diff --git a/Documentation/printk-formats.txt b/Documentation/printk-formats.txt
index 5962949944fd..d2fbeeb29582 100644
--- a/Documentation/printk-formats.txt
+++ b/Documentation/printk-formats.txt
@@ -279,11 +279,10 @@ struct clk:
 
        %pC     pll1
        %pCn    pll1
-       %pCr    1560000000
 
        For printing struct clk structures. '%pC' and '%pCn' print the name
        (Common Clock Framework) or address (legacy clock framework) of the
-       structure; '%pCr' prints the current clock rate.
+       structure.
 
        Passed by reference.
 
diff --git a/Makefile b/Makefile
index 2fcfe1147eaa..b10646531fcd 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 110
+SUBLEVEL = 111
 EXTRAVERSION =
 NAME = Roaring Lionus
 
diff --git a/arch/arm/include/asm/kgdb.h b/arch/arm/include/asm/kgdb.h
index 0a9d5dd93294..6949c7d4481c 100644
--- a/arch/arm/include/asm/kgdb.h
+++ b/arch/arm/include/asm/kgdb.h
@@ -76,7 +76,7 @@ extern int kgdb_fault_expected;
 
 #define KGDB_MAX_NO_CPUS       1
 #define BUFMAX                 400
-#define NUMREGBYTES            (DBG_MAX_REG_NUM << 2)
+#define NUMREGBYTES            (GDB_MAX_REGS << 2)
 #define NUMCRITREGBYTES                (32 << 2)
 
 #define _R0                    0
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 7959d2c92010..625c2b240ffb 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -826,7 +826,7 @@ static int __init parse_kpti(char *str)
        __kpti_forced = enabled ? 1 : -1;
        return 0;
 }
-__setup("kpti=", parse_kpti);
+early_param("kpti", parse_kpti);
 #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */
 
 static const struct arm64_cpu_capabilities arm64_features[] = {
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 66cce2138f95..18d96d349a8b 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -186,8 +186,9 @@ ENDPROC(idmap_cpu_replace_ttbr1)
 
        .macro __idmap_kpti_put_pgtable_ent_ng, type
        orr     \type, \type, #PTE_NG           // Same bit for blocks and pages
-       str     \type, [cur_\()\type\()p]       // Update the entry and ensure 
it
-       dc      civac, cur_\()\type\()p         // is visible to all CPUs.
+       str     \type, [cur_\()\type\()p]       // Update the entry and ensure
+       dmb     sy                              // that it is visible to all
+       dc      civac, cur_\()\type\()p         // CPUs.
        .endm
 
 /*
diff --git a/arch/m68k/mm/kmap.c b/arch/m68k/mm/kmap.c
index 6e4955bc542b..fcd52cefee29 100644
--- a/arch/m68k/mm/kmap.c
+++ b/arch/m68k/mm/kmap.c
@@ -88,7 +88,8 @@ static inline void free_io_area(void *addr)
        for (p = &iolist ; (tmp = *p) ; p = &tmp->next) {
                if (tmp->addr == addr) {
                        *p = tmp->next;
-                       __iounmap(tmp->addr, tmp->size);
+                       /* remove gap added in get_io_area() */
+                       __iounmap(tmp->addr, tmp->size - IO_SIZE);
                        kfree(tmp);
                        return;
                }
diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
index 6054d49e608e..8c9cbf13d32a 100644
--- a/arch/mips/bcm47xx/setup.c
+++ b/arch/mips/bcm47xx/setup.c
@@ -212,6 +212,12 @@ static int __init bcm47xx_cpu_fixes(void)
                 */
                if (bcm47xx_bus.bcma.bus.chipinfo.id == BCMA_CHIP_ID_BCM4706)
                        cpu_wait = NULL;
+
+               /*
+                * BCM47XX Erratum "R10: PCIe Transactions Periodically Fail"
+                * Enable ExternalSync for sync instruction to take effect
+                */
+               set_c0_config7(MIPS_CONF7_ES);
                break;
 #endif
        }
diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
index ecabc00c1e66..853b2f4954fa 100644
--- a/arch/mips/include/asm/io.h
+++ b/arch/mips/include/asm/io.h
@@ -412,6 +412,8 @@ static inline type pfx##in##bwlq##p(unsigned long port)     
                \
        __val = *__addr;                                                \
        slow;                                                           \
                                                                        \
+       /* prevent prefetching of coherent DMA data prematurely */      \
+       rmb();                                                          \
        return pfx##ioswab##bwlq(__addr, __val);                        \
 }
 
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index df78b2ca70eb..22a6782f84f5 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -663,6 +663,8 @@
 #define MIPS_CONF7_WII         (_ULCAST_(1) << 31)
 
 #define MIPS_CONF7_RPS         (_ULCAST_(1) << 2)
+/* ExternalSync */
+#define MIPS_CONF7_ES          (_ULCAST_(1) << 8)
 
 #define MIPS_CONF7_IAR         (_ULCAST_(1) << 10)
 #define MIPS_CONF7_AR          (_ULCAST_(1) << 16)
@@ -2641,6 +2643,7 @@ __BUILD_SET_C0(status)
 __BUILD_SET_C0(cause)
 __BUILD_SET_C0(config)
 __BUILD_SET_C0(config5)
+__BUILD_SET_C0(config7)
 __BUILD_SET_C0(intcontrol)
 __BUILD_SET_C0(intctl)
 __BUILD_SET_C0(srsmap)
diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
index 2f7c734771f4..0df911e772ae 100644
--- a/arch/mips/kernel/mcount.S
+++ b/arch/mips/kernel/mcount.S
@@ -116,10 +116,20 @@ ftrace_stub:
 NESTED(_mcount, PT_SIZE, ra)
        PTR_LA  t1, ftrace_stub
        PTR_L   t2, ftrace_trace_function /* Prepare t2 for (1) */
-       bne     t1, t2, static_trace
+       beq     t1, t2, fgraph_trace
         nop
 
+       MCOUNT_SAVE_REGS
+
+       move    a0, ra          /* arg1: self return address */
+       jalr    t2              /* (1) call *ftrace_trace_function */
+        move   a1, AT          /* arg2: parent's return address */
+
+       MCOUNT_RESTORE_REGS
+
+fgraph_trace:
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+       PTR_LA  t1, ftrace_stub
        PTR_L   t3, ftrace_graph_return
        bne     t1, t3, ftrace_graph_caller
         nop
@@ -128,24 +138,11 @@ NESTED(_mcount, PT_SIZE, ra)
        bne     t1, t3, ftrace_graph_caller
         nop
 #endif
-       b       ftrace_stub
-#ifdef CONFIG_32BIT
-        addiu sp, sp, 8
-#else
-        nop
-#endif
 
-static_trace:
-       MCOUNT_SAVE_REGS
-
-       move    a0, ra          /* arg1: self return address */
-       jalr    t2              /* (1) call *ftrace_trace_function */
-        move   a1, AT          /* arg2: parent's return address */
-
-       MCOUNT_RESTORE_REGS
 #ifdef CONFIG_32BIT
        addiu sp, sp, 8
 #endif
+
        .globl ftrace_stub
 ftrace_stub:
        RETURN_BACK
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 2dc52e6d2af4..e24ae0fa80ed 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -586,6 +586,7 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
         * actually hit this code path.
         */
 
+       isync
        slbie   r6
        slbie   r6              /* Workaround POWER5 < DD2.1 issue */
        slbmte  r7,r0
diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
index 8f0c7c5d93f2..93a6eeba3ace 100644
--- a/arch/powerpc/kernel/fadump.c
+++ b/arch/powerpc/kernel/fadump.c
@@ -1033,6 +1033,9 @@ void fadump_cleanup(void)
                init_fadump_mem_struct(&fdm,
                        
be64_to_cpu(fdm_active->cpu_state_data.destination_address));
                fadump_invalidate_dump(&fdm);
+       } else if (fw_dump.dump_registered) {
+               /* Un-register Firmware-assisted dump if it was registered. */
+               fadump_unregister_dump(&fdm);
        }
 }
 
diff --git a/arch/powerpc/kernel/hw_breakpoint.c 
b/arch/powerpc/kernel/hw_breakpoint.c
index 469d86d1c2a5..532c585ec24b 100644
--- a/arch/powerpc/kernel/hw_breakpoint.c
+++ b/arch/powerpc/kernel/hw_breakpoint.c
@@ -175,8 +175,8 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
        if (cpu_has_feature(CPU_FTR_DAWR)) {
                length_max = 512 ; /* 64 doublewords */
                /* DAWR region can't cross 512 boundary */
-               if ((bp->attr.bp_addr >> 10) != 
-                   ((bp->attr.bp_addr + bp->attr.bp_len - 1) >> 10))
+               if ((bp->attr.bp_addr >> 9) !=
+                   ((bp->attr.bp_addr + bp->attr.bp_len - 1) >> 9))
                        return -EINVAL;
        }
        if (info->len >
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index d97370866a5f..adfa63e7df8c 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -2380,6 +2380,7 @@ static int ptrace_set_debugreg(struct task_struct *task, 
unsigned long addr,
        /* Create a new breakpoint request if one doesn't exist already */
        hw_breakpoint_init(&attr);
        attr.bp_addr = hw_brk.address;
+       attr.bp_len = 8;
        arch_bp_generic_fields(hw_brk.type,
                               &attr.bp_type);
 
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c 
b/arch/powerpc/platforms/powernv/pci-ioda.c
index f602307a4386..9ed90c502005 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -3424,7 +3424,6 @@ static void pnv_pci_ioda2_release_pe_dma(struct 
pnv_ioda_pe *pe)
                WARN_ON(pe->table_group.group);
        }
 
-       pnv_pci_ioda2_table_free_pages(tbl);
        iommu_free_table(tbl, "pnv");
 }
 
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index 78d1c6a3d221..eb53c2c78a1f 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -37,7 +37,7 @@ static inline unsigned long array_index_mask_nospec(unsigned 
long index,
 {
        unsigned long mask;
 
-       asm ("cmp %1,%2; sbb %0,%0;"
+       asm volatile ("cmp %1,%2; sbb %0,%0;"
                        :"=r" (mask)
                        :"g"(size),"r" (index)
                        :"cc");
diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c 
b/arch/x86/kernel/cpu/mcheck/mce-severity.c
index f46071cb2c90..3e0199ee5a2f 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
+++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
@@ -143,6 +143,11 @@ static struct severity {
                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, 
MCI_UC_SAR|MCI_ADDR|MCACOD_INSTR),
                USER
                ),
+       MCESEV(
+               PANIC, "Data load in unrecoverable area of kernel",
+               SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, 
MCI_UC_SAR|MCI_ADDR|MCACOD_DATA),
+               KERNEL
+               ),
 #endif
        MCESEV(
                PANIC, "Action required: unknown MCACOD",
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 7bbd50fa72ad..c49e146d4332 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -738,23 +738,25 @@ EXPORT_SYMBOL_GPL(machine_check_poll);
 static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
                          struct pt_regs *regs)
 {
-       int i, ret = 0;
        char *tmp;
+       int i;
 
        for (i = 0; i < mca_cfg.banks; i++) {
                m->status = mce_rdmsrl(msr_ops.status(i));
-               if (m->status & MCI_STATUS_VAL) {
-                       __set_bit(i, validp);
-                       if (quirk_no_way_out)
-                               quirk_no_way_out(i, m, regs);
-               }
+               if (!(m->status & MCI_STATUS_VAL))
+                       continue;
+
+               __set_bit(i, validp);
+               if (quirk_no_way_out)
+                       quirk_no_way_out(i, m, regs);
 
                if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= 
MCE_PANIC_SEVERITY) {
+                       mce_read_aux(m, i);
                        *msg = tmp;
-                       ret = 1;
+                       return 1;
                }
        }
-       return ret;
+       return 0;
 }
 
 /*
@@ -1140,13 +1142,18 @@ void do_machine_check(struct pt_regs *regs, long 
error_code)
                lmce = m.mcgstatus & MCG_STATUS_LMCES;
 
        /*
+        * Local machine check may already know that we have to panic.
+        * Broadcast machine check begins rendezvous in mce_start()
         * Go through all banks in exclusion of the other CPUs. This way we
         * don't report duplicated events on shared banks because the first one
-        * to see it will clear it. If this is a Local MCE, then no need to
-        * perform rendezvous.
+        * to see it will clear it.
         */
-       if (!lmce)
+       if (lmce) {
+               if (no_way_out)
+                       mce_panic("Fatal local machine check", &m, msg);
+       } else {
                order = mce_start(&no_way_out);
+       }
 
        for (i = 0; i < cfg->banks; i++) {
                __clear_bit(i, toclear);
@@ -1222,12 +1229,17 @@ void do_machine_check(struct pt_regs *regs, long 
error_code)
                        no_way_out = worst >= MCE_PANIC_SEVERITY;
        } else {
                /*
-                * Local MCE skipped calling mce_reign()
-                * If we found a fatal error, we need to panic here.
+                * If there was a fatal machine check we should have
+                * already called mce_panic earlier in this function.
+                * Since we re-read the banks, we might have found
+                * something new. Check again to see if we found a
+                * fatal error. We call "mce_severity()" again to
+                * make sure we have the right "msg".
                 */
-                if (worst >= MCE_PANIC_SEVERITY && mca_cfg.tolerant < 3)
-                       mce_panic("Machine check from unknown source",
-                               NULL, NULL);
+               if (worst >= MCE_PANIC_SEVERITY && mca_cfg.tolerant < 3) {
+                       mce_severity(&m, cfg->tolerant, &msg, true);
+                       mce_panic("Local fatal machine check!", &m, msg);
+               }
        }
 
        /*
diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
index 0bee04d41bed..b57100a2c834 100644
--- a/arch/x86/kernel/quirks.c
+++ b/arch/x86/kernel/quirks.c
@@ -643,12 +643,19 @@ static void quirk_intel_brickland_xeon_ras_cap(struct 
pci_dev *pdev)
 /* Skylake */
 static void quirk_intel_purley_xeon_ras_cap(struct pci_dev *pdev)
 {
-       u32 capid0;
+       u32 capid0, capid5;
 
        pci_read_config_dword(pdev, 0x84, &capid0);
+       pci_read_config_dword(pdev, 0x98, &capid5);
 
-       if ((capid0 & 0xc0) == 0xc0)
+       /*
+        * CAPID0{7:6} indicate whether this is an advanced RAS SKU
+        * CAPID5{8:5} indicate that various NVDIMM usage modes are
+        * enabled, so memory machine check recovery is also enabled.
+        */
+       if ((capid0 & 0xc0) == 0xc0 || (capid5 & 0x1e0))
                static_branch_inc(&mcsafe_key);
+
 }
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x0ec3, 
quirk_intel_brickland_xeon_ras_cap);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2fc0, 
quirk_intel_brickland_xeon_ras_cap);
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index f2142932ff0b..5bbfa2f63b8c 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -799,16 +799,18 @@ static void math_error(struct pt_regs *regs, int 
error_code, int trapnr)
        char *str = (trapnr == X86_TRAP_MF) ? "fpu exception" :
                                                "simd exception";
 
-       if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, SIGFPE) == 
NOTIFY_STOP)
-               return;
        cond_local_irq_enable(regs);
 
        if (!user_mode(regs)) {
-               if (!fixup_exception(regs, trapnr)) {
-                       task->thread.error_code = error_code;
-                       task->thread.trap_nr = trapnr;
+               if (fixup_exception(regs, trapnr))
+                       return;
+
+               task->thread.error_code = error_code;
+               task->thread.trap_nr = trapnr;
+
+               if (notify_die(DIE_TRAP, str, regs, error_code,
+                                       trapnr, SIGFPE) != NOTIFY_STOP)
                        die(str, regs, error_code);
-               }
                return;
        }
 
