223 files changed, 2480 insertions, 1774 deletions

diff --git a/.mailmap b/.mailmap
index ada8ad696b2e..d357e1bd2a43 100644
--- a/.mailmap
+++ b/.mailmap
@@ -51,6 +51,7 @@ Greg Kroah-Hartman <gregkh@suse.de>
 Greg Kroah-Hartman <greg@kroah.com>
 Henk Vergonet <Henk.Vergonet@gmail.com>
 Henrik Kretzschmar <henne@nachtwindheim.de>
+Henrik Rydberg <rydberg@bitmath.org>
 Herbert Xu <herbert@gondor.apana.org.au>
 Jacob Shin <Jacob.Shin@amd.com>
 James Bottomley <jejb@mulgrave.(none)>
diff --git a/MAINTAINERS b/MAINTAINERS
index ddb9ac8d32b3..3589d67437f8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -724,15 +724,15 @@ F:	include/uapi/linux/apm_bios.h
 F:      drivers/char/apm-emulation.c
 
 APPLE BCM5974 MULTITOUCH DRIVER
-M:      Henrik Rydberg <rydberg@euromail.se>
+M:      Henrik Rydberg <rydberg@bitmath.org>
 L:      linux-input@vger.kernel.org
-S:      Maintained
+S:      Odd fixes
 F:      drivers/input/mouse/bcm5974.c
 
 APPLE SMC DRIVER
-M:      Henrik Rydberg <rydberg@euromail.se>
+M:      Henrik Rydberg <rydberg@bitmath.org>
 L:      lm-sensors@lm-sensors.org
-S:      Maintained
+S:      Odd fixes
 F:      drivers/hwmon/applesmc.c
 
 APPLETALK NETWORK LAYER
@@ -2259,6 +2259,7 @@ F:	drivers/gpio/gpio-bt8xx.c
 BTRFS FILE SYSTEM
 M:      Chris Mason <clm@fb.com>
 M:      Josef Bacik <jbacik@fb.com>
+M:      David Sterba <dsterba@suse.cz>
 L:      linux-btrfs@vger.kernel.org
 W:      http://btrfs.wiki.kernel.org/
 Q:      http://patchwork.kernel.org/project/linux-btrfs/list/
@@ -4940,10 +4941,10 @@ F:	include/uapi/linux/input.h
 F:      include/linux/input/
 
 INPUT MULTITOUCH (MT) PROTOCOL
-M:      Henrik Rydberg <rydberg@euromail.se>
+M:      Henrik Rydberg <rydberg@bitmath.org>
 L:      linux-input@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rydberg/input-mt.git
-S:      Maintained
+S:      Odd fixes
 F:      Documentation/input/multi-touch-protocol.txt
 F:      drivers/input/input-mt.c
 K:      \b(ABS|SYN)_MT_
diff --git a/Makefile b/Makefile
index eb4eca56843a..e41a3356abee 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 19
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Diseased Newt
 
 # *DOCUMENTATION*
@@ -391,6 +391,7 @@ USERINCLUDE    := \
 # Needed to be compatible with the O= option
 LINUXINCLUDE    := \
                 -I$(srctree)/arch/$(hdr-arch)/include \
+                -Iarch/$(hdr-arch)/include/generated/uapi \
                 -Iarch/$(hdr-arch)/include/generated \
                 $(if $(KBUILD_SRC), -I$(srctree)/include) \
                 -Iinclude \
diff --git a/arch/arm/include/uapi/asm/unistd.h b/arch/arm/include/uapi/asm/unistd.h
index 705bb7620673..0c3f5a0dafd3 100644
--- a/arch/arm/include/uapi/asm/unistd.h
+++ b/arch/arm/include/uapi/asm/unistd.h
@@ -413,6 +413,7 @@
 #define __NR_getrandom                  (__NR_SYSCALL_BASE+384)
 #define __NR_memfd_create               (__NR_SYSCALL_BASE+385)
 #define __NR_bpf                        (__NR_SYSCALL_BASE+386)
+#define __NR_execveat                   (__NR_SYSCALL_BASE+387)
 
 /*
  * The following SWIs are ARM private.
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index e51833f8cc38..05745eb838c5 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -396,6 +396,7 @@
                 CALL(sys_getrandom)
 /* 385 */       CALL(sys_memfd_create)
                 CALL(sys_bpf)
+                CALL(sys_execveat)
 #ifndef syscalls_counted
 .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
 #define syscalls_counted
diff --git a/arch/arm/kernel/perf_regs.c b/arch/arm/kernel/perf_regs.c
index 6e4379c67cbc..592dda3f21ff 100644
--- a/arch/arm/kernel/perf_regs.c
+++ b/arch/arm/kernel/perf_regs.c
@@ -28,3 +28,11 @@ u64 perf_reg_abi(struct task_struct *task)
 {
         return PERF_SAMPLE_REGS_ABI_32;
 }
+
+void perf_get_regs_user(struct perf_regs *regs_user,
+                        struct pt_regs *regs,
+                        struct pt_regs *regs_user_copy)
+{
+        regs_user->regs = task_pt_regs(current);
+        regs_user->abi = perf_reg_abi(current);
+}
diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
index 59424937e52b..9fe8e241335c 100644
--- a/arch/arm/mm/dump.c
+++ b/arch/arm/mm/dump.c
@@ -220,9 +220,6 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level, u
         static const char units[] = "KMGTPE";
         u64 prot = val & pg_level[level].mask;
 
-        if (addr < USER_PGTABLES_CEILING)
-                return;
-
         if (!st->level) {
                 st->level = level;
                 st->current_prot = prot;
@@ -308,15 +305,13 @@ static void walk_pgd(struct seq_file *m)
         pgd_t *pgd = swapper_pg_dir;
         struct pg_state st;
         unsigned long addr;
-        unsigned i, pgdoff = USER_PGTABLES_CEILING / PGDIR_SIZE;
+        unsigned i;
 
         memset(&st, 0, sizeof(st));
         st.seq = m;
         st.marker = address_markers;
 
-        pgd += pgdoff;
-
-        for (i = pgdoff; i < PTRS_PER_PGD; i++, pgd++) {
+        for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
                 addr = i * PGDIR_SIZE;
                 if (!pgd_none(*pgd)) {
                         walk_pud(&st, pgd, addr);
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 98ad9c79ea0e..2495c8cb47ba 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -658,8 +658,8 @@ static struct section_perm ro_perms[] = {
                 .start  = (unsigned long)_stext,
                 .end    = (unsigned long)__init_begin,
 #ifdef CONFIG_ARM_LPAE
-                .mask   = ~PMD_SECT_RDONLY,
-                .prot   = PMD_SECT_RDONLY,
+                .mask   = ~L_PMD_SECT_RDONLY,
+                .prot   = L_PMD_SECT_RDONLY,
 #else
                 .mask   = ~(PMD_SECT_APX | PMD_SECT_AP_WRITE),
                 .prot   = PMD_SECT_APX | PMD_SECT_AP_WRITE,
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index cda7c40999b6..4e6ef896c619 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -1329,8 +1329,8 @@ static void __init kmap_init(void)
 static void __init map_lowmem(void)
 {
         struct memblock_region *reg;
-        unsigned long kernel_x_start = round_down(__pa(_stext), SECTION_SIZE);
-        unsigned long kernel_x_end = round_up(__pa(__init_end), SECTION_SIZE);
+        phys_addr_t kernel_x_start = round_down(__pa(_stext), SECTION_SIZE);
+        phys_addr_t kernel_x_end = round_up(__pa(__init_end), SECTION_SIZE);
 
         /* Map all the lowmem memory banks. */
         for_each_memblock(memory, reg) {
diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
index b1fa4e614718..fbe0ca31a99c 100644
--- a/arch/arm64/include/asm/arch_timer.h
+++ b/arch/arm64/include/asm/arch_timer.h
@@ -21,6 +21,7 @@
 
 #include <asm/barrier.h>
 
+#include <linux/bug.h>
 #include <linux/init.h>
 #include <linux/types.h>
 
diff --git a/arch/arm64/include/asm/cpu.h b/arch/arm64/include/asm/cpu.h
index ace70682499b..8e797b2fcc01 100644
--- a/arch/arm64/include/asm/cpu.h
+++ b/arch/arm64/include/asm/cpu.h
@@ -39,6 +39,7 @@ struct cpuinfo_arm64 {
         u64             reg_id_aa64pfr0;
         u64             reg_id_aa64pfr1;
 
+        u32             reg_id_dfr0;
         u32             reg_id_isar0;
         u32             reg_id_isar1;
         u32             reg_id_isar2;
@@ -51,6 +52,10 @@ struct cpuinfo_arm64 {
         u32             reg_id_mmfr3;
         u32             reg_id_pfr0;
         u32             reg_id_pfr1;
+
+        u32             reg_mvfr0;
+        u32             reg_mvfr1;
+        u32             reg_mvfr2;
 };
 
 DECLARE_PER_CPU(struct cpuinfo_arm64, cpu_data);
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index 286b1bec547c..f9be30ea1cbd 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -31,6 +31,7 @@
 
 #include <asm/fpsimd.h>
 #include <asm/hw_breakpoint.h>
+#include <asm/pgtable-hwdef.h>
 #include <asm/ptrace.h>
 #include <asm/types.h>
 
@@ -123,9 +124,6 @@ struct task_struct;
 /* Free all resources held by a thread. */
 extern void release_thread(struct task_struct *);
 
-/* Prepare to copy thread state - unlazy all lazy status */
-#define prepare_to_copy(tsk)    do { } while (0)
-
 unsigned long get_wchan(struct task_struct *p);
 
