device advertises feature %s but not %s",
+                fname, dname);
+
+        return true;
+}
+
+#define VIRTNET_FAIL_ON(vdev, fbit, dbit)                       \
+        virtnet_fail_on_feature(vdev, fbit, #fbit, dbit)
+
+static bool virtnet_validate_features(struct virtio_device *vdev)
+{
+        if (!virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ) &&
+            (VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_RX,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_VLAN,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_GUEST_ANNOUNCE,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_MQ, "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_MAC_ADDR,
+                             "VIRTIO_NET_F_CTRL_VQ"))) {
+                return false;
+        }
+
+        return true;
+}
+
 static int virtnet_probe(struct virtio_device *vdev)
 {
         int i, err;
@@ -1680,6 +1714,9 @@ static int virtnet_probe(struct virtio_device *vdev)
         struct virtnet_info *vi;
         u16 max_queue_pairs;
 
+        if (!virtnet_validate_features(vdev))
+                return -EINVAL;
+
         /* Find if host supports multiqueue virtio_net device */
         err = virtio_cread_feature(vdev, VIRTIO_NET_F_MQ,
                                    struct virtio_net_config,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index ca309820d39e..be4649a49c5e 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -67,12 +67,6 @@
 
 #define VXLAN_FLAGS 0x08000000  /* struct vxlanhdr.vx_flags required value. */
 
-/* VXLAN protocol header */
-struct vxlanhdr {
-        __be32 vx_flags;
-        __be32 vx_vni;
-};
-
 /* UDP port for VXLAN traffic.
  * The IANA assigned port is 4789, but the Linux default is 8472
  * for compatibility with early adopters.
@@ -275,13 +269,15 @@ static inline struct vxlan_rdst *first_remote_rtnl(struct vxlan_fdb *fdb)
         return list_first_entry(&fdb->remotes, struct vxlan_rdst, list);
 }
 
-/* Find VXLAN socket based on network namespace and UDP port */
-static struct vxlan_sock *vxlan_find_sock(struct net *net, __be16 port)
+/* Find VXLAN socket based on network namespace, address family and UDP port */
+static struct vxlan_sock *vxlan_find_sock(struct net *net,
+                                          sa_family_t family, __be16 port)
 {
         struct vxlan_sock *vs;
 
         hlist_for_each_entry_rcu(vs, vs_head(net, port), hlist) {
-                if (inet_sk(vs->sock->sk)->inet_sport == port)
+                if (inet_sk(vs->sock->sk)->inet_sport == port &&
+                    inet_sk(vs->sock->sk)->sk.sk_family == family)
                         return vs;
         }
         return NULL;
@@ -300,11 +296,12 @@ static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, u32 id)
 }
 
 /* Look up VNI in a per net namespace table */
-static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id, __be16 port)
+static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id,
+                                        sa_family_t family, __be16 port)
 {
         struct vxlan_sock *vs;
 
-        vs = vxlan_find_sock(net, port);
+        vs = vxlan_find_sock(net, family, port);
         if (!vs)
                 return NULL;
 
@@ -621,6 +618,8 @@ static int vxlan_gro_complete(struct sk_buff *skb, int nhoff)
         int vxlan_len  = sizeof(struct vxlanhdr) + sizeof(struct ethhdr);
         int err = -ENOSYS;
 
+        udp_tunnel_gro_complete(skb, nhoff);
+
         eh = (struct ethhdr *)(skb->data + nhoff + sizeof(struct vxlanhdr));
         type = eh->h_proto;
 
@@ -1771,7 +1770,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                         struct vxlan_dev *dst_vxlan;
 
                         ip_rt_put(rt);
-                        dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port);
+                        dst_vxlan = vxlan_find_vni(vxlan->net, vni,
+                                                   dst->sa.sa_family, dst_port);
                         if (!dst_vxlan)
                                 goto tx_error;
                         vxlan_encap_bypass(skb, vxlan, dst_vxlan);
@@ -1825,7 +1825,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                         struct vxlan_dev *dst_vxlan;
 
                         dst_release(ndst);
-                        dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port);
+                        dst_vxlan = vxlan_find_vni(vxlan->net, vni,
+                                                   dst->sa.sa_family, dst_port);
                         if (!dst_vxlan)
                                 goto tx_error;
                         vxlan_encap_bypass(skb, vxlan, dst_vxlan);
@@ -1985,13 +1986,15 @@ static int vxlan_init(struct net_device *dev)
         struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
         struct vxlan_sock *vs;
+        bool ipv6 = vxlan->flags & VXLAN_F_IPV6;
 
         dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
 
         spin_lock(&vn->sock_lock);
-        vs = vxlan_find_sock(vxlan->net, vxlan->dst_port);
+        vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
+                             vxlan->dst_port);
         if (vs) {
                 /* If we have a socket with same port already, reuse it */
                 atomic_inc(&vs->refcnt);
@@ -2303,9 +2306,9 @@ static struct socket *vxlan_create_sock(struct net *net, bool ipv6,
         if (ipv6) {
                 udp_conf.family = AF_INET6;
                 udp_conf.use_udp6_tx_checksums =
-                    !!(flags & VXLAN_F_UDP_ZERO_CSUM6_TX);
+                    !(flags & VXLAN_F_UDP_ZERO_CSUM6_TX);
                 udp_conf.use_udp6_rx_checksums =
-                    !!(flags & VXLAN_F_UDP_ZERO_CSUM6_RX);
+                    !(flags & VXLAN_F_UDP_ZERO_CSUM6_RX);
         } else {
                 udp_conf.family = AF_INET;
                 udp_conf.local_ip.s_addr = INADDR_ANY;
@@ -2382,6 +2385,7 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
 {
         struct vxlan_net *vn = net_generic(net, vxlan_net_id);
         struct vxlan_sock *vs;
+        bool ipv6 = flags & VXLAN_F_IPV6;
 
         vs = vxlan_socket_create(net, port, rcv, data, flags);
         if (!IS_ERR(vs))
@@ -2391,7 +2395,7 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
                 return vs;
 
         spin_lock(&vn->sock_lock);
-        vs = vxlan_find_sock(net, port);
+        vs = vxlan_find_sock(net, ipv6 ? AF_INET6 : AF_INET, port);
         if (vs) {
                 if (vs->rcv == rcv)
                         atomic_inc(&vs->refcnt);
@@ -2550,7 +2554,8 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
             nla_get_u8(data[IFLA_VXLAN_UDP_ZERO_CSUM6_RX]))
                 vxlan->flags |= VXLAN_F_UDP_ZERO_CSUM6_RX;
 
-        if (vxlan_find_vni(net, vni, vxlan->dst_port)) {
+        if (vxlan_find_vni(net, vni, use_ipv6 ? AF_INET6 : AF_INET,
+                           vxlan->dst_port)) {
                 pr_info("duplicate VNI %u\n", vni);
                 return -EEXIST;
         }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 697c4ae90af0..1e8ea5e4d4ca 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -664,6 +664,19 @@ static void ar9003_hw_override_ini(struct ath_hw *ah)
                 ah->enabled_cals |= TX_CL_CAL;
         else
                 ah->enabled_cals &= ~TX_CL_CAL;
+
+        if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
+                if (ah->is_clk_25mhz) {
+                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
+                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
+                        REG_WRITE(ah, AR_SLP32_INC, 0x0001e7ae);
+                } else {
+                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
+                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
+                        REG_WRITE(ah, AR_SLP32_INC, 0x0001e800);
+                }
+                udelay(100);
+        }
 }
 
 static void ar9003_hw_prog_ini(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 8be4b1453394..2ad605760e21 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -861,19 +861,6 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
         udelay(RTC_PLL_SETTLE_DELAY);
 
         REG_WRITE(ah, AR_RTC_SLEEP_CLK, AR_RTC_FORCE_DERIVED_CLK);
-
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
-                if (ah->is_clk_25mhz) {
-                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
-                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
-                        REG_WRITE(ah,  AR_SLP32_INC, 0x0001e7ae);
-                } else {
-                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
-                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
-                        REG_WRITE(ah,  AR_SLP32_INC, 0x0001e800);
-                }
-                udelay(100);
-        }
 }
 
 static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 30c66dfcd7a0..4f18a6be0c7d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -974,9 +974,8 @@ void ath9k_calculate_iter_data(struct ath_softc *sc,
         struct ath_vif *avp;
 
         /*
-         * Pick the MAC address of the first interface as the new hardware
-         * MAC address. The hardware will use it together with the BSSID mask
-         * when matching addresses.
+         * The hardware will use primary station addr together with the
+         * BSSID mask when matching addresses.
          */
         memset(iter_data, 0, sizeof(*iter_data));
         memset(&iter_data->mask, 0xff, ETH_ALEN);
@@ -1205,6 +1204,8 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 list_add_tail(&avp->list, &avp->chanctx->vifs);
         }
 
+        ath9k_calculate_summary_state(sc, avp->chanctx);
+
         ath9k_assign_hw_queues(hw, vif);
 
         an->sc = sc;
@@ -1274,6 +1275,8 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
 
         ath_tx_node_cleanup(sc, &avp->mcast_node);
 
+        ath9k_calculate_summary_state(sc, avp->chanctx);
+
         mutex_unlock(&sc->mutex);
 }
 
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 1dfc682a8055..ee27b06074e1 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -300,9 +300,7 @@ void b43_phy_write(struct b43_wldev *dev, u16 reg, u16 value)
 
 void b43_phy_copy(struct b43_wldev *dev, u16 destreg, u16 srcreg)
 {
-        assert_mac_suspended(dev);
-        dev->phy.ops->phy_write(dev, destreg,
-                dev->phy.ops->phy_read(dev, srcreg));
+        b43_phy_write(dev, destreg, b43_phy_read(dev, srcreg));
 }
 
 void b43_phy_mask(struct b43_wldev *dev, u16 offset, u16 mask)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/of.c b/drivers/net/wireless/brcm80211/brcmfmac/of.c
index f05f5270fec1..927bffd5be64 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/of.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/of.c
@@ -40,8 +40,8 @@ void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
                 return;
 
         irq = irq_of_parse_and_map(np, 0);
-        if (irq < 0) {
-                brcmf_err("interrupt could not be mapped: err=%d\n", irq);
+        if (!irq) {
+                brcmf_err("interrupt could not be mapped\n");
                 devm_kfree(dev, sdiodev->pdata);
                 return;
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index 8c0632ec9f7a..16fef3382019 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -19,10 +19,10 @@
 #include <linux/pci.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
-#include <linux/unaligned/access_ok.h>
 #include <linux/interrupt.h>
 #include <linux/bcma/bcma.h>
 #include <linux/sched.h>
+#include <asm/unaligned.h>
 
 #include <soc.h>
 #include <chipcommon.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index dc135915470d..875d1142c8b0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -669,10 +669,12 @@ static int brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
                 goto finalize;
         }
 
-        if (!brcmf_usb_ioctl_resp_wait(devinfo))
+        if (!brcmf_usb_ioctl_resp_wait(devinfo)) {
+                usb_kill_urb(devinfo->ctl_urb);
                 ret = -ETIMEDOUT;
-        else
+        } else {
                 memcpy(buffer, tmpbuf, buflen);
+        }
 
 finalize:
         kfree(tmpbuf);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 28fa25b509db..39b45c038a93 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -299,6 +299,7 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
         primary_offset = ch->center_freq1 - ch->chan->center_freq;
         switch (ch->width) {
         case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_20_NOHT:
                 ch_inf.bw = BRCMU_CHAN_BW_20;
                 WARN_ON(primary_offset != 0);
                 break;
@@ -323,6 +324,10 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
                                 ch_inf.sb = BRCMU_CHAN_SB_LU;
                 }
                 break;
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_160:
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
         default:
                 WARN_ON_ONCE(1);
         }
@@ -333,6 +338,7 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
         case IEEE80211_BAND_5GHZ:
                 ch_inf.band = BRCMU_CHAN_BAND_5G;
                 break;
+        case IEEE80211_BAND_60GHZ:
         default:
                 WARN_ON_ONCE(1);
         }
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index 4f6e66892acc..b894a84e8393 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -155,6 +155,7 @@ enum iwl_ucode_tlv_api {
  * @IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT: supports Quiet Period requests
  * @IWL_UCODE_TLV_CAPA_DQA_SUPPORT: supports dynamic queue allocation (DQA),
  *      which also implies support for the scheduler configuration command
+ * @IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT: supports Hot Spot Command
  */
 enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_D0I3_SUPPORT                 = BIT(0),
@@ -163,6 +164,7 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT       = BIT(10),
         IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT         = BIT(11),
         IWL_UCODE_TLV_CAPA_DQA_SUPPORT                  = BIT(12),
+        IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT              = BIT(18),
 };
 
 /* The default calibrate table size if not specified by firmware file */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index e0d9f19650b0..eb03943f8463 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -284,7 +284,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (WARN_ON_ONCE(mvm->init_ucode_complete))
+        if (WARN_ON_ONCE(mvm->init_ucode_complete || mvm->calibrating))
                 return 0;
 
         iwl_init_notification_wait(&mvm->notif_wait,
@@ -334,6 +334,8 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                 goto out;
         }
 
+        mvm->calibrating = true;
+
         /* Send TX valid antennas before triggering calibrations */
         ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
         if (ret)
@@ -358,11 +360,17 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                         MVM_UCODE_CALIB_TIMEOUT);
         if (!ret)
                 mvm->init_ucode_complete = true;
+
+        if (ret && iwl_mvm_is_radio_killed(mvm)) {
+                IWL_DEBUG_RF_KILL(mvm, "RFKILL while calibrating.\n");
+                ret = 1;
+        }
         goto out;
 
 error:
         iwl_remove_notification(&mvm->notif_wait, &calib_wait);
 out:
+        mvm->calibrating = false;
         if (iwlmvm_mod_params.init_dbg && !mvm->nvm_data) {
                 /* we want to debug INIT and we have no NVM - fake */
                 mvm->nvm_data = kzalloc(sizeof(struct iwl_nvm_data) +
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 585fe5b7100f..b6d2683da3a9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -788,6 +788,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
 
         mvm->scan_status = IWL_MVM_SCAN_NONE;
         mvm->ps_disabled = false;
+        mvm->calibrating = false;
 
         /* just in case one was running */
         ieee80211_remain_on_channel_expired(mvm->hw);
@@ -2447,9 +2448,15 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
 
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
-                /* Use aux roc framework (HS20) */
-                ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
-                                               vif, duration);
+                if (mvm->fw->ucode_capa.capa[0] &
+                    IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT) {
+                        /* Use aux roc framework (HS20) */
+                        ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
+                                                       vif, duration);
+                        goto out_unlock;
+                }
+                IWL_ERR(mvm, "hotspot not supported\n");
+                ret = -EINVAL;
                 goto out_unlock;
         case NL80211_IFTYPE_P2P_DEVICE:
                 /* handle below */
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index b153ced7015b..845429c88cf4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -548,6 +548,7 @@ struct iwl_mvm {
         enum iwl_ucode_type cur_ucode;
         bool ucode_loaded;
         bool init_ucode_complete;
+        bool calibrating;
         u32 error_event_table;
         u32 log_event_table;
         u32 umac_error_event_table;
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 48cb25a93591..5b719ee8e789 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -424,6 +424,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         }
         mvm->sf_state = SF_UNINIT;
         mvm->low_latency_agg_frame_limit = 6;
+        mvm->cur_ucode = IWL_UCODE_INIT;
 
         mutex_init(&mvm->mutex);
         mutex_init(&mvm->d0i3_suspend_mutex);
@@ -752,6 +753,7 @@ void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state)
 static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+        bool calibrating = ACCESS_ONCE(mvm->calibrating);
 
         if (state)
                 set_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
@@ -760,7 +762,15 @@ static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 
         wiphy_rfkill_set_hw_state(mvm->hw->wiphy, iwl_mvm_is_radio_killed(mvm));
 
-        return state && mvm->cur_ucode != IWL_UCODE_INIT;
+        /* iwl_run_init_mvm_ucode is waiting for results, abort it */
+        if (calibrating)
+                iwl_abort_notification_waits(&mvm->notif_wait);
+
+        /*
+         * Stop the device if we run OPERATIONAL firmware or if we are in the
+         * middle of the calibrations.
+         */
+        return state && (mvm->cur_ucode != IWL_UCODE_INIT || calibrating);
 }
 
 static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index b280d5d87127..7554f7053830 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -602,16 +602,6 @@ static int iwl_mvm_cancel_regular_scan(struct iwl_mvm *mvm)
                                                SCAN_COMPLETE_NOTIFICATION };
         int ret;
 
-        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
-                return 0;
-
-        if (iwl_mvm_is_radio_killed(mvm)) {
-                ieee80211_scan_completed(mvm->hw, true);
-                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
-                mvm->scan_status = IWL_MVM_SCAN_NONE;
-                return 0;
-        }
-
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
                                    scan_abort_notif,
                                    ARRAY_SIZE(scan_abort_notif),
@@ -1400,6 +1390,16 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
 
 int iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
 {
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return 0;
+
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ieee80211_scan_completed(mvm->hw, true);
+                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
+                mvm->scan_status = IWL_MVM_SCAN_NONE;
+                return 0;
+        }
+
         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN)
                 return iwl_mvm_scan_offload_stop(mvm, true);
         return iwl_mvm_cancel_regular_scan(mvm);
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 3781b029e54a..dd2f3f8baa9d 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -915,7 +915,8 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
          * restart. So don't process again if the device is
          * already dead.
          */
-        if (test_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+        if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+                IWL_DEBUG_INFO(trans, "DEVICE_ENABLED bit was set and is now cleared\n");
                 iwl_pcie_tx_stop(trans);
                 iwl_pcie_rx_stop(trans);
 
@@ -945,7 +946,6 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
         /* clear all status bits */
         clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
         clear_bit(STATUS_INT_ENABLED, &trans->status);
-        clear_bit(STATUS_DEVICE_ENABLED, &trans->status);
         clear_bit(STATUS_TPOWER_PMI, &trans->status);
         clear_bit(STATUS_RFKILL, &trans->status);
 
@@ -1894,8 +1894,7 @@ static u32 iwl_trans_pcie_dump_prph(struct iwl_trans *trans,
                 int reg;
                 __le32 *val;
 
-                prph_len += sizeof(*data) + sizeof(*prph) +
-                        num_bytes_in_chunk;
+                prph_len += sizeof(**data) + sizeof(*prph) + num_bytes_in_chunk;
 
                 (*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_PRPH);
                 (*data)->len = cpu_to_le32(sizeof(*prph) +
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index babbdc1ce741..c9ad4cf1adfb 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1987,7 +1987,7 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         if (err != 0) {
                 printk(KERN_DEBUG "mac80211_hwsim: device_bind_driver failed (%d)\n",
                        err);
-                goto failed_hw;
+                goto failed_bind;
         }
 
         skb_queue_head_init(&data->pending);
@@ -2183,6 +2183,8 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         return idx;
 
 failed_hw:
+        device_release_driver(data->dev);
+failed_bind:
         device_unregister(data->dev);
 failed_drvdata:
         ieee80211_free_hw(hw);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 8e68f87ab13c..66ff36447b94 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -158,55 +158,29 @@ void rt2x00queue_align_frame(struct sk_buff *skb)
         skb_trim(skb, frame_length);
 }
 
-void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
+/*
+ * H/W needs L2 padding between the header and the paylod if header size
+ * is not 4 bytes aligned.
+ */
+void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len)
 {
-        unsigned int payload_length = skb->len - header_length;
-        unsigned int header_align = ALIGN_SIZE(skb, 0);
-        unsigned int payload_align = ALIGN_SIZE(skb, header_length);
-        unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0;
+        unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
 
-        /*
-         * Adjust the header alignment if the payload needs to be moved more
-         * than the header.
-         */
-        if (payload_align > header_align)
-                header_align += 4;
-
-        /* There is nothing to do if no alignment is needed */
-        if (!header_align)
+        if (!l2pad)
                 return;
 
-        /* Reserve the amount of space needed in front of the frame */
-        skb_push(skb, header_align);
-
-        /*
-         * Move the header.
-         */
-        memmove(skb->data, skb->data + header_align, header_length);
-
-        /* Move the payload, if present and if required */
-        if (payload_length && payload_align)
-                memmove(skb->data + header_length + l2pad,
-                        skb->data + header_length + l2pad + payload_align,
-                        payload_length);
-
-        /* Trim the skb to the correct size */
-        skb_trim(skb, header_length + l2pad + payload_length);
+        skb_push(skb, l2pad);
+        memmove(skb->data, skb->data + l2pad, hdr_len);
 }
 
-void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
+void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len)
 {
-        /*
-         * L2 padding is only present if the skb contains more than just the
-         * IEEE 802.11 header.
-         */
-        unsigned int l2pad = (skb->len > header_length) ?
-                                L2PAD_SIZE(header_length) : 0;
+        unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
 
         if (!l2pad)
                 return;
 
-        memmove(skb->data + l2pad, skb->data, header_length);
+        memmove(skb->data + l2pad, skb->data, hdr_len);
         skb_pull(skb, l2pad);
 }
 
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 25daa8715219..846a2e6e34d8 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -842,7 +842,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         break;
                 }
                 /* handle command packet here */
-                if (rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
+                if (rtlpriv->cfg->ops->rx_command_packet &&
+                    rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
                                 dev_kfree_skb_any(skb);
                                 goto end;
                 }
@@ -1127,9 +1128,14 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
 
         __skb_queue_tail(&ring->queue, pskb);
 
-        rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, true, HW_DESC_OWN,
-                                    &temp_one);
-
+        if (rtlpriv->use_new_trx_flow) {
+                temp_one = 4;
+                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pbuffer_desc, true,
+                                            HW_DESC_OWN, (u8 *)&temp_one);
+        } else {
+                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, true, HW_DESC_OWN,
+                                            &temp_one);
+        }
         return;
 }
 
@@ -1370,9 +1376,9 @@ static void _rtl_pci_free_tx_ring(struct ieee80211_hw *hw,
         ring->desc = NULL;
         if (rtlpriv->use_new_trx_flow) {
                 pci_free_consistent(rtlpci->pdev,
-                                    sizeof(*ring->desc) * ring->entries,
+                                    sizeof(*ring->buffer_desc) * ring->entries,
                                     ring->buffer_desc, ring->buffer_desc_dma);
-                ring->desc = NULL;
+                ring->buffer_desc = NULL;
         }
 }
 
@@ -1543,7 +1549,6 @@ int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw)
                                                          true,
                                                          HW_DESC_TXBUFF_ADDR),
                                                  skb->len, PCI_DMA_TODEVICE);
-                                ring->idx = (ring->idx + 1) % ring->entries;
                                 kfree_skb(skb);
                                 ring->idx = (ring->idx + 1) % ring->entries;
                         }
@@ -2244,6 +2249,16 @@ int rtl_pci_probe(struct pci_dev *pdev,
         /*like read eeprom and so on */
         rtlpriv->cfg->ops->read_eeprom_info(hw);
 
+        if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Can't init_sw_vars\n");
+                err = -ENODEV;
+                goto fail3;
+        }
+        rtlpriv->cfg->ops->init_sw_leds(hw);
+
+        /*aspm */
+        rtl_pci_init_aspm(hw);
+
         /* Init mac80211 sw */
         err = rtl_init_core(hw);
         if (err) {
@@ -2259,16 +2274,6 @@ int rtl_pci_probe(struct pci_dev *pdev,
                 goto fail3;
         }
 
-        if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Can't init_sw_vars\n");
-                err = -ENODEV;
-                goto fail3;
-        }
-        rtlpriv->cfg->ops->init_sw_leds(hw);
-
-        /*aspm */
-        rtl_pci_init_aspm(hw);
-
         err = ieee80211_register_hw(hw);
         if (err) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 00e067044c08..5761d5b49e39 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -1201,6 +1201,9 @@ static int _rtl92se_set_media_status(struct ieee80211_hw *hw,
 
         }
 
+        if (type != NL80211_IFTYPE_AP &&
+            rtlpriv->mac80211.link_state < MAC80211_LINKED)
+                bt_msr = rtl_read_byte(rtlpriv, MSR) & ~MSR_LINK_MASK;
         rtl_write_byte(rtlpriv, (MSR), bt_msr);
 
         temp = rtl_read_dword(rtlpriv, TCR);
@@ -1262,6 +1265,7 @@ void rtl92se_enable_interrupt(struct ieee80211_hw *hw)
         rtl_write_dword(rtlpriv, INTA_MASK, rtlpci->irq_mask[0]);
         /* Support Bit 32-37(Assign as Bit 0-5) interrupt setting now */
         rtl_write_dword(rtlpriv, INTA_MASK + 4, rtlpci->irq_mask[1] & 0x3F);
+        rtlpci->irq_enabled = true;
 }
 
 void rtl92se_disable_interrupt(struct ieee80211_hw *hw)
@@ -1276,8 +1280,7 @@ void rtl92se_disable_interrupt(struct ieee80211_hw *hw)
         rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         rtl_write_dword(rtlpriv, INTA_MASK, 0);
         rtl_write_dword(rtlpriv, INTA_MASK + 4, 0);
-
-        synchronize_irq(rtlpci->pdev->irq);
+        rtlpci->irq_enabled = false;
 }
 
 static u8 _rtl92s_set_sysclk(struct ieee80211_hw *hw, u8 data)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
index 77c5b5f35244..4b4612fe2fdb 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
@@ -399,6 +399,8 @@ static bool _rtl92s_phy_sw_chnl_step_by_step(struct ieee80211_hw *hw,
                 case 2:
                         currentcmd = &postcommoncmd[*step];
                         break;
+                default:
+                        return true;
                 }
 
                 if (currentcmd->cmdid == CMDID_END) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index aadba29c167a..fb003868bdef 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -236,6 +236,19 @@ static void rtl92s_deinit_sw_vars(struct ieee80211_hw *hw)
         }
 }
 
+static bool rtl92se_is_tx_desc_closed(struct ieee80211_hw *hw, u8 hw_queue,
+                                      u16 index)
+{
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
+        u8 *entry = (u8 *)(&ring->desc[ring->idx]);
+        u8 own = (u8)rtl92se_get_desc(entry, true, HW_DESC_OWN);
+
+        if (own)
+                return false;
+        return true;
+}
+
 static struct rtl_hal_ops rtl8192se_hal_ops = {
         .init_sw_vars = rtl92s_init_sw_vars,
         .deinit_sw_vars = rtl92s_deinit_sw_vars,
@@ -269,6 +282,7 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .led_control = rtl92se_led_control,
         .set_desc = rtl92se_set_desc,
         .get_desc = rtl92se_get_desc,
+        .is_tx_desc_closed = rtl92se_is_tx_desc_closed,
         .tx_polling = rtl92se_tx_polling,
         .enable_hw_sec = rtl92se_enable_hw_security_config,
         .set_key = rtl92se_set_key,
@@ -306,6 +320,8 @@ static struct rtl_hal_cfg rtl92se_hal_cfg = {
         .maps[MAC_RCR_ACRC32] = RCR_ACRC32,
         .maps[MAC_RCR_ACF] = RCR_ACF,
         .maps[MAC_RCR_AAP] = RCR_AAP,
+        .maps[MAC_HIMR] = INTA_MASK,
+        .maps[MAC_HIMRE] = INTA_MASK + 4,
 
         .maps[EFUSE_TEST] = REG_EFUSE_TEST,
         .maps[EFUSE_CTRL] = REG_EFUSE_CTRL,
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
index 310d3163dc5b..8ec8200002c7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
@@ -3672,8 +3672,9 @@ static void rtl8821ae_update_hal_rate_mask(struct ieee80211_hw *hw,
                 mac->opmode == NL80211_IFTYPE_ADHOC)
                 macid = sta->aid + 1;
         if (wirelessmode == WIRELESS_MODE_N_5G ||
-            wirelessmode == WIRELESS_MODE_AC_5G)
-                ratr_bitmap = sta->supp_rates[NL80211_BAND_5GHZ];
+            wirelessmode == WIRELESS_MODE_AC_5G ||
+            wirelessmode == WIRELESS_MODE_A)
+                ratr_bitmap = sta->supp_rates[NL80211_BAND_5GHZ] << 4;
         else
                 ratr_bitmap = sta->supp_rates[NL80211_BAND_2GHZ];
 
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 4e56a27f9689..fab0d4b42f58 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -39,7 +39,7 @@ struct backend_info {
 static int connect_rings(struct backend_info *be, struct xenvif_queue *queue);
 static void connect(struct backend_info *be);
 static int read_xenbus_vif_flags(struct backend_info *be);
-static void backend_create_xenvif(struct backend_info *be);
+static int backend_create_xenvif(struct backend_info *be);
 static void unregister_hotplug_status_watch(struct backend_info *be);
 static void set_backend_state(struct backend_info *be,
                               enum xenbus_state state);
@@ -352,7 +352,9 @@ static int netback_probe(struct xenbus_device *dev,
         be->state = XenbusStateInitWait;
 
         /* This kicks hotplug scripts, so do it immediately. */
-        backend_create_xenvif(be);
+        err = backend_create_xenvif(be);
+        if (err)
+                goto fail;
 
         return 0;
 
@@ -397,19 +399,19 @@ static int netback_uevent(struct xenbus_device *xdev,
 }
 
 
-static void backend_create_xenvif(struct backend_info *be)
+static int backend_create_xenvif(struct backend_info *be)
 {
         int err;
         long handle;
         struct xenbus_device *dev = be->dev;
 
         if (be->vif != NULL)
-                return;
+                return 0;
 
         err = xenbus_scanf(XBT_NIL, dev->nodename, "handle", "%li", &handle);
         if (err != 1) {
                 xenbus_dev_fatal(dev, err, "reading handle");
-                return;
+                return (err < 0) ? err : -EINVAL;
         }
 
         be->vif = xenvif_alloc(&dev->dev, dev->otherend_id, handle);
@@ -417,10 +419,11 @@ static void backend_create_xenvif(struct backend_info *be)
                 err = PTR_ERR(be->vif);
                 be->vif = NULL;
                 xenbus_dev_fatal(dev, err, "creating interface");
-                return;
+                return err;
         }
 
         kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
+        return 0;
 }
 
 static void backend_disconnect(struct backend_info *be)
diff --git a/drivers/of/address.c b/drivers/of/address.c
index afdb78299f61..06af494184d6 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -450,6 +450,21 @@ static struct of_bus *of_match_bus(struct device_node *np)
         return NULL;
 }
 
+static int of_empty_ranges_quirk(void)
+{
+        if (IS_ENABLED(CONFIG_PPC)) {
+                /* To save cycles, we cache the result */
+                static int quirk_state = -1;
+
+                if (quirk_state < 0)
+                        quirk_state =
+                                of_machine_is_compatible("Power Macintosh") ||
+                                of_machine_is_compatible("MacRISC");
+                return quirk_state;
+        }
+        return false;
+}
+
 static int of_translate_one(struct device_node *parent, struct of_bus *bus,
                             struct of_bus *pbus, __be32 *addr,
                             int na, int ns, int pna, const char *rprop)
@@ -475,12 +490,10 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
          * This code is only enabled on powerpc. --gcl
          */
         ranges = of_get_property(parent, rprop, &rlen);
-#if !defined(CONFIG_PPC)
-        if (ranges == NULL) {
+        if (ranges == NULL && !of_empty_ranges_quirk()) {
                 pr_err("OF: no ranges; cannot translate\n");
                 return 1;
         }
-#endif /* !defined(CONFIG_PPC) */
         if (ranges == NULL || rlen == 0) {
                 offset = of_read_number(addr, na);
                 memset(addr, 0, pna * 4);
diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index f297891d8529..d4994177dec2 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -247,7 +247,7 @@ void of_node_release(struct kobject *kobj)
  * @allocflags: Allocation flags (typically pass GFP_KERNEL)
  *
  * Copy a property by dynamically allocating the memory of both the
- * property stucture and the property name & contents. The property's
+ * property structure and the property name & contents. The property's
  * flags have the OF_DYNAMIC bit set so that we can differentiate between
  * dynamically allocated properties and not.
  * Returns the newly allocated property or NULL on out of memory error.
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index d1ffca8b34ea..30e97bcc4f88 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -773,7 +773,7 @@ int __init early_init_dt_scan_chosen_serial(void)
         if (offset < 0)
                 return -ENODEV;
 
-        while (match->compatible) {
+        while (match->compatible[0]) {
                 unsigned long addr;
                 if (fdt_node_check_compatible(fdt, offset, match->compatible)) {
                         match++;
diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c
index 11b873c54a77..e2d79afa9dc6 100644
--- a/drivers/of/selftest.c
+++ b/drivers/of/selftest.c
@@ -896,10 +896,14 @@ static void selftest_data_remove(void)
                 return;
         }
 
-        while (last_node_index >= 0) {
+        while (last_node_index-- > 0) {
                 if (nodes[last_node_index]) {
                         np = of_find_node_by_path(nodes[last_node_index]->full_name);
-                        if (strcmp(np->full_name, "/aliases") != 0) {
+                        if (np == nodes[last_node_index]) {
+                                if (of_aliases == np) {
+                                        of_node_put(of_aliases);
+                                        of_aliases = NULL;
+                                }
                                 detach_node_and_children(np);
                         } else {
                                 for_each_property_of_node(np, prop) {
@@ -908,7 +912,6 @@ static void selftest_data_remove(void)
                                 }
                         }
                 }
-                last_node_index--;
         }
 }
 
@@ -921,6 +924,8 @@ static int __init of_selftest(void)
         res = selftest_data_add();
         if (res)
                 return res;
+        if (!of_aliases)
+                of_aliases = of_find_node_by_path("/aliases");
 
         np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a");
         if (!np) {
diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index d292d7cb3417..49dd766852ba 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -444,7 +444,7 @@ static inline int pcie_cap_version(const struct pci_dev *dev)
         return pcie_caps_reg(dev) & PCI_EXP_FLAGS_VERS;
 }
 
-static inline bool pcie_cap_has_lnkctl(const struct pci_dev *dev)
+bool pcie_cap_has_lnkctl(const struct pci_dev *dev)
 {
         int type = pci_pcie_type(dev);
 
diff --git a/drivers/pci/host/pci-xgene.c b/drivers/pci/host/pci-xgene.c
index 9ecabfa8c634..2988fe136c1e 100644
--- a/drivers/pci/host/pci-xgene.c
+++ b/drivers/pci/host/pci-xgene.c
@@ -631,10 +631,15 @@ static int xgene_pcie_probe_bridge(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        bus = pci_scan_root_bus(&pdev->dev, 0, &xgene_pcie_ops, port, &res);
+        bus = pci_create_root_bus(&pdev->dev, 0,
+                                        &xgene_pcie_ops, port, &res);
         if (!bus)
                 return -ENOMEM;
 
+        pci_scan_child_bus(bus);
+        pci_assign_unassigned_bus_resources(bus);
+        pci_bus_add_devices(bus);
+
         platform_set_drvdata(pdev, port);
         return 0;
 }
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 9fab30af0e75..084587d7cd13 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -590,6 +590,20 @@ static struct msi_desc *msi_setup_entry(struct pci_dev *dev)
         return entry;
 }
 
+static int msi_verify_entries(struct pci_dev *dev)
+{
+        struct msi_desc *entry;
+
+        list_for_each_entry(entry, &dev->msi_list, list) {
+                if (!dev->no_64bit_msi || !entry->msg.address_hi)
+                        continue;
+                dev_err(&dev->dev, "Device has broken 64-bit MSI but arch"
+                        " tried to assign one above 4G\n");
+                return -EIO;
+        }
+        return 0;
+}
+
 /**
  * msi_capability_init - configure device's MSI capability structure
  * @dev: pointer to the pci_dev data structure of MSI device function
@@ -627,6 +641,13 @@ static int msi_capability_init(struct pci_dev *dev, int nvec)
                 return ret;
         }
 
+        ret = msi_verify_entries(dev);
+        if (ret) {
+                msi_mask_irq(entry, mask, ~mask);
+                free_msi_irqs(dev);
+                return ret;
+        }
+
         ret = populate_msi_sysfs(dev);
         if (ret) {
                 msi_mask_irq(entry, mask, ~mask);
@@ -739,6 +760,11 @@ static int msix_capability_init(struct pci_dev *dev,
         if (ret)
                 goto out_avail;
 
+        /* Check if all MSI entries honor device restrictions */
+        ret = msi_verify_entries(dev);
+        if (ret)
+                goto out_free;
+
         /*
          * Some devices require MSI-X to be enabled before we can touch the
          * MSI-X registers.  We need to mask all the vectors to prevent
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 0601890db22d..4a3902d8e6fe 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -6,6 +6,8 @@
 
 extern const unsigned char pcie_link_speed[];
 
+bool pcie_cap_has_lnkctl(const struct pci_dev *dev);
+
 /* Functions internal to the PCI core code */
 
 int pci_create_sysfs_dev_files(struct pci_dev *pdev);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 5ed99309c758..c8ca98c2b480 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -407,15 +407,16 @@ static void pci_read_bridge_mmio_pref(struct pci_bus *child)
 {
         struct pci_dev *dev = child->self;
         u16 mem_base_lo, mem_limit_lo;
-        unsigned long base, limit;
+        u64 base64, limit64;
+        dma_addr_t base, limit;
         struct pci_bus_region region;
         struct resource *res;
 
         res = child->resource[2];
         pci_read_config_word(dev, PCI_PREF_MEMORY_BASE, &mem_base_lo);
         pci_read_config_word(dev, PCI_PREF_MEMORY_LIMIT, &mem_limit_lo);
-        base = ((unsigned long) mem_base_lo & PCI_PREF_RANGE_MASK) << 16;
-        limit = ((unsigned long) mem_limit_lo & PCI_PREF_RANGE_MASK) << 16;
+        base64 = (mem_base_lo & PCI_PREF_RANGE_MASK) << 16;
+        limit64 = (mem_limit_lo & PCI_PREF_RANGE_MASK) << 16;
 
         if ((mem_base_lo & PCI_PREF_RANGE_TYPE_MASK) == PCI_PREF_RANGE_TYPE_64) {
                 u32 mem_base_hi, mem_limit_hi;
@@ -429,17 +430,20 @@ static void pci_read_bridge_mmio_pref(struct pci_bus *child)
                  * this, just assume they are not being used.
                  */
                 if (mem_base_hi <= mem_limit_hi) {
-#if BITS_PER_LONG == 64
-                        base |= ((unsigned long) mem_base_hi) << 32;
-                        limit |= ((unsigned long) mem_limit_hi) << 32;
-#else
-                        if (mem_base_hi || mem_limit_hi) {
-                                dev_err(&dev->dev, "can't handle 64-bit address space for bridge\n");
-                                return;
-                        }
-#endif
+                        base64 |= (u64) mem_base_hi << 32;
+                        limit64 |= (u64) mem_limit_hi << 32;
                 }
         }
+
+        base = (dma_addr_t) base64;
+        limit = (dma_addr_t) limit64;
+
+        if (base != base64) {
+                dev_err(&dev->dev, "can't handle bridge window above 4GB (bus address %#010llx)\n",
+                        (unsigned long long) base64);
+                return;
+        }
+
         if (base <= limit) {
                 res->flags = (mem_base_lo & PCI_PREF_RANGE_TYPE_MASK) |
                                          IORESOURCE_MEM | IORESOURCE_PREFETCH;
@@ -1323,7 +1327,7 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
                         ~hpp->pci_exp_devctl_and, hpp->pci_exp_devctl_or);
 
         /* Initialize Link Control Register */
-        if (dev->subordinate)
+        if (pcie_cap_has_lnkctl(dev))
                 pcie_capability_clear_and_set_word(dev, PCI_EXP_LNKCTL,
                         ~hpp->pci_exp_lnkctl_and, hpp->pci_exp_lnkctl_or);
 
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 4dcfb7116a04..a2eabe6ff9ad 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -202,6 +202,7 @@ config TC1100_WMI
 config HP_ACCEL
         tristate "HP laptop accelerometer"
         depends on INPUT && ACPI
+        depends on SERIO_I8042
         select SENSORS_LIS3LV02D
         select NEW_LEDS
         select LEDS_CLASS
diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
index 13e14ec1d3d7..6bec745b6b92 100644
--- a/drivers/platform/x86/hp_accel.c
+++ b/drivers/platform/x86/hp_accel.c
@@ -37,6 +37,8 @@
 #include <linux/leds.h>
 #include <linux/atomic.h>
 #include <linux/acpi.h>
+#include <linux/i8042.h>
+#include <linux/serio.h>
 #include "../../misc/lis3lv02d/lis3lv02d.h"
 
 #define DRIVER_NAME     "hp_accel"
@@ -73,6 +75,13 @@ static inline void delayed_sysfs_set(struct led_classdev *led_cdev,
 
 /* HP-specific accelerometer driver ------------------------------------ */
 
+/* e0 25, e0 26, e0 27, e0 28 are scan codes that the accelerometer with acpi id
+ * HPQ6000 sends through the keyboard bus */
+#define ACCEL_1 0x25
+#define ACCEL_2 0x26
+#define ACCEL_3 0x27
+#define ACCEL_4 0x28
+
 /* For automatic insertion of the module */
 static const struct acpi_device_id lis3lv02d_device_ids[] = {
         {"HPQ0004", 0}, /* HP Mobile Data Protection System PNP */
@@ -294,6 +303,35 @@ static void lis3lv02d_enum_resources(struct acpi_device *device)
                 printk(KERN_DEBUG DRIVER_NAME ": Error getting resources\n");
 }
 
+static bool hp_accel_i8042_filter(unsigned char data, unsigned char str,
+                                  struct serio *port)
+{
+        static bool extended;
+
+        if (str & I8042_STR_AUXDATA)
+                return false;
+
+        if (data == 0xe0) {
+                extended = true;
+                return true;
+        } else if (unlikely(extended)) {
+                extended = false;
+
+                switch (data) {
+                case ACCEL_1:
+                case ACCEL_2:
+                case ACCEL_3:
+                case ACCEL_4:
+                        return true;
+                default:
+                        serio_interrupt(port, 0xe0, 0);
+                        return false;
+                }
+        }
+
+        return false;
+}
+
 static int lis3lv02d_add(struct acpi_device *device)
 {
         int ret;
@@ -326,6 +364,11 @@ static int lis3lv02d_add(struct acpi_device *device)
         if (ret)
                 return ret;
 
+        /* filter to remove HPQ6000 accelerometer data
+         * from keyboard bus stream */
+        if (strstr(dev_name(&device->dev), "HPQ6000"))
+                i8042_install_filter(hp_accel_i8042_filter);
+
         INIT_WORK(&hpled_led.work, delayed_set_status_worker);
         ret = led_classdev_register(NULL, &hpled_led.led_classdev);
         if (ret) {
@@ -343,6 +386,7 @@ static int lis3lv02d_remove(struct acpi_device *device)
         if (!device)
                 return -EINVAL;
 
+        i8042_remove_filter(hp_accel_i8042_filter);
         lis3lv02d_joystick_disable(&lis3_dev);
         lis3lv02d_poweroff(&lis3_dev);
 
diff --git a/drivers/power/ab8500_fg.c b/drivers/power/ab8500_fg.c
index 217da4b2ca86..99a78d365ceb 100644
--- a/drivers/power/ab8500_fg.c
+++ b/drivers/power/ab8500_fg.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/time.h>
+#include <linux/time64.h>
 #include <linux/of.h>
 #include <linux/completion.h>
 #include <linux/mfd/core.h>
@@ -108,7 +109,7 @@ enum ab8500_fg_calibration_state {
 struct ab8500_fg_avg_cap {
         int avg;
         int samples[NBR_AVG_SAMPLES];
-        __kernel_time_t time_stamps[NBR_AVG_SAMPLES];
+        time64_t time_stamps[NBR_AVG_SAMPLES];
         int pos;
         int nbr_samples;
         int sum;
@@ -386,15 +387,15 @@ static int ab8500_fg_is_low_curr(struct ab8500_fg *di, int curr)
  */
 static int ab8500_fg_add_cap_sample(struct ab8500_fg *di, int sample)
 {
-        struct timespec ts;
+        struct timespec64 ts64;
         struct ab8500_fg_avg_cap *avg = &di->avg_cap;
 
-        getnstimeofday(&ts);
+        getnstimeofday64(&ts64);
 
         do {
                 avg->sum += sample - avg->samples[avg->pos];
                 avg->samples[avg->pos] = sample;
-                avg->time_stamps[avg->pos] = ts.tv_sec;
+                avg->time_stamps[avg->pos] = ts64.tv_sec;
                 avg->pos++;
 
                 if (avg->pos == NBR_AVG_SAMPLES)
@@ -407,7 +408,7 @@ static int ab8500_fg_add_cap_sample(struct ab8500_fg *di, int sample)
                  * Check the time stamp for each sample. If too old,
                  * replace with latest sample
                  */
-        } while (ts.tv_sec - VALID_CAPACITY_SEC > avg->time_stamps[avg->pos]);
+        } while (ts64.tv_sec - VALID_CAPACITY_SEC > avg->time_stamps[avg->pos]);
 
         avg->avg = avg->sum / avg->nbr_samples;
 
@@ -446,14 +447,14 @@ static void ab8500_fg_clear_cap_samples(struct ab8500_fg *di)
 static void ab8500_fg_fill_cap_sample(struct ab8500_fg *di, int sample)
 {
         int i;
-        struct timespec ts;
+        struct timespec64 ts64;
         struct ab8500_fg_avg_cap *avg = &di->avg_cap;
 