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index f92bdb9f4e46..ae9b84cae57c 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -653,7 +653,9 @@ void __init init_mem_mapping(void)
  */
 int devmem_is_allowed(unsigned long pagenr)
 {
-       if (page_is_ram(pagenr)) {
+       if (region_intersects(PFN_PHYS(pagenr), PAGE_SIZE,
+                               IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE)
+                       != REGION_DISJOINT) {
                /*
                 * For disallowed memory regions in the low 1MB range,
                 * request that the page be shown as all zeros.
diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c
index ce37d5b899fe..44bd9a377ad1 100644
--- a/arch/xtensa/kernel/traps.c
+++ b/arch/xtensa/kernel/traps.c
@@ -334,7 +334,7 @@ do_unaligned_user (struct pt_regs *regs)
        info.si_errno = 0;
        info.si_code = BUS_ADRALN;
        info.si_addr = (void *) regs->excvaddr;
-       force_sig_info(SIGSEGV, &info, current);
+       force_sig_info(SIGBUS, &info, current);
 
 }
 #endif
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c 
b/crypto/asymmetric_keys/x509_cert_parser.c
index ce2df8c9c583..7e6a43ffdcbe 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -249,6 +249,15 @@ int x509_note_signature(void *context, size_t hdrlen,
                return -EINVAL;
        }
 
+       if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0) {
+               /* Discard the BIT STRING metadata */
+               if (vlen < 1 || *(const u8 *)value != 0)
+                       return -EBADMSG;
+
+               value++;
+               vlen--;
+       }
+
        ctx->cert->raw_sig = value;
        ctx->cert->raw_sig_size = vlen;
        return 0;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 343cad9bf7e7..ef3016a467a0 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -3900,7 +3900,6 @@ static void cancel_tasks_sync(struct rbd_device *rbd_dev)
 {
        dout("%s rbd_dev %p\n", __func__, rbd_dev);
 
-       cancel_delayed_work_sync(&rbd_dev->watch_dwork);
        cancel_work_sync(&rbd_dev->acquired_lock_work);
        cancel_work_sync(&rbd_dev->released_lock_work);
        cancel_delayed_work_sync(&rbd_dev->lock_dwork);
@@ -3918,6 +3917,7 @@ static void rbd_unregister_watch(struct rbd_device 
*rbd_dev)
        rbd_dev->watch_state = RBD_WATCH_STATE_UNREGISTERED;
        mutex_unlock(&rbd_dev->watch_mutex);
 
+       cancel_delayed_work_sync(&rbd_dev->watch_dwork);
        ceph_osdc_flush_notifies(&rbd_dev->rbd_client->client->osdc);
 }
 
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index 74b2f4a14643..3a8b9aef96a6 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -939,6 +939,12 @@ static int qca_setup(struct hci_uart *hu)
        } else if (ret == -ENOENT) {
                /* No patch/nvm-config found, run with original fw/config */
                ret = 0;
+       } else if (ret == -EAGAIN) {
+               /*
+                * Userspace firmware loader will return -EAGAIN in case no
+                * patch/nvm-config is found, so run with original fw/config.
+                */
+               ret = 0;
        }
 
        /* Setup bdaddr */
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
index feafdab734ae..4835b588b783 100644
--- a/drivers/char/ipmi/ipmi_bt_sm.c
+++ b/drivers/char/ipmi/ipmi_bt_sm.c
@@ -522,11 +522,12 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, 
long time)
                if (status & BT_H_BUSY)         /* clear a leftover H_BUSY */
                        BT_CONTROL(BT_H_BUSY);
 
+               bt->timeout = bt->BT_CAP_req2rsp;
+
                /* Read BT capabilities if it hasn't been done yet */
                if (!bt->BT_CAP_outreqs)
                        BT_STATE_CHANGE(BT_STATE_CAPABILITIES_BEGIN,
                                        SI_SM_CALL_WITHOUT_DELAY);
-               bt->timeout = bt->BT_CAP_req2rsp;
                BT_SI_SM_RETURN(SI_SM_IDLE);
 
        case BT_STATE_XACTION_START:
diff --git a/drivers/clk/at91/clk-pll.c b/drivers/clk/at91/clk-pll.c
index 45ad168e1496..2bb2551c6245 100644
--- a/drivers/clk/at91/clk-pll.c
+++ b/drivers/clk/at91/clk-pll.c
@@ -132,19 +132,8 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hw,
                                         unsigned long parent_rate)
 {
        struct clk_pll *pll = to_clk_pll(hw);
-       unsigned int pllr;
-       u16 mul;
-       u8 div;
-
-       regmap_read(pll->regmap, PLL_REG(pll->id), &pllr);
-
-       div = PLL_DIV(pllr);
-       mul = PLL_MUL(pllr, pll->layout);
-
-       if (!div || !mul)
-               return 0;
 
-       return (parent_rate / div) * (mul + 1);
+       return (parent_rate / pll->div) * (pll->mul + 1);
 }
 
 static long clk_pll_get_best_div_mul(struct clk_pll *pll, unsigned long rate,
diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c 
b/drivers/clk/renesas/renesas-cpg-mssr.c
index 25c41cd9cdfc..7ecc5eac3d7f 100644
--- a/drivers/clk/renesas/renesas-cpg-mssr.c
+++ b/drivers/clk/renesas/renesas-cpg-mssr.c
@@ -243,8 +243,9 @@ struct clk *cpg_mssr_clk_src_twocell_get(struct 
of_phandle_args *clkspec,
                dev_err(dev, "Cannot get %s clock %u: %ld", type, clkidx,
                       PTR_ERR(clk));
        else
-               dev_dbg(dev, "clock (%u, %u) is %pC at %pCr Hz\n",
-                       clkspec->args[0], clkspec->args[1], clk, clk);
+               dev_dbg(dev, "clock (%u, %u) is %pC at %lu Hz\n",
+                       clkspec->args[0], clkspec->args[1], clk,
+                       clk_get_rate(clk));
        return clk;
 }
 
@@ -304,7 +305,7 @@ static void __init cpg_mssr_register_core_clk(const struct 
cpg_core_clk *core,
        if (IS_ERR_OR_NULL(clk))
                goto fail;
 
-       dev_dbg(dev, "Core clock %pC at %pCr Hz\n", clk, clk);
+       dev_dbg(dev, "Core clock %pC at %lu Hz\n", clk, clk_get_rate(clk));
        priv->clks[id] = clk;
        return;
 
@@ -372,7 +373,7 @@ static void __init cpg_mssr_register_mod_clk(const struct 
mssr_mod_clk *mod,
        if (IS_ERR(clk))
                goto fail;
 
-       dev_dbg(dev, "Module clock %pC at %pCr Hz\n", clk, clk);
+       dev_dbg(dev, "Module clock %pC at %lu Hz\n", clk, clk_get_rate(clk));
        priv->clks[id] = clk;
        return;
 
diff --git a/drivers/cpuidle/cpuidle-powernv.c 
b/drivers/cpuidle/cpuidle-powernv.c
index 854a56781100..fd96af1d2ef0 100644
--- a/drivers/cpuidle/cpuidle-powernv.c
+++ b/drivers/cpuidle/cpuidle-powernv.c
@@ -32,9 +32,31 @@ static struct cpuidle_state *cpuidle_state_table;
 
 static u64 stop_psscr_table[CPUIDLE_STATE_MAX];
 
-static u64 snooze_timeout;
+static u64 default_snooze_timeout;
 static bool snooze_timeout_en;
 
+static u64 get_snooze_timeout(struct cpuidle_device *dev,
+                             struct cpuidle_driver *drv,
+                             int index)
+{
+       int i;
+
+       if (unlikely(!snooze_timeout_en))
+               return default_snooze_timeout;
+
+       for (i = index + 1; i < drv->state_count; i++) {
+               struct cpuidle_state *s = &drv->states[i];
+               struct cpuidle_state_usage *su = &dev->states_usage[i];
+
+               if (s->disabled || su->disable)
+                       continue;
+
+               return s->target_residency * tb_ticks_per_usec;
+       }
+
+       return default_snooze_timeout;
+}
+
 static int snooze_loop(struct cpuidle_device *dev,
                        struct cpuidle_driver *drv,
                        int index)
@@ -44,7 +66,7 @@ static int snooze_loop(struct cpuidle_device *dev,
        local_irq_enable();
        set_thread_flag(TIF_POLLING_NRFLAG);
 
-       snooze_exit_time = get_tb() + snooze_timeout;
+       snooze_exit_time = get_tb() + get_snooze_timeout(dev, drv, index);
        ppc64_runlatch_off();
        while (!need_resched()) {
                HMT_low();
@@ -337,11 +359,9 @@ static int powernv_idle_probe(void)
                cpuidle_state_table = powernv_states;
                /* Device tree can indicate more idle states */
                max_idle_state = powernv_add_idle_states();
-               if (max_idle_state > 1) {
+               default_snooze_timeout = TICK_USEC * tb_ticks_per_usec;
+               if (max_idle_state > 1)
                        snooze_timeout_en = true;
-                       snooze_timeout = powernv_states[1].target_residency *
-                                        tb_ticks_per_usec;
-               }
        } else
                return -ENODEV;
 
diff --git a/drivers/iio/buffer/kfifo_buf.c b/drivers/iio/buffer/kfifo_buf.c
index 7ef9b13262a8..e44181f9eb36 100644
--- a/drivers/iio/buffer/kfifo_buf.c
+++ b/drivers/iio/buffer/kfifo_buf.c
@@ -19,7 +19,7 @@ struct iio_kfifo {
 #define iio_to_kfifo(r) container_of(r, struct iio_kfifo, buffer)
 
 static inline int __iio_allocate_kfifo(struct iio_kfifo *buf,
-                               int bytes_per_datum, int length)
+                       size_t bytes_per_datum, unsigned int length)
 {
        if ((length == 0) || (bytes_per_datum == 0))
                return -EINVAL;
@@ -71,7 +71,7 @@ static int iio_set_bytes_per_datum_kfifo(struct iio_buffer 
*r, size_t bpd)
        return 0;
 }
 
-static int iio_set_length_kfifo(struct iio_buffer *r, int length)
+static int iio_set_length_kfifo(struct iio_buffer *r, unsigned int length)
 {
        /* Avoid an invalid state */
        if (length < 2)
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index a3279f3d2578..a79d9b340cfa 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -1631,6 +1631,7 @@ struct cc_state *get_cc_state_protected(struct 
hfi1_pportdata *ppd)
 #define HFI1_HAS_SDMA_TIMEOUT  0x8
 #define HFI1_HAS_SEND_DMA      0x10   /* Supports Send DMA */
 #define HFI1_FORCED_FREEZE     0x80   /* driver forced freeze mode */
+#define HFI1_SHUTDOWN          0x100  /* device is shutting down */
 
 /* IB dword length mask in PBC (lower 11 bits); same for all chips */
 #define HFI1_PBC_LENGTH_MASK                     ((1 << 11) - 1)
diff --git a/drivers/infiniband/hw/hfi1/init.c 
b/drivers/infiniband/hw/hfi1/init.c
index ae1f90ddd4e8..c81c44525dd5 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -857,6 +857,10 @@ static void shutdown_device(struct hfi1_devdata *dd)
        unsigned pidx;
        int i;
 
+       if (dd->flags & HFI1_SHUTDOWN)
+               return;
+       dd->flags |= HFI1_SHUTDOWN;
+
        for (pidx = 0; pidx < dd->num_pports; ++pidx) {
                ppd = dd->pport + pidx;
 
@@ -1168,6 +1172,7 @@ void hfi1_disable_after_error(struct hfi1_devdata *dd)
 
 static void remove_one(struct pci_dev *);
 static int init_one(struct pci_dev *, const struct pci_device_id *);
+static void shutdown_one(struct pci_dev *);
 
 #define DRIVER_LOAD_MSG "Intel " DRIVER_NAME " loaded: "
 #define PFX DRIVER_NAME ": "
@@ -1184,6 +1189,7 @@ static struct pci_driver hfi1_pci_driver = {
        .name = DRIVER_NAME,
        .probe = init_one,
        .remove = remove_one,
+       .shutdown = shutdown_one,
        .id_table = hfi1_pci_tbl,
        .err_handler = &hfi1_pci_err_handler,
 };
@@ -1590,6 +1596,13 @@ static void remove_one(struct pci_dev *pdev)
        postinit_cleanup(dd);
 }
 
+static void shutdown_one(struct pci_dev *pdev)
+{
+       struct hfi1_devdata *dd = pci_get_drvdata(pdev);
+
+       shutdown_device(dd);
+}
+
 /**
  * hfi1_create_rcvhdrq - create a receive header queue
  * @dd: the hfi1_ib device
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 18d309e40f1b..d9323d7c479c 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1897,7 +1897,6 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct 
*work)
                                               "buf:%lld\n", wc.wr_id);
                                break;
                        default:
-                               BUG_ON(1);
                                break;
                        }
                } else  {
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index fc62a7ded734..a19ebb19952e 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -645,7 +645,7 @@ static int mlx5_poll_one(struct mlx5_ib_cq *cq,
 }
 
 static int poll_soft_wc(struct mlx5_ib_cq *cq, int num_entries,
-                       struct ib_wc *wc)
+                       struct ib_wc *wc, bool is_fatal_err)
 {
        struct mlx5_ib_dev *dev = to_mdev(cq->ibcq.device);
        struct mlx5_ib_wc *soft_wc, *next;
@@ -658,6 +658,10 @@ static int poll_soft_wc(struct mlx5_ib_cq *cq, int 
num_entries,
                mlx5_ib_dbg(dev, "polled software generated completion on CQ 
0x%x\n",
                            cq->mcq.cqn);
 
+               if (unlikely(is_fatal_err)) {
+                       soft_wc->wc.status = IB_WC_WR_FLUSH_ERR;
+                       soft_wc->wc.vendor_err = MLX5_CQE_SYNDROME_WR_FLUSH_ERR;
+               }
                wc[npolled++] = soft_wc->wc;
                list_del(&soft_wc->list);
                kfree(soft_wc);
@@ -678,12 +682,17 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, 
struct ib_wc *wc)
 
        spin_lock_irqsave(&cq->lock, flags);
        if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
-               mlx5_ib_poll_sw_comp(cq, num_entries, wc, &npolled);
+               /* make sure no soft wqe's are waiting */
+               if (unlikely(!list_empty(&cq->wc_list)))
+                       soft_polled = poll_soft_wc(cq, num_entries, wc, true);
+
+               mlx5_ib_poll_sw_comp(cq, num_entries - soft_polled,
+                                    wc + soft_polled, &npolled);
                goto out;
        }
 
        if (unlikely(!list_empty(&cq->wc_list)))
-               soft_polled = poll_soft_wc(cq, num_entries, wc);
+               soft_polled = poll_soft_wc(cq, num_entries, wc, false);
 
        for (npolled = 0; npolled < num_entries - soft_polled; npolled++) {
                if (mlx5_poll_one(cq, &cur_qp, wc + soft_polled + npolled))
diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
index a3e21a25cea5..ef092cca092e 100644
--- a/drivers/infiniband/hw/qib/qib.h
+++ b/drivers/infiniband/hw/qib/qib.h
@@ -1250,6 +1250,7 @@ static inline struct qib_ibport *to_iport(struct 
ib_device *ibdev, u8 port)
 #define QIB_BADINTR           0x8000 /* severe interrupt problems */
 #define QIB_DCA_ENABLED       0x10000 /* Direct Cache Access enabled */
 #define QIB_HAS_QSFP          0x20000 /* device (card instance) has QSFP */
+#define QIB_SHUTDOWN          0x40000 /* device is shutting down */
 
