Linux patch 4.1.54.1-9

2 files changed, 5754 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index ceda226c..148063b2 100644
--- a/0000_README
+++ b/0000_README
@@ -59,6 +59,10 @@ Patch:  1003_linux-4.1.4.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.1.4
 
+Patch:  1004_linux-4.1.5.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.1.5
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1004_linux-4.1.5.patch b/1004_linux-4.1.5.patch
new file mode 100644
index 00000000..ed56bc89
--- /dev/null
+++ b/1004_linux-4.1.5.patch
@@ -0,0 +1,5750 @@
+diff --git a/Documentation/hwmon/nct7904 b/Documentation/hwmon/nct7904
+index 014f112e2a14..57fffe33ebfc 100644
+--- a/Documentation/hwmon/nct7904
++++ b/Documentation/hwmon/nct7904
+@@ -35,11 +35,11 @@ temp1_input		Local temperature (1/1000 degree,
+ temp[2-9]_input		CPU temperatures (1/1000 degree,
+ 			0.125 degree resolution)
+ 
+-fan[1-4]_mode		R/W, 0/1 for manual or SmartFan mode
++pwm[1-4]_enable		R/W, 1/2 for manual or SmartFan mode
+ 			Setting SmartFan mode is supported only if it has been
+ 			previously configured by BIOS (or configuration EEPROM)
+ 
+-fan[1-4]_pwm		R/O in SmartFan mode, R/W in manual control mode
++pwm[1-4]		R/O in SmartFan mode, R/W in manual control mode
+ 
+ The driver checks sensor control registers and does not export the sensors
+ that are not enabled. Anyway, a sensor that is enabled may actually be not
+diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
+index 74b6c6d97210..d2b1c40cb666 100644
+--- a/Documentation/kbuild/makefiles.txt
++++ b/Documentation/kbuild/makefiles.txt
+@@ -952,6 +952,14 @@ When kbuild executes, the following steps are followed (roughly):
+ 	$(KBUILD_ARFLAGS) set by the top level Makefile to "D" (deterministic
+ 	mode) if this option is supported by $(AR).
+ 
++    ARCH_CPPFLAGS, ARCH_AFLAGS, ARCH_CFLAGS   Overrides the kbuild defaults
++
++	These variables are appended to the KBUILD_CPPFLAGS,
++	KBUILD_AFLAGS, and KBUILD_CFLAGS, respectively, after the
++	top-level Makefile has set any other flags. This provides a
++	means for an architecture to override the defaults.
++
++
+ --- 6.2 Add prerequisites to archheaders:
+ 
+ 	The archheaders: rule is used to generate header files that
+diff --git a/Makefile b/Makefile
+index 36f3225cdf1f..068dd690933d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 1
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Series 4800
+ 
+@@ -783,10 +783,11 @@ endif
+ include scripts/Makefile.kasan
+ include scripts/Makefile.extrawarn
+ 
+-# Add user supplied CPPFLAGS, AFLAGS and CFLAGS as the last assignments
+-KBUILD_CPPFLAGS += $(KCPPFLAGS)
+-KBUILD_AFLAGS += $(KAFLAGS)
+-KBUILD_CFLAGS += $(KCFLAGS)
++# Add any arch overrides and user supplied CPPFLAGS, AFLAGS and CFLAGS as the
++# last assignments
++KBUILD_CPPFLAGS += $(ARCH_CPPFLAGS) $(KCPPFLAGS)
++KBUILD_AFLAGS   += $(ARCH_AFLAGS)   $(KAFLAGS)
++KBUILD_CFLAGS   += $(ARCH_CFLAGS)   $(KCFLAGS)
+ 
+ # Use --build-id when available.
+ LDFLAGS_BUILD_ID = $(patsubst -Wl$(comma)%,%,\
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index db72fec0e160..2f21e1e0ecf7 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -43,7 +43,8 @@ endif
+ 
+ ifndef CONFIG_CC_OPTIMIZE_FOR_SIZE
+ # Generic build system uses -O2, we want -O3
+-cflags-y  += -O3
++# Note: No need to add to cflags-y as that happens anyways
++ARCH_CFLAGS += -O3
+ endif
+ 
+ # small data is default for elf32 tool-chain. If not usable, disable it
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index 624a9d048ca9..dae03e66fa9e 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -18,83 +18,49 @@
+ #include <linux/types.h>
+ #include <linux/compiler.h>
+ #include <asm/barrier.h>
++#ifndef CONFIG_ARC_HAS_LLSC
++#include <asm/smp.h>
++#endif
+ 
+-/*
+- * Hardware assisted read-modify-write using ARC700 LLOCK/SCOND insns.
+- * The Kconfig glue ensures that in SMP, this is only set if the container
+- * SoC/platform has cross-core coherent LLOCK/SCOND
+- */
+ #if defined(CONFIG_ARC_HAS_LLSC)
+ 
+-static inline void set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned int temp;
+-
+-	m += nr >> 5;
+-
+-	/*
+-	 * ARC ISA micro-optimization:
+-	 *
+-	 * Instructions dealing with bitpos only consider lower 5 bits (0-31)
+-	 * e.g (x << 33) is handled like (x << 1) by ASL instruction
+-	 *  (mem pointer still needs adjustment to point to next word)
+-	 *
+-	 * Hence the masking to clamp @nr arg can be elided in general.
+-	 *
+-	 * However if @nr is a constant (above assumed it in a register),
+-	 * and greater than 31, gcc can optimize away (x << 33) to 0,
+-	 * as overflow, given the 32-bit ISA. Thus masking needs to be done
+-	 * for constant @nr, but no code is generated due to const prop.
+-	 */
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%1]	\n"
+-	"	bset    %0, %0, %2	\n"
+-	"	scond   %0, [%1]	\n"
+-	"	bnz     1b	\n"
+-	: "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
+-}
+-
+-static inline void clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned int temp;
+-
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%1]	\n"
+-	"	bclr    %0, %0, %2	\n"
+-	"	scond   %0, [%1]	\n"
+-	"	bnz     1b	\n"
+-	: "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
+-}
+-
+-static inline void change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned int temp;
+-
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
++/*
++ * Hardware assisted Atomic-R-M-W
++ */
+ 
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%1]	\n"
+-	"	bxor    %0, %0, %2	\n"
+-	"	scond   %0, [%1]	\n"
+-	"	bnz     1b		\n"
+-	: "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
++#define BIT_OP(op, c_op, asm_op)					\
++static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\
++{									\
++	unsigned int temp;						\
++									\
++	m += nr >> 5;							\
++									\
++	/*								\
++	 * ARC ISA micro-optimization:					\
++	 *								\
++	 * Instructions dealing with bitpos only consider lower 5 bits	\
++	 * e.g (x << 33) is handled like (x << 1) by ASL instruction	\
++	 *  (mem pointer still needs adjustment to point to next word)	\
++	 *								\
++	 * Hence the masking to clamp @nr arg can be elided in general.	\
++	 *								\
++	 * However if @nr is a constant (above assumed in a register),	\
++	 * and greater than 31, gcc can optimize away (x << 33) to 0,	\
++	 * as overflow, given the 32-bit ISA. Thus masking needs to be	\
++	 * done for const @nr, but no code is generated due to gcc	\
++	 * const prop.							\
++	 */								\
++	nr &= 0x1f;							\
++									\
++	__asm__ __volatile__(						\
++	"1:	llock       %0, [%1]		\n"			\
++	"	" #asm_op " %0, %0, %2	\n"				\
++	"	scond       %0, [%1]		\n"			\
++	"	bnz         1b			\n"			\
++	: "=&r"(temp)	/* Early clobber, to prevent reg reuse */	\
++	: "r"(m),	/* Not "m": llock only supports reg direct addr mode */	\
++	  "ir"(nr)							\
++	: "cc");							\
+ }
+ 
+ /*
+@@ -108,91 +74,37 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *m)
+  * Since ARC lacks a equivalent h/w primitive, the bit is set unconditionally
+  * and the old value of bit is returned
+  */
+-static inline int test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old, temp;
+-
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	/*
+-	 * Explicit full memory barrier needed before/after as
+-	 * LLOCK/SCOND themselves don't provide any such semantics
+-	 */
+-	smp_mb();
+-
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%2]	\n"
+-	"	bset    %1, %0, %3	\n"
+-	"	scond   %1, [%2]	\n"
+-	"	bnz     1b		\n"
+-	: "=&r"(old), "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
+-
+-	smp_mb();
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned int old, temp;
+-
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	smp_mb();
+-
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%2]	\n"
+-	"	bclr    %1, %0, %3	\n"
+-	"	scond   %1, [%2]	\n"
+-	"	bnz     1b		\n"
+-	: "=&r"(old), "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
+-
+-	smp_mb();
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned int old, temp;
+-
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	smp_mb();
+-
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%2]	\n"
+-	"	bxor    %1, %0, %3	\n"
+-	"	scond   %1, [%2]	\n"
+-	"	bnz     1b		\n"
+-	: "=&r"(old), "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
+-
+-	smp_mb();
+-
+-	return (old & (1 << nr)) != 0;
++#define TEST_N_BIT_OP(op, c_op, asm_op)					\
++static inline int test_and_##op##_bit(unsigned long nr, volatile unsigned long *m)\
++{									\
++	unsigned long old, temp;					\
++									\
++	m += nr >> 5;							\
++									\
++	nr &= 0x1f;							\
++									\
++	/*								\
++	 * Explicit full memory barrier needed before/after as		\
++	 * LLOCK/SCOND themselves don't provide any such smenatic	\
++	 */								\
++	smp_mb();							\
++									\
++	__asm__ __volatile__(						\
++	"1:	llock       %0, [%2]	\n"				\
++	"	" #asm_op " %1, %0, %3	\n"				\
++	"	scond       %1, [%2]	\n"				\
++	"	bnz         1b		\n"				\
++	: "=&r"(old), "=&r"(temp)					\
++	: "r"(m), "ir"(nr)						\
++	: "cc");							\
++									\
++	smp_mb();							\
++									\
++	return (old & (1 << nr)) != 0;					\
+ }
+ 
+ #else	/* !CONFIG_ARC_HAS_LLSC */
+ 
+-#include <asm/smp.h>
+-
+ /*
+  * Non hardware assisted Atomic-R-M-W
+  * Locking would change to irq-disabling only (UP) and spinlocks (SMP)
+@@ -209,111 +121,37 @@ test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+  *             at compile time)
+  */
+ 
+-static inline void set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	bitops_lock(flags);
+-
+-	temp = *m;
+-	*m = temp | (1UL << nr);
+-
+-	bitops_unlock(flags);
++#define BIT_OP(op, c_op, asm_op)					\
++static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\
++{									\
++	unsigned long temp, flags;					\
++	m += nr >> 5;							\
++									\
++	/*								\
++	 * spin lock/unlock provide the needed smp_mb() before/after	\
++	 */								\
++	bitops_lock(flags);						\
++									\
++	temp = *m;							\
++	*m = temp c_op (1UL << (nr & 0x1f));					\
++									\
++	bitops_unlock(flags);						\
+ }
+ 
+-static inline void clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	bitops_lock(flags);
+-
+-	temp = *m;
+-	*m = temp & ~(1UL << nr);
+-
+-	bitops_unlock(flags);
+-}
+-
+-static inline void change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	bitops_lock(flags);
+-
+-	temp = *m;
+-	*m = temp ^ (1UL << nr);
+-
+-	bitops_unlock(flags);
+-}
+-
+-static inline int test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	/*
+-	 * spin lock/unlock provide the needed smp_mb() before/after
+-	 */
+-	bitops_lock(flags);
+-
+-	old = *m;
+-	*m = old | (1 << nr);
+-
+-	bitops_unlock(flags);
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	bitops_lock(flags);
+-
+-	old = *m;
+-	*m = old & ~(1 << nr);
+-
+-	bitops_unlock(flags);
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	bitops_lock(flags);
+-
+-	old = *m;
+-	*m = old ^ (1 << nr);
+-
+-	bitops_unlock(flags);
+-
+-	return (old & (1 << nr)) != 0;
++#define TEST_N_BIT_OP(op, c_op, asm_op)					\
++static inline int test_and_##op##_bit(unsigned long nr, volatile unsigned long *m)\
++{									\
++	unsigned long old, flags;					\
++	m += nr >> 5;							\
++									\
++	bitops_lock(flags);						\
++									\
++	old = *m;							\
++	*m = old c_op (1UL << (nr & 0x1f));				\
++									\
++	bitops_unlock(flags);						\
++									\
++	return (old & (1UL << (nr & 0x1f))) != 0;			\
+ }
+ 
+ #endif /* CONFIG_ARC_HAS_LLSC */
+@@ -322,86 +160,45 @@ test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+  * Non atomic variants
+  **************************************/
+ 
+-static inline void __set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	temp = *m;
+-	*m = temp | (1UL << nr);
++#define __BIT_OP(op, c_op, asm_op)					\
++static inline void __##op##_bit(unsigned long nr, volatile unsigned long *m)	\
++{									\
++	unsigned long temp;						\
++	m += nr >> 5;							\
++									\
++	temp = *m;							\
++	*m = temp c_op (1UL << (nr & 0x1f));				\
+ }
+ 
+-static inline void __clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	temp = *m;
+-	*m = temp & ~(1UL << nr);
++#define __TEST_N_BIT_OP(op, c_op, asm_op)				\
++static inline int __test_and_##op##_bit(unsigned long nr, volatile unsigned long *m)\
++{									\
++	unsigned long old;						\
++	m += nr >> 5;							\
++									\
++	old = *m;							\
++	*m = old c_op (1UL << (nr & 0x1f));				\
++									\
++	return (old & (1UL << (nr & 0x1f))) != 0;			\
+ }
+ 
+-static inline void __change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	temp = *m;
+-	*m = temp ^ (1UL << nr);
+-}
+-
+-static inline int
+-__test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	old = *m;
+-	*m = old | (1 << nr);
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-__test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	old = *m;
+-	*m = old & ~(1 << nr);
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-__test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	old = *m;
+-	*m = old ^ (1 << nr);
+-
+-	return (old & (1 << nr)) != 0;
+-}
++#define BIT_OPS(op, c_op, asm_op)					\
++									\
++	/* set_bit(), clear_bit(), change_bit() */			\
++	BIT_OP(op, c_op, asm_op)					\
++									\
++	/* test_and_set_bit(), test_and_clear_bit(), test_and_change_bit() */\
++	TEST_N_BIT_OP(op, c_op, asm_op)					\
++									\
++	/* __set_bit(), __clear_bit(), __change_bit() */		\
++	__BIT_OP(op, c_op, asm_op)					\
++									\
++	/* __test_and_set_bit(), __test_and_clear_bit(), __test_and_change_bit() */\
++	__TEST_N_BIT_OP(op, c_op, asm_op)
++
++BIT_OPS(set, |, bset)
++BIT_OPS(clear, & ~, bclr)
++BIT_OPS(change, ^, bxor)
+ 
+ /*
+  * This routine doesn't need to be atomic.
+@@ -413,10 +210,7 @@ test_bit(unsigned int nr, const volatile unsigned long *addr)
+ 
+ 	addr += nr >> 5;
+ 
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	mask = 1 << nr;
++	mask = 1UL << (nr & 0x1f);
+ 
+ 	return ((mask & *addr) != 0);
+ }
+diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
+index 1bfeec2c0558..2a58af7a2e3a 100644
+--- a/arch/arc/include/asm/ptrace.h
++++ b/arch/arc/include/asm/ptrace.h
+@@ -63,7 +63,7 @@ struct callee_regs {
+ 	long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
+ };
+ 
+-#define instruction_pointer(regs)	((regs)->ret)
++#define instruction_pointer(regs)	(unsigned long)((regs)->ret)
+ #define profile_pc(regs)		instruction_pointer(regs)
+ 
+ /* return 1 if user mode or 0 if kernel mode */
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15.dts b/arch/arm/boot/dts/am57xx-beagle-x15.dts
+index 7128fad991ac..c9df40e5cd3b 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15.dts
++++ b/arch/arm/boot/dts/am57xx-beagle-x15.dts
+@@ -544,6 +544,10 @@
+ 	phy-supply = <&ldousb_reg>;
+ };
+ 
++&usb2_phy2 {
++	phy-supply = <&ldousb_reg>;
++};
++
+ &usb1 {
+ 	dr_mode = "host";
+ 	pinctrl-names = "default";
+diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
+index aa465904f6cc..096f68be99e2 100644
+--- a/arch/arm/boot/dts/dra7-evm.dts
++++ b/arch/arm/boot/dts/dra7-evm.dts
+@@ -686,7 +686,8 @@
+ 
+ &dcan1 {
+ 	status = "ok";
+-	pinctrl-names = "default", "sleep";
+-	pinctrl-0 = <&dcan1_pins_default>;
++	pinctrl-names = "default", "sleep", "active";
++	pinctrl-0 = <&dcan1_pins_sleep>;
+ 	pinctrl-1 = <&dcan1_pins_sleep>;
++	pinctrl-2 = <&dcan1_pins_default>;
+ };
+diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
+index ce0390f081d9..6b05f6a0ba84 100644
+--- a/arch/arm/boot/dts/dra72-evm.dts
++++ b/arch/arm/boot/dts/dra72-evm.dts
+@@ -497,9 +497,10 @@
+ 
+ &dcan1 {
+ 	status = "ok";
+-	pinctrl-names = "default", "sleep";
+-	pinctrl-0 = <&dcan1_pins_default>;
++	pinctrl-names = "default", "sleep", "active";
++	pinctrl-0 = <&dcan1_pins_sleep>;
+ 	pinctrl-1 = <&dcan1_pins_sleep>;
++	pinctrl-2 = <&dcan1_pins_default>;
+ };
+ 
+ &qspi {
+diff --git a/arch/arm/mach-imx/gpc.c b/arch/arm/mach-imx/gpc.c
+index 6d0893a3828e..78b6fd0b86e6 100644
+--- a/arch/arm/mach-imx/gpc.c
++++ b/arch/arm/mach-imx/gpc.c
+@@ -291,8 +291,6 @@ void __init imx_gpc_check_dt(void)
+ 	}
+ }
+ 
+-#ifdef CONFIG_PM_GENERIC_DOMAINS
+-
+ static void _imx6q_pm_pu_power_off(struct generic_pm_domain *genpd)
+ {
+ 	int iso, iso2sw;
+@@ -399,7 +397,6 @@ static struct genpd_onecell_data imx_gpc_onecell_data = {
+ static int imx_gpc_genpd_init(struct device *dev, struct regulator *pu_reg)
+ {
+ 	struct clk *clk;
+-	bool is_off;
+ 	int i;
+ 
+ 	imx6q_pu_domain.reg = pu_reg;
+@@ -416,18 +413,13 @@ static int imx_gpc_genpd_init(struct device *dev, struct regulator *pu_reg)
+ 	}
+ 	imx6q_pu_domain.num_clks = i;
+ 
+-	is_off = IS_ENABLED(CONFIG_PM);
+-	if (is_off) {
+-		_imx6q_pm_pu_power_off(&imx6q_pu_domain.base);
+-	} else {
+-		/*
+-		 * Enable power if compiled without CONFIG_PM in case the
+-		 * bootloader disabled it.
+-		 */
+-		imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
+-	}
++	/* Enable power always in case bootloader disabled it. */
++	imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
++
++	if (!IS_ENABLED(CONFIG_PM_GENERIC_DOMAINS))
++		return 0;
+ 
+-	pm_genpd_init(&imx6q_pu_domain.base, NULL, is_off);
++	pm_genpd_init(&imx6q_pu_domain.base, NULL, false);
+ 	return of_genpd_add_provider_onecell(dev->of_node,
+ 					     &imx_gpc_onecell_data);
+ 
+@@ -437,13 +429,6 @@ clk_err:
+ 	return -EINVAL;
+ }
+ 
+-#else
+-static inline int imx_gpc_genpd_init(struct device *dev, struct regulator *reg)
+-{
+-	return 0;
+-}
+-#endif /* CONFIG_PM_GENERIC_DOMAINS */
+-
+ static int imx_gpc_probe(struct platform_device *pdev)
+ {
+ 	struct regulator *pu_reg;
+diff --git a/arch/arm/mach-pxa/capc7117.c b/arch/arm/mach-pxa/capc7117.c
+index c092730749b9..bf366b39fa61 100644
+--- a/arch/arm/mach-pxa/capc7117.c
++++ b/arch/arm/mach-pxa/capc7117.c
+@@ -24,6 +24,7 @@
+ #include <linux/ata_platform.h>
+ #include <linux/serial_8250.h>
+ #include <linux/gpio.h>
++#include <linux/regulator/machine.h>
+ 
+ #include <asm/mach-types.h>
+ #include <asm/mach/arch.h>
+@@ -144,6 +145,8 @@ static void __init capc7117_init(void)
+ 
+ 	capc7117_uarts_init();
+ 	capc7117_ide_init();
++
++	regulator_has_full_constraints();
+ }
+ 
+ MACHINE_START(CAPC7117,
+diff --git a/arch/arm/mach-pxa/cm-x2xx.c b/arch/arm/mach-pxa/cm-x2xx.c
+index bb99f59a36d8..a17a91eb8e9a 100644
+--- a/arch/arm/mach-pxa/cm-x2xx.c
++++ b/arch/arm/mach-pxa/cm-x2xx.c
+@@ -13,6 +13,7 @@
+ #include <linux/syscore_ops.h>
+ #include <linux/irq.h>
+ #include <linux/gpio.h>
++#include <linux/regulator/machine.h>
+ 
+ #include <linux/dm9000.h>
+ #include <linux/leds.h>
+@@ -466,6 +467,8 @@ static void __init cmx2xx_init(void)
+ 	cmx2xx_init_ac97();
+ 	cmx2xx_init_touchscreen();
+ 	cmx2xx_init_leds();
++
++	regulator_has_full_constraints();
+ }
+ 
+ static void __init cmx2xx_init_irq(void)
+diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
+index 4d3588d26c2a..5851f4c254c1 100644
+--- a/arch/arm/mach-pxa/cm-x300.c
++++ b/arch/arm/mach-pxa/cm-x300.c
+@@ -835,6 +835,8 @@ static void __init cm_x300_init(void)
+ 	cm_x300_init_ac97();
+ 	cm_x300_init_wi2wi();
+ 	cm_x300_init_bl();
++
++	regulator_has_full_constraints();
+ }
+ 
+ static void __init cm_x300_fixup(struct tag *tags, char **cmdline)
+diff --git a/arch/arm/mach-pxa/colibri-pxa270.c b/arch/arm/mach-pxa/colibri-pxa270.c
+index 5f9d9303b346..3503826333c7 100644
+--- a/arch/arm/mach-pxa/colibri-pxa270.c
++++ b/arch/arm/mach-pxa/colibri-pxa270.c
+@@ -18,6 +18,7 @@
+ #include <linux/mtd/partitions.h>
+ #include <linux/mtd/physmap.h>
+ #include <linux/platform_device.h>
++#include <linux/regulator/machine.h>
+ #include <linux/ucb1400.h>
+ 
+ #include <asm/mach/arch.h>
+@@ -294,6 +295,8 @@ static void __init colibri_pxa270_init(void)
+ 		printk(KERN_ERR "Illegal colibri_pxa270_baseboard type %d\n",
+ 				colibri_pxa270_baseboard);
+ 	}
++
++	regulator_has_full_constraints();
+ }
+ 
+ /* The "Income s.r.o. SH-Dmaster PXA270 SBC" board can be booted either
+diff --git a/arch/arm/mach-pxa/em-x270.c b/arch/arm/mach-pxa/em-x270.c
+index 51531ecffca8..9d7072b04045 100644
+--- a/arch/arm/mach-pxa/em-x270.c
++++ b/arch/arm/mach-pxa/em-x270.c
+@@ -1306,6 +1306,8 @@ static void __init em_x270_init(void)
+ 	em_x270_init_i2c();
+ 	em_x270_init_camera();
+ 	em_x270_userspace_consumers_init();
++
++	regulator_has_full_constraints();
+ }
+ 
+ MACHINE_START(EM_X270, "Compulab EM-X270")
+diff --git a/arch/arm/mach-pxa/icontrol.c b/arch/arm/mach-pxa/icontrol.c
+index c98511c5abd1..9b0eb0252af6 100644
+--- a/arch/arm/mach-pxa/icontrol.c
++++ b/arch/arm/mach-pxa/icontrol.c
+@@ -26,6 +26,7 @@
+ #include <linux/spi/spi.h>
+ #include <linux/spi/pxa2xx_spi.h>
+ #include <linux/can/platform/mcp251x.h>
++#include <linux/regulator/machine.h>
+ 
+ #include "generic.h"
+ 
+@@ -185,6 +186,8 @@ static void __init icontrol_init(void)
+ 	mxm_8x10_mmc_init();
+ 
+ 	icontrol_can_init();
++
++	regulator_has_full_constraints();
+ }
+ 
+ MACHINE_START(ICONTROL, "iControl/SafeTcam boards using Embedian MXM-8x10 CoM")
+diff --git a/arch/arm/mach-pxa/trizeps4.c b/arch/arm/mach-pxa/trizeps4.c
+index 872dcb20e757..066e3a250ee0 100644
+--- a/arch/arm/mach-pxa/trizeps4.c
++++ b/arch/arm/mach-pxa/trizeps4.c
+@@ -26,6 +26,7 @@
+ #include <linux/dm9000.h>
+ #include <linux/mtd/physmap.h>
+ #include <linux/mtd/partitions.h>
++#include <linux/regulator/machine.h>
+ #include <linux/i2c/pxa-i2c.h>
+ 
+ #include <asm/types.h>
+@@ -534,6 +535,8 @@ static void __init trizeps4_init(void)
+ 
+ 	BCR_writew(trizeps_conxs_bcr);
+ 	board_backlight_power(1);
++
++	regulator_has_full_constraints();
+ }
+ 
+ static void __init trizeps4_map_io(void)
+diff --git a/arch/arm/mach-pxa/vpac270.c b/arch/arm/mach-pxa/vpac270.c
+index aa89488f961e..54122a983ae3 100644
+--- a/arch/arm/mach-pxa/vpac270.c
++++ b/arch/arm/mach-pxa/vpac270.c
+@@ -24,6 +24,7 @@
+ #include <linux/dm9000.h>
+ #include <linux/ucb1400.h>
+ #include <linux/ata_platform.h>
++#include <linux/regulator/machine.h>
+ #include <linux/regulator/max1586.h>
+ #include <linux/i2c/pxa-i2c.h>
+ 
+@@ -711,6 +712,8 @@ static void __init vpac270_init(void)
+ 	vpac270_ts_init();
+ 	vpac270_rtc_init();
+ 	vpac270_ide_init();
++
++	regulator_has_full_constraints();
+ }
+ 
+ MACHINE_START(VPAC270, "Voipac PXA270")
+diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
+index ac2ae5c71ab4..6158566fa0f7 100644
+--- a/arch/arm/mach-pxa/zeus.c
++++ b/arch/arm/mach-pxa/zeus.c
+@@ -868,6 +868,8 @@ static void __init zeus_init(void)
+ 	i2c_register_board_info(0, ARRAY_AND_SIZE(zeus_i2c_devices));
+ 	pxa2xx_set_spi_info(3, &pxa2xx_spi_ssp3_master_info);
+ 	spi_register_board_info(zeus_spi_board_info, ARRAY_SIZE(zeus_spi_board_info));
++
++	regulator_has_full_constraints();
+ }
+ 
+ static struct map_desc zeus_io_desc[] __initdata = {
+diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
+index 7e7583ddd607..6e4b9ff22ef3 100644
+--- a/arch/arm/mm/dma-mapping.c
++++ b/arch/arm/mm/dma-mapping.c
+@@ -1953,7 +1953,7 @@ static int extend_iommu_mapping(struct dma_iommu_mapping *mapping)
+ {
+ 	int next_bitmap;
+ 
+-	if (mapping->nr_bitmaps > mapping->extensions)
++	if (mapping->nr_bitmaps >= mapping->extensions)
+ 		return -EINVAL;
+ 
+ 	next_bitmap = mapping->nr_bitmaps;
+diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
+index ab21e0d58278..352962bc2e78 100644
+--- a/arch/arm64/kernel/efi.c
++++ b/arch/arm64/kernel/efi.c
+@@ -122,12 +122,12 @@ static int __init uefi_init(void)
+ 
+ 	/* Show what we know for posterity */
+ 	c16 = early_memremap(efi_to_phys(efi.systab->fw_vendor),
+-			     sizeof(vendor));
++			     sizeof(vendor) * sizeof(efi_char16_t));
+ 	if (c16) {
+ 		for (i = 0; i < (int) sizeof(vendor) - 1 && *c16; ++i)
+ 			vendor[i] = c16[i];
+ 		vendor[i] = '\0';
+-		early_memunmap(c16, sizeof(vendor));
++		early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
+ 	}
+ 
+ 	pr_info("EFI v%u.%.02u by %s\n",
+diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
+index 23b1a97fae7a..52c179bec0cc 100644
+--- a/arch/avr32/mach-at32ap/clock.c
++++ b/arch/avr32/mach-at32ap/clock.c
+@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk)
+ {
+ 	unsigned long flags;
+ 
++	if (!clk)
++		return 0;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	__clk_enable(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk)
+ {
+ 	unsigned long flags;
+ 
++	if (IS_ERR_OR_NULL(clk))
++		return;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	__clk_disable(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk)
+ 	unsigned long flags;
+ 	unsigned long rate;
+ 
++	if (!clk)
++		return 0;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	rate = clk->get_rate(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
+ {
+ 	unsigned long flags, actual_rate;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_rate)
+ 		return -ENOSYS;
+ 
+@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
+ 	unsigned long flags;
+ 	long ret;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_rate)
+ 		return -ENOSYS;
+ 
+@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent)
+ 	unsigned long flags;
+ 	int ret;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_parent)
+ 		return -ENOSYS;
+ 
+@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent);
+ 
+ struct clk *clk_get_parent(struct clk *clk)
+ {
+-	return clk->parent;
++	return !clk ? NULL : clk->parent;
+ }
+ EXPORT_SYMBOL(clk_get_parent);
+ 
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index f5016656494f..a3b1ffe50aa0 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -1417,6 +1417,7 @@ config CPU_MIPS64_R6
+ 	select CPU_SUPPORTS_HIGHMEM
+ 	select CPU_SUPPORTS_MSA
+ 	select GENERIC_CSUM
++	select MIPS_O32_FP64_SUPPORT if MIPS32_O32
+ 	help
+ 	  Choose this option to build a kernel for release 6 or later of the
+ 	  MIPS64 architecture.  New MIPS processors, starting with the Warrior
+diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
+index 084780b355aa..1b0625189835 100644
+--- a/arch/mips/include/asm/fpu.h
++++ b/arch/mips/include/asm/fpu.h
+@@ -74,7 +74,7 @@ static inline int __enable_fpu(enum fpu_mode mode)
+ 		goto fr_common;
+ 
+ 	case FPU_64BIT:
+-#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_CPU_MIPS32_R6) \
++#if !(defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) \
+       || defined(CONFIG_64BIT))
+ 		/* we only have a 32-bit FPU */
+ 		return SIGFPE;
+diff --git a/arch/mips/include/asm/smp.h b/arch/mips/include/asm/smp.h
+index 2b25d1ba1ea0..16f1ea9ab191 100644
+--- a/arch/mips/include/asm/smp.h
++++ b/arch/mips/include/asm/smp.h
+@@ -23,6 +23,7 @@
+ extern int smp_num_siblings;
+ extern cpumask_t cpu_sibling_map[];
+ extern cpumask_t cpu_core_map[];
++extern cpumask_t cpu_foreign_map;
+ 
+ #define raw_smp_processor_id() (current_thread_info()->cpu)
+ 
+diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
+index faa46ebd9dda..d0744cc77ea7 100644
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -63,6 +63,13 @@ EXPORT_SYMBOL(cpu_sibling_map);
+ cpumask_t cpu_core_map[NR_CPUS] __read_mostly;
+ EXPORT_SYMBOL(cpu_core_map);
+ 
++/*
++ * A logcal cpu mask containing only one VPE per core to
++ * reduce the number of IPIs on large MT systems.