-        getnstimeofday(&ts);
+        getnstimeofday64(&ts64);
 
         for (i = 0; i < NBR_AVG_SAMPLES; i++) {
                 avg->samples[i] = sample;
-                avg->time_stamps[i] = ts.tv_sec;
+                avg->time_stamps[i] = ts64.tv_sec;
         }
 
         avg->pos = 0;
diff --git a/drivers/power/bq2415x_charger.c b/drivers/power/bq2415x_charger.c
index e384844a1ae1..1f49986fc605 100644
--- a/drivers/power/bq2415x_charger.c
+++ b/drivers/power/bq2415x_charger.c
@@ -1579,8 +1579,15 @@ static int bq2415x_probe(struct i2c_client *client,
         if (np) {
                 bq->notify_psy = power_supply_get_by_phandle(np, "ti,usb-charger-detection");
 
-                if (!bq->notify_psy)
-                        return -EPROBE_DEFER;
+                if (IS_ERR(bq->notify_psy)) {
+                        dev_info(&client->dev,
+                                "no 'ti,usb-charger-detection' property (err=%ld)\n",
+                                PTR_ERR(bq->notify_psy));
+                        bq->notify_psy = NULL;
+                } else if (!bq->notify_psy) {
+                        ret = -EPROBE_DEFER;
+                        goto error_2;
+                }
         }
         else if (pdata->notify_device)
                 bq->notify_psy = power_supply_get_by_name(pdata->notify_device);
@@ -1602,27 +1609,27 @@ static int bq2415x_probe(struct i2c_client *client,
                 ret = of_property_read_u32(np, "ti,current-limit",
                                 &bq->init_data.current_limit);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,weak-battery-voltage",
                                 &bq->init_data.weak_battery_voltage);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,battery-regulation-voltage",
                                 &bq->init_data.battery_regulation_voltage);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,charge-current",
                                 &bq->init_data.charge_current);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,termination-current",
                                 &bq->init_data.termination_current);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,resistor-sense",
                                 &bq->init_data.resistor_sense);
                 if (ret)
-                        return ret;
+                        goto error_2;
         } else {
                 memcpy(&bq->init_data, pdata, sizeof(bq->init_data));
         }
diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c
index 7098a1ce2d3c..ef8094a61f1e 100644
--- a/drivers/power/charger-manager.c
+++ b/drivers/power/charger-manager.c
@@ -97,6 +97,7 @@ static struct charger_global_desc *g_desc; /* init with setup_charger_manager */
 static bool is_batt_present(struct charger_manager *cm)
 {
         union power_supply_propval val;
+        struct power_supply *psy;
         bool present = false;
         int i, ret;
 
@@ -107,16 +108,27 @@ static bool is_batt_present(struct charger_manager *cm)
         case CM_NO_BATTERY:
                 break;
         case CM_FUEL_GAUGE:
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                psy = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+                if (!psy)
+                        break;
+
+                ret = psy->get_property(psy,
                                 POWER_SUPPLY_PROP_PRESENT, &val);
                 if (ret == 0 && val.intval)
                         present = true;
                 break;
         case CM_CHARGER_STAT:
-                for (i = 0; cm->charger_stat[i]; i++) {
-                        ret = cm->charger_stat[i]->get_property(
-                                        cm->charger_stat[i],
-                                        POWER_SUPPLY_PROP_PRESENT, &val);
+                for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
+                        psy = power_supply_get_by_name(
+                                        cm->desc->psy_charger_stat[i]);
+                        if (!psy) {
+                                dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
+                                        cm->desc->psy_charger_stat[i]);
+                                continue;
+                        }
+
+                        ret = psy->get_property(psy, POWER_SUPPLY_PROP_PRESENT,
+                                        &val);
                         if (ret == 0 && val.intval) {
                                 present = true;
                                 break;
@@ -139,14 +151,20 @@ static bool is_batt_present(struct charger_manager *cm)
 static bool is_ext_pwr_online(struct charger_manager *cm)
 {
         union power_supply_propval val;
+        struct power_supply *psy;
         bool online = false;
         int i, ret;
 
         /* If at least one of them has one, it's yes. */
-        for (i = 0; cm->charger_stat[i]; i++) {
-                ret = cm->charger_stat[i]->get_property(
-                                cm->charger_stat[i],
-                                POWER_SUPPLY_PROP_ONLINE, &val);
+        for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
+                psy = power_supply_get_by_name(cm->desc->psy_charger_stat[i]);
+                if (!psy) {
+                        dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
+                                        cm->desc->psy_charger_stat[i]);
+                        continue;
+                }
+
+                ret = psy->get_property(psy, POWER_SUPPLY_PROP_ONLINE, &val);
                 if (ret == 0 && val.intval) {
                         online = true;
                         break;
@@ -167,12 +185,14 @@ static bool is_ext_pwr_online(struct charger_manager *cm)
 static int get_batt_uV(struct charger_manager *cm, int *uV)
 {
         union power_supply_propval val;
+        struct power_supply *fuel_gauge;
         int ret;
 
-        if (!cm->fuel_gauge)
+        fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+        if (!fuel_gauge)
                 return -ENODEV;
 
-        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+        ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_VOLTAGE_NOW, &val);
         if (ret)
                 return ret;
@@ -189,6 +209,7 @@ static bool is_charging(struct charger_manager *cm)
 {
         int i, ret;
         bool charging = false;
+        struct power_supply *psy;
         union power_supply_propval val;
 
         /* If there is no battery, it cannot be charged */
@@ -196,17 +217,22 @@ static bool is_charging(struct charger_manager *cm)
                 return false;
 
         /* If at least one of the charger is charging, return yes */
-        for (i = 0; cm->charger_stat[i]; i++) {
+        for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
                 /* 1. The charger sholuld not be DISABLED */
                 if (cm->emergency_stop)
                         continue;
                 if (!cm->charger_enabled)
                         continue;
 
+                psy = power_supply_get_by_name(cm->desc->psy_charger_stat[i]);
+                if (!psy) {
+                        dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
+                                        cm->desc->psy_charger_stat[i]);
+                        continue;
+                }
+
                 /* 2. The charger should be online (ext-power) */
-                ret = cm->charger_stat[i]->get_property(
-                                cm->charger_stat[i],
-                                POWER_SUPPLY_PROP_ONLINE, &val);
+                ret = psy->get_property(psy, POWER_SUPPLY_PROP_ONLINE, &val);
                 if (ret) {
                         dev_warn(cm->dev, "Cannot read ONLINE value from %s\n",
                                  cm->desc->psy_charger_stat[i]);
@@ -219,9 +245,7 @@ static bool is_charging(struct charger_manager *cm)
                  * 3. The charger should not be FULL, DISCHARGING,
                  * or NOT_CHARGING.
                  */
-                ret = cm->charger_stat[i]->get_property(
-                                cm->charger_stat[i],
-                                POWER_SUPPLY_PROP_STATUS, &val);
+                ret = psy->get_property(psy, POWER_SUPPLY_PROP_STATUS, &val);
                 if (ret) {
                         dev_warn(cm->dev, "Cannot read STATUS value from %s\n",
                                  cm->desc->psy_charger_stat[i]);
@@ -248,6 +272,7 @@ static bool is_full_charged(struct charger_manager *cm)
 {
         struct charger_desc *desc = cm->desc;
         union power_supply_propval val;
+        struct power_supply *fuel_gauge;
         int ret = 0;
         int uV;
 
@@ -255,11 +280,15 @@ static bool is_full_charged(struct charger_manager *cm)
         if (!is_batt_present(cm))
                 return false;
 
-        if (cm->fuel_gauge && desc->fullbatt_full_capacity > 0) {
+        fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+        if (!fuel_gauge)
+                return false;
+
+        if (desc->fullbatt_full_capacity > 0) {
                 val.intval = 0;
 
                 /* Not full if capacity of fuel gauge isn't full */
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_CHARGE_FULL, &val);
                 if (!ret && val.intval > desc->fullbatt_full_capacity)
                         return true;
@@ -273,10 +302,10 @@ static bool is_full_charged(struct charger_manager *cm)
         }
 
         /* Full, if the capacity is more than fullbatt_soc */
-        if (cm->fuel_gauge && desc->fullbatt_soc > 0) {
+        if (desc->fullbatt_soc > 0) {
                 val.intval = 0;
 
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_CAPACITY, &val);
                 if (!ret && val.intval >= desc->fullbatt_soc)
                         return true;
@@ -551,6 +580,20 @@ static int check_charging_duration(struct charger_manager *cm)
         return ret;
 }
 
+static int cm_get_battery_temperature_by_psy(struct charger_manager *cm,
+                                        int *temp)
+{
+        struct power_supply *fuel_gauge;
+
+        fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+        if (!fuel_gauge)
+                return -ENODEV;
+
+        return fuel_gauge->get_property(fuel_gauge,
+                                POWER_SUPPLY_PROP_TEMP,
+                                (union power_supply_propval *)temp);
+}
+
 static int cm_get_battery_temperature(struct charger_manager *cm,
                                         int *temp)
 {
@@ -560,15 +603,18 @@ static int cm_get_battery_temperature(struct charger_manager *cm,
                 return -ENODEV;
 
 #ifdef CONFIG_THERMAL
-        ret = thermal_zone_get_temp(cm->tzd_batt, (unsigned long *)temp);
-        if (!ret)
-                /* Calibrate temperature unit */
-                *temp /= 100;
-#else
-        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
-                                POWER_SUPPLY_PROP_TEMP,
-                                (union power_supply_propval *)temp);
+        if (cm->tzd_batt) {
+                ret = thermal_zone_get_temp(cm->tzd_batt, (unsigned long *)temp);
+                if (!ret)
+                        /* Calibrate temperature unit */
+                        *temp /= 100;
+        } else
 #endif
+        {
+                /* if-else continued from CONFIG_THERMAL */
+                ret = cm_get_battery_temperature_by_psy(cm, temp);
+        }
+
         return ret;
 }
 
@@ -827,6 +873,7 @@ static int charger_get_property(struct power_supply *psy,
         struct charger_manager *cm = container_of(psy,
                         struct charger_manager, charger_psy);
         struct charger_desc *desc = cm->desc;
+        struct power_supply *fuel_gauge;
         int ret = 0;
         int uV;
 
@@ -857,14 +904,20 @@ static int charger_get_property(struct power_supply *psy,
                 ret = get_batt_uV(cm, &val->intval);
                 break;
         case POWER_SUPPLY_PROP_CURRENT_NOW:
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+                if (!fuel_gauge) {
+                        ret = -ENODEV;
+                        break;
+                }
+                ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_CURRENT_NOW, val);
                 break;
         case POWER_SUPPLY_PROP_TEMP:
         case POWER_SUPPLY_PROP_TEMP_AMBIENT:
                 return cm_get_battery_temperature(cm, &val->intval);
         case POWER_SUPPLY_PROP_CAPACITY:
-                if (!cm->fuel_gauge) {
+                fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+                if (!fuel_gauge) {
                         ret = -ENODEV;
                         break;
                 }
@@ -875,7 +928,7 @@ static int charger_get_property(struct power_supply *psy,
                         break;
                 }
 
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                ret = fuel_gauge->get_property(fuel_gauge,
                                         POWER_SUPPLY_PROP_CAPACITY, val);
                 if (ret)
                         break;
@@ -924,7 +977,14 @@ static int charger_get_property(struct power_supply *psy,
                 break;
         case POWER_SUPPLY_PROP_CHARGE_NOW:
                 if (is_charging(cm)) {
-                        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                        fuel_gauge = power_supply_get_by_name(
+                                        cm->desc->psy_fuel_gauge);
+                        if (!fuel_gauge) {
+                                ret = -ENODEV;
+                                break;
+                        }
+
+                        ret = fuel_gauge->get_property(fuel_gauge,
                                                 POWER_SUPPLY_PROP_CHARGE_NOW,
                                                 val);
                         if (ret) {
@@ -970,6 +1030,7 @@ static struct power_supply psy_default = {
         .properties = default_charger_props,
         .num_properties = ARRAY_SIZE(default_charger_props),
         .get_property = charger_get_property,
+        .no_thermal = true,
 };
 
 /**
@@ -1485,14 +1546,15 @@ err:
         return ret;
 }
 
-static int cm_init_thermal_data(struct charger_manager *cm)
+static int cm_init_thermal_data(struct charger_manager *cm,
+                struct power_supply *fuel_gauge)
 {
         struct charger_desc *desc = cm->desc;
         union power_supply_propval val;
         int ret;
 
         /* Verify whether fuel gauge provides battery temperature */
-        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+        ret = fuel_gauge->get_property(fuel_gauge,
                                         POWER_SUPPLY_PROP_TEMP, &val);
 
         if (!ret) {
@@ -1502,8 +1564,6 @@ static int cm_init_thermal_data(struct charger_manager *cm)
                 cm->desc->measure_battery_temp = true;
         }
 #ifdef CONFIG_THERMAL
-        cm->tzd_batt = cm->fuel_gauge->tzd;
-
         if (ret && desc->thermal_zone) {
                 cm->tzd_batt =
                         thermal_zone_get_zone_by_name(desc->thermal_zone);
@@ -1666,6 +1726,7 @@ static int charger_manager_probe(struct platform_device *pdev)
         int ret = 0, i = 0;
         int j = 0;
         union power_supply_propval val;
+        struct power_supply *fuel_gauge;
 
         if (g_desc && !rtc_dev && g_desc->rtc_name) {
                 rtc_dev = rtc_class_open(g_desc->rtc_name);
@@ -1729,23 +1790,20 @@ static int charger_manager_probe(struct platform_device *pdev)
         while (desc->psy_charger_stat[i])
                 i++;
 
-        cm->charger_stat = devm_kzalloc(&pdev->dev,
-                                sizeof(struct power_supply *) * i, GFP_KERNEL);
-        if (!cm->charger_stat)
-                return -ENOMEM;
-
+        /* Check if charger's supplies are present at probe */
         for (i = 0; desc->psy_charger_stat[i]; i++) {
-                cm->charger_stat[i] = power_supply_get_by_name(
-                                        desc->psy_charger_stat[i]);
-                if (!cm->charger_stat[i]) {
+                struct power_supply *psy;
+
+                psy = power_supply_get_by_name(desc->psy_charger_stat[i]);
+                if (!psy) {
                         dev_err(&pdev->dev, "Cannot find power supply \"%s\"\n",
                                 desc->psy_charger_stat[i]);
                         return -ENODEV;
                 }
         }
 
-        cm->fuel_gauge = power_supply_get_by_name(desc->psy_fuel_gauge);
-        if (!cm->fuel_gauge) {
+        fuel_gauge = power_supply_get_by_name(desc->psy_fuel_gauge);
+        if (!fuel_gauge) {
                 dev_err(&pdev->dev, "Cannot find power supply \"%s\"\n",
                         desc->psy_fuel_gauge);
                 return -ENODEV;
@@ -1788,13 +1846,13 @@ static int charger_manager_probe(struct platform_device *pdev)
         cm->charger_psy.num_properties = psy_default.num_properties;
 
         /* Find which optional psy-properties are available */
-        if (!cm->fuel_gauge->get_property(cm->fuel_gauge,
+        if (!fuel_gauge->get_property(fuel_gauge,
                                           POWER_SUPPLY_PROP_CHARGE_NOW, &val)) {
                 cm->charger_psy.properties[cm->charger_psy.num_properties] =
                                 POWER_SUPPLY_PROP_CHARGE_NOW;
                 cm->charger_psy.num_properties++;
         }
-        if (!cm->fuel_gauge->get_property(cm->fuel_gauge,
+        if (!fuel_gauge->get_property(fuel_gauge,
                                           POWER_SUPPLY_PROP_CURRENT_NOW,
                                           &val)) {
                 cm->charger_psy.properties[cm->charger_psy.num_properties] =
@@ -1802,7 +1860,7 @@ static int charger_manager_probe(struct platform_device *pdev)
                 cm->charger_psy.num_properties++;
         }
 
-        ret = cm_init_thermal_data(cm);
+        ret = cm_init_thermal_data(cm, fuel_gauge);
         if (ret) {
                 dev_err(&pdev->dev, "Failed to initialize thermal data\n");
                 cm->desc->measure_battery_temp = false;
@@ -2066,8 +2124,8 @@ static bool find_power_supply(struct charger_manager *cm,
         int i;
         bool found = false;
 
-        for (i = 0; cm->charger_stat[i]; i++) {
-                if (psy == cm->charger_stat[i]) {
+        for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
+                if (!strcmp(psy->name, cm->desc->psy_charger_stat[i])) {
                         found = true;
                         break;
                 }
diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
index 6cb7fe5c022d..694e8cddd5c1 100644
--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -417,6 +417,9 @@ static int psy_register_thermal(struct power_supply *psy)
 {
         int i;
 
+        if (psy->no_thermal)
+                return 0;
+
         /* Register battery zone device psy reports temperature */
         for (i = 0; i < psy->num_properties; i++) {
                 if (psy->properties[i] == POWER_SUPPLY_PROP_TEMP) {
diff --git a/drivers/s390/kvm/virtio_ccw.c b/drivers/s390/kvm/virtio_ccw.c
index 6cbe6ef3c889..bda52f18e967 100644
--- a/drivers/s390/kvm/virtio_ccw.c
+++ b/drivers/s390/kvm/virtio_ccw.c
@@ -888,7 +888,6 @@ static void virtio_ccw_int_handler(struct ccw_device *cdev,
         struct virtio_ccw_device *vcdev = dev_get_drvdata(&cdev->dev);
         int i;
         struct virtqueue *vq;
-        struct virtio_driver *drv;
 
         if (!vcdev)
                 return;
diff --git a/drivers/scsi/bnx2fc/bnx2fc_els.c b/drivers/scsi/bnx2fc/bnx2fc_els.c
index ca75c7ca2559..ef355c13ccc4 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_els.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_els.c
@@ -480,9 +480,7 @@ void bnx2fc_rec_compl(struct bnx2fc_els_cb_arg *cb_arg)
                         bnx2fc_initiate_cleanup(orig_io_req);
                         /* Post a new IO req with the same sc_cmd */
                         BNX2FC_IO_DBG(rec_req, "Post IO request again\n");
-                        spin_unlock_bh(&tgt->tgt_lock);
                         rc = bnx2fc_post_io_req(tgt, new_io_req);
-                        spin_lock_bh(&tgt->tgt_lock);
                         if (!rc)
                                 goto free_frame;
                         BNX2FC_IO_DBG(rec_req, "REC: io post err\n");
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 79e5c94107a9..72533c58c1f3 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -412,6 +412,7 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev,
         struct fc_frame_header *fh;
         struct fcoe_rcv_info *fr;
         struct fcoe_percpu_s *bg;
+        struct sk_buff *tmp_skb;
         unsigned short oxid;
 
         interface = container_of(ptype, struct bnx2fc_interface,
@@ -424,6 +425,12 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev,
                 goto err;
         }
 
+        tmp_skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!tmp_skb)
+                goto err;
+
+        skb = tmp_skb;
+
         if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) {
                 printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n");
                 goto err;
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 0679782d9d15..5b99844ef6bf 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -1894,18 +1894,24 @@ int bnx2fc_queuecommand(struct Scsi_Host *host,
                         goto exit_qcmd;
                 }
         }
+
+        spin_lock_bh(&tgt->tgt_lock);
+
         io_req = bnx2fc_cmd_alloc(tgt);
         if (!io_req) {
                 rc = SCSI_MLQUEUE_HOST_BUSY;
-                goto exit_qcmd;
+                goto exit_qcmd_tgtlock;
         }
         io_req->sc_cmd = sc_cmd;
 
         if (bnx2fc_post_io_req(tgt, io_req)) {
                 printk(KERN_ERR PFX "Unable to post io_req\n");
                 rc = SCSI_MLQUEUE_HOST_BUSY;
-                goto exit_qcmd;
+                goto exit_qcmd_tgtlock;
         }
+
+exit_qcmd_tgtlock:
+        spin_unlock_bh(&tgt->tgt_lock);
 exit_qcmd:
         return rc;
 }
@@ -2020,6 +2026,8 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
         int task_idx, index;
         u16 xid;
 
+        /* bnx2fc_post_io_req() is called with the tgt_lock held */
+
         /* Initialize rest of io_req fields */
         io_req->cmd_type = BNX2FC_SCSI_CMD;
         io_req->port = port;
@@ -2047,9 +2055,7 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
         /* Build buffer descriptor list for firmware from sg list */
         if (bnx2fc_build_bd_list_from_sg(io_req)) {
                 printk(KERN_ERR PFX "BD list creation failed\n");
-                spin_lock_bh(&tgt->tgt_lock);
                 kref_put(&io_req->refcount, bnx2fc_cmd_release);
-                spin_unlock_bh(&tgt->tgt_lock);
                 return -EAGAIN;
         }
 
@@ -2061,19 +2067,15 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
         task = &(task_page[index]);
         bnx2fc_init_task(io_req, task);
 
-        spin_lock_bh(&tgt->tgt_lock);
-
         if (tgt->flush_in_prog) {
                 printk(KERN_ERR PFX "Flush in progress..Host Busy\n");
                 kref_put(&io_req->refcount, bnx2fc_cmd_release);
-                spin_unlock_bh(&tgt->tgt_lock);
                 return -EAGAIN;
         }
 
         if (!test_bit(BNX2FC_FLAG_SESSION_READY, &tgt->flags)) {
                 printk(KERN_ERR PFX "Session not ready...post_io\n");
                 kref_put(&io_req->refcount, bnx2fc_cmd_release);
-                spin_unlock_bh(&tgt->tgt_lock);
                 return -EAGAIN;
         }
 
@@ -2091,6 +2093,5 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
 
         /* Ring doorbell */
         bnx2fc_ring_doorbell(tgt);
-        spin_unlock_bh(&tgt->tgt_lock);
         return 0;
 }
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index 3e0a0d315f72..15081257cfc8 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -828,6 +828,8 @@ static void do_act_open_rpl(struct cxgbi_device *cdev, struct sk_buff *skb)
         if (status == CPL_ERR_RTX_NEG_ADVICE)
                 goto rel_skb;
 
+        module_put(THIS_MODULE);
+
         if (status && status != CPL_ERR_TCAM_FULL &&
             status != CPL_ERR_CONN_EXIST &&
             status != CPL_ERR_ARP_MISS)
@@ -936,20 +938,23 @@ static void do_abort_req_rss(struct cxgbi_device *cdev, struct sk_buff *skb)
         cxgbi_sock_get(csk);
         spin_lock_bh(&csk->lock);
 
-        if (!cxgbi_sock_flag(csk, CTPF_ABORT_REQ_RCVD)) {
-                cxgbi_sock_set_flag(csk, CTPF_ABORT_REQ_RCVD);
-                cxgbi_sock_set_state(csk, CTP_ABORTING);
-                goto done;
+        cxgbi_sock_clear_flag(csk, CTPF_ABORT_REQ_RCVD);
+
+        if (!cxgbi_sock_flag(csk, CTPF_TX_DATA_SENT)) {
+                send_tx_flowc_wr(csk);
+                cxgbi_sock_set_flag(csk, CTPF_TX_DATA_SENT);
         }
 
-        cxgbi_sock_clear_flag(csk, CTPF_ABORT_REQ_RCVD);
+        cxgbi_sock_set_flag(csk, CTPF_ABORT_REQ_RCVD);
+        cxgbi_sock_set_state(csk, CTP_ABORTING);
+
         send_abort_rpl(csk, rst_status);
 
         if (!cxgbi_sock_flag(csk, CTPF_ABORT_RPL_PENDING)) {
                 csk->err = abort_status_to_errno(csk, req->status, &rst_status);
                 cxgbi_sock_closed(csk);
         }
-done:
+
         spin_unlock_bh(&csk->lock);
         cxgbi_sock_put(csk);
 rel_skb:
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index 674d498b46ab..7da59c38a69e 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -816,7 +816,7 @@ static void cxgbi_inform_iscsi_conn_closing(struct cxgbi_sock *csk)
                 read_lock_bh(&csk->callback_lock);
                 if (csk->user_data)
                         iscsi_conn_failure(csk->user_data,
-                                        ISCSI_ERR_CONN_FAILED);
+                                        ISCSI_ERR_TCP_CONN_CLOSE);
                 read_unlock_bh(&csk->callback_lock);
         }
 }
@@ -905,18 +905,16 @@ void cxgbi_sock_rcv_abort_rpl(struct cxgbi_sock *csk)
 {
         cxgbi_sock_get(csk);
         spin_lock_bh(&csk->lock);
+
+        cxgbi_sock_set_flag(csk, CTPF_ABORT_RPL_RCVD);
         if (cxgbi_sock_flag(csk, CTPF_ABORT_RPL_PENDING)) {
-                if (!cxgbi_sock_flag(csk, CTPF_ABORT_RPL_RCVD))
-                        cxgbi_sock_set_flag(csk, CTPF_ABORT_RPL_RCVD);
-                else {
-                        cxgbi_sock_clear_flag(csk, CTPF_ABORT_RPL_RCVD);
-                        cxgbi_sock_clear_flag(csk, CTPF_ABORT_RPL_PENDING);
-                        if (cxgbi_sock_flag(csk, CTPF_ABORT_REQ_RCVD))
-                                pr_err("csk 0x%p,%u,0x%lx,%u,ABT_RPL_RSS.\n",
-                                        csk, csk->state, csk->flags, csk->tid);
-                        cxgbi_sock_closed(csk);
-                }
+                cxgbi_sock_clear_flag(csk, CTPF_ABORT_RPL_PENDING);
+                if (cxgbi_sock_flag(csk, CTPF_ABORT_REQ_RCVD))
+                        pr_err("csk 0x%p,%u,0x%lx,%u,ABT_RPL_RSS.\n",
+                               csk, csk->state, csk->flags, csk->tid);
+                cxgbi_sock_closed(csk);
         }
+
         spin_unlock_bh(&csk->lock);
         cxgbi_sock_put(csk);
 }
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index e99507ed0e3c..fd78bdc53528 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -474,6 +474,13 @@ static int alua_check_sense(struct scsi_device *sdev,
                          * LUN Not Ready -- Offline
                          */
                         return SUCCESS;
+                if (sdev->allow_restart &&
+                    sense_hdr->asc == 0x04 && sense_hdr->ascq == 0x02)
+                        /*
+                         * if the device is not started, we need to wake
+                         * the error handler to start the motor
+                         */
+                        return FAILED;
                 break;
         case UNIT_ATTENTION:
                 if (sense_hdr->asc == 0x29 && sense_hdr->ascq == 0x00)
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index f6a69a3b1b3f..5640ad1c8214 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -4453,7 +4453,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
                         instance->msixentry[i].entry = i;
                 i = pci_enable_msix_range(instance->pdev, instance->msixentry,
                                           1, instance->msix_vectors);
-                if (i)
+                if (i > 0)
                         instance->msix_vectors = i;
                 else
                         instance->msix_vectors = 0;
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 49014a143c6a..c1d04d4d3c6c 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -202,6 +202,7 @@ static struct {
         {"IOMEGA", "Io20S         *F", NULL, BLIST_KEY},
         {"INSITE", "Floptical   F*8I", NULL, BLIST_KEY},
         {"INSITE", "I325VM", NULL, BLIST_KEY},
+        {"Intel", "Multi-Flex", NULL, BLIST_NO_RSOC},
         {"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
         {"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN},
         {"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 9a6f8468225f..bc5ff6ff9c79 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -459,14 +459,6 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
         if (! scsi_command_normalize_sense(scmd, &sshdr))
                 return FAILED;  /* no valid sense data */
 
-        if (scmd->cmnd[0] == TEST_UNIT_READY && scmd->scsi_done != scsi_eh_done)
-                /*
-                 * nasty: for mid-layer issued TURs, we need to return the
-                 * actual sense data without any recovery attempt.  For eh
-                 * issued ones, we need to try to recover and interpret
-                 */
-                return SUCCESS;
-
         scsi_report_sense(sdev, &sshdr);
 
         if (scsi_sense_is_deferred(&sshdr))
@@ -482,6 +474,14 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
                 /* handler does not care. Drop down to default handling */
         }
 
+        if (scmd->cmnd[0] == TEST_UNIT_READY && scmd->scsi_done != scsi_eh_done)
+                /*
+                 * nasty: for mid-layer issued TURs, we need to return the
+                 * actual sense data without any recovery attempt.  For eh
+                 * issued ones, we need to try to recover and interpret
+                 */
+                return SUCCESS;
+
         /*
          * Previous logic looked for FILEMARK, EOM or ILI which are
          * mainly associated with tapes and returned SUCCESS.
@@ -2001,8 +2001,10 @@ static void scsi_restart_operations(struct Scsi_Host *shost)
          * is no point trying to lock the door of an off-line device.
          */
         shost_for_each_device(sdev, shost) {
-                if (scsi_device_online(sdev) && sdev->locked)
+                if (scsi_device_online(sdev) && sdev->was_reset && sdev->locked) {
                         scsi_eh_lock_door(sdev);
+                        sdev->was_reset = 0;
+                }
         }
 
         /*
diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
index 8adf067ff019..1c3467b82566 100644
--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
+++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
@@ -102,7 +102,6 @@ static int ufshcd_parse_clock_info(struct ufs_hba *hba)
         clkfreq = devm_kzalloc(dev, sz * sizeof(*clkfreq),
                         GFP_KERNEL);
         if (!clkfreq) {
-                dev_err(dev, "%s: no memory\n", "freq-table-hz");
                 ret = -ENOMEM;
                 goto out;
         }
@@ -112,19 +111,19 @@ static int ufshcd_parse_clock_info(struct ufs_hba *hba)
         if (ret && (ret != -EINVAL)) {
                 dev_err(dev, "%s: error reading array %d\n",
                                 "freq-table-hz", ret);
-                goto free_clkfreq;
+                return ret;
         }
 
         for (i = 0; i < sz; i += 2) {
                 ret = of_property_read_string_index(np,
                                 "clock-names", i/2, (const char **)&name);
                 if (ret)
-                        goto free_clkfreq;
+                        goto out;
 
                 clki = devm_kzalloc(dev, sizeof(*clki), GFP_KERNEL);
                 if (!clki) {
                         ret = -ENOMEM;
-                        goto free_clkfreq;
+                        goto out;
                 }
 
                 clki->min_freq = clkfreq[i];
@@ -134,8 +133,6 @@ static int ufshcd_parse_clock_info(struct ufs_hba *hba)
                                 clki->min_freq, clki->max_freq, clki->name);
                 list_add_tail(&clki->list, &hba->clk_list_head);
         }
-free_clkfreq:
-        kfree(clkfreq);
 out:
         return ret;
 }
@@ -162,10 +159,8 @@ static int ufshcd_populate_vreg(struct device *dev, const char *name,
         }
 
         vreg = devm_kzalloc(dev, sizeof(*vreg), GFP_KERNEL);
-        if (!vreg) {
-                dev_err(dev, "No memory for %s regulator\n", name);
-                goto out;
-        }
+        if (!vreg)
+                return -ENOMEM;
 
         vreg->name = kstrdup(name, GFP_KERNEL);
 
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 497c38a4a866..605ca60e8a10 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -744,6 +744,8 @@ static void ufshcd_exit_clk_gating(struct ufs_hba *hba)
         if (!ufshcd_is_clkgating_allowed(hba))
                 return;
         device_remove_file(hba->dev, &hba->clk_gating.delay_attr);
+        cancel_work_sync(&hba->clk_gating.ungate_work);
+        cancel_delayed_work_sync(&hba->clk_gating.gate_work);
 }
 
 /* Must be called with host lock acquired */
@@ -2246,6 +2248,22 @@ static int ufshcd_uic_hibern8_exit(struct ufs_hba *hba)
         return ret;
 }
 
+ /**
+ * ufshcd_init_pwr_info - setting the POR (power on reset)
+ * values in hba power info
+ * @hba: per-adapter instance
+ */
+static void ufshcd_init_pwr_info(struct ufs_hba *hba)
+{
+        hba->pwr_info.gear_rx = UFS_PWM_G1;
+        hba->pwr_info.gear_tx = UFS_PWM_G1;
+        hba->pwr_info.lane_rx = 1;
+        hba->pwr_info.lane_tx = 1;
+        hba->pwr_info.pwr_rx = SLOWAUTO_MODE;
+        hba->pwr_info.pwr_tx = SLOWAUTO_MODE;
+        hba->pwr_info.hs_rate = 0;
+}
+
 /**
  * ufshcd_get_max_pwr_mode - reads the max power mode negotiated with device
  * @hba: per-adapter instance
@@ -2844,8 +2862,13 @@ static void ufshcd_slave_destroy(struct scsi_device *sdev)
         hba = shost_priv(sdev->host);
         scsi_deactivate_tcq(sdev, hba->nutrs);
         /* Drop the reference as it won't be needed anymore */
-        if (ufshcd_scsi_to_upiu_lun(sdev->lun) == UFS_UPIU_UFS_DEVICE_WLUN)
+        if (ufshcd_scsi_to_upiu_lun(sdev->lun) == UFS_UPIU_UFS_DEVICE_WLUN) {
+                unsigned long flags;
+
+                spin_lock_irqsave(hba->host->host_lock, flags);
                 hba->sdev_ufs_device = NULL;
+                spin_unlock_irqrestore(hba->host->host_lock, flags);
+        }
 }
 
 /**
@@ -4062,6 +4085,8 @@ static void ufshcd_init_icc_levels(struct ufs_hba *hba)
 static int ufshcd_scsi_add_wlus(struct ufs_hba *hba)
 {
         int ret = 0;
+        struct scsi_device *sdev_rpmb;
+        struct scsi_device *sdev_boot;
 
         hba->sdev_ufs_device = __scsi_add_device(hba->host, 0, 0,
                 ufshcd_upiu_wlun_to_scsi_wlun(UFS_UPIU_UFS_DEVICE_WLUN), NULL);
@@ -4070,26 +4095,27 @@ static int ufshcd_scsi_add_wlus(struct ufs_hba *hba)
                 hba->sdev_ufs_device = NULL;
                 goto out;
         }
+        scsi_device_put(hba->sdev_ufs_device);
 
-        hba->sdev_boot = __scsi_add_device(hba->host, 0, 0,
+        sdev_boot = __scsi_add_device(hba->host, 0, 0,
                 ufshcd_upiu_wlun_to_scsi_wlun(UFS_UPIU_BOOT_WLUN), NULL);
-        if (IS_ERR(hba->sdev_boot)) {
-                ret = PTR_ERR(hba->sdev_boot);
-                hba->sdev_boot = NULL;
+        if (IS_ERR(sdev_boot)) {
+                ret = PTR_ERR(sdev_boot);
                 goto remove_sdev_ufs_device;
         }
+        scsi_device_put(sdev_boot);
 
-        hba->sdev_rpmb = __scsi_add_device(hba->host, 0, 0,
+        sdev_rpmb = __scsi_add_device(hba->host, 0, 0,
                 ufshcd_upiu_wlun_to_scsi_wlun(UFS_UPIU_RPMB_WLUN), NULL);
-        if (IS_ERR(hba->sdev_rpmb)) {
-                ret = PTR_ERR(hba->sdev_rpmb);
-                hba->sdev_rpmb = NULL;
+        if (IS_ERR(sdev_rpmb)) {
+                ret = PTR_ERR(sdev_rpmb);
                 goto remove_sdev_boot;
         }
+        scsi_device_put(sdev_rpmb);
         goto out;
 
 remove_sdev_boot:
-        scsi_remove_device(hba->sdev_boot);
+        scsi_remove_device(sdev_boot);
 remove_sdev_ufs_device:
         scsi_remove_device(hba->sdev_ufs_device);
 out:
@@ -4097,30 +4123,6 @@ out:
 }
 
 /**
- * ufshcd_scsi_remove_wlus - Removes the W-LUs which were added by
- *                           ufshcd_scsi_add_wlus()
- * @hba: per-adapter instance
- *
- */
-static void ufshcd_scsi_remove_wlus(struct ufs_hba *hba)
-{
-        if (hba->sdev_ufs_device) {
-                scsi_remove_device(hba->sdev_ufs_device);
-                hba->sdev_ufs_device = NULL;
-        }
-
-        if (hba->sdev_boot) {
-                scsi_remove_device(hba->sdev_boot);
-                hba->sdev_boot = NULL;
-        }
-
-        if (hba->sdev_rpmb) {
-                scsi_remove_device(hba->sdev_rpmb);
-                hba->sdev_rpmb = NULL;
-        }
-}
-
-/**
  * ufshcd_probe_hba - probe hba to detect device and initialize
  * @hba: per-adapter instance
  *
@@ -4134,6 +4136,8 @@ static int ufshcd_probe_hba(struct ufs_hba *hba)
         if (ret)
                 goto out;
 
+        ufshcd_init_pwr_info(hba);
+
         /* UniPro link is active now */
         ufshcd_set_link_active(hba);
 
@@ -4264,12 +4268,18 @@ static int ufshcd_config_vreg_load(struct device *dev, struct ufs_vreg *vreg,
 static inline int ufshcd_config_vreg_lpm(struct ufs_hba *hba,
                                          struct ufs_vreg *vreg)
 {
+        if (!vreg)
+                return 0;
+
         return ufshcd_config_vreg_load(hba->dev, vreg, UFS_VREG_LPM_LOAD_UA);
 }
 
 static inline int ufshcd_config_vreg_hpm(struct ufs_hba *hba,
                                          struct ufs_vreg *vreg)
 {
+        if (!vreg)
+                return 0;
+
         return ufshcd_config_vreg_load(hba->dev, vreg, vreg->max_uA);
 }
 
@@ -4471,7 +4481,7 @@ out:
                         if (!IS_ERR_OR_NULL(clki->clk) && clki->enabled)
                                 clk_disable_unprepare(clki->clk);
                 }
-        } else if (!ret && on) {
+        } else if (on) {
                 spin_lock_irqsave(hba->host->host_lock, flags);
                 hba->clk_gating.state = CLKS_ON;
                 spin_unlock_irqrestore(hba->host->host_lock, flags);
@@ -4675,11 +4685,25 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba,
 {
         unsigned char cmd[6] = { START_STOP };
         struct scsi_sense_hdr sshdr;
-        struct scsi_device *sdp = hba->sdev_ufs_device;
+        struct scsi_device *sdp;
+        unsigned long flags;
         int ret;
 
-        if (!sdp || !scsi_device_online(sdp))
-                return -ENODEV;
+        spin_lock_irqsave(hba->host->host_lock, flags);
+        sdp = hba->sdev_ufs_device;
+        if (sdp) {
+                ret = scsi_device_get(sdp);
+                if (!ret && !scsi_device_online(sdp)) {
+                        ret = -ENODEV;
+                        scsi_device_put(sdp);
+                }
+        } else {
+                ret = -ENODEV;
+        }
+        spin_unlock_irqrestore(hba->host->host_lock, flags);
+
+        if (ret)
+                return ret;
 
         /*
          * If scsi commands fail, the scsi mid-layer schedules scsi error-
@@ -4718,6 +4742,7 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba,
         if (!ret)
                 hba->curr_dev_pwr_mode = pwr_mode;
 out:
+        scsi_device_put(sdp);
         hba->host->eh_noresume = 0;
         return ret;
 }
@@ -5087,7 +5112,7 @@ int ufshcd_system_suspend(struct ufs_hba *hba)
         int ret = 0;
 
         if (!hba || !hba->is_powered)
-                goto out;
+                return 0;
 
         if (pm_runtime_suspended(hba->dev)) {
                 if (hba->rpm_lvl == hba->spm_lvl)
@@ -5231,7 +5256,6 @@ EXPORT_SYMBOL(ufshcd_shutdown);
 void ufshcd_remove(struct ufs_hba *hba)
 {
         scsi_remove_host(hba->host);
-        ufshcd_scsi_remove_wlus(hba);
         /* disable interrupts */
         ufshcd_disable_intr(hba, hba->intr_mask);
         ufshcd_hba_stop(hba);
diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
index 58ecdff5065c..4a574aa45855 100644
--- a/drivers/scsi/ufs/ufshcd.h
+++ b/drivers/scsi/ufs/ufshcd.h
@@ -392,8 +392,6 @@ struct ufs_hba {
          * "UFS device" W-LU.
          */
         struct scsi_device *sdev_ufs_device;
-        struct scsi_device *sdev_rpmb;
-        struct scsi_device *sdev_boot;
 
         enum ufs_dev_pwr_mode curr_dev_pwr_mode;
         enum uic_link_state uic_link_state;
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index 72e12bad14b9..d0d5542efc06 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -376,9 +376,6 @@ static void pump_transfers(unsigned long data)
         chip = dws->cur_chip;
         spi = message->spi;
 
-        if (unlikely(!chip->clk_div))
-                chip->clk_div = dws->max_freq / chip->speed_hz;
-
         if (message->state == ERROR_STATE) {
                 message->status = -EIO;
                 goto early_exit;
@@ -419,7 +416,7 @@ static void pump_transfers(unsigned long data)
         if (transfer->speed_hz) {
                 speed = chip->speed_hz;
 
-                if (transfer->speed_hz != speed) {
+                if ((transfer->speed_hz != speed) || (!chip->clk_div)) {
                         speed = transfer->speed_hz;
 
                         /* clk_div doesn't support odd number */
@@ -581,7 +578,6 @@ static int dw_spi_setup(struct spi_device *spi)
                 dev_err(&spi->dev, "No max speed HZ parameter\n");
                 return -EINVAL;
         }
-        chip->speed_hz = spi->max_speed_hz;
 
         chip->tmode = 0; /* Tx & Rx */
         /* Default SPI mode is SCPOL = 0, SCPH = 0 */
diff --git a/drivers/spi/spi-sirf.c b/drivers/spi/spi-sirf.c
index 39e2c0a55a28..f63de781c729 100644
--- a/drivers/spi/spi-sirf.c
+++ b/drivers/spi/spi-sirf.c
@@ -562,9 +562,9 @@ spi_sirfsoc_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
 
         sspi->word_width = DIV_ROUND_UP(bits_per_word, 8);
         txfifo_ctrl = SIRFSOC_SPI_FIFO_THD(SIRFSOC_SPI_FIFO_SIZE / 2) |
-                                           sspi->word_width;
+                                           (sspi->word_width >> 1);
         rxfifo_ctrl = SIRFSOC_SPI_FIFO_THD(SIRFSOC_SPI_FIFO_SIZE / 2) |
-                                           sspi->word_width;
+                                           (sspi->word_width >> 1);
 
         if (!(spi->mode & SPI_CS_HIGH))
                 regval |= SIRFSOC_SPI_CS_IDLE_STAT;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index ebcb33df2eb2..50f20f243981 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -615,13 +615,13 @@ static int spi_map_buf(struct spi_master *master, struct device *dev,
                                 sg_free_table(sgt);
                                 return -ENOMEM;
                         }
-                        sg_buf = page_address(vm_page) +
-                                ((size_t)buf & ~PAGE_MASK);
+                        sg_set_page(&sgt->sgl[i], vm_page,
+                                    min, offset_in_page(buf));
                 } else {
                         sg_buf = buf;
+                        sg_set_buf(&sgt->sgl[i], sg_buf, min);
                 }
 
-                sg_set_buf(&sgt->sgl[i], sg_buf, min);
 
                 buf += min;
                 len -= min;
diff --git a/drivers/staging/rtl8188eu/core/rtw_cmd.c b/drivers/staging/rtl8188eu/core/rtw_cmd.c
index 9935e66935af..eddef9cd2e16 100644
--- a/drivers/staging/rtl8188eu/core/rtw_cmd.c
+++ b/drivers/staging/rtl8188eu/core/rtw_cmd.c
@@ -275,11 +275,11 @@ u8 rtw_sitesurvey_cmd(struct adapter  *padapter, struct ndis_802_11_ssid *ssid,
         if (check_fwstate(pmlmepriv, _FW_LINKED) == true)
                 rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_SCAN, 1);
 
-        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (ph2c == NULL)
                 return _FAIL;
 
-        psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_KERNEL);
+        psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
         if (psurveyPara == NULL) {
                 kfree(ph2c);
                 return _FAIL;
@@ -405,7 +405,7 @@ u8 rtw_joinbss_cmd(struct adapter  *padapter, struct wlan_network *pnetwork)
         else
                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+Join cmd: SSid =[%s]\n", pmlmepriv->assoc_ssid.Ssid));
 
-        pcmd = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        pcmd = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (pcmd == NULL) {
                 res = _FAIL;
                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("rtw_joinbss_cmd: memory allocate for cmd_obj fail!!!\n"));
@@ -755,13 +755,13 @@ u8 rtw_dynamic_chk_wk_cmd(struct adapter *padapter)
         u8      res = _SUCCESS;
 
 
-        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (ph2c == NULL) {
                 res = _FAIL;
                 goto exit;
         }
 
-        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
+        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
         if (pdrvextra_cmd_parm == NULL) {
                 kfree(ph2c);
                 res = _FAIL;
@@ -967,13 +967,13 @@ u8 rtw_lps_ctrl_wk_cmd(struct adapter *padapter, u8 lps_ctrl_type, u8 enqueue)
         u8      res = _SUCCESS;
 
         if (enqueue) {
-                ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+                ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
                 if (ph2c == NULL) {
                         res = _FAIL;
                         goto exit;
                 }
 
-                pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
+                pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
                 if (pdrvextra_cmd_parm == NULL) {
                         kfree(ph2c);
                         res = _FAIL;
@@ -1010,13 +1010,13 @@ u8 rtw_rpt_timer_cfg_cmd(struct adapter *padapter, u16 min_time)
 
         u8      res = _SUCCESS;
 
-        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (ph2c == NULL) {
                 res = _FAIL;
                 goto exit;
         }
 
-        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
+        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
         if (pdrvextra_cmd_parm == NULL) {
                 kfree(ph2c);
                 res = _FAIL;
@@ -1088,13 +1088,13 @@ u8 rtw_ps_cmd(struct adapter *padapter)
 
         u8      res = _SUCCESS;
 
-        ppscmd = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        ppscmd = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (ppscmd == NULL) {
                 res = _FAIL;
                 goto exit;
         }
 