 /*
  * values for ppd->lflags (_ib_port_ related flags)
@@ -1448,8 +1449,7 @@ u64 qib_sps_ints(void);
 /*
  * dma_addr wrappers - all 0's invalid for hw
  */
-dma_addr_t qib_map_page(struct pci_dev *, struct page *, unsigned long,
-                         size_t, int);
+int qib_map_page(struct pci_dev *d, struct page *p, dma_addr_t *daddr);
 const char *qib_get_unit_name(int unit);
 const char *qib_get_card_name(struct rvt_dev_info *rdi);
 struct pci_dev *qib_get_pci_dev(struct rvt_dev_info *rdi);
diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c 
b/drivers/infiniband/hw/qib/qib_file_ops.c
index 382466a90da7..cc6a92316c7c 100644
--- a/drivers/infiniband/hw/qib/qib_file_ops.c
+++ b/drivers/infiniband/hw/qib/qib_file_ops.c
@@ -364,6 +364,8 @@ static int qib_tid_update(struct qib_ctxtdata *rcd, struct 
file *fp,
                goto done;
        }
        for (i = 0; i < cnt; i++, vaddr += PAGE_SIZE) {
+               dma_addr_t daddr;
+
                for (; ntids--; tid++) {
                        if (tid == tidcnt)
                                tid = 0;
@@ -380,12 +382,14 @@ static int qib_tid_update(struct qib_ctxtdata *rcd, 
struct file *fp,
                        ret = -ENOMEM;
                        break;
                }
+               ret = qib_map_page(dd->pcidev, pagep[i], &daddr);
+               if (ret)
+                       break;
+
                tidlist[i] = tid + tidoff;
                /* we "know" system pages and TID pages are same size */
                dd->pageshadow[ctxttid + tid] = pagep[i];
-               dd->physshadow[ctxttid + tid] =
-                       qib_map_page(dd->pcidev, pagep[i], 0, PAGE_SIZE,
-                                    PCI_DMA_FROMDEVICE);
+               dd->physshadow[ctxttid + tid] = daddr;
                /*
                 * don't need atomic or it's overhead
                 */
diff --git a/drivers/infiniband/hw/qib/qib_init.c 
b/drivers/infiniband/hw/qib/qib_init.c
index 1730aa839a47..caf7c5120b0a 100644
--- a/drivers/infiniband/hw/qib/qib_init.c
+++ b/drivers/infiniband/hw/qib/qib_init.c
@@ -878,6 +878,10 @@ static void qib_shutdown_device(struct qib_devdata *dd)
        struct qib_pportdata *ppd;
        unsigned pidx;
 
+       if (dd->flags & QIB_SHUTDOWN)
+               return;
+       dd->flags |= QIB_SHUTDOWN;
+
        for (pidx = 0; pidx < dd->num_pports; ++pidx) {
                ppd = dd->pport + pidx;
 
@@ -1223,6 +1227,7 @@ void qib_disable_after_error(struct qib_devdata *dd)
 
 static void qib_remove_one(struct pci_dev *);
 static int qib_init_one(struct pci_dev *, const struct pci_device_id *);
+static void qib_shutdown_one(struct pci_dev *);
 
 #define DRIVER_LOAD_MSG "Intel " QIB_DRV_NAME " loaded: "
 #define PFX QIB_DRV_NAME ": "
@@ -1240,6 +1245,7 @@ static struct pci_driver qib_driver = {
        .name = QIB_DRV_NAME,
        .probe = qib_init_one,
        .remove = qib_remove_one,
+       .shutdown = qib_shutdown_one,
        .id_table = qib_pci_tbl,
        .err_handler = &qib_pci_err_handler,
 };
@@ -1591,6 +1597,13 @@ static void qib_remove_one(struct pci_dev *pdev)
        qib_postinit_cleanup(dd);
 }
 
+static void qib_shutdown_one(struct pci_dev *pdev)
+{
+       struct qib_devdata *dd = pci_get_drvdata(pdev);
+
+       qib_shutdown_device(dd);
+}
+
 /**
  * qib_create_rcvhdrq - create a receive header queue
  * @dd: the qlogic_ib device
diff --git a/drivers/infiniband/hw/qib/qib_user_pages.c 
b/drivers/infiniband/hw/qib/qib_user_pages.c
index 75f08624ac05..4715edff5488 100644
--- a/drivers/infiniband/hw/qib/qib_user_pages.c
+++ b/drivers/infiniband/hw/qib/qib_user_pages.c
@@ -98,23 +98,27 @@ static int __qib_get_user_pages(unsigned long start_page, 
size_t num_pages,
  *
  * I'm sure we won't be so lucky with other iommu's, so FIXME.
  */
-dma_addr_t qib_map_page(struct pci_dev *hwdev, struct page *page,
-                       unsigned long offset, size_t size, int direction)
+int qib_map_page(struct pci_dev *hwdev, struct page *page, dma_addr_t *daddr)
 {
        dma_addr_t phys;
 
-       phys = pci_map_page(hwdev, page, offset, size, direction);
+       phys = pci_map_page(hwdev, page, 0, PAGE_SIZE, PCI_DMA_FROMDEVICE);
+       if (pci_dma_mapping_error(hwdev, phys))
+               return -ENOMEM;
 
-       if (phys == 0) {
-               pci_unmap_page(hwdev, phys, size, direction);
-               phys = pci_map_page(hwdev, page, offset, size, direction);
+       if (!phys) {
+               pci_unmap_page(hwdev, phys, PAGE_SIZE, PCI_DMA_FROMDEVICE);
+               phys = pci_map_page(hwdev, page, 0, PAGE_SIZE,
+                                   PCI_DMA_FROMDEVICE);
+               if (pci_dma_mapping_error(hwdev, phys))
+                       return -ENOMEM;
                /*
                 * FIXME: If we get 0 again, we should keep this page,
                 * map another, then free the 0 page.
                 */
        }
-
-       return phys;
+       *daddr = phys;
+       return 0;
 }
 
 /**
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c 
b/drivers/infiniband/ulp/isert/ib_isert.c
index b879d21b7548..02a5e2d7e574 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -879,15 +879,9 @@ isert_login_post_send(struct isert_conn *isert_conn, 
struct iser_tx_desc *tx_des
 }
 
 static void
-isert_create_send_desc(struct isert_conn *isert_conn,
-                      struct isert_cmd *isert_cmd,
-                      struct iser_tx_desc *tx_desc)
+__isert_create_send_desc(struct isert_device *device,
+                        struct iser_tx_desc *tx_desc)
 {
-       struct isert_device *device = isert_conn->device;
-       struct ib_device *ib_dev = device->ib_device;
-
-       ib_dma_sync_single_for_cpu(ib_dev, tx_desc->dma_addr,
-                                  ISER_HEADERS_LEN, DMA_TO_DEVICE);
 
        memset(&tx_desc->iser_header, 0, sizeof(struct iser_ctrl));
        tx_desc->iser_header.flags = ISCSI_CTRL;
@@ -900,6 +894,20 @@ isert_create_send_desc(struct isert_conn *isert_conn,
        }
 }
 
+static void
+isert_create_send_desc(struct isert_conn *isert_conn,
+                      struct isert_cmd *isert_cmd,
+                      struct iser_tx_desc *tx_desc)
+{
+       struct isert_device *device = isert_conn->device;
+       struct ib_device *ib_dev = device->ib_device;
+
+       ib_dma_sync_single_for_cpu(ib_dev, tx_desc->dma_addr,
+                                  ISER_HEADERS_LEN, DMA_TO_DEVICE);
+
+       __isert_create_send_desc(device, tx_desc);
+}
+
 static int
 isert_init_tx_hdrs(struct isert_conn *isert_conn,
                   struct iser_tx_desc *tx_desc)
@@ -987,7 +995,7 @@ isert_put_login_tx(struct iscsi_conn *conn, struct 
iscsi_login *login,
        struct iser_tx_desc *tx_desc = &isert_conn->login_tx_desc;
        int ret;
 
-       isert_create_send_desc(isert_conn, NULL, tx_desc);
+       __isert_create_send_desc(device, tx_desc);
 
        memcpy(&tx_desc->iscsi_header, &login->rsp[0],
               sizeof(struct iscsi_hdr));
@@ -2082,7 +2090,7 @@ isert_set_sig_attrs(struct se_cmd *se_cmd, struct 
ib_sig_attrs *sig_attrs)
 
        sig_attrs->check_mask =
               (se_cmd->prot_checks & TARGET_DIF_CHECK_GUARD  ? 0xc0 : 0) |
-              (se_cmd->prot_checks & TARGET_DIF_CHECK_REFTAG ? 0x30 : 0) |
+              (se_cmd->prot_checks & TARGET_DIF_CHECK_APPTAG ? 0x30 : 0) |
               (se_cmd->prot_checks & TARGET_DIF_CHECK_REFTAG ? 0x0f : 0);
        return 0;
 }
diff --git a/drivers/input/mouse/elan_i2c.h b/drivers/input/mouse/elan_i2c.h
index c0ec26118732..83dd0ce3ad2a 100644
--- a/drivers/input/mouse/elan_i2c.h
+++ b/drivers/input/mouse/elan_i2c.h
@@ -27,6 +27,8 @@
 #define ETP_DISABLE_POWER      0x0001
 #define ETP_PRESSURE_OFFSET    25
 
+#define ETP_CALIBRATE_MAX_LEN  3
+
 /* IAP Firmware handling */
 #define ETP_PRODUCT_ID_FORMAT_STRING   "%d.0"
 #define ETP_FW_NAME            "elan_i2c_" ETP_PRODUCT_ID_FORMAT_STRING ".bin"
diff --git a/drivers/input/mouse/elan_i2c_core.c 
b/drivers/input/mouse/elan_i2c_core.c
index aeb8250ab079..97f6e05cffce 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -595,7 +595,7 @@ static ssize_t calibrate_store(struct device *dev,
        int tries = 20;
        int retval;
        int error;
-       u8 val[3];
+       u8 val[ETP_CALIBRATE_MAX_LEN];
 
        retval = mutex_lock_interruptible(&data->sysfs_mutex);
        if (retval)
@@ -1250,6 +1250,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
        { "ELAN060C", 0 },
        { "ELAN0611", 0 },
        { "ELAN0612", 0 },
+       { "ELAN0618", 0 },
        { "ELAN1000", 0 },
        { }
 };
diff --git a/drivers/input/mouse/elan_i2c_smbus.c 
b/drivers/input/mouse/elan_i2c_smbus.c
index 05b8695a6369..d21bd55f3c42 100644
--- a/drivers/input/mouse/elan_i2c_smbus.c
+++ b/drivers/input/mouse/elan_i2c_smbus.c
@@ -56,7 +56,7 @@
 static int elan_smbus_initialize(struct i2c_client *client)
 {
        u8 check[ETP_SMBUS_HELLOPACKET_LEN] = { 0x55, 0x55, 0x55, 0x55, 0x55 };
-       u8 values[ETP_SMBUS_HELLOPACKET_LEN] = { 0, 0, 0, 0, 0 };
+       u8 values[I2C_SMBUS_BLOCK_MAX] = {0};
        int len, error;
 
        /* Get hello packet */
@@ -117,12 +117,16 @@ static int elan_smbus_calibrate(struct i2c_client *client)
 static int elan_smbus_calibrate_result(struct i2c_client *client, u8 *val)
 {
        int error;
+       u8 buf[I2C_SMBUS_BLOCK_MAX] = {0};
+
+       BUILD_BUG_ON(ETP_CALIBRATE_MAX_LEN > sizeof(buf));
 
        error = i2c_smbus_read_block_data(client,
-                                         ETP_SMBUS_CALIBRATE_QUERY, val);
+                                         ETP_SMBUS_CALIBRATE_QUERY, buf);
        if (error < 0)
                return error;
 
+       memcpy(val, buf, ETP_CALIBRATE_MAX_LEN);
        return 0;
 }
 
@@ -470,6 +474,8 @@ static int elan_smbus_get_report(struct i2c_client *client, 
u8 *report)
 {
        int len;
 
+       BUILD_BUG_ON(I2C_SMBUS_BLOCK_MAX > ETP_SMBUS_REPORT_LEN);
+
        len = i2c_smbus_read_block_data(client,
                                        ETP_SMBUS_PACKET_QUERY,
                                        &report[ETP_SMBUS_REPORT_OFFSET]);
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index c519c0b09568..4e77adbfa835 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -800,7 +800,7 @@ static int elantech_packet_check_v4(struct psmouse *psmouse)
        else if (ic_version == 7 && etd->samples[1] == 0x2A)
                sanity_check = ((packet[3] & 0x1c) == 0x10);
        else
-               sanity_check = ((packet[0] & 0x0c) == 0x04 &&
+               sanity_check = ((packet[0] & 0x08) == 0x00 &&
                                (packet[3] & 0x1c) == 0x10);
 
        if (!sanity_check)
@@ -1173,6 +1173,12 @@ static const struct dmi_system_id 
elantech_dmi_has_middle_button[] = {
        { }
 };
 
+static const char * const middle_button_pnp_ids[] = {
+       "LEN2131", /* ThinkPad P52 w/ NFC */
+       "LEN2132", /* ThinkPad P52 */
+       NULL
+};
+
 /*
  * Set the appropriate event bits for the input subsystem
  */
@@ -1192,7 +1198,8 @@ static int elantech_set_input_params(struct psmouse 
*psmouse)
        __clear_bit(EV_REL, dev->evbit);
 
        __set_bit(BTN_LEFT, dev->keybit);
-       if (dmi_check_system(elantech_dmi_has_middle_button))
+       if (dmi_check_system(elantech_dmi_has_middle_button) ||
+                       psmouse_matches_pnp_id(psmouse, middle_button_pnp_ids))
                __set_bit(BTN_MIDDLE, dev->keybit);
        __set_bit(BTN_RIGHT, dev->keybit);
 
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 0b678b5da4c4..0f0374a4ac6e 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1384,6 +1384,8 @@ static void schedule_external_copy(struct thin_c *tc, 
dm_block_t virt_block,
 
 static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
 
+static void requeue_bios(struct pool *pool);
+
 static void check_for_space(struct pool *pool)
 {
        int r;
@@ -1396,8 +1398,10 @@ static void check_for_space(struct pool *pool)
        if (r)
                return;
 
-       if (nr_free)
+       if (nr_free) {
                set_pool_mode(pool, PM_WRITE);
+               requeue_bios(pool);
+       }
 }
 
 /*
@@ -1474,7 +1478,10 @@ static int alloc_data_block(struct thin_c *tc, 
dm_block_t *result)
 
        r = dm_pool_alloc_data_block(pool->pmd, result);
        if (r) {
-               metadata_operation_failed(pool, "dm_pool_alloc_data_block", r);
+               if (r == -ENOSPC)
+                       set_pool_mode(pool, PM_OUT_OF_DATA_SPACE);
+               else
+                       metadata_operation_failed(pool, 
"dm_pool_alloc_data_block", r);
                return r;
        }
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index cae8f3c12e32..3bb985679f34 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2694,7 +2694,8 @@ state_store(struct md_rdev *rdev, const char *buf, size_t 
len)
                        err = 0;
                }
        } else if (cmd_match(buf, "re-add")) {
-               if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1)) {
+               if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
+                       rdev->saved_raid_disk >= 0) {
                        /* clear_bit is performed _after_ all the devices
                         * have their local Faulty bit cleared. If any writes
                         * happen in the meantime in the local node, they
@@ -8272,6 +8273,7 @@ static int remove_and_add_spares(struct mddev *mddev,
                        if (mddev->pers->hot_remove_disk(
                                    mddev, rdev) == 0) {
                                sysfs_unlink_rdev(mddev, rdev);
+                               rdev->saved_raid_disk = rdev->raid_disk;
                                rdev->raid_disk = -1;
                                removed++;
                        }
diff --git a/drivers/media/dvb-core/dvb_frontend.c 
b/drivers/media/dvb-core/dvb_frontend.c
index 01511e5a5566..2f054db8807b 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -251,8 +251,20 @@ static void dvb_frontend_add_event(struct dvb_frontend *fe,
        wake_up_interruptible (&events->wait_queue);
 }
 