++ */
++cpumask_t cpu_foreign_map __read_mostly;
++EXPORT_SYMBOL(cpu_foreign_map);
++
+ /* representing cpus for which sibling maps can be computed */
+ static cpumask_t cpu_sibling_setup_map;
+ 
+@@ -103,6 +110,29 @@ static inline void set_cpu_core_map(int cpu)
+ 	}
+ }
+ 
++/*
++ * Calculate a new cpu_foreign_map mask whenever a
++ * new cpu appears or disappears.
++ */
++static inline void calculate_cpu_foreign_map(void)
++{
++	int i, k, core_present;
++	cpumask_t temp_foreign_map;
++
++	/* Re-calculate the mask */
++	for_each_online_cpu(i) {
++		core_present = 0;
++		for_each_cpu(k, &temp_foreign_map)
++			if (cpu_data[i].package == cpu_data[k].package &&
++			    cpu_data[i].core == cpu_data[k].core)
++				core_present = 1;
++		if (!core_present)
++			cpumask_set_cpu(i, &temp_foreign_map);
++	}
++
++	cpumask_copy(&cpu_foreign_map, &temp_foreign_map);
++}
++
+ struct plat_smp_ops *mp_ops;
+ EXPORT_SYMBOL(mp_ops);
+ 
+@@ -146,6 +176,8 @@ asmlinkage void start_secondary(void)
+ 	set_cpu_sibling_map(cpu);
+ 	set_cpu_core_map(cpu);
+ 
++	calculate_cpu_foreign_map();
++
+ 	cpumask_set_cpu(cpu, &cpu_callin_map);
+ 
+ 	synchronise_count_slave(cpu);
+@@ -173,9 +205,18 @@ void __irq_entry smp_call_function_interrupt(void)
+ static void stop_this_cpu(void *dummy)
+ {
+ 	/*
+-	 * Remove this CPU:
++	 * Remove this CPU. Be a bit slow here and
++	 * set the bits for every online CPU so we don't miss
++	 * any IPI whilst taking this VPE down.
+ 	 */
++
++	cpumask_copy(&cpu_foreign_map, cpu_online_mask);
++
++	/* Make it visible to every other CPU */
++	smp_mb();
++
+ 	set_cpu_online(smp_processor_id(), false);
++	calculate_cpu_foreign_map();
+ 	local_irq_disable();
+ 	while (1);
+ }
+@@ -197,6 +238,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
+ 	mp_ops->prepare_cpus(max_cpus);
+ 	set_cpu_sibling_map(0);
+ 	set_cpu_core_map(0);
++	calculate_cpu_foreign_map();
+ #ifndef CONFIG_HOTPLUG_CPU
+ 	init_cpu_present(cpu_possible_mask);
+ #endif
+diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
+index 22b9b2cb9219..6983fcd48131 100644
+--- a/arch/mips/math-emu/cp1emu.c
++++ b/arch/mips/math-emu/cp1emu.c
+@@ -451,7 +451,7 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
+ 			/* Fall through */
+ 		case jr_op:
+ 			/* For R6, JR already emulated in jalr_op */
+-			if (NO_R6EMU && insn.r_format.opcode == jr_op)
++			if (NO_R6EMU && insn.r_format.func == jr_op)
+ 				break;
+ 			*contpc = regs->regs[insn.r_format.rs];
+ 			return 1;
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index 2e03ab173591..dca0efc078c1 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -37,6 +37,7 @@
+ #include <asm/cacheflush.h> /* for run_uncached() */
+ #include <asm/traps.h>
+ #include <asm/dma-coherence.h>
++#include <asm/mips-cm.h>
+ 
+ /*
+  * Special Variant of smp_call_function for use by cache functions:
+@@ -51,9 +52,16 @@ static inline void r4k_on_each_cpu(void (*func) (void *info), void *info)
+ {
+ 	preempt_disable();
+ 
+-#ifndef CONFIG_MIPS_MT_SMP
+-	smp_call_function(func, info, 1);
+-#endif
++	/*
++	 * The Coherent Manager propagates address-based cache ops to other
++	 * cores but not index-based ops. However, r4k_on_each_cpu is used
++	 * in both cases so there is no easy way to tell what kind of op is
++	 * executed to the other cores. The best we can probably do is
++	 * to restrict that call when a CM is not present because both
++	 * CM-based SMP protocols (CMP & CPS) restrict index-based cache ops.
++	 */
++	if (!mips_cm_present())
++		smp_call_function_many(&cpu_foreign_map, func, info, 1);
+ 	func(info);
+ 	preempt_enable();
+ }
+diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
+index 3a08eae3318f..3edbb9fc91b4 100644
+--- a/arch/parisc/include/asm/pgalloc.h
++++ b/arch/parisc/include/asm/pgalloc.h
+@@ -72,7 +72,7 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
+ 
+ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+ {
+-	if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
++	if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED) {
+ 		/*
+ 		 * This is the permanent pmd attached to the pgd;
+ 		 * cannot free it.
+@@ -81,6 +81,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+ 		 */
+ 		mm_inc_nr_pmds(mm);
+ 		return;
++	}
+ 	free_pages((unsigned long)pmd, PMD_ORDER);
+ }
+ 
+diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
+index 0a183756d6ec..f93c4a4e6580 100644
+--- a/arch/parisc/include/asm/pgtable.h
++++ b/arch/parisc/include/asm/pgtable.h
+@@ -16,7 +16,7 @@
+ #include <asm/processor.h>
+ #include <asm/cache.h>
+ 
+-extern spinlock_t pa_dbit_lock;
++extern spinlock_t pa_tlb_lock;
+ 
+ /*
+  * kern_addr_valid(ADDR) tests if ADDR is pointing to valid kernel
+@@ -33,6 +33,19 @@ extern spinlock_t pa_dbit_lock;
+  */
+ #define kern_addr_valid(addr)	(1)
+ 
++/* Purge data and instruction TLB entries.  Must be called holding
++ * the pa_tlb_lock.  The TLB purge instructions are slow on SMP
++ * machines since the purge must be broadcast to all CPUs.
++ */
++
++static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
++{
++	mtsp(mm->context, 1);
++	pdtlb(addr);
++	if (unlikely(split_tlb))
++		pitlb(addr);
++}
++
+ /* Certain architectures need to do special things when PTEs
+  * within a page table are directly modified.  Thus, the following
+  * hook is made available.
+@@ -42,15 +55,20 @@ extern spinlock_t pa_dbit_lock;
+                 *(pteptr) = (pteval);                           \
+         } while(0)
+ 
+-extern void purge_tlb_entries(struct mm_struct *, unsigned long);
++#define pte_inserted(x)						\
++	((pte_val(x) & (_PAGE_PRESENT|_PAGE_ACCESSED))		\
++	 == (_PAGE_PRESENT|_PAGE_ACCESSED))
+ 
+-#define set_pte_at(mm, addr, ptep, pteval)                      \
+-	do {                                                    \
++#define set_pte_at(mm, addr, ptep, pteval)			\
++	do {							\
++		pte_t old_pte;					\
+ 		unsigned long flags;				\
+-		spin_lock_irqsave(&pa_dbit_lock, flags);	\
+-		set_pte(ptep, pteval);                          \
+-		purge_tlb_entries(mm, addr);                    \
+-		spin_unlock_irqrestore(&pa_dbit_lock, flags);	\
++		spin_lock_irqsave(&pa_tlb_lock, flags);		\
++		old_pte = *ptep;				\
++		set_pte(ptep, pteval);				\
++		if (pte_inserted(old_pte))			\
++			purge_tlb_entries(mm, addr);		\
++		spin_unlock_irqrestore(&pa_tlb_lock, flags);	\
+ 	} while (0)
+ 
+ #endif /* !__ASSEMBLY__ */
+@@ -268,7 +286,7 @@ extern unsigned long *empty_zero_page;
+ 
+ #define pte_none(x)     (pte_val(x) == 0)
+ #define pte_present(x)	(pte_val(x) & _PAGE_PRESENT)
+-#define pte_clear(mm,addr,xp)	do { pte_val(*(xp)) = 0; } while (0)
++#define pte_clear(mm, addr, xp)  set_pte_at(mm, addr, xp, __pte(0))
+ 
+ #define pmd_flag(x)	(pmd_val(x) & PxD_FLAG_MASK)
+ #define pmd_address(x)	((unsigned long)(pmd_val(x) &~ PxD_FLAG_MASK) << PxD_VALUE_SHIFT)
+@@ -435,15 +453,15 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned
+ 	if (!pte_young(*ptep))
+ 		return 0;
+ 
+-	spin_lock_irqsave(&pa_dbit_lock, flags);
++	spin_lock_irqsave(&pa_tlb_lock, flags);
+ 	pte = *ptep;
+ 	if (!pte_young(pte)) {
+-		spin_unlock_irqrestore(&pa_dbit_lock, flags);
++		spin_unlock_irqrestore(&pa_tlb_lock, flags);
+ 		return 0;
+ 	}
+ 	set_pte(ptep, pte_mkold(pte));
+ 	purge_tlb_entries(vma->vm_mm, addr);
+-	spin_unlock_irqrestore(&pa_dbit_lock, flags);
++	spin_unlock_irqrestore(&pa_tlb_lock, flags);
+ 	return 1;
+ }
+ 
+@@ -453,11 +471,12 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+ 	pte_t old_pte;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&pa_dbit_lock, flags);
++	spin_lock_irqsave(&pa_tlb_lock, flags);
+ 	old_pte = *ptep;
+-	pte_clear(mm,addr,ptep);
+-	purge_tlb_entries(mm, addr);
+-	spin_unlock_irqrestore(&pa_dbit_lock, flags);
++	set_pte(ptep, __pte(0));
++	if (pte_inserted(old_pte))
++		purge_tlb_entries(mm, addr);
++	spin_unlock_irqrestore(&pa_tlb_lock, flags);
+ 
+ 	return old_pte;
+ }
+@@ -465,10 +484,10 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ 	unsigned long flags;
+-	spin_lock_irqsave(&pa_dbit_lock, flags);
++	spin_lock_irqsave(&pa_tlb_lock, flags);
+ 	set_pte(ptep, pte_wrprotect(*ptep));
+ 	purge_tlb_entries(mm, addr);
+-	spin_unlock_irqrestore(&pa_dbit_lock, flags);
++	spin_unlock_irqrestore(&pa_tlb_lock, flags);
+ }
+ 
+ #define pte_same(A,B)	(pte_val(A) == pte_val(B))
+diff --git a/arch/parisc/include/asm/tlbflush.h b/arch/parisc/include/asm/tlbflush.h
+index 9d086a599fa0..e84b96478193 100644
+--- a/arch/parisc/include/asm/tlbflush.h
++++ b/arch/parisc/include/asm/tlbflush.h
+@@ -13,6 +13,9 @@
+  * active at any one time on the Merced bus.  This tlb purge
+  * synchronisation is fairly lightweight and harmless so we activate
+  * it on all systems not just the N class.
++
++ * It is also used to ensure PTE updates are atomic and consistent
++ * with the TLB.
+  */
+ extern spinlock_t pa_tlb_lock;
+ 
+@@ -24,20 +27,24 @@ extern void flush_tlb_all_local(void *);
+ 
+ #define smp_flush_tlb_all()	flush_tlb_all()
+ 
++int __flush_tlb_range(unsigned long sid,
++	unsigned long start, unsigned long end);
++
++#define flush_tlb_range(vma, start, end) \
++	__flush_tlb_range((vma)->vm_mm->context, start, end)
++
++#define flush_tlb_kernel_range(start, end) \
++	__flush_tlb_range(0, start, end)
++
+ /*
+  * flush_tlb_mm()
+  *
+- * XXX This code is NOT valid for HP-UX compatibility processes,
+- * (although it will probably work 99% of the time). HP-UX
+- * processes are free to play with the space id's and save them
+- * over long periods of time, etc. so we have to preserve the
+- * space and just flush the entire tlb. We need to check the
+- * personality in order to do that, but the personality is not
+- * currently being set correctly.
+- *
+- * Of course, Linux processes could do the same thing, but
+- * we don't support that (and the compilers, dynamic linker,
+- * etc. do not do that).
++ * The code to switch to a new context is NOT valid for processes
++ * which play with the space id's.  Thus, we have to preserve the
++ * space and just flush the entire tlb.  However, the compilers,
++ * dynamic linker, etc, do not manipulate space id's, so there
++ * could be a significant performance benefit in switching contexts
++ * and not flushing the whole tlb.
+  */
+ 
+ static inline void flush_tlb_mm(struct mm_struct *mm)
+@@ -45,10 +52,18 @@ static inline void flush_tlb_mm(struct mm_struct *mm)
+ 	BUG_ON(mm == &init_mm); /* Should never happen */
+ 
+ #if 1 || defined(CONFIG_SMP)
++	/* Except for very small threads, flushing the whole TLB is
++	 * faster than using __flush_tlb_range.  The pdtlb and pitlb
++	 * instructions are very slow because of the TLB broadcast.
++	 * It might be faster to do local range flushes on all CPUs
++	 * on PA 2.0 systems.
++	 */
+ 	flush_tlb_all();
+ #else
+ 	/* FIXME: currently broken, causing space id and protection ids
+-	 *  to go out of sync, resulting in faults on userspace accesses.
++	 * to go out of sync, resulting in faults on userspace accesses.
++	 * This approach needs further investigation since running many
++	 * small applications (e.g., GCC testsuite) is faster on HP-UX.
+ 	 */
+ 	if (mm) {
+ 		if (mm->context != 0)
+@@ -65,22 +80,12 @@ static inline void flush_tlb_page(struct vm_area_struct *vma,
+ {
+ 	unsigned long flags, sid;
+ 
+-	/* For one page, it's not worth testing the split_tlb variable */
+-
+-	mb();
+ 	sid = vma->vm_mm->context;
+ 	purge_tlb_start(flags);
+ 	mtsp(sid, 1);
+ 	pdtlb(addr);
+-	pitlb(addr);
++	if (unlikely(split_tlb))
++		pitlb(addr);
+ 	purge_tlb_end(flags);
+ }
+-
+-void __flush_tlb_range(unsigned long sid,
+-	unsigned long start, unsigned long end);
+-
+-#define flush_tlb_range(vma,start,end) __flush_tlb_range((vma)->vm_mm->context,start,end)
+-
+-#define flush_tlb_kernel_range(start, end) __flush_tlb_range(0,start,end)
+-
+ #endif
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index f6448c7c62b5..cda6dbbe9842 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -342,12 +342,15 @@ EXPORT_SYMBOL(flush_data_cache_local);
+ EXPORT_SYMBOL(flush_kernel_icache_range_asm);
+ 
+ #define FLUSH_THRESHOLD 0x80000 /* 0.5MB */
+-int parisc_cache_flush_threshold __read_mostly = FLUSH_THRESHOLD;
++static unsigned long parisc_cache_flush_threshold __read_mostly = FLUSH_THRESHOLD;
++
++#define FLUSH_TLB_THRESHOLD (2*1024*1024) /* 2MB initial TLB threshold */
++static unsigned long parisc_tlb_flush_threshold __read_mostly = FLUSH_TLB_THRESHOLD;
+ 
+ void __init parisc_setup_cache_timing(void)
+ {
+ 	unsigned long rangetime, alltime;
+-	unsigned long size;
++	unsigned long size, start;
+ 
+ 	alltime = mfctl(16);
+ 	flush_data_cache();
+@@ -364,14 +367,43 @@ void __init parisc_setup_cache_timing(void)
+ 	/* Racy, but if we see an intermediate value, it's ok too... */
+ 	parisc_cache_flush_threshold = size * alltime / rangetime;
+ 
+-	parisc_cache_flush_threshold = (parisc_cache_flush_threshold + L1_CACHE_BYTES - 1) &~ (L1_CACHE_BYTES - 1); 
++	parisc_cache_flush_threshold = L1_CACHE_ALIGN(parisc_cache_flush_threshold);
+ 	if (!parisc_cache_flush_threshold)
+ 		parisc_cache_flush_threshold = FLUSH_THRESHOLD;
+ 
+ 	if (parisc_cache_flush_threshold > cache_info.dc_size)
+ 		parisc_cache_flush_threshold = cache_info.dc_size;
+ 
+-	printk(KERN_INFO "Setting cache flush threshold to %x (%d CPUs online)\n", parisc_cache_flush_threshold, num_online_cpus());
++	printk(KERN_INFO "Setting cache flush threshold to %lu kB\n",
++		parisc_cache_flush_threshold/1024);
++
++	/* calculate TLB flush threshold */
++
++	alltime = mfctl(16);
++	flush_tlb_all();
++	alltime = mfctl(16) - alltime;
++
++	size = PAGE_SIZE;
++	start = (unsigned long) _text;
++	rangetime = mfctl(16);
++	while (start < (unsigned long) _end) {
++		flush_tlb_kernel_range(start, start + PAGE_SIZE);
++		start += PAGE_SIZE;
++		size += PAGE_SIZE;
++	}
++	rangetime = mfctl(16) - rangetime;
++
++	printk(KERN_DEBUG "Whole TLB flush %lu cycles, flushing %lu bytes %lu cycles\n",
++		alltime, size, rangetime);
++
++	parisc_tlb_flush_threshold = size * alltime / rangetime;
++	parisc_tlb_flush_threshold *= num_online_cpus();
++	parisc_tlb_flush_threshold = PAGE_ALIGN(parisc_tlb_flush_threshold);
++	if (!parisc_tlb_flush_threshold)
++		parisc_tlb_flush_threshold = FLUSH_TLB_THRESHOLD;
++
++	printk(KERN_INFO "Setting TLB flush threshold to %lu kB\n",
++		parisc_tlb_flush_threshold/1024);
+ }
+ 
+ extern void purge_kernel_dcache_page_asm(unsigned long);
+@@ -403,48 +435,45 @@ void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
+ }
+ EXPORT_SYMBOL(copy_user_page);
+ 
+-void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+-{
+-	unsigned long flags;
+-
+-	/* Note: purge_tlb_entries can be called at startup with
+-	   no context.  */
+-
+-	purge_tlb_start(flags);
+-	mtsp(mm->context, 1);
+-	pdtlb(addr);
+-	pitlb(addr);
+-	purge_tlb_end(flags);
+-}
+-EXPORT_SYMBOL(purge_tlb_entries);
+-
+-void __flush_tlb_range(unsigned long sid, unsigned long start,
+-		       unsigned long end)
++/* __flush_tlb_range()
++ *
++ * returns 1 if all TLBs were flushed.