-        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
+        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
         if (pdrvextra_cmd_parm == NULL) {
                 kfree(ppscmd);
                 res = _FAIL;
diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c
index 5ba5099ec20d..70b1bc3e0e63 100644
--- a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c
@@ -4241,12 +4241,12 @@ void report_survey_event(struct adapter *padapter,
         pcmdpriv = &padapter->cmdpriv;
 
 
-        pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (pcmd_obj == NULL)
                 return;
 
         cmdsz = (sizeof(struct survey_event) + sizeof(struct C2HEvent_Header));
-        pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
+        pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
         if (pevtcmd == NULL) {
                 kfree(pcmd_obj);
                 return;
@@ -4339,12 +4339,12 @@ void report_join_res(struct adapter *padapter, int res)
         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
 
-        pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (pcmd_obj == NULL)
                 return;
 
         cmdsz = (sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header));
-        pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
+        pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
         if (pevtcmd == NULL) {
                 kfree(pcmd_obj);
                 return;
@@ -4854,11 +4854,11 @@ void survey_timer_hdl(void *function_context)
                         pmlmeext->scan_abort = false;/* reset */
                 }
 
-                ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+                ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
                 if (ph2c == NULL)
                         goto exit_survey_timer_hdl;
 
-                psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_KERNEL);
+                psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
                 if (psurveyPara == NULL) {
                         kfree(ph2c);
                         goto exit_survey_timer_hdl;
diff --git a/drivers/staging/rtl8188eu/core/rtw_wlan_util.c b/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
index 33ccbbbd8ed6..d300369977fa 100644
--- a/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
@@ -935,7 +935,7 @@ int rtw_check_bcn_info(struct adapter  *Adapter, u8 *pframe, u32 packet_len)
                 return true;
         }
 
-        bssid = kzalloc(sizeof(struct wlan_bssid_ex), GFP_KERNEL);
+        bssid = kzalloc(sizeof(struct wlan_bssid_ex), GFP_ATOMIC);
 
         subtype = GetFrameSubType(pframe) >> 4;
 
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 407a318b09db..2f87150a21b7 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -47,6 +47,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
         {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
         {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
         {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
+        {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
         {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
         {}      /* Terminating entry */
 };
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index b19e4329ba00..73e58d22e325 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -3491,7 +3491,7 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
                                 len = sprintf(buf, "TargetAddress="
                                         "%s:%hu,%hu",
                                         inaddr_any ? conn->local_ip : np->np_ip,
-                                        inaddr_any ? conn->local_port : np->np_port,
+                                        np->np_port,
                                         tpg->tpgt);
                                 len += 1;
 
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 8c60a1a1ae8d..9f93b8234095 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -2738,7 +2738,8 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
         struct t10_pr_registration *pr_reg, *pr_reg_tmp, *pr_reg_n, *pr_res_holder;
         struct t10_reservation *pr_tmpl = &dev->t10_pr;
         u32 pr_res_mapped_lun = 0;
-        int all_reg = 0, calling_it_nexus = 0, released_regs = 0;
+        int all_reg = 0, calling_it_nexus = 0;
+        bool sa_res_key_unmatched = sa_res_key != 0;
         int prh_type = 0, prh_scope = 0;
 
         if (!se_sess)
@@ -2813,6 +2814,7 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                         if (!all_reg) {
                                 if (pr_reg->pr_res_key != sa_res_key)
                                         continue;
+                                sa_res_key_unmatched = false;
 
                                 calling_it_nexus = (pr_reg_n == pr_reg) ? 1 : 0;
                                 pr_reg_nacl = pr_reg->pr_reg_nacl;
@@ -2820,7 +2822,6 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                                 __core_scsi3_free_registration(dev, pr_reg,
                                         (preempt_type == PREEMPT_AND_ABORT) ? &preempt_and_abort_list :
                                                 NULL, calling_it_nexus);
-                                released_regs++;
                         } else {
                                 /*
                                  * Case for any existing all registrants type
@@ -2838,6 +2839,7 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                                 if ((sa_res_key) &&
                                      (pr_reg->pr_res_key != sa_res_key))
                                         continue;
+                                sa_res_key_unmatched = false;
 
                                 calling_it_nexus = (pr_reg_n == pr_reg) ? 1 : 0;
                                 if (calling_it_nexus)
@@ -2848,7 +2850,6 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                                 __core_scsi3_free_registration(dev, pr_reg,
                                         (preempt_type == PREEMPT_AND_ABORT) ? &preempt_and_abort_list :
                                                 NULL, 0);
-                                released_regs++;
                         }
                         if (!calling_it_nexus)
                                 core_scsi3_ua_allocate(pr_reg_nacl,
@@ -2863,7 +2864,7 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                  * registered reservation key, then the device server shall
                  * complete the command with RESERVATION CONFLICT status.
                  */
-                if (!released_regs) {
+                if (sa_res_key_unmatched) {
                         spin_unlock(&dev->dev_reservation_lock);
                         core_scsi3_put_pr_reg(pr_reg_n);
                         return TCM_RESERVATION_CONFLICT;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 9ea0d5f03f7a..be877bf6f730 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2292,7 +2292,7 @@ transport_generic_new_cmd(struct se_cmd *cmd)
          * and let it call back once the write buffers are ready.
          */
         target_add_to_state_list(cmd);
-        if (cmd->data_direction != DMA_TO_DEVICE) {
+        if (cmd->data_direction != DMA_TO_DEVICE || cmd->data_length == 0) {
                 target_execute_cmd(cmd);
                 return 0;
         }
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 1ab0018271c5..ad09e51ffae4 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -50,15 +50,14 @@ struct cpufreq_cooling_device {
         unsigned int cpufreq_state;
         unsigned int cpufreq_val;
         struct cpumask allowed_cpus;
+        struct list_head node;
 };
 static DEFINE_IDR(cpufreq_idr);
 static DEFINE_MUTEX(cooling_cpufreq_lock);
 
 static unsigned int cpufreq_dev_count;
 
-/* notify_table passes value to the CPUFREQ_ADJUST callback function. */
-#define NOTIFY_INVALID NULL
-static struct cpufreq_cooling_device *notify_device;
+static LIST_HEAD(cpufreq_dev_list);
 
 /**
  * get_idr - function to get a unique id.
@@ -287,15 +286,12 @@ static int cpufreq_apply_cooling(struct cpufreq_cooling_device *cpufreq_device,
 
         cpufreq_device->cpufreq_state = cooling_state;
         cpufreq_device->cpufreq_val = clip_freq;
-        notify_device = cpufreq_device;
 
         for_each_cpu(cpuid, mask) {
                 if (is_cpufreq_valid(cpuid))
                         cpufreq_update_policy(cpuid);
         }
 
-        notify_device = NOTIFY_INVALID;
-
         return 0;
 }
 
@@ -316,21 +312,28 @@ static int cpufreq_thermal_notifier(struct notifier_block *nb,
 {
         struct cpufreq_policy *policy = data;
         unsigned long max_freq = 0;
+        struct cpufreq_cooling_device *cpufreq_dev;
 
-        if (event != CPUFREQ_ADJUST || notify_device == NOTIFY_INVALID)
+        if (event != CPUFREQ_ADJUST)
                 return 0;
 
-        if (cpumask_test_cpu(policy->cpu, &notify_device->allowed_cpus))
-                max_freq = notify_device->cpufreq_val;
-        else
-                return 0;
+        mutex_lock(&cooling_cpufreq_lock);
+        list_for_each_entry(cpufreq_dev, &cpufreq_dev_list, node) {
+                if (!cpumask_test_cpu(policy->cpu,
+                                        &cpufreq_dev->allowed_cpus))
+                        continue;
+
+                if (!cpufreq_dev->cpufreq_val)
+                        cpufreq_dev->cpufreq_val = get_cpu_frequency(
+                                        cpumask_any(&cpufreq_dev->allowed_cpus),
+                                        cpufreq_dev->cpufreq_state);
 
-        /* Never exceed user_policy.max */
-        if (max_freq > policy->user_policy.max)
-                max_freq = policy->user_policy.max;
+                max_freq = cpufreq_dev->cpufreq_val;
 
-        if (policy->max != max_freq)
-                cpufreq_verify_within_limits(policy, 0, max_freq);
+                if (policy->max != max_freq)
+                        cpufreq_verify_within_limits(policy, 0, max_freq);
+        }
+        mutex_unlock(&cooling_cpufreq_lock);
 
         return 0;
 }
@@ -486,6 +489,7 @@ __cpufreq_cooling_register(struct device_node *np,
                 cpufreq_register_notifier(&thermal_cpufreq_notifier_block,
                                           CPUFREQ_POLICY_NOTIFIER);
         cpufreq_dev_count++;
+        list_add(&cpufreq_dev->node, &cpufreq_dev_list);
 
         mutex_unlock(&cooling_cpufreq_lock);
 
@@ -549,6 +553,7 @@ void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
 
         cpufreq_dev = cdev->devdata;
         mutex_lock(&cooling_cpufreq_lock);
+        list_del(&cpufreq_dev->node);
         cpufreq_dev_count--;
 
         /* Unregister the notifier for the last cpufreq cooling device */
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index 461bf3d033a0..5a1f1070b702 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -459,6 +459,10 @@ static int imx_thermal_probe(struct platform_device *pdev)
         int measure_freq;
         int ret;
 
+        if (!cpufreq_get_current_driver()) {
+                dev_dbg(&pdev->dev, "no cpufreq driver!");
+                return -EPROBE_DEFER;
+        }
         data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
@@ -521,6 +525,30 @@ static int imx_thermal_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        data->thermal_clk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(data->thermal_clk)) {
+                ret = PTR_ERR(data->thermal_clk);
+                if (ret != -EPROBE_DEFER)
+                        dev_err(&pdev->dev,
+                                "failed to get thermal clk: %d\n", ret);
+                cpufreq_cooling_unregister(data->cdev);
+                return ret;
+        }
+
+        /*
+         * Thermal sensor needs clk on to get correct value, normally
+         * we should enable its clk before taking measurement and disable
+         * clk after measurement is done, but if alarm function is enabled,
+         * hardware will auto measure the temperature periodically, so we
+         * need to keep the clk always on for alarm function.
+         */
+        ret = clk_prepare_enable(data->thermal_clk);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to enable thermal clk: %d\n", ret);
+                cpufreq_cooling_unregister(data->cdev);
+                return ret;
+        }
+
         data->tz = thermal_zone_device_register("imx_thermal_zone",
                                                 IMX_TRIP_NUM,
                                                 BIT(IMX_TRIP_PASSIVE), data,
@@ -531,26 +559,11 @@ static int imx_thermal_probe(struct platform_device *pdev)
                 ret = PTR_ERR(data->tz);
                 dev_err(&pdev->dev,
                         "failed to register thermal zone device %d\n", ret);
+                clk_disable_unprepare(data->thermal_clk);
                 cpufreq_cooling_unregister(data->cdev);
                 return ret;
         }
 
-        data->thermal_clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(data->thermal_clk)) {
-                dev_warn(&pdev->dev, "failed to get thermal clk!\n");
-        } else {
-                /*
-                 * Thermal sensor needs clk on to get correct value, normally
-                 * we should enable its clk before taking measurement and disable
-                 * clk after measurement is done, but if alarm function is enabled,
-                 * hardware will auto measure the temperature periodically, so we
-                 * need to keep the clk always on for alarm function.
-                 */
-                ret = clk_prepare_enable(data->thermal_clk);
-                if (ret)
-                        dev_warn(&pdev->dev, "failed to enable thermal clk: %d\n", ret);
-        }
-
         /* Enable measurements at ~ 10 Hz */
         regmap_write(map, TEMPSENSE1 + REG_CLR, TEMPSENSE1_MEASURE_FREQ);
         measure_freq = DIV_ROUND_UP(32768, 10); /* 10 Hz */
diff --git a/drivers/thermal/int340x_thermal/int3403_thermal.c b/drivers/thermal/int340x_thermal/int3403_thermal.c
index d20dba986f0f..6e9fb62eb817 100644
--- a/drivers/thermal/int340x_thermal/int3403_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3403_thermal.c
@@ -92,7 +92,13 @@ static int sys_get_trip_hyst(struct thermal_zone_device *tzone,
         if (ACPI_FAILURE(status))
                 return -EIO;
 
-        *temp = DECI_KELVIN_TO_MILLI_CELSIUS(hyst, KELVIN_OFFSET);
+        /*
+         * Thermal hysteresis represents a temperature difference.
+         * Kelvin and Celsius have same degree size. So the
+         * conversion here between tenths of degree Kelvin unit
+         * and Milli-Celsius unit is just to multiply 100.
+         */
+        *temp = hyst * 100;
 
         return 0;
 }
diff --git a/drivers/thermal/samsung/exynos_thermal_common.c b/drivers/thermal/samsung/exynos_thermal_common.c
index 3f5ad25ddca8..b6be572704a4 100644
--- a/drivers/thermal/samsung/exynos_thermal_common.c
+++ b/drivers/thermal/samsung/exynos_thermal_common.c
@@ -417,13 +417,10 @@ void exynos_unregister_thermal(struct thermal_sensor_conf *sensor_conf)
 
         th_zone = sensor_conf->pzone_data;
 
-        if (th_zone->therm_dev)
-                thermal_zone_device_unregister(th_zone->therm_dev);
+        thermal_zone_device_unregister(th_zone->therm_dev);
 
-        for (i = 0; i < th_zone->cool_dev_size; i++) {
-                if (th_zone->cool_dev[i])
-                        cpufreq_cooling_unregister(th_zone->cool_dev[i]);
-        }
+        for (i = 0; i < th_zone->cool_dev_size; ++i)
+                cpufreq_cooling_unregister(th_zone->cool_dev[i]);
 
         dev_info(sensor_conf->dev,
                 "Exynos: Kernel Thermal management unregistered\n");
diff --git a/drivers/thermal/samsung/exynos_tmu_data.c b/drivers/thermal/samsung/exynos_tmu_data.c
index 2683d2897e90..1724f6cdaef8 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.c
+++ b/drivers/thermal/samsung/exynos_tmu_data.c
@@ -264,7 +264,6 @@ struct exynos_tmu_init_data const exynos5250_default_tmu_data = {
 static const struct exynos_tmu_registers exynos5260_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
-        .tmu_ctrl = EXYNOS_TMU_REG_CONTROL1,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
diff --git a/drivers/thermal/samsung/exynos_tmu_data.h b/drivers/thermal/samsung/exynos_tmu_data.h
index 65e2ea6a9579..63de598c9c2c 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.h
+++ b/drivers/thermal/samsung/exynos_tmu_data.h
@@ -75,7 +75,6 @@
 #define EXYNOS_MAX_TRIGGER_PER_REG      4
 
 /* Exynos5260 specific */
-#define EXYNOS_TMU_REG_CONTROL1                 0x24
 #define EXYNOS5260_TMU_REG_INTEN                0xC0
 #define EXYNOS5260_TMU_REG_INTSTAT              0xC4
 #define EXYNOS5260_TMU_REG_INTCLEAR             0xC8
diff --git a/drivers/thermal/st/st_thermal.c b/drivers/thermal/st/st_thermal.c
index 90163b384660..d1ec5804c0bb 100644
--- a/drivers/thermal/st/st_thermal.c
+++ b/drivers/thermal/st/st_thermal.c
@@ -275,6 +275,7 @@ int st_thermal_unregister(struct platform_device *pdev)
 }
 EXPORT_SYMBOL_GPL(st_thermal_unregister);
 
+#ifdef CONFIG_PM_SLEEP
 static int st_thermal_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -305,6 +306,8 @@ static int st_thermal_resume(struct device *dev)
 
         return 0;
 }
+#endif
+
 SIMPLE_DEV_PM_OPS(st_thermal_pm_ops, st_thermal_suspend, st_thermal_resume);
 EXPORT_SYMBOL_GPL(st_thermal_pm_ops);
 
diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
index 56982da4a9e9..bf355050eab6 100644
--- a/drivers/tty/serial/of_serial.c
+++ b/drivers/tty/serial/of_serial.c
@@ -240,32 +240,6 @@ static int of_platform_serial_remove(struct platform_device *ofdev)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int of_serial_suspend(struct device *dev)
-{
-        struct of_serial_info *info = dev_get_drvdata(dev);
-
-        serial8250_suspend_port(info->line);
-        if (info->clk)
-                clk_disable_unprepare(info->clk);
-
-        return 0;
-}
-
-static int of_serial_resume(struct device *dev)
-{
-        struct of_serial_info *info = dev_get_drvdata(dev);
-
-        if (info->clk)
-                clk_prepare_enable(info->clk);
-
-        serial8250_resume_port(info->line);
-
-        return 0;
-}
-#endif
-static SIMPLE_DEV_PM_OPS(of_serial_pm_ops, of_serial_suspend, of_serial_resume);
-
 /*
  * A few common types, add more as needed.
  */
@@ -297,7 +271,6 @@ static struct platform_driver of_platform_serial_driver = {
                 .name = "of_serial",
                 .owner = THIS_MODULE,
                 .of_match_table = of_platform_serial_table,
-                .pm = &of_serial_pm_ops,
         },
         .probe = of_platform_serial_probe,
         .remove = of_platform_serial_remove,
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 39b4081b632d..96fafed92b76 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -44,6 +44,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Creative SB Audigy 2 NX */
         { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Microsoft Wireless Laser Mouse 6000 Receiver */
+        { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Microsoft LifeCam-VX700 v2.0 */
         { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 711b23019d54..df38e7ef4976 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -791,6 +791,10 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
 
         trb = dwc->ep0_trb;
 
+        r = next_request(&ep0->request_list);
+        if (!r)
+                return;
+
         status = DWC3_TRB_SIZE_TRBSTS(trb->size);
         if (status == DWC3_TRBSTS_SETUP_PENDING) {
                 dwc3_trace(trace_dwc3_ep0, "Setup Pending received");
@@ -801,10 +805,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
                 return;
         }
 
-        r = next_request(&ep0->request_list);
-        if (!r)
-                return;
-
         ur = &r->request;
 
         length = trb->size & DWC3_TRB_SIZE_MASK;
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 696160d48ae8..388cfd83b6b6 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -22,7 +22,6 @@
 
 
 #include <linux/slab.h>
-#include <linux/device.h>
 #include <asm/unaligned.h>
 
 #include "xhci.h"
@@ -1149,9 +1148,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                  * including the USB 3.0 roothub, but only if CONFIG_PM_RUNTIME
                  * is enabled, so also enable remote wake here.
                  */
-                if (hcd->self.root_hub->do_remote_wakeup
-                                && device_may_wakeup(hcd->self.controller)) {
-
+                if (hcd->self.root_hub->do_remote_wakeup) {
                         if (t1 & PORT_CONNECT) {
                                 t2 |= PORT_WKOC_E | PORT_WKDISC_E;
                                 t2 &= ~PORT_WKCONN_E;
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 9a69b1f1b300..142b601f9563 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -281,7 +281,7 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
         if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
                 pdev->no_d3cold = true;
 
-        return xhci_suspend(xhci);
+        return xhci_suspend(xhci, do_wakeup);
 }
 
 static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 3d78b0cd674b..646300cbe5f7 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -204,7 +204,15 @@ static int xhci_plat_suspend(struct device *dev)
         struct usb_hcd  *hcd = dev_get_drvdata(dev);
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
 
-        return xhci_suspend(xhci);
+        /*
+         * xhci_suspend() needs `do_wakeup` to know whether host is allowed
+         * to do wakeup during suspend. Since xhci_plat_suspend is currently
+         * only designed for system suspend, device_may_wakeup() is enough
+         * to dertermine whether host is allowed to do wakeup. Need to
+         * reconsider this when xhci_plat_suspend enlarges its scope, e.g.,
+         * also applies to runtime suspend.
+         */
+        return xhci_suspend(xhci, device_may_wakeup(dev));
 }
 
 static int xhci_plat_resume(struct device *dev)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index bc6fcbc16f61..06433aec81d7 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1067,9 +1067,8 @@ static void xhci_handle_cmd_reset_ep(struct xhci_hcd *xhci, int slot_id,
                                 false);
                 xhci_ring_cmd_db(xhci);
         } else {
-                /* Clear our internal halted state and restart the ring(s) */
+                /* Clear our internal halted state */
                 xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_HALTED;
-                ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
         }
 }
 
@@ -1823,22 +1822,13 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 ep->stopped_td = td;
                 return 0;
         } else {
-                if (trb_comp_code == COMP_STALL) {
-                        /* The transfer is completed from the driver's
-                         * perspective, but we need to issue a set dequeue
-                         * command for this stalled endpoint to move the dequeue
-                         * pointer past the TD.  We can't do that here because
-                         * the halt condition must be cleared first.  Let the
-                         * USB class driver clear the stall later.
-                         */
-                        ep->stopped_td = td;
-                        ep->stopped_stream = ep_ring->stream_id;
-                } else if (xhci_requires_manual_halt_cleanup(xhci,
-                                        ep_ctx, trb_comp_code)) {
-                        /* Other types of errors halt the endpoint, but the
-                         * class driver doesn't call usb_reset_endpoint() unless
-                         * the error is -EPIPE.  Clear the halted status in the
-                         * xHCI hardware manually.
+                if (trb_comp_code == COMP_STALL ||
+                    xhci_requires_manual_halt_cleanup(xhci, ep_ctx,
+                                                      trb_comp_code)) {
+                        /* Issue a reset endpoint command to clear the host side
+                         * halt, followed by a set dequeue command to move the
+                         * dequeue pointer past the TD.
+                         * The class driver clears the device side halt later.
                          */
                         xhci_cleanup_halted_endpoint(xhci,
                                         slot_id, ep_index, ep_ring->stream_id,
@@ -1958,9 +1948,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 else
                         td->urb->actual_length = 0;
 
-                xhci_cleanup_halted_endpoint(xhci,
-                        slot_id, ep_index, 0, td, event_trb);
-                return finish_td(xhci, td, event_trb, event, ep, status, true);
+                return finish_td(xhci, td, event_trb, event, ep, status, false);
         }
         /*
          * Did we transfer any data, despite the errors that might have
@@ -2519,17 +2507,8 @@ cleanup:
                 if (ret) {
                         urb = td->urb;
                         urb_priv = urb->hcpriv;
-                        /* Leave the TD around for the reset endpoint function
-                         * to use(but only if it's not a control endpoint,
-                         * since we already queued the Set TR dequeue pointer
-                         * command for stalled control endpoints).
-                         */
-                        if (usb_endpoint_xfer_control(&urb->ep->desc) ||
-                                (trb_comp_code != COMP_STALL &&
-                                        trb_comp_code != COMP_BABBLE))
-                                xhci_urb_free_priv(xhci, urb_priv);
-                        else
-                                kfree(urb_priv);
+
+                        xhci_urb_free_priv(xhci, urb_priv);
 
                         usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb);
                         if ((urb->actual_length != urb->transfer_buffer_length &&
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2a5d45b4cb15..033b46c470bd 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -35,6 +35,8 @@
 #define DRIVER_AUTHOR "Sarah Sharp"
 #define DRIVER_DESC "'eXtensible' Host Controller (xHC) Driver"
 
+#define PORT_WAKE_BITS  (PORT_WKOC_E | PORT_WKDISC_E | PORT_WKCONN_E)
+
 /* Some 0.95 hardware can't handle the chain bit on a Link TRB being cleared */
 static int link_quirk;
 module_param(link_quirk, int, S_IRUGO | S_IWUSR);
@@ -851,13 +853,47 @@ static void xhci_clear_command_ring(struct xhci_hcd *xhci)
         xhci_set_cmd_ring_deq(xhci);
 }
 
+static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
+{
+        int port_index;
+        __le32 __iomem **port_array;
+        unsigned long flags;
+        u32 t1, t2;
+
+        spin_lock_irqsave(&xhci->lock, flags);
+
+        /* disble usb3 ports Wake bits*/
+        port_index = xhci->num_usb3_ports;
+        port_array = xhci->usb3_ports;
+        while (port_index--) {
+                t1 = readl(port_array[port_index]);
+                t1 = xhci_port_state_to_neutral(t1);
+                t2 = t1 & ~PORT_WAKE_BITS;
+                if (t1 != t2)
+                        writel(t2, port_array[port_index]);
+        }
+
+        /* disble usb2 ports Wake bits*/
+        port_index = xhci->num_usb2_ports;
+        port_array = xhci->usb2_ports;
+        while (port_index--) {
+                t1 = readl(port_array[port_index]);
+                t1 = xhci_port_state_to_neutral(t1);
+                t2 = t1 & ~PORT_WAKE_BITS;
+                if (t1 != t2)
+                        writel(t2, port_array[port_index]);
+        }
+
+        spin_unlock_irqrestore(&xhci->lock, flags);
+}
+
 /*
  * Stop HC (not bus-specific)
  *
  * This is called when the machine transition into S3/S4 mode.
  *
  */
-int xhci_suspend(struct xhci_hcd *xhci)
+int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
 {
         int                     rc = 0;
         unsigned int            delay = XHCI_MAX_HALT_USEC;
@@ -868,6 +904,10 @@ int xhci_suspend(struct xhci_hcd *xhci)
                         xhci->shared_hcd->state != HC_STATE_SUSPENDED)
                 return -EINVAL;
 
+        /* Clear root port wake on bits if wakeup not allowed. */
+        if (!do_wakeup)
+                xhci_disable_port_wake_on_bits(xhci);
+
         /* Don't poll the roothubs on bus suspend. */
         xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
         clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
@@ -2912,68 +2952,33 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
         }
 }
 
-/* Deal with stalled endpoints.  The core should have sent the control message
- * to clear the halt condition.  However, we need to make the xHCI hardware
- * reset its sequence number, since a device will expect a sequence number of
- * zero after the halt condition is cleared.
+/* Called when clearing halted device. The core should have sent the control
+ * message to clear the device halt condition. The host side of the halt should
+ * already be cleared with a reset endpoint command issued when the STALL tx
+ * event was received.
+ *
  * Context: in_interrupt
  */
+
 void xhci_endpoint_reset(struct usb_hcd *hcd,
                 struct usb_host_endpoint *ep)
 {
         struct xhci_hcd *xhci;
-        struct usb_device *udev;
-        unsigned int ep_index;
-        unsigned long flags;
-        int ret;
-        struct xhci_virt_ep *virt_ep;
-        struct xhci_command *command;
 
         xhci = hcd_to_xhci(hcd);
-        udev = (struct usb_device *) ep->hcpriv;
-        /* Called with a root hub endpoint (or an endpoint that wasn't added
-         * with xhci_add_endpoint()
-         */
-        if (!ep->hcpriv)
-                return;
-        ep_index = xhci_get_endpoint_index(&ep->desc);
-        virt_ep = &xhci->devs[udev->slot_id]->eps[ep_index];
-        if (!virt_ep->stopped_td) {
-                xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep,
-                        "Endpoint 0x%x not halted, refusing to reset.",
-                        ep->desc.bEndpointAddress);
-                return;
-        }
-        if (usb_endpoint_xfer_control(&ep->desc)) {
-                xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep,
-                                "Control endpoint stall already handled.");
-                return;
-        }
 
-        command = xhci_alloc_command(xhci, false, false, GFP_ATOMIC);
-        if (!command)
-                return;
-
-        xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep,
-                        "Queueing reset endpoint command");
-        spin_lock_irqsave(&xhci->lock, flags);
-        ret = xhci_queue_reset_ep(xhci, command, udev->slot_id, ep_index);
         /*
-         * Can't change the ring dequeue pointer until it's transitioned to the
-         * stopped state, which is only upon a successful reset endpoint
-         * command.  Better hope that last command worked!
+         * We might need to implement the config ep cmd in xhci 4.8.1 note:
+         * The Reset Endpoint Command may only be issued to endpoints in the
+         * Halted state. If software wishes reset the Data Toggle or Sequence
+         * Number of an endpoint that isn't in the Halted state, then software
+         * may issue a Configure Endpoint Command with the Drop and Add bits set
+         * for the target endpoint. that is in the Stopped state.
          */
-        if (!ret) {
-                xhci_cleanup_stalled_ring(xhci, udev, ep_index);
-                kfree(virt_ep->stopped_td);
-                xhci_ring_cmd_db(xhci);
-        }
-        virt_ep->stopped_td = NULL;
-        virt_ep->stopped_stream = 0;
-        spin_unlock_irqrestore(&xhci->lock, flags);
 
-        if (ret)
-                xhci_warn(xhci, "FIXME allocate a new ring segment\n");
+        /* For now just print debug to follow the situation */
+        xhci_dbg(xhci, "Endpoint 0x%x ep reset callback called\n",
+                 ep->desc.bEndpointAddress);
 }
 
 static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index df76d642e719..d745715a1e2f 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1746,7 +1746,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks);
 void xhci_init_driver(struct hc_driver *drv, int (*setup_fn)(struct usb_hcd *));
 
 #ifdef  CONFIG_PM
-int xhci_suspend(struct xhci_hcd *xhci);
+int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup);
 int xhci_resume(struct xhci_hcd *xhci, bool hibernated);
 #else
 #define xhci_suspend    NULL
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index cfd009dc4018..6c4eb3cf5efd 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -120,6 +120,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
         { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
         { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
+        { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */
         { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
         { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
         { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 0dad8ce5a609..1ebb351b9e9a 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -470,6 +470,39 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FD_PID) },
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FE_PID) },
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FF_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_4701_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9300_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9301_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9302_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9303_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9304_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9305_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9306_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9307_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9308_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9309_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930A_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930B_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930C_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930D_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930E_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930F_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9310_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9311_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9312_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9313_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9314_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9315_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9316_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9317_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9318_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9319_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931A_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931B_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931C_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931D_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931E_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931F_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 6786b705ccf6..e52409c9be99 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -926,8 +926,8 @@
 #define BAYER_CONTOUR_CABLE_PID        0x6001
 
 /*
- * The following are the values for the Matrix Orbital FTDI Range
- * Anything in this range will use an FT232RL.
+ * Matrix Orbital Intelligent USB displays.
+ * http://www.matrixorbital.com
  */
 #define MTXORB_VID                      0x1B3D
 #define MTXORB_FTDI_RANGE_0100_PID      0x0100
@@ -1186,8 +1186,39 @@
 #define MTXORB_FTDI_RANGE_01FD_PID      0x01FD
 #define MTXORB_FTDI_RANGE_01FE_PID      0x01FE
 #define MTXORB_FTDI_RANGE_01FF_PID      0x01FF
-
-
+#define MTXORB_FTDI_RANGE_4701_PID      0x4701
+#define MTXORB_FTDI_RANGE_9300_PID      0x9300
+#define MTXORB_FTDI_RANGE_9301_PID      0x9301
+#define MTXORB_FTDI_RANGE_9302_PID      0x9302
+#define MTXORB_FTDI_RANGE_9303_PID      0x9303
+#define MTXORB_FTDI_RANGE_9304_PID      0x9304
+#define MTXORB_FTDI_RANGE_9305_PID      0x9305
+#define MTXORB_FTDI_RANGE_9306_PID      0x9306
+#define MTXORB_FTDI_RANGE_9307_PID      0x9307
+#define MTXORB_FTDI_RANGE_9308_PID      0x9308
+#define MTXORB_FTDI_RANGE_9309_PID      0x9309
+#define MTXORB_FTDI_RANGE_930A_PID      0x930A
+#define MTXORB_FTDI_RANGE_930B_PID      0x930B
+#define MTXORB_FTDI_RANGE_930C_PID      0x930C
+#define MTXORB_FTDI_RANGE_930D_PID      0x930D
+#define MTXORB_FTDI_RANGE_930E_PID      0x930E
+#define MTXORB_FTDI_RANGE_930F_PID      0x930F
+#define MTXORB_FTDI_RANGE_9310_PID      0x9310
+#define MTXORB_FTDI_RANGE_9311_PID      0x9311
+#define MTXORB_FTDI_RANGE_9312_PID      0x9312
+#define MTXORB_FTDI_RANGE_9313_PID      0x9313
+#define MTXORB_FTDI_RANGE_9314_PID      0x9314
+#define MTXORB_FTDI_RANGE_9315_PID      0x9315
+#define MTXORB_FTDI_RANGE_9316_PID      0x9316
+#define MTXORB_FTDI_RANGE_9317_PID      0x9317
+#define MTXORB_FTDI_RANGE_9318_PID      0x9318
+#define MTXORB_FTDI_RANGE_9319_PID      0x9319
+#define MTXORB_FTDI_RANGE_931A_PID      0x931A
+#define MTXORB_FTDI_RANGE_931B_PID      0x931B
+#define MTXORB_FTDI_RANGE_931C_PID      0x931C
+#define MTXORB_FTDI_RANGE_931D_PID      0x931D
+#define MTXORB_FTDI_RANGE_931E_PID      0x931E
+#define MTXORB_FTDI_RANGE_931F_PID      0x931F
 
 /*
  * The Mobility Lab (TML)
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 93cb7cebda62..077c714f1285 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -311,24 +311,30 @@ static void	usa26_indat_callback(struct urb *urb)
                 if ((data[0] & 0x80) == 0) {
                         /* no errors on individual bytes, only
                            possible overrun err */
-                        if (data[0] & RXERROR_OVERRUN)
-                                err = TTY_OVERRUN;
-                        else
-                                err = 0;
+                        if (data[0] & RXERROR_OVERRUN) {
+                                tty_insert_flip_char(&port->port, 0,
+                                                                TTY_OVERRUN);
+                        }
                         for (i = 1; i < urb->actual_length ; ++i)
-                                tty_insert_flip_char(&port->port, data[i], err);
+                                tty_insert_flip_char(&port->port, data[i],
+                                                                TTY_NORMAL);
                 } else {
                         /* some bytes had errors, every byte has status */
                         dev_dbg(&port->dev, "%s - RX error!!!!\n", __func__);
                         for (i = 0; i + 1 < urb->actual_length; i += 2) {
-                                int stat = data[i], flag = 0;
-                                if (stat & RXERROR_OVERRUN)
-                                        flag |= TTY_OVERRUN;
-                                if (stat & RXERROR_FRAMING)
-                                        flag |= TTY_FRAME;
-                                if (stat & RXERROR_PARITY)
-                                        flag |= TTY_PARITY;
+                                int stat = data[i];
+                                int flag = TTY_NORMAL;
+
+                                if (stat & RXERROR_OVERRUN) {
+                                        tty_insert_flip_char(&port->port, 0,
+                                                                TTY_OVERRUN);
+                                }
                                 /* XXX should handle break (0x10) */
+                                if (stat & RXERROR_PARITY)
+                                        flag = TTY_PARITY;
+                                else if (stat & RXERROR_FRAMING)
+                                        flag = TTY_FRAME;
+
                                 tty_insert_flip_char(&port->port, data[i+1],
                                                 flag);
                         }
@@ -649,14 +655,19 @@ static void	usa49_indat_callback(struct urb *urb)
                 } else {
                         /* some bytes had errors, every byte has status */
                         for (i = 0; i + 1 < urb->actual_length; i += 2) {
-                                int stat = data[i], flag = 0;
-                                if (stat & RXERROR_OVERRUN)
-                                        flag |= TTY_OVERRUN;
-                                if (stat & RXERROR_FRAMING)
-                                        flag |= TTY_FRAME;
-                                if (stat & RXERROR_PARITY)
-                                        flag |= TTY_PARITY;
+                                int stat = data[i];
+                                int flag = TTY_NORMAL;
+
+                                if (stat & RXERROR_OVERRUN) {
+                                        tty_insert_flip_char(&port->port, 0,
+                                                                TTY_OVERRUN);
+                                }
                                 /* XXX should handle break (0x10) */
+                                if (stat & RXERROR_PARITY)
+                                        flag = TTY_PARITY;
+                                else if (stat & RXERROR_FRAMING)
+                                        flag = TTY_FRAME;
+
                                 tty_insert_flip_char(&port->port, data[i+1],
                                                 flag);
                         }
@@ -713,15 +724,19 @@ static void usa49wg_indat_callback(struct urb *urb)
                          */
                         for (x = 0; x + 1 < len &&
                                     i + 1 < urb->actual_length; x += 2) {
-                                int stat = data[i], flag = 0;
+                                int stat = data[i];
+                                int flag = TTY_NORMAL;
 
-                                if (stat & RXERROR_OVERRUN)
-                                        flag |= TTY_OVERRUN;
-                                if (stat & RXERROR_FRAMING)
-                                        flag |= TTY_FRAME;
-                                if (stat & RXERROR_PARITY)
-                                        flag |= TTY_PARITY;
+                                if (stat & RXERROR_OVERRUN) {
+                                        tty_insert_flip_char(&port->port, 0,
+                                                                TTY_OVERRUN);
+                                }
                                 /* XXX should handle break (0x10) */
+                                if (stat & RXERROR_PARITY)
+                                        flag = TTY_PARITY;
+                                else if (stat & RXERROR_FRAMING)
+                                        flag = TTY_FRAME;
+
                                 tty_insert_flip_char(&port->port, data[i+1],
                                                      flag);
                                 i += 2;
@@ -773,25 +788,31 @@ static void usa90_indat_callback(struct urb *urb)
                         if ((data[0] & 0x80) == 0) {
                                 /* no errors on individual bytes, only
                                    possible overrun err*/
-                                if (data[0] & RXERROR_OVERRUN)
-                                        err = TTY_OVERRUN;
-                                else
-                                        err = 0;
+                                if (data[0] & RXERROR_OVERRUN) {
+                                        tty_insert_flip_char(&port->port, 0,
+                                                                TTY_OVERRUN);
+                                }
                                 for (i = 1; i < urb->actual_length ; ++i)
                                         tty_insert_flip_char(&port->port,
-                                                        data[i], err);
+                                                        data[i], TTY_NORMAL);
                         }  else {
                         /* some bytes had errors, every byte has status */
                                 dev_dbg(&port->dev, "%s - RX error!!!!\n", __func__);
                                 for (i = 0; i + 1 < urb->actual_length; i += 2) {
-                                        int stat = data[i], flag = 0;
-                                        if (stat & RXERROR_OVERRUN)
-                                                flag |= TTY_OVERRUN;
-                                        if (stat & RXERROR_FRAMING)
-                                                flag |= TTY_FRAME;
-                                        if (stat & RXERROR_PARITY)
-                                                flag |= TTY_PARITY;
+                                        int stat = data[i];
+                                        int flag = TTY_NORMAL;
+
+                                        if (stat & RXERROR_OVERRUN) {
+                                                tty_insert_flip_char(
+                                                                &port->port, 0,
+                                                                TTY_OVERRUN);
+                                        }
                                         /* XXX should handle break (0x10) */
+                                        if (stat & RXERROR_PARITY)
+                                                flag = TTY_PARITY;
+                                        else if (stat & RXERROR_FRAMING)
+                                                flag = TTY_FRAME;
+
                                         tty_insert_flip_char(&port->port,
                                                         data[i+1], flag);
                                 }
diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
index a7fe664b6b7d..70a098de429f 100644
--- a/drivers/usb/serial/ssu100.c
+++ b/drivers/usb/serial/ssu100.c
@@ -490,10 +490,9 @@ static void ssu100_update_lsr(struct usb_serial_port *port, u8 lsr,
                         if (*tty_flag == TTY_NORMAL)
                                 *tty_flag = TTY_FRAME;
                 }
-                if (lsr & UART_LSR_OE){
+                if (lsr & UART_LSR_OE) {
                         port->icount.overrun++;
-                        if (*tty_flag == TTY_NORMAL)
-                                *tty_flag = TTY_OVERRUN;
+                        tty_insert_flip_char(&port->port, 0, TTY_OVERRUN);
                 }
         }
 
@@ -511,12 +510,8 @@ static void ssu100_process_read_urb(struct urb *urb)
         if ((len >= 4) &&
             (packet[0] == 0x1b) && (packet[1] == 0x1b) &&
             ((packet[2] == 0x00) || (packet[2] == 0x01))) {
-                if (packet[2] == 0x00) {
+                if (packet[2] == 0x00)
                         ssu100_update_lsr(port, packet[3], &flag);
-                        if (flag == TTY_OVERRUN)
-                                tty_insert_flip_char(&port->port, 0,
-                                                TTY_OVERRUN);
-                }
                 if (packet[2] == 0x01)
                         ssu100_update_msr(port, packet[3]);
 
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 2fefaf923e4a..18a283d6de1c 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -103,3 +103,10 @@ UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
                 "VL711",
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_ATA_1X),
+
+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x9999,
+                "Hitachi",
+                "External HDD",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_UAS),
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 69906cacd04f..a17f11850669 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1312,6 +1312,7 @@ static int
 vhost_scsi_set_endpoint(struct vhost_scsi *vs,
                         struct vhost_scsi_target *t)
 {
+        struct se_portal_group *se_tpg;
         struct tcm_vhost_tport *tv_tport;
         struct tcm_vhost_tpg *tpg;
         struct tcm_vhost_tpg **vs_tpg;
@@ -1359,6 +1360,21 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
                                 ret = -EEXIST;
                                 goto out;
                         }
+                        /*
+                         * In order to ensure individual vhost-scsi configfs
+                         * groups cannot be removed while in use by vhost ioctl,
+                         * go ahead and take an explicit se_tpg->tpg_group.cg_item
+                         * dependency now.
+                         */
+                        se_tpg = &tpg->se_tpg;
+                        ret = configfs_depend_item(se_tpg->se_tpg_tfo->tf_subsys,
+                                                   &se_tpg->tpg_group.cg_item);
+                        if (ret) {
+                                pr_warn("configfs_depend_item() failed: %d\n", ret);
+                                kfree(vs_tpg);
+                                mutex_unlock(&tpg->tv_tpg_mutex);
+                                goto out;
+                        }
                         tpg->tv_tpg_vhost_count++;
                         tpg->vhost_scsi = vs;
                         vs_tpg[tpg->tport_tpgt] = tpg;
@@ -1401,6 +1417,7 @@ static int
 vhost_scsi_clear_endpoint(struct vhost_scsi *vs,
                           struct vhost_scsi_target *t)
 {
+        struct se_portal_group *se_tpg;
         struct tcm_vhost_tport *tv_tport;
         struct tcm_vhost_tpg *tpg;
         struct vhost_virtqueue *vq;
@@ -1449,6 +1466,13 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs,
                 vs->vs_tpg[target] = NULL;
                 match = true;
                 mutex_unlock(&tpg->tv_tpg_mutex);
+                /*
+                 * Release se_tpg->tpg_group.cg_item configfs dependency now
+                 * to allow vhost-scsi WWPN se_tpg->tpg_group shutdown to occur.
+                 */
+                se_tpg = &tpg->se_tpg;
+                configfs_undepend_item(se_tpg->se_tpg_tfo->tf_subsys,
+                                       &se_tpg->tpg_group.cg_item);
         }
         if (match) {
                 for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
diff --git a/fs/Makefile b/fs/Makefile
index 34a1b9dea6dd..da0bbb456d3f 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -104,7 +104,7 @@ obj-$(CONFIG_QNX6FS_FS)		+= qnx6/
 obj-$(CONFIG_AUTOFS4_FS)        += autofs4/
 obj-$(CONFIG_ADFS_FS)           += adfs/
 obj-$(CONFIG_FUSE_FS)           += fuse/
-obj-$(CONFIG_OVERLAYFS_FS)      += overlayfs/
+obj-$(CONFIG_OVERLAY_FS)        += overlayfs/
 obj-$(CONFIG_UDF_FS)            += udf/
 obj-$(CONFIG_SUN_OPENPROMFS)    += openpromfs/
 obj-$(CONFIG_OMFS_FS)           += omfs/
diff --git a/fs/aio.c b/fs/aio.c
index 84a751005f5b..14b93159ef83 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -165,6 +165,15 @@ static struct vfsmount *aio_mnt;
 static const struct file_operations aio_ring_fops;
 static const struct address_space_operations aio_ctx_aops;
 
+/* Backing dev info for aio fs.
+ * -no dirty page accounting or writeback happens
+ */
+static struct backing_dev_info aio_fs_backing_dev_info = {
+        .name           = "aiofs",
+        .state          = 0,
+        .capabilities   = BDI_CAP_NO_ACCT_AND_WRITEBACK | BDI_CAP_MAP_COPY,
+};
+
 static struct file *aio_private_file(struct kioctx *ctx, loff_t nr_pages)
 {
         struct qstr this = QSTR_INIT("[aio]", 5);
@@ -176,6 +185,7 @@ static struct file *aio_private_file(struct kioctx *ctx, loff_t nr_pages)
 
         inode->i_mapping->a_ops = &aio_ctx_aops;
         inode->i_mapping->private_data = ctx;
+        inode->i_mapping->backing_dev_info = &aio_fs_backing_dev_info;
         inode->i_size = PAGE_SIZE * nr_pages;
 
         path.dentry = d_alloc_pseudo(aio_mnt->mnt_sb, &this);
@@ -220,6 +230,9 @@ static int __init aio_setup(void)
         if (IS_ERR(aio_mnt))
                 panic("Failed to create aio fs mount.");
 
+        if (bdi_init(&aio_fs_backing_dev_info))
+                panic("Failed to init aio fs backing dev info.");
+
         kiocb_cachep = KMEM_CACHE(kiocb, SLAB_HWCACHE_ALIGN|SLAB_PANIC);
         kioctx_cachep = KMEM_CACHE(kioctx,SLAB_HWCACHE_ALIGN|SLAB_PANIC);
 
@@ -281,11 +294,6 @@ static const struct file_operations aio_ring_fops = {
         .mmap = aio_ring_mmap,
 };
 