+static int dvb_frontend_test_event(struct dvb_frontend_private *fepriv,
+                                  struct dvb_fe_events *events)
+{
+       int ret;
+
+       up(&fepriv->sem);
+       ret = events->eventw != events->eventr;
+       down(&fepriv->sem);
+
+       return ret;
+}
+
 static int dvb_frontend_get_event(struct dvb_frontend *fe,
-                           struct dvb_frontend_event *event, int flags)
+                                 struct dvb_frontend_event *event, int flags)
 {
        struct dvb_frontend_private *fepriv = fe->frontend_priv;
        struct dvb_fe_events *events = &fepriv->events;
@@ -270,13 +282,8 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe,
                if (flags & O_NONBLOCK)
                        return -EWOULDBLOCK;
 
-               up(&fepriv->sem);
-
-               ret = wait_event_interruptible (events->wait_queue,
-                                               events->eventw != 
events->eventr);
-
-               if (down_interruptible (&fepriv->sem))
-                       return -ERESTARTSYS;
+               ret = wait_event_interruptible(events->wait_queue,
+                                              dvb_frontend_test_event(fepriv, 
events));
 
                if (ret < 0)
                        return ret;
diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c 
b/drivers/media/usb/cx231xx/cx231xx-cards.c
index 921cf1edb3b1..69156affd0ae 100644
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -864,6 +864,9 @@ struct usb_device_id cx231xx_id_table[] = {
         .driver_info = CX231XX_BOARD_CNXT_RDE_250},
        {USB_DEVICE(0x0572, 0x58A0),
         .driver_info = CX231XX_BOARD_CNXT_RDU_250},
+       /* AverMedia DVD EZMaker 7 */
+       {USB_DEVICE(0x07ca, 0xc039),
+        .driver_info = CX231XX_BOARD_CNXT_VIDEO_GRABBER},
        {USB_DEVICE(0x2040, 0xb110),
         .driver_info = CX231XX_BOARD_HAUPPAUGE_USB2_FM_PAL},
        {USB_DEVICE(0x2040, 0xb111),
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c 
b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index a9fc64557c53..f1f697296ca0 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -864,7 +864,7 @@ static int put_v4l2_ext_controls32(struct file *file,
            get_user(kcontrols, &kp->controls))
                return -EFAULT;
 
-       if (!count)
+       if (!count || count > (U32_MAX/sizeof(*ucontrols)))
                return 0;
        if (get_user(p, &up->controls))
                return -EFAULT;
diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
index 70c646b0097d..19ac8bc8e7ea 100644
--- a/drivers/mfd/intel-lpss.c
+++ b/drivers/mfd/intel-lpss.c
@@ -275,11 +275,11 @@ static void intel_lpss_init_dev(const struct intel_lpss 
*lpss)
 
        intel_lpss_deassert_reset(lpss);
 
+       intel_lpss_set_remap_addr(lpss);
+
        if (!intel_lpss_has_idma(lpss))
                return;
 
-       intel_lpss_set_remap_addr(lpss);
-
        /* Make sure that SPI multiblock DMA transfers are re-enabled */
        if (lpss->type == LPSS_DEV_SPI)
                writel(value, lpss->priv + LPSS_PRIV_SSP_REG);
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c 
b/drivers/mtd/chips/cfi_cmdset_0002.c
index 107c05b3ddbb..33d025e42793 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -1876,7 +1876,7 @@ static int __xipram do_write_buffer(struct map_info *map, 
struct flchip *chip,
                if (time_after(jiffies, timeo) && !chip_ready(map, adr))
                        break;
 
-               if (chip_ready(map, adr)) {
+               if (chip_good(map, adr, datum)) {
                        xip_enable(map, chip, adr);
                        goto op_done;
                }
@@ -2531,7 +2531,7 @@ static int cfi_atmel_unlock(struct mtd_info *mtd, loff_t 
ofs, uint64_t len)
 
 struct ppb_lock {
        struct flchip *chip;
-       loff_t offset;
+       unsigned long adr;
        int locked;
 };
 
@@ -2549,8 +2549,9 @@ static int __maybe_unused do_ppb_xxlock(struct map_info 
*map,
        unsigned long timeo;
        int ret;
 
+       adr += chip->start;
        mutex_lock(&chip->mutex);
-       ret = get_chip(map, chip, adr + chip->start, FL_LOCKING);
+       ret = get_chip(map, chip, adr, FL_LOCKING);
        if (ret) {
                mutex_unlock(&chip->mutex);
                return ret;
@@ -2568,8 +2569,8 @@ static int __maybe_unused do_ppb_xxlock(struct map_info 
*map,
 
        if (thunk == DO_XXLOCK_ONEBLOCK_LOCK) {
                chip->state = FL_LOCKING;
-               map_write(map, CMD(0xA0), chip->start + adr);
-               map_write(map, CMD(0x00), chip->start + adr);
+               map_write(map, CMD(0xA0), adr);
+               map_write(map, CMD(0x00), adr);
        } else if (thunk == DO_XXLOCK_ONEBLOCK_UNLOCK) {
                /*
                 * Unlocking of one specific sector is not supported, so we
@@ -2607,7 +2608,7 @@ static int __maybe_unused do_ppb_xxlock(struct map_info 
*map,
        map_write(map, CMD(0x00), chip->start);
 
        chip->state = FL_READY;
-       put_chip(map, chip, adr + chip->start);
+       put_chip(map, chip, adr);
        mutex_unlock(&chip->mutex);
 
        return ret;
@@ -2664,9 +2665,9 @@ static int __maybe_unused cfi_ppb_unlock(struct mtd_info 
*mtd, loff_t ofs,
                 * sectors shall be unlocked, so lets keep their locking
                 * status at "unlocked" (locked=0) for the final re-locking.
                 */
-               if ((adr < ofs) || (adr >= (ofs + len))) {
+               if ((offset < ofs) || (offset >= (ofs + len))) {
                        sect[sectors].chip = &cfi->chips[chipnum];
-                       sect[sectors].offset = offset;
+                       sect[sectors].adr = adr;
                        sect[sectors].locked = do_ppb_xxlock(
                                map, &cfi->chips[chipnum], adr, 0,
                                DO_XXLOCK_ONEBLOCK_GETLOCK);
@@ -2680,6 +2681,8 @@ static int __maybe_unused cfi_ppb_unlock(struct mtd_info 
*mtd, loff_t ofs,
                        i++;
 
                if (adr >> cfi->chipshift) {
+                       if (offset >= (ofs + len))
+                               break;
                        adr = 0;
                        chipnum++;
 
@@ -2710,7 +2713,7 @@ static int __maybe_unused cfi_ppb_unlock(struct mtd_info 
*mtd, loff_t ofs,
         */
        for (i = 0; i < sectors; i++) {
                if (sect[i].locked)
-                       do_ppb_xxlock(map, sect[i].chip, sect[i].offset, 0,
+                       do_ppb_xxlock(map, sect[i].chip, sect[i].adr, 0,
                                      DO_XXLOCK_ONEBLOCK_LOCK);
        }
 
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 6cb5ca52cb5a..ad2b57c6b13f 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -1137,6 +1137,9 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
         */
        get_device(&ubi->dev);
 
+#ifdef CONFIG_MTD_UBI_FASTMAP
+       cancel_work_sync(&ubi->fm_work);
+#endif
        ubi_debugfs_exit_dev(ubi);
        uif_close(ubi);
 
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index 388e46be6ad9..d0884bd9d955 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -490,6 +490,82 @@ int ubi_eba_unmap_leb(struct ubi_device *ubi, struct 
ubi_volume *vol,
        return err;
 }
 
+#ifdef CONFIG_MTD_UBI_FASTMAP
+/**
+ * check_mapping - check and fixup a mapping
+ * @ubi: UBI device description object
+ * @vol: volume description object
+ * @lnum: logical eraseblock number
+ * @pnum: physical eraseblock number
+ *
+ * Checks whether a given mapping is valid. Fastmap cannot track LEB unmap
+ * operations, if such an operation is interrupted the mapping still looks
+ * good, but upon first read an ECC is reported to the upper layer.
+ * Normaly during the full-scan at attach time this is fixed, for Fastmap
+ * we have to deal with it while reading.
+ * If the PEB behind a LEB shows this symthom we change the mapping to
+ * %UBI_LEB_UNMAPPED and schedule the PEB for erasure.
+ *
+ * Returns 0 on success, negative error code in case of failure.
+ */
+static int check_mapping(struct ubi_device *ubi, struct ubi_volume *vol, int 
lnum,
+                        int *pnum)
+{
+       int err;
+       struct ubi_vid_io_buf *vidb;
+
+       if (!ubi->fast_attach)
+               return 0;
+
+       vidb = ubi_alloc_vid_buf(ubi, GFP_NOFS);
+       if (!vidb)
+               return -ENOMEM;
+
+       err = ubi_io_read_vid_hdr(ubi, *pnum, vidb, 0);
+       if (err > 0 && err != UBI_IO_BITFLIPS) {
+               int torture = 0;
+
+               switch (err) {
+                       case UBI_IO_FF:
+                       case UBI_IO_FF_BITFLIPS:
+                       case UBI_IO_BAD_HDR:
+                       case UBI_IO_BAD_HDR_EBADMSG:
+                               break;
+                       default:
+                               ubi_assert(0);
+               }
+
+               if (err == UBI_IO_BAD_HDR_EBADMSG || err == UBI_IO_FF_BITFLIPS)
+                       torture = 1;
+
+               down_read(&ubi->fm_eba_sem);
+               vol->eba_tbl->entries[lnum].pnum = UBI_LEB_UNMAPPED;
+               up_read(&ubi->fm_eba_sem);
+               ubi_wl_put_peb(ubi, vol->vol_id, lnum, *pnum, torture);
+
+               *pnum = UBI_LEB_UNMAPPED;
+       } else if (err < 0) {
+               ubi_err(ubi, "unable to read VID header back from PEB %i: %i",
+                       *pnum, err);
+
+               goto out_free;
+       }
+
+       err = 0;
+
+out_free:
+       ubi_free_vid_buf(vidb);
+
+       return err;
+}
+#else
+static int check_mapping(struct ubi_device *ubi, struct ubi_volume *vol, int 
lnum,
+                 int *pnum)
+{
+       return 0;
+}
+#endif
+
 /**
  * ubi_eba_read_leb - read data.
  * @ubi: UBI device description object
@@ -522,7 +598,13 @@ int ubi_eba_read_leb(struct ubi_device *ubi, struct 
ubi_volume *vol, int lnum,
                return err;
 
        pnum = vol->eba_tbl->entries[lnum].pnum;
-       if (pnum < 0) {
+       if (pnum >= 0) {
+               err = check_mapping(ubi, vol, lnum, &pnum);
+               if (err < 0)
+                       goto out_unlock;
+       }
+
+       if (pnum == UBI_LEB_UNMAPPED) {
                /*
                 * The logical eraseblock is not mapped, fill the whole buffer
                 * with 0xFF bytes. The exception is static volumes for which
@@ -930,6 +1012,12 @@ int ubi_eba_write_leb(struct ubi_device *ubi, struct 
ubi_volume *vol, int lnum,
                return err;
 
        pnum = vol->eba_tbl->entries[lnum].pnum;
+       if (pnum >= 0) {
+               err = check_mapping(ubi, vol, lnum, &pnum);
+               if (err < 0)
+                       goto out;
+       }
+
        if (pnum >= 0) {
                dbg_eba("write %d bytes at offset %d of LEB %d:%d, PEB %d",
                        len, offset, vol_id, lnum, pnum);
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 668b46202507..23a6986d512b 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -1505,6 +1505,7 @@ int ubi_thread(void *u)
        }
 
        dbg_wl("background thread \"%s\" is killed", ubi->bgt_name);
+       ubi->thread_enabled = 0;
        return 0;
 }
 
@@ -1514,9 +1515,6 @@ int ubi_thread(void *u)
  */
 static void shutdown_work(struct ubi_device *ubi)
 {
-#ifdef CONFIG_MTD_UBI_FASTMAP
-       flush_work(&ubi->fm_work);
-#endif
        while (!list_empty(&ubi->works)) {
                struct ubi_work *wrk;
 
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index feb61eaffe32..3086cae62fdc 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1124,7 +1124,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff 
*skb, __le32 sign)
         * accordingly. Otherwise, we should check here.
         */
        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
-               delayed_ndp_size = ctx->max_ndp_size;
+               delayed_ndp_size = ALIGN(ctx->max_ndp_size, 
ctx->tx_ndp_modulus);
        else
                delayed_ndp_size = 0;
 
@@ -1257,7 +1257,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff 
*skb, __le32 sign)
        /* If requested, put NDP at end of frame. */
        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
                nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;
-               cdc_ncm_align_tail(skb_out, ctx->tx_ndp_modulus, 0, 
ctx->tx_max);
+               cdc_ncm_align_tail(skb_out, ctx->tx_ndp_modulus, 0, ctx->tx_max 
- ctx->max_ndp_size);
                nth16->wNdpIndex = cpu_to_le16(skb_out->len);
                memcpy(skb_put(skb_out, ctx->max_ndp_size), ctx->delayed_ndp16, 
ctx->max_ndp_size);
 
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 8311a93cabd8..c1a65ce31243 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -505,14 +505,18 @@ int nvdimm_revalidate_disk(struct gendisk *disk)
 {
        struct device *dev = disk_to_dev(disk)->parent;
        struct nd_region *nd_region = to_nd_region(dev->parent);
-       const char *pol = nd_region->ro ? "only" : "write";
+       int disk_ro = get_disk_ro(disk);
 
-       if (nd_region->ro == get_disk_ro(disk))
+       /*
+        * Upgrade to read-only if the region is read-only preserve as
+        * read-only if the disk is already read-only.
+        */
+       if (disk_ro || nd_region->ro == disk_ro)
                return 0;
 
-       dev_info(dev, "%s read-%s, marking %s read-%s\n",
-                       dev_name(&nd_region->dev), pol, disk->disk_name, pol);
-       set_disk_ro(disk, nd_region->ro);
+       dev_info(dev, "%s read-only, marking %s read-only\n",
+                       dev_name(&nd_region->dev), disk->disk_name);
+       set_disk_ro(disk, 1);
 
        return 0;
 
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 53c83d66eb7e..90b5a898d6b1 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -155,20 +155,20 @@ static void __init of_unittest_dynamic(void)
        /* Add a new property - should pass*/
        prop->name = "new-property";
        prop->value = "new-property-data";
-       prop->length = strlen(prop->value);
+       prop->length = strlen(prop->value) + 1;
        unittest(of_add_property(np, prop) == 0, "Adding a new property 
failed\n");
 
        /* Try to add an existing property - should fail */
        prop++;
        prop->name = "new-property";
        prop->value = "new-property-data-should-fail";
-       prop->length = strlen(prop->value);
+       prop->length = strlen(prop->value) + 1;
        unittest(of_add_property(np, prop) != 0,
                 "Adding an existing property should have failed\n");
 
        /* Try to modify an existing property - should pass */
        prop->value = "modify-property-data-should-pass";
-       prop->length = strlen(prop->value);
+       prop->length = strlen(prop->value) + 1;
        unittest(of_update_property(np, prop) == 0,
                 "Updating an existing property should have passed\n");
 
@@ -176,7 +176,7 @@ static void __init of_unittest_dynamic(void)
        prop++;
        prop->name = "modify-property";
        prop->value = "modify-missing-property-data-should-pass";
-       prop->length = strlen(prop->value);
+       prop->length = strlen(prop->value) + 1;
        unittest(of_update_property(np, prop) == 0,
                 "Updating a missing property should have passed\n");
 