++ */
++int __flush_tlb_range(unsigned long sid, unsigned long start,
++		      unsigned long end)
+ {
+-	unsigned long npages;
++	unsigned long flags, size;
+ 
+-	npages = ((end - (start & PAGE_MASK)) + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+-	if (npages >= 512)  /* 2MB of space: arbitrary, should be tuned */
++	size = (end - start);
++	if (size >= parisc_tlb_flush_threshold) {
+ 		flush_tlb_all();
+-	else {
+-		unsigned long flags;
++		return 1;
++	}
+ 
++	/* Purge TLB entries for small ranges using the pdtlb and
++	   pitlb instructions.  These instructions execute locally
++	   but cause a purge request to be broadcast to other TLBs.  */
++	if (likely(!split_tlb)) {
++		while (start < end) {
++			purge_tlb_start(flags);
++			mtsp(sid, 1);
++			pdtlb(start);
++			purge_tlb_end(flags);
++			start += PAGE_SIZE;
++		}
++		return 0;
++	}
++
++	/* split TLB case */
++	while (start < end) {
+ 		purge_tlb_start(flags);
+ 		mtsp(sid, 1);
+-		if (split_tlb) {
+-			while (npages--) {
+-				pdtlb(start);
+-				pitlb(start);
+-				start += PAGE_SIZE;
+-			}
+-		} else {
+-			while (npages--) {
+-				pdtlb(start);
+-				start += PAGE_SIZE;
+-			}
+-		}
++		pdtlb(start);
++		pitlb(start);
+ 		purge_tlb_end(flags);
++		start += PAGE_SIZE;
+ 	}
++	return 0;
+ }
+ 
+ static void cacheflush_h_tmp_function(void *dummy)
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index 75819617f93b..c5ef4081b01d 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -45,7 +45,7 @@
+ 	.level 2.0
+ #endif
+ 
+-	.import         pa_dbit_lock,data
++	.import		pa_tlb_lock,data
+ 
+ 	/* space_to_prot macro creates a prot id from a space id */
+ 
+@@ -420,8 +420,8 @@
+ 	SHLREG		%r9,PxD_VALUE_SHIFT,\pmd
+ 	extru		\va,31-PAGE_SHIFT,ASM_BITS_PER_PTE,\index
+ 	dep		%r0,31,PAGE_SHIFT,\pmd  /* clear offset */
+-	shladd		\index,BITS_PER_PTE_ENTRY,\pmd,\pmd
+-	LDREG		%r0(\pmd),\pte		/* pmd is now pte */
++	shladd		\index,BITS_PER_PTE_ENTRY,\pmd,\pmd /* pmd is now pte */
++	LDREG		%r0(\pmd),\pte
+ 	bb,>=,n		\pte,_PAGE_PRESENT_BIT,\fault
+ 	.endm
+ 
+@@ -453,57 +453,53 @@
+ 	L2_ptep		\pgd,\pte,\index,\va,\fault
+ 	.endm
+ 
+-	/* Acquire pa_dbit_lock lock. */
+-	.macro		dbit_lock	spc,tmp,tmp1
++	/* Acquire pa_tlb_lock lock and recheck page is still present. */
++	.macro		tlb_lock	spc,ptp,pte,tmp,tmp1,fault
+ #ifdef CONFIG_SMP
+ 	cmpib,COND(=),n	0,\spc,2f
+-	load32		PA(pa_dbit_lock),\tmp
++	load32		PA(pa_tlb_lock),\tmp
+ 1:	LDCW		0(\tmp),\tmp1
+ 	cmpib,COND(=)	0,\tmp1,1b
+ 	nop
++	LDREG		0(\ptp),\pte
++	bb,<,n		\pte,_PAGE_PRESENT_BIT,2f
++	b		\fault
++	stw		 \spc,0(\tmp)
+ 2:
+ #endif
+ 	.endm
+ 
+-	/* Release pa_dbit_lock lock without reloading lock address. */
+-	.macro		dbit_unlock0	spc,tmp
++	/* Release pa_tlb_lock lock without reloading lock address. */
++	.macro		tlb_unlock0	spc,tmp
+ #ifdef CONFIG_SMP
+ 	or,COND(=)	%r0,\spc,%r0
+ 	stw             \spc,0(\tmp)
+ #endif
+ 	.endm
+ 
+-	/* Release pa_dbit_lock lock. */
+-	.macro		dbit_unlock1	spc,tmp
++	/* Release pa_tlb_lock lock. */
++	.macro		tlb_unlock1	spc,tmp
+ #ifdef CONFIG_SMP
+-	load32		PA(pa_dbit_lock),\tmp
+-	dbit_unlock0	\spc,\tmp
++	load32		PA(pa_tlb_lock),\tmp
++	tlb_unlock0	\spc,\tmp
+ #endif
+ 	.endm
+ 
+ 	/* Set the _PAGE_ACCESSED bit of the PTE.  Be clever and
+ 	 * don't needlessly dirty the cache line if it was already set */
+-	.macro		update_ptep	spc,ptep,pte,tmp,tmp1
+-#ifdef CONFIG_SMP
+-	or,COND(=)	%r0,\spc,%r0
+-	LDREG		0(\ptep),\pte
+-#endif
++	.macro		update_accessed	ptp,pte,tmp,tmp1
+ 	ldi		_PAGE_ACCESSED,\tmp1
+ 	or		\tmp1,\pte,\tmp
+ 	and,COND(<>)	\tmp1,\pte,%r0
+-	STREG		\tmp,0(\ptep)
++	STREG		\tmp,0(\ptp)
+ 	.endm
+ 
+ 	/* Set the dirty bit (and accessed bit).  No need to be
+ 	 * clever, this is only used from the dirty fault */
+-	.macro		update_dirty	spc,ptep,pte,tmp
+-#ifdef CONFIG_SMP
+-	or,COND(=)	%r0,\spc,%r0
+-	LDREG		0(\ptep),\pte
+-#endif
++	.macro		update_dirty	ptp,pte,tmp
+ 	ldi		_PAGE_ACCESSED|_PAGE_DIRTY,\tmp
+ 	or		\tmp,\pte,\pte
+-	STREG		\pte,0(\ptep)
++	STREG		\pte,0(\ptp)
+ 	.endm
+ 
+ 	/* bitshift difference between a PFN (based on kernel's PAGE_SIZE)
+@@ -1148,14 +1144,14 @@ dtlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,dtlb_check_alias_20w
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_20w
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 	
+ 	idtlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1174,14 +1170,14 @@ nadtlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,nadtlb_check_alias_20w
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_20w
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+ 	idtlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1202,20 +1198,20 @@ dtlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dtlb_check_alias_11
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_11
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+ 
+-	mfsp		%sr1,t0  /* Save sr1 so we can use it in tlb inserts */
++	mfsp		%sr1,t1  /* Save sr1 so we can use it in tlb inserts */
+ 	mtsp		spc,%sr1
+ 
+ 	idtlba		pte,(%sr1,va)
+ 	idtlbp		prot,(%sr1,va)
+ 
+-	mtsp		t0, %sr1	/* Restore sr1 */
+-	dbit_unlock1	spc,t0
++	mtsp		t1, %sr1	/* Restore sr1 */
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1235,21 +1231,20 @@ nadtlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,nadtlb_check_alias_11
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_11
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+ 
+-
+-	mfsp		%sr1,t0  /* Save sr1 so we can use it in tlb inserts */
++	mfsp		%sr1,t1  /* Save sr1 so we can use it in tlb inserts */
+ 	mtsp		spc,%sr1
+ 
+ 	idtlba		pte,(%sr1,va)
+ 	idtlbp		prot,(%sr1,va)
+ 
+-	mtsp		t0, %sr1	/* Restore sr1 */
+-	dbit_unlock1	spc,t0
++	mtsp		t1, %sr1	/* Restore sr1 */
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1269,16 +1264,16 @@ dtlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dtlb_check_alias_20
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_20
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+-	f_extend	pte,t0
++	f_extend	pte,t1
+ 
+ 	idtlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1297,16 +1292,16 @@ nadtlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,nadtlb_check_alias_20
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_20
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+-	f_extend	pte,t0
++	f_extend	pte,t1
+ 	
+-        idtlbt          pte,prot
+-	dbit_unlock1	spc,t0
++	idtlbt		pte,prot
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1406,14 +1401,14 @@ itlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,itlb_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,itlb_fault
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 	
+ 	iitlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1430,14 +1425,14 @@ naitlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,naitlb_check_alias_20w
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_20w
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+ 	iitlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1458,20 +1453,20 @@ itlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,itlb_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,itlb_fault
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+ 
+-	mfsp		%sr1,t0  /* Save sr1 so we can use it in tlb inserts */
++	mfsp		%sr1,t1  /* Save sr1 so we can use it in tlb inserts */
+ 	mtsp		spc,%sr1
+ 
+ 	iitlba		pte,(%sr1,va)
+ 	iitlbp		prot,(%sr1,va)
+ 
+-	mtsp		t0, %sr1	/* Restore sr1 */
+-	dbit_unlock1	spc,t0
++	mtsp		t1, %sr1	/* Restore sr1 */
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1482,20 +1477,20 @@ naitlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,naitlb_check_alias_11
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_11
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+ 
+-	mfsp		%sr1,t0  /* Save sr1 so we can use it in tlb inserts */
++	mfsp		%sr1,t1  /* Save sr1 so we can use it in tlb inserts */
+ 	mtsp		spc,%sr1
+ 
+ 	iitlba		pte,(%sr1,va)
+ 	iitlbp		prot,(%sr1,va)
+ 
+-	mtsp		t0, %sr1	/* Restore sr1 */
+-	dbit_unlock1	spc,t0
++	mtsp		t1, %sr1	/* Restore sr1 */
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1516,16 +1511,16 @@ itlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,itlb_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,itlb_fault
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+-	f_extend	pte,t0	
++	f_extend	pte,t1
+ 
+ 	iitlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1536,16 +1531,16 @@ naitlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,naitlb_check_alias_20
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_20
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+-	f_extend	pte,t0
++	f_extend	pte,t1
+ 
+ 	iitlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1568,14 +1563,14 @@ dbit_trap_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,dbit_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_dirty	spc,ptp,pte,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dbit_fault
++	update_dirty	ptp,pte,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 		
+ 	idtlbt          pte,prot
+-	dbit_unlock0	spc,t0
+ 
++	tlb_unlock0	spc,t0
+ 	rfir
+ 	nop
+ #else
+@@ -1588,8 +1583,8 @@ dbit_trap_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dbit_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_dirty	spc,ptp,pte,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dbit_fault
++	update_dirty	ptp,pte,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+ 
+@@ -1600,8 +1595,8 @@ dbit_trap_11:
+ 	idtlbp		prot,(%sr1,va)
+ 
+ 	mtsp            t1, %sr1     /* Restore sr1 */
+-	dbit_unlock0	spc,t0
+ 
++	tlb_unlock0	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1612,16 +1607,16 @@ dbit_trap_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dbit_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_dirty	spc,ptp,pte,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dbit_fault
++	update_dirty	ptp,pte,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+ 	f_extend	pte,t1
+ 	
+-        idtlbt          pte,prot
+-	dbit_unlock0	spc,t0
++	idtlbt		pte,prot
+ 
++	tlb_unlock0	spc,t0
+ 	rfir
+ 	nop
+ #endif
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index 47ee620d15d2..7f67c4c96a7a 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -43,10 +43,6 @@
+ 
+ #include "../math-emu/math-emu.h"	/* for handle_fpe() */
+ 
+-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+-DEFINE_SPINLOCK(pa_dbit_lock);
+-#endif
+-
+ static void parisc_show_stack(struct task_struct *task, unsigned long *sp,
+ 	struct pt_regs *regs);
+ 
+diff --git a/arch/powerpc/kernel/idle_power7.S b/arch/powerpc/kernel/idle_power7.S
+index ccde8f084ce4..112ccf497562 100644
+--- a/arch/powerpc/kernel/idle_power7.S
++++ b/arch/powerpc/kernel/idle_power7.S
+@@ -52,6 +52,22 @@
+ 	.text
+ 
+ /*
++ * Used by threads when the lock bit of core_idle_state is set.
++ * Threads will spin in HMT_LOW until the lock bit is cleared.
++ * r14 - pointer to core_idle_state
++ * r15 - used to load contents of core_idle_state
++ */
++
++core_idle_lock_held:
++	HMT_LOW
++3:	lwz	r15,0(r14)
++	andi.   r15,r15,PNV_CORE_IDLE_LOCK_BIT
++	bne	3b
++	HMT_MEDIUM
++	lwarx	r15,0,r14
++	blr
++
++/*
+  * Pass requested state in r3:
+  *	r3 - PNV_THREAD_NAP/SLEEP/WINKLE
+  *
+@@ -150,6 +166,10 @@ power7_enter_nap_mode:
+ 	ld	r14,PACA_CORE_IDLE_STATE_PTR(r13)
+ lwarx_loop1:
+ 	lwarx	r15,0,r14
++
++	andi.   r9,r15,PNV_CORE_IDLE_LOCK_BIT
++	bnel	core_idle_lock_held
++
+ 	andc	r15,r15,r7			/* Clear thread bit */
+ 
+ 	andi.	r15,r15,PNV_CORE_IDLE_THREAD_BITS
+@@ -294,7 +314,7 @@ lwarx_loop2:
+ 	 * workaround undo code or resyncing timebase or restoring context
+ 	 * In either case loop until the lock bit is cleared.
+ 	 */
+-	bne	core_idle_lock_held
++	bnel	core_idle_lock_held
+ 
+ 	cmpwi	cr2,r15,0
+ 	lbz	r4,PACA_SUBCORE_SIBLING_MASK(r13)
+@@ -319,15 +339,6 @@ lwarx_loop2:
+ 	isync
+ 	b	common_exit
+ 
+-core_idle_lock_held:
+-	HMT_LOW
+-core_idle_lock_loop:
+-	lwz	r15,0(14)
+-	andi.   r9,r15,PNV_CORE_IDLE_LOCK_BIT
+-	bne	core_idle_lock_loop
+-	HMT_MEDIUM
+-	b	lwarx_loop2
+-
+ first_thread_in_subcore:
+ 	/* First thread in subcore to wakeup */
+ 	ori	r15,r15,PNV_CORE_IDLE_LOCK_BIT
+diff --git a/arch/s390/include/asm/ctl_reg.h b/arch/s390/include/asm/ctl_reg.h
+index cfad7fca01d6..d7697ab802f6 100644
+--- a/arch/s390/include/asm/ctl_reg.h
++++ b/arch/s390/include/asm/ctl_reg.h
+@@ -57,7 +57,10 @@ union ctlreg0 {
+ 		unsigned long lap  : 1; /* Low-address-protection control */
+ 		unsigned long	   : 4;
+ 		unsigned long edat : 1; /* Enhanced-DAT-enablement control */
+-		unsigned long	   : 23;
++		unsigned long	   : 4;
++		unsigned long afp  : 1; /* AFP-register control */
++		unsigned long vx   : 1; /* Vector enablement control */
++		unsigned long	   : 17;
+ 	};
+ };
+ 
+diff --git a/arch/s390/kernel/cache.c b/arch/s390/kernel/cache.c
+index bff5e3b6d822..8ba32436effe 100644
+--- a/arch/s390/kernel/cache.c
++++ b/arch/s390/kernel/cache.c
+@@ -138,6 +138,8 @@ int init_cache_level(unsigned int cpu)
+ 	union cache_topology ct;
+ 	enum cache_type ctype;
+ 
++	if (!test_facility(34))
++		return -EOPNOTSUPP;
+ 	if (!this_cpu_ci)
+ 		return -EINVAL;
+ 	ct.raw = ecag(EXTRACT_TOPOLOGY, 0, 0);
+diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
+index 505c17c0ae1a..56b550893593 100644
+--- a/arch/s390/kernel/nmi.c
++++ b/arch/s390/kernel/nmi.c
+@@ -21,6 +21,7 @@
+ #include <asm/nmi.h>
+ #include <asm/crw.h>
+ #include <asm/switch_to.h>
++#include <asm/ctl_reg.h>
+ 
+ struct mcck_struct {
+ 	int kill_task;
+@@ -129,26 +130,30 @@ static int notrace s390_revalidate_registers(struct mci *mci)
+ 	} else
+ 		asm volatile("lfpc 0(%0)" : : "a" (fpt_creg_save_area));
+ 
+-	asm volatile(
+-		"	ld	0,0(%0)\n"
+-		"	ld	1,8(%0)\n"
+-		"	ld	2,16(%0)\n"
+-		"	ld	3,24(%0)\n"
+-		"	ld	4,32(%0)\n"
+-		"	ld	5,40(%0)\n"
+-		"	ld	6,48(%0)\n"
+-		"	ld	7,56(%0)\n"
+-		"	ld	8,64(%0)\n"
+-		"	ld	9,72(%0)\n"
+-		"	ld	10,80(%0)\n"
+-		"	ld	11,88(%0)\n"
+-		"	ld	12,96(%0)\n"
+-		"	ld	13,104(%0)\n"
+-		"	ld	14,112(%0)\n"
+-		"	ld	15,120(%0)\n"
+-		: : "a" (fpt_save_area));
+-	/* Revalidate vector registers */
+-	if (MACHINE_HAS_VX && current->thread.vxrs) {
++	if (!MACHINE_HAS_VX) {
++		/* Revalidate floating point registers */
++		asm volatile(
++			"	ld	0,0(%0)\n"
++			"	ld	1,8(%0)\n"
++			"	ld	2,16(%0)\n"
++			"	ld	3,24(%0)\n"
++			"	ld	4,32(%0)\n"
++			"	ld	5,40(%0)\n"
++			"	ld	6,48(%0)\n"
++			"	ld	7,56(%0)\n"
++			"	ld	8,64(%0)\n"
++			"	ld	9,72(%0)\n"
++			"	ld	10,80(%0)\n"
++			"	ld	11,88(%0)\n"
++			"	ld	12,96(%0)\n"
++			"	ld	13,104(%0)\n"
++			"	ld	14,112(%0)\n"
++			"	ld	15,120(%0)\n"
++			: : "a" (fpt_save_area));
++	} else {
++		/* Revalidate vector registers */
++		union ctlreg0 cr0;
++
+ 		if (!mci->vr) {
+ 			/*
+ 			 * Vector registers can't be restored and therefore
+@@ -156,8 +161,12 @@ static int notrace s390_revalidate_registers(struct mci *mci)
+ 			 */
+ 			kill_task = 1;
+ 		}
++		cr0.val = S390_lowcore.cregs_save_area[0];
++		cr0.afp = cr0.vx = 1;
++		__ctl_load(cr0.val, 0, 0);
+ 		restore_vx_regs((__vector128 *)
+-				S390_lowcore.vector_save_area_addr);
++				&S390_lowcore.vector_save_area);
++		__ctl_load(S390_lowcore.cregs_save_area[0], 0, 0);
+ 	}
+ 	/* Revalidate access registers */
+ 	asm volatile(
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index dc5edc29b73a..8f587d871b9f 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -163,7 +163,7 @@ int copy_thread(unsigned long clone_flags, unsigned long new_stackp,
+ asmlinkage void execve_tail(void)
+ {
+ 	current->thread.fp_regs.fpc = 0;
+-	asm volatile("sfpc %0,%0" : : "d" (0));
++	asm volatile("sfpc %0" : : "d" (0));
+ }
+ 
+ /*
+diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
+index 43c3169ea49c..ada0c07fe1a8 100644
+--- a/arch/s390/kernel/sclp.S
++++ b/arch/s390/kernel/sclp.S
+@@ -270,6 +270,8 @@ ENTRY(_sclp_print_early)
+ 	jno	.Lesa2
+ 	ahi	%r15,-80
+ 	stmh	%r6,%r15,96(%r15)		# store upper register halves
++	basr	%r13,0
++	lmh	%r0,%r15,.Lzeroes-.(%r13)	# clear upper register halves
+ .Lesa2:
+ 	lr	%r10,%r2			# save string pointer
+ 	lhi	%r2,0
+@@ -291,6 +293,8 @@ ENTRY(_sclp_print_early)
+ .Lesa3:
+ 	lm	%r6,%r15,120(%r15)		# restore registers
+ 	br	%r14
++.Lzeroes:
++	.fill	64,4,0
+ 
+ .LwritedataS4:
+ 	.long	0x00760005			# SCLP command for write data
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 9afb9d602f84..dc2d7aa56440 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -415,13 +415,13 @@ static void bpf_jit_prologue(struct bpf_jit *jit)
+ 		EMIT6_DISP_LH(0xe3000000, 0x0004, REG_SKB_DATA, REG_0,
+ 			      BPF_REG_1, offsetof(struct sk_buff, data));
+ 	}
+-	/* BPF compatibility: clear A (%b7) and X (%b8) registers */
+-	if (REG_SEEN(BPF_REG_7))
+-		/* lghi %b7,0 */
+-		EMIT4_IMM(0xa7090000, BPF_REG_7, 0);
+-	if (REG_SEEN(BPF_REG_8))
+-		/* lghi %b8,0 */
+-		EMIT4_IMM(0xa7090000, BPF_REG_8, 0);
++	/* BPF compatibility: clear A (%b0) and X (%b7) registers */
++	if (REG_SEEN(BPF_REG_A))
++		/* lghi %ba,0 */
++		EMIT4_IMM(0xa7090000, BPF_REG_A, 0);
++	if (REG_SEEN(BPF_REG_X))
++		/* lghi %bx,0 */
++		EMIT4_IMM(0xa7090000, BPF_REG_X, 0);
+ }
+ 
+ /*
+diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
+index d366675e4bf8..396b5c96e272 100644
+--- a/arch/tile/kernel/setup.c
++++ b/arch/tile/kernel/setup.c
+@@ -1139,7 +1139,7 @@ static void __init load_hv_initrd(void)
+ 
+ void __init free_initrd_mem(unsigned long begin, unsigned long end)
+ {
+-	free_bootmem(__pa(begin), end - begin);
++	free_bootmem_late(__pa(begin), end - begin);
+ }
+ 
+ static int __init setup_initrd(char *str)
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 48304b89b601..0cdc154a22b5 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -1193,6 +1193,10 @@ static efi_status_t setup_e820(struct boot_params *params,
+ 		unsigned int e820_type = 0;
+ 		unsigned long m = efi->efi_memmap;
+ 
++#ifdef CONFIG_X86_64
++		m |= (u64)efi->efi_memmap_hi << 32;
++#endif
++
+ 		d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
+ 		switch (d->type) {
+ 		case EFI_RESERVED_TYPE:
+diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h
+index 8b22422fbad8..74a2a8dc9908 100644
+--- a/arch/x86/include/asm/kasan.h
++++ b/arch/x86/include/asm/kasan.h
+@@ -14,15 +14,11 @@
+ 
+ #ifndef __ASSEMBLY__
+ 
+-extern pte_t kasan_zero_pte[];
+-extern pte_t kasan_zero_pmd[];
+-extern pte_t kasan_zero_pud[];
+-
+ #ifdef CONFIG_KASAN
+-void __init kasan_map_early_shadow(pgd_t *pgd);
++void __init kasan_early_init(void);
+ void __init kasan_init(void);
+ #else
+-static inline void kasan_map_early_shadow(pgd_t *pgd) { }
++static inline void kasan_early_init(void) { }
+ static inline void kasan_init(void) { }
+ #endif
+ 
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index 883f6b933fa4..e997f70f80c4 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -23,7 +23,7 @@ extern struct static_key rdpmc_always_available;
+ 
+ static inline void load_mm_cr4(struct mm_struct *mm)
+ {
+-	if (static_key_true(&rdpmc_always_available) ||
++	if (static_key_false(&rdpmc_always_available) ||
+ 	    atomic_read(&mm->context.perf_rdpmc_allowed))
+ 		cr4_set_bits(X86_CR4_PCE);
+ 	else
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_cqm.c b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
+index e4d1b8b738fa..cb77b11bc414 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_cqm.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
+@@ -934,6 +934,14 @@ static u64 intel_cqm_event_count(struct perf_event *event)
+ 		return 0;
+ 
+ 	/*
++	 * Getting up-to-date values requires an SMP IPI which is not
++	 * possible if we're being called in interrupt context. Return
++	 * the cached values instead.
++	 */
++	if (unlikely(in_interrupt()))
++		goto out;
++
++	/*
+ 	 * Notice that we don't perform the reading of an RMID
+ 	 * atomically, because we can't hold a spin lock across the
+ 	 * IPIs.
+diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
+index 5a4668136e98..f129a9af6357 100644
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -161,11 +161,12 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
+ 	/* Kill off the identity-map trampoline */
+ 	reset_early_page_tables();
+ 
+-	kasan_map_early_shadow(early_level4_pgt);
+-
+-	/* clear bss before set_intr_gate with early_idt_handler */
+ 	clear_bss();
+ 
++	clear_page(init_level4_pgt);
++
++	kasan_early_init();
++
+ 	for (i = 0; i < NUM_EXCEPTION_VECTORS; i++)
+ 		set_intr_gate(i, early_idt_handler_array[i]);
+ 	load_idt((const struct desc_ptr *)&idt_descr);
+@@ -177,12 +178,9 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
+ 	 */
+ 	load_ucode_bsp();
+ 
+-	clear_page(init_level4_pgt);
+ 	/* set init_level4_pgt kernel high mapping*/
+ 	init_level4_pgt[511] = early_level4_pgt[511];
+ 
+-	kasan_map_early_shadow(init_level4_pgt);
+-
+ 	x86_64_start_reservations(real_mode_data);
+ }
+ 
+diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
+index df7e78057ae0..7e5da2cbe59e 100644
+--- a/arch/x86/kernel/head_64.S
++++ b/arch/x86/kernel/head_64.S
+@@ -516,38 +516,9 @@ ENTRY(phys_base)
+ 	/* This must match the first entry in level2_kernel_pgt */
+ 	.quad   0x0000000000000000
+ 
+-#ifdef CONFIG_KASAN
+-#define FILL(VAL, COUNT)				\
+-	.rept (COUNT) ;					\
+-	.quad	(VAL) ;					\
+-	.endr
+-
+-NEXT_PAGE(kasan_zero_pte)
+-	FILL(kasan_zero_page - __START_KERNEL_map + _KERNPG_TABLE, 512)
+-NEXT_PAGE(kasan_zero_pmd)
+-	FILL(kasan_zero_pte - __START_KERNEL_map + _KERNPG_TABLE, 512)
+-NEXT_PAGE(kasan_zero_pud)
+-	FILL(kasan_zero_pmd - __START_KERNEL_map + _KERNPG_TABLE, 512)
+-
+-#undef FILL
+-#endif
+-
+-
+ #include "../../x86/xen/xen-head.S"
+ 	
+ 	__PAGE_ALIGNED_BSS
+ NEXT_PAGE(empty_zero_page)
+ 	.skip PAGE_SIZE
+ 
+-#ifdef CONFIG_KASAN
+-/*
+- * This page used as early shadow. We don't use empty_zero_page
+- * at early stages, stack instrumentation could write some garbage
+- * to this page.
+- * Latter we reuse it as zero shadow for large ranges of memory
+- * that allowed to access, but not instrumented by kasan
+- * (vmalloc/vmemmap ...).
+- */
+-NEXT_PAGE(kasan_zero_page)
+-	.skip PAGE_SIZE
+-#endif
+diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
+index 4860906c6b9f..9a54dbe98064 100644
+--- a/arch/x86/mm/kasan_init_64.c
++++ b/arch/x86/mm/kasan_init_64.c
+@@ -11,7 +11,19 @@
+ extern pgd_t early_level4_pgt[PTRS_PER_PGD];
+ extern struct range pfn_mapped[E820_X_MAX];
+ 
+-extern unsigned char kasan_zero_page[PAGE_SIZE];
++static pud_t kasan_zero_pud[PTRS_PER_PUD] __page_aligned_bss;
++static pmd_t kasan_zero_pmd[PTRS_PER_PMD] __page_aligned_bss;
++static pte_t kasan_zero_pte[PTRS_PER_PTE] __page_aligned_bss;
++
++/*
++ * This page used as early shadow. We don't use empty_zero_page
++ * at early stages, stack instrumentation could write some garbage
++ * to this page.
++ * Latter we reuse it as zero shadow for large ranges of memory
++ * that allowed to access, but not instrumented by kasan
++ * (vmalloc/vmemmap ...).