 #define cpu_relax()                     barrier()
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index 49c9aefd24a5..b780c6c76eec 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -44,7 +44,7 @@
 #define __ARM_NR_compat_cacheflush      (__ARM_NR_COMPAT_BASE+2)
 #define __ARM_NR_compat_set_tls         (__ARM_NR_COMPAT_BASE+5)
 
-#define __NR_compat_syscalls            386
+#define __NR_compat_syscalls            387
 #endif
 
 #define __ARCH_WANT_SYS_CLONE
diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
index 57b641747534..07d435cf2eea 100644
--- a/arch/arm64/kernel/cpuinfo.c
+++ b/arch/arm64/kernel/cpuinfo.c
@@ -147,6 +147,7 @@ static void cpuinfo_sanity_check(struct cpuinfo_arm64 *cur)
          * If we have AArch32, we care about 32-bit features for compat. These
          * registers should be RES0 otherwise.
          */
+        diff |= CHECK(id_dfr0, boot, cur, cpu);
         diff |= CHECK(id_isar0, boot, cur, cpu);
         diff |= CHECK(id_isar1, boot, cur, cpu);
         diff |= CHECK(id_isar2, boot, cur, cpu);
@@ -165,6 +166,10 @@ static void cpuinfo_sanity_check(struct cpuinfo_arm64 *cur)
         diff |= CHECK(id_pfr0, boot, cur, cpu);
         diff |= CHECK(id_pfr1, boot, cur, cpu);
 
+        diff |= CHECK(mvfr0, boot, cur, cpu);
+        diff |= CHECK(mvfr1, boot, cur, cpu);
+        diff |= CHECK(mvfr2, boot, cur, cpu);
+
         /*
          * Mismatched CPU features are a recipe for disaster. Don't even
          * pretend to support them.
@@ -189,6 +194,7 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info)
         info->reg_id_aa64pfr0 = read_cpuid(ID_AA64PFR0_EL1);
         info->reg_id_aa64pfr1 = read_cpuid(ID_AA64PFR1_EL1);
 
+        info->reg_id_dfr0 = read_cpuid(ID_DFR0_EL1);
         info->reg_id_isar0 = read_cpuid(ID_ISAR0_EL1);
         info->reg_id_isar1 = read_cpuid(ID_ISAR1_EL1);
         info->reg_id_isar2 = read_cpuid(ID_ISAR2_EL1);
@@ -202,6 +208,10 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info)
         info->reg_id_pfr0 = read_cpuid(ID_PFR0_EL1);
         info->reg_id_pfr1 = read_cpuid(ID_PFR1_EL1);
 
+        info->reg_mvfr0 = read_cpuid(MVFR0_EL1);
+        info->reg_mvfr1 = read_cpuid(MVFR1_EL1);
+        info->reg_mvfr2 = read_cpuid(MVFR2_EL1);
+
         cpuinfo_detect_icache_policy(info);
 
         check_local_cpu_errata();
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 6fac253bc783..2bb4347d0edf 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -326,6 +326,7 @@ void __init efi_idmap_init(void)
 
         /* boot time idmap_pg_dir is incomplete, so fill in missing parts */
         efi_setup_idmap();
+        early_memunmap(memmap.map, memmap.map_end - memmap.map);
 }
 
 static int __init remap_region(efi_memory_desc_t *md, void **new)
@@ -380,7 +381,6 @@ static int __init arm64_enter_virtual_mode(void)
         }
 
         mapsize = memmap.map_end - memmap.map;
-        early_memunmap(memmap.map, mapsize);
 
         if (efi_runtime_disabled()) {
                 pr_info("EFI runtime services will be disabled.\n");
diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
index fd027b101de5..9b6f71db2709 100644
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -25,6 +25,7 @@
 #include <linux/mm.h>
 #include <linux/moduleloader.h>
 #include <linux/vmalloc.h>
+#include <asm/alternative.h>
 #include <asm/insn.h>
 #include <asm/sections.h>
 
diff --git a/arch/arm64/kernel/perf_regs.c b/arch/arm64/kernel/perf_regs.c
index 6762ad705587..3f62b35fb6f1 100644
--- a/arch/arm64/kernel/perf_regs.c
+++ b/arch/arm64/kernel/perf_regs.c
@@ -50,3 +50,11 @@ u64 perf_reg_abi(struct task_struct *task)
         else
                 return PERF_SAMPLE_REGS_ABI_64;
 }
+
+void perf_get_regs_user(struct perf_regs *regs_user,
+                        struct pt_regs *regs,
+                        struct pt_regs *regs_user_copy)
+{
+        regs_user->regs = task_pt_regs(current);
+        regs_user->abi = perf_reg_abi(current);
+}
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index b80991166754..20fe2932ad0c 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -402,6 +402,7 @@ void __init setup_arch(char **cmdline_p)
         request_standard_resources();
 
         efi_idmap_init();
+        early_ioremap_reset();
 
         unflatten_device_tree();
 
diff --git a/arch/arm64/kernel/smp_spin_table.c b/arch/arm64/kernel/smp_spin_table.c
index 4f93c67e63de..14944e5b28da 100644
--- a/arch/arm64/kernel/smp_spin_table.c
+++ b/arch/arm64/kernel/smp_spin_table.c
@@ -25,6 +25,7 @@
 #include <asm/cacheflush.h>
 #include <asm/cpu_ops.h>
 #include <asm/cputype.h>
+#include <asm/io.h>
 #include <asm/smp_plat.h>
 
 extern void secondary_holding_pen(void);
diff --git a/arch/blackfin/mach-bf533/boards/stamp.c b/arch/blackfin/mach-bf533/boards/stamp.c
index 6f4bac969bf7..23eada79439c 100644
--- a/arch/blackfin/mach-bf533/boards/stamp.c
+++ b/arch/blackfin/mach-bf533/boards/stamp.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/device.h>
+#include <linux/delay.h>
 #include <linux/platform_device.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index 615ef81def49..e795cb848154 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -893,13 +893,13 @@ static int _acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
 }
 
 /* wrapper to silence section mismatch warning */
-int __ref acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
+int __ref acpi_map_cpu(acpi_handle handle, int physid, int *pcpu)
 {
         return _acpi_map_lsapic(handle, physid, pcpu);
 }
-EXPORT_SYMBOL(acpi_map_lsapic);
+EXPORT_SYMBOL(acpi_map_cpu);
 
-int acpi_unmap_lsapic(int cpu)
+int acpi_unmap_cpu(int cpu)
 {
         ia64_cpu_to_sapicid[cpu] = -1;
         set_cpu_present(cpu, false);
@@ -910,8 +910,7 @@ int acpi_unmap_lsapic(int cpu)
 
         return (0);
 }
-
-EXPORT_SYMBOL(acpi_unmap_lsapic);
+EXPORT_SYMBOL(acpi_unmap_cpu);
 #endif                          /* CONFIG_ACPI_HOTPLUG_CPU */
 
 #ifdef CONFIG_ACPI_NUMA
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index 5b016e2498f3..3db07f30636f 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -51,6 +51,7 @@ targets += cpustr.h
 $(obj)/cpustr.h: $(obj)/mkcpustr FORCE
         $(call if_changed,cpustr)
 endif
+clean-files += cpustr.h
 
 # ---------------------------------------------------------------------------
 
diff --git a/arch/x86/crypto/Makefile b/arch/x86/crypto/Makefile
index fd0f848938cc..5a4a089e8b1f 100644
--- a/arch/x86/crypto/Makefile
+++ b/arch/x86/crypto/Makefile
@@ -26,7 +26,6 @@ obj-$(CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL) += ghash-clmulni-intel.o
 
 obj-$(CONFIG_CRYPTO_CRC32C_INTEL) += crc32c-intel.o
 obj-$(CONFIG_CRYPTO_SHA1_SSSE3) += sha1-ssse3.o
-obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
 obj-$(CONFIG_CRYPTO_CRC32_PCLMUL) += crc32-pclmul.o
 obj-$(CONFIG_CRYPTO_SHA256_SSSE3) += sha256-ssse3.o
 obj-$(CONFIG_CRYPTO_SHA512_SSSE3) += sha512-ssse3.o
@@ -46,6 +45,7 @@ endif
 ifeq ($(avx2_supported),yes)
         obj-$(CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64) += camellia-aesni-avx2.o
         obj-$(CONFIG_CRYPTO_SERPENT_AVX2_X86_64) += serpent-avx2.o
+        obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
 endif
 
 aes-i586-y := aes-i586-asm_32.o aes_glue.o
diff --git a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
index 2df2a0298f5a..a916c4a61165 100644
--- a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
+++ b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
@@ -208,7 +208,7 @@ ddq_add_8:
 
         .if (klen == KEY_128)
                 .if (load_keys)
-                        vmovdqa 3*16(p_keys), xkeyA
+                        vmovdqa 3*16(p_keys), xkey4
                 .endif
         .else
                 vmovdqa 3*16(p_keys), xkeyA
@@ -224,7 +224,7 @@ ddq_add_8:
         add     $(16*by), p_in
 
         .if (klen == KEY_128)
-                vmovdqa 4*16(p_keys), xkey4
+                vmovdqa 4*16(p_keys), xkeyB
         .else
                 .if (load_keys)
                         vmovdqa 4*16(p_keys), xkey4
@@ -234,7 +234,12 @@ ddq_add_8:
         .set i, 0
         .rept by
                 club XDATA, i
-                vaesenc xkeyA, var_xdata, var_xdata             /* key 3 */
+                /* key 3 */
+                .if (klen == KEY_128)
+                        vaesenc xkey4, var_xdata, var_xdata
+                .else
+                        vaesenc xkeyA, var_xdata, var_xdata
+                .endif
                 .set i, (i +1)
         .endr
 