-static int aio_set_page_dirty(struct page *page)
-{
-        return 0;
-}
-
 #if IS_ENABLED(CONFIG_MIGRATION)
 static int aio_migratepage(struct address_space *mapping, struct page *new,
                         struct page *old, enum migrate_mode mode)
@@ -357,7 +365,7 @@ out:
 #endif
 
 static const struct address_space_operations aio_ctx_aops = {
-        .set_page_dirty = aio_set_page_dirty,
+        .set_page_dirty = __set_page_dirty_no_writeback,
 #if IS_ENABLED(CONFIG_MIGRATION)
         .migratepage    = aio_migratepage,
 #endif
@@ -412,7 +420,6 @@ static int aio_setup_ring(struct kioctx *ctx)
                 pr_debug("pid(%d) page[%d]->count=%d\n",
                          current->pid, i, page_count(page));
                 SetPageUptodate(page);
-                SetPageDirty(page);
                 unlock_page(page);
 
                 ctx->ring_pages[i] = page;
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index d3220d31d3cb..dcd9be32ac57 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -1011,8 +1011,6 @@ int btrfs_decompress_buf2page(char *buf, unsigned long buf_start,
                 bytes = min(bytes, working_bytes);
                 kaddr = kmap_atomic(page_out);
                 memcpy(kaddr + *pg_offset, buf + buf_offset, bytes);
-                if (*pg_index == (vcnt - 1) && *pg_offset == 0)
-                        memset(kaddr + bytes, 0, PAGE_CACHE_SIZE - bytes);
                 kunmap_atomic(kaddr);
                 flush_dcache_page(page_out);
 
@@ -1054,3 +1052,34 @@ int btrfs_decompress_buf2page(char *buf, unsigned long buf_start,
 
         return 1;
 }
+
+/*
+ * When uncompressing data, we need to make sure and zero any parts of
+ * the biovec that were not filled in by the decompression code.  pg_index
+ * and pg_offset indicate the last page and the last offset of that page
+ * that have been filled in.  This will zero everything remaining in the
+ * biovec.
+ */
+void btrfs_clear_biovec_end(struct bio_vec *bvec, int vcnt,
+                                   unsigned long pg_index,
+                                   unsigned long pg_offset)
+{
+        while (pg_index < vcnt) {
+                struct page *page = bvec[pg_index].bv_page;
+                unsigned long off = bvec[pg_index].bv_offset;
+                unsigned long len = bvec[pg_index].bv_len;
+
+                if (pg_offset < off)
+                        pg_offset = off;
+                if (pg_offset < off + len) {
+                        unsigned long bytes = off + len - pg_offset;
+                        char *kaddr;
+
+                        kaddr = kmap_atomic(page);
+                        memset(kaddr + pg_offset, 0, bytes);
+                        kunmap_atomic(kaddr);
+                }
+                pg_index++;
+                pg_offset = 0;
+        }
+}
diff --git a/fs/btrfs/compression.h b/fs/btrfs/compression.h
index 0c803b4fbf93..d181f70caae0 100644
--- a/fs/btrfs/compression.h
+++ b/fs/btrfs/compression.h
@@ -45,7 +45,9 @@ int btrfs_submit_compressed_write(struct inode *inode, u64 start,
                                   unsigned long nr_pages);
 int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
                                  int mirror_num, unsigned long bio_flags);
-
+void btrfs_clear_biovec_end(struct bio_vec *bvec, int vcnt,
+                                   unsigned long pg_index,
+                                   unsigned long pg_offset);
 struct btrfs_compress_op {
         struct list_head *(*alloc_workspace)(void);
 
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 19bc6162fb8e..150822ee0a0b 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -80,13 +80,6 @@ noinline void btrfs_clear_path_blocking(struct btrfs_path *p,
 {
         int i;
 
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
-        /* lockdep really cares that we take all of these spinlocks
-         * in the right order.  If any of the locks in the path are not
-         * currently blocking, it is going to complain.  So, make really
-         * really sure by forcing the path to blocking before we clear
-         * the path blocking.
-         */
         if (held) {
                 btrfs_set_lock_blocking_rw(held, held_rw);
                 if (held_rw == BTRFS_WRITE_LOCK)
@@ -95,7 +88,6 @@ noinline void btrfs_clear_path_blocking(struct btrfs_path *p,
                         held_rw = BTRFS_READ_LOCK_BLOCKING;
         }
         btrfs_set_path_blocking(p);
-#endif
 
         for (i = BTRFS_MAX_LEVEL - 1; i >= 0; i--) {
                 if (p->nodes[i] && p->locks[i]) {
@@ -107,10 +99,8 @@ noinline void btrfs_clear_path_blocking(struct btrfs_path *p,
                 }
         }
 
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
         if (held)
                 btrfs_clear_lock_blocking_rw(held, held_rw);
-#endif
 }
 
 /* this also releases the path */
@@ -2893,7 +2883,7 @@ cow_done:
                                         }
                                         p->locks[level] = BTRFS_WRITE_LOCK;
                                 } else {
-                                        err = btrfs_try_tree_read_lock(b);
+                                        err = btrfs_tree_read_lock_atomic(b);
                                         if (!err) {
                                                 btrfs_set_path_blocking(p);
                                                 btrfs_tree_read_lock(b);
@@ -3025,7 +3015,7 @@ again:
                         }
 
                         level = btrfs_header_level(b);
-                        err = btrfs_try_tree_read_lock(b);
+                        err = btrfs_tree_read_lock_atomic(b);
                         if (!err) {
                                 btrfs_set_path_blocking(p);
                                 btrfs_tree_read_lock(b);
diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
index 5665d2149249..f8229ef1b46d 100644
--- a/fs/btrfs/locking.c
+++ b/fs/btrfs/locking.c
@@ -128,6 +128,26 @@ again:
 }
 
 /*
+ * take a spinning read lock.
+ * returns 1 if we get the read lock and 0 if we don't
+ * this won't wait for blocking writers
+ */
+int btrfs_tree_read_lock_atomic(struct extent_buffer *eb)
+{
+        if (atomic_read(&eb->blocking_writers))
+                return 0;
+
+        read_lock(&eb->lock);
+        if (atomic_read(&eb->blocking_writers)) {
+                read_unlock(&eb->lock);
+                return 0;
+        }
+        atomic_inc(&eb->read_locks);
+        atomic_inc(&eb->spinning_readers);
+        return 1;
+}
+
+/*
  * returns 1 if we get the read lock and 0 if we don't
  * this won't wait for blocking writers
  */
@@ -158,9 +178,7 @@ int btrfs_try_tree_write_lock(struct extent_buffer *eb)
             atomic_read(&eb->blocking_readers))
                 return 0;
 
-        if (!write_trylock(&eb->lock))
-                return 0;
-
+        write_lock(&eb->lock);
         if (atomic_read(&eb->blocking_writers) ||
             atomic_read(&eb->blocking_readers)) {
                 write_unlock(&eb->lock);
diff --git a/fs/btrfs/locking.h b/fs/btrfs/locking.h
index b81e0e9a4894..c44a9d5f5362 100644
--- a/fs/btrfs/locking.h
+++ b/fs/btrfs/locking.h
@@ -35,6 +35,8 @@ void btrfs_clear_lock_blocking_rw(struct extent_buffer *eb, int rw);
 void btrfs_assert_tree_locked(struct extent_buffer *eb);
 int btrfs_try_tree_read_lock(struct extent_buffer *eb);
 int btrfs_try_tree_write_lock(struct extent_buffer *eb);
+int btrfs_tree_read_lock_atomic(struct extent_buffer *eb);
+
 
 static inline void btrfs_tree_unlock_rw(struct extent_buffer *eb, int rw)
 {
diff --git a/fs/btrfs/lzo.c b/fs/btrfs/lzo.c
index 78285f30909e..617553cdb7d3 100644
--- a/fs/btrfs/lzo.c
+++ b/fs/btrfs/lzo.c
@@ -373,6 +373,8 @@ cont:
         }
 done:
         kunmap(pages_in[page_in_index]);
+        if (!ret)
+                btrfs_clear_biovec_end(bvec, vcnt, page_out_index, pg_offset);
         return ret;
 }
 
@@ -410,10 +412,23 @@ static int lzo_decompress(struct list_head *ws, unsigned char *data_in,
                 goto out;
         }
 
+        /*
+         * the caller is already checking against PAGE_SIZE, but lets
+         * move this check closer to the memcpy/memset
+         */
+        destlen = min_t(unsigned long, destlen, PAGE_SIZE);
         bytes = min_t(unsigned long, destlen, out_len - start_byte);
 
         kaddr = kmap_atomic(dest_page);
         memcpy(kaddr, workspace->buf + start_byte, bytes);
+
+        /*
+         * btrfs_getblock is doing a zero on the tail of the page too,
+         * but this will cover anything missing from the decompressed
+         * data.
+         */
+        if (bytes < destlen)
+                memset(kaddr+bytes, 0, destlen-bytes);
         kunmap_atomic(kaddr);
 out:
         return ret;
diff --git a/fs/btrfs/zlib.c b/fs/btrfs/zlib.c
index 759fa4e2de8f..fb22fd8d8fb8 100644
--- a/fs/btrfs/zlib.c
+++ b/fs/btrfs/zlib.c
@@ -299,6 +299,8 @@ done:
         zlib_inflateEnd(&workspace->strm);
         if (data_in)
                 kunmap(pages_in[page_in_index]);
+        if (!ret)
+                btrfs_clear_biovec_end(bvec, vcnt, page_out_index, pg_offset);
         return ret;
 }
 
@@ -310,10 +312,14 @@ static int zlib_decompress(struct list_head *ws, unsigned char *data_in,
         struct workspace *workspace = list_entry(ws, struct workspace, list);
         int ret = 0;
         int wbits = MAX_WBITS;
-        unsigned long bytes_left = destlen;
+        unsigned long bytes_left;
         unsigned long total_out = 0;
+        unsigned long pg_offset = 0;
         char *kaddr;
 
+        destlen = min_t(unsigned long, destlen, PAGE_SIZE);
+        bytes_left = destlen;
+
         workspace->strm.next_in = data_in;
         workspace->strm.avail_in = srclen;
         workspace->strm.total_in = 0;
@@ -341,7 +347,6 @@ static int zlib_decompress(struct list_head *ws, unsigned char *data_in,
                 unsigned long buf_start;
                 unsigned long buf_offset;
                 unsigned long bytes;
-                unsigned long pg_offset = 0;
 
                 ret = zlib_inflate(&workspace->strm, Z_NO_FLUSH);
                 if (ret != Z_OK && ret != Z_STREAM_END)
@@ -384,6 +389,17 @@ next:
                 ret = 0;
 
         zlib_inflateEnd(&workspace->strm);
+
+        /*
+         * this should only happen if zlib returned fewer bytes than we
+         * expected.  btrfs_get_block is responsible for zeroing from the
+         * end of the inline extent (destlen) to the end of the page
+         */
+        if (pg_offset < destlen) {
+                kaddr = kmap_atomic(dest_page);
+                memset(kaddr + pg_offset, 0, destlen - pg_offset);
+                kunmap_atomic(kaddr);
+        }
         return ret;
 }
 
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 659f2ea9e6f7..cefca661464b 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2638,7 +2638,7 @@ static void handle_cap_flush_ack(struct inode *inode, u64 flush_tid,
 
         for (i = 0; i < CEPH_CAP_BITS; i++)
                 if ((dirty & (1 << i)) &&
-                    flush_tid == ci->i_cap_flush_tid[i])
+                    (u16)flush_tid == ci->i_cap_flush_tid[i])
                         cleaned |= 1 << i;
 
         dout("handle_cap_flush_ack inode %p mds%d seq %d on %s cleaned %s,"
diff --git a/fs/dcache.c b/fs/dcache.c
index 3ffef7f4e5cd..5bc72b07fde2 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -778,6 +778,7 @@ restart:
                         struct dentry *parent = lock_parent(dentry);
                         if (likely(!dentry->d_lockref.count)) {
                                 __dentry_kill(dentry);
+                                dput(parent);
                                 goto restart;
                         }
                         if (parent)
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index fe839b915116..d67a16f2a45d 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -174,27 +174,6 @@ struct iso9660_options{
  * Compute the hash for the isofs name corresponding to the dentry.
  */
 static int
-isofs_hash_common(struct qstr *qstr, int ms)
-{
-        const char *name;
-        int len;
-
-        len = qstr->len;
-        name = qstr->name;
-        if (ms) {
-                while (len && name[len-1] == '.')
-                        len--;
-        }
-
-        qstr->hash = full_name_hash(name, len);
-
-        return 0;
-}
-
-/*
- * Compute the hash for the isofs name corresponding to the dentry.
- */
-static int
 isofs_hashi_common(struct qstr *qstr, int ms)
 {
         const char *name;
@@ -263,6 +242,27 @@ isofs_dentry_cmpi(const struct dentry *parent, const struct dentry *dentry,
 }
 
 #ifdef CONFIG_JOLIET
+/*
+ * Compute the hash for the isofs name corresponding to the dentry.
+ */
+static int
+isofs_hash_common(struct qstr *qstr, int ms)
+{
+        const char *name;
+        int len;
+
+        len = qstr->len;
+        name = qstr->name;
+        if (ms) {
+                while (len && name[len-1] == '.')
+                        len--;
+        }
+
+        qstr->hash = full_name_hash(name, len);
+
+        return 0;
+}
+
 static int
 isofs_hash_ms(const struct dentry *dentry, struct qstr *qstr)
 {
diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
index 5228f201d3d5..4f46f7a05289 100644
--- a/fs/nfs/blocklayout/blocklayout.c
+++ b/fs/nfs/blocklayout/blocklayout.c
@@ -378,7 +378,7 @@ bl_write_pagelist(struct nfs_pgio_header *header, int sync)
         loff_t offset = header->args.offset;
         size_t count = header->args.count;
         struct page **pages = header->args.pages;
-        int pg_index = pg_index = header->args.pgbase >> PAGE_CACHE_SHIFT;
+        int pg_index = header->args.pgbase >> PAGE_CACHE_SHIFT;
         unsigned int pg_len;
         struct blk_plug plug;
         int i;
diff --git a/fs/nfs/blocklayout/rpc_pipefs.c b/fs/nfs/blocklayout/rpc_pipefs.c
index e966c023b1b7..acbf9ca4018c 100644
--- a/fs/nfs/blocklayout/rpc_pipefs.c
+++ b/fs/nfs/blocklayout/rpc_pipefs.c
@@ -65,17 +65,18 @@ bl_resolve_deviceid(struct nfs_server *server, struct pnfs_block_volume *b,
 
         dprintk("%s CREATING PIPEFS MESSAGE\n", __func__);
 
+        mutex_lock(&nn->bl_mutex);
         bl_pipe_msg.bl_wq = &nn->bl_wq;
 
         b->simple.len += 4;     /* single volume */
         if (b->simple.len > PAGE_SIZE)
-                return -EIO;
+                goto out_unlock;
 
         memset(msg, 0, sizeof(*msg));
         msg->len = sizeof(*bl_msg) + b->simple.len;
         msg->data = kzalloc(msg->len, gfp_mask);
         if (!msg->data)
-                goto out;
+                goto out_free_data;
 
         bl_msg = msg->data;
         bl_msg->type = BL_DEVICE_MOUNT,
@@ -87,7 +88,7 @@ bl_resolve_deviceid(struct nfs_server *server, struct pnfs_block_volume *b,
         rc = rpc_queue_upcall(nn->bl_device_pipe, msg);
         if (rc < 0) {
                 remove_wait_queue(&nn->bl_wq, &wq);
-                goto out;
+                goto out_free_data;
         }
 
         set_current_state(TASK_UNINTERRUPTIBLE);
@@ -97,12 +98,14 @@ bl_resolve_deviceid(struct nfs_server *server, struct pnfs_block_volume *b,
         if (reply->status != BL_DEVICE_REQUEST_PROC) {
                 printk(KERN_WARNING "%s failed to decode device: %d\n",
                         __func__, reply->status);
-                goto out;
+                goto out_free_data;
         }
 
         dev = MKDEV(reply->major, reply->minor);
-out:
+out_free_data:
         kfree(msg->data);
+out_unlock:
+        mutex_unlock(&nn->bl_mutex);
         return dev;
 }
 
@@ -232,6 +235,7 @@ static int nfs4blocklayout_net_init(struct net *net)
         struct nfs_net *nn = net_generic(net, nfs_net_id);
         struct dentry *dentry;
 
+        mutex_init(&nn->bl_mutex);
         init_waitqueue_head(&nn->bl_wq);
         nn->bl_device_pipe = rpc_mkpipe_data(&bl_upcall_ops, 0);
         if (IS_ERR(nn->bl_device_pipe))
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 5853f53db732..7f3f60641344 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -125,6 +125,8 @@ again:
                         continue;
                 if (!test_bit(NFS_DELEGATED_STATE, &state->flags))
                         continue;
+                if (!nfs4_valid_open_stateid(state))
+                        continue;
                 if (!nfs4_stateid_match(&state->stateid, stateid))
                         continue;
                 get_nfs_open_context(ctx);
@@ -193,7 +195,11 @@ static int nfs_do_return_delegation(struct inode *inode, struct nfs_delegation *
 {
         int res = 0;
 
-        res = nfs4_proc_delegreturn(inode, delegation->cred, &delegation->stateid, issync);
+        if (!test_bit(NFS_DELEGATION_REVOKED, &delegation->flags))
+                res = nfs4_proc_delegreturn(inode,
+                                delegation->cred,
+                                &delegation->stateid,
+                                issync);
         nfs_free_delegation(delegation);
         return res;
 }
@@ -380,11 +386,13 @@ static int nfs_end_delegation_return(struct inode *inode, struct nfs_delegation
 {
         struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
         struct nfs_inode *nfsi = NFS_I(inode);
-        int err;
+        int err = 0;
 
         if (delegation == NULL)
                 return 0;
         do {
+                if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags))
+                        break;
                 err = nfs_delegation_claim_opens(inode, &delegation->stateid);
                 if (!issync || err != -EAGAIN)
                         break;
@@ -605,10 +613,23 @@ static void nfs_client_mark_return_unused_delegation_types(struct nfs_client *cl
         rcu_read_unlock();
 }
 
+static void nfs_revoke_delegation(struct inode *inode)
+{
+        struct nfs_delegation *delegation;
+        rcu_read_lock();
+        delegation = rcu_dereference(NFS_I(inode)->delegation);
+        if (delegation != NULL) {
+                set_bit(NFS_DELEGATION_REVOKED, &delegation->flags);
+                nfs_mark_return_delegation(NFS_SERVER(inode), delegation);
+        }
+        rcu_read_unlock();
+}
+
 void nfs_remove_bad_delegation(struct inode *inode)
 {
         struct nfs_delegation *delegation;
 
+        nfs_revoke_delegation(inode);
         delegation = nfs_inode_detach_delegation(inode);
         if (delegation) {
                 nfs_inode_find_state_and_recover(inode, &delegation->stateid);
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index 5c1cce39297f..e3c20a3ccc93 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -31,6 +31,7 @@ enum {
         NFS_DELEGATION_RETURN_IF_CLOSED,
         NFS_DELEGATION_REFERENCED,
         NFS_DELEGATION_RETURNING,
+        NFS_DELEGATION_REVOKED,
 };
 
 int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res);
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 06e8cfcbb670..6e62155abf26 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1527,6 +1527,7 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
                 case -ENOENT:
                         d_drop(dentry);
                         d_add(dentry, NULL);
+                        nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
                         break;
                 case -EISDIR:
                 case -ENOTDIR:
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 20cffc830468..10bf07280f4a 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -266,6 +266,7 @@ static void nfs_direct_req_free(struct kref *kref)
 {
         struct nfs_direct_req *dreq = container_of(kref, struct nfs_direct_req, kref);
 
+        nfs_free_pnfs_ds_cinfo(&dreq->ds_cinfo);
         if (dreq->l_ctx != NULL)
                 nfs_put_lock_context(dreq->l_ctx);
         if (dreq->ctx != NULL)
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index 46fab1cb455a..7afb52f6a25a 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -145,9 +145,6 @@ static int filelayout_async_handle_error(struct rpc_task *task,
         case -NFS4ERR_DELEG_REVOKED:
         case -NFS4ERR_ADMIN_REVOKED:
         case -NFS4ERR_BAD_STATEID:
-                if (state == NULL)
-                        break;
-                nfs_remove_bad_delegation(state->inode);
         case -NFS4ERR_OPENMODE:
                 if (state == NULL)
                         break;
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 6388a59f2add..00689a8a85e4 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -626,7 +626,7 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
 {
         struct inode *inode = dentry->d_inode;
         int need_atime = NFS_I(inode)->cache_validity & NFS_INO_INVALID_ATIME;
-        int err;
+        int err = 0;
 
         trace_nfs_getattr_enter(inode);
         /* Flush out writes to the server in order to update c/mtime.  */
diff --git a/fs/nfs/netns.h b/fs/nfs/netns.h
index ef221fb8a183..f0e06e4acbef 100644
--- a/fs/nfs/netns.h
+++ b/fs/nfs/netns.h
@@ -19,6 +19,7 @@ struct nfs_net {
         struct rpc_pipe *bl_device_pipe;
         struct bl_dev_msg bl_mount_reply;
         wait_queue_head_t bl_wq;
+        struct mutex bl_mutex;
         struct list_head nfs_client_list;
         struct list_head nfs_volume_list;
 #if IS_ENABLED(CONFIG_NFS_V4)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 405bd95c1f58..69dc20a743f9 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -370,11 +370,6 @@ static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struc
                 case -NFS4ERR_DELEG_REVOKED:
                 case -NFS4ERR_ADMIN_REVOKED:
                 case -NFS4ERR_BAD_STATEID:
-                        if (inode != NULL && nfs4_have_delegation(inode, FMODE_READ)) {
-                                nfs_remove_bad_delegation(inode);
-                                exception->retry = 1;
-                                break;
-                        }
                         if (state == NULL)
                                 break;
                         ret = nfs4_schedule_stateid_recovery(server, state);
@@ -1654,7 +1649,7 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
                         nfs_inode_find_state_and_recover(state->inode,
                                         stateid);
                         nfs4_schedule_stateid_recovery(server, state);
-                        return 0;
+                        return -EAGAIN;
                 case -NFS4ERR_DELAY:
                 case -NFS4ERR_GRACE:
                         set_bit(NFS_DELEGATED_STATE, &state->flags);
@@ -2109,46 +2104,60 @@ static int nfs4_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *sta
         return ret;
 }
 
+static void nfs_finish_clear_delegation_stateid(struct nfs4_state *state)
+{
+        nfs_remove_bad_delegation(state->inode);
+        write_seqlock(&state->seqlock);
+        nfs4_stateid_copy(&state->stateid, &state->open_stateid);
+        write_sequnlock(&state->seqlock);
+        clear_bit(NFS_DELEGATED_STATE, &state->flags);
+}
+
+static void nfs40_clear_delegation_stateid(struct nfs4_state *state)
+{
+        if (rcu_access_pointer(NFS_I(state->inode)->delegation) != NULL)
+                nfs_finish_clear_delegation_stateid(state);
+}
+
+static int nfs40_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *state)
+{
+        /* NFSv4.0 doesn't allow for delegation recovery on open expire */
+        nfs40_clear_delegation_stateid(state);
+        return nfs4_open_expired(sp, state);
+}
+
 #if defined(CONFIG_NFS_V4_1)
-static void nfs41_clear_delegation_stateid(struct nfs4_state *state)
+static void nfs41_check_delegation_stateid(struct nfs4_state *state)
 {
         struct nfs_server *server = NFS_SERVER(state->inode);
-        nfs4_stateid *stateid = &state->stateid;
+        nfs4_stateid stateid;
         struct nfs_delegation *delegation;
-        struct rpc_cred *cred = NULL;
-        int status = -NFS4ERR_BAD_STATEID;
-
-        /* If a state reset has been done, test_stateid is unneeded */
-        if (test_bit(NFS_DELEGATED_STATE, &state->flags) == 0)
-                return;
+        struct rpc_cred *cred;
+        int status;
 
         /* Get the delegation credential for use by test/free_stateid */
         rcu_read_lock();
         delegation = rcu_dereference(NFS_I(state->inode)->delegation);
-        if (delegation != NULL &&
-            nfs4_stateid_match(&delegation->stateid, stateid)) {
-                cred = get_rpccred(delegation->cred);
-                rcu_read_unlock();
-                status = nfs41_test_stateid(server, stateid, cred);
-                trace_nfs4_test_delegation_stateid(state, NULL, status);
-        } else
+        if (delegation == NULL) {
                 rcu_read_unlock();
+                return;
+        }
+
+        nfs4_stateid_copy(&stateid, &delegation->stateid);
+        cred = get_rpccred(delegation->cred);
+        rcu_read_unlock();
+        status = nfs41_test_stateid(server, &stateid, cred);
+        trace_nfs4_test_delegation_stateid(state, NULL, status);
 
         if (status != NFS_OK) {
                 /* Free the stateid unless the server explicitly
                  * informs us the stateid is unrecognized. */
                 if (status != -NFS4ERR_BAD_STATEID)
-                        nfs41_free_stateid(server, stateid, cred);
-                nfs_remove_bad_delegation(state->inode);
-
-                write_seqlock(&state->seqlock);
-                nfs4_stateid_copy(&state->stateid, &state->open_stateid);
-                write_sequnlock(&state->seqlock);
-                clear_bit(NFS_DELEGATED_STATE, &state->flags);
+                        nfs41_free_stateid(server, &stateid, cred);
+                nfs_finish_clear_delegation_stateid(state);
         }
 
-        if (cred != NULL)
-                put_rpccred(cred);
+        put_rpccred(cred);
 }
 
 /**
@@ -2192,7 +2201,7 @@ static int nfs41_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st
 {
         int status;
 
-        nfs41_clear_delegation_stateid(state);
+        nfs41_check_delegation_stateid(state);
         status = nfs41_check_open_stateid(state);
         if (status != NFS_OK)
                 status = nfs4_open_expired(sp, state);
@@ -2231,19 +2240,8 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
         seq = raw_seqcount_begin(&sp->so_reclaim_seqcount);
 
         ret = _nfs4_proc_open(opendata);
-        if (ret != 0) {
-                if (ret == -ENOENT) {
-                        dentry = opendata->dentry;
-                        if (dentry->d_inode)
-                                d_delete(dentry);
-                        else if (d_unhashed(dentry))
-                                d_add(dentry, NULL);
-
-                        nfs_set_verifier(dentry,
-                                         nfs_save_change_attribute(opendata->dir->d_inode));
-                }
+        if (ret != 0)
                 goto out;
-        }
 
         state = nfs4_opendata_to_nfs4_state(opendata);
         ret = PTR_ERR(state);
@@ -4841,9 +4839,6 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                 case -NFS4ERR_DELEG_REVOKED:
                 case -NFS4ERR_ADMIN_REVOKED:
                 case -NFS4ERR_BAD_STATEID:
-                        if (state == NULL)
-                                break;
-                        nfs_remove_bad_delegation(state->inode);
                 case -NFS4ERR_OPENMODE:
                         if (state == NULL)
                                 break;
@@ -8341,7 +8336,7 @@ static const struct nfs4_state_recovery_ops nfs41_reboot_recovery_ops = {
 static const struct nfs4_state_recovery_ops nfs40_nograce_recovery_ops = {
         .owner_flag_bit = NFS_OWNER_RECLAIM_NOGRACE,
         .state_flag_bit = NFS_STATE_RECLAIM_NOGRACE,
-        .recover_open   = nfs4_open_expired,
+        .recover_open   = nfs40_open_expired,
         .recover_lock   = nfs4_lock_expired,
         .establish_clid = nfs4_init_clientid,
 };
@@ -8408,8 +8403,7 @@ static const struct nfs4_minor_version_ops nfs_v4_1_minor_ops = {
                 | NFS_CAP_CHANGE_ATTR
                 | NFS_CAP_POSIX_LOCK
                 | NFS_CAP_STATEID_NFSV41
-                | NFS_CAP_ATOMIC_OPEN_V1
-                | NFS_CAP_SEEK,
+                | NFS_CAP_ATOMIC_OPEN_V1,
         .init_client = nfs41_init_client,
         .shutdown_client = nfs41_shutdown_client,
         .match_stateid = nfs41_match_stateid,
@@ -8431,7 +8425,8 @@ static const struct nfs4_minor_version_ops nfs_v4_2_minor_ops = {
                 | NFS_CAP_CHANGE_ATTR
                 | NFS_CAP_POSIX_LOCK
                 | NFS_CAP_STATEID_NFSV41
-                | NFS_CAP_ATOMIC_OPEN_V1,
+                | NFS_CAP_ATOMIC_OPEN_V1
+                | NFS_CAP_SEEK,
         .init_client = nfs41_init_client,
         .shutdown_client = nfs41_shutdown_client,
         .match_stateid = nfs41_match_stateid,
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 12493846a2d3..f83b02dc9166 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -715,8 +715,6 @@ static void nfs_inode_remove_request(struct nfs_page *req)
 
         if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags))
                 nfs_release_request(req);
-        else
-                WARN_ON_ONCE(1);
 }
 
 static void
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index ed2b1151b171..7cbdf1b2e4ab 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -774,8 +774,12 @@ static bool nfsd41_cb_get_slot(struct nfs4_client *clp, struct rpc_task *task)
 {
         if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
                 rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
-                dprintk("%s slot is busy\n", __func__);
-                return false;
+                /* Race breaker */
+                if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
+                        dprintk("%s slot is busy\n", __func__);
+                        return false;
+                }
+                rpc_wake_up_queued_task(&clp->cl_cb_waitq, task);
         }
         return true;
 }
diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
index 747f3b95bd11..33a46a8dfaf7 100644
--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -335,12 +335,15 @@ void		nfsd_lockd_shutdown(void);
         (NFSD4_SUPPORTED_ATTRS_WORD2 | FATTR4_WORD2_SUPPATTR_EXCLCREAT)
 
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
-#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \
-        (NFSD4_1_SUPPORTED_ATTRS_WORD2 | FATTR4_WORD2_SECURITY_LABEL)
+#define NFSD4_2_SECURITY_ATTRS          FATTR4_WORD2_SECURITY_LABEL
 #else
-#define NFSD4_2_SUPPORTED_ATTRS_WORD2 0
+#define NFSD4_2_SECURITY_ATTRS          0
 #endif
 
+#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \
+        (NFSD4_1_SUPPORTED_ATTRS_WORD2 | \
+        NFSD4_2_SECURITY_ATTRS)
+
 static inline u32 nfsd_suppattrs0(u32 minorversion)
 {
         return minorversion ? NFSD4_1_SUPPORTED_ATTRS_WORD0
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index 9d3e9c50066a..89326acd4561 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -229,8 +229,16 @@ int fsnotify(struct inode *to_tell, __u32 mask, void *data, int data_is,
                                               &fsnotify_mark_srcu);
         }
 
+        /*
+         * We need to merge inode & vfsmount mark lists so that inode mark
+         * ignore masks are properly reflected for mount mark notifications.
+         * That's why this traversal is so complicated...
+         */
         while (inode_node || vfsmount_node) {
-                inode_group = vfsmount_group = NULL;
+                inode_group = NULL;
+                inode_mark = NULL;
+                vfsmount_group = NULL;
+                vfsmount_mark = NULL;
 
                 if (inode_node) {
                         inode_mark = hlist_entry(srcu_dereference(inode_node, &fsnotify_mark_srcu),
@@ -244,21 +252,19 @@ int fsnotify(struct inode *to_tell, __u32 mask, void *data, int data_is,
                         vfsmount_group = vfsmount_mark->group;
                 }
 
-                if (inode_group > vfsmount_group) {
-                        /* handle inode */
-                        ret = send_to_group(to_tell, inode_mark, NULL, mask,
-                                            data, data_is, cookie, file_name);
-                        /* we didn't use the vfsmount_mark */
-                        vfsmount_group = NULL;
-                } else if (vfsmount_group > inode_group) {
-                        ret = send_to_group(to_tell, NULL, vfsmount_mark, mask,
-                                            data, data_is, cookie, file_name);
-                        inode_group = NULL;
-                } else {
-                        ret = send_to_group(to_tell, inode_mark, vfsmount_mark,
-                                            mask, data, data_is, cookie,
-                                            file_name);
+                if (inode_group && vfsmount_group) {
+                        int cmp = fsnotify_compare_groups(inode_group,
+                                                          vfsmount_group);
+                        if (cmp > 0) {
+                                inode_group = NULL;
+                                inode_mark = NULL;
+                        } else if (cmp < 0) {
+                                vfsmount_group = NULL;
+                                vfsmount_mark = NULL;
+                        }
                 }
+                ret = send_to_group(to_tell, inode_mark, vfsmount_mark, mask,
+                                    data, data_is, cookie, file_name);
 
                 if (ret && (mask & ALL_FSNOTIFY_PERM_EVENTS))
                         goto out;
diff --git a/fs/notify/fsnotify.h b/fs/notify/fsnotify.h
index 9c0898c4cfe1..3b68b0ae0a97 100644
--- a/fs/notify/fsnotify.h
+++ b/fs/notify/fsnotify.h
@@ -12,6 +12,10 @@ extern void fsnotify_flush_notify(struct fsnotify_group *group);
 /* protects reads of inode and vfsmount marks list */
 extern struct srcu_struct fsnotify_mark_srcu;
 
+/* compare two groups for sorting of marks lists */
+extern int fsnotify_compare_groups(struct fsnotify_group *a,
+                                   struct fsnotify_group *b);
+
 extern void fsnotify_set_inode_mark_mask_locked(struct fsnotify_mark *fsn_mark,
                                                 __u32 mask);
 /* add a mark to an inode */
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index e8497144b323..dfbf5447eea4 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -194,6 +194,7 @@ int fsnotify_add_inode_mark(struct fsnotify_mark *mark,
 {
         struct fsnotify_mark *lmark, *last = NULL;
         int ret = 0;
+        int cmp;
 
         mark->flags |= FSNOTIFY_MARK_FLAG_INODE;
 
@@ -219,11 +220,8 @@ int fsnotify_add_inode_mark(struct fsnotify_mark *mark,
                         goto out;
                 }
 
-                if (mark->group->priority < lmark->group->priority)
-                        continue;
-
-                if ((mark->group->priority == lmark->group->priority) &&
-                    (mark->group < lmark->group))
+                cmp = fsnotify_compare_groups(lmark->group, mark->group);
+                if (cmp < 0)
                         continue;
 
                 hlist_add_before_rcu(&mark->i.i_list, &lmark->i.i_list);
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index d90deaa08e78..34c38fabf514 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -210,6 +210,42 @@ void fsnotify_set_mark_ignored_mask_locked(struct fsnotify_mark *mark, __u32 mas
 }
 
 /*
+ * Sorting function for lists of fsnotify marks.
+ *
+ * Fanotify supports different notification classes (reflected as priority of
+ * notification group). Events shall be passed to notification groups in
+ * decreasing priority order. To achieve this marks in notification lists for
+ * inodes and vfsmounts are sorted so that priorities of corresponding groups
+ * are descending.
+ *
+ * Furthermore correct handling of the ignore mask requires processing inode
+ * and vfsmount marks of each group together. Using the group address as
+ * further sort criterion provides a unique sorting order and thus we can
+ * merge inode and vfsmount lists of marks in linear time and find groups
+ * present in both lists.
+ *
+ * A return value of 1 signifies that b has priority over a.
+ * A return value of 0 signifies that the two marks have to be handled together.
+ * A return value of -1 signifies that a has priority over b.
+ */
+int fsnotify_compare_groups(struct fsnotify_group *a, struct fsnotify_group *b)
+{
+        if (a == b)
+                return 0;
+        if (!a)
+                return 1;
+        if (!b)
+                return -1;
+        if (a->priority < b->priority)
+                return 1;
+        if (a->priority > b->priority)
+                return -1;
+        if (a < b)
+                return 1;
+        return -1;
+}
+
+/*
  * Attach an initialized mark to a given group and fs object.
  * These marks may be used for the fsnotify backend to determine which
  * event types should be delivered to which group.
diff --git a/fs/notify/vfsmount_mark.c b/fs/notify/vfsmount_mark.c
index ac851e8376b1..faefa72a11eb 100644
--- a/fs/notify/vfsmount_mark.c
+++ b/fs/notify/vfsmount_mark.c
@@ -153,6 +153,7 @@ int fsnotify_add_vfsmount_mark(struct fsnotify_mark *mark,
         struct mount *m = real_mount(mnt);
         struct fsnotify_mark *lmark, *last = NULL;
         int ret = 0;
+        int cmp;
 
         mark->flags |= FSNOTIFY_MARK_FLAG_VFSMOUNT;
 
@@ -178,11 +179,8 @@ int fsnotify_add_vfsmount_mark(struct fsnotify_mark *mark,
                         goto out;
                 }
 
-                if (mark->group->priority < lmark->group->priority)
-                        continue;
-
-                if ((mark->group->priority == lmark->group->priority) &&
-                    (mark->group < lmark->group))
+                cmp = fsnotify_compare_groups(lmark->group, mark->group);
+                if (cmp < 0)
                         continue;
 
                 hlist_add_before_rcu(&mark->m.m_list, &lmark->m.m_list);
diff --git a/fs/overlayfs/Kconfig b/fs/overlayfs/Kconfig
index e60125976873..34355818a2e0 100644
--- a/fs/overlayfs/Kconfig
+++ b/fs/overlayfs/Kconfig
@@ -1,4 +1,4 @@
-config OVERLAYFS_FS
+config OVERLAY_FS
         tristate "Overlay filesystem support"
         help
           An overlay filesystem combines two filesystems - an 'upper' filesystem
diff --git a/fs/overlayfs/Makefile b/fs/overlayfs/Makefile
index 8f91889480d0..900daed3e91d 100644
--- a/fs/overlayfs/Makefile
+++ b/fs/overlayfs/Makefile
@@ -2,6 +2,6 @@
 # Makefile for the overlay filesystem.
 #
 
-obj-$(CONFIG_OVERLAYFS_FS) += overlayfs.o
+obj-$(CONFIG_OVERLAY_FS) += overlay.o
 
-overlayfs-objs := super.o inode.o dir.o readdir.o copy_up.o
+overlay-objs := super.o inode.o dir.o readdir.o copy_up.o
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 15cd91ad9940..8ffc4b980f1b 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -284,8 +284,7 @@ out:
         return ERR_PTR(err);
 }
 
-static struct dentry *ovl_check_empty_and_clear(struct dentry *dentry,
-                                                enum ovl_path_type type)
+static struct dentry *ovl_check_empty_and_clear(struct dentry *dentry)
 {
         int err;
         struct dentry *ret = NULL;
@@ -294,8 +293,17 @@ static struct dentry *ovl_check_empty_and_clear(struct dentry *dentry,
         err = ovl_check_empty_dir(dentry, &list);
         if (err)
                 ret = ERR_PTR(err);
-        else if (type == OVL_PATH_MERGE)
-                ret = ovl_clear_empty(dentry, &list);
+        else {
+                /*
+                 * If no upperdentry then skip clearing whiteouts.
+                 *
+                 * Can race with copy-up, since we don't hold the upperdir
+                 * mutex.  Doesn't matter, since copy-up can't create a
+                 * non-empty directory from an empty one.
+                 */
+                if (ovl_dentry_upper(dentry))
+                        ret = ovl_clear_empty(dentry, &list);
+        }
 
         ovl_cache_free(&list);
 
@@ -487,8 +495,7 @@ out:
         return err;
 }
 
-static int ovl_remove_and_whiteout(struct dentry *dentry,
-                                   enum ovl_path_type type, bool is_dir)
+static int ovl_remove_and_whiteout(struct dentry *dentry, bool is_dir)
 {
         struct dentry *workdir = ovl_workdir(dentry);
         struct inode *wdir = workdir->d_inode;
@@ -500,7 +507,7 @@ static int ovl_remove_and_whiteout(struct dentry *dentry,
         int err;
 
         if (is_dir) {
-                opaquedir = ovl_check_empty_and_clear(dentry, type);
+                opaquedir = ovl_check_empty_and_clear(dentry);
                 err = PTR_ERR(opaquedir);
                 if (IS_ERR(opaquedir))
                         goto out;
@@ -515,9 +522,10 @@ static int ovl_remove_and_whiteout(struct dentry *dentry,
         if (IS_ERR(whiteout))
                 goto out_unlock;
 
-        if (type == OVL_PATH_LOWER) {
+        upper = ovl_dentry_upper(dentry);
+        if (!upper) {
                 upper = lookup_one_len(dentry->d_name.name, upperdir,
-                                           dentry->d_name.len);
+                                       dentry->d_name.len);
                 err = PTR_ERR(upper);
                 if (IS_ERR(upper))
                         goto kill_whiteout;
@@ -529,7 +537,6 @@ static int ovl_remove_and_whiteout(struct dentry *dentry,
         } else {
                 int flags = 0;
 
-                upper = ovl_dentry_upper(dentry);
                 if (opaquedir)
                         upper = opaquedir;
                 err = -ESTALE;
@@ -648,7 +655,7 @@ static int ovl_do_remove(struct dentry *dentry, bool is_dir)
                 cap_raise(override_cred->cap_effective, CAP_CHOWN);
                 old_cred = override_creds(override_cred);
 
-                err = ovl_remove_and_whiteout(dentry, type, is_dir);
+                err = ovl_remove_and_whiteout(dentry, is_dir);
 
                 revert_creds(old_cred);
                 put_cred(override_cred);
@@ -781,7 +788,7 @@ static int ovl_rename2(struct inode *olddir, struct dentry *old,
         }
 
         if (overwrite && (new_type == OVL_PATH_LOWER || new_type == OVL_PATH_MERGE) && new_is_dir) {
-                opaquedir = ovl_check_empty_and_clear(new, new_type);
+                opaquedir = ovl_check_empty_and_clear(new);
                 err = PTR_ERR(opaquedir);
                 if (IS_ERR(opaquedir)) {
                         opaquedir = NULL;
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index af2d18c9fcee..07d74b24913b 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -235,26 +235,36 @@ out:
         return err;
 }
 
+static bool ovl_need_xattr_filter(struct dentry *dentry,
+                                  enum ovl_path_type type)
+{
+        return type == OVL_PATH_UPPER && S_ISDIR(dentry->d_inode->i_mode);
+}
+
 ssize_t ovl_getxattr(struct dentry *dentry, const char *name,
                      void *value, size_t size)
 {
-        if (ovl_path_type(dentry->d_parent) == OVL_PATH_MERGE &&
-            ovl_is_private_xattr(name))
+        struct path realpath;
+        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
+
+        if (ovl_need_xattr_filter(dentry, type) && ovl_is_private_xattr(name))
                 return -ENODATA;
 
-        return vfs_getxattr(ovl_dentry_real(dentry), name, value, size);
+        return vfs_getxattr(realpath.dentry, name, value, size);
 }
 
 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
 {
+        struct path realpath;
+        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
         ssize_t res;
         int off;
 
-        res = vfs_listxattr(ovl_dentry_real(dentry), list, size);
+        res = vfs_listxattr(realpath.dentry, list, size);
         if (res <= 0 || size == 0)
                 return res;
 
-        if (ovl_path_type(dentry->d_parent) != OVL_PATH_MERGE)
+        if (!ovl_need_xattr_filter(dentry, type))
                 return res;
 
         /* filter out private xattrs */
@@ -279,17 +289,16 @@ int ovl_removexattr(struct dentry *dentry, const char *name)
 {
         int err;
         struct path realpath;
-        enum ovl_path_type type;
+        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
 
         err = ovl_want_write(dentry);
         if (err)
                 goto out;
 
-        if (ovl_path_type(dentry->d_parent) == OVL_PATH_MERGE &&
-            ovl_is_private_xattr(name))
+        err = -ENODATA;
+        if (ovl_need_xattr_filter(dentry, type) && ovl_is_private_xattr(name))
                 goto out_drop_write;
 
-        type = ovl_path_real(dentry, &realpath);
         if (type == OVL_PATH_LOWER) {
                 err = vfs_getxattr(realpath.dentry, name, NULL, 0);
                 if (err < 0)
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 2a7ef4f8e2a6..ab1e3dcbed95 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -274,11 +274,11 @@ static int ovl_dir_mark_whiteouts(struct dentry *dir,
         return 0;
 }
 
-static inline int ovl_dir_read_merged(struct path *upperpath,
-                                      struct path *lowerpath,
-                                      struct list_head *list)
+static int ovl_dir_read_merged(struct dentry *dentry, struct list_head *list)
 {
         int err;
+        struct path lowerpath;
+        struct path upperpath;
         struct ovl_readdir_data rdd = {
                 .ctx.actor = ovl_fill_merge,
                 .list = list,
@@ -286,25 +286,28 @@ static inline int ovl_dir_read_merged(struct path *upperpath,
                 .is_merge = false,
         };
 
-        if (upperpath->dentry) {
-                err = ovl_dir_read(upperpath, &rdd);
+        ovl_path_lower(dentry, &lowerpath);
+        ovl_path_upper(dentry, &upperpath);
+
+        if (upperpath.dentry) {
+                err = ovl_dir_read(&upperpath, &rdd);
                 if (err)
                         goto out;
 
-                if (lowerpath->dentry) {
-                        err = ovl_dir_mark_whiteouts(upperpath->dentry, &rdd);
+                if (lowerpath.dentry) {
+                        err = ovl_dir_mark_whiteouts(upperpath.dentry, &rdd);
                         if (err)
                                 goto out;
                 }
         }
-        if (lowerpath->dentry) {
+        if (lowerpath.dentry) {
                 /*
                  * Insert lowerpath entries before upperpath ones, this allows
                  * offsets to be reasonably constant
                  */
                 list_add(&rdd.middle, rdd.list);
                 rdd.is_merge = true;
-                err = ovl_dir_read(lowerpath, &rdd);
+                err = ovl_dir_read(&lowerpath, &rdd);
                 list_del(&rdd.middle);
         }
 out:
@@ -329,8 +332,6 @@ static void ovl_seek_cursor(struct ovl_dir_file *od, loff_t pos)
 static struct ovl_dir_cache *ovl_cache_get(struct dentry *dentry)
 {
         int res;
-        struct path lowerpath;
-        struct path upperpath;
         struct ovl_dir_cache *cache;
 
         cache = ovl_dir_cache(dentry);
@@ -347,10 +348,7 @@ static struct ovl_dir_cache *ovl_cache_get(struct dentry *dentry)
         cache->refcount = 1;
         INIT_LIST_HEAD(&cache->entries);
 