++ */
++static unsigned char kasan_zero_page[PAGE_SIZE] __page_aligned_bss;
+ 
+ static int __init map_range(struct range *range)
+ {
+@@ -36,7 +48,7 @@ static void __init clear_pgds(unsigned long start,
+ 		pgd_clear(pgd_offset_k(start));
+ }
+ 
+-void __init kasan_map_early_shadow(pgd_t *pgd)
++static void __init kasan_map_early_shadow(pgd_t *pgd)
+ {
+ 	int i;
+ 	unsigned long start = KASAN_SHADOW_START;
+@@ -73,7 +85,7 @@ static int __init zero_pmd_populate(pud_t *pud, unsigned long addr,
+ 	while (IS_ALIGNED(addr, PMD_SIZE) && addr + PMD_SIZE <= end) {
+ 		WARN_ON(!pmd_none(*pmd));
+ 		set_pmd(pmd, __pmd(__pa_nodebug(kasan_zero_pte)
+-					| __PAGE_KERNEL_RO));
++					| _KERNPG_TABLE));
+ 		addr += PMD_SIZE;
+ 		pmd = pmd_offset(pud, addr);
+ 	}
+@@ -99,7 +111,7 @@ static int __init zero_pud_populate(pgd_t *pgd, unsigned long addr,
+ 	while (IS_ALIGNED(addr, PUD_SIZE) && addr + PUD_SIZE <= end) {
+ 		WARN_ON(!pud_none(*pud));
+ 		set_pud(pud, __pud(__pa_nodebug(kasan_zero_pmd)
+-					| __PAGE_KERNEL_RO));
++					| _KERNPG_TABLE));
+ 		addr += PUD_SIZE;
+ 		pud = pud_offset(pgd, addr);
+ 	}
+@@ -124,7 +136,7 @@ static int __init zero_pgd_populate(unsigned long addr, unsigned long end)
+ 	while (IS_ALIGNED(addr, PGDIR_SIZE) && addr + PGDIR_SIZE <= end) {
+ 		WARN_ON(!pgd_none(*pgd));
+ 		set_pgd(pgd, __pgd(__pa_nodebug(kasan_zero_pud)
+-					| __PAGE_KERNEL_RO));
++					| _KERNPG_TABLE));
+ 		addr += PGDIR_SIZE;
+ 		pgd = pgd_offset_k(addr);
+ 	}
+@@ -166,6 +178,26 @@ static struct notifier_block kasan_die_notifier = {
+ };
+ #endif
+ 
++void __init kasan_early_init(void)
++{
++	int i;
++	pteval_t pte_val = __pa_nodebug(kasan_zero_page) | __PAGE_KERNEL;
++	pmdval_t pmd_val = __pa_nodebug(kasan_zero_pte) | _KERNPG_TABLE;
++	pudval_t pud_val = __pa_nodebug(kasan_zero_pmd) | _KERNPG_TABLE;
++
++	for (i = 0; i < PTRS_PER_PTE; i++)
++		kasan_zero_pte[i] = __pte(pte_val);
++
++	for (i = 0; i < PTRS_PER_PMD; i++)
++		kasan_zero_pmd[i] = __pmd(pmd_val);
++
++	for (i = 0; i < PTRS_PER_PUD; i++)
++		kasan_zero_pud[i] = __pud(pud_val);
++
++	kasan_map_early_shadow(early_level4_pgt);
++	kasan_map_early_shadow(init_level4_pgt);
++}
++
+ void __init kasan_init(void)
+ {
+ 	int i;
+@@ -176,6 +208,7 @@ void __init kasan_init(void)
+ 
+ 	memcpy(early_level4_pgt, init_level4_pgt, sizeof(early_level4_pgt));
+ 	load_cr3(early_level4_pgt);
++	__flush_tlb_all();
+ 
+ 	clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);
+ 
+@@ -202,5 +235,6 @@ void __init kasan_init(void)
+ 	memset(kasan_zero_page, 0, PAGE_SIZE);
+ 
+ 	load_cr3(init_level4_pgt);
++	__flush_tlb_all();
+ 	init_task.kasan_depth = 0;
+ }
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index 3250f2371aea..90b924acd982 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -117,7 +117,7 @@ static void flush_tlb_func(void *info)
+ 		} else {
+ 			unsigned long addr;
+ 			unsigned long nr_pages =
+-				f->flush_end - f->flush_start / PAGE_SIZE;
++				(f->flush_end - f->flush_start) / PAGE_SIZE;
+ 			addr = f->flush_start;
+ 			while (addr < f->flush_end) {
+ 				__flush_tlb_single(addr);
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 02744df576d5..841ea05e1b02 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -946,6 +946,11 @@ u64 efi_mem_attributes(unsigned long phys_addr)
+ 
+ static int __init arch_parse_efi_cmdline(char *str)
+ {
++	if (!str) {
++		pr_warn("need at least one option\n");
++		return -EINVAL;
++	}
++
+ 	if (parse_option_str(str, "old_map"))
+ 		set_bit(EFI_OLD_MEMMAP, &efi.flags);
+ 	if (parse_option_str(str, "debug"))
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index 5cbd5d9ea61d..39ce74d10e2b 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -51,7 +51,7 @@ struct bio_integrity_payload *bio_integrity_alloc(struct bio *bio,
+ 	unsigned long idx = BIO_POOL_NONE;
+ 	unsigned inline_vecs;
+ 
+-	if (!bs) {
++	if (!bs || !bs->bio_integrity_pool) {
+ 		bip = kmalloc(sizeof(struct bio_integrity_payload) +
+ 			      sizeof(struct bio_vec) * nr_vecs, gfp_mask);
+ 		inline_vecs = nr_vecs;
+@@ -104,7 +104,7 @@ void bio_integrity_free(struct bio *bio)
+ 		kfree(page_address(bip->bip_vec->bv_page) +
+ 		      bip->bip_vec->bv_offset);
+ 
+-	if (bs) {
++	if (bs && bs->bio_integrity_pool) {
+ 		if (bip->bip_slab != BIO_POOL_NONE)
+ 			bvec_free(bs->bvec_integrity_pool, bip->bip_vec,
+ 				  bip->bip_slab);
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 0ac817b750db..6817e28960b7 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -716,8 +716,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 		return -EINVAL;
+ 
+ 	disk = get_gendisk(MKDEV(major, minor), &part);
+-	if (!disk || part)
++	if (!disk)
+ 		return -EINVAL;
++	if (part) {
++		put_disk(disk);
++		return -EINVAL;
++	}
+ 
+ 	rcu_read_lock();
+ 	spin_lock_irq(disk->queue->queue_lock);
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 594eea04266e..2dc1fd6c5bdb 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1968,7 +1968,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
+ 		goto err_hctxs;
+ 
+ 	setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
+-	blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30000);
++	blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30 * HZ);
+ 
+ 	q->nr_queues = nr_cpu_ids;
+ 	q->nr_hw_queues = set->nr_hw_queues;
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 7ccc084bf1df..85aa76116a30 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ 				       ATA_LFLAG_NO_SRST |
+ 				       ATA_LFLAG_ASSUME_ATA;
+ 		}
++	} else if (vendor == 0x11ab && devid == 0x4140) {
++		/* Marvell 4140 quirks */
++		ata_for_each_link(link, ap, EDGE) {
++			/* port 4 is for SEMB device and it doesn't like SRST */
++			if (link->pmp == 4)
++				link->flags |= ATA_LFLAG_DISABLED;
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/clk/st/clk-flexgen.c b/drivers/clk/st/clk-flexgen.c
+index bf12a25eb3a2..0f8db28353c5 100644
+--- a/drivers/clk/st/clk-flexgen.c
++++ b/drivers/clk/st/clk-flexgen.c
+@@ -303,6 +303,8 @@ void __init st_of_flexgen_setup(struct device_node *np)
+ 	if (!rlock)
+ 		goto err;
+ 
++	spin_lock_init(rlock);
++
+ 	for (i = 0; i < clk_data->clk_num; i++) {
+ 		struct clk *clk;
+ 		const char *clk_name;
+diff --git a/drivers/clk/st/clkgen-fsyn.c b/drivers/clk/st/clkgen-fsyn.c
+index a917c4c7eaa9..6ae068ab07c8 100644
+--- a/drivers/clk/st/clkgen-fsyn.c
++++ b/drivers/clk/st/clkgen-fsyn.c
+@@ -340,7 +340,7 @@ static const struct clkgen_quadfs_data st_fs660c32_C_407 = {
+ 		    CLKGEN_FIELD(0x30c, 0xf, 20),
+ 		    CLKGEN_FIELD(0x310, 0xf, 20) },
+ 	.lockstatus_present = true,
+-	.lock_status = CLKGEN_FIELD(0x2A0, 0x1, 24),
++	.lock_status = CLKGEN_FIELD(0x2f0, 0x1, 24),
+ 	.powerup_polarity = 1,
+ 	.standby_polarity = 1,
+ 	.pll_ops	= &st_quadfs_pll_c32_ops,
+diff --git a/drivers/clk/st/clkgen-mux.c b/drivers/clk/st/clkgen-mux.c
+index fdcff10f6d30..ef6514636bfc 100644
+--- a/drivers/clk/st/clkgen-mux.c
++++ b/drivers/clk/st/clkgen-mux.c
+@@ -582,7 +582,7 @@ static struct clkgen_mux_data stih416_a9_mux_data = {
+ };
+ static struct clkgen_mux_data stih407_a9_mux_data = {
+ 	.offset = 0x1a4,
+-	.shift = 1,
++	.shift = 0,
+ 	.width = 2,
+ };
+ 
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index c45d274a75c8..6f9d27f9001c 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -678,6 +678,7 @@ static struct cpu_defaults knl_params = {
+ 		.get_max = core_get_max_pstate,
+ 		.get_min = core_get_min_pstate,
+ 		.get_turbo = knl_get_turbo_pstate,
++		.get_scaling = core_get_scaling,
+ 		.set = core_set_pstate,
+ 	},
+ };
+diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
+index 46307098f8ba..0a70e46d5416 100644
+--- a/drivers/crypto/omap-des.c
++++ b/drivers/crypto/omap-des.c
+@@ -536,9 +536,6 @@ static int omap_des_crypt_dma_stop(struct omap_des_dev *dd)
+ 	dmaengine_terminate_all(dd->dma_lch_in);
+ 	dmaengine_terminate_all(dd->dma_lch_out);
+ 
+-	dma_unmap_sg(dd->dev, dd->in_sg, dd->in_sg_len, DMA_TO_DEVICE);
+-	dma_unmap_sg(dd->dev, dd->out_sg, dd->out_sg_len, DMA_FROM_DEVICE);
+-
+ 	return err;
+ }
+ 
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 4fd9961d552e..d42537425438 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -305,10 +305,17 @@ const char *cper_mem_err_unpack(struct trace_seq *p,
+ 	return ret;
+ }
+ 
+-static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem)
++static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem,
++	int len)
+ {
+ 	struct cper_mem_err_compact cmem;
+ 
++	/* Don't trust UEFI 2.1/2.2 structure with bad validation bits */
++	if (len == sizeof(struct cper_sec_mem_err_old) &&
++	    (mem->validation_bits & ~(CPER_MEM_VALID_RANK_NUMBER - 1))) {
++		pr_err(FW_WARN "valid bits set for fields beyond structure\n");
++		return;
++	}
+ 	if (mem->validation_bits & CPER_MEM_VALID_ERROR_STATUS)
+ 		printk("%s""error_status: 0x%016llx\n", pfx, mem->error_status);
+ 	if (mem->validation_bits & CPER_MEM_VALID_PA)
+@@ -405,8 +412,10 @@ static void cper_estatus_print_section(
+ 	} else if (!uuid_le_cmp(*sec_type, CPER_SEC_PLATFORM_MEM)) {
+ 		struct cper_sec_mem_err *mem_err = (void *)(gdata + 1);
+ 		printk("%s""section_type: memory error\n", newpfx);
+-		if (gdata->error_data_length >= sizeof(*mem_err))
+-			cper_print_mem(newpfx, mem_err);
++		if (gdata->error_data_length >=
++		    sizeof(struct cper_sec_mem_err_old))
++			cper_print_mem(newpfx, mem_err,
++				       gdata->error_data_length);
+ 		else
+ 			goto err_section_too_small;
+ 	} else if (!uuid_le_cmp(*sec_type, CPER_SEC_PCIE)) {
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index e14363d12690..63226e9036a1 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -57,6 +57,11 @@ bool efi_runtime_disabled(void)
+ 
+ static int __init parse_efi_cmdline(char *str)
+ {
++	if (!str) {
++		pr_warn("need at least one option\n");
++		return -EINVAL;
++	}
++
+ 	if (parse_option_str(str, "noruntime"))
+ 		disable_runtime = true;
+ 
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index 89049335b738..cd6dae08175e 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -863,8 +863,10 @@ nouveau_drm_preclose(struct drm_device *dev, struct drm_file *fpriv)
+ 
+ 	pm_runtime_get_sync(dev->dev);
+ 
++	mutex_lock(&cli->mutex);
+ 	if (cli->abi16)
+ 		nouveau_abi16_fini(cli->abi16);
++	mutex_unlock(&cli->mutex);
+ 
+ 	mutex_lock(&drm->client.mutex);
+ 	list_del(&cli->head);
+diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
+index 4ef602c5469d..495c57644ced 100644
+--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
+@@ -203,7 +203,7 @@ nv04_fbcon_accel_init(struct fb_info *info)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (RING_SPACE(chan, 49)) {
++	if (RING_SPACE(chan, 49 + (device->info.chipset >= 0x11 ? 4 : 0))) {
+ 		nouveau_fbcon_gpu_lockup(info);
+ 		return 0;
+ 	}
+diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
+index 7da7958556a3..981342d142ff 100644
+--- a/drivers/gpu/drm/nouveau/nv50_display.c
++++ b/drivers/gpu/drm/nouveau/nv50_display.c
+@@ -979,7 +979,7 @@ nv50_crtc_cursor_show_hide(struct nouveau_crtc *nv_crtc, bool show, bool update)
+ {
+ 	struct nv50_mast *mast = nv50_mast(nv_crtc->base.dev);
+ 
+-	if (show && nv_crtc->cursor.nvbo)
++	if (show && nv_crtc->cursor.nvbo && nv_crtc->base.enabled)
+ 		nv50_crtc_cursor_show(nv_crtc);
+ 	else
+ 		nv50_crtc_cursor_hide(nv_crtc);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
+index 80614f1b2074..282143f49d72 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
+@@ -50,7 +50,12 @@ nv04_instobj_dtor(struct nvkm_object *object)
+ {
+ 	struct nv04_instmem_priv *priv = (void *)nvkm_instmem(object);
+ 	struct nv04_instobj_priv *node = (void *)object;
++	struct nvkm_subdev *subdev = (void *)priv;
++
++	mutex_lock(&subdev->mutex);
+ 	nvkm_mm_free(&priv->heap, &node->mem);
++	mutex_unlock(&subdev->mutex);
++
+ 	nvkm_instobj_destroy(&node->base);
+ }
+ 
+@@ -62,6 +67,7 @@ nv04_instobj_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
+ 	struct nv04_instmem_priv *priv = (void *)nvkm_instmem(parent);
+ 	struct nv04_instobj_priv *node;
+ 	struct nvkm_instobj_args *args = data;
++	struct nvkm_subdev *subdev = (void *)priv;
+ 	int ret;
+ 
+ 	if (!args->align)
+@@ -72,8 +78,10 @@ nv04_instobj_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
+ 	if (ret)
+ 		return ret;
+ 
++	mutex_lock(&subdev->mutex);
+ 	ret = nvkm_mm_head(&priv->heap, 0, 1, args->size, args->size,
+ 			   args->align, &node->mem);
++	mutex_unlock(&subdev->mutex);
+ 	if (ret)
+ 		return ret;
+ 
+diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
+index 3318de690e00..a2dbbbe0d8d7 100644
+--- a/drivers/hid/hid-cp2112.c
++++ b/drivers/hid/hid-cp2112.c
+@@ -356,6 +356,8 @@ static int cp2112_read(struct cp2112_device *dev, u8 *data, size_t size)
+ 	struct cp2112_force_read_report report;
+ 	int ret;
+ 
++	if (size > sizeof(dev->read_data))
++		size = sizeof(dev->read_data);
+ 	report.report = CP2112_DATA_READ_FORCE_SEND;
+ 	report.length = cpu_to_be16(size);
+ 
+diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
+index 28fcb2e246d5..fbfc02bb2cfa 100644
+--- a/drivers/hwmon/nct7802.c
++++ b/drivers/hwmon/nct7802.c
+@@ -195,7 +195,7 @@ abort:
+ }
+ 
+ static int nct7802_write_voltage(struct nct7802_data *data, int nr, int index,
+-				 unsigned int voltage)
++				 unsigned long voltage)
+ {
+ 	int shift = 8 - REG_VOLTAGE_LIMIT_MSB_SHIFT[index - 1][nr];
+ 	int err;
+diff --git a/drivers/hwmon/nct7904.c b/drivers/hwmon/nct7904.c
+index b77b82f24480..6153df735e82 100644
+--- a/drivers/hwmon/nct7904.c
++++ b/drivers/hwmon/nct7904.c
+@@ -412,8 +412,9 @@ static ssize_t show_pwm(struct device *dev,
+ 	return sprintf(buf, "%d\n", val);
+ }
+ 
+-static ssize_t store_mode(struct device *dev, struct device_attribute *devattr,
+-			  const char *buf, size_t count)
++static ssize_t store_enable(struct device *dev,
++			    struct device_attribute *devattr,
++			    const char *buf, size_t count)
+ {
+ 	int index = to_sensor_dev_attr(devattr)->index;
+ 	struct nct7904_data *data = dev_get_drvdata(dev);
+@@ -422,18 +423,18 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *devattr,
+ 
+ 	if (kstrtoul(buf, 10, &val) < 0)
+ 		return -EINVAL;
+-	if (val > 1 || (val && !data->fan_mode[index]))
++	if (val < 1 || val > 2 || (val == 2 && !data->fan_mode[index]))
+ 		return -EINVAL;
+ 
+ 	ret = nct7904_write_reg(data, BANK_3, FANCTL1_FMR_REG + index,
+-				val ? data->fan_mode[index] : 0);
++				val == 2 ? data->fan_mode[index] : 0);
+ 
+ 	return ret ? ret : count;
+ }
+ 
+-/* Return 0 for manual mode or 1 for SmartFan mode */
+-static ssize_t show_mode(struct device *dev,
+-			 struct device_attribute *devattr, char *buf)
++/* Return 1 for manual mode or 2 for SmartFan mode */
++static ssize_t show_enable(struct device *dev,
++			   struct device_attribute *devattr, char *buf)
+ {
+ 	int index = to_sensor_dev_attr(devattr)->index;
+ 	struct nct7904_data *data = dev_get_drvdata(dev);
+@@ -443,36 +444,36 @@ static ssize_t show_mode(struct device *dev,
+ 	if (val < 0)
+ 		return val;
+ 
+-	return sprintf(buf, "%d\n", val ? 1 : 0);
++	return sprintf(buf, "%d\n", val ? 2 : 1);
+ }
+ 
+ /* 2 attributes per channel: pwm and mode */
+-static SENSOR_DEVICE_ATTR(fan1_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm1, S_IRUGO | S_IWUSR,
+ 			show_pwm, store_pwm, 0);
+-static SENSOR_DEVICE_ATTR(fan1_mode, S_IRUGO | S_IWUSR,
+-			show_mode, store_mode, 0);
+-static SENSOR_DEVICE_ATTR(fan2_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm1_enable, S_IRUGO | S_IWUSR,
++			show_enable, store_enable, 0);
++static SENSOR_DEVICE_ATTR(pwm2, S_IRUGO | S_IWUSR,
+ 			show_pwm, store_pwm, 1);
+-static SENSOR_DEVICE_ATTR(fan2_mode, S_IRUGO | S_IWUSR,
+-			show_mode, store_mode, 1);
+-static SENSOR_DEVICE_ATTR(fan3_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm2_enable, S_IRUGO | S_IWUSR,
++			show_enable, store_enable, 1);
++static SENSOR_DEVICE_ATTR(pwm3, S_IRUGO | S_IWUSR,
+ 			show_pwm, store_pwm, 2);
+-static SENSOR_DEVICE_ATTR(fan3_mode, S_IRUGO | S_IWUSR,
+-			show_mode, store_mode, 2);
+-static SENSOR_DEVICE_ATTR(fan4_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm3_enable, S_IRUGO | S_IWUSR,
++			show_enable, store_enable, 2);
++static SENSOR_DEVICE_ATTR(pwm4, S_IRUGO | S_IWUSR,
+ 			show_pwm, store_pwm, 3);
+-static SENSOR_DEVICE_ATTR(fan4_mode, S_IRUGO | S_IWUSR,
+-			show_mode, store_mode, 3);
++static SENSOR_DEVICE_ATTR(pwm4_enable, S_IRUGO | S_IWUSR,
++			show_enable, store_enable, 3);
+ 
+ static struct attribute *nct7904_fanctl_attrs[] = {
+-	&sensor_dev_attr_fan1_pwm.dev_attr.attr,
+-	&sensor_dev_attr_fan1_mode.dev_attr.attr,
+-	&sensor_dev_attr_fan2_pwm.dev_attr.attr,
+-	&sensor_dev_attr_fan2_mode.dev_attr.attr,
+-	&sensor_dev_attr_fan3_pwm.dev_attr.attr,
+-	&sensor_dev_attr_fan3_mode.dev_attr.attr,
+-	&sensor_dev_attr_fan4_pwm.dev_attr.attr,
+-	&sensor_dev_attr_fan4_mode.dev_attr.attr,
++	&sensor_dev_attr_pwm1.dev_attr.attr,
++	&sensor_dev_attr_pwm1_enable.dev_attr.attr,
++	&sensor_dev_attr_pwm2.dev_attr.attr,
++	&sensor_dev_attr_pwm2_enable.dev_attr.attr,
++	&sensor_dev_attr_pwm3.dev_attr.attr,
++	&sensor_dev_attr_pwm3_enable.dev_attr.attr,
++	&sensor_dev_attr_pwm4.dev_attr.attr,
++	&sensor_dev_attr_pwm4_enable.dev_attr.attr,
+ 	NULL
+ };
+ 
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+index e5cc43074196..2d13fd08ceb7 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+@@ -176,7 +176,8 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
+ 		else
+ 			size += ipoib_recvq_size * ipoib_max_conn_qp;
+ 	} else
+-		goto out_free_wq;
++		if (ret != -ENOSYS)
++			goto out_free_wq;
+ 
+ 	priv->recv_cq = ib_create_cq(priv->ca, ipoib_ib_completion, NULL, dev, size, 0);
+ 	if (IS_ERR(priv->recv_cq)) {
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 35c8d0ceabee..3a32caf06bf1 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1199,7 +1199,7 @@ static void set_input_params(struct psmouse *psmouse,
+ 					ABS_MT_POSITION_Y);
+ 		/* Image sensors can report per-contact pressure */
+ 		input_set_abs_params(dev, ABS_MT_PRESSURE, 0, 255, 0, 0);
+-		input_mt_init_slots(dev, 3, INPUT_MT_POINTER | INPUT_MT_TRACK);
++		input_mt_init_slots(dev, 2, INPUT_MT_POINTER | INPUT_MT_TRACK);
+ 
+ 		/* Image sensors can signal 4 and 5 finger clicks */
+ 		__set_bit(BTN_TOOL_QUADTAP, dev->keybit);
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index f2c6c352c55a..2c41107240de 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -627,6 +627,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
+ 		goto err_out;
+ 	}
+ 
++	/* TSC-25 data sheet specifies a delay after the RESET command */
++	msleep(150);
++
+ 	/* set coordinate output rate */
+ 	buf[0] = buf[1] = 0xFF;
+ 	ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 5ecfaf29933a..c87c4b1bfc00 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1756,8 +1756,9 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
+ 
+ static void domain_exit(struct dmar_domain *domain)
+ {
++	struct dmar_drhd_unit *drhd;
++	struct intel_iommu *iommu;
+ 	struct page *freelist = NULL;
+-	int i;
+ 
+ 	/* Domain 0 is reserved, so dont process it */
+ 	if (!domain)
+@@ -1777,8 +1778,10 @@ static void domain_exit(struct dmar_domain *domain)
+ 
+ 	/* clear attached or cached domains */
+ 	rcu_read_lock();
+-	for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
+-		iommu_detach_domain(domain, g_iommus[i]);
++	for_each_active_iommu(iommu, drhd)
++		if (domain_type_is_vm(domain) ||
++		    test_bit(iommu->seq_id, domain->iommu_bmp))
++			iommu_detach_domain(domain, iommu);
+ 	rcu_read_unlock();
+ 
+ 	dma_free_pagelist(freelist);
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 1b7e155869f6..c00e2db351ba 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -75,6 +75,13 @@ struct its_node {
+ 
+ #define ITS_ITT_ALIGN		SZ_256
+ 
++struct event_lpi_map {
++	unsigned long		*lpi_map;
++	u16			*col_map;
++	irq_hw_number_t		lpi_base;
++	int			nr_lpis;
++};
++
+ /*
+  * The ITS view of a device - belongs to an ITS, a collection, owns an
+  * interrupt translation table, and a list of interrupts.
+@@ -82,11 +89,8 @@ struct its_node {
+ struct its_device {
+ 	struct list_head	entry;
+ 	struct its_node		*its;
+-	struct its_collection	*collection;
++	struct event_lpi_map	event_map;
+ 	void			*itt;
+-	unsigned long		*lpi_map;
+-	irq_hw_number_t		lpi_base;
+-	int			nr_lpis;
+ 	u32			nr_ites;
+ 	u32			device_id;
+ };
+@@ -99,6 +103,14 @@ static struct rdists *gic_rdists;
+ #define gic_data_rdist()		(raw_cpu_ptr(gic_rdists->rdist))
+ #define gic_data_rdist_rd_base()	(gic_data_rdist()->rd_base)
+ 
++static struct its_collection *dev_event_to_col(struct its_device *its_dev,
++					       u32 event)
++{
++	struct its_node *its = its_dev->its;
++
++	return its->collections + its_dev->event_map.col_map[event];
++}
++
+ /*
+  * ITS command descriptors - parameters to be encoded in a command
+  * block.