@@ -243,13 +248,18 @@ ddq_add_8:
         .set i, 0
         .rept by
                 club XDATA, i
-                vaesenc xkey4, var_xdata, var_xdata             /* key 4 */
+                /* key 4 */
+                .if (klen == KEY_128)
+                        vaesenc xkeyB, var_xdata, var_xdata
+                .else
+                        vaesenc xkey4, var_xdata, var_xdata
+                .endif
                 .set i, (i +1)
         .endr
 
         .if (klen == KEY_128)
                 .if (load_keys)
-                        vmovdqa 6*16(p_keys), xkeyB
+                        vmovdqa 6*16(p_keys), xkey8
                 .endif
         .else
                 vmovdqa 6*16(p_keys), xkeyB
@@ -267,12 +277,17 @@ ddq_add_8:
         .set i, 0
         .rept by
                 club XDATA, i
-                vaesenc xkeyB, var_xdata, var_xdata             /* key 6 */
+                /* key 6 */
+                .if (klen == KEY_128)
+                        vaesenc xkey8, var_xdata, var_xdata
+                .else
+                        vaesenc xkeyB, var_xdata, var_xdata
+                .endif
                 .set i, (i +1)
         .endr
 
         .if (klen == KEY_128)
-                vmovdqa 8*16(p_keys), xkey8
+                vmovdqa 8*16(p_keys), xkeyB
         .else
                 .if (load_keys)
                         vmovdqa 8*16(p_keys), xkey8
@@ -288,7 +303,7 @@ ddq_add_8:
 
         .if (klen == KEY_128)
                 .if (load_keys)
-                        vmovdqa 9*16(p_keys), xkeyA
+                        vmovdqa 9*16(p_keys), xkey12
                 .endif
         .else
                 vmovdqa 9*16(p_keys), xkeyA
@@ -297,7 +312,12 @@ ddq_add_8:
         .set i, 0
         .rept by
                 club XDATA, i
-                vaesenc xkey8, var_xdata, var_xdata             /* key 8 */
+                /* key 8 */
+                .if (klen == KEY_128)
+                        vaesenc xkeyB, var_xdata, var_xdata
+                .else
+                        vaesenc xkey8, var_xdata, var_xdata
+                .endif
                 .set i, (i +1)
         .endr
 
@@ -306,7 +326,12 @@ ddq_add_8:
         .set i, 0
         .rept by
                 club XDATA, i
-                vaesenc xkeyA, var_xdata, var_xdata             /* key 9 */
+                /* key 9 */
+                .if (klen == KEY_128)
+                        vaesenc xkey12, var_xdata, var_xdata
+                .else
+                        vaesenc xkeyA, var_xdata, var_xdata
+                .endif
                 .set i, (i +1)
         .endr
 
@@ -412,7 +437,6 @@ ddq_add_8:
 /* main body of aes ctr load */
 
 .macro do_aes_ctrmain key_len
-
         cmp     $16, num_bytes
         jb      .Ldo_return2\key_len
 
diff --git a/arch/x86/include/asm/vgtod.h b/arch/x86/include/asm/vgtod.h
index e7e9682a33e9..f556c4843aa1 100644
--- a/arch/x86/include/asm/vgtod.h
+++ b/arch/x86/include/asm/vgtod.h
@@ -80,9 +80,11 @@ static inline unsigned int __getcpu(void)
 
         /*
          * Load per CPU data from GDT.  LSL is faster than RDTSCP and
-         * works on all CPUs.
+         * works on all CPUs.  This is volatile so that it orders
+         * correctly wrt barrier() and to keep gcc from cleverly
+         * hoisting it out of the calling function.
          */
-        asm("lsl %1,%0" : "=r" (p) : "r" (__PER_CPU_SEG));
+        asm volatile ("lsl %1,%0" : "=r" (p) : "r" (__PER_CPU_SEG));
 
         return p;
 }
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 4433a4be8171..d1626364a28a 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -750,13 +750,13 @@ static int _acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
 }
 
 /* wrapper to silence section mismatch warning */
-int __ref acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
+int __ref acpi_map_cpu(acpi_handle handle, int physid, int *pcpu)
 {
         return _acpi_map_lsapic(handle, physid, pcpu);
 }
-EXPORT_SYMBOL(acpi_map_lsapic);
+EXPORT_SYMBOL(acpi_map_cpu);
 
-int acpi_unmap_lsapic(int cpu)
+int acpi_unmap_cpu(int cpu)
 {
 #ifdef CONFIG_ACPI_NUMA
         set_apicid_to_node(per_cpu(x86_cpu_to_apicid, cpu), NUMA_NO_NODE);
@@ -768,8 +768,7 @@ int acpi_unmap_lsapic(int cpu)
 
         return (0);
 }
-
-EXPORT_SYMBOL(acpi_unmap_lsapic);
+EXPORT_SYMBOL(acpi_unmap_cpu);
 #endif                          /* CONFIG_ACPI_HOTPLUG_CPU */
 
 int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base)
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index e27b49d7c922..80091ae54c2b 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -66,3 +66,4 @@ targets += capflags.c
 $(obj)/capflags.c: $(cpufeature) $(src)/mkcapflags.sh FORCE
         $(call if_changed,mkcapflags)
 endif
+clean-files += capflags.c
diff --git a/arch/x86/kernel/cpu/mkcapflags.sh b/arch/x86/kernel/cpu/mkcapflags.sh
index e2b22df964cd..36d99a337b49 100644
--- a/arch/x86/kernel/cpu/mkcapflags.sh
+++ b/arch/x86/kernel/cpu/mkcapflags.sh
@@ -28,7 +28,7 @@ function dump_array()
                 # If the /* comment */ starts with a quote string, grab that.
                 VALUE="$(echo "$i" | sed -n 's@.*/\* *\("[^"]*"\).*\*/@\1@p')"
                 [ -z "$VALUE" ] && VALUE="\"$NAME\""
-                [ "$VALUE" == '""' ] && continue
+                [ "$VALUE" = '""' ] && continue
 
                 # Name is uppercase, VALUE is all lowercase
                 VALUE="$(echo "$VALUE" | tr A-Z a-z)"
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.h b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
index 18eb78bbdd10..863d9b02563e 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.h
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
@@ -17,7 +17,7 @@
 #define UNCORE_PCI_DEV_TYPE(data)       ((data >> 8) & 0xff)
 #define UNCORE_PCI_DEV_IDX(data)        (data & 0xff)
 #define UNCORE_EXTRA_PCI_DEV            0xff
-#define UNCORE_EXTRA_PCI_DEV_MAX        2
+#define UNCORE_EXTRA_PCI_DEV_MAX        3
 
 /* support up to 8 sockets */
 #define UNCORE_SOCKET_MAX               8
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
index 745b158e9a65..21af6149edf2 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
@@ -891,6 +891,7 @@ void snbep_uncore_cpu_init(void)
 enum {
         SNBEP_PCI_QPI_PORT0_FILTER,
         SNBEP_PCI_QPI_PORT1_FILTER,
+        HSWEP_PCI_PCU_3,
 };
 
 static int snbep_qpi_hw_config(struct intel_uncore_box *box, struct perf_event *event)
@@ -2026,6 +2027,17 @@ void hswep_uncore_cpu_init(void)
 {
         if (hswep_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores)
                 hswep_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores;
+
+        /* Detect 6-8 core systems with only two SBOXes */
+        if (uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3]) {
+                u32 capid4;
+
+                pci_read_config_dword(uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3],
+                                      0x94, &capid4);
+                if (((capid4 >> 6) & 0x3) == 0)
+                        hswep_uncore_sbox.num_boxes = 2;
+        }
+
         uncore_msr_uncores = hswep_msr_uncores;
 }
 
@@ -2287,6 +2299,11 @@ static DEFINE_PCI_DEVICE_TABLE(hswep_uncore_pci_ids) = {
                 .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
                                                    SNBEP_PCI_QPI_PORT1_FILTER),
         },
+        { /* PCU.3 (for Capability registers) */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fc0),
+                .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+                                                   HSWEP_PCI_PCU_3),
+        },
         { /* end: all zeroes */ }
 };
 