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index 37d70b5ad22f..2bba8481beb1 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -134,7 +134,7 @@ struct controller *pcie_init(struct pcie_device *dev);
 int pcie_init_notification(struct controller *ctrl);
 int pciehp_enable_slot(struct slot *p_slot);
 int pciehp_disable_slot(struct slot *p_slot);
-void pcie_enable_notification(struct controller *ctrl);
+void pcie_reenable_notification(struct controller *ctrl);
 int pciehp_power_on_slot(struct slot *slot);
 void pciehp_power_off_slot(struct slot *slot);
 void pciehp_get_power_status(struct slot *slot, u8 *status);
diff --git a/drivers/pci/hotplug/pciehp_core.c 
b/drivers/pci/hotplug/pciehp_core.c
index 7d32fa33dcef..6620b1095046 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -297,7 +297,7 @@ static int pciehp_resume(struct pcie_device *dev)
        ctrl = get_service_data(dev);
 
        /* reinitialize the chipset's event detection logic */
-       pcie_enable_notification(ctrl);
+       pcie_reenable_notification(ctrl);
 
        slot = ctrl->slot;
 
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index d08dfc8b9ba9..8d811ea353c8 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -673,7 +673,7 @@ static irqreturn_t pcie_isr(int irq, void *dev_id)
        return handled;
 }
 
-void pcie_enable_notification(struct controller *ctrl)
+static void pcie_enable_notification(struct controller *ctrl)
 {
        u16 cmd, mask;
 
@@ -711,6 +711,17 @@ void pcie_enable_notification(struct controller *ctrl)
                 pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, cmd);
 }
 
+void pcie_reenable_notification(struct controller *ctrl)
+{
+       /*
+        * Clear both Presence and Data Link Layer Changed to make sure
+        * those events still fire after we have re-enabled them.
+        */
+       pcie_capability_write_word(ctrl->pcie->port, PCI_EXP_SLTSTA,
+                                  PCI_EXP_SLTSTA_PDC | PCI_EXP_SLTSTA_DLLSC);
+       pcie_enable_notification(ctrl);
+}
+
 static void pcie_disable_notification(struct controller *ctrl)
 {
        u16 mask;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index b55f9179c94e..a05d143ac43b 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4225,11 +4225,29 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, 
u16 acs_flags)
  * 0xa290-0xa29f PCI Express Root port #{0-16}
  * 0xa2e7-0xa2ee PCI Express Root port #{17-24}
  *
+ * Mobile chipsets are also affected, 7th & 8th Generation
+ * Specification update confirms ACS errata 22, status no fix: (7th Generation
+ * Intel Processor Family I/O for U/Y Platforms and 8th Generation Intel
+ * Processor Family I/O for U Quad Core Platforms Specification Update,
+ * August 2017, Revision 002, Document#: 334660-002)[6]
+ * Device IDs from I/O datasheet: (7th Generation Intel Processor Family I/O
+ * for U/Y Platforms and 8th Generation Intel ® Processor Family I/O for U
+ * Quad Core Platforms, Vol 1 of 2, August 2017, Document#: 334658-003)[7]
+ *
+ * 0x9d10-0x9d1b PCI Express Root port #{1-12}
+ *
+ * The 300 series chipset suffers from the same bug so include those root
+ * ports here as well.
+ *
+ * 0xa32c-0xa343 PCI Express Root port #{0-24}
+ *
  * [1] 
http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html
  * [2] 
http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html
  * [3] 
http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html
  * [4] 
http://www.intel.com/content/www/us/en/chipsets/200-series-chipset-pch-spec-update.html
  * [5] 
http://www.intel.com/content/www/us/en/chipsets/200-series-chipset-pch-datasheet-vol-1.html
+ * [6] 
https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-mobile-u-y-processor-lines-i-o-spec-update.html
+ * [7] 
https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-mobile-u-y-processor-lines-i-o-datasheet-vol-1.html
  */
 static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev)
 {
@@ -4239,6 +4257,8 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct 
pci_dev *dev)
        switch (dev->device) {
        case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */
        case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */
+       case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */
+       case 0xa32c ... 0xa343:                         /* 300 series */
                return true;
        }
 
diff --git a/drivers/pwm/pwm-lpss-platform.c b/drivers/pwm/pwm-lpss-platform.c
index 54433fc6d1a4..e4eaefc2a2ef 100644
--- a/drivers/pwm/pwm-lpss-platform.c
+++ b/drivers/pwm/pwm-lpss-platform.c
@@ -52,6 +52,10 @@ static int pwm_lpss_remove_platform(struct platform_device 
*pdev)
        return pwm_lpss_remove(lpwm);
 }
 
+static SIMPLE_DEV_PM_OPS(pwm_lpss_platform_pm_ops,
+                        pwm_lpss_suspend,
+                        pwm_lpss_resume);
+
 static const struct acpi_device_id pwm_lpss_acpi_match[] = {
        { "80860F09", (unsigned long)&pwm_lpss_byt_info },
        { "80862288", (unsigned long)&pwm_lpss_bsw_info },
@@ -64,6 +68,7 @@ static struct platform_driver pwm_lpss_driver_platform = {
        .driver = {
                .name = "pwm-lpss",
                .acpi_match_table = pwm_lpss_acpi_match,
+               .pm = &pwm_lpss_platform_pm_ops,
        },
        .probe = pwm_lpss_probe_platform,
        .remove = pwm_lpss_remove_platform,
diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
index 72c0bce5a75c..5208b3f80ad8 100644
--- a/drivers/pwm/pwm-lpss.c
+++ b/drivers/pwm/pwm-lpss.c
@@ -31,10 +31,13 @@
 /* Size of each PWM register space if multiple */
 #define PWM_SIZE                       0x400
 
+#define MAX_PWMS                       4
+
 struct pwm_lpss_chip {
        struct pwm_chip chip;
        void __iomem *regs;
        const struct pwm_lpss_boardinfo *info;
+       u32 saved_ctrl[MAX_PWMS];
 };
 
 /* BayTrail */
@@ -168,6 +171,9 @@ struct pwm_lpss_chip *pwm_lpss_probe(struct device *dev, 
struct resource *r,
        unsigned long c;
        int ret;
 
+       if (WARN_ON(info->npwm > MAX_PWMS))
+               return ERR_PTR(-ENODEV);
+
        lpwm = devm_kzalloc(dev, sizeof(*lpwm), GFP_KERNEL);
        if (!lpwm)
                return ERR_PTR(-ENOMEM);
@@ -203,6 +209,30 @@ int pwm_lpss_remove(struct pwm_lpss_chip *lpwm)
 }
 EXPORT_SYMBOL_GPL(pwm_lpss_remove);
 
+int pwm_lpss_suspend(struct device *dev)
+{
+       struct pwm_lpss_chip *lpwm = dev_get_drvdata(dev);
+       int i;
+
+       for (i = 0; i < lpwm->info->npwm; i++)
+               lpwm->saved_ctrl[i] = readl(lpwm->regs + i * PWM_SIZE + PWM);
+
+       return 0;
+}
+EXPORT_SYMBOL_GPL(pwm_lpss_suspend);
+
+int pwm_lpss_resume(struct device *dev)
+{
+       struct pwm_lpss_chip *lpwm = dev_get_drvdata(dev);
+       int i;
+
+       for (i = 0; i < lpwm->info->npwm; i++)
+               writel(lpwm->saved_ctrl[i], lpwm->regs + i * PWM_SIZE + PWM);
+
+       return 0;
+}
+EXPORT_SYMBOL_GPL(pwm_lpss_resume);
+
 MODULE_DESCRIPTION("PWM driver for Intel LPSS");
 MODULE_AUTHOR("Mika Westerberg <[email protected]>");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/pwm/pwm-lpss.h b/drivers/pwm/pwm-lpss.h
index 04766e0d41aa..27d5081ec218 100644
--- a/drivers/pwm/pwm-lpss.h
+++ b/drivers/pwm/pwm-lpss.h
@@ -31,5 +31,7 @@ extern const struct pwm_lpss_boardinfo pwm_lpss_bxt_info;
 struct pwm_lpss_chip *pwm_lpss_probe(struct device *dev, struct resource *r,
                                     const struct pwm_lpss_boardinfo *info);
 int pwm_lpss_remove(struct pwm_lpss_chip *lpwm);
+int pwm_lpss_suspend(struct device *dev);
+int pwm_lpss_resume(struct device *dev);
 
 #endif /* __PWM_LPSS_H */
diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
index 1d4770c02e57..fd3d9419c468 100644
--- a/drivers/rpmsg/qcom_smd.c
+++ b/drivers/rpmsg/qcom_smd.c
@@ -1006,12 +1006,12 @@ static struct qcom_smd_channel 
*qcom_smd_create_channel(struct qcom_smd_edge *ed
        void *info;
        int ret;
 
-       channel = devm_kzalloc(&edge->dev, sizeof(*channel), GFP_KERNEL);
+       channel = kzalloc(sizeof(*channel), GFP_KERNEL);
        if (!channel)
                return ERR_PTR(-ENOMEM);
 
        channel->edge = edge;
-       channel->name = devm_kstrdup(&edge->dev, name, GFP_KERNEL);
+       channel->name = kstrdup(name, GFP_KERNEL);
        if (!channel->name)
                return ERR_PTR(-ENOMEM);
 
@@ -1061,8 +1061,8 @@ static struct qcom_smd_channel 
*qcom_smd_create_channel(struct qcom_smd_edge *ed
        return channel;
 
 free_name_and_channel:
-       devm_kfree(&edge->dev, channel->name);
-       devm_kfree(&edge->dev, channel);
+       kfree(channel->name);
+       kfree(channel);
 
        return ERR_PTR(ret);
 }
@@ -1279,13 +1279,13 @@ static int qcom_smd_parse_edge(struct device *dev,
  */
 static void qcom_smd_edge_release(struct device *dev)
 {
-       struct qcom_smd_channel *channel;
+       struct qcom_smd_channel *channel, *tmp;
        struct qcom_smd_edge *edge = to_smd_edge(dev);
 
-       list_for_each_entry(channel, &edge->channels, list) {
-               SET_RX_CHANNEL_INFO(channel, state, SMD_CHANNEL_CLOSED);
-               SET_RX_CHANNEL_INFO(channel, head, 0);
-               SET_RX_CHANNEL_INFO(channel, tail, 0);
+       list_for_each_entry_safe(channel, tmp, &edge->channels, list) {
+               list_del(&channel->list);
+               kfree(channel->name);
+               kfree(channel);
        }
 
        kfree(edge);
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index 4534a7ce77b8..b6caad0fee24 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -625,6 +625,46 @@ void zfcp_dbf_scsi(char *tag, int level, struct scsi_cmnd 
*sc,
        spin_unlock_irqrestore(&dbf->scsi_lock, flags);
 }
 
+/**
+ * zfcp_dbf_scsi_eh() - Trace event for special cases of scsi_eh callbacks.
+ * @tag: Identifier for event.
+ * @adapter: Pointer to zfcp adapter as context for this event.
+ * @scsi_id: SCSI ID/target to indicate scope of task management function 
(TMF).
+ * @ret: Return value of calling function.
+ *
+ * This SCSI trace variant does not depend on any of:
+ * scsi_cmnd, zfcp_fsf_req, scsi_device.
+ */
+void zfcp_dbf_scsi_eh(char *tag, struct zfcp_adapter *adapter,
+                     unsigned int scsi_id, int ret)
+{
+       struct zfcp_dbf *dbf = adapter->dbf;
+       struct zfcp_dbf_scsi *rec = &dbf->scsi_buf;
+       unsigned long flags;
+       static int const level = 1;
+
+       if (unlikely(!debug_level_enabled(adapter->dbf->scsi, level)))
+               return;
+
+       spin_lock_irqsave(&dbf->scsi_lock, flags);
+       memset(rec, 0, sizeof(*rec));
+
+       memcpy(rec->tag, tag, ZFCP_DBF_TAG_LEN);
+       rec->id = ZFCP_DBF_SCSI_CMND;
+       rec->scsi_result = ret; /* re-use field, int is 4 bytes and fits */
+       rec->scsi_retries = ~0;
+       rec->scsi_allowed = ~0;
+       rec->fcp_rsp_info = ~0;
+       rec->scsi_id = scsi_id;
+       rec->scsi_lun = (u32)ZFCP_DBF_INVALID_LUN;
+       rec->scsi_lun_64_hi = (u32)(ZFCP_DBF_INVALID_LUN >> 32);
+       rec->host_scribble = ~0;
+       memset(rec->scsi_opcode, 0xff, ZFCP_DBF_SCSI_OPCODE);
+
+       debug_event(dbf->scsi, level, rec, sizeof(*rec));
+       spin_unlock_irqrestore(&dbf->scsi_lock, flags);
+}
+
 static debug_info_t *zfcp_dbf_reg(const char *name, int size, int rec_size)
 {
        struct debug_info *d;
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 3b23d6754598..2abcd331b05d 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -34,11 +34,28 @@ enum zfcp_erp_steps {
        ZFCP_ERP_STEP_LUN_OPENING       = 0x2000,
 };
 
+/**
+ * enum zfcp_erp_act_type - Type of ERP action object.
+ * @ZFCP_ERP_ACTION_REOPEN_LUN: LUN recovery.
+ * @ZFCP_ERP_ACTION_REOPEN_PORT: Port recovery.
+ * @ZFCP_ERP_ACTION_REOPEN_PORT_FORCED: Forced port recovery.
+ * @ZFCP_ERP_ACTION_REOPEN_ADAPTER: Adapter recovery.
+ * @ZFCP_ERP_ACTION_NONE: Eyecatcher pseudo flag to bitwise or-combine with
+ *                       either of the first four enum values.
+ *                       Used to indicate that an ERP action could not be
+ *                       set up despite a detected need for some recovery.
+ * @ZFCP_ERP_ACTION_FAILED: Eyecatcher pseudo flag to bitwise or-combine with
+ *                         either of the first four enum values.
+ *                         Used to indicate that ERP not needed because
+ *                         the object has ZFCP_STATUS_COMMON_ERP_FAILED.
+ */
 enum zfcp_erp_act_type {
        ZFCP_ERP_ACTION_REOPEN_LUN         = 1,
        ZFCP_ERP_ACTION_REOPEN_PORT        = 2,
        ZFCP_ERP_ACTION_REOPEN_PORT_FORCED = 3,
        ZFCP_ERP_ACTION_REOPEN_ADAPTER     = 4,
+       ZFCP_ERP_ACTION_NONE               = 0xc0,
+       ZFCP_ERP_ACTION_FAILED             = 0xe0,
 };
 
 enum zfcp_erp_act_state {
@@ -125,6 +142,49 @@ static void zfcp_erp_action_dismiss_adapter(struct 
zfcp_adapter *adapter)
        }
 }
 
+static int zfcp_erp_handle_failed(int want, struct zfcp_adapter *adapter,
+                                 struct zfcp_port *port,
+                                 struct scsi_device *sdev)
+{
+       int need = want;
+       struct zfcp_scsi_dev *zsdev;
+
+       switch (want) {
+       case ZFCP_ERP_ACTION_REOPEN_LUN:
+               zsdev = sdev_to_zfcp(sdev);
+               if (atomic_read(&zsdev->status) & ZFCP_STATUS_COMMON_ERP_FAILED)
+                       need = 0;
+               break;
+       case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
+               if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_FAILED)
+                       need = 0;
+               break;
+       case ZFCP_ERP_ACTION_REOPEN_PORT:
+               if (atomic_read(&port->status) &
+                   ZFCP_STATUS_COMMON_ERP_FAILED) {
+                       need = 0;
+                       /* ensure propagation of failed status to new devices */
+                       zfcp_erp_set_port_status(
+                               port, ZFCP_STATUS_COMMON_ERP_FAILED);
+               }
+               break;
+       case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
+               if (atomic_read(&adapter->status) &
+                   ZFCP_STATUS_COMMON_ERP_FAILED) {
+                       need = 0;
+                       /* ensure propagation of failed status to new devices */
+                       zfcp_erp_set_adapter_status(
+                               adapter, ZFCP_STATUS_COMMON_ERP_FAILED);
+               }
+               break;
+       default:
+               need = 0;
+               break;
+       }
+
+       return need;
+}
+
 static int zfcp_erp_required_act(int want, struct zfcp_adapter *adapter,
                                 struct zfcp_port *port,
                                 struct scsi_device *sdev)
@@ -248,16 +308,27 @@ static int zfcp_erp_action_enqueue(int want, struct 
zfcp_adapter *adapter,
        int retval = 1, need;
        struct zfcp_erp_action *act;
 