-        ovl_path_lower(dentry, &lowerpath);
-        ovl_path_upper(dentry, &upperpath);
-
-        res = ovl_dir_read_merged(&upperpath, &lowerpath, &cache->entries);
+        res = ovl_dir_read_merged(dentry, &cache->entries);
         if (res) {
                 ovl_cache_free(&cache->entries);
                 kfree(cache);
@@ -452,10 +450,10 @@ static int ovl_dir_fsync(struct file *file, loff_t start, loff_t end,
         /*
          * Need to check if we started out being a lower dir, but got copied up
          */
-        if (!od->is_upper && ovl_path_type(dentry) == OVL_PATH_MERGE) {
+        if (!od->is_upper && ovl_path_type(dentry) != OVL_PATH_LOWER) {
                 struct inode *inode = file_inode(file);
 
-                realfile =lockless_dereference(od->upperfile);
+                realfile = lockless_dereference(od->upperfile);
                 if (!realfile) {
                         struct path upperpath;
 
@@ -538,14 +536,9 @@ const struct file_operations ovl_dir_operations = {
 int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list)
 {
         int err;
-        struct path lowerpath;
-        struct path upperpath;
         struct ovl_cache_entry *p;
 
-        ovl_path_upper(dentry, &upperpath);
-        ovl_path_lower(dentry, &lowerpath);
-
-        err = ovl_dir_read_merged(&upperpath, &lowerpath, list);
+        err = ovl_dir_read_merged(dentry, list);
         if (err)
                 return err;
 
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 08b704cebfc4..f16d318b71f8 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -24,7 +24,7 @@ MODULE_AUTHOR("Miklos Szeredi <miklos@szeredi.hu>");
 MODULE_DESCRIPTION("Overlay filesystem");
 MODULE_LICENSE("GPL");
 
-#define OVERLAYFS_SUPER_MAGIC 0x794c764f
+#define OVERLAYFS_SUPER_MAGIC 0x794c7630
 
 struct ovl_config {
         char *lowerdir;
@@ -84,12 +84,7 @@ enum ovl_path_type ovl_path_type(struct dentry *dentry)
 
 static struct dentry *ovl_upperdentry_dereference(struct ovl_entry *oe)
 {
-        struct dentry *upperdentry = ACCESS_ONCE(oe->__upperdentry);
-        /*
-         * Make sure to order reads to upperdentry wrt ovl_dentry_update()
-         */
-        smp_read_barrier_depends();
-        return upperdentry;
+        return lockless_dereference(oe->__upperdentry);
 }
 
 void ovl_path_upper(struct dentry *dentry, struct path *path)
@@ -462,11 +457,34 @@ static const match_table_t ovl_tokens = {
         {OPT_ERR,                       NULL}
 };
 
+static char *ovl_next_opt(char **s)
+{
+        char *sbegin = *s;
+        char *p;
+
+        if (sbegin == NULL)
+                return NULL;
+
+        for (p = sbegin; *p; p++) {
+                if (*p == '\\') {
+                        p++;
+                        if (!*p)
+                                break;
+                } else if (*p == ',') {
+                        *p = '\0';
+                        *s = p + 1;
+                        return sbegin;
+                }
+        }
+        *s = NULL;
+        return sbegin;
+}
+
 static int ovl_parse_opt(char *opt, struct ovl_config *config)
 {
         char *p;
 
-        while ((p = strsep(&opt, ",")) != NULL) {
+        while ((p = ovl_next_opt(&opt)) != NULL) {
                 int token;
                 substring_t args[MAX_OPT_ARGS];
 
@@ -554,15 +572,34 @@ out_dput:
         goto out_unlock;
 }
 
+static void ovl_unescape(char *s)
+{
+        char *d = s;
+
+        for (;; s++, d++) {
+                if (*s == '\\')
+                        s++;
+                *d = *s;
+                if (!*s)
+                        break;
+        }
+}
+
 static int ovl_mount_dir(const char *name, struct path *path)
 {
         int err;
+        char *tmp = kstrdup(name, GFP_KERNEL);
+
+        if (!tmp)
+                return -ENOMEM;
 
-        err = kern_path(name, LOOKUP_FOLLOW, path);
+        ovl_unescape(tmp);
+        err = kern_path(tmp, LOOKUP_FOLLOW, path);
         if (err) {
-                pr_err("overlayfs: failed to resolve '%s': %i\n", name, err);
+                pr_err("overlayfs: failed to resolve '%s': %i\n", tmp, err);
                 err = -EINVAL;
         }
+        kfree(tmp);
         return err;
 }
 
@@ -776,11 +813,11 @@ static struct dentry *ovl_mount(struct file_system_type *fs_type, int flags,
 
 static struct file_system_type ovl_fs_type = {
         .owner          = THIS_MODULE,
-        .name           = "overlayfs",
+        .name           = "overlay",
         .mount          = ovl_mount,
         .kill_sb        = kill_anon_super,
 };
-MODULE_ALIAS_FS("overlayfs");
+MODULE_ALIAS_FS("overlay");
 
 static int __init ovl_init(void)
 {
diff --git a/include/dt-bindings/clock/qcom,mmcc-apq8084.h b/include/dt-bindings/clock/qcom,mmcc-apq8084.h
index a929f86d0ddd..d72b5b35f15e 100644
--- a/include/dt-bindings/clock/qcom,mmcc-apq8084.h
+++ b/include/dt-bindings/clock/qcom,mmcc-apq8084.h
@@ -60,7 +60,7 @@
 #define ESC1_CLK_SRC                    43
 #define HDMI_CLK_SRC                    44
 #define VSYNC_CLK_SRC                   45
-#define RBCPR_CLK_SRC                   46
+#define MMSS_RBCPR_CLK_SRC              46
 #define RBBMTIMER_CLK_SRC               47
 #define MAPLE_CLK_SRC                   48
 #define VDP_CLK_SRC                     49
diff --git a/include/dt-bindings/pinctrl/dra.h b/include/dt-bindings/pinctrl/dra.h
index 3d33794e4f3e..7448edff4723 100644
--- a/include/dt-bindings/pinctrl/dra.h
+++ b/include/dt-bindings/pinctrl/dra.h
@@ -40,8 +40,8 @@
 
 /* Active pin states */
 #define PIN_OUTPUT              (0 | PULL_DIS)
-#define PIN_OUTPUT_PULLUP       (PIN_OUTPUT | PULL_ENA | PULL_UP)
-#define PIN_OUTPUT_PULLDOWN     (PIN_OUTPUT | PULL_ENA)
+#define PIN_OUTPUT_PULLUP       (PULL_UP)
+#define PIN_OUTPUT_PULLDOWN     (0)
 #define PIN_INPUT               (INPUT_EN | PULL_DIS)
 #define PIN_INPUT_SLEW          (INPUT_EN | SLEWCONTROL)
 #define PIN_INPUT_PULLUP        (PULL_ENA | INPUT_EN | PULL_UP)
diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index be5fd38bd5a0..5d858e02997f 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -18,8 +18,11 @@
  * position @h. For example
  * GENMASK_ULL(39, 21) gives us the 64bit vector 0x000000ffffe00000.
  */
-#define GENMASK(h, l)           (((U32_C(1) << ((h) - (l) + 1)) - 1) << (l))
-#define GENMASK_ULL(h, l)       (((U64_C(1) << ((h) - (l) + 1)) - 1) << (l))
+#define GENMASK(h, l) \
+        (((~0UL) << (l)) & (~0UL >> (BITS_PER_LONG - 1 - (h))))
+
+#define GENMASK_ULL(h, l) \
+        (((~0ULL) << (l)) & (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h))))
 
 extern unsigned int __sw_hweight8(unsigned int w);
 extern unsigned int __sw_hweight16(unsigned int w);
diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index 4e2bd4c95b66..0995c2de8162 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -46,6 +46,7 @@ extern unsigned long init_bootmem_node(pg_data_t *pgdat,
 extern unsigned long init_bootmem(unsigned long addr, unsigned long memend);
 
 extern unsigned long free_all_bootmem(void);
+extern void reset_node_managed_pages(pg_data_t *pgdat);
 extern void reset_all_zones_managed_pages(void);
 
 extern void free_bootmem_node(pg_data_t *pgdat,
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index 6992afc6ba7f..b37ea95bc348 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -99,6 +99,12 @@ inval_skb:
         return 1;
 }
 
+static inline bool can_is_canfd_skb(const struct sk_buff *skb)
+{
+        /* the CAN specific type of skb is identified by its data length */
+        return skb->len == CANFD_MTU;
+}
+
 /* get data length from can_dlc with sanitized can_dlc */
 u8 can_dlc2len(u8 can_dlc);
 
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index be21af149f11..2839c639f092 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -352,7 +352,6 @@ struct clk_divider {
 #define CLK_DIVIDER_READ_ONLY           BIT(5)
 
 extern const struct clk_ops clk_divider_ops;
-extern const struct clk_ops clk_divider_ro_ops;
 struct clk *clk_register_divider(struct device *dev, const char *name,
                 const char *parent_name, unsigned long flags,
                 void __iomem *reg, u8 shift, u8 width,
diff --git a/include/linux/iio/events.h b/include/linux/iio/events.h
index 8bbd7bc1043d..03fa332ad2a8 100644
--- a/include/linux/iio/events.h
+++ b/include/linux/iio/events.h
@@ -72,7 +72,7 @@ struct iio_event_data {
 
 #define IIO_EVENT_CODE_EXTRACT_TYPE(mask) ((mask >> 56) & 0xFF)
 
-#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0xCF)
+#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0x7F)
 
 #define IIO_EVENT_CODE_EXTRACT_CHAN_TYPE(mask) ((mask >> 32) & 0xFF)
 
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 0068708161ff..0a21fbefdfbe 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -242,7 +242,7 @@ static inline void in_dev_put(struct in_device *idev)
 static __inline__ __be32 inet_make_mask(int logmask)
 {
         if (logmask)
-                return htonl(~((1<<(32-logmask))-1));
+                return htonl(~((1U<<(32-logmask))-1));
         return 0;
 }
 
diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h
index 8422b4ed6882..b9376cd5a187 100644
--- a/include/linux/kernel_stat.h
+++ b/include/linux/kernel_stat.h
@@ -77,11 +77,6 @@ static inline unsigned int kstat_cpu_irqs_sum(unsigned int cpu)
         return kstat_cpu(cpu).irqs_sum;
 }
 
-/*
- * Lock/unlock the current runqueue - to extract task statistics:
- */
-extern unsigned long long task_delta_exec(struct task_struct *);
-
 extern void account_user_time(struct task_struct *, cputime_t, cputime_t);
 extern void account_system_time(struct task_struct *, int, cputime_t, cputime_t);
 extern void account_steal_time(cputime_t);
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index ea53b04993f2..a6059bdf7b03 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -703,7 +703,7 @@ void kvm_arch_sync_events(struct kvm *kvm);
 int kvm_cpu_has_pending_timer(struct kvm_vcpu *vcpu);
 void kvm_vcpu_kick(struct kvm_vcpu *vcpu);
 
-bool kvm_is_mmio_pfn(pfn_t pfn);
+bool kvm_is_reserved_pfn(pfn_t pfn);
 
 struct kvm_irq_ack_notifier {
         struct hlist_node link;
diff --git a/include/linux/mfd/max77693-private.h b/include/linux/mfd/max77693-private.h
index fc17d56581b2..582e67f34054 100644
--- a/include/linux/mfd/max77693-private.h
+++ b/include/linux/mfd/max77693-private.h
@@ -330,6 +330,13 @@ enum max77693_irq_source {
         MAX77693_IRQ_GROUP_NR,
 };
 
+#define SRC_IRQ_CHARGER                 BIT(0)
+#define SRC_IRQ_TOP                     BIT(1)
+#define SRC_IRQ_FLASH                   BIT(2)
+#define SRC_IRQ_MUIC                    BIT(3)
+#define SRC_IRQ_ALL                     (SRC_IRQ_CHARGER | SRC_IRQ_TOP \
+                                                | SRC_IRQ_FLASH | SRC_IRQ_MUIC)
+
 #define LED_IRQ_FLED2_OPEN              BIT(0)
 #define LED_IRQ_FLED2_SHORT             BIT(1)
 #define LED_IRQ_FLED1_OPEN              BIT(2)
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 48bf12ef6620..ffe66e381c04 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -431,6 +431,15 @@ struct zone {
          */
         int                     nr_migrate_reserve_block;
 
+#ifdef CONFIG_MEMORY_ISOLATION
+        /*
+         * Number of isolated pageblock. It is used to solve incorrect
+         * freepage counting problem due to racy retrieving migratetype
+         * of pageblock. Protected by zone->lock.
+         */
+        unsigned long           nr_isolate_pageblock;
+#endif
+
 #ifdef CONFIG_MEMORY_HOTPLUG
         /* see spanned/present_pages for more description */
         seqlock_t               span_seqlock;
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 983876f24aed..47ebb4fafd87 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1224,11 +1224,22 @@ struct nfs41_free_stateid_res {
         unsigned int                    status;
 };
 
+static inline void
+nfs_free_pnfs_ds_cinfo(struct pnfs_ds_commit_info *cinfo)
+{
+        kfree(cinfo->buckets);
+}
+
 #else
 
 struct pnfs_ds_commit_info {
 };
 
+static inline void
+nfs_free_pnfs_ds_cinfo(struct pnfs_ds_commit_info *cinfo)
+{
+}
+
 #endif /* CONFIG_NFS_V4_1 */
 
 #ifdef CONFIG_NFS_V4_2
diff --git a/include/linux/page-isolation.h b/include/linux/page-isolation.h
index 3fff8e774067..2dc1e1697b45 100644
--- a/include/linux/page-isolation.h
+++ b/include/linux/page-isolation.h
@@ -2,6 +2,10 @@
 #define __LINUX_PAGEISOLATION_H
 
 #ifdef CONFIG_MEMORY_ISOLATION
+static inline bool has_isolate_pageblock(struct zone *zone)
+{
+        return zone->nr_isolate_pageblock;
+}
 static inline bool is_migrate_isolate_page(struct page *page)
 {
         return get_pageblock_migratetype(page) == MIGRATE_ISOLATE;
@@ -11,6 +15,10 @@ static inline bool is_migrate_isolate(int migratetype)
         return migratetype == MIGRATE_ISOLATE;
 }
 #else
+static inline bool has_isolate_pageblock(struct zone *zone)
+{
+        return false;
+}
 static inline bool is_migrate_isolate_page(struct page *page)
 {
         return false;
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 5be8db45e368..4c8ac5fcc224 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -331,6 +331,7 @@ struct pci_dev {
         unsigned int    is_added:1;
         unsigned int    is_busmaster:1; /* device is busmaster */
         unsigned int    no_msi:1;       /* device may not use msi */
+        unsigned int    no_64bit_msi:1; /* device may only use 32-bit MSIs */
         unsigned int    block_cfg_access:1;     /* config space access is blocked */
         unsigned int    broken_parity_status:1; /* Device generates false positive parity */
         unsigned int    irq_reroute_variant:2;  /* device needs IRQ rerouting variant */
diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
index d5c89e0dd0e6..51ce60c35f4c 100644
--- a/include/linux/percpu-refcount.h
+++ b/include/linux/percpu-refcount.h
@@ -133,7 +133,13 @@ static inline bool __ref_is_percpu(struct percpu_ref *ref,
         /* paired with smp_store_release() in percpu_ref_reinit() */
         smp_read_barrier_depends();
 
-        if (unlikely(percpu_ptr & __PERCPU_REF_ATOMIC))
+        /*
+         * Theoretically, the following could test just ATOMIC; however,
+         * then we'd have to mask off DEAD separately as DEAD may be
+         * visible without ATOMIC if we race with percpu_ref_kill().  DEAD
+         * implies ATOMIC anyway.  Test them together.
+         */
+        if (unlikely(percpu_ptr & __PERCPU_REF_ATOMIC_DEAD))
                 return false;
 
         *percpu_countp = (unsigned long __percpu *)percpu_ptr;
diff --git a/include/linux/pm_domain.h b/include/linux/pm_domain.h
index 73e938b7e937..2e0e06daf8c0 100644
--- a/include/linux/pm_domain.h
+++ b/include/linux/pm_domain.h
@@ -72,8 +72,10 @@ struct generic_pm_domain {
         bool max_off_time_changed;
         bool cached_power_down_ok;
         struct gpd_cpuidle_data *cpuidle_data;
-        void (*attach_dev)(struct device *dev);
-        void (*detach_dev)(struct device *dev);
+        int (*attach_dev)(struct generic_pm_domain *domain,
+                          struct device *dev);
+        void (*detach_dev)(struct generic_pm_domain *domain,
+                           struct device *dev);
 };
 
 static inline struct generic_pm_domain *pd_to_genpd(struct dev_pm_domain *pd)
@@ -104,7 +106,7 @@ struct generic_pm_domain_data {
         struct notifier_block nb;
         struct mutex lock;
         unsigned int refcount;
-        bool need_restore;
+        int need_restore;
 };
 
 #ifdef CONFIG_PM_GENERIC_DOMAINS
diff --git a/include/linux/power/charger-manager.h b/include/linux/power/charger-manager.h
index 07e7945a1ff2..e97fc656a058 100644
--- a/include/linux/power/charger-manager.h
+++ b/include/linux/power/charger-manager.h
@@ -253,9 +253,6 @@ struct charger_manager {
         struct device *dev;
         struct charger_desc *desc;
 
-        struct power_supply *fuel_gauge;
-        struct power_supply **charger_stat;
-
 #ifdef CONFIG_THERMAL
         struct thermal_zone_device *tzd_batt;
 #endif
diff --git a/include/linux/power_supply.h b/include/linux/power_supply.h
index 3ed049673022..096dbced02ac 100644
--- a/include/linux/power_supply.h
+++ b/include/linux/power_supply.h
@@ -200,6 +200,12 @@ struct power_supply {
         void (*external_power_changed)(struct power_supply *psy);
         void (*set_charged)(struct power_supply *psy);
 
+        /*
+         * Set if thermal zone should not be created for this power supply.
+         * For example for virtual supplies forwarding calls to actual
+         * sensors or other supplies.
+         */
+        bool no_thermal;
         /* For APM emulation, think legacy userspace. */
         int use_for_apm;
 
diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index 49a4d6f59108..e2c13cd863bd 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -97,7 +97,7 @@ __ring_buffer_alloc(unsigned long size, unsigned flags, struct lock_class_key *k
         __ring_buffer_alloc((size), (flags), &__key);   \
 })
 
-int ring_buffer_wait(struct ring_buffer *buffer, int cpu);
+int ring_buffer_wait(struct ring_buffer *buffer, int cpu, bool full);
 int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu,
                           struct file *filp, poll_table *poll_table);
 
diff --git a/include/linux/socket.h b/include/linux/socket.h
index ec538fc287a6..bb9b83640070 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -256,7 +256,7 @@ struct ucred {
 #define MSG_EOF         MSG_FIN
 
 #define MSG_FASTOPEN    0x20000000      /* Send data in TCP SYN */
-#define MSG_CMSG_CLOEXEC 0x40000000     /* Set close_on_exit for file
+#define MSG_CMSG_CLOEXEC 0x40000000     /* Set close_on_exec for file
                                            descriptor received through
                                            SCM_RIGHTS */
 #if defined(CONFIG_COMPAT)
diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index d9fa68f26c41..2a25dec30211 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -34,7 +34,6 @@
  * @list: used to maintain a list of currently available transports
  * @name: the human-readable name of the transport
  * @maxsize: transport provided maximum packet size
- * @pref: Preferences of this transport
  * @def: set if this transport should be considered the default
  * @create: member function to create a new connection on this transport
  * @close: member function to discard a connection on this transport
diff --git a/include/net/inet_common.h b/include/net/inet_common.h
index fe7994c48b75..b2828a06a5a6 100644
--- a/include/net/inet_common.h
+++ b/include/net/inet_common.h
@@ -37,6 +37,8 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int inet_ctl_sock_create(struct sock **sk, unsigned short family,
                          unsigned short type, unsigned char protocol,
                          struct net *net);
+int inet_recv_error(struct sock *sk, struct msghdr *msg, int len,
+                    int *addr_len);
 
 static inline void inet_ctl_sock_destroy(struct sock *sk)
 {
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 845c596bf594..3ae969e3acf0 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -396,14 +396,12 @@ struct nft_rule {
 /**
  *      struct nft_trans - nf_tables object update in transaction
  *
- *      @rcu_head: rcu head to defer release of transaction data
  *      @list: used internally
  *      @msg_type: message type
  *      @ctx: transaction context
  *      @data: internal information related to the transaction
  */
 struct nft_trans {
-        struct rcu_head                 rcu_head;
         struct list_head                list;
         int                             msg_type;
         struct nft_ctx                  ctx;
diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h
index a47790bcaa38..2a50a70ef587 100644
--- a/include/net/udp_tunnel.h
+++ b/include/net/udp_tunnel.h
@@ -100,6 +100,15 @@ static inline struct sk_buff *udp_tunnel_handle_offloads(struct sk_buff *skb,
         return iptunnel_handle_offloads(skb, udp_csum, type);
 }
 
+static inline void udp_tunnel_gro_complete(struct sk_buff *skb, int nhoff)
+{
+        struct udphdr *uh;
+
+        uh = (struct udphdr *)(skb->data + nhoff - sizeof(struct udphdr));
+        skb_shinfo(skb)->gso_type |= uh->check ?
+                                SKB_GSO_UDP_TUNNEL_CSUM : SKB_GSO_UDP_TUNNEL;
+}
+
 static inline void udp_tunnel_encap_enable(struct socket *sock)
 {
 #if IS_ENABLED(CONFIG_IPV6)
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index d5f59f3fc35d..57cccd0052e5 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -8,6 +8,12 @@
 #define VNI_HASH_BITS   10
 #define VNI_HASH_SIZE   (1<<VNI_HASH_BITS)
 
+/* VXLAN protocol header */
+struct vxlanhdr {
+        __be32 vx_flags;
+        __be32 vx_vni;
+};
+
 struct vxlan_sock;
 typedef void (vxlan_rcv_t)(struct vxlan_sock *vh, struct sk_buff *skb, __be32 key);
 
@@ -45,6 +51,18 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
                    __be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
                    __be16 src_port, __be16 dst_port, __be32 vni, bool xnet);
 
+static inline bool vxlan_gso_check(struct sk_buff *skb)
+{
+        if ((skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL) &&
+            (skb->inner_protocol_type != ENCAP_TYPE_ETHER ||
+             skb->inner_protocol != htons(ETH_P_TEB) ||
+             (skb_inner_mac_header(skb) - skb_transport_header(skb) !=
+              sizeof(struct udphdr) + sizeof(struct vxlanhdr))))
+                return false;
+
+        return true;
+}
+
 /* IP header + UDP + VXLAN + Ethernet header */
 #define VXLAN_HEADROOM (20 + 8 + 8 + 14)
 /* IPv6 header + UDP + VXLAN + Ethernet header */
diff --git a/include/sound/pcm.h b/include/sound/pcm.h
index e862497f7556..8bb00a27e219 100644
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -184,6 +184,8 @@ struct snd_pcm_ops {
 #define SNDRV_PCM_FMTBIT_DSD_U8         _SNDRV_PCM_FMTBIT(DSD_U8)
 #define SNDRV_PCM_FMTBIT_DSD_U16_LE     _SNDRV_PCM_FMTBIT(DSD_U16_LE)
 #define SNDRV_PCM_FMTBIT_DSD_U32_LE     _SNDRV_PCM_FMTBIT(DSD_U32_LE)
+#define SNDRV_PCM_FMTBIT_DSD_U16_BE     _SNDRV_PCM_FMTBIT(DSD_U16_BE)
+#define SNDRV_PCM_FMTBIT_DSD_U32_BE     _SNDRV_PCM_FMTBIT(DSD_U32_BE)
 
 #ifdef SNDRV_LITTLE_ENDIAN
 #define SNDRV_PCM_FMTBIT_S16            SNDRV_PCM_FMTBIT_S16_LE
diff --git a/include/sound/soc-dpcm.h b/include/sound/soc-dpcm.h
index 2883a7a6f9f3..98f2ade0266e 100644
--- a/include/sound/soc-dpcm.h
+++ b/include/sound/soc-dpcm.h
@@ -102,6 +102,8 @@ struct snd_soc_dpcm_runtime {
         /* state and update */
         enum snd_soc_dpcm_update runtime_update;
         enum snd_soc_dpcm_state state;
+
+        int trigger_pending; /* trigger cmd + 1 if pending, 0 if not */
 };
 
 /* can this BE stop and free */
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index b70237e8bc37..4c94f31a8c99 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -125,6 +125,7 @@ header-y += filter.h
 header-y += firewire-cdev.h
 header-y += firewire-constants.h
 header-y += flat.h
+header-y += fou.h
 header-y += fs.h
 header-y += fsl_hypervisor.h
 header-y += fuse.h
@@ -141,6 +142,7 @@ header-y += hid.h
 header-y += hiddev.h
 header-y += hidraw.h
 header-y += hpet.h
+header-y += hsr_netlink.h
 header-y += hyperv.h
 header-y += hysdn_if.h
 header-y += i2c-dev.h
@@ -251,6 +253,7 @@ header-y += mii.h
 header-y += minix_fs.h
 header-y += mman.h
 header-y += mmtimer.h
+header-y += mpls.h
 header-y += mqueue.h
 header-y += mroute.h
 header-y += mroute6.h
@@ -424,6 +427,7 @@ header-y += virtio_net.h
 header-y += virtio_pci.h
 header-y += virtio_ring.h
 header-y += virtio_rng.h
+header=y += vm_sockets.h
 header-y += vt.h
 header-y += wait.h
 header-y += wanrouter.h
diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h
index 39f621a9fe82..da17e456908d 100644
--- a/include/uapi/linux/if_bridge.h
+++ b/include/uapi/linux/if_bridge.h
@@ -15,6 +15,7 @@
 
 #include <linux/types.h>
 #include <linux/if_ether.h>
+#include <linux/in6.h>
 
 #define SYSFS_BRIDGE_ATTR       "bridge"
 #define SYSFS_BRIDGE_FDB        "brforward"
diff --git a/include/uapi/sound/asound.h b/include/uapi/sound/asound.h
index 6ee586728df9..941d32f007dc 100644
--- a/include/uapi/sound/asound.h
+++ b/include/uapi/sound/asound.h
@@ -220,7 +220,9 @@ typedef int __bitwise snd_pcm_format_t;
 #define SNDRV_PCM_FORMAT_DSD_U8         ((__force snd_pcm_format_t) 48) /* DSD, 1-byte samples DSD (x8) */
 #define SNDRV_PCM_FORMAT_DSD_U16_LE     ((__force snd_pcm_format_t) 49) /* DSD, 2-byte samples DSD (x16), little endian */
 #define SNDRV_PCM_FORMAT_DSD_U32_LE     ((__force snd_pcm_format_t) 50) /* DSD, 4-byte samples DSD (x32), little endian */
-#define SNDRV_PCM_FORMAT_LAST           SNDRV_PCM_FORMAT_DSD_U32_LE
+#define SNDRV_PCM_FORMAT_DSD_U16_BE     ((__force snd_pcm_format_t) 51) /* DSD, 2-byte samples DSD (x16), big endian */
+#define SNDRV_PCM_FORMAT_DSD_U32_BE     ((__force snd_pcm_format_t) 52) /* DSD, 4-byte samples DSD (x32), big endian */
+#define SNDRV_PCM_FORMAT_LAST           SNDRV_PCM_FORMAT_DSD_U32_BE
 
 #ifdef SNDRV_LITTLE_ENDIAN
 #define SNDRV_PCM_FORMAT_S16            SNDRV_PCM_FORMAT_S16_LE
diff --git a/init/main.c b/init/main.c
index 800a0daede7e..321d0ceb26d3 100644
--- a/init/main.c
+++ b/init/main.c
@@ -544,7 +544,7 @@ asmlinkage __visible void __init start_kernel(void)
                                   static_command_line, __start___param,
                                   __stop___param - __start___param,
                                   -1, -1, &unknown_bootoption);
-        if (after_dashes)
+        if (!IS_ERR_OR_NULL(after_dashes))
                 parse_args("Setting init args", after_dashes, NULL, 0, -1, -1,
                            set_init_arg);
 
diff --git a/kernel/audit.c b/kernel/audit.c
index 80983df92cd4..cebb11db4d34 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -739,7 +739,7 @@ static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature
 
         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_FEATURE_CHANGE);
         audit_log_task_info(ab, current);
-        audit_log_format(ab, "feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
+        audit_log_format(ab, " feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
                          audit_feature_names[which], !!old_feature, !!new_feature,
                          !!old_lock, !!new_lock, res);
         audit_log_end(ab);
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index e242e3a9864a..80f29e015570 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -154,6 +154,7 @@ static struct audit_chunk *alloc_chunk(int count)
                 chunk->owners[i].index = i;
         }
         fsnotify_init_mark(&chunk->mark, audit_tree_destroy_watch);
+        chunk->mark.mask = FS_IN_IGNORED;
         return chunk;
 }
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 2b02c9fda790..1cd5eef1fcdd 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1562,8 +1562,10 @@ static void perf_remove_from_context(struct perf_event *event, bool detach_group
 
         if (!task) {
                 /*
-                 * Per cpu events are removed via an smp call and
-                 * the removal is always successful.
+                 * Per cpu events are removed via an smp call. The removal can
+                 * fail if the CPU is currently offline, but in that case we
+                 * already called __perf_remove_from_context from
+                 * perf_event_exit_cpu.
                  */
                 cpu_function_call(event->cpu, __perf_remove_from_context, &re);
                 return;
@@ -8117,7 +8119,7 @@ static void perf_pmu_rotate_stop(struct pmu *pmu)
 
 static void __perf_event_exit_context(void *__info)
 {
-        struct remove_event re = { .detach_group = false };
+        struct remove_event re = { .detach_group = true };
         struct perf_event_context *ctx = __info;
 
         perf_pmu_rotate_stop(ctx->pmu);
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index bc143cf56cab..d2a5689a6b2e 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1640,7 +1640,6 @@ bool uprobe_deny_signal(void)
                 if (__fatal_signal_pending(t) || arch_uprobe_xol_was_trapped(t)) {
                         utask->state = UTASK_SSTEP_TRAPPED;
                         set_tsk_thread_flag(t, TIF_UPROBE);
-                        set_tsk_thread_flag(t, TIF_NOTIFY_RESUME);
                 }
         }
 
diff --git a/kernel/panic.c b/kernel/panic.c
index d09dc5c32c67..cf80672b7924 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -244,6 +244,7 @@ static const struct tnt tnts[] = {
  *  'I' - Working around severe firmware bug.
  *  'O' - Out-of-tree module has been loaded.
  *  'E' - Unsigned module has been loaded.
+ *  'L' - A soft lockup has previously occurred.
  *
  *      The string is overwritten by the next call to print_tainted().
  */
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 4ca9a33ff620..c347e3ce3a55 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -146,7 +146,7 @@ static int platform_suspend_prepare(suspend_state_t state)
 
 static int platform_suspend_prepare_late(suspend_state_t state)
 {
-        return state == PM_SUSPEND_FREEZE && freeze_ops->prepare ?
+        return state == PM_SUSPEND_FREEZE && freeze_ops && freeze_ops->prepare ?
                 freeze_ops->prepare() : 0;
 }
 
@@ -164,7 +164,7 @@ static void platform_resume_noirq(suspend_state_t state)
 
 static void platform_resume_early(suspend_state_t state)
 {
-        if (state == PM_SUSPEND_FREEZE && freeze_ops->restore)
+        if (state == PM_SUSPEND_FREEZE && freeze_ops && freeze_ops->restore)
                 freeze_ops->restore();
 }
 
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 240157c13ddc..24beb9bb4c3e 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2475,44 +2475,6 @@ EXPORT_PER_CPU_SYMBOL(kstat);
 EXPORT_PER_CPU_SYMBOL(kernel_cpustat);
 
 /*
- * Return any ns on the sched_clock that have not yet been accounted in
- * @p in case that task is currently running.
- *
- * Called with task_rq_lock() held on @rq.
- */
-static u64 do_task_delta_exec(struct task_struct *p, struct rq *rq)
-{
-        u64 ns = 0;
-
-        /*
-         * Must be ->curr _and_ ->on_rq.  If dequeued, we would
-         * project cycles that may never be accounted to this
-         * thread, breaking clock_gettime().
-         */
-        if (task_current(rq, p) && task_on_rq_queued(p)) {
-                update_rq_clock(rq);
-                ns = rq_clock_task(rq) - p->se.exec_start;
-                if ((s64)ns < 0)
-                        ns = 0;
-        }
-
-        return ns;
-}
-
-unsigned long long task_delta_exec(struct task_struct *p)
-{
-        unsigned long flags;
-        struct rq *rq;
-        u64 ns = 0;
-
-        rq = task_rq_lock(p, &flags);
-        ns = do_task_delta_exec(p, rq);
-        task_rq_unlock(rq, p, &flags);
-
-        return ns;
-}
-
-/*
  * Return accounted runtime for the task.
  * In case the task is currently running, return the runtime plus current's
  * pending runtime that have not been accounted yet.
@@ -2521,7 +2483,7 @@ unsigned long long task_sched_runtime(struct task_struct *p)
 {
         unsigned long flags;
         struct rq *rq;
-        u64 ns = 0;
+        u64 ns;
 
 #if defined(CONFIG_64BIT) && defined(CONFIG_SMP)
         /*
@@ -2540,7 +2502,16 @@ unsigned long long task_sched_runtime(struct task_struct *p)
 #endif
 
         rq = task_rq_lock(p, &flags);
-        ns = p->se.sum_exec_runtime + do_task_delta_exec(p, rq);
+        /*
+         * Must be ->curr _and_ ->on_rq.  If dequeued, we would
+         * project cycles that may never be accounted to this
+         * thread, breaking clock_gettime().
+         */
+        if (task_current(rq, p) && task_on_rq_queued(p)) {
+                update_rq_clock(rq);
+                p->sched_class->update_curr(rq);
+        }
+        ns = p->se.sum_exec_runtime;
         task_rq_unlock(rq, p, &flags);
 
         return ns;
@@ -6368,6 +6339,10 @@ static void sched_init_numa(void)
                 if (!sched_debug())
                         break;
         }
+
+        if (!level)
+                return;
+
         /*
          * 'level' contains the number of unique distances, excluding the
          * identity distance node_distance(i,i).
@@ -7444,8 +7419,12 @@ void sched_move_task(struct task_struct *tsk)
         if (unlikely(running))
                 put_prev_task(rq, tsk);
 
-        tg = container_of(task_css_check(tsk, cpu_cgrp_id,
-                                lockdep_is_held(&tsk->sighand->siglock)),
+        /*
+         * All callers are synchronized by task_rq_lock(); we do not use RCU
+         * which is pointless here. Thus, we pass "true" to task_css_check()
+         * to prevent lockdep warnings.
+         */
+        tg = container_of(task_css_check(tsk, cpu_cgrp_id, true),
                           struct task_group, css);
         tg = autogroup_task_group(tsk, tg);
         tsk->sched_task_group = tg;
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 5285332392d5..28fa9d9e9201 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -1701,4 +1701,6 @@ const struct sched_class dl_sched_class = {
         .prio_changed           = prio_changed_dl,
         .switched_from          = switched_from_dl,
         .switched_to            = switched_to_dl,
+
+        .update_curr            = update_curr_dl,
 };
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 34baa60f8a7b..ef2b104b254c 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -726,6 +726,11 @@ static void update_curr(struct cfs_rq *cfs_rq)
         account_cfs_rq_runtime(cfs_rq, delta_exec);
 }
 
+static void update_curr_fair(struct rq *rq)
+{
+        update_curr(cfs_rq_of(&rq->curr->se));
+}
+
 static inline void
 update_stats_wait_start(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
@@ -1180,6 +1185,13 @@ static void task_numa_compare(struct task_numa_env *env,
         raw_spin_unlock_irq(&dst_rq->lock);
 
         /*
+         * Because we have preemption enabled we can get migrated around and
+         * end try selecting ourselves (current == env->p) as a swap candidate.
+         */
+        if (cur == env->p)
+                goto unlock;
+
+        /*
          * "imp" is the fault differential for the source task between the
          * source and destination node. Calculate the total differential for
          * the source task and potential destination task. The more negative
@@ -7949,6 +7961,8 @@ const struct sched_class fair_sched_class = {
 
         .get_rr_interval        = get_rr_interval_fair,
 
+        .update_curr            = update_curr_fair,
+
 #ifdef CONFIG_FAIR_GROUP_SCHED
         .task_move_group        = task_move_group_fair,
 #endif
diff --git a/kernel/sched/idle_task.c b/kernel/sched/idle_task.c
index 67ad4e7f506a..c65dac8c97cd 100644
--- a/kernel/sched/idle_task.c
+++ b/kernel/sched/idle_task.c
@@ -75,6 +75,10 @@ static unsigned int get_rr_interval_idle(struct rq *rq, struct task_struct *task
         return 0;
 }
 
+static void update_curr_idle(struct rq *rq)
+{
+}
+
 /*
  * Simple, special scheduling class for the per-CPU idle tasks:
  */
@@ -101,4 +105,5 @@ const struct sched_class idle_sched_class = {
 
         .prio_changed           = prio_changed_idle,
         .switched_to            = switched_to_idle,
+        .update_curr            = update_curr_idle,
 };
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index d024e6ce30ba..20bca398084a 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -2128,6 +2128,8 @@ const struct sched_class rt_sched_class = {
 
         .prio_changed           = prio_changed_rt,
         .switched_to            = switched_to_rt,
+
+        .update_curr            = update_curr_rt,
 };
 
 #ifdef CONFIG_SCHED_DEBUG
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 24156c8434d1..2df8ef067cc5 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1135,6 +1135,8 @@ struct sched_class {
         unsigned int (*get_rr_interval) (struct rq *rq,
                                          struct task_struct *task);
 
+        void (*update_curr) (struct rq *rq);
+
 #ifdef CONFIG_FAIR_GROUP_SCHED
         void (*task_move_group) (struct task_struct *p, int on_rq);
 #endif
diff --git a/kernel/sched/stop_task.c b/kernel/sched/stop_task.c
index 67426e529f59..79ffec45a6ac 100644
--- a/kernel/sched/stop_task.c
+++ b/kernel/sched/stop_task.c
@@ -102,6 +102,10 @@ get_rr_interval_stop(struct rq *rq, struct task_struct *task)
         return 0;
 }
 
+static void update_curr_stop(struct rq *rq)
+{
+}
+
 /*
  * Simple, special scheduling class for the per-CPU stop tasks:
  */
@@ -128,4 +132,5 @@ const struct sched_class stop_sched_class = {
 
         .prio_changed           = prio_changed_stop,
         .switched_to            = switched_to_stop,
+        .update_curr            = update_curr_stop,
 };
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 492b986195d5..a16b67859e2a 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -553,7 +553,7 @@ static int cpu_timer_sample_group(const clockid_t which_clock,
                 *sample = cputime_to_expires(cputime.utime);
                 break;
         case CPUCLOCK_SCHED:
-                *sample = cputime.sum_exec_runtime + task_delta_exec(p);
+                *sample = cputime.sum_exec_runtime;
                 break;
         }
         return 0;
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 2d75c94ae87d..a56e07c8d15b 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -538,16 +538,18 @@ static void rb_wake_up_waiters(struct irq_work *work)
  * ring_buffer_wait - wait for input to the ring buffer
  * @buffer: buffer to wait on
  * @cpu: the cpu buffer to wait on
+ * @full: wait until a full page is available, if @cpu != RING_BUFFER_ALL_CPUS
  *
  * If @cpu == RING_BUFFER_ALL_CPUS then the task will wake up as soon
  * as data is added to any of the @buffer's cpu buffers. Otherwise
  * it will wait for data to be added to a specific cpu buffer.
  */
-int ring_buffer_wait(struct ring_buffer *buffer, int cpu)
+int ring_buffer_wait(struct ring_buffer *buffer, int cpu, bool full)
 {
-        struct ring_buffer_per_cpu *cpu_buffer;
+        struct ring_buffer_per_cpu *uninitialized_var(cpu_buffer);
         DEFINE_WAIT(wait);
         struct rb_irq_work *work;
+        int ret = 0;
 
         /*
          * Depending on what the caller is waiting for, either any
@@ -564,36 +566,61 @@ int ring_buffer_wait(struct ring_buffer *buffer, int cpu)
         }
 
 
-        prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE);
+        while (true) {
+                prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE);
 
-        /*
-         * The events can happen in critical sections where
-         * checking a work queue can cause deadlocks.
-         * After adding a task to the queue, this flag is set
-         * only to notify events to try to wake up the queue
-         * using irq_work.
-         *
-         * We don't clear it even if the buffer is no longer
-         * empty. The flag only causes the next event to run
-         * irq_work to do the work queue wake up. The worse
-         * that can happen if we race with !trace_empty() is that
-         * an event will cause an irq_work to try to wake up
-         * an empty queue.
-         *
-         * There's no reason to protect this flag either, as
-         * the work queue and irq_work logic will do the necessary
-         * synchronization for the wake ups. The only thing
-         * that is necessary is that the wake up happens after
-         * a task has been queued. It's OK for spurious wake ups.
-         */
-        work->waiters_pending = true;
+                /*
+                 * The events can happen in critical sections where
+                 * checking a work queue can cause deadlocks.
+                 * After adding a task to the queue, this flag is set
+                 * only to notify events to try to wake up the queue
+                 * using irq_work.
+                 *
+                 * We don't clear it even if the buffer is no longer
+                 * empty. The flag only causes the next event to run
+                 * irq_work to do the work queue wake up. The worse
+                 * that can happen if we race with !trace_empty() is that
+                 * an event will cause an irq_work to try to wake up
+                 * an empty queue.
+                 *
+                 * There's no reason to protect this flag either, as
+                 * the work queue and irq_work logic will do the necessary
+                 * synchronization for the wake ups. The only thing
+                 * that is necessary is that the wake up happens after
+                 * a task has been queued. It's OK for spurious wake ups.
+                 */
+                work->waiters_pending = true;
+
+                if (signal_pending(current)) {
+                        ret = -EINTR;
+                        break;
+                }
+
+                if (cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer))
+                        break;
+
+                if (cpu != RING_BUFFER_ALL_CPUS &&
+                    !ring_buffer_empty_cpu(buffer, cpu)) {
+                        unsigned long flags;
+                        bool pagebusy;
+
+                        if (!full)
+                                break;
+
+                        raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+                        pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page;
+                        raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+
+                        if (!pagebusy)
+                                break;
+                }
 
-        if ((cpu == RING_BUFFER_ALL_CPUS && ring_buffer_empty(buffer)) ||
-            (cpu != RING_BUFFER_ALL_CPUS && ring_buffer_empty_cpu(buffer, cpu)))
                 schedule();
+        }
 
         finish_wait(&work->waiters, &wait);
-        return 0;
+
+        return ret;
 }
 
 /**
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 8a528392b1f4..92f4a6cee172 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1076,13 +1076,14 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu)
 }
 #endif /* CONFIG_TRACER_MAX_TRACE */
 
-static int wait_on_pipe(struct trace_iterator *iter)
+static int wait_on_pipe(struct trace_iterator *iter, bool full)
 {
         /* Iterators are static, they should be filled or empty */
         if (trace_buffer_iter(iter, iter->cpu_file))
                 return 0;
 
-        return ring_buffer_wait(iter->trace_buffer->buffer, iter->cpu_file);
+        return ring_buffer_wait(iter->trace_buffer->buffer, iter->cpu_file,
+                                full);
 }
 
 #ifdef CONFIG_FTRACE_STARTUP_TEST
@@ -4434,15 +4435,12 @@ static int tracing_wait_pipe(struct file *filp)
 
                 mutex_unlock(&iter->mutex);
 
-                ret = wait_on_pipe(iter);
+                ret = wait_on_pipe(iter, false);
 
                 mutex_lock(&iter->mutex);
 
                 if (ret)
                         return ret;
-
-                if (signal_pending(current))
-                        return -EINTR;
         }
 
         return 1;
@@ -5372,16 +5370,12 @@ tracing_buffers_read(struct file *filp, char __user *ubuf,
                                 goto out_unlock;
                         }
                         mutex_unlock(&trace_types_lock);
-                        ret = wait_on_pipe(iter);
+                        ret = wait_on_pipe(iter, false);
                         mutex_lock(&trace_types_lock);
                         if (ret) {
                                 size = ret;
                                 goto out_unlock;
                         }
-                        if (signal_pending(current)) {
-                                size = -EINTR;
-                                goto out_unlock;
-                        }
                         goto again;
                 }
                 size = 0;
@@ -5500,7 +5494,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
         };
         struct buffer_ref *ref;
         int entries, size, i;
-        ssize_t ret;
+        ssize_t ret = 0;
 
         mutex_lock(&trace_types_lock);
 
@@ -5538,13 +5532,16 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
                 int r;
 
                 ref = kzalloc(sizeof(*ref), GFP_KERNEL);
-                if (!ref)
+                if (!ref) {
+                        ret = -ENOMEM;
                         break;
+                }
 
                 ref->ref = 1;
                 ref->buffer = iter->trace_buffer->buffer;
                 ref->page = ring_buffer_alloc_read_page(ref->buffer, iter->cpu_file);
                 if (!ref->page) {
+                        ret = -ENOMEM;
                         kfree(ref);
                         break;
                 }
@@ -5582,19 +5579,19 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
 