diff --git a/arch/x86/kernel/perf_regs.c b/arch/x86/kernel/perf_regs.c
index e309cc5c276e..781861cc5ee8 100644
--- a/arch/x86/kernel/perf_regs.c
+++ b/arch/x86/kernel/perf_regs.c
@@ -78,6 +78,14 @@ u64 perf_reg_abi(struct task_struct *task)
 {
         return PERF_SAMPLE_REGS_ABI_32;
 }
+
+void perf_get_regs_user(struct perf_regs *regs_user,
+                        struct pt_regs *regs,
+                        struct pt_regs *regs_user_copy)
+{
+        regs_user->regs = task_pt_regs(current);
+        regs_user->abi = perf_reg_abi(current);
+}
 #else /* CONFIG_X86_64 */
 #define REG_NOSUPPORT ((1ULL << PERF_REG_X86_DS) | \
                        (1ULL << PERF_REG_X86_ES) | \
@@ -102,4 +110,86 @@ u64 perf_reg_abi(struct task_struct *task)
         else
                 return PERF_SAMPLE_REGS_ABI_64;
 }
+
+void perf_get_regs_user(struct perf_regs *regs_user,
+                        struct pt_regs *regs,
+                        struct pt_regs *regs_user_copy)
+{
+        struct pt_regs *user_regs = task_pt_regs(current);
+
+        /*
+         * If we're in an NMI that interrupted task_pt_regs setup, then
+         * we can't sample user regs at all.  This check isn't really
+         * sufficient, though, as we could be in an NMI inside an interrupt
+         * that happened during task_pt_regs setup.
+         */
+        if (regs->sp > (unsigned long)&user_regs->r11 &&
+            regs->sp <= (unsigned long)(user_regs + 1)) {
+                regs_user->abi = PERF_SAMPLE_REGS_ABI_NONE;
+                regs_user->regs = NULL;
+                return;
+        }
+
+        /*
+         * RIP, flags, and the argument registers are usually saved.
+         * orig_ax is probably okay, too.
+         */
+        regs_user_copy->ip = user_regs->ip;
+        regs_user_copy->cx = user_regs->cx;
+        regs_user_copy->dx = user_regs->dx;
+        regs_user_copy->si = user_regs->si;
+        regs_user_copy->di = user_regs->di;
+        regs_user_copy->r8 = user_regs->r8;
+        regs_user_copy->r9 = user_regs->r9;
+        regs_user_copy->r10 = user_regs->r10;
+        regs_user_copy->r11 = user_regs->r11;
+        regs_user_copy->orig_ax = user_regs->orig_ax;
+        regs_user_copy->flags = user_regs->flags;
+
+        /*
+         * Don't even try to report the "rest" regs.
+         */
+        regs_user_copy->bx = -1;
+        regs_user_copy->bp = -1;
+        regs_user_copy->r12 = -1;
+        regs_user_copy->r13 = -1;
+        regs_user_copy->r14 = -1;
+        regs_user_copy->r15 = -1;
+
+        /*
+         * For this to be at all useful, we need a reasonable guess for
+         * sp and the ABI.  Be careful: we're in NMI context, and we're
+         * considering current to be the current task, so we should
+         * be careful not to look at any other percpu variables that might
+         * change during context switches.
+         */
+        if (IS_ENABLED(CONFIG_IA32_EMULATION) &&
+            task_thread_info(current)->status & TS_COMPAT) {
+                /* Easy case: we're in a compat syscall. */
+                regs_user->abi = PERF_SAMPLE_REGS_ABI_32;
+                regs_user_copy->sp = user_regs->sp;
+                regs_user_copy->cs = user_regs->cs;
+                regs_user_copy->ss = user_regs->ss;
+        } else if (user_regs->orig_ax != -1) {
+                /*
+                 * We're probably in a 64-bit syscall.
+                 * Warning: this code is severely racy.  At least it's better
+                 * than just blindly copying user_regs.
+                 */
+                regs_user->abi = PERF_SAMPLE_REGS_ABI_64;
+                regs_user_copy->sp = this_cpu_read(old_rsp);
+                regs_user_copy->cs = __USER_CS;
+                regs_user_copy->ss = __USER_DS;
+                regs_user_copy->cx = -1;  /* usually contains garbage */
+        } else {
+                /* We're probably in an interrupt or exception. */
+                regs_user->abi = user_64bit_mode(user_regs) ?
+                        PERF_SAMPLE_REGS_ABI_64 : PERF_SAMPLE_REGS_ABI_32;
+                regs_user_copy->sp = user_regs->sp;
+                regs_user_copy->cs = user_regs->cs;
+                regs_user_copy->ss = user_regs->ss;
+        }
+
+        regs_user->regs = regs_user_copy;
+}
 #endif /* CONFIG_X86_32 */
diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
index 2480978b31cc..1313ae6b478b 100644
--- a/arch/x86/lib/insn.c
+++ b/arch/x86/lib/insn.c
@@ -28,7 +28,7 @@
 
 /* Verify next sizeof(t) bytes can be on the same instruction */
 #define validate_next(t, insn, n)       \
-        ((insn)->next_byte + sizeof(t) + n < (insn)->end_kaddr)
+        ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)
 
 #define __get_next(t, insn)     \
         ({ t r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index a97ee0801475..08a7d313538a 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -438,20 +438,20 @@ static unsigned long __init init_range_memory_mapping(
 static unsigned long __init get_new_step_size(unsigned long step_size)
 {
         /*
-         * Explain why we shift by 5 and why we don't have to worry about
-         * 'step_size << 5' overflowing:
-         *
-         * initial mapped size is PMD_SIZE (2M).
+         * Initial mapped size is PMD_SIZE (2M).
          * We can not set step_size to be PUD_SIZE (1G) yet.
          * In worse case, when we cross the 1G boundary, and
          * PG_LEVEL_2M is not set, we will need 1+1+512 pages (2M + 8k)
-         * to map 1G range with PTE. Use 5 as shift for now.
+         * to map 1G range with PTE. Hence we use one less than the
+         * difference of page table level shifts.
          *
-         * Don't need to worry about overflow, on 32bit, when step_size
-         * is 0, round_down() returns 0 for start, and that turns it
-         * into 0x100000000ULL.
+         * Don't need to worry about overflow in the top-down case, on 32bit,
+         * when step_size is 0, round_down() returns 0 for start, and that
+         * turns it into 0x100000000ULL.
+         * In the bottom-up case, round_up(x, 0) returns 0 though too, which
+         * needs to be taken into consideration by the code below.
          */
-        return step_size << 5;
+        return step_size << (PMD_SHIFT - PAGE_SHIFT - 1);
 }
 
 /**
@@ -471,7 +471,6 @@ static void __init memory_map_top_down(unsigned long map_start,
         unsigned long step_size;
         unsigned long addr;
         unsigned long mapped_ram_size = 0;
-        unsigned long new_mapped_ram_size;
 
         /* xen has big range in reserved near end of ram, skip it at first.*/
         addr = memblock_find_in_range(map_start, map_end, PMD_SIZE, PMD_SIZE);
@@ -496,14 +495,12 @@ static void __init memory_map_top_down(unsigned long map_start,
                                 start = map_start;
                 } else
                         start = map_start;
-                new_mapped_ram_size = init_range_memory_mapping(start,
+                mapped_ram_size += init_range_memory_mapping(start,
                                                         last_start);
                 last_start = start;
                 min_pfn_mapped = last_start >> PAGE_SHIFT;
-                /* only increase step_size after big range get mapped */
-                if (new_mapped_ram_size > mapped_ram_size)
+                if (mapped_ram_size >= step_size)
                         step_size = get_new_step_size(step_size);
-                mapped_ram_size += new_mapped_ram_size;
         }
 
         if (real_end < map_end)
@@ -524,7 +521,7 @@ static void __init memory_map_top_down(unsigned long map_start,
 static void __init memory_map_bottom_up(unsigned long map_start,
                                         unsigned long map_end)
 {
-        unsigned long next, new_mapped_ram_size, start;
+        unsigned long next, start;
         unsigned long mapped_ram_size = 0;
         /* step_size need to be small so pgt_buf from BRK could cover it */
         unsigned long step_size = PMD_SIZE;
@@ -539,19 +536,19 @@ static void __init memory_map_bottom_up(unsigned long map_start,
          * for page table.
          */
         while (start < map_end) {
-                if (map_end - start > step_size) {
+                if (step_size && map_end - start > step_size) {
                         next = round_up(start + 1, step_size);
                         if (next > map_end)
                                 next = map_end;
-                } else
+                } else {
                         next = map_end;
+                }
 
-                new_mapped_ram_size = init_range_memory_mapping(start, next);
+                mapped_ram_size += init_range_memory_mapping(start, next);
                 start = next;
 
-                if (new_mapped_ram_size > mapped_ram_size)
+                if (mapped_ram_size >= step_size)
                         step_size = get_new_step_size(step_size);
-                mapped_ram_size += new_mapped_ram_size;
         }
 }
 
diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
index 009495b9ab4b..1c9f750c3859 100644
--- a/arch/x86/vdso/vma.c
+++ b/arch/x86/vdso/vma.c
@@ -41,12 +41,17 @@ void __init init_vdso_image(const struct vdso_image *image)
 
 struct linux_binprm;
 
-/* Put the vdso above the (randomized) stack with another randomized offset.
-   This way there is no hole in the middle of address space.
-   To save memory make sure it is still in the same PTE as the stack top.
-   This doesn't give that many random bits.
-
-   Only used for the 64-bit and x32 vdsos. */
+/*
+ * Put the vdso above the (randomized) stack with another randomized
+ * offset.  This way there is no hole in the middle of address space.
+ * To save memory make sure it is still in the same PTE as the stack
+ * top.  This doesn't give that many random bits.
+ *
+ * Note that this algorithm is imperfect: the distribution of the vdso
+ * start address within a PMD is biased toward the end.
+ *
+ * Only used for the 64-bit and x32 vdsos.
+ */
 static unsigned long vdso_addr(unsigned long start, unsigned len)
 {
 #ifdef CONFIG_X86_32
@@ -54,22 +59,30 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
 #else
         unsigned long addr, end;
         unsigned offset;
-        end = (start + PMD_SIZE - 1) & PMD_MASK;
+
+        /*
+         * Round up the start address.  It can start out unaligned as a result
+         * of stack start randomization.
+         */
+        start = PAGE_ALIGN(start);
+
+        /* Round the lowest possible end address up to a PMD boundary. */
+        end = (start + len + PMD_SIZE - 1) & PMD_MASK;
         if (end >= TASK_SIZE_MAX)
                 end = TASK_SIZE_MAX;
         end -= len;
-        /* This loses some more bits than a modulo, but is cheaper */
-        offset = get_random_int() & (PTRS_PER_PTE - 1);
-        addr = start + (offset << PAGE_SHIFT);
-        if (addr >= end)
-                addr = end;
+
+        if (end > start) {
+                offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1);
+                addr = start + (offset << PAGE_SHIFT);
+        } else {
+                addr = start;
+        }
 