-       if (!adapter->erp_thread)
-               return -EIO;
+       need = zfcp_erp_handle_failed(want, adapter, port, sdev);
+       if (!need) {
+               need = ZFCP_ERP_ACTION_FAILED; /* marker for trace */
+               goto out;
+       }
+
+       if (!adapter->erp_thread) {
+               need = ZFCP_ERP_ACTION_NONE; /* marker for trace */
+               retval = -EIO;
+               goto out;
+       }
 
        need = zfcp_erp_required_act(want, adapter, port, sdev);
        if (!need)
                goto out;
 
        act = zfcp_erp_setup_act(need, act_status, adapter, port, sdev);
-       if (!act)
+       if (!act) {
+               need |= ZFCP_ERP_ACTION_NONE; /* marker for trace */
                goto out;
+       }
        atomic_or(ZFCP_STATUS_ADAPTER_ERP_PENDING, &adapter->status);
        ++adapter->erp_total_count;
        list_add_tail(&act->list, &adapter->erp_ready_head);
@@ -268,18 +339,32 @@ static int zfcp_erp_action_enqueue(int want, struct 
zfcp_adapter *adapter,
        return retval;
 }
 
+void zfcp_erp_port_forced_no_port_dbf(char *id, struct zfcp_adapter *adapter,
+                                     u64 port_name, u32 port_id)
+{
+       unsigned long flags;
+       static /* don't waste stack */ struct zfcp_port tmpport;
+
+       write_lock_irqsave(&adapter->erp_lock, flags);
+       /* Stand-in zfcp port with fields just good enough for
+        * zfcp_dbf_rec_trig() and zfcp_dbf_set_common().
+        * Under lock because tmpport is static.
+        */
+       atomic_set(&tmpport.status, -1); /* unknown */
+       tmpport.wwpn = port_name;
+       tmpport.d_id = port_id;
+       zfcp_dbf_rec_trig(id, adapter, &tmpport, NULL,
+                         ZFCP_ERP_ACTION_REOPEN_PORT_FORCED,
+                         ZFCP_ERP_ACTION_NONE);
+       write_unlock_irqrestore(&adapter->erp_lock, flags);
+}
+
 static int _zfcp_erp_adapter_reopen(struct zfcp_adapter *adapter,
                                    int clear_mask, char *id)
 {
        zfcp_erp_adapter_block(adapter, clear_mask);
        zfcp_scsi_schedule_rports_block(adapter);
 
-       /* ensure propagation of failed status to new devices */
-       if (atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_ERP_FAILED) {
-               zfcp_erp_set_adapter_status(adapter,
-                                           ZFCP_STATUS_COMMON_ERP_FAILED);
-               return -EIO;
-       }
        return zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_ADAPTER,
                                       adapter, NULL, NULL, id, 0);
 }
@@ -298,12 +383,8 @@ void zfcp_erp_adapter_reopen(struct zfcp_adapter *adapter, 
int clear, char *id)
        zfcp_scsi_schedule_rports_block(adapter);
 
        write_lock_irqsave(&adapter->erp_lock, flags);
-       if (atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_ERP_FAILED)
-               zfcp_erp_set_adapter_status(adapter,
-                                           ZFCP_STATUS_COMMON_ERP_FAILED);
-       else
-               zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_ADAPTER, adapter,
-                                       NULL, NULL, id, 0);
+       zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_ADAPTER, adapter,
+                               NULL, NULL, id, 0);
        write_unlock_irqrestore(&adapter->erp_lock, flags);
 }
 
@@ -344,9 +425,6 @@ static void _zfcp_erp_port_forced_reopen(struct zfcp_port 
*port, int clear,
        zfcp_erp_port_block(port, clear);
        zfcp_scsi_schedule_rport_block(port);
 
-       if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_FAILED)
-               return;
-
        zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_PORT_FORCED,
                                port->adapter, port, NULL, id, 0);
 }
@@ -372,12 +450,6 @@ static int _zfcp_erp_port_reopen(struct zfcp_port *port, 
int clear, char *id)
        zfcp_erp_port_block(port, clear);
        zfcp_scsi_schedule_rport_block(port);
 
-       if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_FAILED) {
-               /* ensure propagation of failed status to new devices */
-               zfcp_erp_set_port_status(port, ZFCP_STATUS_COMMON_ERP_FAILED);
-               return -EIO;
-       }
-
        return zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_PORT,
                                       port->adapter, port, NULL, id, 0);
 }
@@ -417,9 +489,6 @@ static void _zfcp_erp_lun_reopen(struct scsi_device *sdev, 
int clear, char *id,
 
        zfcp_erp_lun_block(sdev, clear);
 
-       if (atomic_read(&zfcp_sdev->status) & ZFCP_STATUS_COMMON_ERP_FAILED)
-               return;
-
        zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_LUN, adapter,
                                zfcp_sdev->port, sdev, id, act_status);
 }
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index 7a7984a50683..b326f05c7f89 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -52,10 +52,15 @@ extern void zfcp_dbf_san_res(char *, struct zfcp_fsf_req *);
 extern void zfcp_dbf_san_in_els(char *, struct zfcp_fsf_req *);
 extern void zfcp_dbf_scsi(char *, int, struct scsi_cmnd *,
                          struct zfcp_fsf_req *);
+extern void zfcp_dbf_scsi_eh(char *tag, struct zfcp_adapter *adapter,
+                            unsigned int scsi_id, int ret);
 
 /* zfcp_erp.c */
 extern void zfcp_erp_set_adapter_status(struct zfcp_adapter *, u32);
 extern void zfcp_erp_clear_adapter_status(struct zfcp_adapter *, u32);
+extern void zfcp_erp_port_forced_no_port_dbf(char *id,
+                                            struct zfcp_adapter *adapter,
+                                            u64 port_name, u32 port_id);
 extern void zfcp_erp_adapter_reopen(struct zfcp_adapter *, int, char *);
 extern void zfcp_erp_adapter_shutdown(struct zfcp_adapter *, int, char *);
 extern void zfcp_erp_set_port_status(struct zfcp_port *, u32);
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index bb99db2948ab..3afb200b2829 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -180,6 +180,7 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd 
*scpnt)
                if (abrt_req)
                        break;
 
+               zfcp_dbf_scsi_abort("abrt_wt", scpnt, NULL);
                zfcp_erp_wait(adapter);
                ret = fc_block_scsi_eh(scpnt);
                if (ret) {
@@ -276,6 +277,7 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, 
u8 tm_flags)
                if (fsf_req)
                        break;
 
+               zfcp_dbf_scsi_devreset("wait", scpnt, tm_flags, NULL);
                zfcp_erp_wait(adapter);
                ret = fc_block_scsi_eh(scpnt);
                if (ret) {
@@ -322,15 +324,16 @@ static int zfcp_scsi_eh_host_reset_handler(struct 
scsi_cmnd *scpnt)
 {
        struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(scpnt->device);
        struct zfcp_adapter *adapter = zfcp_sdev->port->adapter;
-       int ret;
+       int ret = SUCCESS, fc_ret;
 
        zfcp_erp_adapter_reopen(adapter, 0, "schrh_1");
        zfcp_erp_wait(adapter);
-       ret = fc_block_scsi_eh(scpnt);
-       if (ret)
-               return ret;
+       fc_ret = fc_block_scsi_eh(scpnt);
+       if (fc_ret)
+               ret = fc_ret;
 
-       return SUCCESS;
+       zfcp_dbf_scsi_eh("schrh_r", adapter, ~0, ret);
+       return ret;
 }
 
 struct scsi_transport_template *zfcp_scsi_transport_template;
@@ -600,6 +603,11 @@ static void zfcp_scsi_terminate_rport_io(struct fc_rport 
*rport)
        if (port) {
                zfcp_erp_port_forced_reopen(port, 0, "sctrpi1");
                put_device(&port->dev);
+       } else {
+               zfcp_erp_port_forced_no_port_dbf(
+                       "sctrpin", adapter,
+                       rport->port_name /* zfcp_scsi_rport_register */,
+                       rport->port_id /* zfcp_scsi_rport_register */);
        }
 }
 
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 4441a559f139..34bbcfcae67c 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -3319,7 +3319,8 @@ qla2x00_iidma_fcport(scsi_qla_host_t *vha, fc_port_t 
*fcport)
                return;
 
        if (fcport->fp_speed == PORT_SPEED_UNKNOWN ||
-           fcport->fp_speed > ha->link_data_rate)
+           fcport->fp_speed > ha->link_data_rate ||
+           !ha->flags.gpsc_supported)
                return;
 
        rval = qla2x00_set_idma_speed(vha, fcport->loop_id, fcport->fp_speed,
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index da46f0fba5da..6ff53b604ff6 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -2807,16 +2807,15 @@ static void serial_console_write(struct console *co, 
const char *s,
        unsigned long flags;
        int locked = 1;
 
-       local_irq_save(flags);
 #if defined(SUPPORT_SYSRQ)
        if (port->sysrq)
                locked = 0;
        else
 #endif
        if (oops_in_progress)
-               locked = spin_trylock(&port->lock);
+               locked = spin_trylock_irqsave(&port->lock, flags);
        else
-               spin_lock(&port->lock);
+               spin_lock_irqsave(&port->lock, flags);
 
        /* first save SCSCR then disable interrupts, keep clock source */
        ctrl = serial_port_in(port, SCSCR);
@@ -2835,8 +2834,7 @@ static void serial_console_write(struct console *co, 
const char *s,
        serial_port_out(port, SCSCR, ctrl);
 
        if (locked)
-               spin_unlock(&port->lock);
-       local_irq_restore(flags);
+               spin_unlock_irqrestore(&port->lock, flags);
 }
 
 static int serial_console_setup(struct console *co, char *options)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index d8d992b73e88..8bf0090218dd 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4509,7 +4509,9 @@ hub_port_init(struct usb_hub *hub, struct usb_device 
*udev, int port1,
                                 * reset. But only on the first attempt,
                                 * lest we get into a time out/reset loop
                                 */
-                               if (r == 0  || (r == -ETIMEDOUT && retries == 
0))
+                               if (r == 0 || (r == -ETIMEDOUT &&
+                                               retries == 0 &&
+                                               udev->speed > USB_SPEED_FULL))
                                        break;
                        }
                        udev->descriptor.bMaxPacketSize0 =
diff --git a/drivers/video/backlight/as3711_bl.c 
b/drivers/video/backlight/as3711_bl.c
index 734a9158946b..e55304d5cf07 100644
--- a/drivers/video/backlight/as3711_bl.c
+++ b/drivers/video/backlight/as3711_bl.c
@@ -262,10 +262,10 @@ static int as3711_bl_register(struct platform_device 
*pdev,
 static int as3711_backlight_parse_dt(struct device *dev)
 {
        struct as3711_bl_pdata *pdata = dev_get_platdata(dev);
-       struct device_node *bl =
-               of_find_node_by_name(dev->parent->of_node, "backlight"), *fb;
+       struct device_node *bl, *fb;
        int ret;
 
+       bl = of_get_child_by_name(dev->parent->of_node, "backlight");
        if (!bl) {
                dev_dbg(dev, "backlight node not found\n");
                return -ENODEV;
@@ -279,7 +279,7 @@ static int as3711_backlight_parse_dt(struct device *dev)
                if (pdata->su1_max_uA <= 0)
                        ret = -EINVAL;
                if (ret < 0)
-                       return ret;
+                       goto err_put_bl;
        }
 
        fb = of_parse_phandle(bl, "su2-dev", 0);
@@ -292,7 +292,7 @@ static int as3711_backlight_parse_dt(struct device *dev)
                if (pdata->su2_max_uA <= 0)
                        ret = -EINVAL;
                if (ret < 0)
-                       return ret;
+                       goto err_put_bl;
 
                if (of_find_property(bl, "su2-feedback-voltage", NULL)) {
                        pdata->su2_feedback = AS3711_SU2_VOLTAGE;
@@ -314,8 +314,10 @@ static int as3711_backlight_parse_dt(struct device *dev)
                        pdata->su2_feedback = AS3711_SU2_CURR_AUTO;
                        count++;
                }
-               if (count != 1)
-                       return -EINVAL;
+               if (count != 1) {
+                       ret = -EINVAL;
+                       goto err_put_bl;
+               }
 
                count = 0;
                if (of_find_property(bl, "su2-fbprot-lx-sd4", NULL)) {
@@ -334,8 +336,10 @@ static int as3711_backlight_parse_dt(struct device *dev)
                        pdata->su2_fbprot = AS3711_SU2_GPIO4;
                        count++;
                }
-               if (count != 1)
-                       return -EINVAL;
+               if (count != 1) {
+                       ret = -EINVAL;
+                       goto err_put_bl;
+               }
 
                count = 0;
                if (of_find_property(bl, "su2-auto-curr1", NULL)) {
@@ -355,11 +359,20 @@ static int as3711_backlight_parse_dt(struct device *dev)
                 * At least one su2-auto-curr* must be specified iff
                 * AS3711_SU2_CURR_AUTO is used
                 */
-               if (!count ^ (pdata->su2_feedback != AS3711_SU2_CURR_AUTO))
-                       return -EINVAL;
+               if (!count ^ (pdata->su2_feedback != AS3711_SU2_CURR_AUTO)) {
+                       ret = -EINVAL;
+                       goto err_put_bl;
+               }
        }
 
+       of_node_put(bl);
+
        return 0;
+
+err_put_bl:
+       of_node_put(bl);
+
+       return ret;
 }
 
 static int as3711_backlight_probe(struct platform_device *pdev)
diff --git a/drivers/video/backlight/max8925_bl.c 
b/drivers/video/backlight/max8925_bl.c
index 7b738d60ecc2..f3aa6088f1d9 100644
--- a/drivers/video/backlight/max8925_bl.c
+++ b/drivers/video/backlight/max8925_bl.c
@@ -116,7 +116,7 @@ static void max8925_backlight_dt_init(struct 
platform_device *pdev)
        if (!pdata)
                return;
 
-       np = of_find_node_by_name(nproot, "backlight");
+       np = of_get_child_by_name(nproot, "backlight");
        if (!np) {
                dev_err(&pdev->dev, "failed to find backlight node\n");
                return;
@@ -125,6 +125,8 @@ static void max8925_backlight_dt_init(struct 
platform_device *pdev)
        if (!of_property_read_u32(np, "maxim,max8925-dual-string", &val))
                pdata->dual_string = val;
 
+       of_node_put(np);
+
        pdev->dev.platform_data = pdata;
 }
 
diff --git a/drivers/video/backlight/tps65217_bl.c 
b/drivers/video/backlight/tps65217_bl.c
index fd524ad860a5..f45d0c9467db 100644
--- a/drivers/video/backlight/tps65217_bl.c
+++ b/drivers/video/backlight/tps65217_bl.c
@@ -184,11 +184,11 @@ static struct tps65217_bl_pdata *
 tps65217_bl_parse_dt(struct platform_device *pdev)
 {
        struct tps65217 *tps = dev_get_drvdata(pdev->dev.parent);
-       struct device_node *node = of_node_get(tps->dev->of_node);
+       struct device_node *node;
        struct tps65217_bl_pdata *pdata, *err;
        u32 val;
 