+@@ -134,7 +146,7 @@ struct its_cmd_desc {
+ 		struct {
+ 			struct its_device *dev;
+ 			struct its_collection *col;
+-			u32 id;
++			u32 event_id;
+ 		} its_movi_cmd;
+ 
+ 		struct {
+@@ -241,7 +253,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_cmd_block *cmd,
+ 
+ 	its_fixup_cmd(cmd);
+ 
+-	return desc->its_mapd_cmd.dev->collection;
++	return NULL;
+ }
+ 
+ static struct its_collection *its_build_mapc_cmd(struct its_cmd_block *cmd,
+@@ -260,52 +272,72 @@ static struct its_collection *its_build_mapc_cmd(struct its_cmd_block *cmd,
+ static struct its_collection *its_build_mapvi_cmd(struct its_cmd_block *cmd,
+ 						  struct its_cmd_desc *desc)
+ {
++	struct its_collection *col;
++
++	col = dev_event_to_col(desc->its_mapvi_cmd.dev,
++			       desc->its_mapvi_cmd.event_id);
++
+ 	its_encode_cmd(cmd, GITS_CMD_MAPVI);
+ 	its_encode_devid(cmd, desc->its_mapvi_cmd.dev->device_id);
+ 	its_encode_event_id(cmd, desc->its_mapvi_cmd.event_id);
+ 	its_encode_phys_id(cmd, desc->its_mapvi_cmd.phys_id);
+-	its_encode_collection(cmd, desc->its_mapvi_cmd.dev->collection->col_id);
++	its_encode_collection(cmd, col->col_id);
+ 
+ 	its_fixup_cmd(cmd);
+ 
+-	return desc->its_mapvi_cmd.dev->collection;
++	return col;
+ }
+ 
+ static struct its_collection *its_build_movi_cmd(struct its_cmd_block *cmd,
+ 						 struct its_cmd_desc *desc)
+ {
++	struct its_collection *col;
++
++	col = dev_event_to_col(desc->its_movi_cmd.dev,
++			       desc->its_movi_cmd.event_id);
++
+ 	its_encode_cmd(cmd, GITS_CMD_MOVI);
+ 	its_encode_devid(cmd, desc->its_movi_cmd.dev->device_id);
+-	its_encode_event_id(cmd, desc->its_movi_cmd.id);
++	its_encode_event_id(cmd, desc->its_movi_cmd.event_id);
+ 	its_encode_collection(cmd, desc->its_movi_cmd.col->col_id);
+ 
+ 	its_fixup_cmd(cmd);
+ 
+-	return desc->its_movi_cmd.dev->collection;
++	return col;
+ }
+ 
+ static struct its_collection *its_build_discard_cmd(struct its_cmd_block *cmd,
+ 						    struct its_cmd_desc *desc)
+ {
++	struct its_collection *col;
++
++	col = dev_event_to_col(desc->its_discard_cmd.dev,
++			       desc->its_discard_cmd.event_id);
++
+ 	its_encode_cmd(cmd, GITS_CMD_DISCARD);
+ 	its_encode_devid(cmd, desc->its_discard_cmd.dev->device_id);
+ 	its_encode_event_id(cmd, desc->its_discard_cmd.event_id);
+ 
+ 	its_fixup_cmd(cmd);
+ 
+-	return desc->its_discard_cmd.dev->collection;
++	return col;
+ }
+ 
+ static struct its_collection *its_build_inv_cmd(struct its_cmd_block *cmd,
+ 						struct its_cmd_desc *desc)
+ {
++	struct its_collection *col;
++
++	col = dev_event_to_col(desc->its_inv_cmd.dev,
++			       desc->its_inv_cmd.event_id);
++
+ 	its_encode_cmd(cmd, GITS_CMD_INV);
+ 	its_encode_devid(cmd, desc->its_inv_cmd.dev->device_id);
+ 	its_encode_event_id(cmd, desc->its_inv_cmd.event_id);
+ 
+ 	its_fixup_cmd(cmd);
+ 
+-	return desc->its_inv_cmd.dev->collection;
++	return col;
+ }
+ 
+ static struct its_collection *its_build_invall_cmd(struct its_cmd_block *cmd,
+@@ -497,7 +529,7 @@ static void its_send_movi(struct its_device *dev,
+ 
+ 	desc.its_movi_cmd.dev = dev;
+ 	desc.its_movi_cmd.col = col;
+-	desc.its_movi_cmd.id = id;
++	desc.its_movi_cmd.event_id = id;
+ 
+ 	its_send_single_command(dev->its, its_build_movi_cmd, &desc);
+ }
+@@ -528,7 +560,7 @@ static void its_send_invall(struct its_node *its, struct its_collection *col)
+ static inline u32 its_get_event_id(struct irq_data *d)
+ {
+ 	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+-	return d->hwirq - its_dev->lpi_base;
++	return d->hwirq - its_dev->event_map.lpi_base;
+ }
+ 
+ static void lpi_set_config(struct irq_data *d, bool enable)
+@@ -583,7 +615,7 @@ static int its_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
+ 
+ 	target_col = &its_dev->its->collections[cpu];
+ 	its_send_movi(its_dev, target_col, id);
+-	its_dev->collection = target_col;
++	its_dev->event_map.col_map[id] = cpu;
+ 
+ 	return IRQ_SET_MASK_OK_DONE;
+ }
+@@ -713,8 +745,10 @@ out:
+ 	return bitmap;
+ }
+ 
+-static void its_lpi_free(unsigned long *bitmap, int base, int nr_ids)
++static void its_lpi_free(struct event_lpi_map *map)
+ {
++	int base = map->lpi_base;
++	int nr_ids = map->nr_lpis;
+ 	int lpi;
+ 
+ 	spin_lock(&lpi_lock);
+@@ -731,7 +765,8 @@ static void its_lpi_free(unsigned long *bitmap, int base, int nr_ids)
+ 
+ 	spin_unlock(&lpi_lock);
+ 
+-	kfree(bitmap);
++	kfree(map->lpi_map);
++	kfree(map->col_map);
+ }
+ 
+ /*
+@@ -1099,11 +1134,11 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
+ 	struct its_device *dev;
+ 	unsigned long *lpi_map;
+ 	unsigned long flags;
++	u16 *col_map = NULL;
+ 	void *itt;
+ 	int lpi_base;
+ 	int nr_lpis;
+ 	int nr_ites;
+-	int cpu;
+ 	int sz;
+ 
+ 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+@@ -1117,20 +1152,24 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
+ 	sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
+ 	itt = kzalloc(sz, GFP_KERNEL);
+ 	lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
++	if (lpi_map)
++		col_map = kzalloc(sizeof(*col_map) * nr_lpis, GFP_KERNEL);
+ 
+-	if (!dev || !itt || !lpi_map) {
++	if (!dev || !itt || !lpi_map || !col_map) {
+ 		kfree(dev);
+ 		kfree(itt);
+ 		kfree(lpi_map);
++		kfree(col_map);
+ 		return NULL;
+ 	}
+ 
+ 	dev->its = its;
+ 	dev->itt = itt;
+ 	dev->nr_ites = nr_ites;
+-	dev->lpi_map = lpi_map;
+-	dev->lpi_base = lpi_base;
+-	dev->nr_lpis = nr_lpis;
++	dev->event_map.lpi_map = lpi_map;
++	dev->event_map.col_map = col_map;
++	dev->event_map.lpi_base = lpi_base;
++	dev->event_map.nr_lpis = nr_lpis;
+ 	dev->device_id = dev_id;
+ 	INIT_LIST_HEAD(&dev->entry);
+ 
+@@ -1138,10 +1177,6 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
+ 	list_add(&dev->entry, &its->its_device_list);
+ 	raw_spin_unlock_irqrestore(&its->lock, flags);
+ 
+-	/* Bind the device to the first possible CPU */
+-	cpu = cpumask_first(cpu_online_mask);
+-	dev->collection = &its->collections[cpu];
+-
+ 	/* Map device to its ITT */
+ 	its_send_mapd(dev, 1);
+ 
+@@ -1163,12 +1198,13 @@ static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
+ {
+ 	int idx;
+ 
+-	idx = find_first_zero_bit(dev->lpi_map, dev->nr_lpis);
+-	if (idx == dev->nr_lpis)
++	idx = find_first_zero_bit(dev->event_map.lpi_map,
++				  dev->event_map.nr_lpis);
++	if (idx == dev->event_map.nr_lpis)
+ 		return -ENOSPC;
+ 
+-	*hwirq = dev->lpi_base + idx;
+-	set_bit(idx, dev->lpi_map);
++	*hwirq = dev->event_map.lpi_base + idx;
++	set_bit(idx, dev->event_map.lpi_map);
+ 
+ 	return 0;
+ }
+@@ -1288,7 +1324,8 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ 		irq_domain_set_hwirq_and_chip(domain, virq + i,
+ 					      hwirq, &its_irq_chip, its_dev);
+ 		dev_dbg(info->scratchpad[1].ptr, "ID:%d pID:%d vID:%d\n",
+-			(int)(hwirq - its_dev->lpi_base), (int)hwirq, virq + i);
++			(int)(hwirq - its_dev->event_map.lpi_base),
++			(int)hwirq, virq + i);
+ 	}
+ 
+ 	return 0;
+@@ -1300,6 +1337,9 @@ static void its_irq_domain_activate(struct irq_domain *domain,
+ 	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+ 	u32 event = its_get_event_id(d);
+ 
++	/* Bind the LPI to the first possible CPU */
++	its_dev->event_map.col_map[event] = cpumask_first(cpu_online_mask);
++
+ 	/* Map the GIC IRQ and event to the device */
+ 	its_send_mapvi(its_dev, d->hwirq, event);
+ }
+@@ -1327,17 +1367,16 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
+ 		u32 event = its_get_event_id(data);
+ 
+ 		/* Mark interrupt index as unused */
+-		clear_bit(event, its_dev->lpi_map);
++		clear_bit(event, its_dev->event_map.lpi_map);
+ 
+ 		/* Nuke the entry in the domain */
+ 		irq_domain_reset_irq_data(data);
+ 	}
+ 
+ 	/* If all interrupts have been freed, start mopping the floor */
+-	if (bitmap_empty(its_dev->lpi_map, its_dev->nr_lpis)) {
+-		its_lpi_free(its_dev->lpi_map,
+-			     its_dev->lpi_base,
+-			     its_dev->nr_lpis);
++	if (bitmap_empty(its_dev->event_map.lpi_map,
++			 its_dev->event_map.nr_lpis)) {
++		its_lpi_free(&its_dev->event_map);
+ 
+ 		/* Unmap device/itt */
+ 		its_send_mapd(its_dev, 0);
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 2caf492890d6..e8d84566f311 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1053,13 +1053,10 @@ static struct dm_rq_target_io *tio_from_request(struct request *rq)
+  */
+ static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
+ {
+-	int nr_requests_pending;
+-
+ 	atomic_dec(&md->pending[rw]);
+ 
+ 	/* nudge anyone waiting on suspend queue */
+-	nr_requests_pending = md_in_flight(md);
+-	if (!nr_requests_pending)
++	if (!md_in_flight(md))
+ 		wake_up(&md->wait);
+ 
+ 	/*
+@@ -1071,8 +1068,7 @@ static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
+ 	if (run_queue) {
+ 		if (md->queue->mq_ops)
+ 			blk_mq_run_hw_queues(md->queue, true);
+-		else if (!nr_requests_pending ||
+-			 (nr_requests_pending >= md->queue->nr_congestion_on))
++		else
+ 			blk_run_queue_async(md->queue);
+ 	}
+ 
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 9157a29c8dbf..cd7b0c1e882d 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
+ 		spin_lock_irqsave(&conf->device_lock, flags);
+ 		if (r1_bio->mddev->degraded == conf->raid_disks ||
+ 		    (r1_bio->mddev->degraded == conf->raid_disks-1 &&
+-		     !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
++		     test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
+ 			uptodate = 1;
+ 		spin_unlock_irqrestore(&conf->device_lock, flags);
+ 	}
+diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
+index d1b55fe62817..e4dc8cdf67a3 100644
+--- a/drivers/misc/cxl/context.c
++++ b/drivers/misc/cxl/context.c
+@@ -113,11 +113,11 @@ static int cxl_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ 
+ 	if (ctx->afu->current_mode == CXL_MODE_DEDICATED) {
+ 		area = ctx->afu->psn_phys;
+-		if (offset > ctx->afu->adapter->ps_size)
++		if (offset >= ctx->afu->adapter->ps_size)
+ 			return VM_FAULT_SIGBUS;
+ 	} else {
+ 		area = ctx->psn_phys;
+-		if (offset > ctx->psn_size)
++		if (offset >= ctx->psn_size)
+ 			return VM_FAULT_SIGBUS;
+ 	}
+ 
+diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
+index 8ccddceead66..de350dd46218 100644
+--- a/drivers/misc/cxl/main.c
++++ b/drivers/misc/cxl/main.c
+@@ -73,7 +73,7 @@ static inline void cxl_slbia_core(struct mm_struct *mm)
+ 		spin_lock(&adapter->afu_list_lock);
+ 		for (slice = 0; slice < adapter->slices; slice++) {
+ 			afu = adapter->afu[slice];
+-			if (!afu->enabled)
++			if (!afu || !afu->enabled)
+ 				continue;
+ 			rcu_read_lock();
+ 			idr_for_each_entry(&afu->contexts_idr, ctx, id)
+diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
+index 3e2968159506..e40bcd03bd47 100644
+--- a/drivers/misc/mei/main.c
++++ b/drivers/misc/mei/main.c
+@@ -685,7 +685,7 @@ int mei_register(struct mei_device *dev, struct device *parent)
+ 	/* Fill in the data structures */
+ 	devno = MKDEV(MAJOR(mei_devt), dev->minor);
+ 	cdev_init(&dev->cdev, &mei_fops);
+-	dev->cdev.owner = mei_fops.owner;
++	dev->cdev.owner = parent->driver->owner;
+ 
+ 	/* Add the device */
+ 	ret = cdev_add(&dev->cdev, devno, 1);
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 9df2b6801f76..d0abdffb0d7c 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -1062,6 +1062,10 @@ static void omap_hsmmc_do_irq(struct omap_hsmmc_host *host, int status)
+ 
+ 		if (status & (CTO_EN | CCRC_EN))
+ 			end_cmd = 1;
++		if (host->data || host->response_busy) {
++			end_trans = !end_cmd;
++			host->response_busy = 0;
++		}
+ 		if (status & (CTO_EN | DTO_EN))
+ 			hsmmc_command_incomplete(host, -ETIMEDOUT, end_cmd);
+ 		else if (status & (CCRC_EN | DCRC_EN))
+@@ -1081,10 +1085,6 @@ static void omap_hsmmc_do_irq(struct omap_hsmmc_host *host, int status)
+ 			}
+ 			dev_dbg(mmc_dev(host->mmc), "AC12 err: 0x%x\n", ac12);
+ 		}
+-		if (host->data || host->response_busy) {
+-			end_trans = !end_cmd;
+-			host->response_busy = 0;
+-		}
+ 	}
+ 
+ 	OMAP_HSMMC_WRITE(host->base, STAT, status);
+diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
+index 3497cfaf683c..a870c42731d7 100644
+--- a/drivers/mmc/host/sdhci-esdhc.h
++++ b/drivers/mmc/host/sdhci-esdhc.h
+@@ -45,6 +45,6 @@
+ #define ESDHC_DMA_SYSCTL	0x40c
+ #define ESDHC_DMA_SNOOP		0x00000040
+ 
+-#define ESDHC_HOST_CONTROL_RES	0x05
++#define ESDHC_HOST_CONTROL_RES	0x01
+ 
+ #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */
+diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
+index b5103a247bc1..065dc70caa1d 100644
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -411,6 +411,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ 			goto err_of_parse;
+ 		sdhci_get_of_property(pdev);
+ 		pdata = pxav3_get_mmc_pdata(dev);
++		pdev->dev.platform_data = pdata;
+ 	} else if (pdata) {
+ 		/* on-chip device */
+ 		if (pdata->flags & PXA_FLAG_CARD_PERMANENT)
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index d3dbb28057e9..bec8a307f8cd 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3037,8 +3037,11 @@ int sdhci_add_host(struct sdhci_host *host)
+ 						      GFP_KERNEL);
+ 		host->align_buffer = kmalloc(host->align_buffer_sz, GFP_KERNEL);
+ 		if (!host->adma_table || !host->align_buffer) {
+-			dma_free_coherent(mmc_dev(mmc), host->adma_table_sz,
+-					  host->adma_table, host->adma_addr);
++			if (host->adma_table)
++				dma_free_coherent(mmc_dev(mmc),
++						  host->adma_table_sz,
++						  host->adma_table,
++						  host->adma_addr);
+ 			kfree(host->align_buffer);
+ 			pr_warn("%s: Unable to allocate ADMA buffers - falling back to standard DMA\n",
+ 				mmc_hostname(mmc));
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 041525d2595c..5d214d135332 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -592,6 +592,7 @@ static int c_can_start(struct net_device *dev)
+ {
+ 	struct c_can_priv *priv = netdev_priv(dev);
+ 	int err;
++	struct pinctrl *p;
+ 
+ 	/* basic c_can configuration */
+ 	err = c_can_chip_config(dev);
+@@ -604,8 +605,13 @@ static int c_can_start(struct net_device *dev)
+ 
+ 	priv->can.state = CAN_STATE_ERROR_ACTIVE;
+ 
+-	/* activate pins */
+-	pinctrl_pm_select_default_state(dev->dev.parent);
++	/* Attempt to use "active" if available else use "default" */
++	p = pinctrl_get_select(priv->device, "active");
++	if (!IS_ERR(p))
++		pinctrl_put(p);
++	else
++		pinctrl_pm_select_default_state(priv->device);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index e9b1810d319f..aede704605c6 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -440,9 +440,6 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
+ 		struct can_frame *cf = (struct can_frame *)skb->data;
+ 		u8 dlc = cf->can_dlc;
+ 
+-		if (!(skb->tstamp.tv64))
+-			__net_timestamp(skb);
+-
+ 		netif_rx(priv->echo_skb[idx]);
+ 		priv->echo_skb[idx] = NULL;
+ 
+@@ -578,7 +575,6 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	__net_timestamp(skb);
+ 	skb->protocol = htons(ETH_P_CAN);
+ 	skb->pkt_type = PACKET_BROADCAST;
+ 	skb->ip_summed = CHECKSUM_UNNECESSARY;
+@@ -589,6 +585,7 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
+ 
+ 	can_skb_reserve(skb);
+ 	can_skb_prv(skb)->ifindex = dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 
+ 	*cf = (struct can_frame *)skb_put(skb, sizeof(struct can_frame));
+ 	memset(*cf, 0, sizeof(struct can_frame));
+@@ -607,7 +604,6 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	__net_timestamp(skb);
+ 	skb->protocol = htons(ETH_P_CANFD);
+ 	skb->pkt_type = PACKET_BROADCAST;
+ 	skb->ip_summed = CHECKSUM_UNNECESSARY;
+@@ -618,6 +614,7 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
+ 
+ 	can_skb_reserve(skb);
+ 	can_skb_prv(skb)->ifindex = dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 
+ 	*cfd = (struct canfd_frame *)skb_put(skb, sizeof(struct canfd_frame));
+ 	memset(*cfd, 0, sizeof(struct canfd_frame));
+diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
+index 7deb80dcbe8c..2f9ebad4ff56 100644
+--- a/drivers/net/can/rcar_can.c
++++ b/drivers/net/can/rcar_can.c
+@@ -526,7 +526,7 @@ static int rcar_can_open(struct net_device *ndev)
+ 	napi_enable(&priv->napi);
+ 	err = request_irq(ndev->irq, rcar_can_interrupt, 0, ndev->name, ndev);
+ 	if (err) {
+-		netdev_err(ndev, "error requesting interrupt %x\n", ndev->irq);
++		netdev_err(ndev, "error requesting interrupt %d\n", ndev->irq);
+ 		goto out_close;
+ 	}
+ 	can_led_event(ndev, CAN_LED_EVENT_OPEN);
+@@ -758,8 +758,9 @@ static int rcar_can_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	if (!irq) {
++	if (irq < 0) {
+ 		dev_err(&pdev->dev, "No IRQ resource\n");
++		err = irq;
+ 		goto fail;
+ 	}
+ 
+@@ -823,7 +824,7 @@ static int rcar_can_probe(struct platform_device *pdev)
+ 
+ 	devm_can_led_init(ndev);
+ 
+-	dev_info(&pdev->dev, "device registered (reg_base=%p, irq=%u)\n",
++	dev_info(&pdev->dev, "device registered (regs @ %p, IRQ%d)\n",
+ 		 priv->regs, ndev->irq);
+ 
+ 	return 0;
+diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
+index f64f5290d6f8..a23a7af8eb9a 100644
+--- a/drivers/net/can/slcan.c
++++ b/drivers/net/can/slcan.c
+@@ -207,7 +207,6 @@ static void slc_bump(struct slcan *sl)
+ 	if (!skb)
+ 		return;
+ 
+-	__net_timestamp(skb);
+ 	skb->dev = sl->dev;
+ 	skb->protocol = htons(ETH_P_CAN);
+ 	skb->pkt_type = PACKET_BROADCAST;
+@@ -215,6 +214,7 @@ static void slc_bump(struct slcan *sl)
+ 
+ 	can_skb_reserve(skb);
+ 	can_skb_prv(skb)->ifindex = sl->dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 
+ 	memcpy(skb_put(skb, sizeof(struct can_frame)),
+ 	       &cf, sizeof(struct can_frame));
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index bf63fee4e743..34c625ea2801 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -1221,17 +1221,16 @@ static int __maybe_unused mcp251x_can_resume(struct device *dev)
+ 	struct spi_device *spi = to_spi_device(dev);
+ 	struct mcp251x_priv *priv = spi_get_drvdata(spi);
+ 
+-	if (priv->after_suspend & AFTER_SUSPEND_POWER) {
++	if (priv->after_suspend & AFTER_SUSPEND_POWER)
+ 		mcp251x_power_enable(priv->power, 1);
++
++	if (priv->after_suspend & AFTER_SUSPEND_UP) {
++		mcp251x_power_enable(priv->transceiver, 1);
+ 		queue_work(priv->wq, &priv->restart_work);
+ 	} else {
+-		if (priv->after_suspend & AFTER_SUSPEND_UP) {
+-			mcp251x_power_enable(priv->transceiver, 1);
+-			queue_work(priv->wq, &priv->restart_work);
+-		} else {
+-			priv->after_suspend = 0;
+-		}
++		priv->after_suspend = 0;
+ 	}
++
+ 	priv->force_quit = 0;
+ 	enable_irq(spi->irq);
+ 	return 0;
+diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
+index 0ce868de855d..674f367087c5 100644
+--- a/drivers/net/can/vcan.c
++++ b/drivers/net/can/vcan.c
+@@ -78,9 +78,6 @@ static void vcan_rx(struct sk_buff *skb, struct net_device *dev)
+ 	skb->dev       = dev;
+ 	skb->ip_summed = CHECKSUM_UNNECESSARY;
+ 
+-	if (!(skb->tstamp.tv64))
+-		__net_timestamp(skb);
+-
+ 	netif_rx_ni(skb);
+ }
+ 
+diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+index 8e604a3931ca..ef20be084b24 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+@@ -540,13 +540,11 @@ static void iwl_set_hw_address_family_8000(struct device *dev,
+ 		hw_addr = (const u8 *)(mac_override +
+ 				 MAC_ADDRESS_OVERRIDE_FAMILY_8000);
+ 
+-		/* The byte order is little endian 16 bit, meaning 214365 */
+-		data->hw_addr[0] = hw_addr[1];
+-		data->hw_addr[1] = hw_addr[0];
+-		data->hw_addr[2] = hw_addr[3];
+-		data->hw_addr[3] = hw_addr[2];
+-		data->hw_addr[4] = hw_addr[5];
+-		data->hw_addr[5] = hw_addr[4];
++		/*
++		 * Store the MAC address from MAO section.
++		 * No byte swapping is required in MAO section
++		 */
++		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
+ 
+ 		/*
+ 		 * Force the use of the OTP MAC address in case of reserved MAC
+diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
+index ef32e177f662..281451c274ca 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
+@@ -225,7 +225,7 @@ void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, struct iwl_tx_cmd *tx_cmd,
+ 
+ 	if (info->band == IEEE80211_BAND_2GHZ &&
+ 	    !iwl_mvm_bt_coex_is_shared_ant_avail(mvm))
+-		rate_flags = BIT(mvm->cfg->non_shared_ant) << RATE_MCS_ANT_POS;
++		rate_flags = mvm->cfg->non_shared_ant << RATE_MCS_ANT_POS;
+ 	else
+ 		rate_flags =
+ 			BIT(mvm->mgmt_last_antenna_idx) << RATE_MCS_ANT_POS;
+diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
+index dc179094e6a0..37e6a6f91487 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -2515,6 +2515,12 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ 		trans->hw_rev = (trans->hw_rev & 0xfff0) |
+ 				(CSR_HW_REV_STEP(trans->hw_rev << 2) << 2);
+ 
++		ret = iwl_pcie_prepare_card_hw(trans);
++		if (ret) {
++			IWL_WARN(trans, "Exit HW not ready\n");
++			goto out_pci_disable_msi;
++		}
++
+ 		/*
+ 		 * in-order to recognize C step driver should read chip version
+ 		 * id located at the AUX bus MISC address space.
+diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+index 5ac59fbb2440..d3a3be7476e1 100644
+--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+@@ -403,14 +403,13 @@ static int imx1_pinconf_set(struct pinctrl_dev *pctldev,
+ 			     unsigned num_configs)
+ {
+ 	struct imx1_pinctrl *ipctl = pinctrl_dev_get_drvdata(pctldev);
+-	const struct imx1_pinctrl_soc_info *info = ipctl->info;
+ 	int i;
+ 
+ 	for (i = 0; i != num_configs; ++i) {
+ 		imx1_write_bit(ipctl, pin_id, configs[i] & 0x01, MX1_PUEN);
+ 
+ 		dev_dbg(ipctl->dev, "pinconf set pullup pin %s\n",
+-			info->pins[pin_id].name);
++			pin_desc_get(pctldev, pin_id)->name);
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
+index ff828117798f..8de135174e82 100644
+--- a/drivers/regulator/s2mps11.c
++++ b/drivers/regulator/s2mps11.c
+@@ -34,6 +34,8 @@
+ #include <linux/mfd/samsung/s2mps14.h>
+ #include <linux/mfd/samsung/s2mpu02.h>
+ 
++/* The highest number of possible regulators for supported devices. */
++#define S2MPS_REGULATOR_MAX		S2MPS13_REGULATOR_MAX
+ struct s2mps11_info {
+ 	unsigned int rdev_num;
+ 	int ramp_delay2;
+@@ -49,7 +51,7 @@ struct s2mps11_info {
+ 	 * One bit for each S2MPS13/S2MPS14/S2MPU02 regulator whether
+ 	 * the suspend mode was enabled.