         /*
-         * page-align it here so that get_unmapped_area doesn't
-         * align it wrongfully again to the next page. addr can come in 4K
-         * unaligned here as a result of stack start randomization.
+         * Forcibly align the final address in case we have a hardware
+         * issue that requires alignment for performance reasons.
          */
-        addr = PAGE_ALIGN(addr);
         addr = align_vdso_addr(addr);
 
         return addr;
diff --git a/drivers/Makefile b/drivers/Makefile
index 67d2334dc41e..527a6da8d539 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -50,7 +50,10 @@ obj-$(CONFIG_RESET_CONTROLLER)	+= reset/
 obj-y                           += tty/
 obj-y                           += char/
 
-# gpu/ comes after char for AGP vs DRM startup
+# iommu/ comes before gpu as gpu are using iommu controllers
+obj-$(CONFIG_IOMMU_SUPPORT)     += iommu/
+
+# gpu/ comes after char for AGP vs DRM startup and after iommu
 obj-y                           += gpu/
 
 obj-$(CONFIG_CONNECTOR)         += connector/
@@ -141,7 +144,6 @@ obj-y				+= clk/
 
 obj-$(CONFIG_MAILBOX)           += mailbox/
 obj-$(CONFIG_HWSPINLOCK)        += hwspinlock/
-obj-$(CONFIG_IOMMU_SUPPORT)     += iommu/
 obj-$(CONFIG_REMOTEPROC)        += remoteproc/
 obj-$(CONFIG_RPMSG)             += rpmsg/
 
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index 1fdf5e07a1c7..1020b1b53a17 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -170,7 +170,7 @@ static int acpi_processor_hotadd_init(struct acpi_processor *pr)
         acpi_status status;
         int ret;
 
-        if (pr->apic_id == -1)
+        if (pr->phys_id == -1)
                 return -ENODEV;
 
         status = acpi_evaluate_integer(pr->handle, "_STA", NULL, &sta);
@@ -180,13 +180,13 @@ static int acpi_processor_hotadd_init(struct acpi_processor *pr)
         cpu_maps_update_begin();
         cpu_hotplug_begin();
 
-        ret = acpi_map_lsapic(pr->handle, pr->apic_id, &pr->id);
+        ret = acpi_map_cpu(pr->handle, pr->phys_id, &pr->id);
         if (ret)
                 goto out;
 
         ret = arch_register_cpu(pr->id);
         if (ret) {
-                acpi_unmap_lsapic(pr->id);
+                acpi_unmap_cpu(pr->id);
                 goto out;
         }
 
@@ -215,7 +215,7 @@ static int acpi_processor_get_info(struct acpi_device *device)
         union acpi_object object = { 0 };
         struct acpi_buffer buffer = { sizeof(union acpi_object), &object };
         struct acpi_processor *pr = acpi_driver_data(device);
-        int apic_id, cpu_index, device_declaration = 0;
+        int phys_id, cpu_index, device_declaration = 0;
         acpi_status status = AE_OK;
         static int cpu0_initialized;
         unsigned long long value;
@@ -262,15 +262,18 @@ static int acpi_processor_get_info(struct acpi_device *device)
                 pr->acpi_id = value;
         }
 
-        apic_id = acpi_get_apicid(pr->handle, device_declaration, pr->acpi_id);
-        if (apic_id < 0)
-                acpi_handle_debug(pr->handle, "failed to get CPU APIC ID.\n");
-        pr->apic_id = apic_id;
+        phys_id = acpi_get_phys_id(pr->handle, device_declaration, pr->acpi_id);
+        if (phys_id < 0)
+                acpi_handle_debug(pr->handle, "failed to get CPU physical ID.\n");
+        pr->phys_id = phys_id;
 
-        cpu_index = acpi_map_cpuid(pr->apic_id, pr->acpi_id);
+        cpu_index = acpi_map_cpuid(pr->phys_id, pr->acpi_id);
         if (!cpu0_initialized && !acpi_has_cpu_in_madt()) {
                 cpu0_initialized = 1;
-                /* Handle UP system running SMP kernel, with no LAPIC in MADT */
+                /*
+                 * Handle UP system running SMP kernel, with no CPU
+                 * entry in MADT
+                 */
                 if ((cpu_index == -1) && (num_online_cpus() == 1))
                         cpu_index = 0;
         }
@@ -458,7 +461,7 @@ static void acpi_processor_remove(struct acpi_device *device)
 
         /* Remove the CPU. */
         arch_unregister_cpu(pr->id);
-        acpi_unmap_lsapic(pr->id);
+        acpi_unmap_cpu(pr->id);
 
         cpu_hotplug_done();
         cpu_maps_update_done();
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index c2daa85fc9f7..c0d44d394ca3 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -257,7 +257,7 @@ int acpi_bus_init_power(struct acpi_device *device)
 
         device->power.state = ACPI_STATE_UNKNOWN;
         if (!acpi_device_is_present(device))
-                return 0;
+                return -ENXIO;
 
         result = acpi_device_get_power(device, &state);
         if (result)
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 342942f90a10..02e48394276c 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -69,7 +69,7 @@ static int map_madt_entry(int type, u32 acpi_id)
         unsigned long madt_end, entry;
         static struct acpi_table_madt *madt;
         static int read_madt;
-        int apic_id = -1;
+        int phys_id = -1;       /* CPU hardware ID */
 
         if (!read_madt) {
                 if (ACPI_FAILURE(acpi_get_table(ACPI_SIG_MADT, 0,
@@ -79,7 +79,7 @@ static int map_madt_entry(int type, u32 acpi_id)
         }
 
         if (!madt)
-                return apic_id;
+                return phys_id;
 
         entry = (unsigned long)madt;
         madt_end = entry + madt->header.length;
@@ -91,18 +91,18 @@ static int map_madt_entry(int type, u32 acpi_id)
                 struct acpi_subtable_header *header =
                         (struct acpi_subtable_header *)entry;
                 if (header->type == ACPI_MADT_TYPE_LOCAL_APIC) {
-                        if (!map_lapic_id(header, acpi_id, &apic_id))
+                        if (!map_lapic_id(header, acpi_id, &phys_id))
                                 break;
                 } else if (header->type == ACPI_MADT_TYPE_LOCAL_X2APIC) {
-                        if (!map_x2apic_id(header, type, acpi_id, &apic_id))
+                        if (!map_x2apic_id(header, type, acpi_id, &phys_id))
                                 break;
                 } else if (header->type == ACPI_MADT_TYPE_LOCAL_SAPIC) {
-                        if (!map_lsapic_id(header, type, acpi_id, &apic_id))
+                        if (!map_lsapic_id(header, type, acpi_id, &phys_id))
                                 break;
                 }
                 entry += header->length;
         }
-        return apic_id;
+        return phys_id;
 }
 
 static int map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
@@ -110,7 +110,7 @@ static int map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *obj;
         struct acpi_subtable_header *header;
-        int apic_id = -1;
+        int phys_id = -1;
 
         if (ACPI_FAILURE(acpi_evaluate_object(handle, "_MAT", NULL, &buffer)))
                 goto exit;
@@ -126,38 +126,38 @@ static int map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
 
         header = (struct acpi_subtable_header *)obj->buffer.pointer;
         if (header->type == ACPI_MADT_TYPE_LOCAL_APIC)
-                map_lapic_id(header, acpi_id, &apic_id);
+                map_lapic_id(header, acpi_id, &phys_id);
         else if (header->type == ACPI_MADT_TYPE_LOCAL_SAPIC)
-                map_lsapic_id(header, type, acpi_id, &apic_id);
+                map_lsapic_id(header, type, acpi_id, &phys_id);
         else if (header->type == ACPI_MADT_TYPE_LOCAL_X2APIC)
-                map_x2apic_id(header, type, acpi_id, &apic_id);
+                map_x2apic_id(header, type, acpi_id, &phys_id);
 
 exit:
         kfree(buffer.pointer);
-        return apic_id;
+        return phys_id;
 }
 
-int acpi_get_apicid(acpi_handle handle, int type, u32 acpi_id)
+int acpi_get_phys_id(acpi_handle handle, int type, u32 acpi_id)
 {
-        int apic_id;
+        int phys_id;
 
-        apic_id = map_mat_entry(handle, type, acpi_id);
-        if (apic_id == -1)
-                apic_id = map_madt_entry(type, acpi_id);
+        phys_id = map_mat_entry(handle, type, acpi_id);
+        if (phys_id == -1)
+                phys_id = map_madt_entry(type, acpi_id);
 
-        return apic_id;
+        return phys_id;
 }
 
-int acpi_map_cpuid(int apic_id, u32 acpi_id)
+int acpi_map_cpuid(int phys_id, u32 acpi_id)
 {
 #ifdef CONFIG_SMP
         int i;
 #endif
 
-        if (apic_id == -1) {
+        if (phys_id == -1) {
                 /*
                  * On UP processor, there is no _MAT or MADT table.
-                 * So above apic_id is always set to -1.
+                 * So above phys_id is always set to -1.
                  *
                  * BIOS may define multiple CPU handles even for UP processor.
                  * For example,
@@ -170,7 +170,7 @@ int acpi_map_cpuid(int apic_id, u32 acpi_id)
                  *     Processor (CPU3, 0x03, 0x00000410, 0x06) {}
                  * }
                  *
-                 * Ignores apic_id and always returns 0 for the processor
+                 * Ignores phys_id and always returns 0 for the processor
                  * handle with acpi id 0 if nr_cpu_ids is 1.
                  * This should be the case if SMP tables are not found.
                  * Return -1 for other CPU's handle.
@@ -178,28 +178,28 @@ int acpi_map_cpuid(int apic_id, u32 acpi_id)
                 if (nr_cpu_ids <= 1 && acpi_id == 0)
                         return acpi_id;
                 else
-                        return apic_id;
+                        return phys_id;
         }
 