         /* did we read anything? */
         if (!spd.nr_pages) {
+                if (ret)
+                        goto out;
+
                 if ((file->f_flags & O_NONBLOCK) || (flags & SPLICE_F_NONBLOCK)) {
                         ret = -EAGAIN;
                         goto out;
                 }
                 mutex_unlock(&trace_types_lock);
-                ret = wait_on_pipe(iter);
+                ret = wait_on_pipe(iter, true);
                 mutex_lock(&trace_types_lock);
                 if (ret)
                         goto out;
-                if (signal_pending(current)) {
-                        ret = -EINTR;
-                        goto out;
-                }
+
                 goto again;
         }
 
diff --git a/lib/Makefile b/lib/Makefile
index 7512dc978f18..0211d2bd5e17 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -10,7 +10,7 @@ endif
 lib-y := ctype.o string.o vsprintf.o cmdline.o \
          rbtree.o radix-tree.o dump_stack.o timerqueue.o\
          idr.o int_sqrt.o extable.o \
-         sha1.o md5.o irq_regs.o reciprocal_div.o argv_split.o \
+         sha1.o md5.o irq_regs.o argv_split.o \
          proportions.o flex_proportions.o ratelimit.o show_mem.o \
          is_single_threaded.o plist.o decompress.o kobject_uevent.o \
          earlycpio.o
@@ -26,7 +26,7 @@ obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
          bust_spinlocks.o hexdump.o kasprintf.o bitmap.o scatterlist.o \
          gcd.o lcm.o list_sort.o uuid.o flex_array.o iovec.o clz_ctz.o \
          bsearch.o find_last_bit.o find_next_bit.o llist.o memweight.o kfifo.o \
-         percpu-refcount.o percpu_ida.o hash.o rhashtable.o
+         percpu-refcount.o percpu_ida.o hash.o rhashtable.o reciprocal_div.o
 obj-y += string_helpers.o
 obj-$(CONFIG_TEST_STRING_HELPERS) += test-string_helpers.o
 obj-y += kstrtox.o
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 081be3ba9ea8..624a0b7c05ef 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -230,7 +230,7 @@ int rhashtable_expand(struct rhashtable *ht, gfp_t flags)
         ht->shift++;
 
         /* For each new bucket, search the corresponding old bucket
-         * for the first entry that hashes to the new bucket, and
+         * for the first entry that hashes to the new bucket, and
          * link the new bucket to that entry. Since all the entries
          * which will end up in the new bucket appear in the same
          * old bucket, this constructs an entirely valid new hash
@@ -248,8 +248,8 @@ int rhashtable_expand(struct rhashtable *ht, gfp_t flags)
         }
 
         /* Publish the new table pointer. Lookups may now traverse
-         * the new table, but they will not benefit from any
-         * additional efficiency until later steps unzip the buckets.
+         * the new table, but they will not benefit from any
+         * additional efficiency until later steps unzip the buckets.
          */
         rcu_assign_pointer(ht->tbl, new_tbl);
 
@@ -306,14 +306,14 @@ int rhashtable_shrink(struct rhashtable *ht, gfp_t flags)
 
         ht->shift--;
 
-        /* Link each bucket in the new table to the first bucket
+        /* Link each bucket in the new table to the first bucket
          * in the old table that contains entries which will hash
          * to the new bucket.
          */
         for (i = 0; i < ntbl->size; i++) {
                 ntbl->buckets[i] = tbl->buckets[i];
 
-                /* Link each bucket in the new table to the first bucket
+                /* Link each bucket in the new table to the first bucket
                  * in the old table that contains entries which will hash
                  * to the new bucket.
                  */
diff --git a/mm/bootmem.c b/mm/bootmem.c
index 8a000cebb0d7..477be696511d 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -243,13 +243,10 @@ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata)
 
 static int reset_managed_pages_done __initdata;
 
-static inline void __init reset_node_managed_pages(pg_data_t *pgdat)
+void reset_node_managed_pages(pg_data_t *pgdat)
 {
         struct zone *z;
 
-        if (reset_managed_pages_done)
-                return;
-
         for (z = pgdat->node_zones; z < pgdat->node_zones + MAX_NR_ZONES; z++)
                 z->managed_pages = 0;
 }
@@ -258,8 +255,12 @@ void __init reset_all_zones_managed_pages(void)
 {
         struct pglist_data *pgdat;
 
+        if (reset_managed_pages_done)
+                return;
+
         for_each_online_pgdat(pgdat)
                 reset_node_managed_pages(pgdat);
+
         reset_managed_pages_done = 1;
 }
 
diff --git a/mm/compaction.c b/mm/compaction.c
index ec74cf0123ef..f9792ba3537c 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -479,6 +479,16 @@ isolate_freepages_range(struct compact_control *cc,
 
                 block_end_pfn = min(block_end_pfn, end_pfn);
 
+                /*
+                 * pfn could pass the block_end_pfn if isolated freepage
+                 * is more than pageblock order. In this case, we adjust
+                 * scanning range to right one.
+                 */
+                if (pfn >= block_end_pfn) {
+                        block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages);
+                        block_end_pfn = min(block_end_pfn, end_pfn);
+                }
+
                 if (!pageblock_pfn_to_page(pfn, block_end_pfn, cc->zone))
                         break;
 
@@ -1029,8 +1039,12 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
         }
 
         acct_isolated(zone, cc);
-        /* Record where migration scanner will be restarted */
-        cc->migrate_pfn = low_pfn;
+        /*
+         * Record where migration scanner will be restarted. If we end up in
+         * the same pageblock as the free scanner, make the scanners fully
+         * meet so that compact_finished() terminates compaction.
+         */
+        cc->migrate_pfn = (end_pfn <= cc->free_pfn) ? low_pfn : cc->free_pfn;
 
         return cc->nr_migratepages ? ISOLATE_SUCCESS : ISOLATE_NONE;
 }
diff --git a/mm/internal.h b/mm/internal.h
index 829304090b90..a4f90ba7068e 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -108,6 +108,31 @@ extern pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address);
 /*
  * in mm/page_alloc.c
  */
+
+/*
+ * Locate the struct page for both the matching buddy in our
+ * pair (buddy1) and the combined O(n+1) page they form (page).
+ *
+ * 1) Any buddy B1 will have an order O twin B2 which satisfies
+ * the following equation:
+ *     B2 = B1 ^ (1 << O)
+ * For example, if the starting buddy (buddy2) is #8 its order
+ * 1 buddy is #10:
+ *     B2 = 8 ^ (1 << 1) = 8 ^ 2 = 10
+ *
+ * 2) Any buddy B will have an order O+1 parent P which
+ * satisfies the following equation:
+ *     P = B & ~(1 << O)
+ *
+ * Assumption: *_mem_map is contiguous at least up to MAX_ORDER
+ */
+static inline unsigned long
+__find_buddy_index(unsigned long page_idx, unsigned int order)
+{
+        return page_idx ^ (1 << order);
+}
+
+extern int __isolate_free_page(struct page *page, unsigned int order);
 extern void __free_pages_bootmem(struct page *page, unsigned int order);
 extern void prep_compound_page(struct page *page, unsigned long order);
 #ifdef CONFIG_MEMORY_FAILURE
diff --git a/mm/iov_iter.c b/mm/iov_iter.c
index eafcf60f6b83..e34a3cb6aad6 100644
--- a/mm/iov_iter.c
+++ b/mm/iov_iter.c
@@ -911,9 +911,9 @@ size_t iov_iter_single_seg_count(const struct iov_iter *i)
         if (i->nr_segs == 1)
                 return i->count;
         else if (i->type & ITER_BVEC)
-                return min(i->count, i->iov->iov_len - i->iov_offset);
-        else
                 return min(i->count, i->bvec->bv_len - i->iov_offset);
+        else
+                return min(i->count, i->iov->iov_len - i->iov_offset);
 }
 EXPORT_SYMBOL(iov_iter_single_seg_count);
 
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 252e1dbbed86..1bf4807cb21e 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -31,6 +31,7 @@
 #include <linux/stop_machine.h>
 #include <linux/hugetlb.h>
 #include <linux/memblock.h>
+#include <linux/bootmem.h>
 
 #include <asm/tlbflush.h>
 
@@ -1066,6 +1067,16 @@ out:
 }
 #endif /* CONFIG_MEMORY_HOTPLUG_SPARSE */
 
+static void reset_node_present_pages(pg_data_t *pgdat)
+{
+        struct zone *z;
+
+        for (z = pgdat->node_zones; z < pgdat->node_zones + MAX_NR_ZONES; z++)
+                z->present_pages = 0;
+
+        pgdat->node_present_pages = 0;
+}
+
 /* we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG */
 static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
 {
@@ -1096,6 +1107,21 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
         build_all_zonelists(pgdat, NULL);
         mutex_unlock(&zonelists_mutex);
 
+        /*
+         * zone->managed_pages is set to an approximate value in
+         * free_area_init_core(), which will cause
+         * /sys/device/system/node/nodeX/meminfo has wrong data.
+         * So reset it to 0 before any memory is onlined.
+         */
+        reset_node_managed_pages(pgdat);
+
+        /*
+         * When memory is hot-added, all the memory is in offline state. So
+         * clear all zones' present_pages because they will be updated in
+         * online_pages() and offline_pages().
+         */
+        reset_node_present_pages(pgdat);
+
         return pgdat;
 }
 
diff --git a/mm/nobootmem.c b/mm/nobootmem.c
index 7c7ab32ee503..90b50468333e 100644
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -145,12 +145,10 @@ static unsigned long __init free_low_memory_core_early(void)
 
 static int reset_managed_pages_done __initdata;
 
-static inline void __init reset_node_managed_pages(pg_data_t *pgdat)
+void reset_node_managed_pages(pg_data_t *pgdat)
 {
         struct zone *z;
 
-        if (reset_managed_pages_done)
-                return;
         for (z = pgdat->node_zones; z < pgdat->node_zones + MAX_NR_ZONES; z++)
                 z->managed_pages = 0;
 }
@@ -159,8 +157,12 @@ void __init reset_all_zones_managed_pages(void)
 {
         struct pglist_data *pgdat;
 
+        if (reset_managed_pages_done)
+                return;
+
         for_each_online_pgdat(pgdat)
                 reset_node_managed_pages(pgdat);
+
         reset_managed_pages_done = 1;
 }
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 9cd36b822444..616a2c956b4b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -467,29 +467,6 @@ static inline void rmv_page_order(struct page *page)
 }
 
 /*
- * Locate the struct page for both the matching buddy in our
- * pair (buddy1) and the combined O(n+1) page they form (page).
- *
- * 1) Any buddy B1 will have an order O twin B2 which satisfies
- * the following equation:
- *     B2 = B1 ^ (1 << O)
- * For example, if the starting buddy (buddy2) is #8 its order
- * 1 buddy is #10:
- *     B2 = 8 ^ (1 << 1) = 8 ^ 2 = 10
- *
- * 2) Any buddy B will have an order O+1 parent P which
- * satisfies the following equation:
- *     P = B & ~(1 << O)
- *
- * Assumption: *_mem_map is contiguous at least up to MAX_ORDER
- */
-static inline unsigned long
-__find_buddy_index(unsigned long page_idx, unsigned int order)
-{
-        return page_idx ^ (1 << order);
-}
-
-/*
  * This function checks whether a page is free && is the buddy
  * we can do coalesce a page and its buddy if
  * (a) the buddy is not in a hole &&
@@ -569,6 +546,7 @@ static inline void __free_one_page(struct page *page,
         unsigned long combined_idx;
         unsigned long uninitialized_var(buddy_idx);
         struct page *buddy;
+        int max_order = MAX_ORDER;
 
         VM_BUG_ON(!zone_is_initialized(zone));
 
@@ -577,13 +555,24 @@ static inline void __free_one_page(struct page *page,
                         return;
 
         VM_BUG_ON(migratetype == -1);
+        if (is_migrate_isolate(migratetype)) {
+                /*
+                 * We restrict max order of merging to prevent merge
+                 * between freepages on isolate pageblock and normal
+                 * pageblock. Without this, pageblock isolation
+                 * could cause incorrect freepage accounting.
+                 */
+                max_order = min(MAX_ORDER, pageblock_order + 1);
+        } else {
+                __mod_zone_freepage_state(zone, 1 << order, migratetype);
+        }
 
-        page_idx = pfn & ((1 << MAX_ORDER) - 1);
+        page_idx = pfn & ((1 << max_order) - 1);
 
         VM_BUG_ON_PAGE(page_idx & ((1 << order) - 1), page);
         VM_BUG_ON_PAGE(bad_range(zone, page), page);
 
-        while (order < MAX_ORDER-1) {
+        while (order < max_order - 1) {
                 buddy_idx = __find_buddy_index(page_idx, order);
                 buddy = page + (buddy_idx - page_idx);
                 if (!page_is_buddy(page, buddy, order))
@@ -594,9 +583,11 @@ static inline void __free_one_page(struct page *page,
                  */
                 if (page_is_guard(buddy)) {
                         clear_page_guard_flag(buddy);
-                        set_page_private(page, 0);
-                        __mod_zone_freepage_state(zone, 1 << order,
-                                                  migratetype);
+                        set_page_private(buddy, 0);
+                        if (!is_migrate_isolate(migratetype)) {
+                                __mod_zone_freepage_state(zone, 1 << order,
+                                                          migratetype);
+                        }
                 } else {
                         list_del(&buddy->lru);
                         zone->free_area[order].nr_free--;
@@ -715,14 +706,12 @@ static void free_pcppages_bulk(struct zone *zone, int count,
                         /* must delete as __free_one_page list manipulates */
                         list_del(&page->lru);
                         mt = get_freepage_migratetype(page);
+                        if (unlikely(has_isolate_pageblock(zone)))
+                                mt = get_pageblock_migratetype(page);
+
                         /* MIGRATE_MOVABLE list may include MIGRATE_RESERVEs */
                         __free_one_page(page, page_to_pfn(page), zone, 0, mt);
                         trace_mm_page_pcpu_drain(page, 0, mt);
-                        if (likely(!is_migrate_isolate_page(page))) {
-                                __mod_zone_page_state(zone, NR_FREE_PAGES, 1);
-                                if (is_migrate_cma(mt))
-                                        __mod_zone_page_state(zone, NR_FREE_CMA_PAGES, 1);
-                        }
                 } while (--to_free && --batch_free && !list_empty(list));
         }
         spin_unlock(&zone->lock);
@@ -739,9 +728,11 @@ static void free_one_page(struct zone *zone,
         if (nr_scanned)
                 __mod_zone_page_state(zone, NR_PAGES_SCANNED, -nr_scanned);
 
+        if (unlikely(has_isolate_pageblock(zone) ||
+                is_migrate_isolate(migratetype))) {
+                migratetype = get_pfnblock_migratetype(page, pfn);
+        }
         __free_one_page(page, pfn, zone, order, migratetype);
-        if (unlikely(!is_migrate_isolate(migratetype)))
-                __mod_zone_freepage_state(zone, 1 << order, migratetype);
         spin_unlock(&zone->lock);
 }
 
@@ -1484,7 +1475,7 @@ void split_page(struct page *page, unsigned int order)
 }
 EXPORT_SYMBOL_GPL(split_page);
 
-static int __isolate_free_page(struct page *page, unsigned int order)
+int __isolate_free_page(struct page *page, unsigned int order)
 {
         unsigned long watermark;
         struct zone *zone;
@@ -6408,13 +6399,12 @@ int alloc_contig_range(unsigned long start, unsigned long end,
 
         /* Make sure the range is really isolated. */
         if (test_pages_isolated(outer_start, end, false)) {
-                pr_warn("alloc_contig_range test_pages_isolated(%lx, %lx) failed\n",
-                       outer_start, end);
+                pr_info("%s: [%lx, %lx) PFNs busy\n",
+                        __func__, outer_start, end);
                 ret = -EBUSY;
                 goto done;
         }
 
-
         /* Grab isolated pages from freelists. */
         outer_end = isolate_freepages_range(&cc, outer_start, end);
         if (!outer_end) {
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index d1473b2e9481..c8778f7e208e 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -60,6 +60,7 @@ out:
                 int migratetype = get_pageblock_migratetype(page);
 
                 set_pageblock_migratetype(page, MIGRATE_ISOLATE);
+                zone->nr_isolate_pageblock++;
                 nr_pages = move_freepages_block(zone, page, MIGRATE_ISOLATE);
 
                 __mod_zone_freepage_state(zone, -nr_pages, migratetype);
@@ -75,16 +76,54 @@ void unset_migratetype_isolate(struct page *page, unsigned migratetype)
 {
         struct zone *zone;
         unsigned long flags, nr_pages;
+        struct page *isolated_page = NULL;
+        unsigned int order;
+        unsigned long page_idx, buddy_idx;
+        struct page *buddy;
 
         zone = page_zone(page);
         spin_lock_irqsave(&zone->lock, flags);
         if (get_pageblock_migratetype(page) != MIGRATE_ISOLATE)
                 goto out;
-        nr_pages = move_freepages_block(zone, page, migratetype);
-        __mod_zone_freepage_state(zone, nr_pages, migratetype);
+
+        /*
+         * Because freepage with more than pageblock_order on isolated
+         * pageblock is restricted to merge due to freepage counting problem,
+         * it is possible that there is free buddy page.
+         * move_freepages_block() doesn't care of merge so we need other
+         * approach in order to merge them. Isolation and free will make
+         * these pages to be merged.
+         */
+        if (PageBuddy(page)) {
+                order = page_order(page);
+                if (order >= pageblock_order) {
+                        page_idx = page_to_pfn(page) & ((1 << MAX_ORDER) - 1);
+                        buddy_idx = __find_buddy_index(page_idx, order);
+                        buddy = page + (buddy_idx - page_idx);
+
+                        if (!is_migrate_isolate_page(buddy)) {
+                                __isolate_free_page(page, order);
+                                set_page_refcounted(page);
+                                isolated_page = page;
+                        }
+                }
+        }
+
+        /*
+         * If we isolate freepage with more than pageblock_order, there
+         * should be no freepage in the range, so we could avoid costly
+         * pageblock scanning for freepage moving.
+         */
+        if (!isolated_page) {
+                nr_pages = move_freepages_block(zone, page, migratetype);
+                __mod_zone_freepage_state(zone, nr_pages, migratetype);
+        }
         set_pageblock_migratetype(page, migratetype);
+        zone->nr_isolate_pageblock--;
 out:
         spin_unlock_irqrestore(&zone->lock, flags);
+        if (isolated_page)
+                __free_pages(isolated_page, order);
 }
 
 static inline struct page *
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 406944207b61..dcdab81bd240 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -259,6 +259,10 @@ struct kmem_cache *find_mergeable(size_t size, size_t align,
                 if (s->size - size >= sizeof(void *))
                         continue;
 
+                if (IS_ENABLED(CONFIG_SLAB) && align &&
+                        (align > s->align || s->align % align))
+                        continue;
+
                 return s;
         }
         return NULL;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 648d79ccf462..c465876c7861 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -813,10 +813,9 @@ static void __br_multicast_send_query(struct net_bridge *br,
                 return;
 
         if (port) {
-                __skb_push(skb, sizeof(struct ethhdr));
                 skb->dev = port->dev;
                 NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
-                        dev_queue_xmit);
+                        br_dev_queue_push_xmit);
         } else {
                 br_multicast_select_own_querier(br, ip, skb);
                 netif_rx(skb);
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 2ff9706647f2..e5ec470b851f 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -280,6 +280,7 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = {
         [IFLA_BRPORT_MODE]      = { .type = NLA_U8 },
         [IFLA_BRPORT_GUARD]     = { .type = NLA_U8 },
         [IFLA_BRPORT_PROTECT]   = { .type = NLA_U8 },
+        [IFLA_BRPORT_FAST_LEAVE]= { .type = NLA_U8 },
         [IFLA_BRPORT_LEARNING]  = { .type = NLA_U8 },
         [IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 },
 };
diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index 654c9018e3e7..48da2c54a69e 100644
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -18,6 +18,7 @@
 #include <net/netfilter/ipv6/nf_reject.h>
 #include <linux/ip.h>
 #include <net/ip.h>
+#include <net/ip6_checksum.h>
 #include <linux/netfilter_bridge.h>
 #include "../br_private.h"
 
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index 62fc5e7a9acf..790fe89d90c0 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -90,11 +90,82 @@ static struct crypto_blkcipher *ceph_crypto_alloc_cipher(void)
 
 static const u8 *aes_iv = (u8 *)CEPH_AES_IV;
 
+/*
+ * Should be used for buffers allocated with ceph_kvmalloc().
+ * Currently these are encrypt out-buffer (ceph_buffer) and decrypt
+ * in-buffer (msg front).
+ *
+ * Dispose of @sgt with teardown_sgtable().
+ *
+ * @prealloc_sg is to avoid memory allocation inside sg_alloc_table()
+ * in cases where a single sg is sufficient.  No attempt to reduce the
+ * number of sgs by squeezing physically contiguous pages together is
+ * made though, for simplicity.
+ */
+static int setup_sgtable(struct sg_table *sgt, struct scatterlist *prealloc_sg,
+                         const void *buf, unsigned int buf_len)
+{
+        struct scatterlist *sg;
+        const bool is_vmalloc = is_vmalloc_addr(buf);
+        unsigned int off = offset_in_page(buf);
+        unsigned int chunk_cnt = 1;
+        unsigned int chunk_len = PAGE_ALIGN(off + buf_len);
+        int i;
+        int ret;
+
+        if (buf_len == 0) {
+                memset(sgt, 0, sizeof(*sgt));
+                return -EINVAL;
+        }
+
+        if (is_vmalloc) {
+                chunk_cnt = chunk_len >> PAGE_SHIFT;
+                chunk_len = PAGE_SIZE;
+        }
+
+        if (chunk_cnt > 1) {
+                ret = sg_alloc_table(sgt, chunk_cnt, GFP_NOFS);
+                if (ret)
+                        return ret;
+        } else {
+                WARN_ON(chunk_cnt != 1);
+                sg_init_table(prealloc_sg, 1);
+                sgt->sgl = prealloc_sg;
+                sgt->nents = sgt->orig_nents = 1;
+        }
+
+        for_each_sg(sgt->sgl, sg, sgt->orig_nents, i) {
+                struct page *page;
+                unsigned int len = min(chunk_len - off, buf_len);
+
+                if (is_vmalloc)
+                        page = vmalloc_to_page(buf);
+                else
+                        page = virt_to_page(buf);
+
+                sg_set_page(sg, page, len, off);
+
+                off = 0;
+                buf += len;
+                buf_len -= len;
+        }
+        WARN_ON(buf_len != 0);
+
+        return 0;
+}
+
+static void teardown_sgtable(struct sg_table *sgt)
+{
+        if (sgt->orig_nents > 1)
+                sg_free_table(sgt);
+}
+
 static int ceph_aes_encrypt(const void *key, int key_len,
                             void *dst, size_t *dst_len,
                             const void *src, size_t src_len)
 {
-        struct scatterlist sg_in[2], sg_out[1];
+        struct scatterlist sg_in[2], prealloc_sg;
+        struct sg_table sg_out;
         struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
         struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
         int ret;
@@ -110,16 +181,18 @@ static int ceph_aes_encrypt(const void *key, int key_len,
 
         *dst_len = src_len + zero_padding;
 
-        crypto_blkcipher_setkey((void *)tfm, key, key_len);
         sg_init_table(sg_in, 2);
         sg_set_buf(&sg_in[0], src, src_len);
         sg_set_buf(&sg_in[1], pad, zero_padding);
-        sg_init_table(sg_out, 1);
-        sg_set_buf(sg_out, dst, *dst_len);
+        ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len);
+        if (ret)
+                goto out_tfm;
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
         iv = crypto_blkcipher_crt(tfm)->iv;
         ivsize = crypto_blkcipher_ivsize(tfm);
-
         memcpy(iv, aes_iv, ivsize);
+
         /*
         print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1,
                        key, key_len, 1);
@@ -128,16 +201,22 @@ static int ceph_aes_encrypt(const void *key, int key_len,
         print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1,
                         pad, zero_padding, 1);
         */
-        ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
+        ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in,
                                      src_len + zero_padding);
-        crypto_free_blkcipher(tfm);
-        if (ret < 0)
+        if (ret < 0) {
                 pr_err("ceph_aes_crypt failed %d\n", ret);
+                goto out_sg;
+        }
         /*
         print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1,
                        dst, *dst_len, 1);
         */
-        return 0;
+
+out_sg:
+        teardown_sgtable(&sg_out);
+out_tfm:
+        crypto_free_blkcipher(tfm);
+        return ret;
 }
 
 static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
@@ -145,7 +224,8 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
                              const void *src1, size_t src1_len,
                              const void *src2, size_t src2_len)
 {
-        struct scatterlist sg_in[3], sg_out[1];
+        struct scatterlist sg_in[3], prealloc_sg;
+        struct sg_table sg_out;
         struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
         struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
         int ret;
@@ -161,17 +241,19 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
 
         *dst_len = src1_len + src2_len + zero_padding;
 
-        crypto_blkcipher_setkey((void *)tfm, key, key_len);
         sg_init_table(sg_in, 3);
         sg_set_buf(&sg_in[0], src1, src1_len);
         sg_set_buf(&sg_in[1], src2, src2_len);
         sg_set_buf(&sg_in[2], pad, zero_padding);
-        sg_init_table(sg_out, 1);
-        sg_set_buf(sg_out, dst, *dst_len);
+        ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len);
+        if (ret)
+                goto out_tfm;
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
         iv = crypto_blkcipher_crt(tfm)->iv;
         ivsize = crypto_blkcipher_ivsize(tfm);
-
         memcpy(iv, aes_iv, ivsize);
+
         /*
         print_hex_dump(KERN_ERR, "enc  key: ", DUMP_PREFIX_NONE, 16, 1,
                        key, key_len, 1);
@@ -182,23 +264,30 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
         print_hex_dump(KERN_ERR, "enc  pad: ", DUMP_PREFIX_NONE, 16, 1,
                         pad, zero_padding, 1);
         */
-        ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
+        ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in,
                                      src1_len + src2_len + zero_padding);
-        crypto_free_blkcipher(tfm);
-        if (ret < 0)
+        if (ret < 0) {
                 pr_err("ceph_aes_crypt2 failed %d\n", ret);
+                goto out_sg;
+        }
         /*
         print_hex_dump(KERN_ERR, "enc  out: ", DUMP_PREFIX_NONE, 16, 1,
                        dst, *dst_len, 1);
         */
-        return 0;
+
+out_sg:
+        teardown_sgtable(&sg_out);
+out_tfm:
+        crypto_free_blkcipher(tfm);
+        return ret;
 }
 
 static int ceph_aes_decrypt(const void *key, int key_len,
                             void *dst, size_t *dst_len,
                             const void *src, size_t src_len)
 {
-        struct scatterlist sg_in[1], sg_out[2];
+        struct sg_table sg_in;
+        struct scatterlist sg_out[2], prealloc_sg;
         struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
         struct blkcipher_desc desc = { .tfm = tfm };
         char pad[16];
@@ -210,16 +299,16 @@ static int ceph_aes_decrypt(const void *key, int key_len,
         if (IS_ERR(tfm))
                 return PTR_ERR(tfm);
 
-        crypto_blkcipher_setkey((void *)tfm, key, key_len);
-        sg_init_table(sg_in, 1);
         sg_init_table(sg_out, 2);
-        sg_set_buf(sg_in, src, src_len);
         sg_set_buf(&sg_out[0], dst, *dst_len);
         sg_set_buf(&sg_out[1], pad, sizeof(pad));
+        ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len);
+        if (ret)
+                goto out_tfm;
 
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
         iv = crypto_blkcipher_crt(tfm)->iv;
         ivsize = crypto_blkcipher_ivsize(tfm);
-
         memcpy(iv, aes_iv, ivsize);
 
         /*
@@ -228,12 +317,10 @@ static int ceph_aes_decrypt(const void *key, int key_len,
         print_hex_dump(KERN_ERR, "dec  in: ", DUMP_PREFIX_NONE, 16, 1,
                        src, src_len, 1);
         */
-
-        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
-        crypto_free_blkcipher(tfm);
+        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len);
         if (ret < 0) {
                 pr_err("ceph_aes_decrypt failed %d\n", ret);
-                return ret;
+                goto out_sg;
         }
 
         if (src_len <= *dst_len)
@@ -251,7 +338,12 @@ static int ceph_aes_decrypt(const void *key, int key_len,
         print_hex_dump(KERN_ERR, "dec out: ", DUMP_PREFIX_NONE, 16, 1,
                        dst, *dst_len, 1);
         */
-        return 0;
+
+out_sg:
+        teardown_sgtable(&sg_in);
+out_tfm:
+        crypto_free_blkcipher(tfm);
+        return ret;
 }
 
 static int ceph_aes_decrypt2(const void *key, int key_len,
@@ -259,7 +351,8 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
                              void *dst2, size_t *dst2_len,
                              const void *src, size_t src_len)
 {
-        struct scatterlist sg_in[1], sg_out[3];
+        struct sg_table sg_in;
+        struct scatterlist sg_out[3], prealloc_sg;
         struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
         struct blkcipher_desc desc = { .tfm = tfm };
         char pad[16];
@@ -271,17 +364,17 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
         if (IS_ERR(tfm))
                 return PTR_ERR(tfm);
 
-        sg_init_table(sg_in, 1);
-        sg_set_buf(sg_in, src, src_len);
         sg_init_table(sg_out, 3);
         sg_set_buf(&sg_out[0], dst1, *dst1_len);
         sg_set_buf(&sg_out[1], dst2, *dst2_len);
         sg_set_buf(&sg_out[2], pad, sizeof(pad));
+        ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len);
+        if (ret)
+                goto out_tfm;
 
         crypto_blkcipher_setkey((void *)tfm, key, key_len);
         iv = crypto_blkcipher_crt(tfm)->iv;
         ivsize = crypto_blkcipher_ivsize(tfm);
-
         memcpy(iv, aes_iv, ivsize);
 
         /*
@@ -290,12 +383,10 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
         print_hex_dump(KERN_ERR, "dec   in: ", DUMP_PREFIX_NONE, 16, 1,
                        src, src_len, 1);
         */
-
-        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
-        crypto_free_blkcipher(tfm);
+        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len);
         if (ret < 0) {
                 pr_err("ceph_aes_decrypt failed %d\n", ret);
-                return ret;
+                goto out_sg;
         }
 
         if (src_len <= *dst1_len)
@@ -325,7 +416,11 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
                        dst2, *dst2_len, 1);
         */
 
-        return 0;
+out_sg:
+        teardown_sgtable(&sg_in);
+out_tfm:
+        crypto_free_blkcipher(tfm);
+        return ret;
 }
 
 
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index f3fc54eac09d..6f164289bde8 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1007,8 +1007,8 @@ static void put_osd(struct ceph_osd *osd)
 static void __remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
 {
         dout("__remove_osd %p\n", osd);
-        BUG_ON(!list_empty(&osd->o_requests));
-        BUG_ON(!list_empty(&osd->o_linger_requests));
+        WARN_ON(!list_empty(&osd->o_requests));
+        WARN_ON(!list_empty(&osd->o_linger_requests));
 
         rb_erase(&osd->o_node, &osdc->osds);
         list_del_init(&osd->o_osd_lru);
@@ -1254,6 +1254,8 @@ static void __unregister_linger_request(struct ceph_osd_client *osdc,
                 if (list_empty(&req->r_osd_item))
                         req->r_osd = NULL;
         }
+
+        list_del_init(&req->r_req_lru_item); /* can be on notarget */
         ceph_osdc_put_request(req);
 }
 
@@ -1395,6 +1397,7 @@ static int __map_request(struct ceph_osd_client *osdc,
         if (req->r_osd) {
                 __cancel_request(req);
                 list_del_init(&req->r_osd_item);
+                list_del_init(&req->r_linger_osd_item);
                 req->r_osd = NULL;
         }
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a6882686ca3a..b9b7dfaf202b 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2685,13 +2685,20 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
         int idx = 0;
         u32 portid = NETLINK_CB(cb->skb).portid;
         u32 seq = cb->nlh->nlmsg_seq;
-        struct nlattr *extfilt;
         u32 filter_mask = 0;
 
-        extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct ifinfomsg),
-                                  IFLA_EXT_MASK);
-        if (extfilt)
-                filter_mask = nla_get_u32(extfilt);
+        if (nlmsg_len(cb->nlh) > sizeof(struct ifinfomsg)) {
+                struct nlattr *extfilt;
+
+                extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct ifinfomsg),
+                                          IFLA_EXT_MASK);
+                if (extfilt) {
+                        if (nla_len(extfilt) < sizeof(filter_mask))
+                                return -EINVAL;
+
+                        filter_mask = nla_get_u32(extfilt);
+                }
+        }
 
         rcu_read_lock();
         for_each_netdev_rcu(net, dev) {
@@ -2798,6 +2805,9 @@ static int rtnl_bridge_setlink(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (br_spec) {
                 nla_for_each_nested(attr, br_spec, rem) {
                         if (nla_type(attr) == IFLA_BRIDGE_FLAGS) {
+                                if (nla_len(attr) < sizeof(flags))
+                                        return -EINVAL;
+
                                 have_flags = true;
                                 flags = nla_get_u16(attr);
                                 break;
@@ -2868,6 +2878,9 @@ static int rtnl_bridge_dellink(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (br_spec) {
                 nla_for_each_nested(attr, br_spec, rem) {
                         if (nla_type(attr) == IFLA_BRIDGE_FLAGS) {
+                                if (nla_len(attr) < sizeof(flags))
+                                        return -EINVAL;
+
                                 have_flags = true;
                                 flags = nla_get_u16(attr);
                                 break;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c16615bfb61e..32e31c299631 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -552,20 +552,13 @@ static void kfree_skbmem(struct sk_buff *skb)
         case SKB_FCLONE_CLONE:
                 fclones = container_of(skb, struct sk_buff_fclones, skb2);
 
-                /* Warning : We must perform the atomic_dec_and_test() before
-                 * setting skb->fclone back to SKB_FCLONE_FREE, otherwise
-                 * skb_clone() could set clone_ref to 2 before our decrement.
-                 * Anyway, if we are going to free the structure, no need to
-                 * rewrite skb->fclone.
+                /* The clone portion is available for
+                 * fast-cloning again.
                  */
-                if (atomic_dec_and_test(&fclones->fclone_ref)) {
+                skb->fclone = SKB_FCLONE_FREE;
+
+                if (atomic_dec_and_test(&fclones->fclone_ref))
                         kmem_cache_free(skbuff_fclone_cache, fclones);
-                } else {
-                        /* The clone portion is available for
-                         * fast-cloning again.
-                         */
-                        skb->fclone = SKB_FCLONE_FREE;
-                }
                 break;
         }
 }
@@ -887,11 +880,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         if (skb->fclone == SKB_FCLONE_ORIG &&
             n->fclone == SKB_FCLONE_FREE) {
                 n->fclone = SKB_FCLONE_CLONE;
-                /* As our fastclone was free, clone_ref must be 1 at this point.
-                 * We could use atomic_inc() here, but it is faster
-                 * to set the final value.
-                 */
-                atomic_set(&fclones->fclone_ref, 2);
+                atomic_inc(&fclones->fclone_ref);
         } else {
                 if (skb_pfmemalloc(skb))
                         gfp_mask |= __GFP_MEMALLOC;
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index ca11d283bbeb..93ea80196f0e 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -1080,13 +1080,13 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
         if (!app)
                 return -EMSGSIZE;
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         list_for_each_entry(itr, &dcb_app_list, list) {
                 if (itr->ifindex == netdev->ifindex) {
                         err = nla_put(skb, DCB_ATTR_IEEE_APP, sizeof(itr->app),
                                          &itr->app);
                         if (err) {
-                                spin_unlock(&dcb_lock);
+                                spin_unlock_bh(&dcb_lock);
                                 return -EMSGSIZE;
                         }
                 }
@@ -1097,7 +1097,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
         else
                 dcbx = -EOPNOTSUPP;
 
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
         nla_nest_end(skb, app);
 
         /* get peer info if available */
@@ -1234,7 +1234,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
         }
 
         /* local app */
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         app = nla_nest_start(skb, DCB_ATTR_CEE_APP_TABLE);
         if (!app)
                 goto dcb_unlock;
@@ -1271,7 +1271,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
         else
                 dcbx = -EOPNOTSUPP;
 
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
 
         /* features flags */
         if (ops->getfeatcfg) {
@@ -1326,7 +1326,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
         return 0;
 
 dcb_unlock:
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
 nla_put_failure:
         return err;
 }
@@ -1762,10 +1762,10 @@ u8 dcb_getapp(struct net_device *dev, struct dcb_app *app)
         struct dcb_app_type *itr;
         u8 prio = 0;
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         if ((itr = dcb_app_lookup(app, dev->ifindex, 0)))
                 prio = itr->app.priority;
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
 
         return prio;
 }
@@ -1789,7 +1789,7 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new)
         if (dev->dcbnl_ops->getdcbx)
                 event.dcbx = dev->dcbnl_ops->getdcbx(dev);
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         /* Search for existing match and replace */
         if ((itr = dcb_app_lookup(new, dev->ifindex, 0))) {
                 if (new->priority)
@@ -1804,7 +1804,7 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new)
         if (new->priority)
                 err = dcb_app_add(new, dev->ifindex);
 out:
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
         if (!err)
                 call_dcbevent_notifiers(DCB_APP_EVENT, &event);
         return err;
@@ -1823,10 +1823,10 @@ u8 dcb_ieee_getapp_mask(struct net_device *dev, struct dcb_app *app)
         struct dcb_app_type *itr;
         u8 prio = 0;
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         if ((itr = dcb_app_lookup(app, dev->ifindex, 0)))
                 prio |= 1 << itr->app.priority;
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
 
         return prio;
 }
@@ -1850,7 +1850,7 @@ int dcb_ieee_setapp(struct net_device *dev, struct dcb_app *new)
         if (dev->dcbnl_ops->getdcbx)
                 event.dcbx = dev->dcbnl_ops->getdcbx(dev);
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         /* Search for existing match and abort if found */
         if (dcb_app_lookup(new, dev->ifindex, new->priority)) {
                 err = -EEXIST;
@@ -1859,7 +1859,7 @@ int dcb_ieee_setapp(struct net_device *dev, struct dcb_app *new)
 
         err = dcb_app_add(new, dev->ifindex);
 out:
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
         if (!err)
                 call_dcbevent_notifiers(DCB_APP_EVENT, &event);
         return err;
@@ -1882,7 +1882,7 @@ int dcb_ieee_delapp(struct net_device *dev, struct dcb_app *del)
         if (dev->dcbnl_ops->getdcbx)
                 event.dcbx = dev->dcbnl_ops->getdcbx(dev);
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         /* Search for existing match and remove it. */
         if ((itr = dcb_app_lookup(del, dev->ifindex, del->priority))) {
                 list_del(&itr->list);
@@ -1890,7 +1890,7 @@ int dcb_ieee_delapp(struct net_device *dev, struct dcb_app *del)
                 err = 0;
         }
 
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
         if (!err)
                 call_dcbevent_notifiers(DCB_APP_EVENT, &event);
         return err;
@@ -1902,12 +1902,12 @@ static void dcb_flushapp(void)
         struct dcb_app_type *app;
         struct dcb_app_type *tmp;
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         list_for_each_entry_safe(app, tmp, &dcb_app_list, list) {
                 list_del(&app->list);
                 kfree(app);
         }
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
 }
 
 static int __init dcbnl_init(void)
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 6d1817449c36..ab03e00ffe8f 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -489,11 +489,14 @@ static void dsa_slave_phy_setup(struct dsa_slave_priv *p,
         /* We could not connect to a designated PHY, so use the switch internal
          * MDIO bus instead
          */
-        if (!p->phy)
+        if (!p->phy) {
                 p->phy = ds->slave_mii_bus->phy_map[p->port];
-        else
+                phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link,
+                                   p->phy_interface);
+        } else {
                 pr_info("attached PHY at address %d [%s]\n",
                         p->phy->addr, p->phy->drv->name);
+        }
 }
 
 int dsa_slave_suspend(struct net_device *slave_dev)
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 8b7fe5b03906..e67da4e6c324 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1386,6 +1386,17 @@ out:
         return pp;
 }
 
+int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
+{
+        if (sk->sk_family == AF_INET)
+                return ip_recv_error(sk, msg, len, addr_len);
+#if IS_ENABLED(CONFIG_IPV6)
+        if (sk->sk_family == AF_INET6)
+                return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len);
+#endif
+        return -EINVAL;
+}
+
 static int inet_gro_complete(struct sk_buff *skb, int nhoff)
 {
         __be16 newlen = htons(skb->len - nhoff);
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index f2e15738534d..8f7bd56955b0 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -62,6 +62,10 @@ int __fib_lookup(struct net *net, struct flowi4 *flp, struct fib_result *res)
         else
                 res->tclassid = 0;
 #endif
+
+        if (err == -ESRCH)
+                err = -ENETUNREACH;
+
         return err;
 }
 EXPORT_SYMBOL_GPL(__fib_lookup);
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 32e78924e246..606c520ffd5a 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -133,6 +133,8 @@ static int fou_gro_complete(struct sk_buff *skb, int nhoff)
         int err = -ENOSYS;
         const struct net_offload **offloads;
 
+        udp_tunnel_gro_complete(skb, nhoff);
+
         rcu_read_lock();
         offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
         ops = rcu_dereference(offloads[proto]);
diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c
index 065cd94c640c..dedb21e99914 100644
--- a/net/ipv4/geneve.c
+++ b/net/ipv4/geneve.c
@@ -144,6 +144,8 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
         gnvh = (struct genevehdr *)__skb_push(skb, sizeof(*gnvh) + opt_len);
         geneve_build_header(gnvh, tun_flags, vni, opt_len, opt);
 
+        skb_set_inner_protocol(skb, htons(ETH_P_TEB));
+
         return udp_tunnel_xmit_skb(gs->sock, rt, skb, src, dst,
                                    tos, ttl, df, src_port, dst_port, xnet);
 }
@@ -364,6 +366,7 @@ late_initcall(geneve_init_module);
 static void __exit geneve_cleanup_module(void)
 {
         destroy_workqueue(geneve_wq);
+        unregister_pernet_subsys(&geneve_net_ops);
 }
 module_exit(geneve_cleanup_module);
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index fb70e3ecc3e4..bb15d0e03d4f 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -318,9 +318,7 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
         return scount;
 }
 
-#define igmp_skb_size(skb) (*(unsigned int *)((skb)->cb))
-
-static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
+static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
 {
         struct sk_buff *skb;
         struct rtable *rt;
@@ -330,6 +328,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         struct flowi4 fl4;
         int hlen = LL_RESERVED_SPACE(dev);
         int tlen = dev->needed_tailroom;
+        unsigned int size = mtu;
 
         while (1) {
                 skb = alloc_skb(size + hlen + tlen,
@@ -341,7 +340,6 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
                         return NULL;
         }
         skb->priority = TC_PRIO_CONTROL;
-        igmp_skb_size(skb) = size;
 
         rt = ip_route_output_ports(net, &fl4, NULL, IGMPV3_ALL_MCR, 0,
                                    0, 0,
@@ -354,6 +352,8 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         skb_dst_set(skb, &rt->dst);
         skb->dev = dev;
 
+        skb->reserved_tailroom = skb_end_offset(skb) -
+                                 min(mtu, skb_end_offset(skb));
         skb_reserve(skb, hlen);
 
         skb_reset_network_header(skb);
@@ -423,8 +423,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
         return skb;
 }
 
-#define AVAILABLE(skb) ((skb) ? ((skb)->dev ? igmp_skb_size(skb) - (skb)->len : \
-        skb_tailroom(skb)) : 0)
+#define AVAILABLE(skb)  ((skb) ? skb_availroom(skb) : 0)
 
 static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
         int type, int gdeleted, int sdeleted)
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index c373a9ad4555..9daf2177dc00 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -195,7 +195,7 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc,
         for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
                 if (!CMSG_OK(msg, cmsg))
                         return -EINVAL;
-#if defined(CONFIG_IPV6)
+#if IS_ENABLED(CONFIG_IPV6)
                 if (allow_ipv6 &&
                     cmsg->cmsg_level == SOL_IPV6 &&
                     cmsg->cmsg_type == IPV6_PKTINFO) {
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 3e861011e4a3..1a7e979e80ba 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -528,6 +528,7 @@ static struct rtnl_link_ops vti_link_ops __read_mostly = {
         .validate       = vti_tunnel_validate,
         .newlink        = vti_newlink,
         .changelink     = vti_changelink,
+        .dellink        = ip_tunnel_dellink,
         .get_size       = vti_get_size,
         .fill_info      = vti_fill_info,
 };
diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
index c1023c445920..665de06561cd 100644
--- a/net/ipv4/netfilter/nft_masq_ipv4.c
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -24,6 +24,7 @@ static void nft_masq_ipv4_eval(const struct nft_expr *expr,
         struct nf_nat_range range;
         unsigned int verdict;
 
+        memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
 
         verdict = nf_nat_masquerade_ipv4(pkt->skb, pkt->ops->hooknum,
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 57f7c9804139..5d740cccf69e 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -217,6 +217,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
                                              &ipv6_hdr(skb)->daddr))
                                 continue;
 #endif
+                } else {
+                        continue;
                 }
 
                 if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif)
@@ -853,16 +855,8 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (flags & MSG_OOB)
                 goto out;
 