+ 	 */
+-	unsigned long long s2mps14_suspend_state:50;
++	DECLARE_BITMAP(suspend_state, S2MPS_REGULATOR_MAX);
+ 
+ 	/* Array of size rdev_num with GPIO-s for external sleep control */
+ 	int *ext_control_gpio;
+@@ -500,7 +502,7 @@ static int s2mps14_regulator_enable(struct regulator_dev *rdev)
+ 	switch (s2mps11->dev_type) {
+ 	case S2MPS13X:
+ 	case S2MPS14X:
+-		if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
++		if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
+ 			val = S2MPS14_ENABLE_SUSPEND;
+ 		else if (gpio_is_valid(s2mps11->ext_control_gpio[rdev_get_id(rdev)]))
+ 			val = S2MPS14_ENABLE_EXT_CONTROL;
+@@ -508,7 +510,7 @@ static int s2mps14_regulator_enable(struct regulator_dev *rdev)
+ 			val = rdev->desc->enable_mask;
+ 		break;
+ 	case S2MPU02:
+-		if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
++		if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
+ 			val = S2MPU02_ENABLE_SUSPEND;
+ 		else
+ 			val = rdev->desc->enable_mask;
+@@ -562,7 +564,7 @@ static int s2mps14_regulator_set_suspend_disable(struct regulator_dev *rdev)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	s2mps11->s2mps14_suspend_state |= (1 << rdev_get_id(rdev));
++	set_bit(rdev_get_id(rdev), s2mps11->suspend_state);
+ 	/*
+ 	 * Don't enable suspend mode if regulator is already disabled because
+ 	 * this would effectively for a short time turn on the regulator after
+@@ -960,18 +962,22 @@ static int s2mps11_pmic_probe(struct platform_device *pdev)
+ 	case S2MPS11X:
+ 		s2mps11->rdev_num = ARRAY_SIZE(s2mps11_regulators);
+ 		regulators = s2mps11_regulators;
++		BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ 		break;
+ 	case S2MPS13X:
+ 		s2mps11->rdev_num = ARRAY_SIZE(s2mps13_regulators);
+ 		regulators = s2mps13_regulators;
++		BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ 		break;
+ 	case S2MPS14X:
+ 		s2mps11->rdev_num = ARRAY_SIZE(s2mps14_regulators);
+ 		regulators = s2mps14_regulators;
++		BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ 		break;
+ 	case S2MPU02:
+ 		s2mps11->rdev_num = ARRAY_SIZE(s2mpu02_regulators);
+ 		regulators = s2mpu02_regulators;
++		BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ 		break;
+ 	default:
+ 		dev_err(&pdev->dev, "Invalid device type: %u\n",
+diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
+index 0e6ee3ca30e6..e9ae6b924c70 100644
+--- a/drivers/scsi/qla2xxx/qla_dbg.c
++++ b/drivers/scsi/qla2xxx/qla_dbg.c
+@@ -68,7 +68,7 @@
+  * |                              |                    | 0xd101-0xd1fe	|
+  * |                              |                    | 0xd214-0xd2fe	|
+  * | Target Mode		  |	  0xe079       |		|
+- * | Target Mode Management	  |	  0xf072       | 0xf002		|
++ * | Target Mode Management	  |	  0xf080       | 0xf002		|
+  * |                              |                    | 0xf046-0xf049  |
+  * | Target Mode Task Management  |	  0x1000b      |		|
+  * ----------------------------------------------------------------------
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 285cb204f300..998498e2341b 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -2924,6 +2924,7 @@ qla2x00_rport_del(void *data)
+ 	struct fc_rport *rport;
+ 	scsi_qla_host_t *vha = fcport->vha;
+ 	unsigned long flags;
++	unsigned long vha_flags;
+ 
+ 	spin_lock_irqsave(fcport->vha->host->host_lock, flags);
+ 	rport = fcport->drport ? fcport->drport: fcport->rport;
+@@ -2935,7 +2936,9 @@ qla2x00_rport_del(void *data)
+ 		 * Release the target mode FC NEXUS in qla_target.c code
+ 		 * if target mod is enabled.
+ 		 */
++		spin_lock_irqsave(&vha->hw->hardware_lock, vha_flags);
+ 		qlt_fc_port_deleted(vha, fcport);
++		spin_unlock_irqrestore(&vha->hw->hardware_lock, vha_flags);
+ 	}
+ }
+ 
+@@ -3303,6 +3306,7 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport)
+ 	 * Create target mode FC NEXUS in qla_target.c if target mode is
+ 	 * enabled..
+ 	 */
++
+ 	qlt_fc_port_added(vha, fcport);
+ 
+ 	spin_lock_irqsave(fcport->vha->host->host_lock, flags);
+@@ -3460,20 +3464,43 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ 			if ((fcport->flags & FCF_FABRIC_DEVICE) == 0)
+ 				continue;
+ 
+-			if (fcport->scan_state == QLA_FCPORT_SCAN &&
+-			    atomic_read(&fcport->state) == FCS_ONLINE) {
+-				qla2x00_mark_device_lost(vha, fcport,
+-				    ql2xplogiabsentdevice, 0);
+-				if (fcport->loop_id != FC_NO_LOOP_ID &&
+-				    (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
+-				    fcport->port_type != FCT_INITIATOR &&
+-				    fcport->port_type != FCT_BROADCAST) {
+-					ha->isp_ops->fabric_logout(vha,
+-					    fcport->loop_id,
+-					    fcport->d_id.b.domain,
+-					    fcport->d_id.b.area,
+-					    fcport->d_id.b.al_pa);
+-					qla2x00_clear_loop_id(fcport);
++			if (fcport->scan_state == QLA_FCPORT_SCAN) {
++				if (qla_ini_mode_enabled(base_vha) &&
++				    atomic_read(&fcport->state) == FCS_ONLINE) {
++					qla2x00_mark_device_lost(vha, fcport,
++					    ql2xplogiabsentdevice, 0);
++					if (fcport->loop_id != FC_NO_LOOP_ID &&
++					    (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
++					    fcport->port_type != FCT_INITIATOR &&
++					    fcport->port_type != FCT_BROADCAST) {
++						ha->isp_ops->fabric_logout(vha,
++						    fcport->loop_id,
++						    fcport->d_id.b.domain,
++						    fcport->d_id.b.area,
++						    fcport->d_id.b.al_pa);
++						qla2x00_clear_loop_id(fcport);
++					}
++				} else if (!qla_ini_mode_enabled(base_vha)) {
++					/*
++					 * In target mode, explicitly kill
++					 * sessions and log out of devices
++					 * that are gone, so that we don't
++					 * end up with an initiator using the
++					 * wrong ACL (if the fabric recycles
++					 * an FC address and we have a stale
++					 * session around) and so that we don't
++					 * report initiators that are no longer
++					 * on the fabric.
++					 */
++					ql_dbg(ql_dbg_tgt_mgt, vha, 0xf077,
++					    "port gone, logging out/killing session: "
++					    "%8phC state 0x%x flags 0x%x fc4_type 0x%x "
++					    "scan_state %d\n",
++					    fcport->port_name,
++					    atomic_read(&fcport->state),
++					    fcport->flags, fcport->fc4_type,
++					    fcport->scan_state);
++					qlt_fc_port_deleted(vha, fcport);
+ 				}
+ 			}
+ 		}
+@@ -3494,6 +3521,28 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ 			    (fcport->flags & FCF_LOGIN_NEEDED) == 0)
+ 				continue;
+ 
++			/*
++			 * If we're not an initiator, skip looking for devices
++			 * and logging in.  There's no reason for us to do it,
++			 * and it seems to actively cause problems in target
++			 * mode if we race with the initiator logging into us
++			 * (we might get the "port ID used" status back from
++			 * our login command and log out the initiator, which
++			 * seems to cause havoc).
++			 */
++			if (!qla_ini_mode_enabled(base_vha)) {
++				if (fcport->scan_state == QLA_FCPORT_FOUND) {
++					ql_dbg(ql_dbg_tgt_mgt, vha, 0xf078,
++					    "port %8phC state 0x%x flags 0x%x fc4_type 0x%x "
++					    "scan_state %d (initiator mode disabled; skipping "
++					    "login)\n", fcport->port_name,
++					    atomic_read(&fcport->state),
++					    fcport->flags, fcport->fc4_type,
++					    fcport->scan_state);
++				}
++				continue;
++			}
++
+ 			if (fcport->loop_id == FC_NO_LOOP_ID) {
+ 				fcport->loop_id = next_loopid;
+ 				rval = qla2x00_find_new_loop_id(
+@@ -3520,16 +3569,38 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ 			    test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags))
+ 				break;
+ 
+-			/* Find a new loop ID to use. */
+-			fcport->loop_id = next_loopid;
+-			rval = qla2x00_find_new_loop_id(base_vha, fcport);
+-			if (rval != QLA_SUCCESS) {
+-				/* Ran out of IDs to use */
+-				break;
+-			}
++			/*
++			 * If we're not an initiator, skip looking for devices
++			 * and logging in.  There's no reason for us to do it,
++			 * and it seems to actively cause problems in target
++			 * mode if we race with the initiator logging into us
++			 * (we might get the "port ID used" status back from
++			 * our login command and log out the initiator, which
++			 * seems to cause havoc).
++			 */
++			if (qla_ini_mode_enabled(base_vha)) {
++				/* Find a new loop ID to use. */
++				fcport->loop_id = next_loopid;
++				rval = qla2x00_find_new_loop_id(base_vha,
++				    fcport);
++				if (rval != QLA_SUCCESS) {
++					/* Ran out of IDs to use */
++					break;
++				}
+ 
+-			/* Login and update database */
+-			qla2x00_fabric_dev_login(vha, fcport, &next_loopid);
++				/* Login and update database */
++				qla2x00_fabric_dev_login(vha, fcport,
++				    &next_loopid);
++			} else {
++				ql_dbg(ql_dbg_tgt_mgt, vha, 0xf079,
++					"new port %8phC state 0x%x flags 0x%x fc4_type "
++					"0x%x scan_state %d (initiator mode disabled; "
++					"skipping login)\n",
++					fcport->port_name,
++					atomic_read(&fcport->state),
++					fcport->flags, fcport->fc4_type,
++					fcport->scan_state);
++			}
+ 
+ 			list_move_tail(&fcport->list, &vha->vp_fcports);
+ 		}
+@@ -3725,11 +3796,12 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ 			fcport->fp_speed = new_fcport->fp_speed;
+ 
+ 			/*
+-			 * If address the same and state FCS_ONLINE, nothing
+-			 * changed.
++			 * If address the same and state FCS_ONLINE
++			 * (or in target mode), nothing changed.
+ 			 */
+ 			if (fcport->d_id.b24 == new_fcport->d_id.b24 &&
+-			    atomic_read(&fcport->state) == FCS_ONLINE) {
++			    (atomic_read(&fcport->state) == FCS_ONLINE ||
++			     !qla_ini_mode_enabled(base_vha))) {
+ 				break;
+ 			}
+ 
+@@ -3749,6 +3821,22 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ 			 * Log it out if still logged in and mark it for
+ 			 * relogin later.
+ 			 */
++			if (!qla_ini_mode_enabled(base_vha)) {
++				ql_dbg(ql_dbg_tgt_mgt, vha, 0xf080,
++					 "port changed FC ID, %8phC"
++					 " old %x:%x:%x (loop_id 0x%04x)-> new %x:%x:%x\n",
++					 fcport->port_name,
++					 fcport->d_id.b.domain,
++					 fcport->d_id.b.area,
++					 fcport->d_id.b.al_pa,
++					 fcport->loop_id,
++					 new_fcport->d_id.b.domain,
++					 new_fcport->d_id.b.area,
++					 new_fcport->d_id.b.al_pa);
++				fcport->d_id.b24 = new_fcport->d_id.b24;
++				break;
++			}
++
+ 			fcport->d_id.b24 = new_fcport->d_id.b24;
+ 			fcport->flags |= FCF_LOGIN_NEEDED;
+ 			if (fcport->loop_id != FC_NO_LOOP_ID &&
+@@ -3768,6 +3856,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ 		if (found)
+ 			continue;
+ 		/* If device was not in our fcports list, then add it. */
++		new_fcport->scan_state = QLA_FCPORT_FOUND;
+ 		list_add_tail(&new_fcport->list, new_fcports);
+ 
+ 		/* Allocate a new replacement fcport. */
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index fe8a8d157e22..496a733d0ca3 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -113,6 +113,7 @@ static void qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha,
+ static void qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
+ 	struct atio_from_isp *atio, uint16_t status, int qfull);
+ static void qlt_disable_vha(struct scsi_qla_host *vha);
++static void qlt_clear_tgt_db(struct qla_tgt *tgt);
+ /*
+  * Global Variables
+  */
+@@ -431,10 +432,10 @@ static int qlt_reset(struct scsi_qla_host *vha, void *iocb, int mcmd)
+ 
+ 	loop_id = le16_to_cpu(n->u.isp24.nport_handle);
+ 	if (loop_id == 0xFFFF) {
+-#if 0 /* FIXME: Re-enable Global event handling.. */
+ 		/* Global event */
+-		atomic_inc(&ha->tgt.qla_tgt->tgt_global_resets_count);
+-		qlt_clear_tgt_db(ha->tgt.qla_tgt);
++		atomic_inc(&vha->vha_tgt.qla_tgt->tgt_global_resets_count);
++		qlt_clear_tgt_db(vha->vha_tgt.qla_tgt);
++#if 0 /* FIXME: do we need to choose a session here? */
+ 		if (!list_empty(&ha->tgt.qla_tgt->sess_list)) {
+ 			sess = list_entry(ha->tgt.qla_tgt->sess_list.next,
+ 			    typeof(*sess), sess_list_entry);
+@@ -782,25 +783,20 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
+ 
+ void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
+ {
+-	struct qla_hw_data *ha = vha->hw;
+ 	struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
+ 	struct qla_tgt_sess *sess;
+-	unsigned long flags;
+ 
+ 	if (!vha->hw->tgt.tgt_ops)
+ 		return;
+ 
+-	if (!tgt || (fcport->port_type != FCT_INITIATOR))
++	if (!tgt)
+ 		return;
+ 
+-	spin_lock_irqsave(&ha->hardware_lock, flags);
+ 	if (tgt->tgt_stop) {
+-		spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ 		return;
+ 	}
+ 	sess = qlt_find_sess_by_port_name(tgt, fcport->port_name);
+ 	if (!sess) {
+-		spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ 		return;
+ 	}
+ 
+@@ -808,7 +804,6 @@ void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
+ 
+ 	sess->local = 1;
+ 	qlt_schedule_sess_for_deletion(sess, false);
+-	spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ }
+ 
+ static inline int test_tgt_sess_count(struct qla_tgt *tgt)
+@@ -2347,9 +2342,10 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ 		res = qlt_build_ctio_crc2_pkt(&prm, vha);
+ 	else
+ 		res = qlt_24xx_build_ctio_pkt(&prm, vha);
+-	if (unlikely(res != 0))
++	if (unlikely(res != 0)) {
++		vha->req->cnt += full_req_cnt;
+ 		goto out_unmap_unlock;
+-
++	}
+ 
+ 	pkt = (struct ctio7_to_24xx *)prm.pkt;
+ 
+@@ -2487,8 +2483,11 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
+ 	else
+ 		res = qlt_24xx_build_ctio_pkt(&prm, vha);
+ 
+-	if (unlikely(res != 0))
++	if (unlikely(res != 0)) {
++		vha->req->cnt += prm.req_cnt;
+ 		goto out_unlock_free_unmap;
++	}
++
+ 	pkt = (struct ctio7_to_24xx *)prm.pkt;
+ 	pkt->u.status0.flags |= __constant_cpu_to_le16(CTIO7_FLAGS_DATA_OUT |
+ 	    CTIO7_FLAGS_STATUS_MODE_0);
+@@ -2717,7 +2716,7 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
+ static void qlt_send_term_exchange(struct scsi_qla_host *vha,
+ 	struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked)
+ {
+-	unsigned long flags;
++	unsigned long flags = 0;
+ 	int rc;
+ 
+ 	if (qlt_issue_marker(vha, ha_locked) < 0)
+@@ -2733,17 +2732,18 @@ static void qlt_send_term_exchange(struct scsi_qla_host *vha,
+ 	rc = __qlt_send_term_exchange(vha, cmd, atio);
+ 	if (rc == -ENOMEM)
+ 		qlt_alloc_qfull_cmd(vha, atio, 0, 0);
+-	spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
+ 
+ done:
+ 	if (cmd && ((cmd->state != QLA_TGT_STATE_ABORTED) ||
+ 	    !cmd->cmd_sent_to_fw)) {
+-		if (!ha_locked && !in_interrupt())
+-			msleep(250); /* just in case */
+-
+-		qlt_unmap_sg(vha, cmd);
++		if (cmd->sg_mapped)
++			qlt_unmap_sg(vha, cmd);
+ 		vha->hw->tgt.tgt_ops->free_cmd(cmd);
+ 	}
++
++	if (!ha_locked)
++		spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
++
+ 	return;
+ }
+ 
+@@ -3347,6 +3347,11 @@ static struct qla_tgt_cmd *qlt_get_tag(scsi_qla_host_t *vha,
+ 	cmd->loop_id = sess->loop_id;
+ 	cmd->conf_compl_supported = sess->conf_compl_supported;
+ 
++	cmd->cmd_flags = 0;
++	cmd->jiffies_at_alloc = get_jiffies_64();
++
++	cmd->reset_count = vha->hw->chip_reset;
++
+ 	return cmd;
+ }
+ 
+@@ -3453,11 +3458,6 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
+ 		return -ENOMEM;
+ 	}
+ 
+-	cmd->cmd_flags = 0;
+-	cmd->jiffies_at_alloc = get_jiffies_64();
+-
+-	cmd->reset_count = vha->hw->chip_reset;
+-
+ 	cmd->cmd_in_wq = 1;
+ 	cmd->cmd_flags |= BIT_0;
+ 	INIT_WORK(&cmd->work, qlt_do_work);
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index c95a4e943fc6..59c31bf88d92 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -944,7 +944,7 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
+ 			    scmd->sdb.length);
+ 		scmd->sdb.table.sgl = &ses->sense_sgl;
+ 		scmd->sc_data_direction = DMA_FROM_DEVICE;
+-		scmd->sdb.table.nents = 1;
++		scmd->sdb.table.nents = scmd->sdb.table.orig_nents = 1;
+ 		scmd->cmnd[0] = REQUEST_SENSE;
+ 		scmd->cmnd[4] = scmd->sdb.length;
+ 		scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index b1a263137a23..448ebdaa3d69 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -583,7 +583,7 @@ static struct scatterlist *scsi_sg_alloc(unsigned int nents, gfp_t gfp_mask)
+ 
+ static void scsi_free_sgtable(struct scsi_data_buffer *sdb, bool mq)
+ {
+-	if (mq && sdb->table.nents <= SCSI_MAX_SG_SEGMENTS)
++	if (mq && sdb->table.orig_nents <= SCSI_MAX_SG_SEGMENTS)
+ 		return;
+ 	__sg_free_table(&sdb->table, SCSI_MAX_SG_SEGMENTS, mq, scsi_sg_free);
+ }
+@@ -597,8 +597,8 @@ static int scsi_alloc_sgtable(struct scsi_data_buffer *sdb, int nents, bool mq)
+ 
+ 	if (mq) {
+ 		if (nents <= SCSI_MAX_SG_SEGMENTS) {
+-			sdb->table.nents = nents;
+-			sg_init_table(sdb->table.sgl, sdb->table.nents);
++			sdb->table.nents = sdb->table.orig_nents = nents;
++			sg_init_table(sdb->table.sgl, nents);
+ 			return 0;
+ 		}
+ 		first_chunk = sdb->table.sgl;
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 1ac38e73df7e..9ad41168d26d 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -859,7 +859,7 @@ sdev_store_queue_depth(struct device *dev, struct device_attribute *attr,
+ 
+ 	depth = simple_strtoul(buf, NULL, 0);
+ 
+-	if (depth < 1 || depth > sht->can_queue)
++	if (depth < 1 || depth > sdev->host->can_queue)
+ 		return -EINVAL;
+ 
+ 	retval = sht->change_queue_depth(sdev, depth);
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index 9a1c34205254..525ab4c1f306 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -1274,9 +1274,9 @@ static int st_open(struct inode *inode, struct file *filp)
+ 	spin_lock(&st_use_lock);
+ 	STp->in_use = 0;
+ 	spin_unlock(&st_use_lock);
+-	scsi_tape_put(STp);
+ 	if (resumed)
+ 		scsi_autopm_put_device(STp->device);
++	scsi_tape_put(STp);
+ 	return retval;
+ 
+ }
+diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
+index 788e2b176a4f..acce90ac7371 100644
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -40,6 +40,7 @@
+ #define SPFI_CONTROL_SOFT_RESET			BIT(11)
+ #define SPFI_CONTROL_SEND_DMA			BIT(10)
+ #define SPFI_CONTROL_GET_DMA			BIT(9)
++#define SPFI_CONTROL_SE			BIT(8)
+ #define SPFI_CONTROL_TMODE_SHIFT		5
+ #define SPFI_CONTROL_TMODE_MASK			0x7
+ #define SPFI_CONTROL_TMODE_SINGLE		0
+@@ -491,6 +492,7 @@ static void img_spfi_config(struct spi_master *master, struct spi_device *spi,
+ 	else if (xfer->tx_nbits == SPI_NBITS_QUAD &&
+ 		 xfer->rx_nbits == SPI_NBITS_QUAD)
+ 		val |= SPFI_CONTROL_TMODE_QUAD << SPFI_CONTROL_TMODE_SHIFT;
++	val |= SPFI_CONTROL_SE;
+ 	spfi_writel(spfi, val, SPFI_CONTROL);
+ }
+ 
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index f08e812b2984..412b9c86b997 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -201,8 +201,9 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi,
+ {
+ 	struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
+ 
+-	if (spi_imx->dma_is_inited && (transfer->len > spi_imx->rx_wml)
+-	    && (transfer->len > spi_imx->tx_wml))
++	if (spi_imx->dma_is_inited
++	    && transfer->len > spi_imx->rx_wml * sizeof(u32)
++	    && transfer->len > spi_imx->tx_wml * sizeof(u32))
+ 		return true;
+ 	return false;
+ }
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 74e6114ff18f..305a5cbc099a 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4001,7 +4001,13 @@ get_immediate:
+ 	}
+ 
+ transport_err:
+-	iscsit_take_action_for_connection_exit(conn);
++	/*
++	 * Avoid the normal connection failure code-path if this connection
++	 * is still within LOGIN mode, and iscsi_np process context is
++	 * responsible for cleaning up the early connection failure.
++	 */
++	if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
++		iscsit_take_action_for_connection_exit(conn);
+ out:
+ 	return 0;
+ }
+@@ -4093,7 +4099,7 @@ reject:
+ 
+ int iscsi_target_rx_thread(void *arg)
+ {
+-	int ret;
++	int ret, rc;
+ 	u8 buffer[ISCSI_HDR_LEN], opcode;
+ 	u32 checksum = 0, digest = 0;
+ 	struct iscsi_conn *conn = arg;
+@@ -4103,10 +4109,16 @@ int iscsi_target_rx_thread(void *arg)
+ 	 * connection recovery / failure event can be triggered externally.
+ 	 */
+ 	allow_signal(SIGINT);
++	/*
++	 * Wait for iscsi_post_login_handler() to complete before allowing
++	 * incoming iscsi/tcp socket I/O, and/or failing the connection.
++	 */
++	rc = wait_for_completion_interruptible(&conn->rx_login_comp);
++	if (rc < 0)
++		return 0;
+ 
+ 	if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
+ 		struct completion comp;
+-		int rc;
+ 
+ 		init_completion(&comp);
+ 		rc = wait_for_completion_interruptible(&comp);
+@@ -4543,7 +4555,18 @@ static void iscsit_logout_post_handler_closesession(
+ 	struct iscsi_conn *conn)
+ {
+ 	struct iscsi_session *sess = conn->sess;
+-	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++	int sleep = 1;
++	/*
++	 * Traditional iscsi/tcp will invoke this logic from TX thread
++	 * context during session logout, so clear tx_thread_active and
++	 * sleep if iscsit_close_connection() has not already occured.
++	 *
++	 * Since iser-target invokes this logic from it's own workqueue,
++	 * always sleep waiting for RX/TX thread shutdown to complete
++	 * within iscsit_close_connection().