 #ifdef CONFIG_SMP
         for_each_possible_cpu(i) {
-                if (cpu_physical_id(i) == apic_id)
+                if (cpu_physical_id(i) == phys_id)
                         return i;
         }
 #else
         /* In UP kernel, only processor 0 is valid */
-        if (apic_id == 0)
-                return apic_id;
+        if (phys_id == 0)
+                return phys_id;
 #endif
         return -1;
 }
 
 int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
 {
-        int apic_id;
+        int phys_id;
 
-        apic_id = acpi_get_apicid(handle, type, acpi_id);
+        phys_id = acpi_get_phys_id(handle, type, acpi_id);
 
-        return acpi_map_cpuid(apic_id, acpi_id);
+        return acpi_map_cpuid(phys_id, acpi_id);
 }
 EXPORT_SYMBOL_GPL(acpi_get_cpuid);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 16914cc30882..dc4d8960684a 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1001,7 +1001,7 @@ static void acpi_free_power_resources_lists(struct acpi_device *device)
         if (device->wakeup.flags.valid)
                 acpi_power_resources_list_free(&device->wakeup.resources);
 
-        if (!device->flags.power_manageable)
+        if (!device->power.flags.power_resources)
                 return;
 
         for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3_HOT; i++) {
@@ -1744,10 +1744,8 @@ static void acpi_bus_get_power_flags(struct acpi_device *device)
                         device->power.flags.power_resources)
                 device->power.states[ACPI_STATE_D3_COLD].flags.os_accessible = 1;
 
-        if (acpi_bus_init_power(device)) {
-                acpi_free_power_resources_lists(device);
+        if (acpi_bus_init_power(device))
                 device->flags.power_manageable = 0;
-        }
 }
 
 static void acpi_bus_get_flags(struct acpi_device *device)
@@ -2371,13 +2369,18 @@ static void acpi_bus_attach(struct acpi_device *device)
         /* Skip devices that are not present. */
         if (!acpi_device_is_present(device)) {
                 device->flags.visited = false;
+                device->flags.power_manageable = 0;
                 return;
         }
         if (device->handler)
                 goto ok;
 
         if (!device->flags.initialized) {
-                acpi_bus_update_power(device, NULL);
+                device->flags.power_manageable =
+                        device->power.states[ACPI_STATE_D0].flags.valid;
+                if (acpi_bus_init_power(device))
+                        device->flags.power_manageable = 0;
+
                 device->flags.initialized = true;
         }
         device->flags.visited = false;
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index c72e79d2c5ad..032db459370f 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -522,6 +522,16 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "370R4E/370R4V/370R5E/3570RE/370R5V"),
                 },
         },
+
+        {
+         /* https://bugzilla.redhat.com/show_bug.cgi?id=1163574 */
+         .callback = video_disable_native_backlight,
+         .ident = "Dell XPS15 L521X",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "XPS L521X"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index fd5a5e85d7dc..982b96323f82 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -969,7 +969,8 @@ static void sender(void                *send_info,
 
                 do_gettimeofday(&t);
                 pr_info("**Enqueue %02x %02x: %ld.%6.6ld\n",
-                       msg->data[0], msg->data[1], t.tv_sec, t.tv_usec);
+                       msg->data[0], msg->data[1],
+                       (long) t.tv_sec, (long) t.tv_usec);
         }
 }
 
diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile
index 66e40398b3d3..e620807418ea 100644
--- a/drivers/gpu/drm/Makefile
+++ b/drivers/gpu/drm/Makefile
@@ -37,6 +37,7 @@ obj-$(CONFIG_DRM_MIPI_DSI) += drm_mipi_dsi.o
 obj-$(CONFIG_DRM_TTM)   += ttm/
 obj-$(CONFIG_DRM_TDFX)  += tdfx/
 obj-$(CONFIG_DRM_R128)  += r128/
+obj-$(CONFIG_HSA_AMD) += amd/amdkfd/
 obj-$(CONFIG_DRM_RADEON)+= radeon/
 obj-$(CONFIG_DRM_MGA)   += mga/
 obj-$(CONFIG_DRM_I810)  += i810/
@@ -67,4 +68,3 @@ obj-$(CONFIG_DRM_IMX) += imx/
 obj-y                   += i2c/
 obj-y                   += panel/
 obj-y                   += bridge/
-obj-$(CONFIG_HSA_AMD) += amd/amdkfd/
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 7d4974b83af7..fcfdf23e1913 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -31,7 +31,6 @@
 #include <uapi/linux/kfd_ioctl.h>
 #include <linux/time.h>
 #include <linux/mm.h>
-#include <linux/uaccess.h>
 #include <uapi/asm-generic/mman-common.h>
 #include <asm/processor.h>
 #include "kfd_priv.h"
@@ -127,17 +126,14 @@ static int kfd_open(struct inode *inode, struct file *filep)
         return 0;
 }
 
-static long kfd_ioctl_get_version(struct file *filep, struct kfd_process *p,
-                                        void __user *arg)
+static int kfd_ioctl_get_version(struct file *filep, struct kfd_process *p,
+                                        void *data)
 {
-        struct kfd_ioctl_get_version_args args;
+        struct kfd_ioctl_get_version_args *args = data;
         int err = 0;
 
-        args.major_version = KFD_IOCTL_MAJOR_VERSION;
-        args.minor_version = KFD_IOCTL_MINOR_VERSION;
-
-        if (copy_to_user(arg, &args, sizeof(args)))
-                err = -EFAULT;
+        args->major_version = KFD_IOCTL_MAJOR_VERSION;
+        args->minor_version = KFD_IOCTL_MINOR_VERSION;
 
         return err;
 }
@@ -221,10 +217,10 @@ static int set_queue_properties_from_user(struct queue_properties *q_properties,
         return 0;
 }
 
-static long kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
-                                        void __user *arg)
+static int kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
+                                        void *data)
 {
-        struct kfd_ioctl_create_queue_args args;
+        struct kfd_ioctl_create_queue_args *args = data;
         struct kfd_dev *dev;
         int err = 0;
         unsigned int queue_id;
@@ -233,16 +229,13 @@ static long kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
 
         memset(&q_properties, 0, sizeof(struct queue_properties));
 
-        if (copy_from_user(&args, arg, sizeof(args)))
-                return -EFAULT;
-
         pr_debug("kfd: creating queue ioctl\n");
 
-        err = set_queue_properties_from_user(&q_properties, &args);
+        err = set_queue_properties_from_user(&q_properties, args);
         if (err)
                 return err;
 
-        dev = kfd_device_by_id(args.gpu_id);
+        dev = kfd_device_by_id(args->gpu_id);
         if (dev == NULL)
                 return -EINVAL;
 
@@ -250,7 +243,7 @@ static long kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
 
         pdd = kfd_bind_process_to_device(dev, p);
         if (IS_ERR(pdd)) {
-                err = PTR_ERR(pdd);
+                err = -ESRCH;
                 goto err_bind_process;
         }
 
@@ -263,33 +256,26 @@ static long kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
         if (err != 0)
                 goto err_create_queue;
 
-        args.queue_id = queue_id;
+        args->queue_id = queue_id;
 
         /* Return gpu_id as doorbell offset for mmap usage */
-        args.doorbell_offset = args.gpu_id << PAGE_SHIFT;
-
-        if (copy_to_user(arg, &args, sizeof(args))) {
-                err = -EFAULT;
-                goto err_copy_args_out;
-        }
+        args->doorbell_offset = args->gpu_id << PAGE_SHIFT;
 
         mutex_unlock(&p->mutex);
 
-        pr_debug("kfd: queue id %d was created successfully\n", args.queue_id);
+        pr_debug("kfd: queue id %d was created successfully\n", args->queue_id);
 
         pr_debug("ring buffer address == 0x%016llX\n",
-                        args.ring_base_address);
+                        args->ring_base_address);
 
         pr_debug("read ptr address    == 0x%016llX\n",
-                        args.read_pointer_address);
+                        args->read_pointer_address);
 
         pr_debug("write ptr address   == 0x%016llX\n",
-                        args.write_pointer_address);
+                        args->write_pointer_address);
 
         return 0;
 
-err_copy_args_out:
-        pqm_destroy_queue(&p->pqm, queue_id);
 err_create_queue:
 err_bind_process:
         mutex_unlock(&p->mutex);
@@ -297,99 +283,90 @@ err_bind_process:
 }
 
 static int kfd_ioctl_destroy_queue(struct file *filp, struct kfd_process *p,
-                                        void __user *arg)
+                                        void *data)
 {
         int retval;
-        struct kfd_ioctl_destroy_queue_args args;
-
-        if (copy_from_user(&args, arg, sizeof(args)))
-                return -EFAULT;
+        struct kfd_ioctl_destroy_queue_args *args = data;
 
         pr_debug("kfd: destroying queue id %d for PASID %d\n",
-                                args.queue_id,
+                                args->queue_id,
                                 p->pasid);
 
         mutex_lock(&p->mutex);
 
-        retval = pqm_destroy_queue(&p->pqm, args.queue_id);
+        retval = pqm_destroy_queue(&p->pqm, args->queue_id);
 
         mutex_unlock(&p->mutex);
         return retval;
 }
 
 static int kfd_ioctl_update_queue(struct file *filp, struct kfd_process *p,
-                                        void __user *arg)
+                                        void *data)
 {
         int retval;
-        struct kfd_ioctl_update_queue_args args;
+        struct kfd_ioctl_update_queue_args *args = data;
         struct queue_properties properties;
 