-        if (flags & MSG_ERRQUEUE) {
-                if (family == AF_INET) {
-                        return ip_recv_error(sk, msg, len, addr_len);
-#if IS_ENABLED(CONFIG_IPV6)
-                } else if (family == AF_INET6) {
-                        return pingv6_ops.ipv6_recv_error(sk, msg, len,
-                                                          addr_len);
-#endif
-                }
-        }
+        if (flags & MSG_ERRQUEUE)
+                return inet_recv_error(sk, msg, len, addr_len);
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 39ec0c379545..38c2bcb8dd5d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1598,7 +1598,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         u32 urg_hole = 0;
 
         if (unlikely(flags & MSG_ERRQUEUE))
-                return ip_recv_error(sk, msg, len, addr_len);
+                return inet_recv_error(sk, msg, len, addr_len);
 
         if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue) &&
             (sk->sk_state == TCP_ESTABLISHED))
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a12b455928e5..d107ee246a1d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2315,6 +2315,35 @@ static inline bool tcp_packet_delayed(const struct tcp_sock *tp)
 
 /* Undo procedures. */
 
+/* We can clear retrans_stamp when there are no retransmissions in the
+ * window. It would seem that it is trivially available for us in
+ * tp->retrans_out, however, that kind of assumptions doesn't consider
+ * what will happen if errors occur when sending retransmission for the
+ * second time. ...It could the that such segment has only
+ * TCPCB_EVER_RETRANS set at the present time. It seems that checking
+ * the head skb is enough except for some reneging corner cases that
+ * are not worth the effort.
+ *
+ * Main reason for all this complexity is the fact that connection dying
+ * time now depends on the validity of the retrans_stamp, in particular,
+ * that successive retransmissions of a segment must not advance
+ * retrans_stamp under any conditions.
+ */
+static bool tcp_any_retrans_done(const struct sock *sk)
+{
+        const struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb;
+
+        if (tp->retrans_out)
+                return true;
+
+        skb = tcp_write_queue_head(sk);
+        if (unlikely(skb && TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS))
+                return true;
+
+        return false;
+}
+
 #if FASTRETRANS_DEBUG > 1
 static void DBGUNDO(struct sock *sk, const char *msg)
 {
@@ -2410,6 +2439,8 @@ static bool tcp_try_undo_recovery(struct sock *sk)
                  * is ACKed. For Reno it is MUST to prevent false
                  * fast retransmits (RFC2582). SACK TCP is safe. */
                 tcp_moderate_cwnd(tp);
+                if (!tcp_any_retrans_done(sk))
+                        tp->retrans_stamp = 0;
                 return true;
         }
         tcp_set_ca_state(sk, TCP_CA_Open);
@@ -2430,35 +2461,6 @@ static bool tcp_try_undo_dsack(struct sock *sk)
         return false;
 }
 
-/* We can clear retrans_stamp when there are no retransmissions in the
- * window. It would seem that it is trivially available for us in
- * tp->retrans_out, however, that kind of assumptions doesn't consider
- * what will happen if errors occur when sending retransmission for the
- * second time. ...It could the that such segment has only
- * TCPCB_EVER_RETRANS set at the present time. It seems that checking
- * the head skb is enough except for some reneging corner cases that
- * are not worth the effort.
- *
- * Main reason for all this complexity is the fact that connection dying
- * time now depends on the validity of the retrans_stamp, in particular,
- * that successive retransmissions of a segment must not advance
- * retrans_stamp under any conditions.
- */
-static bool tcp_any_retrans_done(const struct sock *sk)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *skb;
-
-        if (tp->retrans_out)
-                return true;
-
-        skb = tcp_write_queue_head(sk);
-        if (unlikely(skb && TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS))
-                return true;
-
-        return false;
-}
-
 /* Undo during loss recovery after partial ACK or using F-RTO. */
 static bool tcp_try_undo_loss(struct sock *sk, bool frto_undo)
 {
@@ -5229,7 +5231,7 @@ slow_path:
         if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb))
                 goto csum_error;
 
-        if (!th->ack && !th->rst)
+        if (!th->ack && !th->rst && !th->syn)
                 goto discard;
 
         /*
@@ -5648,7 +5650,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                         goto discard;
         }
 
-        if (!th->ack && !th->rst)
+        if (!th->ack && !th->rst && !th->syn)
                 goto discard;
 
         if (!tcp_validate_incoming(sk, skb, th, 0))
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 9c7d7621466b..147be2024290 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -598,7 +598,10 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
         if (th->rst)
                 return;
 
-        if (skb_rtable(skb)->rt_type != RTN_LOCAL)
+        /* If sk not NULL, it means we did a successful lookup and incoming
+         * route had to be correct. prequeue might have dropped our dst.
+         */
+        if (!sk && skb_rtable(skb)->rt_type != RTN_LOCAL)
                 return;
 
         /* Swap the send and the receive. */
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 12c3c8ef3849..0e32d2e1bdbf 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -502,11 +502,11 @@ static int ip6gre_rcv(struct sk_buff *skb)
 
                 skb->protocol = gre_proto;
                 /* WCCP version 1 and 2 protocol decoding.
-                 * - Change protocol to IP
+                 * - Change protocol to IPv6
                  * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
                  */
                 if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) {
-                        skb->protocol = htons(ETH_P_IP);
+                        skb->protocol = htons(ETH_P_IPV6);
                         if ((*(h + offset) & 0xF0) != 0x40)
                                 offset += 4;
                 }
@@ -961,8 +961,6 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
         else
                 dev->flags &= ~IFF_POINTOPOINT;
 
-        dev->iflink = p->link;
-
         /* Precalculate GRE options length */
         if (t->parms.o_flags&(GRE_CSUM|GRE_KEY|GRE_SEQ)) {
                 if (t->parms.o_flags&GRE_CSUM)
@@ -1272,6 +1270,7 @@ static int ip6gre_tunnel_init(struct net_device *dev)
                 u64_stats_init(&ip6gre_tunnel_stats->syncp);
         }
 
+        dev->iflink = tunnel->parms.link;
 
         return 0;
 }
@@ -1481,6 +1480,8 @@ static int ip6gre_tap_init(struct net_device *dev)
         if (!dev->tstats)
                 return -ENOMEM;
 
+        dev->iflink = tunnel->parms.link;
+
         return 0;
 }
 
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index a071563a7e6e..01e12d0d8fcc 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -69,7 +69,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         int nhoff;
 
         if (unlikely(skb_shinfo(skb)->gso_type &
-                     ~(SKB_GSO_UDP |
+                     ~(SKB_GSO_TCPV4 |
+                       SKB_GSO_UDP |
                        SKB_GSO_DODGY |
                        SKB_GSO_TCP_ECN |
                        SKB_GSO_GRE |
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 9409887fb664..9cb94cfa0ae7 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -272,9 +272,6 @@ static int ip6_tnl_create2(struct net_device *dev)
         int err;
 
         t = netdev_priv(dev);
-        err = ip6_tnl_dev_init(dev);
-        if (err < 0)
-                goto out;
 
         err = register_netdevice(dev);
         if (err < 0)
@@ -1462,6 +1459,7 @@ ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
 
 
 static const struct net_device_ops ip6_tnl_netdev_ops = {
+        .ndo_init       = ip6_tnl_dev_init,
         .ndo_uninit     = ip6_tnl_dev_uninit,
         .ndo_start_xmit = ip6_tnl_xmit,
         .ndo_do_ioctl   = ip6_tnl_ioctl,
@@ -1546,16 +1544,10 @@ static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
         struct ip6_tnl *t = netdev_priv(dev);
         struct net *net = dev_net(dev);
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        int err = ip6_tnl_dev_init_gen(dev);
-
-        if (err)
-                return err;
 
         t->parms.proto = IPPROTO_IPV6;
         dev_hold(dev);
 
-        ip6_tnl_link_config(t);
-
         rcu_assign_pointer(ip6n->tnls_wc[0], t);
         return 0;
 }
diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
index b04ed72c4542..8db6c98fe218 100644
--- a/net/ipv6/ip6_udp_tunnel.c
+++ b/net/ipv6/ip6_udp_tunnel.c
@@ -79,15 +79,13 @@ int udp_tunnel6_xmit_skb(struct socket *sock, struct dst_entry *dst,
         uh->source = src_port;
 
         uh->len = htons(skb->len);
-        uh->check = 0;
 
         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED
                             | IPSKB_REROUTED);
         skb_dst_set(skb, dst);
 
-        udp6_set_csum(udp_get_no_check6_tx(sk), skb, &inet6_sk(sk)->saddr,
-                      &sk->sk_v6_daddr, skb->len);
+        udp6_set_csum(udp_get_no_check6_tx(sk), skb, saddr, daddr, skb->len);
 
         __skb_push(skb, sizeof(*ip6h));
         skb_reset_network_header(skb);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index d440bb585524..bcda14de7f84 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -172,10 +172,6 @@ static int vti6_tnl_create2(struct net_device *dev)
         struct vti6_net *ip6n = net_generic(net, vti6_net_id);
         int err;
 
-        err = vti6_dev_init(dev);
-        if (err < 0)
-                goto out;
-
         err = register_netdevice(dev);
         if (err < 0)
                 goto out;
@@ -783,6 +779,7 @@ static int vti6_change_mtu(struct net_device *dev, int new_mtu)
 }
 
 static const struct net_device_ops vti6_netdev_ops = {
+        .ndo_init       = vti6_dev_init,
         .ndo_uninit     = vti6_dev_uninit,
         .ndo_start_xmit = vti6_tnl_xmit,
         .ndo_do_ioctl   = vti6_ioctl,
@@ -852,16 +849,10 @@ static int __net_init vti6_fb_tnl_dev_init(struct net_device *dev)
         struct ip6_tnl *t = netdev_priv(dev);
         struct net *net = dev_net(dev);
         struct vti6_net *ip6n = net_generic(net, vti6_net_id);
-        int err = vti6_dev_init_gen(dev);
-
-        if (err)
-                return err;
 
         t->parms.proto = IPPROTO_IPV6;
         dev_hold(dev);
 
-        vti6_link_config(t);
-
         rcu_assign_pointer(ip6n->tnls_wc[0], t);
         return 0;
 }
@@ -914,6 +905,15 @@ static int vti6_newlink(struct net *src_net, struct net_device *dev,
         return vti6_tnl_create2(dev);
 }
 
+static void vti6_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct net *net = dev_net(dev);
+        struct vti6_net *ip6n = net_generic(net, vti6_net_id);
+
+        if (dev != ip6n->fb_tnl_dev)
+                unregister_netdevice_queue(dev, head);
+}
+
 static int vti6_changelink(struct net_device *dev, struct nlattr *tb[],
                            struct nlattr *data[])
 {
@@ -989,6 +989,7 @@ static struct rtnl_link_ops vti6_link_ops __read_mostly = {
         .setup          = vti6_dev_setup,
         .validate       = vti6_validate,
         .newlink        = vti6_newlink,
+        .dellink        = vti6_dellink,
         .changelink     = vti6_changelink,
         .get_size       = vti6_get_size,
         .fill_info      = vti6_fill_info,
@@ -1029,6 +1030,7 @@ static int __net_init vti6_init_net(struct net *net)
         if (!ip6n->fb_tnl_dev)
                 goto err_alloc_dev;
         dev_net_set(ip6n->fb_tnl_dev, net);
+        ip6n->fb_tnl_dev->rtnl_link_ops = &vti6_link_ops;
 
         err = vti6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
         if (err < 0)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 0171f08325c3..1a01d79b8698 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1439,6 +1439,10 @@ reg_pernet_fail:
 
 void ip6_mr_cleanup(void)
 {
+        rtnl_unregister(RTNL_FAMILY_IP6MR, RTM_GETROUTE);
+#ifdef CONFIG_IPV6_PIMSM_V2
+        inet6_del_protocol(&pim6_protocol, IPPROTO_PIM);
+#endif
         unregister_netdevice_notifier(&ip6_mr_notifier);
         unregister_pernet_subsys(&ip6mr_net_ops);
         kmem_cache_destroy(mrt_cachep);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 9648de2b6745..ed2c4e400b46 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1550,7 +1550,7 @@ static void ip6_mc_hdr(struct sock *sk, struct sk_buff *skb,
         hdr->daddr = *daddr;
 }
 
-static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
+static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu)
 {
         struct net_device *dev = idev->dev;
         struct net *net = dev_net(dev);
@@ -1561,13 +1561,13 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
         const struct in6_addr *saddr;
         int hlen = LL_RESERVED_SPACE(dev);
         int tlen = dev->needed_tailroom;
+        unsigned int size = mtu + hlen + tlen;
         int err;
         u8 ra[8] = { IPPROTO_ICMPV6, 0,
                      IPV6_TLV_ROUTERALERT, 2, 0, 0,
                      IPV6_TLV_PADN, 0 };
 
         /* we assume size > sizeof(ra) here */
-        size += hlen + tlen;
         /* limit our allocations to order-0 page */
         size = min_t(int, size, SKB_MAX_ORDER(0, 0));
         skb = sock_alloc_send_skb(sk, size, 1, &err);
@@ -1576,6 +1576,8 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
                 return NULL;
 
         skb->priority = TC_PRIO_CONTROL;
+        skb->reserved_tailroom = skb_end_offset(skb) -
+                                 min(mtu, skb_end_offset(skb));
         skb_reserve(skb, hlen);
 
         if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
@@ -1690,8 +1692,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
         return skb;
 }
 
-#define AVAILABLE(skb) ((skb) ? ((skb)->dev ? (skb)->dev->mtu - (skb)->len : \
-        skb_tailroom(skb)) : 0)
+#define AVAILABLE(skb)  ((skb) ? skb_availroom(skb) : 0)
 
 static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
         int type, int gdeleted, int sdeleted, int crsend)
diff --git a/net/ipv6/netfilter/nft_masq_ipv6.c b/net/ipv6/netfilter/nft_masq_ipv6.c
index 8a7ac685076d..529c119cbb14 100644
--- a/net/ipv6/netfilter/nft_masq_ipv6.c
+++ b/net/ipv6/netfilter/nft_masq_ipv6.c
@@ -25,6 +25,7 @@ static void nft_masq_ipv6_eval(const struct nft_expr *expr,
         struct nf_nat_range range;
         unsigned int verdict;
 
+        memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
 
         verdict = nf_nat_masquerade_ipv6(pkt->skb, &range, pkt->out);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 58e5b4710127..a24557a1c1d8 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -195,10 +195,8 @@ static int ipip6_tunnel_create(struct net_device *dev)
         struct sit_net *sitn = net_generic(net, sit_net_id);
         int err;
 
-        err = ipip6_tunnel_init(dev);
-        if (err < 0)
-                goto out;
-        ipip6_tunnel_clone_6rd(dev, sitn);
+        memcpy(dev->dev_addr, &t->parms.iph.saddr, 4);
+        memcpy(dev->broadcast, &t->parms.iph.daddr, 4);
 
         if ((__force u16)t->parms.i_flags & SIT_ISATAP)
                 dev->priv_flags |= IFF_ISATAP;
@@ -207,7 +205,8 @@ static int ipip6_tunnel_create(struct net_device *dev)
         if (err < 0)
                 goto out;
 
-        strcpy(t->parms.name, dev->name);
+        ipip6_tunnel_clone_6rd(dev, sitn);
+
         dev->rtnl_link_ops = &sit_link_ops;
 
         dev_hold(dev);
@@ -1330,6 +1329,7 @@ static int ipip6_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 }
 
 static const struct net_device_ops ipip6_netdev_ops = {
+        .ndo_init       = ipip6_tunnel_init,
         .ndo_uninit     = ipip6_tunnel_uninit,
         .ndo_start_xmit = sit_tunnel_xmit,
         .ndo_do_ioctl   = ipip6_tunnel_ioctl,
@@ -1378,9 +1378,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
 
         tunnel->dev = dev;
         tunnel->net = dev_net(dev);
-
-        memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
-        memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
+        strcpy(tunnel->parms.name, dev->name);
 
         ipip6_tunnel_bind_dev(dev);
         dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
@@ -1405,7 +1403,6 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
 
         tunnel->dev = dev;
         tunnel->net = dev_net(dev);
-        strcpy(tunnel->parms.name, dev->name);
 
         iph->version            = 4;
         iph->protocol           = IPPROTO_IPV6;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ace29b60813c..dc495ae2ead0 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -903,7 +903,10 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
         if (th->rst)
                 return;
 
-        if (!ipv6_unicast_destination(skb))
+        /* If sk not NULL, it means we did a successful lookup and incoming
+         * route had to be correct. prequeue might have dropped our dst.
+         */
+        if (!sk && !ipv6_unicast_destination(skb))
                 return;
 
 #ifdef CONFIG_TCP_MD5SIG
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 91729b807c7d..1b095ca37aa4 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1764,6 +1764,7 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct ipxhdr *ipx = NULL;
         struct sk_buff *skb;
         int copied, rc;
+        bool locked = true;
 
         lock_sock(sk);
         /* put the autobinding in */
@@ -1790,6 +1791,8 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (sock_flag(sk, SOCK_ZAPPED))
                 goto out;
 
+        release_sock(sk);
+        locked = false;
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &rc);
         if (!skb) {
@@ -1826,7 +1829,8 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
 out_free:
         skb_free_datagram(sk, skb);
 out:
-        release_sock(sk);
+        if (locked)
+                release_sock(sk);
         return rc;
 }
 
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c
index ec24378caaaf..09d9caaec591 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aes_ccm.c
@@ -53,6 +53,9 @@ int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
                 __aligned(__alignof__(struct aead_request));
         struct aead_request *aead_req = (void *) aead_req_data;
 
+        if (data_len == 0)
+                return -EINVAL;
+
         memset(aead_req, 0, sizeof(aead_req_data));
 
         sg_init_one(&pt, data, data_len);
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 56b53571c807..509bc157ce55 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -805,7 +805,7 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 
         memset(&params, 0, sizeof(params));
         memset(&csa_ie, 0, sizeof(csa_ie));
-        err = ieee80211_parse_ch_switch_ie(sdata, elems, beacon,
+        err = ieee80211_parse_ch_switch_ie(sdata, elems,
                                            ifibss->chandef.chan->band,
                                            sta_flags, ifibss->bssid, &csa_ie);
         /* can't switch to destination channel, fail */
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c2aaec4dfcf0..8c68da30595d 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1642,7 +1642,6 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
  * ieee80211_parse_ch_switch_ie - parses channel switch IEs
  * @sdata: the sdata of the interface which has received the frame
  * @elems: parsed 802.11 elements received with the frame
- * @beacon: indicates if the frame was a beacon or probe response
  * @current_band: indicates the current band
  * @sta_flags: contains information about own capabilities and restrictions
  *      to decide which channel switch announcements can be accepted. Only the
@@ -1656,7 +1655,7 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
  * Return: 0 on success, <0 on error and >0 if there is nothing to parse.
  */
 int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
-                                 struct ieee802_11_elems *elems, bool beacon,
+                                 struct ieee802_11_elems *elems,
                                  enum ieee80211_band current_band,
                                  u32 sta_flags, u8 *bssid,
                                  struct ieee80211_csa_ie *csa_ie);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index af237223a8cd..653f5eb07a27 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -766,10 +766,12 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         int i, flushed;
         struct ps_data *ps;
         struct cfg80211_chan_def chandef;
+        bool cancel_scan;
 
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
-        if (rcu_access_pointer(local->scan_sdata) == sdata)
+        cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
+        if (cancel_scan)
                 ieee80211_scan_cancel(local);
 
         /*
@@ -898,6 +900,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 list_del(&sdata->u.vlan.list);
                 mutex_unlock(&local->mtx);
                 RCU_INIT_POINTER(sdata->vif.chanctx_conf, NULL);
+                /* see comment in the default case below */
+                ieee80211_free_keys(sdata, true);
                 /* no need to tell driver */
                 break;
         case NL80211_IFTYPE_MONITOR:
@@ -923,17 +927,16 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 /*
                  * When we get here, the interface is marked down.
                  * Free the remaining keys, if there are any
-                 * (shouldn't be, except maybe in WDS mode?)
+                 * (which can happen in AP mode if userspace sets
+                 * keys before the interface is operating, and maybe
+                 * also in WDS mode)
                  *
                  * Force the key freeing to always synchronize_net()
                  * to wait for the RX path in case it is using this
-                 * interface enqueuing frames * at this very time on
+                 * interface enqueuing frames at this very time on
                  * another CPU.
                  */
                 ieee80211_free_keys(sdata, true);
-
-                /* fall through */
-        case NL80211_IFTYPE_AP:
                 skb_queue_purge(&sdata->skb_queue);
         }
 
@@ -991,6 +994,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_recalc_ps(local, -1);
 
+        if (cancel_scan)
+                flush_delayed_work(&local->scan_work);
+
         if (local->open_count == 0) {
                 ieee80211_stop_device(local);
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index e9f99c1e3fad..0c8b2a77d312 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -874,7 +874,7 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
 
         memset(&params, 0, sizeof(params));
         memset(&csa_ie, 0, sizeof(csa_ie));
-        err = ieee80211_parse_ch_switch_ie(sdata, elems, beacon, band,
+        err = ieee80211_parse_ch_switch_ie(sdata, elems, band,
                                            sta_flags, sdata->vif.addr,
                                            &csa_ie);
         if (err < 0)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 2de88704278b..93af0f1c9d99 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1072,7 +1072,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 
         current_band = cbss->channel->band;
         memset(&csa_ie, 0, sizeof(csa_ie));
-        res = ieee80211_parse_ch_switch_ie(sdata, elems, beacon, current_band,
+        res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
                                            ifmgd->flags,
                                            ifmgd->associated->bssid, &csa_ie);
         if (res < 0)
@@ -1168,7 +1168,8 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                 ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
         else
                 mod_timer(&ifmgd->chswitch_timer,
-                          TU_TO_EXP_TIME(csa_ie.count * cbss->beacon_interval));
+                          TU_TO_EXP_TIME((csa_ie.count - 1) *
+                                         cbss->beacon_interval));
 }
 
 static bool
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index df90ce2db00c..408fd8ab4eef 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -252,19 +252,16 @@ minstrel_ht_sort_best_tp_rates(struct minstrel_ht_sta *mi, u8 index,
         cur_thr = mi->groups[cur_group].rates[cur_idx].cur_tp;
         cur_prob = mi->groups[cur_group].rates[cur_idx].probability;
 
-        tmp_group = tp_list[j - 1] / MCS_GROUP_RATES;
-        tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES;
-        tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp;
-        tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability;
-
-        while (j > 0 && (cur_thr > tmp_thr ||
-              (cur_thr == tmp_thr && cur_prob > tmp_prob))) {
-                j--;
+        do {
                 tmp_group = tp_list[j - 1] / MCS_GROUP_RATES;
                 tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES;
                 tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp;
                 tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability;
-        }
+                if (cur_thr < tmp_thr ||
+                    (cur_thr == tmp_thr && cur_prob <= tmp_prob))
+                        break;
+                j--;
+        } while (j > 0);
 
         if (j < MAX_THR_RATES - 1) {
                 memmove(&tp_list[j + 1], &tp_list[j], (sizeof(*tp_list) *
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index b04ca4049c95..a37f9af634cb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1678,11 +1678,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         sc = le16_to_cpu(hdr->seq_ctrl);
         frag = sc & IEEE80211_SCTL_FRAG;
 
-        if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
-                   is_multicast_ether_addr(hdr->addr1))) {
-                /* not fragmented */
+        if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
+                goto out;
+
+        if (is_multicast_ether_addr(hdr->addr1)) {
+                rx->local->dot11MulticastReceivedFrameCount++;
                 goto out;
         }
+
         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
 
         if (skb_linearize(rx->skb))
@@ -1775,10 +1778,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
  out:
         if (rx->sta)
                 rx->sta->rx_packets++;
-        if (is_multicast_ether_addr(hdr->addr1))
-                rx->local->dot11MulticastReceivedFrameCount++;
-        else
-                ieee80211_led_rx(rx->local);
+        ieee80211_led_rx(rx->local);
         return RX_CONTINUE;
 }
 
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index 6ab009070084..efeba56c913b 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -22,7 +22,7 @@
 #include "wme.h"
 
 int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
-                                 struct ieee802_11_elems *elems, bool beacon,
+                                 struct ieee802_11_elems *elems,
                                  enum ieee80211_band current_band,
                                  u32 sta_flags, u8 *bssid,
                                  struct ieee80211_csa_ie *csa_ie)
@@ -91,19 +91,13 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
                 return -EINVAL;
         }
 
-        if (!beacon && sec_chan_offs) {
+        if (sec_chan_offs) {
                 secondary_channel_offset = sec_chan_offs->sec_chan_offs;
-        } else if (beacon && ht_oper) {
-                secondary_channel_offset =
-                        ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
         } else if (!(sta_flags & IEEE80211_STA_DISABLE_HT)) {
-                /* If it's not a beacon, HT is enabled and the IE not present,
-                 * it's 20 MHz, 802.11-2012 8.5.2.6:
-                 *      This element [the Secondary Channel Offset Element] is
-                 *      present when switching to a 40 MHz channel. It may be
-                 *      present when switching to a 20 MHz channel (in which
-                 *      case the secondary channel offset is set to SCN).
-                 */
+                /* If the secondary channel offset IE is not present,
+                 * we can't know what's the post-CSA offset, so the
+                 * best we can do is use 20MHz.
+                */
                 secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
         }
 
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 86f9d76b1464..d259da3ce67a 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1863,6 +1863,12 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
         if (*op < IP_SET_OP_VERSION) {
                 /* Check the version at the beginning of operations */
                 struct ip_set_req_version *req_version = data;
+
+                if (*len < sizeof(struct ip_set_req_version)) {
+                        ret = -EINVAL;
+                        goto done;
+                }
+
                 if (req_version->version != IPSET_PROTOCOL) {
                         ret = -EPROTO;
                         goto done;
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 437a3663ad03..bd90bf8107da 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -846,6 +846,8 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
                 new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb)
                         goto error;
+                if (skb->sk)
+                        skb_set_owner_w(new_skb, skb->sk);
                 consume_skb(skb);
                 skb = new_skb;
         }
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 11ab4b078f3b..66e8425dbfe7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3484,13 +3484,8 @@ static void nft_chain_commit_update(struct nft_trans *trans)
         }
 }
 
-/* Schedule objects for release via rcu to make sure no packets are accesing
- * removed rules.
- */
-static void nf_tables_commit_release_rcu(struct rcu_head *rt)
+static void nf_tables_commit_release(struct nft_trans *trans)
 {
-        struct nft_trans *trans = container_of(rt, struct nft_trans, rcu_head);
-
         switch (trans->msg_type) {
         case NFT_MSG_DELTABLE:
                 nf_tables_table_destroy(&trans->ctx);
@@ -3612,10 +3607,11 @@ static int nf_tables_commit(struct sk_buff *skb)
                 }
         }
 
+        synchronize_rcu();
+
         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
                 list_del(&trans->list);
-                trans->ctx.nla = NULL;
-                call_rcu(&trans->rcu_head, nf_tables_commit_release_rcu);
+                nf_tables_commit_release(trans);
         }
 
         nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
@@ -3623,13 +3619,8 @@ static int nf_tables_commit(struct sk_buff *skb)
         return 0;
 }
 
-/* Schedule objects for release via rcu to make sure no packets are accesing
- * aborted rules.
- */
-static void nf_tables_abort_release_rcu(struct rcu_head *rt)
+static void nf_tables_abort_release(struct nft_trans *trans)
 {
-        struct nft_trans *trans = container_of(rt, struct nft_trans, rcu_head);
-
         switch (trans->msg_type) {
         case NFT_MSG_NEWTABLE:
                 nf_tables_table_destroy(&trans->ctx);
@@ -3725,11 +3716,12 @@ static int nf_tables_abort(struct sk_buff *skb)
                 }
         }
 
+        synchronize_rcu();
+
         list_for_each_entry_safe_reverse(trans, next,
                                          &net->nft.commit_list, list) {
                 list_del(&trans->list);
-                trans->ctx.nla = NULL;
-                call_rcu(&trans->rcu_head, nf_tables_abort_release_rcu);
+                nf_tables_abort_release(trans);
         }
 
         return 0;
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 6c5a915cfa75..13c2e17bbe27 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -47,6 +47,8 @@ static const int nfnl_group2type[NFNLGRP_MAX+1] = {
         [NFNLGRP_CONNTRACK_EXP_NEW]     = NFNL_SUBSYS_CTNETLINK_EXP,
         [NFNLGRP_CONNTRACK_EXP_UPDATE]  = NFNL_SUBSYS_CTNETLINK_EXP,
         [NFNLGRP_CONNTRACK_EXP_DESTROY] = NFNL_SUBSYS_CTNETLINK_EXP,
+        [NFNLGRP_NFTABLES]              = NFNL_SUBSYS_NFTABLES,
+        [NFNLGRP_ACCT_QUOTA]            = NFNL_SUBSYS_ACCT,
 };
 
 void nfnl_lock(__u8 subsys_id)
@@ -464,7 +466,12 @@ static void nfnetlink_rcv(struct sk_buff *skb)
 static int nfnetlink_bind(int group)
 {
         const struct nfnetlink_subsystem *ss;
-        int type = nfnl_group2type[group];
+        int type;
+
+        if (group <= NFNLGRP_NONE || group > NFNLGRP_MAX)
+                return -EINVAL;
+
+        type = nfnl_group2type[group];
 
         rcu_read_lock();
         ss = nfnetlink_get_subsys(type);
@@ -514,6 +521,9 @@ static int __init nfnetlink_init(void)
 {
         int i;
 
+        for (i = NFNLGRP_NONE + 1; i <= NFNLGRP_MAX; i++)
+                BUG_ON(nfnl_group2type[i] == NFNL_SUBSYS_NONE);
+
         for (i=0; i<NFNL_SUBSYS_COUNT; i++)
                 mutex_init(&table[i].mutex);
 
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 9d6d6f60a80f..265e190f2218 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -21,45 +21,17 @@
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <net/netfilter/nf_tables.h>
 
-static const struct {
-       const char       *name;
-       u8               type;
-} table_to_chaintype[] = {
-       { "filter",     NFT_CHAIN_T_DEFAULT },
-       { "raw",        NFT_CHAIN_T_DEFAULT },
-       { "security",   NFT_CHAIN_T_DEFAULT },
-       { "mangle",     NFT_CHAIN_T_ROUTE },
-       { "nat",        NFT_CHAIN_T_NAT },
-       { },
-};
-
-static int nft_compat_table_to_chaintype(const char *table)
-{
-        int i;
-
-        for (i = 0; table_to_chaintype[i].name != NULL; i++) {
-                if (strcmp(table_to_chaintype[i].name, table) == 0)
-                        return table_to_chaintype[i].type;
-        }
-
-        return -1;
-}
-
 static int nft_compat_chain_validate_dependency(const char *tablename,
                                                 const struct nft_chain *chain)
 {
-        enum nft_chain_type type;
         const struct nft_base_chain *basechain;
 
         if (!tablename || !(chain->flags & NFT_BASE_CHAIN))
                 return 0;
 
-        type = nft_compat_table_to_chaintype(tablename);
-        if (type < 0)
-                return -EINVAL;
-
         basechain = nft_base_chain(chain);
-        if (basechain->type->type != type)
+        if (strcmp(tablename, "nat") == 0 &&
+            basechain->type->type != NFT_CHAIN_T_NAT)
                 return -EINVAL;
 
         return 0;
@@ -117,7 +89,7 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                            struct xt_target *target, void *info,
                            union nft_entry *entry, u8 proto, bool inv)
 {
-        par->net        = &init_net;
+        par->net        = ctx->net;
         par->table      = ctx->table->name;
         switch (ctx->afi->family) {
         case AF_INET:
@@ -324,7 +296,7 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                           struct xt_match *match, void *info,
                           union nft_entry *entry, u8 proto, bool inv)
 {
-        par->net        = &init_net;
+        par->net        = ctx->net;
         par->table      = ctx->table->name;
         switch (ctx->afi->family) {
         case AF_INET:
@@ -374,7 +346,7 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         union nft_entry e = {};
         int ret;
 
-        ret = nft_compat_chain_validate_dependency(match->name, ctx->chain);
+        ret = nft_compat_chain_validate_dependency(match->table, ctx->chain);
         if (ret < 0)
                 goto err;
 
@@ -448,7 +420,7 @@ static int nft_match_validate(const struct nft_ctx *ctx,
                 if (!(hook_mask & match->hooks))
                         return -EINVAL;
 
-                ret = nft_compat_chain_validate_dependency(match->name,
+                ret = nft_compat_chain_validate_dependency(match->table,
                                                            ctx->chain);
                 if (ret < 0)
                         return ret;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index f1de72de273e..0007b8180397 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1440,7 +1440,7 @@ static void netlink_unbind(int group, long unsigned int groups,
                 return;
 
         for (undo = 0; undo < group; undo++)
-                if (test_bit(group, &groups))
+                if (test_bit(undo, &groups))
                         nlk->netlink_unbind(undo);
 }
 
@@ -1492,7 +1492,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                         netlink_insert(sk, net, nladdr->nl_pid) :
                         netlink_autobind(sock);
                 if (err) {
-                        netlink_unbind(nlk->ngroups - 1, groups, nlk);
+                        netlink_unbind(nlk->ngroups, groups, nlk);
                         return err;
                 }
         }
@@ -2509,6 +2509,7 @@ __netlink_kernel_create(struct net *net, int unit, struct module *module,
                 nl_table[unit].module = module;
                 if (cfg) {
                         nl_table[unit].bind = cfg->bind;
+                        nl_table[unit].unbind = cfg->unbind;
                         nl_table[unit].flags = cfg->flags;
                         if (cfg->compare)
                                 nl_table[unit].compare = cfg->compare;
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 006886dbee36..8c4229b11c34 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -246,11 +246,11 @@ static void update_ipv6_checksum(struct sk_buff *skb, u8 l4_proto,
 {
         int transport_len = skb->len - skb_transport_offset(skb);
 
-        if (l4_proto == IPPROTO_TCP) {
+        if (l4_proto == NEXTHDR_TCP) {
                 if (likely(transport_len >= sizeof(struct tcphdr)))
                         inet_proto_csum_replace16(&tcp_hdr(skb)->check, skb,
                                                   addr, new_addr, 1);
-        } else if (l4_proto == IPPROTO_UDP) {
+        } else if (l4_proto == NEXTHDR_UDP) {
                 if (likely(transport_len >= sizeof(struct udphdr))) {
                         struct udphdr *uh = udp_hdr(skb);
 
@@ -261,6 +261,10 @@ static void update_ipv6_checksum(struct sk_buff *skb, u8 l4_proto,
                                         uh->check = CSUM_MANGLED_0;
                         }
                 }
+        } else if (l4_proto == NEXTHDR_ICMP) {
+                if (likely(transport_len >= sizeof(struct icmp6hdr)))
+                        inet_proto_csum_replace16(&icmp6_hdr(skb)->icmp6_cksum,
+                                                  skb, addr, new_addr, 1);
         }
 }
 
@@ -722,8 +726,6 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
 
                 case OVS_ACTION_ATTR_SAMPLE:
                         err = sample(dp, skb, key, a);
-                        if (unlikely(err)) /* skb already freed. */
-                                return err;
                         break;
                 }
 
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index e6d7255183eb..f9e556b56086 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1265,7 +1265,7 @@ static size_t ovs_dp_cmd_msg_size(void)
         return msgsize;
 }
 
-/* Called with ovs_mutex or RCU read lock. */
+/* Called with ovs_mutex. */
 static int ovs_dp_cmd_fill_info(struct datapath *dp, struct sk_buff *skb,
                                 u32 portid, u32 seq, u32 flags, u8 cmd)
 {
@@ -1555,7 +1555,7 @@ static int ovs_dp_cmd_get(struct sk_buff *skb, struct genl_info *info)
         if (!reply)
                 return -ENOMEM;
 
-        rcu_read_lock();
+        ovs_lock();
         dp = lookup_datapath(sock_net(skb->sk), info->userhdr, info->attrs);
         if (IS_ERR(dp)) {
                 err = PTR_ERR(dp);
@@ -1564,12 +1564,12 @@ static int ovs_dp_cmd_get(struct sk_buff *skb, struct genl_info *info)
         err = ovs_dp_cmd_fill_info(dp, reply, info->snd_portid,
                                    info->snd_seq, 0, OVS_DP_CMD_NEW);
         BUG_ON(err < 0);
-        rcu_read_unlock();
+        ovs_unlock();
 
         return genlmsg_reply(reply, info);
 
 err_unlock_free:
-        rcu_read_unlock();
+        ovs_unlock();
         kfree_skb(reply);
         return err;
 }
@@ -1581,8 +1581,8 @@ static int ovs_dp_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int skip = cb->args[0];
         int i = 0;
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(dp, &ovs_net->dps, list_node) {
+        ovs_lock();
+        list_for_each_entry(dp, &ovs_net->dps, list_node) {
                 if (i >= skip &&
                     ovs_dp_cmd_fill_info(dp, skb, NETLINK_CB(cb->skb).portid,
                                          cb->nlh->nlmsg_seq, NLM_F_MULTI,
@@ -1590,7 +1590,7 @@ static int ovs_dp_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
                         break;
                 i++;
         }
-        rcu_read_unlock();
+        ovs_unlock();
 
         cb->args[0] = i;
 
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 939bcb32100f..089b195c064a 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -145,7 +145,7 @@ static bool match_validate(const struct sw_flow_match *match,
         if (match->key->eth.type == htons(ETH_P_ARP)
                         || match->key->eth.type == htons(ETH_P_RARP)) {
                 key_expected |= 1 << OVS_KEY_ATTR_ARP;
-                if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
+                if (match->mask && (match->mask->key.tp.src == htons(0xff)))
                         mask_allowed |= 1 << OVS_KEY_ATTR_ARP;
         }
 
@@ -689,6 +689,13 @@ static int ovs_key_from_nlattrs(struct sw_flow_match *match, u64 attrs,
                                 ipv6_key->ipv6_frag, OVS_FRAG_TYPE_MAX);
                         return -EINVAL;
                 }
+
+                if (!is_mask && ipv6_key->ipv6_label & htonl(0xFFF00000)) {
+                        OVS_NLERR("IPv6 flow label %x is out of range (max=%x).\n",
+                                  ntohl(ipv6_key->ipv6_label), (1 << 20) - 1);
+                        return -EINVAL;
+                }
+
                 SW_FLOW_KEY_PUT(match, ipv6.label,
                                 ipv6_key->ipv6_label, is_mask);
                 SW_FLOW_KEY_PUT(match, ip.proto,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 87d20f48ff06..07c04a841ba0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -378,7 +378,7 @@ static void unregister_prot_hook(struct sock *sk, bool sync)
                 __unregister_prot_hook(sk, sync);
 }
 
-static inline __pure struct page *pgv_to_page(void *addr)
+static inline struct page * __pure pgv_to_page(void *addr)
 {
         if (is_vmalloc_addr(addr))
                 return vmalloc_to_page(addr);
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 0e8529113dc5..fb7976aee61c 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -862,8 +862,6 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,
                 list_add(&cur_key->key_list, sh_keys);
 
         cur_key->key = key;
-        sctp_auth_key_hold(key);
-
         return 0;
 nomem:
         if (!replace)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index ab734be8cb20..9f32741abb1c 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2609,6 +2609,9 @@ do_addr_param:
                 addr_param = param.v + sizeof(sctp_addip_param_t);
 
                 af = sctp_get_af_specific(param_type2af(param.p->type));
+                if (af == NULL)
+                        break;
+
                 af->from_addr_param(&addr, addr_param,
                                     htons(asoc->peer.port), 0);
 
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index afb292cd797d..53ed8d3f8897 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1353,6 +1353,7 @@ gss_stringify_acceptor(struct rpc_cred *cred)
         char *string = NULL;
         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
         struct gss_cl_ctx *ctx;
+        unsigned int len;
         struct xdr_netobj *acceptor;
 
         rcu_read_lock();
@@ -1360,15 +1361,39 @@ gss_stringify_acceptor(struct rpc_cred *cred)
         if (!ctx)
                 goto out;
 
-        acceptor = &ctx->gc_acceptor;
+        len = ctx->gc_acceptor.len;
+        rcu_read_unlock();
 
         /* no point if there's no string */
-        if (!acceptor->len)
-                goto out;
-
-        string = kmalloc(acceptor->len + 1, GFP_KERNEL);
+        if (!len)
+                return NULL;
+realloc:
+        string = kmalloc(len + 1, GFP_KERNEL);
         if (!string)
+                return NULL;
+
+        rcu_read_lock();
+        ctx = rcu_dereference(gss_cred->gc_ctx);
+
+        /* did the ctx disappear or was it replaced by one with no acceptor? */
+        if (!ctx || !ctx->gc_acceptor.len) {
+                kfree(string);
+                string = NULL;
                 goto out;
+        }
+
+        acceptor = &ctx->gc_acceptor;
+
+        /*
+         * Did we find a new acceptor that's longer than the original? Allocate
+         * a longer buffer and try again.
+         */
+        if (len < acceptor->len) {
+                len = acceptor->len;
+                rcu_read_unlock();
+                kfree(string);
+                goto realloc;
+        }
 
         memcpy(string, acceptor->data, acceptor->len);
         string[acceptor->len] = '\0';
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 3f959c681885..f9c052d508f0 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1019,17 +1019,12 @@ static int receive_cb_reply(struct svc_sock *svsk, struct svc_rqst *rqstp)
         xid = *p++;
         calldir = *p;
 
-        if (bc_xprt)
-                req = xprt_lookup_rqst(bc_xprt, xid);
-
-        if (!req) {
-                printk(KERN_NOTICE
-                        "%s: Got unrecognized reply: "
-                        "calldir 0x%x xpt_bc_xprt %p xid %08x\n",
-                        __func__, ntohl(calldir),
-                        bc_xprt, ntohl(xid));
+        if (!bc_xprt)
                 return -EAGAIN;
-        }
+        spin_lock_bh(&bc_xprt->transport_lock);
+        req = xprt_lookup_rqst(bc_xprt, xid);
+        if (!req)
+                goto unlock_notfound;
 
         memcpy(&req->rq_private_buf, &req->rq_rcv_buf, sizeof(struct xdr_buf));
         /*
@@ -1040,11 +1035,21 @@ static int receive_cb_reply(struct svc_sock *svsk, struct svc_rqst *rqstp)
         dst = &req->rq_private_buf.head[0];
         src = &rqstp->rq_arg.head[0];
         if (dst->iov_len < src->iov_len)
-                return -EAGAIN; /* whatever; just giving up. */
+                goto unlock_eagain; /* whatever; just giving up. */
         memcpy(dst->iov_base, src->iov_base, src->iov_len);
         xprt_complete_rqst(req->rq_task, rqstp->rq_arg.len);
         rqstp->rq_arg.len = 0;
+        spin_unlock_bh(&bc_xprt->transport_lock);
         return 0;
+unlock_notfound:
+        printk(KERN_NOTICE
+                "%s: Got unrecognized reply: "
+                "calldir 0x%x xpt_bc_xprt %p xid %08x\n",
+                __func__, ntohl(calldir),
+                bc_xprt, ntohl(xid));
+unlock_eagain:
+        spin_unlock_bh(&bc_xprt->transport_lock);
+        return -EAGAIN;
 }
 
 static int copy_pages_to_kvecs(struct kvec *vec, struct page **pages, int len)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e66314138b38..c603b20356ad 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4725,9 +4725,10 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
         if (err) {
                 if (err == -EINVAL) {
-                        WARN_ONCE(1, "selinux_nlmsg_perm: unrecognized netlink message:"
-                                  " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
-                                  sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
+                        printk(KERN_WARNING
+                               "SELinux: unrecognized netlink message:"
+                               " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
+                               sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
                         if (!selinux_enforcing || security_get_allow_unknown())
                                 err = 0;
                 }
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 42ded997b223..c6ff94ab1ad6 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -216,6 +216,8 @@ static char *snd_pcm_format_names[] = {
         FORMAT(DSD_U8),
         FORMAT(DSD_U16_LE),
         FORMAT(DSD_U32_LE),
+        FORMAT(DSD_U16_BE),
+        FORMAT(DSD_U32_BE),
 };
 
 const char *snd_pcm_format_name(snd_pcm_format_t format)
diff --git a/sound/core/pcm_misc.c b/sound/core/pcm_misc.c
index ae7a0feb3b76..ebe8444de6c6 100644
--- a/sound/core/pcm_misc.c
+++ b/sound/core/pcm_misc.c
@@ -152,6 +152,14 @@ static struct pcm_format_data pcm_formats[(INT)SNDRV_PCM_FORMAT_LAST+1] = {
                 .width = 32, .phys = 32, .le = 1, .signd = 0,
                 .silence = { 0x69, 0x69, 0x69, 0x69 },
         },
+        [SNDRV_PCM_FORMAT_DSD_U16_BE] = {
+                .width = 16, .phys = 16, .le = 0, .signd = 0,
+                .silence = { 0x69, 0x69 },
+        },
+        [SNDRV_PCM_FORMAT_DSD_U32_BE] = {
+                .width = 32, .phys = 32, .le = 0, .signd = 0,
+                .silence = { 0x69, 0x69, 0x69, 0x69 },
+        },
         /* FIXME: the following three formats are not defined properly yet */
         [SNDRV_PCM_FORMAT_MPEG] = {
                 .le = -1, .signd = -1,
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 9ab1e631cb32..48b6c5a3884f 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -219,6 +219,7 @@ MODULE_SUPPORTED_DEVICE("{{Intel, ICH6},"
                          "{Intel, LPT_LP},"
                          "{Intel, WPT_LP},"
                          "{Intel, SPT},"
+                         "{Intel, SPT_LP},"
                          "{Intel, HPT},"
                          "{Intel, PBG},"
                          "{Intel, SCH},"
@@ -297,7 +298,8 @@ enum {
 