++	 */
++	if (conn->conn_transport->transport_type == ISCSI_TCP)
++		sleep = cmpxchg(&conn->tx_thread_active, true, false);
+ 
+ 	atomic_set(&conn->conn_logout_remove, 0);
+ 	complete(&conn->conn_logout_comp);
+@@ -4557,7 +4580,10 @@ static void iscsit_logout_post_handler_closesession(
+ static void iscsit_logout_post_handler_samecid(
+ 	struct iscsi_conn *conn)
+ {
+-	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++	int sleep = 1;
++
++	if (conn->conn_transport->transport_type == ISCSI_TCP)
++		sleep = cmpxchg(&conn->tx_thread_active, true, false);
+ 
+ 	atomic_set(&conn->conn_logout_remove, 0);
+ 	complete(&conn->conn_logout_comp);
+@@ -4776,6 +4802,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ 	struct iscsi_session *sess;
+ 	struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+ 	struct se_session *se_sess, *se_sess_tmp;
++	LIST_HEAD(free_list);
+ 	int session_count = 0;
+ 
+ 	spin_lock_bh(&se_tpg->session_lock);
+@@ -4797,14 +4824,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ 		}
+ 		atomic_set(&sess->session_reinstatement, 1);
+ 		spin_unlock(&sess->conn_lock);
+-		spin_unlock_bh(&se_tpg->session_lock);
+ 
+-		iscsit_free_session(sess);
+-		spin_lock_bh(&se_tpg->session_lock);
++		list_move_tail(&se_sess->sess_list, &free_list);
++	}
++	spin_unlock_bh(&se_tpg->session_lock);
++
++	list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
++		sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
+ 
++		iscsit_free_session(sess);
+ 		session_count++;
+ 	}
+-	spin_unlock_bh(&se_tpg->session_lock);
+ 
+ 	pr_debug("Released %d iSCSI Session(s) from Target Portal"
+ 			" Group: %hu\n", session_count, tpg->tpgt);
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 70d799dfab03..c3bccaddb592 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -82,6 +82,7 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn)
+ 	init_completion(&conn->conn_logout_comp);
+ 	init_completion(&conn->rx_half_close_comp);
+ 	init_completion(&conn->tx_half_close_comp);
++	init_completion(&conn->rx_login_comp);
+ 	spin_lock_init(&conn->cmd_lock);
+ 	spin_lock_init(&conn->conn_usage_lock);
+ 	spin_lock_init(&conn->immed_queue_lock);
+@@ -699,7 +700,7 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn)
+ 		iscsit_start_nopin_timer(conn);
+ }
+ 
+-static int iscsit_start_kthreads(struct iscsi_conn *conn)
++int iscsit_start_kthreads(struct iscsi_conn *conn)
+ {
+ 	int ret = 0;
+ 
+@@ -734,6 +735,7 @@ static int iscsit_start_kthreads(struct iscsi_conn *conn)
+ 
+ 	return 0;
+ out_tx:
++	send_sig(SIGINT, conn->tx_thread, 1);
+ 	kthread_stop(conn->tx_thread);
+ 	conn->tx_thread_active = false;
+ out_bitmap:
+@@ -744,7 +746,7 @@ out_bitmap:
+ 	return ret;
+ }
+ 
+-int iscsi_post_login_handler(
++void iscsi_post_login_handler(
+ 	struct iscsi_np *np,
+ 	struct iscsi_conn *conn,
+ 	u8 zero_tsih)
+@@ -754,7 +756,6 @@ int iscsi_post_login_handler(
+ 	struct se_session *se_sess = sess->se_sess;
+ 	struct iscsi_portal_group *tpg = sess->tpg;
+ 	struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+-	int rc;
+ 
+ 	iscsit_inc_conn_usage_count(conn);
+ 
+@@ -795,10 +796,6 @@ int iscsi_post_login_handler(
+ 			sess->sess_ops->InitiatorName);
+ 		spin_unlock_bh(&sess->conn_lock);
+ 
+-		rc = iscsit_start_kthreads(conn);
+-		if (rc)
+-			return rc;
+-
+ 		iscsi_post_login_start_timers(conn);
+ 		/*
+ 		 * Determine CPU mask to ensure connection's RX and TX kthreads
+@@ -807,15 +804,20 @@ int iscsi_post_login_handler(
+ 		iscsit_thread_get_cpumask(conn);
+ 		conn->conn_rx_reset_cpumask = 1;
+ 		conn->conn_tx_reset_cpumask = 1;
+-
++		/*
++		 * Wakeup the sleeping iscsi_target_rx_thread() now that
++		 * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
++		 */
++		complete(&conn->rx_login_comp);
+ 		iscsit_dec_conn_usage_count(conn);
++
+ 		if (stop_timer) {
+ 			spin_lock_bh(&se_tpg->session_lock);
+ 			iscsit_stop_time2retain_timer(sess);
+ 			spin_unlock_bh(&se_tpg->session_lock);
+ 		}
+ 		iscsit_dec_session_usage_count(sess);
+-		return 0;
++		return;
+ 	}
+ 
+ 	iscsi_set_session_parameters(sess->sess_ops, conn->param_list, 1);
+@@ -856,10 +858,6 @@ int iscsi_post_login_handler(
+ 		" iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt);
+ 	spin_unlock_bh(&se_tpg->session_lock);
+ 
+-	rc = iscsit_start_kthreads(conn);
+-	if (rc)
+-		return rc;
+-
+ 	iscsi_post_login_start_timers(conn);
+ 	/*
+ 	 * Determine CPU mask to ensure connection's RX and TX kthreads
+@@ -868,10 +866,12 @@ int iscsi_post_login_handler(
+ 	iscsit_thread_get_cpumask(conn);
+ 	conn->conn_rx_reset_cpumask = 1;
+ 	conn->conn_tx_reset_cpumask = 1;
+-
++	/*
++	 * Wakeup the sleeping iscsi_target_rx_thread() now that
++	 * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
++	 */
++	complete(&conn->rx_login_comp);
+ 	iscsit_dec_conn_usage_count(conn);
+-
+-	return 0;
+ }
+ 
+ static void iscsi_handle_login_thread_timeout(unsigned long data)
+@@ -1436,23 +1436,12 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ 	if (ret < 0)
+ 		goto new_sess_out;
+ 
+-	if (!conn->sess) {
+-		pr_err("struct iscsi_conn session pointer is NULL!\n");
+-		goto new_sess_out;
+-	}
+-
+ 	iscsi_stop_login_thread_timer(np);
+ 
+-	if (signal_pending(current))
+-		goto new_sess_out;
+-
+ 	if (ret == 1) {
+ 		tpg_np = conn->tpg_np;
+ 
+-		ret = iscsi_post_login_handler(np, conn, zero_tsih);
+-		if (ret < 0)
+-			goto new_sess_out;
+-
++		iscsi_post_login_handler(np, conn, zero_tsih);
+ 		iscsit_deaccess_np(np, tpg, tpg_np);
+ 	}
+ 
+diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
+index 29d098324b7f..55cbf4533544 100644
+--- a/drivers/target/iscsi/iscsi_target_login.h
++++ b/drivers/target/iscsi/iscsi_target_login.h
+@@ -12,7 +12,8 @@ extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *);
+ extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *);
+ extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
+ extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *);
+-extern int iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
++extern int iscsit_start_kthreads(struct iscsi_conn *);
++extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
+ extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,
+ 				bool, bool);
+ extern int iscsi_target_login_thread(void *);
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index 8c02fa34716f..f9cde9141836 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -17,6 +17,7 @@
+  ******************************************************************************/
+ 
+ #include <linux/ctype.h>
++#include <linux/kthread.h>
+ #include <scsi/iscsi_proto.h>
+ #include <target/target_core_base.h>
+ #include <target/target_core_fabric.h>
+@@ -361,10 +362,24 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
+ 		ntohl(login_rsp->statsn), login->rsp_length);
+ 
+ 	padding = ((-login->rsp_length) & 3);
++	/*
++	 * Before sending the last login response containing the transition
++	 * bit for full-feature-phase, go ahead and start up TX/RX threads
++	 * now to avoid potential resource allocation failures after the
++	 * final login response has been sent.
++	 */
++	if (login->login_complete) {
++		int rc = iscsit_start_kthreads(conn);
++		if (rc) {
++			iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
++					    ISCSI_LOGIN_STATUS_NO_RESOURCES);
++			return -1;
++		}
++	}
+ 
+ 	if (conn->conn_transport->iscsit_put_login_tx(conn, login,
+ 					login->rsp_length + padding) < 0)
+-		return -1;
++		goto err;
+ 
+ 	login->rsp_length		= 0;
+ 	mutex_lock(&sess->cmdsn_mutex);
+@@ -373,6 +388,23 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
+ 	mutex_unlock(&sess->cmdsn_mutex);
+ 
+ 	return 0;
++
++err:
++	if (login->login_complete) {
++		if (conn->rx_thread && conn->rx_thread_active) {
++			send_sig(SIGINT, conn->rx_thread, 1);
++			kthread_stop(conn->rx_thread);
++		}
++		if (conn->tx_thread && conn->tx_thread_active) {
++			send_sig(SIGINT, conn->tx_thread, 1);
++			kthread_stop(conn->tx_thread);
++		}
++		spin_lock(&iscsit_global->ts_bitmap_lock);
++		bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
++				      get_order(1));
++		spin_unlock(&iscsit_global->ts_bitmap_lock);
++	}
++	return -1;
+ }
+ 
+ static void iscsi_target_sk_data_ready(struct sock *sk)
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 396344cb011f..16ed0b6c7f9c 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -1108,19 +1108,29 @@ static void eraser(unsigned char c, struct tty_struct *tty)
+  *	Locking: ctrl_lock
+  */
+ 
+-static void isig(int sig, struct tty_struct *tty)
++static void __isig(int sig, struct tty_struct *tty)
+ {
+-	struct n_tty_data *ldata = tty->disc_data;
+ 	struct pid *tty_pgrp = tty_get_pgrp(tty);
+ 	if (tty_pgrp) {
+ 		kill_pgrp(tty_pgrp, sig, 1);
+ 		put_pid(tty_pgrp);
+ 	}
++}
+ 
+-	if (!L_NOFLSH(tty)) {
++static void isig(int sig, struct tty_struct *tty)
++{
++	struct n_tty_data *ldata = tty->disc_data;
++
++	if (L_NOFLSH(tty)) {
++		/* signal only */
++		__isig(sig, tty);
++
++	} else { /* signal and flush */
+ 		up_read(&tty->termios_rwsem);
+ 		down_write(&tty->termios_rwsem);
+ 
++		__isig(sig, tty);
++
+ 		/* clear echo buffer */
+ 		mutex_lock(&ldata->output_lock);
+ 		ldata->echo_head = ldata->echo_tail = 0;
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 88250395b0ce..01aa52f574e5 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -1132,11 +1132,6 @@ static int imx_startup(struct uart_port *port)
+ 	while (!(readl(sport->port.membase + UCR2) & UCR2_SRST) && (--i > 0))
+ 		udelay(1);
+ 
+-	/* Can we enable the DMA support? */
+-	if (is_imx6q_uart(sport) && !uart_console(port) &&
+-	    !sport->dma_is_inited)
+-		imx_uart_dma_init(sport);
+-
+ 	spin_lock_irqsave(&sport->port.lock, flags);
+ 
+ 	/*
+@@ -1145,9 +1140,6 @@ static int imx_startup(struct uart_port *port)
+ 	writel(USR1_RTSD, sport->port.membase + USR1);
+ 	writel(USR2_ORE, sport->port.membase + USR2);
+ 
+-	if (sport->dma_is_inited && !sport->dma_is_enabled)
+-		imx_enable_dma(sport);
+-
+ 	temp = readl(sport->port.membase + UCR1);
+ 	temp |= UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN;
+ 
+@@ -1318,6 +1310,11 @@ imx_set_termios(struct uart_port *port, struct ktermios *termios,
+ 			} else {
+ 				ucr2 |= UCR2_CTSC;
+ 			}
++
++			/* Can we enable the DMA support? */
++			if (is_imx6q_uart(sport) && !uart_console(port)
++				&& !sport->dma_is_inited)
++				imx_uart_dma_init(sport);
+ 		} else {
+ 			termios->c_cflag &= ~CRTSCTS;
+ 		}
+@@ -1434,6 +1431,8 @@ imx_set_termios(struct uart_port *port, struct ktermios *termios,
+ 	if (UART_ENABLE_MS(&sport->port, termios->c_cflag))
+ 		imx_enable_ms(&sport->port);
+ 
++	if (sport->dma_is_inited && !sport->dma_is_enabled)
++		imx_enable_dma(sport);
+ 	spin_unlock_irqrestore(&sport->port.lock, flags);
+ }
+ 
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 0b7bb12dfc68..ec540445bb71 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1409,7 +1409,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
+ 	mutex_lock(&port->mutex);
+ 	uart_shutdown(tty, state);
+ 	tty_port_tty_set(port, NULL);
+-	tty->closing = 0;
++
+ 	spin_lock_irqsave(&port->lock, flags);
+ 
+ 	if (port->blocked_open) {
+@@ -1435,6 +1435,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
+ 	mutex_unlock(&port->mutex);
+ 
+ 	tty_ldisc_flush(tty);
++	tty->closing = 0;
+ }
+ 
+ static void uart_wait_until_sent(struct tty_struct *tty, int timeout)
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 0827d7c96527..ee07ba41c8db 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -484,10 +484,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
+ 	u32 pls = status_reg & PORT_PLS_MASK;
+ 
+ 	/* resume state is a xHCI internal state.
+-	 * Do not report it to usb core.
++	 * Do not report it to usb core, instead, pretend to be U3,
++	 * thus usb core knows it's not ready for transfer
+ 	 */
+-	if (pls == XDEV_RESUME)
++	if (pls == XDEV_RESUME) {
++		*status |= USB_SS_PORT_LS_U3;
+ 		return;
++	}
+ 
+ 	/* When the CAS bit is set then warm reset
+ 	 * should be performed on port
+@@ -588,7 +591,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ 		status |= USB_PORT_STAT_C_RESET << 16;
+ 	/* USB3.0 only */
+ 	if (hcd->speed == HCD_USB3) {
+-		if ((raw_port_status & PORT_PLC))
++		/* Port link change with port in resume state should not be
++		 * reported to usbcore, as this is an internal state to be
++		 * handled by xhci driver. Reporting PLC to usbcore may
++		 * cause usbcore clearing PLC first and port change event
++		 * irq won't be generated.
++		 */
++		if ((raw_port_status & PORT_PLC) &&
++			(raw_port_status & PORT_PLS_MASK) != XDEV_RESUME)
+ 			status |= USB_PORT_STAT_C_LINK_STATE << 16;
+ 		if ((raw_port_status & PORT_WRC))
+ 			status |= USB_PORT_STAT_C_BH_RESET << 16;
+@@ -1120,10 +1130,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ 	spin_lock_irqsave(&xhci->lock, flags);
+ 
+ 	if (hcd->self.root_hub->do_remote_wakeup) {
+-		if (bus_state->resuming_ports) {
++		if (bus_state->resuming_ports ||	/* USB2 */
++		    bus_state->port_remote_wakeup) {	/* USB3 */
+ 			spin_unlock_irqrestore(&xhci->lock, flags);
+-			xhci_dbg(xhci, "suspend failed because "
+-						"a port is resuming\n");
++			xhci_dbg(xhci, "suspend failed because a port is resuming\n");
+ 			return -EBUSY;
+ 		}
+ 	}
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 7d34cbfaf373..d095677a0702 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1546,6 +1546,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ 		usb_hcd_resume_root_hub(hcd);
+ 	}
+ 
++	if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
++		bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
++
+ 	if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
+ 		xhci_dbg(xhci, "port resume event for port %d\n", port_id);
+ 
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 36bf089b708f..c502c2277aeb 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3453,6 +3453,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ 			return -EINVAL;
+ 	}
+ 
++	if (virt_dev->tt_info)
++		old_active_eps = virt_dev->tt_info->active_eps;
++
+ 	if (virt_dev->udev != udev) {
+ 		/* If the virt_dev and the udev does not match, this virt_dev
+ 		 * may belong to another udev.
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 6977f8491fa7..0f26dd2697b6 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -285,6 +285,7 @@ struct xhci_op_regs {
+ #define XDEV_U0		(0x0 << 5)
+ #define XDEV_U2		(0x2 << 5)
+ #define XDEV_U3		(0x3 << 5)
++#define XDEV_INACTIVE	(0x6 << 5)
+ #define XDEV_RESUME	(0xf << 5)
+ /* true: port has power (see HCC_PPC) */
+ #define PORT_POWER	(1 << 9)
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index caf188800c67..87898ca2ed17 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2065,6 +2065,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_READ_DISC_INFO ),
+ 
++/* Reported by Oliver Neukum <oneukum@suse.com>
++ * This device morphes spontaneously into another device if the access
++ * pattern of Windows isn't followed. Thus writable media would be dirty
++ * if the initial instance is used. So the device is limited to its
++ * virtual CD.
++ * And yes, the concept that BCD goes up to 9 is not heeded */
++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
++		"ZTE,Incorporated",
++		"ZTE WCDMA Technologies MSM",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_SINGLE_LUN ),
++
+ /* Reported by Sven Geggus <sven-usbst@geggus.net>
+  * This encrypted pen drive returns bogus data for the initial READ(10).
+  */
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 2ee28266fd07..fa49d3294cd5 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -886,6 +886,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
+ 		}
+ 		if (eventfp != d->log_file) {
+ 			filep = d->log_file;
++			d->log_file = eventfp;
+ 			ctx = d->log_ctx;
+ 			d->log_ctx = eventfp ?
+ 				eventfd_ctx_fileget(eventfp) : NULL;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 50bb3c207621..5d03eb0ec0ac 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -642,7 +642,7 @@ static inline bool fast_dput(struct dentry *dentry)
+ 
+ 	/*
+ 	 * If we have a d_op->d_delete() operation, we sould not
+-	 * let the dentry count go to zero, so use "put__or_lock".
++	 * let the dentry count go to zero, so use "put_or_lock".
+ 	 */
+ 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE))
+ 		return lockref_put_or_lock(&dentry->d_lockref);
+@@ -697,7 +697,7 @@ static inline bool fast_dput(struct dentry *dentry)
+ 	 */
+ 	smp_rmb();
+ 	d_flags = ACCESS_ONCE(dentry->d_flags);
+-	d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST;
++	d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST | DCACHE_DISCONNECTED;
+ 
+ 	/* Nothing to do? Dropping the reference was all we needed? */
+ 	if (d_flags == (DCACHE_REFERENCED | DCACHE_LRU_LIST) && !d_unhashed(dentry))
+@@ -776,6 +776,9 @@ repeat:
+ 	if (unlikely(d_unhashed(dentry)))
+ 		goto kill_it;
+ 
++	if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
++		goto kill_it;
++
+ 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
+ 		if (dentry->d_op->d_delete(dentry))
+ 			goto kill_it;
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 02c6875dd945..fce3cc1a3fa7 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1350,6 +1350,36 @@ enum umount_tree_flags {
+ 	UMOUNT_PROPAGATE = 2,
+ 	UMOUNT_CONNECTED = 4,
+ };
++
++static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
++{
++	/* Leaving mounts connected is only valid for lazy umounts */
++	if (how & UMOUNT_SYNC)
++		return true;
++
++	/* A mount without a parent has nothing to be connected to */
++	if (!mnt_has_parent(mnt))
++		return true;
++
++	/* Because the reference counting rules change when mounts are
++	 * unmounted and connected, umounted mounts may not be
++	 * connected to mounted mounts.
++	 */
++	if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
++		return true;
++
++	/* Has it been requested that the mount remain connected? */
++	if (how & UMOUNT_CONNECTED)
++		return false;
++
++	/* Is the mount locked such that it needs to remain connected? */
++	if (IS_MNT_LOCKED(mnt))
++		return false;
++
++	/* By default disconnect the mount */
++	return true;
++}
++
+ /*
+  * mount_lock must be held
+  * namespace_sem must be held for write
+@@ -1387,10 +1417,7 @@ static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
+ 		if (how & UMOUNT_SYNC)
+ 			p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
+ 
+-		disconnect = !(((how & UMOUNT_CONNECTED) &&
+-				mnt_has_parent(p) &&
+-				(p->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) ||
+-			       IS_MNT_LOCKED_AND_LAZY(p));
++		disconnect = disconnect_mount(p, how);
+ 
+ 		pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt,
+ 				 disconnect ? &unmounted : NULL);
+@@ -1527,11 +1554,8 @@ void __detach_mounts(struct dentry *dentry)
+ 	while (!hlist_empty(&mp->m_list)) {
+ 		mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
+ 		if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
+-			struct mount *p, *tmp;
+-			list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts,  mnt_child) {
+-				hlist_add_head(&p->mnt_umount.s_list, &unmounted);
+-				umount_mnt(p);
+-			}
++			hlist_add_head(&mnt->mnt_umount.s_list, &unmounted);
++			umount_mnt(mnt);
+ 		}
+ 		else umount_tree(mnt, UMOUNT_CONNECTED);
+ 	}
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index f734562c6d24..5d25b9d97c29 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1242,9 +1242,11 @@ static int nfs_check_inode_attributes(struct inode *inode, struct nfs_fattr *fat
+ 	if (fattr->valid & NFS_ATTR_FATTR_SIZE) {
+ 		cur_size = i_size_read(inode);
+ 		new_isize = nfs_size_to_loff_t(fattr->size);
+-		if (cur_size != new_isize && nfsi->nrequests == 0)
++		if (cur_size != new_isize)
+ 			invalid |= NFS_INO_INVALID_ATTR|NFS_INO_REVAL_PAGECACHE;
+ 	}
++	if (nfsi->nrequests != 0)
++		invalid &= ~NFS_INO_REVAL_PAGECACHE;
+ 
+ 	/* Have any file permissions changed? */
+ 	if ((fattr->valid & NFS_ATTR_FATTR_MODE) && (inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO))
+@@ -1682,8 +1684,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ 			invalid |= NFS_INO_INVALID_ATTR
+ 				| NFS_INO_INVALID_DATA
+ 				| NFS_INO_INVALID_ACCESS
+-				| NFS_INO_INVALID_ACL
+-				| NFS_INO_REVAL_PAGECACHE;
++				| NFS_INO_INVALID_ACL;
+ 			if (S_ISDIR(inode->i_mode))
+ 				nfs_force_lookup_revalidate(inode);
+ 			inode->i_version = fattr->change_attr;
+@@ -1715,7 +1716,6 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ 			if ((nfsi->nrequests == 0) || new_isize > cur_isize) {
+ 				i_size_write(inode, new_isize);
+ 				invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
+-				invalid &= ~NFS_INO_REVAL_PAGECACHE;
+ 			}
+ 			dprintk("NFS: isize change on server for file %s/%ld "
+ 					"(%Ld to %Ld)\n",
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 55e1e3af23a3..d3f205126609 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1204,12 +1204,15 @@ static bool nfs_need_update_open_stateid(struct nfs4_state *state,
+ 
+ static void nfs_resync_open_stateid_locked(struct nfs4_state *state)
+ {
++	if (!(state->n_wronly || state->n_rdonly || state->n_rdwr))
++		return;
+ 	if (state->n_wronly)
+ 		set_bit(NFS_O_WRONLY_STATE, &state->flags);
+ 	if (state->n_rdonly)
+ 		set_bit(NFS_O_RDONLY_STATE, &state->flags);
+ 	if (state->n_rdwr)
+ 		set_bit(NFS_O_RDWR_STATE, &state->flags);
++	set_bit(NFS_OPEN_STATE, &state->flags);
+ }
+ 
+ static void nfs_clear_open_stateid_locked(struct nfs4_state *state,
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index 282b39369510..7b4552678536 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -1110,8 +1110,11 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
+ 			nfs_list_remove_request(req);
+ 			if (__nfs_pageio_add_request(desc, req))
+ 				continue;
+-			if (desc->pg_error < 0)
++			if (desc->pg_error < 0) {
++				list_splice_tail(&head, &mirror->pg_list);
++				mirror->pg_recoalesce = 1;
+ 				return 0;
++			}
+ 			break;
+ 		}
+ 	} while (mirror->pg_recoalesce);
+diff --git a/fs/pnode.h b/fs/pnode.h
+index 7114ce6e6b9e..0fcdbe7ca648 100644
+--- a/fs/pnode.h
++++ b/fs/pnode.h
+@@ -20,8 +20,6 @@
+ #define SET_MNT_MARK(m) ((m)->mnt.mnt_flags |= MNT_MARKED)
+ #define CLEAR_MNT_MARK(m) ((m)->mnt.mnt_flags &= ~MNT_MARKED)
+ #define IS_MNT_LOCKED(m) ((m)->mnt.mnt_flags & MNT_LOCKED)
+-#define IS_MNT_LOCKED_AND_LAZY(m) \
+-	(((m)->mnt.mnt_flags & (MNT_LOCKED|MNT_SYNC_UMOUNT)) == MNT_LOCKED)
+ 
+ #define CL_EXPIRE    		0x01
+ #define CL_SLAVE     		0x02
+diff --git a/fs/xfs/libxfs/xfs_attr_remote.c b/fs/xfs/libxfs/xfs_attr_remote.c
+index 20de88d1bf86..dd714037c322 100644
+--- a/fs/xfs/libxfs/xfs_attr_remote.c
++++ b/fs/xfs/libxfs/xfs_attr_remote.c
+@@ -159,11 +159,10 @@ xfs_attr3_rmt_write_verify(
+ 	struct xfs_buf	*bp)
+ {
+ 	struct xfs_mount *mp = bp->b_target->bt_mount;
+-	struct xfs_buf_log_item	*bip = bp->b_fspriv;
++	int		blksize = mp->m_attr_geo->blksize;
+ 	char		*ptr;
+ 	int		len;
+ 	xfs_daddr_t	bno;
+-	int		blksize = mp->m_attr_geo->blksize;
+ 
+ 	/* no verification of non-crc buffers */
+ 	if (!xfs_sb_version_hascrc(&mp->m_sb))
+@@ -175,16 +174,22 @@ xfs_attr3_rmt_write_verify(
+ 	ASSERT(len >= blksize);
+ 
+ 	while (len > 0) {
++		struct xfs_attr3_rmt_hdr *rmt = (struct xfs_attr3_rmt_hdr *)ptr;
++
+ 		if (!xfs_attr3_rmt_verify(mp, ptr, blksize, bno)) {
+ 			xfs_buf_ioerror(bp, -EFSCORRUPTED);
+ 			xfs_verifier_error(bp);
+ 			return;
+ 		}
+-		if (bip) {
+-			struct xfs_attr3_rmt_hdr *rmt;
+ 
+-			rmt = (struct xfs_attr3_rmt_hdr *)ptr;
+-			rmt->rm_lsn = cpu_to_be64(bip->bli_item.li_lsn);
++		/*
++		 * Ensure we aren't writing bogus LSNs to disk. See
++		 * xfs_attr3_rmt_hdr_set() for the explanation.
++		 */
++		if (rmt->rm_lsn != cpu_to_be64(NULLCOMMITLSN)) {
++			xfs_buf_ioerror(bp, -EFSCORRUPTED);
++			xfs_verifier_error(bp);
++			return;
+ 		}
+ 		xfs_update_cksum(ptr, blksize, XFS_ATTR3_RMT_CRC_OFF);
+ 
+@@ -221,6 +226,18 @@ xfs_attr3_rmt_hdr_set(
+ 	rmt->rm_owner = cpu_to_be64(ino);
+ 	rmt->rm_blkno = cpu_to_be64(bno);
+ 
++	/*
++	 * Remote attribute blocks are written synchronously, so we don't
++	 * have an LSN that we can stamp in them that makes any sense to log
++	 * recovery. To ensure that log recovery handles overwrites of these
++	 * blocks sanely (i.e. once they've been freed and reallocated as some
++	 * other type of metadata) we need to ensure that the LSN has a value
++	 * that tells log recovery to ignore the LSN and overwrite the buffer
++	 * with whatever is in it's log. To do this, we use the magic
++	 * NULLCOMMITLSN to indicate that the LSN is invalid.
++	 */
++	rmt->rm_lsn = cpu_to_be64(NULLCOMMITLSN);
++
+ 	return sizeof(struct xfs_attr3_rmt_hdr);
+ }
+ 
+@@ -434,14 +451,21 @@ xfs_attr_rmtval_set(
+ 
+ 		/*
+ 		 * Allocate a single extent, up to the size of the value.
++		 *
++		 * Note that we have to consider this a data allocation as we
++		 * write the remote attribute without logging the contents.
++		 * Hence we must ensure that we aren't using blocks that are on
++		 * the busy list so that we don't overwrite blocks which have
++		 * recently been freed but their transactions are not yet
++		 * committed to disk. If we overwrite the contents of a busy
++		 * extent and then crash then the block may not contain the
++		 * correct metadata after log recovery occurs.
+ 		 */
+ 		xfs_bmap_init(args->flist, args->firstblock);
+ 		nmap = 1;
+ 		error = xfs_bmapi_write(args->trans, dp, (xfs_fileoff_t)lblkno,
+-				  blkcnt,
+-				  XFS_BMAPI_ATTRFORK | XFS_BMAPI_METADATA,
+-				  args->firstblock, args->total, &map, &nmap,
+-				  args->flist);
++				  blkcnt, XFS_BMAPI_ATTRFORK, args->firstblock,
++				  args->total, &map, &nmap, args->flist);
+ 		if (!error) {
+ 			error = xfs_bmap_finish(&args->trans, args->flist,
+ 						&committed);
+diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
+index 4f5784f85a5b..a5d03396dda0 100644
+--- a/fs/xfs/xfs_log_recover.c
++++ b/fs/xfs/xfs_log_recover.c
+@@ -1887,9 +1887,14 @@ xlog_recover_get_buf_lsn(
+ 		uuid = &((struct xfs_dir3_blk_hdr *)blk)->uuid;
+ 		break;
+ 	case XFS_ATTR3_RMT_MAGIC:
+-		lsn = be64_to_cpu(((struct xfs_attr3_rmt_hdr *)blk)->rm_lsn);
+-		uuid = &((struct xfs_attr3_rmt_hdr *)blk)->rm_uuid;
+-		break;
++		/*
++		 * Remote attr blocks are written synchronously, rather than
++		 * being logged. That means they do not contain a valid LSN
++		 * (i.e. transactionally ordered) in them, and hence any time we
++		 * see a buffer to replay over the top of a remote attribute
++		 * block we should simply do so.