-        if (copy_from_user(&args, arg, sizeof(args)))
-                return -EFAULT;
-
-        if (args.queue_percentage > KFD_MAX_QUEUE_PERCENTAGE) {
+        if (args->queue_percentage > KFD_MAX_QUEUE_PERCENTAGE) {
                 pr_err("kfd: queue percentage must be between 0 to KFD_MAX_QUEUE_PERCENTAGE\n");
                 return -EINVAL;
         }
 
-        if (args.queue_priority > KFD_MAX_QUEUE_PRIORITY) {
+        if (args->queue_priority > KFD_MAX_QUEUE_PRIORITY) {
                 pr_err("kfd: queue priority must be between 0 to KFD_MAX_QUEUE_PRIORITY\n");
                 return -EINVAL;
         }
 
-        if ((args.ring_base_address) &&
+        if ((args->ring_base_address) &&
                 (!access_ok(VERIFY_WRITE,
-                        (const void __user *) args.ring_base_address,
+                        (const void __user *) args->ring_base_address,
                         sizeof(uint64_t)))) {
                 pr_err("kfd: can't access ring base address\n");
                 return -EFAULT;
         }
 
-        if (!is_power_of_2(args.ring_size) && (args.ring_size != 0)) {
+        if (!is_power_of_2(args->ring_size) && (args->ring_size != 0)) {
                 pr_err("kfd: ring size must be a power of 2 or 0\n");
                 return -EINVAL;
         }
 
-        properties.queue_address = args.ring_base_address;
-        properties.queue_size = args.ring_size;
-        properties.queue_percent = args.queue_percentage;
-        properties.priority = args.queue_priority;
+        properties.queue_address = args->ring_base_address;
+        properties.queue_size = args->ring_size;
+        properties.queue_percent = args->queue_percentage;
+        properties.priority = args->queue_priority;
 
         pr_debug("kfd: updating queue id %d for PASID %d\n",
-                        args.queue_id, p->pasid);
+                        args->queue_id, p->pasid);
 
         mutex_lock(&p->mutex);
 
-        retval = pqm_update_queue(&p->pqm, args.queue_id, &properties);
+        retval = pqm_update_queue(&p->pqm, args->queue_id, &properties);
 
         mutex_unlock(&p->mutex);
 
         return retval;
 }
 
-static long kfd_ioctl_set_memory_policy(struct file *filep,
-                                struct kfd_process *p, void __user *arg)
+static int kfd_ioctl_set_memory_policy(struct file *filep,
+                                        struct kfd_process *p, void *data)
 {
-        struct kfd_ioctl_set_memory_policy_args args;
+        struct kfd_ioctl_set_memory_policy_args *args = data;
         struct kfd_dev *dev;
         int err = 0;
         struct kfd_process_device *pdd;
         enum cache_policy default_policy, alternate_policy;
 
-        if (copy_from_user(&args, arg, sizeof(args)))
-                return -EFAULT;
-
-        if (args.default_policy != KFD_IOC_CACHE_POLICY_COHERENT
-            && args.default_policy != KFD_IOC_CACHE_POLICY_NONCOHERENT) {
+        if (args->default_policy != KFD_IOC_CACHE_POLICY_COHERENT
+            && args->default_policy != KFD_IOC_CACHE_POLICY_NONCOHERENT) {
                 return -EINVAL;
         }
 
-        if (args.alternate_policy != KFD_IOC_CACHE_POLICY_COHERENT
-            && args.alternate_policy != KFD_IOC_CACHE_POLICY_NONCOHERENT) {
+        if (args->alternate_policy != KFD_IOC_CACHE_POLICY_COHERENT
+            && args->alternate_policy != KFD_IOC_CACHE_POLICY_NONCOHERENT) {
                 return -EINVAL;
         }
 
-        dev = kfd_device_by_id(args.gpu_id);
+        dev = kfd_device_by_id(args->gpu_id);
         if (dev == NULL)
                 return -EINVAL;
 
@@ -397,23 +374,23 @@ static long kfd_ioctl_set_memory_policy(struct file *filep,
 
         pdd = kfd_bind_process_to_device(dev, p);
         if (IS_ERR(pdd)) {
-                err = PTR_ERR(pdd);
+                err = -ESRCH;
                 goto out;
         }
 
-        default_policy = (args.default_policy == KFD_IOC_CACHE_POLICY_COHERENT)
+        default_policy = (args->default_policy == KFD_IOC_CACHE_POLICY_COHERENT)
                          ? cache_policy_coherent : cache_policy_noncoherent;
 
         alternate_policy =
-                (args.alternate_policy == KFD_IOC_CACHE_POLICY_COHERENT)
+                (args->alternate_policy == KFD_IOC_CACHE_POLICY_COHERENT)
                    ? cache_policy_coherent : cache_policy_noncoherent;
 
         if (!dev->dqm->set_cache_memory_policy(dev->dqm,
                                 &pdd->qpd,
                                 default_policy,
                                 alternate_policy,
-                                (void __user *)args.alternate_aperture_base,
-                                args.alternate_aperture_size))
+                                (void __user *)args->alternate_aperture_base,
+                                args->alternate_aperture_size))
                 err = -EINVAL;
 
 out:
@@ -422,53 +399,44 @@ out:
         return err;
 }
 
-static long kfd_ioctl_get_clock_counters(struct file *filep,
-                                struct kfd_process *p, void __user *arg)
+static int kfd_ioctl_get_clock_counters(struct file *filep,
+                                struct kfd_process *p, void *data)
 {
-        struct kfd_ioctl_get_clock_counters_args args;
+        struct kfd_ioctl_get_clock_counters_args *args = data;
         struct kfd_dev *dev;
         struct timespec time;
 
-        if (copy_from_user(&args, arg, sizeof(args)))
-                return -EFAULT;
-
-        dev = kfd_device_by_id(args.gpu_id);
+        dev = kfd_device_by_id(args->gpu_id);
         if (dev == NULL)
                 return -EINVAL;
 
         /* Reading GPU clock counter from KGD */
-        args.gpu_clock_counter = kfd2kgd->get_gpu_clock_counter(dev->kgd);
+        args->gpu_clock_counter = kfd2kgd->get_gpu_clock_counter(dev->kgd);
 
         /* No access to rdtsc. Using raw monotonic time */
         getrawmonotonic(&time);
-        args.cpu_clock_counter = (uint64_t)timespec_to_ns(&time);
+        args->cpu_clock_counter = (uint64_t)timespec_to_ns(&time);
 
         get_monotonic_boottime(&time);
-        args.system_clock_counter = (uint64_t)timespec_to_ns(&time);
+        args->system_clock_counter = (uint64_t)timespec_to_ns(&time);
 
         /* Since the counter is in nano-seconds we use 1GHz frequency */
-        args.system_clock_freq = 1000000000;
-
-        if (copy_to_user(arg, &args, sizeof(args)))
-                return -EFAULT;
+        args->system_clock_freq = 1000000000;
 
         return 0;
 }
 
 
 static int kfd_ioctl_get_process_apertures(struct file *filp,
-                                struct kfd_process *p, void __user *arg)
+                                struct kfd_process *p, void *data)
 {
-        struct kfd_ioctl_get_process_apertures_args args;
+        struct kfd_ioctl_get_process_apertures_args *args = data;
         struct kfd_process_device_apertures *pAperture;
         struct kfd_process_device *pdd;
 
         dev_dbg(kfd_device, "get apertures for PASID %d", p->pasid);
 
-        if (copy_from_user(&args, arg, sizeof(args)))
-                return -EFAULT;
-
-        args.num_of_nodes = 0;
+        args->num_of_nodes = 0;
 
         mutex_lock(&p->mutex);
 
@@ -477,7 +445,8 @@ static int kfd_ioctl_get_process_apertures(struct file *filp,
                 /* Run over all pdd of the process */
                 pdd = kfd_get_first_process_device_data(p);
                 do {
-                        pAperture = &args.process_apertures[args.num_of_nodes];
+                        pAperture =
+                                &args->process_apertures[args->num_of_nodes];
                         pAperture->gpu_id = pdd->dev->id;
                         pAperture->lds_base = pdd->lds_base;
                         pAperture->lds_limit = pdd->lds_limit;
@@ -487,7 +456,7 @@ static int kfd_ioctl_get_process_apertures(struct file *filp,
                         pAperture->scratch_limit = pdd->scratch_limit;
 
                         dev_dbg(kfd_device,
-                                "node id %u\n", args.num_of_nodes);
+                                "node id %u\n", args->num_of_nodes);
                         dev_dbg(kfd_device,
                                 "gpu id %u\n", pdd->dev->id);
                         dev_dbg(kfd_device,
@@ -503,80 +472,131 @@ static int kfd_ioctl_get_process_apertures(struct file *filp,
                         dev_dbg(kfd_device,
                                 "scratch_limit %llX\n", pdd->scratch_limit);
 
-                        args.num_of_nodes++;
+                        args->num_of_nodes++;
                 } while ((pdd = kfd_get_next_process_device_data(p, pdd)) != NULL &&
-                                (args.num_of_nodes < NUM_OF_SUPPORTED_GPUS));
+                                (args->num_of_nodes < NUM_OF_SUPPORTED_GPUS));
         }
 
         mutex_unlock(&p->mutex);
 
-        if (copy_to_user(arg, &args, sizeof(args)))
-                return -EFAULT;
-
         return 0;
 }
 