 /* quirks for ATI/AMD HDMI */
 #define AZX_DCAPS_PRESET_ATI_HDMI \
-        (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB)
+        (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB|\
+         AZX_DCAPS_NO_MSI64)
 
 /* quirks for Nvidia */
 #define AZX_DCAPS_PRESET_NVIDIA \
@@ -1485,6 +1487,7 @@ static int azx_first_init(struct azx *chip)
         struct snd_card *card = chip->card;
         int err;
         unsigned short gcap;
+        unsigned int dma_bits = 64;
 
 #if BITS_PER_LONG != 64
         /* Fix up base address on ULI M5461 */
@@ -1508,9 +1511,14 @@ static int azx_first_init(struct azx *chip)
                 return -ENXIO;
         }
 
-        if (chip->msi)
+        if (chip->msi) {
+                if (chip->driver_caps & AZX_DCAPS_NO_MSI64) {
+                        dev_dbg(card->dev, "Disabling 64bit MSI\n");
+                        pci->no_64bit_msi = true;
+                }
                 if (pci_enable_msi(pci) < 0)
                         chip->msi = 0;
+        }
 
         if (azx_acquire_irq(chip, 0) < 0)
                 return -EBUSY;
@@ -1521,9 +1529,14 @@ static int azx_first_init(struct azx *chip)
         gcap = azx_readw(chip, GCAP);
         dev_dbg(card->dev, "chipset global capabilities = 0x%x\n", gcap);
 
+        /* AMD devices support 40 or 48bit DMA, take the safe one */
+        if (chip->pci->vendor == PCI_VENDOR_ID_AMD)
+                dma_bits = 40;
+
         /* disable SB600 64bit support for safety */
         if (chip->pci->vendor == PCI_VENDOR_ID_ATI) {
                 struct pci_dev *p_smbus;
+                dma_bits = 40;
                 p_smbus = pci_get_device(PCI_VENDOR_ID_ATI,
                                          PCI_DEVICE_ID_ATI_SBX00_SMBUS,
                                          NULL);
@@ -1553,9 +1566,11 @@ static int azx_first_init(struct azx *chip)
         }
 
         /* allow 64bit DMA address if supported by H/W */
-        if ((gcap & AZX_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
-                pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64));
-        else {
+        if (!(gcap & AZX_GCAP_64OK))
+                dma_bits = 32;
+        if (!pci_set_dma_mask(pci, DMA_BIT_MASK(dma_bits))) {
+                pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(dma_bits));
+        } else {
                 pci_set_dma_mask(pci, DMA_BIT_MASK(32));
                 pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(32));
         }
@@ -2004,6 +2019,9 @@ static const struct pci_device_id azx_ids[] = {
         /* Sunrise Point */
         { PCI_DEVICE(0x8086, 0xa170),
           .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+        /* Sunrise Point-LP */
+        { PCI_DEVICE(0x8086, 0x9d70),
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
         /* Haswell */
         { PCI_DEVICE(0x8086, 0x0a0c),
           .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL },
diff --git a/sound/pci/hda/hda_priv.h b/sound/pci/hda/hda_priv.h
index 949cd437eeb2..5016014e57f2 100644
--- a/sound/pci/hda/hda_priv.h
+++ b/sound/pci/hda/hda_priv.h
@@ -171,6 +171,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
 #define AZX_DCAPS_PM_RUNTIME    (1 << 26)       /* runtime PM support */
 #define AZX_DCAPS_I915_POWERWELL (1 << 27)      /* HSW i915 powerwell support */
 #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28)   /* CORBRP clears itself after reset */
+#define AZX_DCAPS_NO_MSI64      (1 << 29)       /* Stick to 32-bit MSIs */
 
 /* HD Audio class code */
 #define PCI_CLASS_MULTIMEDIA_HD_AUDIO   0x0403
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 71e4bad06345..e9ebc7bd752c 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -43,6 +43,7 @@ struct conexant_spec {
         unsigned int num_eapds;
         hda_nid_t eapds[4];
         bool dynamic_eapd;
+        hda_nid_t mute_led_eapd;
 
         unsigned int parse_flags; /* flag for snd_hda_parse_pin_defcfg() */
 
@@ -163,6 +164,17 @@ static void cx_auto_vmaster_hook(void *private_data, int enabled)
         cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, enabled);
 }
 
+/* turn on/off EAPD according to Master switch (inversely!) for mute LED */
+static void cx_auto_vmaster_hook_mute_led(void *private_data, int enabled)
+{
+        struct hda_codec *codec = private_data;
+        struct conexant_spec *spec = codec->spec;
+
+        snd_hda_codec_write(codec, spec->mute_led_eapd, 0,
+                            AC_VERB_SET_EAPD_BTLENABLE,
+                            enabled ? 0x00 : 0x02);
+}
+
 static int cx_auto_build_controls(struct hda_codec *codec)
 {
         int err;
@@ -223,6 +235,7 @@ enum {
         CXT_FIXUP_TOSHIBA_P105,
         CXT_FIXUP_HP_530,
         CXT_FIXUP_CAP_MIX_AMP_5047,
+        CXT_FIXUP_MUTE_LED_EAPD,
 };
 
 /* for hda_fixup_thinkpad_acpi() */
@@ -557,6 +570,18 @@ static void cxt_fixup_olpc_xo(struct hda_codec *codec,
         }
 }
 
+static void cxt_fixup_mute_led_eapd(struct hda_codec *codec,
+                                    const struct hda_fixup *fix, int action)
+{
+        struct conexant_spec *spec = codec->spec;
+
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                spec->mute_led_eapd = 0x1b;
+                spec->dynamic_eapd = 1;
+                spec->gen.vmaster_mute.hook = cx_auto_vmaster_hook_mute_led;
+        }
+}
+
 /*
  * Fix max input level on mixer widget to 0dB
  * (originally it has 0x2b steps with 0dB offset 0x14)
@@ -705,6 +730,10 @@ static const struct hda_fixup cxt_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = cxt_fixup_cap_mix_amp_5047,
         },
+        [CXT_FIXUP_MUTE_LED_EAPD] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = cxt_fixup_mute_led_eapd,
+        },
 };
 
 static const struct snd_pci_quirk cxt5045_fixups[] = {
@@ -762,6 +791,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
         SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410),
         SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410),
+        SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD),
         SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
@@ -780,6 +810,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = {
         { .id = CXT_PINCFG_LEMOTE_A1004, .name = "lemote-a1004" },
         { .id = CXT_PINCFG_LEMOTE_A1205, .name = "lemote-a1205" },
         { .id = CXT_FIXUP_OLPC_XO, .name = "olpc-xo" },
+        { .id = CXT_FIXUP_MUTE_LED_EAPD, .name = "mute-led-eapd" },
         {}
 };
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index da03693099eb..14f16be3f374 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -288,6 +288,80 @@ static void alc880_unsol_event(struct hda_codec *codec, unsigned int res)
         snd_hda_jack_unsol_event(codec, res >> 2);
 }
 
+/* Change EAPD to verb control */
+static void alc_fill_eapd_coef(struct hda_codec *codec)
+{
+        int coef;
+
+        coef = alc_get_coef0(codec);
+
+        switch (codec->vendor_id) {
+        case 0x10ec0262:
+                alc_update_coef_idx(codec, 0x7, 0, 1<<5);
+                break;
+        case 0x10ec0267:
+        case 0x10ec0268:
+                alc_update_coef_idx(codec, 0x7, 0, 1<<13);
+                break;
+        case 0x10ec0269:
+                if ((coef & 0x00f0) == 0x0010)
+                        alc_update_coef_idx(codec, 0xd, 0, 1<<14);
+                if ((coef & 0x00f0) == 0x0020)
+                        alc_update_coef_idx(codec, 0x4, 1<<15, 0);
+                if ((coef & 0x00f0) == 0x0030)
+                        alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+                break;
+        case 0x10ec0280:
+        case 0x10ec0284:
+        case 0x10ec0290:
+        case 0x10ec0292:
+                alc_update_coef_idx(codec, 0x4, 1<<15, 0);
+                break;
+        case 0x10ec0233:
+        case 0x10ec0255:
+        case 0x10ec0282:
+        case 0x10ec0283:
+        case 0x10ec0286:
+        case 0x10ec0288:
+                alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+                break;
+        case 0x10ec0285:
+        case 0x10ec0293:
+                alc_update_coef_idx(codec, 0xa, 1<<13, 0);
+                break;
+        case 0x10ec0662:
+                if ((coef & 0x00f0) == 0x0030)
+                        alc_update_coef_idx(codec, 0x4, 1<<10, 0); /* EAPD Ctrl */
+                break;
+        case 0x10ec0272:
+        case 0x10ec0273:
+        case 0x10ec0663:
+        case 0x10ec0665:
+        case 0x10ec0670:
+        case 0x10ec0671:
+        case 0x10ec0672:
+                alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */
+                break;
+        case 0x10ec0668:
+                alc_update_coef_idx(codec, 0x7, 3<<13, 0);
+                break;
+        case 0x10ec0867:
+                alc_update_coef_idx(codec, 0x4, 1<<10, 0);
+                break;
+        case 0x10ec0888:
+                if ((coef & 0x00f0) == 0x0020 || (coef & 0x00f0) == 0x0030)
+                        alc_update_coef_idx(codec, 0x7, 1<<5, 0);
+                break;
+        case 0x10ec0892:
+                alc_update_coef_idx(codec, 0x7, 1<<5, 0);
+                break;
+        case 0x10ec0899:
+        case 0x10ec0900:
+                alc_update_coef_idx(codec, 0x7, 1<<1, 0);
+                break;
+        }
+}
+
 /* additional initialization for ALC888 variants */
 static void alc888_coef_init(struct hda_codec *codec)
 {
@@ -339,6 +413,7 @@ static void alc_eapd_shutup(struct hda_codec *codec)
 /* generic EAPD initialization */
 static void alc_auto_init_amp(struct hda_codec *codec, int type)
 {
+        alc_fill_eapd_coef(codec);
         alc_auto_setup_eapd(codec, true);
         switch (type) {
         case ALC_INIT_GPIO1:
@@ -4445,6 +4520,8 @@ static const struct hda_fixup alc269_fixups[] = {
         [ALC269_FIXUP_HEADSET_MODE] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_headset_mode,
+                .chained = true,
+                .chain_id = ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED
         },
         [ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC] = {
                 .type = HDA_FIXUP_FUNC,
@@ -4634,6 +4711,8 @@ static const struct hda_fixup alc269_fixups[] = {
         [ALC255_FIXUP_HEADSET_MODE] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_headset_mode_alc255,
+                .chained = true,
+                .chain_id = ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED
         },
         [ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC] = {
                 .type = HDA_FIXUP_FUNC,
@@ -4669,8 +4748,6 @@ static const struct hda_fixup alc269_fixups[] = {
         [ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_dell_wmi,
-                .chained_before = true,
-                .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
         },
         [ALC282_FIXUP_ASPIRE_V5_PINS] = {
                 .type = HDA_FIXUP_PINS,
@@ -4708,10 +4785,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x05f4, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x05f5, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x05f6, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1028, 0x0610, "Dell", ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED),
         SND_PCI_QUIRK(0x1028, 0x0615, "Dell Vostro 5470", ALC290_FIXUP_SUBWOOFER_HSJACK),
         SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_SUBWOOFER_HSJACK),
-        SND_PCI_QUIRK(0x1028, 0x061f, "Dell", ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED),
         SND_PCI_QUIRK(0x1028, 0x0638, "Dell Inspiron 5439", ALC290_FIXUP_MONO_SPEAKERS_HSJACK),
         SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
@@ -4743,7 +4818,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x221b, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2221, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2225, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-        SND_PCI_QUIRK(0x103c, 0x2246, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2253, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2254, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2255, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
@@ -5212,9 +5286,6 @@ static void alc269_fill_coef(struct hda_codec *codec)
                 }
         }
 
-        /* Class D */
-        alc_update_coef_idx(codec, 0xd, 0, 1<<14);
-
         /* HP */
         alc_update_coef_idx(codec, 0x4, 0, 1<<11);
 }
@@ -6124,29 +6195,6 @@ static const struct snd_hda_pin_quirk alc662_pin_fixup_tbl[] = {
         {}
 };
 
-static void alc662_fill_coef(struct hda_codec *codec)
-{
-        int coef;
-
-        coef = alc_get_coef0(codec);
-
-        switch (codec->vendor_id) {
-        case 0x10ec0662:
-                if ((coef & 0x00f0) == 0x0030)
-                        alc_update_coef_idx(codec, 0x4, 1<<10, 0); /* EAPD Ctrl */
-                break;
-        case 0x10ec0272:
-        case 0x10ec0273:
-        case 0x10ec0663:
-        case 0x10ec0665:
-        case 0x10ec0670:
-        case 0x10ec0671:
-        case 0x10ec0672:
-                alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */
-                break;
-        }
-}
-
 /*
  */
 static int patch_alc662(struct hda_codec *codec)
@@ -6169,10 +6217,6 @@ static int patch_alc662(struct hda_codec *codec)
         case 0x10ec0668:
                 spec->init_hook = alc668_restore_default_value;
                 break;
-        default:
-                spec->init_hook = alc662_fill_coef;
-                alc662_fill_coef(codec);
-                break;
         }
 
         snd_hda_pick_fixup(codec, alc662_fixup_models,
diff --git a/sound/soc/codecs/cs42l51-i2c.c b/sound/soc/codecs/cs42l51-i2c.c
index cee51ae177c1..c40428f25ba5 100644
--- a/sound/soc/codecs/cs42l51-i2c.c
+++ b/sound/soc/codecs/cs42l51-i2c.c
@@ -46,6 +46,7 @@ static struct i2c_driver cs42l51_i2c_driver = {
         .driver = {
                 .name = "cs42l51",
                 .owner = THIS_MODULE,
+                .of_match_table = cs42l51_of_match,
         },
         .probe = cs42l51_i2c_probe,
         .remove = cs42l51_i2c_remove,
diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c
index 09488d97de60..669c38fc3034 100644
--- a/sound/soc/codecs/cs42l51.c
+++ b/sound/soc/codecs/cs42l51.c
@@ -558,11 +558,13 @@ error:
 }
 EXPORT_SYMBOL_GPL(cs42l51_probe);
 
-static const struct of_device_id cs42l51_of_match[] = {
+const struct of_device_id cs42l51_of_match[] = {
         { .compatible = "cirrus,cs42l51", },
         { }
 };
 MODULE_DEVICE_TABLE(of, cs42l51_of_match);
+EXPORT_SYMBOL_GPL(cs42l51_of_match);
+
 MODULE_AUTHOR("Arnaud Patard <arnaud.patard@rtp-net.org>");
 MODULE_DESCRIPTION("Cirrus Logic CS42L51 ALSA SoC Codec Driver");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/cs42l51.h b/sound/soc/codecs/cs42l51.h
index 8c55bf384bc6..0ca805492ac4 100644
--- a/sound/soc/codecs/cs42l51.h
+++ b/sound/soc/codecs/cs42l51.h
@@ -22,6 +22,7 @@ struct device;
 
 extern const struct regmap_config cs42l51_regmap;
 int cs42l51_probe(struct device *dev, struct regmap *regmap);
+extern const struct of_device_id cs42l51_of_match[];
 
 #define CS42L51_CHIP_ID                 0x1B
 #define CS42L51_CHIP_REV_A              0x00
diff --git a/sound/soc/codecs/es8328-i2c.c b/sound/soc/codecs/es8328-i2c.c
index aae410d122ee..2d05b5d3a6ce 100644
--- a/sound/soc/codecs/es8328-i2c.c
+++ b/sound/soc/codecs/es8328-i2c.c
@@ -19,7 +19,7 @@
 #include "es8328.h"
 
 static const struct i2c_device_id es8328_id[] = {
-        { "everest,es8328", 0 },
+        { "es8328", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, es8328_id);
diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
index d519294f57c7..1229554f1464 100644
--- a/sound/soc/codecs/max98090.c
+++ b/sound/soc/codecs/max98090.c
@@ -1941,13 +1941,13 @@ static int max98090_dai_set_sysclk(struct snd_soc_dai *dai,
          *               0x02 (when master clk is 20MHz to 40MHz)..
          *               0x03 (when master clk is 40MHz to 60MHz)..
          */
-        if ((freq >= 10000000) && (freq < 20000000)) {
+        if ((freq >= 10000000) && (freq <= 20000000)) {
                 snd_soc_write(codec, M98090_REG_SYSTEM_CLOCK,
                         M98090_PSCLK_DIV1);
-        } else if ((freq >= 20000000) && (freq < 40000000)) {
+        } else if ((freq > 20000000) && (freq <= 40000000)) {
                 snd_soc_write(codec, M98090_REG_SYSTEM_CLOCK,
                         M98090_PSCLK_DIV2);
-        } else if ((freq >= 40000000) && (freq < 60000000)) {
+        } else if ((freq > 40000000) && (freq <= 60000000)) {
                 snd_soc_write(codec, M98090_REG_SYSTEM_CLOCK,
                         M98090_PSCLK_DIV4);
         } else {
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index 3fb83bf09768..d16331e0b64d 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -139,6 +139,7 @@ static const struct reg_default rt5645_reg[] = {
         { 0x76, 0x000a },
         { 0x77, 0x0c00 },
         { 0x78, 0x0000 },
+        { 0x79, 0x0123 },
         { 0x80, 0x0000 },
         { 0x81, 0x0000 },
         { 0x82, 0x0000 },
@@ -334,6 +335,7 @@ static bool rt5645_readable_register(struct device *dev, unsigned int reg)
         case RT5645_DMIC_CTRL2:
         case RT5645_TDM_CTRL_1:
         case RT5645_TDM_CTRL_2:
+        case RT5645_TDM_CTRL_3:
         case RT5645_GLB_CLK:
         case RT5645_PLL_CTRL1:
         case RT5645_PLL_CTRL2:
diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
index ba9d9b4d4857..9bd8b4f63303 100644
--- a/sound/soc/codecs/rt5670.c
+++ b/sound/soc/codecs/rt5670.c
@@ -100,18 +100,18 @@ static const struct reg_default rt5670_reg[] = {
         { 0x4c, 0x5380 },
         { 0x4f, 0x0073 },
         { 0x52, 0x00d3 },
-        { 0x53, 0xf0f0 },
+        { 0x53, 0xf000 },
         { 0x61, 0x0000 },
         { 0x62, 0x0001 },
         { 0x63, 0x00c3 },
         { 0x64, 0x0000 },
-        { 0x65, 0x0000 },
+        { 0x65, 0x0001 },
         { 0x66, 0x0000 },
         { 0x6f, 0x8000 },
         { 0x70, 0x8000 },
         { 0x71, 0x8000 },
         { 0x72, 0x8000 },
-        { 0x73, 0x1110 },
+        { 0x73, 0x7770 },
         { 0x74, 0x0e00 },
         { 0x75, 0x1505 },
         { 0x76, 0x0015 },
@@ -125,21 +125,21 @@ static const struct reg_default rt5670_reg[] = {
         { 0x83, 0x0000 },
         { 0x84, 0x0000 },
         { 0x85, 0x0000 },
-        { 0x86, 0x0008 },
+        { 0x86, 0x0004 },
         { 0x87, 0x0000 },
         { 0x88, 0x0000 },
         { 0x89, 0x0000 },
         { 0x8a, 0x0000 },
         { 0x8b, 0x0000 },
-        { 0x8c, 0x0007 },
+        { 0x8c, 0x0003 },
         { 0x8d, 0x0000 },
         { 0x8e, 0x0004 },
         { 0x8f, 0x1100 },
         { 0x90, 0x0646 },
         { 0x91, 0x0c06 },
         { 0x93, 0x0000 },
-        { 0x94, 0x0000 },
-        { 0x95, 0x0000 },
+        { 0x94, 0x1270 },
+        { 0x95, 0x1000 },
         { 0x97, 0x0000 },
         { 0x98, 0x0000 },
         { 0x99, 0x0000 },
@@ -150,11 +150,11 @@ static const struct reg_default rt5670_reg[] = {
         { 0x9e, 0x0400 },
         { 0xae, 0x7000 },
         { 0xaf, 0x0000 },
-        { 0xb0, 0x6000 },
+        { 0xb0, 0x7000 },
         { 0xb1, 0x0000 },
         { 0xb2, 0x0000 },
         { 0xb3, 0x001f },
-        { 0xb4, 0x2206 },
+        { 0xb4, 0x220c },
         { 0xb5, 0x1f00 },
         { 0xb6, 0x0000 },
         { 0xb7, 0x0000 },
@@ -171,25 +171,25 @@ static const struct reg_default rt5670_reg[] = {
         { 0xcf, 0x1813 },
         { 0xd0, 0x0690 },
         { 0xd1, 0x1c17 },
-        { 0xd3, 0xb320 },
+        { 0xd3, 0xa220 },
         { 0xd4, 0x0000 },
         { 0xd6, 0x0400 },
         { 0xd9, 0x0809 },
         { 0xda, 0x0000 },
         { 0xdb, 0x0001 },
         { 0xdc, 0x0049 },
-        { 0xdd, 0x0009 },
+        { 0xdd, 0x0024 },
         { 0xe6, 0x8000 },
         { 0xe7, 0x0000 },
-        { 0xec, 0xb300 },
+        { 0xec, 0xa200 },
         { 0xed, 0x0000 },
-        { 0xee, 0xb300 },
+        { 0xee, 0xa200 },
         { 0xef, 0x0000 },
         { 0xf8, 0x0000 },
         { 0xf9, 0x0000 },
         { 0xfa, 0x8010 },
         { 0xfb, 0x0033 },
-        { 0xfc, 0x0080 },
+        { 0xfc, 0x0100 },
 };
 
 static bool rt5670_volatile_register(struct device *dev, unsigned int reg)
@@ -1877,6 +1877,10 @@ static const struct snd_soc_dapm_route rt5670_dapm_routes[] = {
         { "DAC1 MIXR", "DAC1 Switch", "DAC1 R Mux" },
         { "DAC1 MIXR", NULL, "DAC Stereo1 Filter" },
 
+        { "DAC Stereo1 Filter", NULL, "PLL1", is_sys_clk_from_pll },
+        { "DAC Mono Left Filter", NULL, "PLL1", is_sys_clk_from_pll },
+        { "DAC Mono Right Filter", NULL, "PLL1", is_sys_clk_from_pll },
+
         { "DAC MIX", NULL, "DAC1 MIXL" },
         { "DAC MIX", NULL, "DAC1 MIXR" },
 
@@ -1926,14 +1930,10 @@ static const struct snd_soc_dapm_route rt5670_dapm_routes[] = {
 
         { "DAC L1", NULL, "DAC L1 Power" },
         { "DAC L1", NULL, "Stereo DAC MIXL" },
-        { "DAC L1", NULL, "PLL1", is_sys_clk_from_pll },
         { "DAC R1", NULL, "DAC R1 Power" },
         { "DAC R1", NULL, "Stereo DAC MIXR" },
-        { "DAC R1", NULL, "PLL1", is_sys_clk_from_pll },
         { "DAC L2", NULL, "Mono DAC MIXL" },
-        { "DAC L2", NULL, "PLL1", is_sys_clk_from_pll },
         { "DAC R2", NULL, "Mono DAC MIXR" },
-        { "DAC R2", NULL, "PLL1", is_sys_clk_from_pll },
 
         { "OUT MIXL", "BST1 Switch", "BST1" },
         { "OUT MIXL", "INL Switch", "INL VOL" },
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index 6bb77d76561b..dab9b15304af 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -1299,8 +1299,7 @@ static int sgtl5000_probe(struct snd_soc_codec *codec)
 
         /* enable small pop, introduce 400ms delay in turning off */
         snd_soc_update_bits(codec, SGTL5000_CHIP_REF_CTRL,
-                                SGTL5000_SMALL_POP,
-                                SGTL5000_SMALL_POP);
+                                SGTL5000_SMALL_POP, 1);
 
         /* disable short cut detector */
         snd_soc_write(codec, SGTL5000_CHIP_SHORT_CTRL, 0);
diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h
index 2f8c88931f69..bd7a344bf8c5 100644
--- a/sound/soc/codecs/sgtl5000.h
+++ b/sound/soc/codecs/sgtl5000.h
@@ -275,7 +275,7 @@
 #define SGTL5000_BIAS_CTRL_MASK                 0x000e
 #define SGTL5000_BIAS_CTRL_SHIFT                1
 #define SGTL5000_BIAS_CTRL_WIDTH                3
-#define SGTL5000_SMALL_POP                      0x0001
+#define SGTL5000_SMALL_POP                      0
 
 /*
  * SGTL5000_CHIP_MIC_CTRL
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index f412a9911a75..67124783558a 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1355,6 +1355,7 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
                           file, blocks, pos - firmware->size);
 
 out_fw:
+        regmap_async_complete(regmap);
         release_firmware(firmware);
         wm_adsp_buf_free(&buf_list);
 out:
diff --git a/sound/soc/fsl/fsl_asrc.c b/sound/soc/fsl/fsl_asrc.c
index ed866e9a2928..9deabdd2b1a2 100644
--- a/sound/soc/fsl/fsl_asrc.c
+++ b/sound/soc/fsl/fsl_asrc.c
@@ -684,12 +684,38 @@ static bool fsl_asrc_writeable_reg(struct device *dev, unsigned int reg)
         }
 }
 
+static struct reg_default fsl_asrc_reg[] = {
+        { REG_ASRCTR, 0x0000 }, { REG_ASRIER, 0x0000 },
+        { REG_ASRCNCR, 0x0000 }, { REG_ASRCFG, 0x0000 },
+        { REG_ASRCSR, 0x0000 }, { REG_ASRCDR1, 0x0000 },
+        { REG_ASRCDR2, 0x0000 }, { REG_ASRSTR, 0x0000 },
+        { REG_ASRRA, 0x0000 }, { REG_ASRRB, 0x0000 },
+        { REG_ASRRC, 0x0000 }, { REG_ASRPM1, 0x0000 },
+        { REG_ASRPM2, 0x0000 }, { REG_ASRPM3, 0x0000 },
+        { REG_ASRPM4, 0x0000 }, { REG_ASRPM5, 0x0000 },
+        { REG_ASRTFR1, 0x0000 }, { REG_ASRCCR, 0x0000 },
+        { REG_ASRDIA, 0x0000 }, { REG_ASRDOA, 0x0000 },
+        { REG_ASRDIB, 0x0000 }, { REG_ASRDOB, 0x0000 },
+        { REG_ASRDIC, 0x0000 }, { REG_ASRDOC, 0x0000 },
+        { REG_ASRIDRHA, 0x0000 }, { REG_ASRIDRLA, 0x0000 },
+        { REG_ASRIDRHB, 0x0000 }, { REG_ASRIDRLB, 0x0000 },
+        { REG_ASRIDRHC, 0x0000 }, { REG_ASRIDRLC, 0x0000 },
+        { REG_ASR76K, 0x0A47 }, { REG_ASR56K, 0x0DF3 },
+        { REG_ASRMCRA, 0x0000 }, { REG_ASRFSTA, 0x0000 },
+        { REG_ASRMCRB, 0x0000 }, { REG_ASRFSTB, 0x0000 },
+        { REG_ASRMCRC, 0x0000 }, { REG_ASRFSTC, 0x0000 },
+        { REG_ASRMCR1A, 0x0000 }, { REG_ASRMCR1B, 0x0000 },
+        { REG_ASRMCR1C, 0x0000 },
+};
+
 static const struct regmap_config fsl_asrc_regmap_config = {
         .reg_bits = 32,
         .reg_stride = 4,
         .val_bits = 32,
 
         .max_register = REG_ASRMCR1C,
+        .reg_defaults = fsl_asrc_reg,
+        .num_reg_defaults = ARRAY_SIZE(fsl_asrc_reg),
         .readable_reg = fsl_asrc_readable_reg,
         .volatile_reg = fsl_asrc_volatile_reg,
         .writeable_reg = fsl_asrc_writeable_reg,
diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
index f373e37f8305..c74ba37f862c 100644
--- a/sound/soc/rockchip/rockchip_i2s.c
+++ b/sound/soc/rockchip/rockchip_i2s.c
@@ -154,8 +154,10 @@ static void rockchip_snd_rxctrl(struct rk_i2s_dev *i2s, int on)
                         while (val) {
                                 regmap_read(i2s->regmap, I2S_CLR, &val);
                                 retry--;
-                                if (!retry)
+                                if (!retry) {
                                         dev_warn(i2s->dev, "fail to clear\n");
+                                        break;
+                                }
                         }
                 }
         }
diff --git a/sound/soc/samsung/snow.c b/sound/soc/samsung/snow.c
index 0acf5d0eed53..72118a77dd5b 100644
--- a/sound/soc/samsung/snow.c
+++ b/sound/soc/samsung/snow.c
@@ -110,6 +110,7 @@ static const struct of_device_id snow_of_match[] = {
         { .compatible = "google,snow-audio-max98095", },
         {},
 };
+MODULE_DEVICE_TABLE(of, snow_of_match);
 
 static struct platform_driver snow_driver = {
         .driver = {
diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c
index 66fddec9543d..88e5df474ccf 100644
--- a/sound/soc/sh/fsi.c
+++ b/sound/soc/sh/fsi.c
@@ -1711,8 +1711,7 @@ static const struct snd_soc_dai_ops fsi_dai_ops = {
 static struct snd_pcm_hardware fsi_pcm_hardware = {
         .info =         SNDRV_PCM_INFO_INTERLEAVED      |
                         SNDRV_PCM_INFO_MMAP             |
-                        SNDRV_PCM_INFO_MMAP_VALID       |
-                        SNDRV_PCM_INFO_PAUSE,
+                        SNDRV_PCM_INFO_MMAP_VALID,
         .buffer_bytes_max       = 64 * 1024,
         .period_bytes_min       = 32,
         .period_bytes_max       = 8192,
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 1922ec57d10a..70042197f9e2 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -886,8 +886,7 @@ static int rsnd_dai_probe(struct platform_device *pdev,
 static struct snd_pcm_hardware rsnd_pcm_hardware = {
         .info =         SNDRV_PCM_INFO_INTERLEAVED      |
                         SNDRV_PCM_INFO_MMAP             |
-                        SNDRV_PCM_INFO_MMAP_VALID       |
-                        SNDRV_PCM_INFO_PAUSE,
+                        SNDRV_PCM_INFO_MMAP_VALID,
         .buffer_bytes_max       = 64 * 1024,
         .period_bytes_min       = 32,
         .period_bytes_max       = 8192,
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 4c8f8a23a0e9..b60ff56ebc0f 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -884,7 +884,7 @@ static struct snd_soc_dai *snd_soc_find_dai(
         list_for_each_entry(component, &component_list, list) {
                 if (dlc->of_node && component->dev->of_node != dlc->of_node)
                         continue;
-                if (dlc->name && strcmp(dev_name(component->dev), dlc->name))
+                if (dlc->name && strcmp(component->name, dlc->name))
                         continue;
                 list_for_each_entry(dai, &component->dai_list, list) {
                         if (dlc->dai_name && strcmp(dai->name, dlc->dai_name))
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 002311afdeaa..57277dd79e11 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1522,13 +1522,36 @@ static void dpcm_set_fe_runtime(struct snd_pcm_substream *substream)
                 dpcm_init_runtime_hw(runtime, &cpu_dai_drv->capture);
 }
 
+static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd);
+
+/* Set FE's runtime_update state; the state is protected via PCM stream lock
+ * for avoiding the race with trigger callback.
+ * If the state is unset and a trigger is pending while the previous operation,
+ * process the pending trigger action here.
+ */
+static void dpcm_set_fe_update_state(struct snd_soc_pcm_runtime *fe,
+                                     int stream, enum snd_soc_dpcm_update state)
+{
+        struct snd_pcm_substream *substream =
+                snd_soc_dpcm_get_substream(fe, stream);
+
+        snd_pcm_stream_lock_irq(substream);
+        if (state == SND_SOC_DPCM_UPDATE_NO && fe->dpcm[stream].trigger_pending) {
+                dpcm_fe_dai_do_trigger(substream,
+                                       fe->dpcm[stream].trigger_pending - 1);
+                fe->dpcm[stream].trigger_pending = 0;
+        }
+        fe->dpcm[stream].runtime_update = state;
+        snd_pcm_stream_unlock_irq(substream);
+}
+
 static int dpcm_fe_dai_startup(struct snd_pcm_substream *fe_substream)
 {
         struct snd_soc_pcm_runtime *fe = fe_substream->private_data;
         struct snd_pcm_runtime *runtime = fe_substream->runtime;
         int stream = fe_substream->stream, ret = 0;
 
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_FE);
 
         ret = dpcm_be_dai_startup(fe, fe_substream->stream);
         if (ret < 0) {
@@ -1550,13 +1573,13 @@ static int dpcm_fe_dai_startup(struct snd_pcm_substream *fe_substream)
         dpcm_set_fe_runtime(fe_substream);
         snd_pcm_limit_hw_rates(runtime);
 
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
         return 0;
 
 unwind:
         dpcm_be_dai_startup_unwind(fe, fe_substream->stream);
 be_err:
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
         return ret;
 }
 
@@ -1603,7 +1626,7 @@ static int dpcm_fe_dai_shutdown(struct snd_pcm_substream *substream)
         struct snd_soc_pcm_runtime *fe = substream->private_data;
         int stream = substream->stream;
 
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_FE);
 
         /* shutdown the BEs */
         dpcm_be_dai_shutdown(fe, substream->stream);
@@ -1617,7 +1640,7 @@ static int dpcm_fe_dai_shutdown(struct snd_pcm_substream *substream)
         dpcm_dapm_stream_event(fe, stream, SND_SOC_DAPM_STREAM_STOP);
 
         fe->dpcm[stream].state = SND_SOC_DPCM_STATE_CLOSE;
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
         return 0;
 }
 
@@ -1665,7 +1688,7 @@ static int dpcm_fe_dai_hw_free(struct snd_pcm_substream *substream)
         int err, stream = substream->stream;
 
         mutex_lock_nested(&fe->card->mutex, SND_SOC_CARD_CLASS_RUNTIME);
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_FE);
 
         dev_dbg(fe->dev, "ASoC: hw_free FE %s\n", fe->dai_link->name);
 
@@ -1680,7 +1703,7 @@ static int dpcm_fe_dai_hw_free(struct snd_pcm_substream *substream)
         err = dpcm_be_dai_hw_free(fe, stream);
 
         fe->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_FREE;
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
 
         mutex_unlock(&fe->card->mutex);
         return 0;
@@ -1773,7 +1796,7 @@ static int dpcm_fe_dai_hw_params(struct snd_pcm_substream *substream,
         int ret, stream = substream->stream;
 
         mutex_lock_nested(&fe->card->mutex, SND_SOC_CARD_CLASS_RUNTIME);
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_FE);
 
         memcpy(&fe->dpcm[substream->stream].hw_params, params,
                         sizeof(struct snd_pcm_hw_params));
@@ -1796,7 +1819,7 @@ static int dpcm_fe_dai_hw_params(struct snd_pcm_substream *substream,
                 fe->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_PARAMS;
 
 out:
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
         mutex_unlock(&fe->card->mutex);
         return ret;
 }
@@ -1910,7 +1933,7 @@ int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream,
 }
 EXPORT_SYMBOL_GPL(dpcm_be_dai_trigger);
 
-static int dpcm_fe_dai_trigger(struct snd_pcm_substream *substream, int cmd)
+static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
 {
         struct snd_soc_pcm_runtime *fe = substream->private_data;
         int stream = substream->stream, ret;
@@ -1984,6 +2007,23 @@ out:
         return ret;
 }
 
+static int dpcm_fe_dai_trigger(struct snd_pcm_substream *substream, int cmd)
+{
+        struct snd_soc_pcm_runtime *fe = substream->private_data;
+        int stream = substream->stream;
+
+        /* if FE's runtime_update is already set, we're in race;
+         * process this trigger later at exit
+         */
+        if (fe->dpcm[stream].runtime_update != SND_SOC_DPCM_UPDATE_NO) {
+                fe->dpcm[stream].trigger_pending = cmd + 1;
+                return 0; /* delayed, assuming it's successful */
+        }
+
+        /* we're alone, let's trigger */
+        return dpcm_fe_dai_do_trigger(substream, cmd);
+}
+
 int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream)
 {
         struct snd_soc_dpcm *dpcm;
@@ -2027,7 +2067,7 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream)
 
         dev_dbg(fe->dev, "ASoC: prepare FE %s\n", fe->dai_link->name);
 
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_FE);
 
         /* there is no point preparing this FE if there are no BEs */
         if (list_empty(&fe->dpcm[stream].be_clients)) {
@@ -2054,7 +2094,7 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream)
         fe->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE;
 
 out:
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
         mutex_unlock(&fe->card->mutex);
 
         return ret;
@@ -2201,11 +2241,11 @@ static int dpcm_run_new_update(struct snd_soc_pcm_runtime *fe, int stream)
 {
         int ret;
 
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_BE;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_BE);
         ret = dpcm_run_update_startup(fe, stream);
         if (ret < 0)
                 dev_err(fe->dev, "ASoC: failed to startup some BEs\n");
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
 
         return ret;
 }
@@ -2214,11 +2254,11 @@ static int dpcm_run_old_update(struct snd_soc_pcm_runtime *fe, int stream)
 {
         int ret;
 
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_BE;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_BE);
         ret = dpcm_run_update_shutdown(fe, stream);
         if (ret < 0)
                 dev_err(fe->dev, "ASoC: failed to shutdown some BEs\n");
-        fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+        dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
 
         return ret;
 }
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 2e4a9dbc51fa..6e354d326858 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2033,10 +2033,11 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
         cval->res = 1;
         cval->initialized = 1;
 
-        if (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR)
-                cval->control = UAC2_CX_CLOCK_SELECTOR;
-        else
+        if (state->mixer->protocol == UAC_VERSION_1)
                 cval->control = 0;
+        else /* UAC_VERSION_2 */
+                cval->control = (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR) ?
+                        UAC2_CX_CLOCK_SELECTOR : UAC2_SU_SELECTOR;
 
         namelist = kmalloc(sizeof(char *) * desc->bNrInPins, GFP_KERNEL);
         if (!namelist) {
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index f119a41ed9a9..8c9bf4b7aaf0 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -593,10 +593,10 @@ static int snd_nativeinstruments_control_get(struct snd_kcontrol *kcontrol,
         if (mixer->chip->shutdown)
                 ret = -ENODEV;
         else
-                ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), bRequest,
+                ret = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), bRequest,
                                   USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
                                   0, wIndex,
-                                  &tmp, sizeof(tmp), 1000);
+                                  &tmp, sizeof(tmp));
         up_read(&mixer->chip->shutdown_rwsem);
 
         if (ret < 0) {
@@ -885,6 +885,11 @@ static int snd_ftu_eff_switch_put(struct snd_kcontrol *kctl,
         return changed;
 }
 
+static void kctl_private_value_free(struct snd_kcontrol *kctl)
+{
+        kfree((void *)kctl->private_value);
+}
+
 static int snd_ftu_create_effect_switch(struct usb_mixer_interface *mixer,
         int validx, int bUnitID)
 {
@@ -919,6 +924,7 @@ static int snd_ftu_create_effect_switch(struct usb_mixer_interface *mixer,
                 return -ENOMEM;
         }
 
+        kctl->private_free = kctl_private_value_free;
         err = snd_ctl_add(mixer->chip->card, kctl);
         if (err < 0)
                 return err;
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index d2aa45a8d895..60dfe0d28771 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1146,6 +1146,20 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
         if ((le16_to_cpu(dev->descriptor.idVendor) == 0x23ba) &&
             (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
                 mdelay(20);
+
+        /* Marantz/Denon devices with USB DAC functionality need a delay
+         * after each class compliant request
+         */
+        if ((le16_to_cpu(dev->descriptor.idVendor) == 0x154e) &&
+            (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) {
+
+                switch (le16_to_cpu(dev->descriptor.idProduct)) {
+                case 0x3005: /* Marantz HD-DAC1 */
+                case 0x3006: /* Marantz SA-14S1 */
+                        mdelay(20);
+                        break;
+                }
+        }
 }
 
 /*
@@ -1179,12 +1193,12 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
         /* iFi Audio micro/nano iDSD */
         case USB_ID(0x20b1, 0x3008):
                 if (fp->altsetting == 2)
-                        return SNDRV_PCM_FMTBIT_DSD_U32_LE;
+                        return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
         /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */
         case USB_ID(0x20b1, 0x2009):
                 if (fp->altsetting == 3)
-                        return SNDRV_PCM_FMTBIT_DSD_U32_LE;
+                        return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
         default:
                 break;
diff --git a/tools/testing/selftests/net/psock_fanout.c b/tools/testing/selftests/net/psock_fanout.c
index 57b9c2b7c4ff..6f6733331d95 100644
--- a/tools/testing/selftests/net/psock_fanout.c
+++ b/tools/testing/selftests/net/psock_fanout.c
@@ -128,7 +128,7 @@ static int sock_fanout_read_ring(int fd, void *ring)
         struct tpacket2_hdr *header = ring;
         int count = 0;
 
-        while (header->tp_status & TP_STATUS_USER && count < RING_NUM_FRAMES) {
+        while (count < RING_NUM_FRAMES && header->tp_status & TP_STATUS_USER) {
                 count++;
                 header = ring + (count * getpagesize());
         }
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 3aaca49de325..aacdb59f30de 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -1933,7 +1933,7 @@ out:
 
 int kvm_vgic_create(struct kvm *kvm)
 {
-        int i, vcpu_lock_idx = -1, ret = 0;
+        int i, vcpu_lock_idx = -1, ret;
         struct kvm_vcpu *vcpu;
 
         mutex_lock(&kvm->lock);
@@ -1948,6 +1948,7 @@ int kvm_vgic_create(struct kvm *kvm)
          * vcpu->mutex.  By grabbing the vcpu->mutex of all VCPUs we ensure
          * that no other VCPUs are run while we create the vgic.
          */
+        ret = -EBUSY;
         kvm_for_each_vcpu(i, vcpu, kvm) {
                 if (!mutex_trylock(&vcpu->mutex))
                         goto out_unlock;
@@ -1955,11 +1956,10 @@ int kvm_vgic_create(struct kvm *kvm)
         }
 
         kvm_for_each_vcpu(i, vcpu, kvm) {
-                if (vcpu->arch.has_run_once) {
-                        ret = -EBUSY;
+                if (vcpu->arch.has_run_once)
                         goto out_unlock;
-                }
         }
+        ret = 0;
 
         spin_lock_init(&kvm->arch.vgic.lock);
         kvm->arch.vgic.in_kernel = true;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 25ffac9e947d..3cee7b167052 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -107,10 +107,10 @@ EXPORT_SYMBOL_GPL(kvm_rebooting);
 
 static bool largepages_enabled = true;
 
-bool kvm_is_mmio_pfn(pfn_t pfn)
+bool kvm_is_reserved_pfn(pfn_t pfn)
 {
         if (pfn_valid(pfn))
-                return !is_zero_pfn(pfn) && PageReserved(pfn_to_page(pfn));
+                return PageReserved(pfn_to_page(pfn));
 
         return true;
 }
@@ -1321,7 +1321,7 @@ static pfn_t hva_to_pfn(unsigned long addr, bool atomic, bool *async,
         else if ((vma->vm_flags & VM_PFNMAP)) {
                 pfn = ((addr - vma->vm_start) >> PAGE_SHIFT) +
                         vma->vm_pgoff;
-                BUG_ON(!kvm_is_mmio_pfn(pfn));
+                BUG_ON(!kvm_is_reserved_pfn(pfn));
         } else {
                 if (async && vma_is_valid(vma, write_fault))
                         *async = true;
@@ -1427,7 +1427,7 @@ static struct page *kvm_pfn_to_page(pfn_t pfn)
         if (is_error_noslot_pfn(pfn))
                 return KVM_ERR_PTR_BAD_PAGE;
 
-        if (kvm_is_mmio_pfn(pfn)) {
+        if (kvm_is_reserved_pfn(pfn)) {
                 WARN_ON(1);
                 return KVM_ERR_PTR_BAD_PAGE;
         }
@@ -1456,7 +1456,7 @@ EXPORT_SYMBOL_GPL(kvm_release_page_clean);
 
 void kvm_release_pfn_clean(pfn_t pfn)
 {
-        if (!is_error_noslot_pfn(pfn) && !kvm_is_mmio_pfn(pfn))
+        if (!is_error_noslot_pfn(pfn) && !kvm_is_reserved_pfn(pfn))
                 put_page(pfn_to_page(pfn));
 }
 EXPORT_SYMBOL_GPL(kvm_release_pfn_clean);
@@ -1477,7 +1477,7 @@ static void kvm_release_pfn_dirty(pfn_t pfn)
 
 void kvm_set_pfn_dirty(pfn_t pfn)
 {
-        if (!kvm_is_mmio_pfn(pfn)) {
+        if (!kvm_is_reserved_pfn(pfn)) {
                 struct page *page = pfn_to_page(pfn);
                 if (!PageReserved(page))
                         SetPageDirty(page);
@@ -1487,14 +1487,14 @@ EXPORT_SYMBOL_GPL(kvm_set_pfn_dirty);
 
 void kvm_set_pfn_accessed(pfn_t pfn)
 {
-        if (!kvm_is_mmio_pfn(pfn))
+        if (!kvm_is_reserved_pfn(pfn))
                 mark_page_accessed(pfn_to_page(pfn));
 }
 EXPORT_SYMBOL_GPL(kvm_set_pfn_accessed);
 
 void kvm_get_pfn(pfn_t pfn)
 {
-        if (!kvm_is_mmio_pfn(pfn))
+        if (!kvm_is_reserved_pfn(pfn))
                 get_page(pfn_to_page(pfn));
 }
 EXPORT_SYMBOL_GPL(kvm_get_pfn);