++		 */
++		goto recover_immediately;
+ 	case XFS_SB_MAGIC:
+ 		lsn = be64_to_cpu(((struct xfs_dsb *)blk)->sb_lsn);
+ 		uuid = &((struct xfs_dsb *)blk)->sb_uuid;
+diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
+index b6a52a4b457a..51bb6532785c 100644
+--- a/include/linux/can/skb.h
++++ b/include/linux/can/skb.h
+@@ -27,10 +27,12 @@
+ /**
+  * struct can_skb_priv - private additional data inside CAN sk_buffs
+  * @ifindex:	ifindex of the first interface the CAN frame appeared on
++ * @skbcnt:	atomic counter to have an unique id together with skb pointer
+  * @cf:		align to the following CAN frame at skb->data
+  */
+ struct can_skb_priv {
+ 	int ifindex;
++	int skbcnt;
+ 	struct can_frame cf[0];
+ };
+ 
+diff --git a/include/linux/cper.h b/include/linux/cper.h
+index 76abba4b238e..dcacb1a72e26 100644
+--- a/include/linux/cper.h
++++ b/include/linux/cper.h
+@@ -340,7 +340,27 @@ struct cper_ia_proc_ctx {
+ 	__u64	mm_reg_addr;
+ };
+ 
+-/* Memory Error Section */
++/* Old Memory Error Section UEFI 2.1, 2.2 */
++struct cper_sec_mem_err_old {
++	__u64	validation_bits;
++	__u64	error_status;
++	__u64	physical_addr;
++	__u64	physical_addr_mask;
++	__u16	node;
++	__u16	card;
++	__u16	module;
++	__u16	bank;
++	__u16	device;
++	__u16	row;
++	__u16	column;
++	__u16	bit_pos;
++	__u64	requestor_id;
++	__u64	responder_id;
++	__u64	target_id;
++	__u8	error_type;
++};
++
++/* Memory Error Section UEFI >= 2.3 */
+ struct cper_sec_mem_err {
+ 	__u64	validation_bits;
+ 	__u64	error_status;
+diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
+index 1da602982cf9..6cd8c0ee4b6f 100644
+--- a/include/linux/ftrace.h
++++ b/include/linux/ftrace.h
+@@ -116,6 +116,7 @@ ftrace_func_t ftrace_ops_get_func(struct ftrace_ops *ops);
+  *            SAVE_REGS. If another ops with this flag set is already registered
+  *            for any of the functions that this ops will be registered for, then
+  *            this ops will fail to register or set_filter_ip.
++ * PID     - Is affected by set_ftrace_pid (allows filtering on those pids)
+  */
+ enum {
+ 	FTRACE_OPS_FL_ENABLED			= 1 << 0,
+@@ -132,6 +133,7 @@ enum {
+ 	FTRACE_OPS_FL_MODIFYING			= 1 << 11,
+ 	FTRACE_OPS_FL_ALLOC_TRAMP		= 1 << 12,
+ 	FTRACE_OPS_FL_IPMODIFY			= 1 << 13,
++	FTRACE_OPS_FL_PID			= 1 << 14,
+ };
+ 
+ #ifdef CONFIG_DYNAMIC_FTRACE
+@@ -159,6 +161,7 @@ struct ftrace_ops {
+ 	struct ftrace_ops		*next;
+ 	unsigned long			flags;
+ 	void				*private;
++	ftrace_func_t			saved_func;
+ 	int __percpu			*disabled;
+ #ifdef CONFIG_DYNAMIC_FTRACE
+ 	int				nr_trampolines;
+diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
+index 54e7af301888..73abbc54063d 100644
+--- a/include/target/iscsi/iscsi_target_core.h
++++ b/include/target/iscsi/iscsi_target_core.h
+@@ -606,6 +606,7 @@ struct iscsi_conn {
+ 	int			bitmap_id;
+ 	int			rx_thread_active;
+ 	struct task_struct	*rx_thread;
++	struct completion	rx_login_comp;
+ 	int			tx_thread_active;
+ 	struct task_struct	*tx_thread;
+ 	/* list_head for session connection list */
+diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
+index 9065107f083e..7a5237a1bce5 100644
+--- a/kernel/irq/resend.c
++++ b/kernel/irq/resend.c
+@@ -75,13 +75,21 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
+ 		    !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
+ #ifdef CONFIG_HARDIRQS_SW_RESEND
+ 			/*
+-			 * If the interrupt has a parent irq and runs
+-			 * in the thread context of the parent irq,
+-			 * retrigger the parent.
++			 * If the interrupt is running in the thread
++			 * context of the parent irq we need to be
++			 * careful, because we cannot trigger it
++			 * directly.
+ 			 */
+-			if (desc->parent_irq &&
+-			    irq_settings_is_nested_thread(desc))
++			if (irq_settings_is_nested_thread(desc)) {
++				/*
++				 * If the parent_irq is valid, we
++				 * retrigger the parent, otherwise we
++				 * do nothing.
++				 */
++				if (!desc->parent_irq)
++					return;
+ 				irq = desc->parent_irq;
++			}
+ 			/* Set it pending and activate the softirq: */
+ 			set_bit(irq, irqs_resend);
+ 			tasklet_schedule(&resend_tasklet);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 02bece4a99ea..eb11011b5292 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -98,6 +98,13 @@ struct ftrace_pid {
+ 	struct pid *pid;
+ };
+ 
++static bool ftrace_pids_enabled(void)
++{
++	return !list_empty(&ftrace_pids);
++}
++
++static void ftrace_update_trampoline(struct ftrace_ops *ops);
++
+ /*
+  * ftrace_disabled is set when an anomaly is discovered.
+  * ftrace_disabled is much stronger than ftrace_enabled.
+@@ -109,7 +116,6 @@ static DEFINE_MUTEX(ftrace_lock);
+ static struct ftrace_ops *ftrace_control_list __read_mostly = &ftrace_list_end;
+ static struct ftrace_ops *ftrace_ops_list __read_mostly = &ftrace_list_end;
+ ftrace_func_t ftrace_trace_function __read_mostly = ftrace_stub;
+-ftrace_func_t ftrace_pid_function __read_mostly = ftrace_stub;
+ static struct ftrace_ops global_ops;
+ static struct ftrace_ops control_ops;
+ 
+@@ -183,14 +189,7 @@ static void ftrace_pid_func(unsigned long ip, unsigned long parent_ip,
+ 	if (!test_tsk_trace_trace(current))
+ 		return;
+ 
+-	ftrace_pid_function(ip, parent_ip, op, regs);
+-}
+-
+-static void set_ftrace_pid_function(ftrace_func_t func)
+-{
+-	/* do not set ftrace_pid_function to itself! */
+-	if (func != ftrace_pid_func)
+-		ftrace_pid_function = func;
++	op->saved_func(ip, parent_ip, op, regs);
+ }
+ 
+ /**
+@@ -202,7 +201,6 @@ static void set_ftrace_pid_function(ftrace_func_t func)
+ void clear_ftrace_function(void)
+ {
+ 	ftrace_trace_function = ftrace_stub;
+-	ftrace_pid_function = ftrace_stub;
+ }
+ 
+ static void control_ops_disable_all(struct ftrace_ops *ops)
+@@ -436,6 +434,12 @@ static int __register_ftrace_function(struct ftrace_ops *ops)
+ 	} else
+ 		add_ftrace_ops(&ftrace_ops_list, ops);
+ 
++	/* Always save the function, and reset at unregistering */
++	ops->saved_func = ops->func;
++
++	if (ops->flags & FTRACE_OPS_FL_PID && ftrace_pids_enabled())
++		ops->func = ftrace_pid_func;
++
+ 	ftrace_update_trampoline(ops);
+ 
+ 	if (ftrace_enabled)
+@@ -463,15 +467,28 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
+ 	if (ftrace_enabled)
+ 		update_ftrace_function();
+ 
++	ops->func = ops->saved_func;
++
+ 	return 0;
+ }
+ 
+ static void ftrace_update_pid_func(void)
+ {
++	bool enabled = ftrace_pids_enabled();
++	struct ftrace_ops *op;
++
+ 	/* Only do something if we are tracing something */
+ 	if (ftrace_trace_function == ftrace_stub)
+ 		return;
+ 
++	do_for_each_ftrace_op(op, ftrace_ops_list) {
++		if (op->flags & FTRACE_OPS_FL_PID) {
++			op->func = enabled ? ftrace_pid_func :
++				op->saved_func;
++			ftrace_update_trampoline(op);
++		}
++	} while_for_each_ftrace_op(op);
++
+ 	update_ftrace_function();
+ }
+ 
+@@ -1133,7 +1150,8 @@ static struct ftrace_ops global_ops = {
+ 	.local_hash.filter_hash		= EMPTY_HASH,
+ 	INIT_OPS_HASH(global_ops)
+ 	.flags				= FTRACE_OPS_FL_RECURSION_SAFE |
+-					  FTRACE_OPS_FL_INITIALIZED,
++					  FTRACE_OPS_FL_INITIALIZED |
++					  FTRACE_OPS_FL_PID,
+ };
+ 
+ /*
+@@ -5023,7 +5041,9 @@ static void ftrace_update_trampoline(struct ftrace_ops *ops)
+ 
+ static struct ftrace_ops global_ops = {
+ 	.func			= ftrace_stub,
+-	.flags			= FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
++	.flags			= FTRACE_OPS_FL_RECURSION_SAFE |
++				  FTRACE_OPS_FL_INITIALIZED |
++				  FTRACE_OPS_FL_PID,
+ };
+ 
+ static int __init ftrace_nodyn_init(void)
+@@ -5080,11 +5100,6 @@ void ftrace_init_array_ops(struct trace_array *tr, ftrace_func_t func)
+ 		if (WARN_ON(tr->ops->func != ftrace_stub))
+ 			printk("ftrace ops had %pS for function\n",
+ 			       tr->ops->func);
+-		/* Only the top level instance does pid tracing */
+-		if (!list_empty(&ftrace_pids)) {
+-			set_ftrace_pid_function(func);
+-			func = ftrace_pid_func;
+-		}
+ 	}
+ 	tr->ops->func = func;
+ 	tr->ops->private = tr;
+@@ -5371,7 +5386,7 @@ static void *fpid_start(struct seq_file *m, loff_t *pos)
+ {
+ 	mutex_lock(&ftrace_lock);
+ 
+-	if (list_empty(&ftrace_pids) && (!*pos))
++	if (!ftrace_pids_enabled() && (!*pos))
+ 		return (void *) 1;
+ 
+ 	return seq_list_start(&ftrace_pids, *pos);
+@@ -5610,6 +5625,7 @@ static struct ftrace_ops graph_ops = {
+ 	.func			= ftrace_stub,
+ 	.flags			= FTRACE_OPS_FL_RECURSION_SAFE |
+ 				   FTRACE_OPS_FL_INITIALIZED |
++				   FTRACE_OPS_FL_PID |
+ 				   FTRACE_OPS_FL_STUB,
+ #ifdef FTRACE_GRAPH_TRAMP_ADDR
+ 	.trampoline		= FTRACE_GRAPH_TRAMP_ADDR,
+diff --git a/lib/dma-debug.c b/lib/dma-debug.c
+index ae4b65e17e64..dace71fe41f7 100644
+--- a/lib/dma-debug.c
++++ b/lib/dma-debug.c
+@@ -574,6 +574,9 @@ void debug_dma_assert_idle(struct page *page)
+ 	unsigned long flags;
+ 	phys_addr_t cln;
+ 
++	if (dma_debug_disabled())
++		return;
++
+ 	if (!page)
+ 		return;
+ 
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 689c818ed007..62c635f2bcfc 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -89,6 +89,8 @@ struct timer_list can_stattimer;   /* timer for statistics update */
+ struct s_stats    can_stats;       /* packet statistics */
+ struct s_pstats   can_pstats;      /* receive list statistics */
+ 
++static atomic_t skbcounter = ATOMIC_INIT(0);
++
+ /*
+  * af_can socket functions
+  */
+@@ -310,12 +312,8 @@ int can_send(struct sk_buff *skb, int loop)
+ 		return err;
+ 	}
+ 
+-	if (newskb) {
+-		if (!(newskb->tstamp.tv64))
+-			__net_timestamp(newskb);
+-
++	if (newskb)
+ 		netif_rx_ni(newskb);
+-	}
+ 
+ 	/* update statistics */
+ 	can_stats.tx_frames++;
+@@ -683,6 +681,10 @@ static void can_receive(struct sk_buff *skb, struct net_device *dev)
+ 	can_stats.rx_frames++;
+ 	can_stats.rx_frames_delta++;
+ 
++	/* create non-zero unique skb identifier together with *skb */
++	while (!(can_skb_prv(skb)->skbcnt))
++		can_skb_prv(skb)->skbcnt = atomic_inc_return(&skbcounter);
++
+ 	rcu_read_lock();
+ 
+ 	/* deliver the packet to sockets listening on all devices */
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index b523453585be..a1ba6875c2a2 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -261,6 +261,7 @@ static void bcm_can_tx(struct bcm_op *op)
+ 
+ 	can_skb_reserve(skb);
+ 	can_skb_prv(skb)->ifindex = dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 
+ 	memcpy(skb_put(skb, CFSIZ), cf, CFSIZ);
+ 
+@@ -1217,6 +1218,7 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk)
+ 	}
+ 
+ 	can_skb_prv(skb)->ifindex = dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 	skb->dev = dev;
+ 	can_skb_set_owner(skb, sk);
+ 	err = can_send(skb, 1); /* send with loopback */
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 31b9748cbb4e..2e67b1423cd3 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -75,7 +75,7 @@ MODULE_ALIAS("can-proto-1");
+  */
+ 
+ struct uniqframe {
+-	ktime_t tstamp;
++	int skbcnt;
+ 	const struct sk_buff *skb;
+ 	unsigned int join_rx_count;
+ };
+@@ -133,7 +133,7 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
+ 
+ 	/* eliminate multiple filter matches for the same skb */
+ 	if (this_cpu_ptr(ro->uniq)->skb == oskb &&
+-	    ktime_equal(this_cpu_ptr(ro->uniq)->tstamp, oskb->tstamp)) {
++	    this_cpu_ptr(ro->uniq)->skbcnt == can_skb_prv(oskb)->skbcnt) {
+ 		if (ro->join_filters) {
+ 			this_cpu_inc(ro->uniq->join_rx_count);
+ 			/* drop frame until all enabled filters matched */
+@@ -144,7 +144,7 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
+ 		}
+ 	} else {
+ 		this_cpu_ptr(ro->uniq)->skb = oskb;
+-		this_cpu_ptr(ro->uniq)->tstamp = oskb->tstamp;
++		this_cpu_ptr(ro->uniq)->skbcnt = can_skb_prv(oskb)->skbcnt;
+ 		this_cpu_ptr(ro->uniq)->join_rx_count = 1;
+ 		/* drop first frame to check all enabled filters? */
+ 		if (ro->join_filters && ro->count > 1)
+@@ -749,6 +749,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ 
+ 	can_skb_reserve(skb);
+ 	can_skb_prv(skb)->ifindex = dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 
+ 	err = memcpy_from_msg(skb_put(skb, size), msg, size);
+ 	if (err < 0)
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index 29236e832e44..c09c0131bfa2 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -723,6 +723,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
+ 
+ 	debugfs_remove_recursive(sdata->vif.debugfs_dir);
+ 	sdata->vif.debugfs_dir = NULL;
++	sdata->debugfs.subdir_stations = NULL;
+ }
+ 
+ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
+index 273b8bff6ba4..657ba9f5d308 100644
+--- a/net/rds/ib_rdma.c
++++ b/net/rds/ib_rdma.c
+@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
+ 	}
+ 
+ 	ibmr = rds_ib_alloc_fmr(rds_ibdev);
+-	if (IS_ERR(ibmr))
++	if (IS_ERR(ibmr)) {
++		rds_ib_dev_put(rds_ibdev);
+ 		return ibmr;
++	}
+ 
+ 	ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
+ 	if (ret == 0)
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index d126c03361ae..75888dd38a7f 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -85,7 +85,7 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem);
+ void snd_pcm_stream_lock(struct snd_pcm_substream *substream)
+ {
+ 	if (substream->pcm->nonatomic) {
+-		down_read(&snd_pcm_link_rwsem);
++		down_read_nested(&snd_pcm_link_rwsem, SINGLE_DEPTH_NESTING);
+ 		mutex_lock(&substream->self_group.mutex);
+ 	} else {
+ 		read_lock(&snd_pcm_link_rwlock);
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index c403dd10d126..44dfc7b92bc3 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2056,6 +2056,8 @@ static const struct pci_device_id azx_ids[] = {
+ 	/* ATI HDMI */
+ 	{ PCI_DEVICE(0x1002, 0x1308),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++	{ PCI_DEVICE(0x1002, 0x157a),
++	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ 	{ PCI_DEVICE(0x1002, 0x793b),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
+ 	{ PCI_DEVICE(0x1002, 0x7919),
+@@ -2110,8 +2112,14 @@ static const struct pci_device_id azx_ids[] = {
+ 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ 	{ PCI_DEVICE(0x1002, 0xaab0),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++	{ PCI_DEVICE(0x1002, 0xaac0),
++	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ 	{ PCI_DEVICE(0x1002, 0xaac8),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++	{ PCI_DEVICE(0x1002, 0xaad8),
++	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++	{ PCI_DEVICE(0x1002, 0xaae8),
++	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ 	/* VIA VT8251/VT8237A */
+ 	{ PCI_DEVICE(0x1106, 0x3288),
+ 	  .driver_data = AZX_DRIVER_VIA | AZX_DCAPS_POSFIX_VIA },
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 5f44f60a6389..225b78b4ef12 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3333,6 +3333,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
+ { .id = 0x10de0070, .name = "GPU 70 HDMI/DP",	.patch = patch_nvhdmi },
+ { .id = 0x10de0071, .name = "GPU 71 HDMI/DP",	.patch = patch_nvhdmi },
+ { .id = 0x10de0072, .name = "GPU 72 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de007d, .name = "GPU 7d HDMI/DP",	.patch = patch_nvhdmi },
+ { .id = 0x10de8001, .name = "MCP73 HDMI",	.patch = patch_nvhdmi_2ch },
+ { .id = 0x11069f80, .name = "VX900 HDMI/DP",	.patch = patch_via_hdmi },
+ { .id = 0x11069f81, .name = "VX900 HDMI/DP",	.patch = patch_via_hdmi },
+@@ -3396,6 +3397,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0067");
+ MODULE_ALIAS("snd-hda-codec-id:10de0070");
+ MODULE_ALIAS("snd-hda-codec-id:10de0071");
+ MODULE_ALIAS("snd-hda-codec-id:10de0072");
++MODULE_ALIAS("snd-hda-codec-id:10de007d");
+ MODULE_ALIAS("snd-hda-codec-id:10de8001");
+ MODULE_ALIAS("snd-hda-codec-id:11069f80");
+ MODULE_ALIAS("snd-hda-codec-id:11069f81");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 0e75998db39f..590bcfb0e82f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2224,7 +2224,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
+-	SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
++	SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
+ 
+ 	SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ 	SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+@@ -5004,7 +5004,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ 			{ 0x14, 0x90170110 },
+ 			{ 0x17, 0x40000008 },
+ 			{ 0x18, 0x411111f0 },
+-			{ 0x19, 0x411111f0 },
++			{ 0x19, 0x01a1913c },
+ 			{ 0x1a, 0x411111f0 },
+ 			{ 0x1b, 0x411111f0 },
+ 			{ 0x1d, 0x40f89b2d },
+@@ -5114,6 +5114,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0665, "Dell XPS 13", ALC288_FIXUP_DELL_XPS_13),
++	SND_PCI_QUIRK(0x1028, 0x069a, "Dell Vostro 5480", ALC290_FIXUP_SUBWOOFER_HSJACK),
+ 	SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+@@ -5382,6 +5383,17 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ 		{0x1d, 0x40700001},
+ 		{0x21, 0x02211030}),
+ 	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++		{0x12, 0x40000000},
++		{0x14, 0x90170130},
++		{0x17, 0x411111f0},
++		{0x18, 0x411111f0},
++		{0x19, 0x411111f0},
++		{0x1a, 0x411111f0},
++		{0x1b, 0x01014020},
++		{0x1d, 0x4054c029},
++		{0x1e, 0x411111f0},
++		{0x21, 0x0221103f}),
++	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 		{0x12, 0x90a60160},
+ 		{0x14, 0x90170120},
+ 		{0x17, 0x90170140},
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 6c66d7e16439..25f0f45e6640 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -2920,7 +2920,8 @@ static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x148a,
+ 		      "HP Mini", STAC_92HD83XXX_HP_LED),
+ 	SND_PCI_QUIRK_VENDOR(PCI_VENDOR_ID_HP, "HP", STAC_92HD83XXX_HP),
+-	SND_PCI_QUIRK(PCI_VENDOR_ID_TOSHIBA, 0xfa91,
++	/* match both for 0xfa91 and 0xfa93 */
++	SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_TOSHIBA, 0xfffd, 0xfa91,
+ 		      "Toshiba Satellite S50D", STAC_92HD83XXX_GPIO10_EAPD),
+ 	{} /* terminator */
+ };
+diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
+index 8461d6bf992f..204cc074adb9 100644
+--- a/sound/usb/line6/pcm.c
++++ b/sound/usb/line6/pcm.c
+@@ -186,12 +186,8 @@ static int line6_stream_start(struct snd_line6_pcm *line6pcm, int direction,
+ 	int ret = 0;
+ 
+ 	spin_lock_irqsave(&pstr->lock, flags);
+-	if (!test_and_set_bit(type, &pstr->running)) {
+-		if (pstr->active_urbs || pstr->unlink_urbs) {
+-			ret = -EBUSY;
+-			goto error;
+-		}
+-
++	if (!test_and_set_bit(type, &pstr->running) &&
++	    !(pstr->active_urbs || pstr->unlink_urbs)) {
+ 		pstr->count = 0;
+ 		/* Submit all currently available URBs */
+ 		if (direction == SNDRV_PCM_STREAM_PLAYBACK)
+@@ -199,7 +195,6 @@ static int line6_stream_start(struct snd_line6_pcm *line6pcm, int direction,
+ 		else
+ 			ret = line6_submit_audio_in_all_urbs(line6pcm);
+ 	}
+- error:
+ 	if (ret < 0)
+ 		clear_bit(type, &pstr->running);
+ 	spin_unlock_irqrestore(&pstr->lock, flags);
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index e5000da9e9d7..6a803eff87f7 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -341,6 +341,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
+ 	{ 0 }
+ };
+ 
++/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
++static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
++static struct usbmix_name_map bose_companion5_map[] = {
++	{ 3, NULL, .dB = &bose_companion5_dB },
++	{ 0 }	/* terminator */
++};
++
++/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
++static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
++static struct usbmix_name_map dragonfly_1_2_map[] = {
++	{ 7, NULL, .dB = &dragonfly_1_2_dB },
++	{ 0 }	/* terminator */
++};
++
+ /*
+  * Control map entries
+  */
+@@ -451,6 +465,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ 		.id = USB_ID(0x25c4, 0x0003),
+ 		.map = scms_usb3318_map,
+ 	},
++	{
++		/* Bose Companion 5 */
++		.id = USB_ID(0x05a7, 0x1020),
++		.map = bose_companion5_map,
++	},
++	{
++		/* Dragonfly DAC 1.2 */
++		.id = USB_ID(0x21b4, 0x0081),
++		.map = dragonfly_1_2_map,
++	},
+ 	{ 0 } /* terminator */
+ };
+ 
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 2f6d3e9a1bcd..e4756651a52c 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2512,6 +2512,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ 	}
+ },
+ 
++/* Steinberg devices */
++{
++	/* Steinberg MI2 */
++	USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
++	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++		.ifnum = QUIRK_ANY_INTERFACE,
++		.type = QUIRK_COMPOSITE,
++		.data = & (const struct snd_usb_audio_quirk[]) {
++			{
++				.ifnum = 0,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 1,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 2,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 3,
++				.type = QUIRK_MIDI_FIXED_ENDPOINT,
++				.data = &(const struct snd_usb_midi_endpoint_info) {
++					.out_cables = 0x0001,
++					.in_cables  = 0x0001
++				}
++			},
++			{
++				.ifnum = -1
++			}
++		}
++	}
++},
++{
++	/* Steinberg MI4 */
++	USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
++	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++		.ifnum = QUIRK_ANY_INTERFACE,
++		.type = QUIRK_COMPOSITE,
++		.data = & (const struct snd_usb_audio_quirk[]) {
++			{
++				.ifnum = 0,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 1,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 2,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 3,
++				.type = QUIRK_MIDI_FIXED_ENDPOINT,
++				.data = &(const struct snd_usb_midi_endpoint_info) {
++					.out_cables = 0x0001,
++					.in_cables  = 0x0001
++				}
++			},
++			{
++				.ifnum = -1
++			}
++		}
++	}
++},
++
+ /* TerraTec devices */
+ {
+ 	USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
+diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
+index 995b7a8596b1..658b0a89796d 100644
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -45,7 +45,7 @@ static struct rb_node *hists__filter_entries(struct rb_node *nd,
+ 
+ static bool hist_browser__has_filter(struct hist_browser *hb)
+ {
+-	return hists__has_filter(hb->hists) || hb->min_pcnt;
++	return hists__has_filter(hb->hists) || hb->min_pcnt || symbol_conf.has_filter;
+ }
+ 
+ static int hist_browser__get_folding(struct hist_browser *browser)
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index 201f6c4ca738..99378a5c57a7 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -1893,6 +1893,8 @@ int setup_intlist(struct intlist **list, const char *list_str,
+ 		pr_err("problems parsing %s list\n", list_name);
+ 		return -1;
+ 	}
++
++	symbol_conf.has_filter = true;
+ 	return 0;
+ }
+ 
+diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
+index 09561500164a..be0217989bcc 100644
+--- a/tools/perf/util/symbol.h
++++ b/tools/perf/util/symbol.h
+@@ -105,7 +105,8 @@ struct symbol_conf {
+ 			demangle_kernel,
+ 			filter_relative,
+ 			show_hist_headers,
+-			branch_callstack;
++			branch_callstack,
++			has_filter;
+ 	const char	*vmlinux_name,
+ 			*kallsyms_name,
+ 			*source_prefix,