-       node = of_find_node_by_name(node, "backlight");
+       node = of_get_child_by_name(tps->dev->of_node, "backlight");
        if (!node)
                return ERR_PTR(-ENODEV);
 
diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
index 98af9e02959b..9fe0d0bcdf62 100644
--- a/drivers/video/fbdev/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
@@ -1059,7 +1059,8 @@ static int uvesafb_setcmap(struct fb_cmap *cmap, struct 
fb_info *info)
                    info->cmap.len || cmap->start < info->cmap.start)
                        return -EINVAL;
 
-               entries = kmalloc(sizeof(*entries) * cmap->len, GFP_KERNEL);
+               entries = kmalloc_array(cmap->len, sizeof(*entries),
+                                       GFP_KERNEL);
                if (!entries)
                        return -ENOMEM;
 
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index ab0931e7a9bb..aa458f2fced1 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -741,7 +741,7 @@ int w1_attach_slave_device(struct w1_master *dev, struct 
w1_reg_num *rn)
 
        /* slave modules need to be loaded in a context with unlocked mutex */
        mutex_unlock(&dev->mutex);
-       request_module("w1-family-0x%02x", rn->family);
+       request_module("w1-family-0x%02X", rn->family);
        mutex_lock(&dev->mutex);
 
        spin_lock(&w1_flock);
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 6d3b32ccc2c4..1435d8c58ea0 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -637,8 +637,6 @@ static void __unbind_from_irq(unsigned int irq)
                xen_irq_info_cleanup(info);
        }
 
-       BUG_ON(info_for_irq(irq)->type == IRQT_UNBOUND);
-
        xen_free_irq(irq);
 }
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index f073de65e818..bd036557c6bc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1230,6 +1230,8 @@ static noinline int csum_exist_in_range(struct btrfs_root 
*root,
                list_del(&sums->list);
                kfree(sums);
        }
+       if (ret < 0)
+               return ret;
        return 1;
 }
 
@@ -1381,10 +1383,23 @@ static noinline int run_delalloc_nocow(struct inode 
*inode,
                                goto out_check;
                        if (btrfs_extent_readonly(root, disk_bytenr))
                                goto out_check;
-                       if (btrfs_cross_ref_exist(trans, root, ino,
+                       ret = btrfs_cross_ref_exist(trans, root, ino,
                                                  found_key.offset -
-                                                 extent_offset, disk_bytenr))
+                                                 extent_offset, disk_bytenr);
+                       if (ret) {
+                               /*
+                                * ret could be -EIO if the above fails to read
+                                * metadata.
+                                */
+                               if (ret < 0) {
+                                       if (cow_start != (u64)-1)
+                                               cur_offset = cow_start;
+                                       goto error;
+                               }
+
+                               WARN_ON_ONCE(nolock);
                                goto out_check;
+                       }
                        disk_bytenr += extent_offset;
                        disk_bytenr += cur_offset - found_key.offset;
                        num_bytes = min(end + 1, extent_end) - cur_offset;
@@ -1402,8 +1417,20 @@ static noinline int run_delalloc_nocow(struct inode 
*inode,
                         * this ensure that csum for a given extent are
                         * either valid or do not exist.
                         */
-                       if (csum_exist_in_range(root, disk_bytenr, num_bytes))
+                       ret = csum_exist_in_range(root, disk_bytenr, num_bytes);
+                       if (ret) {
+                               /*
+                                * ret could be -EIO if the above fails to read
+                                * metadata.
+                                */
+                               if (ret < 0) {
+                                       if (cow_start != (u64)-1)
+                                               cur_offset = cow_start;
+                                       goto error;
+                               }
+                               WARN_ON_ONCE(nolock);
                                goto out_check;
+                       }
                        if (!btrfs_inc_nocow_writers(root->fs_info,
                                                     disk_bytenr))
                                goto out_check;
@@ -9561,6 +9588,7 @@ static int btrfs_rename_exchange(struct inode *old_dir,
        u64 new_idx = 0;
        u64 root_objectid;
        int ret;
+       int ret2;
        bool root_log_pinned = false;
        bool dest_log_pinned = false;
 
@@ -9751,7 +9779,8 @@ static int btrfs_rename_exchange(struct inode *old_dir,
                        dest_log_pinned = false;
                }
        }
-       ret = btrfs_end_transaction(trans, root);
+       ret2 = btrfs_end_transaction(trans, root);
+       ret = ret ? ret : ret2;
 out_notrans:
        if (new_ino == BTRFS_FIRST_FREE_OBJECTID)
                up_read(&dest->fs_info->subvol_sem);
diff --git a/fs/fuse/control.c b/fs/fuse/control.c
index 6e22748b0704..e25c40c10f4f 100644
--- a/fs/fuse/control.c
+++ b/fs/fuse/control.c
@@ -211,10 +211,11 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry 
*parent,
        if (!dentry)
                return NULL;
 
-       fc->ctl_dentry[fc->ctl_ndents++] = dentry;
        inode = new_inode(fuse_control_sb);
-       if (!inode)
+       if (!inode) {
+               dput(dentry);
                return NULL;
+       }
 
        inode->i_ino = get_next_ino();
        inode->i_mode = mode;
@@ -228,6 +229,9 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry 
*parent,
        set_nlink(inode, nlink);
        inode->i_private = fc;
        d_add(dentry, inode);
+
+       fc->ctl_dentry[fc->ctl_ndents++] = dentry;
+
        return dentry;
 }
 
@@ -284,7 +288,10 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc)
        for (i = fc->ctl_ndents - 1; i >= 0; i--) {
                struct dentry *dentry = fc->ctl_dentry[i];
                d_inode(dentry)->i_private = NULL;
-               d_drop(dentry);
+               if (!i) {
+                       /* Get rid of submounts: */
+                       d_invalidate(dentry);
+               }
                dput(dentry);
        }
        drop_nlink(d_inode(fuse_control_sb->s_root));
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 4bbad745415a..cca8dd3bda09 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1633,8 +1633,19 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr 
*attr,
                return err;
 
        if (attr->ia_valid & ATTR_OPEN) {
-               if (fc->atomic_o_trunc)
+               /* This is coming from open(..., ... | O_TRUNC); */
+               WARN_ON(!(attr->ia_valid & ATTR_SIZE));
+               WARN_ON(attr->ia_size != 0);
+               if (fc->atomic_o_trunc) {
+                       /*
+                        * No need to send request to userspace, since actual
+                        * truncation has already been done by OPEN.  But still
+                        * need to truncate page cache.
+                        */
+                       i_size_write(inode, 0);
+                       truncate_pagecache(inode, 0);
                        return 0;
+               }
                file = NULL;
        }
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 6fe6a88ecb4a..f95e1d49b048 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -1184,6 +1184,7 @@ static int fuse_fill_super(struct super_block *sb, void 
*data, int silent)
  err_put_conn:
        fuse_bdi_destroy(fc);
        fuse_conn_put(fc);
+       sb->s_fs_info = NULL;
  err_fput:
        fput(file);
  err:
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index e9aa235e9d10..2e7ebd9d7168 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -402,11 +402,8 @@ validate_seqid(const struct nfs4_slot_table *tbl, const 
struct nfs4_slot *slot,
                return htonl(NFS4ERR_SEQ_FALSE_RETRY);
        }
 
-       /* Wraparound */
-       if (unlikely(slot->seq_nr == 0xFFFFFFFFU)) {
-               if (args->csa_sequenceid == 1)
-                       return htonl(NFS4_OK);
-       } else if (likely(args->csa_sequenceid == slot->seq_nr + 1))
+       /* Note: wraparound relies on seq_nr being of type u32 */
+       if (likely(args->csa_sequenceid == slot->seq_nr + 1))
                return htonl(NFS4_OK);
 
        /* Misordered request */
diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c
index f1160cdd4682..3d4602d66068 100644
--- a/fs/nfs/nfs4idmap.c
+++ b/fs/nfs/nfs4idmap.c
@@ -343,7 +343,7 @@ static ssize_t nfs_idmap_lookup_name(__u32 id, const char 
*type, char *buf,
        int id_len;
        ssize_t ret;
 
-       id_len = snprintf(id_str, sizeof(id_str), "%u", id);
+       id_len = nfs_map_numeric_to_string(id, id_str, sizeof(id_str));
        ret = nfs_idmap_get_key(id_str, id_len, type, buf, buflen, idmap);
        if (ret < 0)
                return -EINVAL;
@@ -626,7 +626,8 @@ static int nfs_idmap_read_and_verify_message(struct 
idmap_msg *im,
                if (strcmp(upcall->im_name, im->im_name) != 0)
                        break;
                /* Note: here we store the NUL terminator too */
-               len = sprintf(id_str, "%d", im->im_id) + 1;
+               len = 1 + nfs_map_numeric_to_string(im->im_id, id_str,
+                                                   sizeof(id_str));
                ret = nfs_idmap_instantiate(key, authkey, id_str, len);
                break;
        case IDMAP_CONV_IDTONAME:
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 2c4f7a22e128..bdbd9e6d1ace 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -3638,7 +3638,8 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, 
__be32 nfserr, struct nfsd4
                nfserr = nfserr_resource;
                goto err_no_verf;
        }
-       maxcount = min_t(u32, readdir->rd_maxcount, INT_MAX);
+       maxcount = svc_max_payload(resp->rqstp);
+       maxcount = min_t(u32, readdir->rd_maxcount, maxcount);
        /*
         * Note the rfc defines rd_maxcount as the size of the
         * READDIR4resok structure, which includes the verifier above
@@ -3652,7 +3653,7 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, 
__be32 nfserr, struct nfsd4
 
        /* RFC 3530 14.2.24 allows us to ignore dircount when it's 0: */
        if (!readdir->rd_dircount)
-               readdir->rd_dircount = INT_MAX;
+               readdir->rd_dircount = svc_max_payload(resp->rqstp);
 
        readdir->xdr = xdr;
        readdir->rd_maxcount = maxcount;
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index 7d764e3b6c79..504658fd0d08 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -1265,7 +1265,7 @@ static int recomp_data_node(const struct ubifs_info *c,
        int err, len, compr_type, out_len;
 
        out_len = le32_to_cpu(dn->size);
-       buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS);
+       buf = kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS);
        if (!buf)
                return -ENOMEM;
 
diff --git a/fs/udf/directory.c b/fs/udf/directory.c
index 988d5352bdb8..48ef184929ec 100644
--- a/fs/udf/directory.c
+++ b/fs/udf/directory.c
@@ -150,6 +150,9 @@ struct fileIdentDesc *udf_fileident_read(struct inode *dir, 
loff_t *nf_pos,
                               sizeof(struct fileIdentDesc));
                }
        }
+       /* Got last entry outside of dir size - fs is corrupted! */
+       if (*nf_pos > dir->i_size)
+               return NULL;
        return fi;
 }
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index f6a816129856..bd738aafd432 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -901,8 +901,8 @@ static inline unsigned int blk_max_size_offset(struct 
request_queue *q,
        if (!q->limits.chunk_sectors)
                return q->limits.max_sectors;
 
-       return q->limits.chunk_sectors -
-                       (offset & (q->limits.chunk_sectors - 1));
+       return min(q->limits.max_sectors, (unsigned 
int)(q->limits.chunk_sectors -
+                       (offset & (q->limits.chunk_sectors - 1))));
 }
 
 static inline unsigned int blk_rq_get_max_sectors(struct request *rq,
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 5ce911db7d88..4f3dfabb680f 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -113,7 +113,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int 
val, int expect);
 #define unlikely_notrace(x)    __builtin_expect(!!(x), 0)
 
 #define __branch_check__(x, expect) ({                                 \
-                       int ______r;                                    \
+                       long ______r;                                   \
                        static struct ftrace_branch_data                \
                                __attribute__((__aligned__(4)))         \
                                
__attribute__((section("_ftrace_annotated_branch"))) \
diff --git a/include/linux/iio/buffer.h b/include/linux/iio/buffer.h
index 70a5164f4728..821965c90070 100644
--- a/include/linux/iio/buffer.h
+++ b/include/linux/iio/buffer.h
@@ -61,7 +61,7 @@ struct iio_buffer_access_funcs {
        int (*request_update)(struct iio_buffer *buffer);
 
        int (*set_bytes_per_datum)(struct iio_buffer *buffer, size_t bpd);
-       int (*set_length)(struct iio_buffer *buffer, int length);
+       int (*set_length)(struct iio_buffer *buffer, unsigned int length);
 
        int (*enable)(struct iio_buffer *buffer, struct iio_dev *indio_dev);
        int (*disable)(struct iio_buffer *buffer, struct iio_dev *indio_dev);
@@ -96,8 +96,8 @@ struct iio_buffer_access_funcs {
  * @watermark:         [INTERN] number of datums to wait for poll/read.
  */
 struct iio_buffer {
-       int                                     length;
-       int                                     bytes_per_datum;
+       unsigned int                            length;
+       size_t                                  bytes_per_datum;
        struct attribute_group                  *scan_el_attrs;
        long                                    *scan_mask;
        bool                                    scan_timestamp;
diff --git a/kernel/printk/nmi.c b/kernel/printk/nmi.c
index 16bab471c7e2..5fa65aa904d3 100644
--- a/kernel/printk/nmi.c
+++ b/kernel/printk/nmi.c
@@ -63,6 +63,7 @@ static int vprintk_nmi(const char *fmt, va_list args)
        struct nmi_seq_buf *s = this_cpu_ptr(&nmi_print_seq);
        int add = 0;
        size_t len;
+       va_list ap;
 
 again:
        len = atomic_read(&s->len);
@@ -79,7 +80,9 @@ static int vprintk_nmi(const char *fmt, va_list args)
        if (!len)
                smp_rmb();
 
-       add = vsnprintf(s->buffer + len, sizeof(s->buffer) - len, fmt, args);
+       va_copy(ap, args);
+       add = vsnprintf(s->buffer + len, sizeof(s->buffer) - len, fmt, ap);
+       va_end(ap);
 
        /*
         * Do it once again if the buffer has been flushed in the meantime.
diff --git a/kernel/time/time.c b/kernel/time/time.c
index bd62fb8e8e77..39468651a064 100644
--- a/kernel/time/time.c
+++ b/kernel/time/time.c
@@ -28,6 +28,7 @@
  */
 
 #include <linux/export.h>
+#include <linux/kernel.h>
 #include <linux/timex.h>
 #include <linux/capability.h>
 #include <linux/timekeeper_internal.h>
@@ -258,9 +259,10 @@ unsigned int jiffies_to_msecs(const unsigned long j)
        return (j + (HZ / MSEC_PER_SEC) - 1)/(HZ / MSEC_PER_SEC);
 #else
 # if BITS_PER_LONG == 32
-       return (HZ_TO_MSEC_MUL32 * j) >> HZ_TO_MSEC_SHR32;
+       return (HZ_TO_MSEC_MUL32 * j + (1ULL << HZ_TO_MSEC_SHR32) - 1) >>
+              HZ_TO_MSEC_SHR32;
 # else
-       return (j * HZ_TO_MSEC_NUM) / HZ_TO_MSEC_DEN;
+       return DIV_ROUND_UP(j * HZ_TO_MSEC_NUM, HZ_TO_MSEC_DEN);
 # endif
 #endif
 }
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 0967771d8f7f..79ba3cc07026 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1391,9 +1391,6 @@ char *clock(char *buf, char *end, struct clk *clk, struct 
printf_spec spec,
                return string(buf, end, NULL, spec);
 
        switch (fmt[1]) {
-       case 'r':
-               return number(buf, end, clk_get_rate(clk), spec);
-
        case 'n':
        default:
 #ifdef CONFIG_COMMON_CLK
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 183436e4a8c1..f03a1430a3cb 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2448,6 +2448,7 @@ static const struct snd_pci_quirk alc262_fixup_tbl[] = {
        SND_PCI_QUIRK(0x10cf, 0x1397, "Fujitsu Lifebook S7110", 
ALC262_FIXUP_FSC_S7110),
        SND_PCI_QUIRK(0x10cf, 0x142d, "Fujitsu Lifebook E8410", 
ALC262_FIXUP_BENQ),
        SND_PCI_QUIRK(0x10f1, 0x2915, "Tyan Thunder n6650W", ALC262_FIXUP_TYAN),
+       SND_PCI_QUIRK(0x1734, 0x1141, "FSC ESPRIMO U9210", 
ALC262_FIXUP_FSC_H270),
        SND_PCI_QUIRK(0x1734, 0x1147, "FSC Celsius H270", 
ALC262_FIXUP_FSC_H270),
        SND_PCI_QUIRK(0x17aa, 0x384e, "Lenovo 3000", ALC262_FIXUP_LENOVO_3000),
        SND_PCI_QUIRK(0x17ff, 0x0560, "Benq ED8", ALC262_FIXUP_BENQ),
@@ -4473,7 +4474,6 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
        struct alc_spec *spec = codec->spec;
 
        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
-               spec->shutup = alc_no_shutup; /* reduce click noise */
                spec->reboot_notify = alc_d3_at_reboot; /* reduce noise */
                spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
                codec->power_save_node = 0; /* avoid click noises */
@@ -4835,6 +4835,13 @@ static void alc280_fixup_hp_9480m(struct hda_codec 
*codec,
 /* for hda_fixup_thinkpad_acpi() */
 #include "thinkpad_helper.c"
 
+static void alc_fixup_thinkpad_acpi(struct hda_codec *codec,
+                                   const struct hda_fixup *fix, int action)
+{
+       alc_fixup_no_shutup(codec, fix, action); /* reduce click noise */
+       hda_fixup_thinkpad_acpi(codec, fix, action);
+}
+
 /* for dell wmi mic mute led */
 #include "dell_wmi_helper.c"
 
@@ -5350,7 +5357,7 @@ static const struct hda_fixup alc269_fixups[] = {
        },
        [ALC269_FIXUP_THINKPAD_ACPI] = {
                .type = HDA_FIXUP_FUNC,
-               .v.func = hda_fixup_thinkpad_acpi,
+               .v.func = alc_fixup_thinkpad_acpi,
                .chained = true,
                .chain_id = ALC269_FIXUP_SKU_IGNORE,
        },
diff --git a/sound/soc/cirrus/edb93xx.c b/sound/soc/cirrus/edb93xx.c
index 85962657aabe..517963ef4847 100644
--- a/sound/soc/cirrus/edb93xx.c
+++ b/sound/soc/cirrus/edb93xx.c
@@ -67,7 +67,7 @@ static struct snd_soc_dai_link edb93xx_dai = {
        .cpu_dai_name   = "ep93xx-i2s",
        .codec_name     = "spi0.0",
        .codec_dai_name = "cs4271-hifi",
-       .dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_IF |
+       .dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
                          SND_SOC_DAIFMT_CBS_CFS,
        .ops            = &edb93xx_ops,
 };
diff --git a/sound/soc/cirrus/ep93xx-i2s.c b/sound/soc/cirrus/ep93xx-i2s.c
index 934f8aefdd90..0dc3852c4621 100644
--- a/sound/soc/cirrus/ep93xx-i2s.c
+++ b/sound/soc/cirrus/ep93xx-i2s.c
@@ -51,7 +51,9 @@
 #define EP93XX_I2S_WRDLEN_24           (1 << 0)
 #define EP93XX_I2S_WRDLEN_32           (2 << 0)
 
-#define EP93XX_I2S_LINCTRLDATA_R_JUST  (1 << 2) /* Right justify */
+#define EP93XX_I2S_RXLINCTRLDATA_R_JUST        BIT(1) /* Right justify */
+
+#define EP93XX_I2S_TXLINCTRLDATA_R_JUST        BIT(2) /* Right justify */
 
 #define EP93XX_I2S_CLKCFG_LRS          (1 << 0) /* lrclk polarity */
 #define EP93XX_I2S_CLKCFG_CKP          (1 << 1) /* Bit clock polarity */
@@ -170,25 +172,25 @@ static int ep93xx_i2s_set_dai_fmt(struct snd_soc_dai 
*cpu_dai,
                                  unsigned int fmt)
 {
        struct ep93xx_i2s_info *info = snd_soc_dai_get_drvdata(cpu_dai);
-       unsigned int clk_cfg, lin_ctrl;
+       unsigned int clk_cfg;
+       unsigned int txlin_ctrl = 0;
+       unsigned int rxlin_ctrl = 0;
 
        clk_cfg  = ep93xx_i2s_read_reg(info, EP93XX_I2S_RXCLKCFG);
-       lin_ctrl = ep93xx_i2s_read_reg(info, EP93XX_I2S_RXLINCTRLDATA);
 
        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
        case SND_SOC_DAIFMT_I2S:
                clk_cfg |= EP93XX_I2S_CLKCFG_REL;
-               lin_ctrl &= ~EP93XX_I2S_LINCTRLDATA_R_JUST;
                break;
 
        case SND_SOC_DAIFMT_LEFT_J:
                clk_cfg &= ~EP93XX_I2S_CLKCFG_REL;
-               lin_ctrl &= ~EP93XX_I2S_LINCTRLDATA_R_JUST;
                break;
 
        case SND_SOC_DAIFMT_RIGHT_J:
                clk_cfg &= ~EP93XX_I2S_CLKCFG_REL;
-               lin_ctrl |= EP93XX_I2S_LINCTRLDATA_R_JUST;
+               rxlin_ctrl |= EP93XX_I2S_RXLINCTRLDATA_R_JUST;
+               txlin_ctrl |= EP93XX_I2S_TXLINCTRLDATA_R_JUST;
                break;
 
        default:
@@ -213,32 +215,32 @@ static int ep93xx_i2s_set_dai_fmt(struct snd_soc_dai 
*cpu_dai,
        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
        case SND_SOC_DAIFMT_NB_NF:
                /* Negative bit clock, lrclk low on left word */
-               clk_cfg &= ~(EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_REL);
+               clk_cfg &= ~(EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_LRS);
                break;
 
        case SND_SOC_DAIFMT_NB_IF:
                /* Negative bit clock, lrclk low on right word */
                clk_cfg &= ~EP93XX_I2S_CLKCFG_CKP;
-               clk_cfg |= EP93XX_I2S_CLKCFG_REL;
+               clk_cfg |= EP93XX_I2S_CLKCFG_LRS;
                break;
 
        case SND_SOC_DAIFMT_IB_NF:
                /* Positive bit clock, lrclk low on left word */
                clk_cfg |= EP93XX_I2S_CLKCFG_CKP;
-               clk_cfg &= ~EP93XX_I2S_CLKCFG_REL;
+               clk_cfg &= ~EP93XX_I2S_CLKCFG_LRS;
                break;
 
        case SND_SOC_DAIFMT_IB_IF:
                /* Positive bit clock, lrclk low on right word */
-               clk_cfg |= EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_REL;
+               clk_cfg |= EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_LRS;
                break;
        }
 
        /* Write new register values */
        ep93xx_i2s_write_reg(info, EP93XX_I2S_RXCLKCFG, clk_cfg);
        ep93xx_i2s_write_reg(info, EP93XX_I2S_TXCLKCFG, clk_cfg);
-       ep93xx_i2s_write_reg(info, EP93XX_I2S_RXLINCTRLDATA, lin_ctrl);
-       ep93xx_i2s_write_reg(info, EP93XX_I2S_TXLINCTRLDATA, lin_ctrl);
+       ep93xx_i2s_write_reg(info, EP93XX_I2S_RXLINCTRLDATA, rxlin_ctrl);
+       ep93xx_i2s_write_reg(info, EP93XX_I2S_TXLINCTRLDATA, txlin_ctrl);
        return 0;
 }
 
diff --git a/sound/soc/cirrus/snappercl15.c b/sound/soc/cirrus/snappercl15.c
index 98089df08df6..c6737a573bc0 100644
--- a/sound/soc/cirrus/snappercl15.c
+++ b/sound/soc/cirrus/snappercl15.c
@@ -72,7 +72,7 @@ static struct snd_soc_dai_link snappercl15_dai = {
        .codec_dai_name = "tlv320aic23-hifi",
        .codec_name     = "tlv320aic23-codec.0-001a",
        .platform_name  = "ep93xx-i2s",
-       .dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_IF |
+       .dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
                          SND_SOC_DAIFMT_CBS_CFS,
        .ops            = &snappercl15_ops,
 };
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 6780eba55ec2..0b5d132bc3dd 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -425,6 +425,8 @@ static int dapm_kcontrol_data_alloc(struct 
snd_soc_dapm_widget *widget,
 static void dapm_kcontrol_free(struct snd_kcontrol *kctl)
 {
        struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl);
+
+       list_del(&data->paths);
        kfree(data->wlist);
        kfree(data);
 }
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index d2c6cdd9d42b..8bec05365aae 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -253,6 +253,8 @@ int __kmod_path__parse(struct kmod_path *m, const char 
*path,
                if ((strncmp(name, "[kernel.kallsyms]", 17) == 0) ||
                    (strncmp(name, "[guest.kernel.kallsyms", 22) == 0) ||
                    (strncmp(name, "[vdso]", 6) == 0) ||
+                   (strncmp(name, "[vdso32]", 8) == 0) ||
+                   (strncmp(name, "[vdsox32]", 9) == 0) ||
                    (strncmp(name, "[vsyscall]", 10) == 0)) {
                        m->kmod = false;
 
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c 
b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
index cac39532c057..d27715ff9a5f 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -112,6 +112,7 @@ struct intel_pt_decoder {
        bool have_cyc;
        bool fixup_last_mtc;
        bool have_last_ip;
+       enum intel_pt_param_flags flags;
        uint64_t pos;
        uint64_t last_ip;
        uint64_t ip;
@@ -215,6 +216,8 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct 
intel_pt_params *params)
        decoder->data               = params->data;
        decoder->return_compression = params->return_compression;
 
+       decoder->flags              = params->flags;
+
        decoder->period             = params->period;
        decoder->period_type        = params->period_type;
 
@@ -1012,6 +1015,15 @@ static int intel_pt_walk_insn(struct intel_pt_decoder 
*decoder,
        return err;
 }
 
+static inline bool intel_pt_fup_with_nlip(struct intel_pt_decoder *decoder,
+                                         struct intel_pt_insn *intel_pt_insn,
+                                         uint64_t ip, int err)
+{
+       return decoder->flags & INTEL_PT_FUP_WITH_NLIP && !err &&
+              intel_pt_insn->branch == INTEL_PT_BR_INDIRECT &&
+              ip == decoder->ip + intel_pt_insn->length;
+}
+
 static int intel_pt_walk_fup(struct intel_pt_decoder *decoder)
 {
        struct intel_pt_insn intel_pt_insn;
@@ -1024,7 +1036,8 @@ static int intel_pt_walk_fup(struct intel_pt_decoder 
*decoder)
                err = intel_pt_walk_insn(decoder, &intel_pt_insn, ip);
                if (err == INTEL_PT_RETURN)
                        return 0;
-               if (err == -EAGAIN) {
+               if (err == -EAGAIN ||
+                   intel_pt_fup_with_nlip(decoder, &intel_pt_insn, ip, err)) {
                        if (decoder->set_fup_tx_flags) {
                                decoder->set_fup_tx_flags = false;
                                decoder->tx_flags = decoder->fup_tx_flags;
@@ -1034,7 +1047,7 @@ static int intel_pt_walk_fup(struct intel_pt_decoder 
*decoder)
                                decoder->state.flags = decoder->fup_tx_flags;
                                return 0;
                        }
-                       return err;
+                       return -EAGAIN;
                }
                decoder->set_fup_tx_flags = false;
                if (err)
@@ -1298,7 +1311,6 @@ static int intel_pt_overflow(struct intel_pt_decoder 
*decoder)
 {
        intel_pt_log("ERROR: Buffer overflow\n");
        intel_pt_clear_tx_flags(decoder);
-       decoder->have_tma = false;
        decoder->cbr = 0;
        decoder->timestamp_insn_cnt = 0;
        decoder->pkt_state = INTEL_PT_STATE_ERR_RESYNC;
@@ -1517,7 +1529,6 @@ static int intel_pt_walk_fup_tip(struct intel_pt_decoder 
*decoder)
                case INTEL_PT_PSB:
                case INTEL_PT_TSC:
                case INTEL_PT_TMA:
-               case INTEL_PT_CBR:
                case INTEL_PT_MODE_TSX:
                case INTEL_PT_BAD:
                case INTEL_PT_PSBEND:
@@ -1526,6 +1537,10 @@ static int intel_pt_walk_fup_tip(struct intel_pt_decoder 
*decoder)
                        decoder->pkt_step = 0;
                        return -ENOENT;
 
+               case INTEL_PT_CBR:
+                       intel_pt_calc_cbr(decoder);
+                       break;
+
                case INTEL_PT_OVF:
                        return intel_pt_overflow(decoder);
 
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h 
b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
index 9ae4df1dcedc..2fe8f4c5aeb5 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
@@ -53,6 +53,14 @@ enum {
        INTEL_PT_ERR_MAX,
 };
 
+enum intel_pt_param_flags {
+       /*
+        * FUP packet can contain next linear instruction pointer instead of
+        * current linear instruction pointer.
+        */
+       INTEL_PT_FUP_WITH_NLIP  = 1 << 0,
+};
+
 struct intel_pt_state {
        enum intel_pt_sample_type type;
        int err;
@@ -92,6 +100,7 @@ struct intel_pt_params {
        unsigned int mtc_period;
        uint32_t tsc_ctc_ratio_n;
        uint32_t tsc_ctc_ratio_d;
+       enum intel_pt_param_flags flags;
 };
 
 struct intel_pt_decoder;
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c 
b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
index 7528ae4f7e28..e5c6caf913f3 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
@@ -281,7 +281,7 @@ static int intel_pt_get_cyc(unsigned int byte, const 
unsigned char *buf,
                if (len < offs)
                        return INTEL_PT_NEED_MORE_BYTES;
                byte = buf[offs++];
-               payload |= (byte >> 1) << shift;
+               payload |= ((uint64_t)byte >> 1) << shift;
        }
 
        packet->type = INTEL_PT_CYC;
diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index b1161d725ce9..d40ab4cf8932 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -752,6 +752,7 @@ static struct intel_pt_queue *intel_pt_alloc_queue(struct 
intel_pt *pt,
                                                   unsigned int queue_nr)
 {
        struct intel_pt_params params = { .get_trace = 0, };
+       struct perf_env *env = pt->machine->env;
        struct intel_pt_queue *ptq;
 
        ptq = zalloc(sizeof(struct intel_pt_queue));
@@ -832,6 +833,9 @@ static struct intel_pt_queue *intel_pt_alloc_queue(struct 
intel_pt *pt,
                }
        }
 
+       if (env->cpuid && !strncmp(env->cpuid, "GenuineIntel,6,92,", 18))
+               params.flags |= INTEL_PT_FUP_WITH_NLIP;
+
        ptq->decoder = intel_pt_decoder_new(&params);
        if (!ptq->decoder)
                goto out_free;
@@ -1344,6 +1348,7 @@ static int intel_pt_sample(struct intel_pt_queue *ptq)
 
        if (intel_pt_is_switch_ip(ptq, state->to_ip)) {
                switch (ptq->switch_state) {
+               case INTEL_PT_SS_NOT_TRACING:
                case INTEL_PT_SS_UNKNOWN:
                case INTEL_PT_SS_EXPECTING_SWITCH_IP:
                        err = intel_pt_next_tid(pt, ptq);

Reply via email to