+#define AMDKFD_IOCTL_DEF(ioctl, _func, _flags) \
+        [_IOC_NR(ioctl)] = {.cmd = ioctl, .func = _func, .flags = _flags, .cmd_drv = 0, .name = #ioctl}
+
+/** Ioctl table */
+static const struct amdkfd_ioctl_desc amdkfd_ioctls[] = {
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_VERSION,
+                        kfd_ioctl_get_version, 0),
+
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_CREATE_QUEUE,
+                        kfd_ioctl_create_queue, 0),
+
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_DESTROY_QUEUE,
+                        kfd_ioctl_destroy_queue, 0),
+
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_SET_MEMORY_POLICY,
+                        kfd_ioctl_set_memory_policy, 0),
+
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_CLOCK_COUNTERS,
+                        kfd_ioctl_get_clock_counters, 0),
+
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_PROCESS_APERTURES,
+                        kfd_ioctl_get_process_apertures, 0),
+
+        AMDKFD_IOCTL_DEF(AMDKFD_IOC_UPDATE_QUEUE,
+                        kfd_ioctl_update_queue, 0),
+};
+
+#define AMDKFD_CORE_IOCTL_COUNT ARRAY_SIZE(amdkfd_ioctls)
+
 static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
 {
         struct kfd_process *process;
-        long err = -EINVAL;
+        amdkfd_ioctl_t *func;
+        const struct amdkfd_ioctl_desc *ioctl = NULL;
+        unsigned int nr = _IOC_NR(cmd);
+        char stack_kdata[128];
+        char *kdata = NULL;
+        unsigned int usize, asize;
+        int retcode = -EINVAL;
 
-        dev_dbg(kfd_device,
-                "ioctl cmd 0x%x (#%d), arg 0x%lx\n",
-                cmd, _IOC_NR(cmd), arg);
+        if (nr >= AMDKFD_CORE_IOCTL_COUNT)
+                goto err_i1;
+
+        if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
+                u32 amdkfd_size;
+
+                ioctl = &amdkfd_ioctls[nr];
+
+                amdkfd_size = _IOC_SIZE(ioctl->cmd);
+                usize = asize = _IOC_SIZE(cmd);
+                if (amdkfd_size > asize)
+                        asize = amdkfd_size;
+
+                cmd = ioctl->cmd;
+        } else
+                goto err_i1;
+
+        dev_dbg(kfd_device, "ioctl cmd 0x%x (#%d), arg 0x%lx\n", cmd, nr, arg);
 
         process = kfd_get_process(current);
-        if (IS_ERR(process))
-                return PTR_ERR(process);
+        if (IS_ERR(process)) {
+                dev_dbg(kfd_device, "no process\n");
+                goto err_i1;
+        }
 
-        switch (cmd) {
-        case KFD_IOC_GET_VERSION:
-                err = kfd_ioctl_get_version(filep, process, (void __user *)arg);
-                break;
-        case KFD_IOC_CREATE_QUEUE:
-                err = kfd_ioctl_create_queue(filep, process,
-                                                (void __user *)arg);
-                break;
-
-        case KFD_IOC_DESTROY_QUEUE:
-                err = kfd_ioctl_destroy_queue(filep, process,
-                                                (void __user *)arg);
-                break;
-
-        case KFD_IOC_SET_MEMORY_POLICY:
-                err = kfd_ioctl_set_memory_policy(filep, process,
-                                                (void __user *)arg);
-                break;
-
-        case KFD_IOC_GET_CLOCK_COUNTERS:
-                err = kfd_ioctl_get_clock_counters(filep, process,
-                                                (void __user *)arg);
-                break;
-
-        case KFD_IOC_GET_PROCESS_APERTURES:
-                err = kfd_ioctl_get_process_apertures(filep, process,
-                                                (void __user *)arg);
-                break;
-
-        case KFD_IOC_UPDATE_QUEUE:
-                err = kfd_ioctl_update_queue(filep, process,
-                                                (void __user *)arg);
-                break;
-
-        default:
-                dev_err(kfd_device,
-                        "unknown ioctl cmd 0x%x, arg 0x%lx)\n",
-                        cmd, arg);
-                err = -EINVAL;
-                break;
+        /* Do not trust userspace, use our own definition */
+        func = ioctl->func;
+
+        if (unlikely(!func)) {
+                dev_dbg(kfd_device, "no function\n");
+                retcode = -EINVAL;
+                goto err_i1;
         }
 
-        if (err < 0)
-                dev_err(kfd_device,
-                        "ioctl error %ld for ioctl cmd 0x%x (#%d)\n",
-                        err, cmd, _IOC_NR(cmd));
+        if (cmd & (IOC_IN | IOC_OUT)) {
+                if (asize <= sizeof(stack_kdata)) {
+                        kdata = stack_kdata;
+                } else {
+                        kdata = kmalloc(asize, GFP_KERNEL);
+                        if (!kdata) {
+                                retcode = -ENOMEM;
+                                goto err_i1;
+                        }
+                }
+                if (asize > usize)
+                        memset(kdata + usize, 0, asize - usize);
+        }
 
-        return err;
+        if (cmd & IOC_IN) {
+                if (copy_from_user(kdata, (void __user *)arg, usize) != 0) {
+                        retcode = -EFAULT;
+                        goto err_i1;
+                }
+        } else if (cmd & IOC_OUT) {
+                memset(kdata, 0, usize);
+        }
+
+        retcode = func(filep, process, kdata);
+
+        if (cmd & IOC_OUT)
+                if (copy_to_user((void __user *)arg, kdata, usize) != 0)
+                        retcode = -EFAULT;
+
+err_i1:
+        if (!ioctl)
+                dev_dbg(kfd_device, "invalid ioctl: pid=%d, cmd=0x%02x, nr=0x%02x\n",
+                          task_pid_nr(current), cmd, nr);
+
+        if (kdata != stack_kdata)
+                kfree(kdata);
+
+        if (retcode)
+                dev_dbg(kfd_device, "ret = %d\n", retcode);
+
+        return retcode;
 }
 
 static int kfd_mmap(struct file *filp, struct vm_area_struct *vma)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 924e90c072e5..9c8961d22360 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -161,6 +161,9 @@ static void deallocate_vmid(struct device_queue_manager *dqm,
 {
         int bit = qpd->vmid - KFD_VMID_START_OFFSET;
 
+        /* Release the vmid mapping */
+        set_pasid_vmid_mapping(dqm, 0, qpd->vmid);
+
         set_bit(bit, (unsigned long *)&dqm->vmid_bitmap);
         qpd->vmid = 0;
         q->properties.vmid = 0;
@@ -272,6 +275,18 @@ static int create_compute_queue_nocpsch(struct device_queue_manager *dqm,
                 return retval;
         }
 
+        pr_debug("kfd: loading mqd to hqd on pipe (%d) queue (%d)\n",
+                        q->pipe,
+                        q->queue);
+
+        retval = mqd->load_mqd(mqd, q->mqd, q->pipe,
+                        q->queue, q->properties.write_ptr);
+        if (retval != 0) {
+                deallocate_hqd(dqm, q);
+                mqd->uninit_mqd(mqd, q->mqd, q->mqd_mem_obj);
+                return retval;
+        }
+
         return 0;
 }
 
@@ -320,6 +335,7 @@ static int update_queue(struct device_queue_manager *dqm, struct queue *q)
 {
         int retval;
         struct mqd_manager *mqd;
+        bool prev_active = false;
 
         BUG_ON(!dqm || !q || !q->mqd);
 
@@ -330,10 +346,18 @@ static int update_queue(struct device_queue_manager *dqm, struct queue *q)
                 return -ENOMEM;
         }
 
-        retval = mqd->update_mqd(mqd, q->mqd, &q->properties);
         if (q->properties.is_active == true)
+                prev_active = true;
+
+        /*
+         *
+         * check active state vs. the previous state
+         * and modify counter accordingly
+         */
+        retval = mqd->update_mqd(mqd, q->mqd, &q->properties);
+        if ((q->properties.is_active == true) && (prev_active == false))
                 dqm->queue_count++;
-        else
+        else if ((q->properties.is_active == false) && (prev_active == true))
                 dqm->queue_count--;
 
         if (sched_policy != KFD_SCHED_POLICY_NO_HWS)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
index adc31474e786..4c3828cf45bf 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
@@ -184,7 +184,7 @@ static bool is_occupied(struct mqd_manager *mm, void *mqd,
                         uint32_t queue_id)
 {
 
-        return kfd2kgd->hqd_is_occupies(mm->dev->kgd, queue_address,
+        return kfd2kgd->hqd_is_occupied(mm->dev->kgd, queue_address,
                                         pipe_id, queue_id);
 
 }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c b/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c
index 71699ad97d74..4c25ef504f79 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c
@@ -32,7 +32,7 @@ int kfd_pasid_init(void)
 {
         pasid_limit = max_num_of_processes;
 
-        pasid_bitmap = kzalloc(BITS_TO_LONGS(pasid_limit), GFP_KERNEL);
+        pasid_bitmap = kcalloc(BITS_TO_LONGS(pasid_limit), sizeof(long), GFP_KERNEL);
         if (!pasid_bitmap)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index f9fb81e3bb09..a5edb29507e3 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -463,6 +463,24 @@ struct kfd_process {
         bool is_32bit_user_mode;
 };
 
+/**
+ * Ioctl function type.
+ *
+ * \param filep pointer to file structure.
+ * \param p amdkfd process pointer.
+ * \param data pointer to arg that was copied from user.
+ */
+typedef int amdkfd_ioctl_t(struct file *filep, struct kfd_process *p,
+                                void *data);
+
+struct amdkfd_ioctl_desc {
+        unsigned int cmd;
+        int flags;
+        amdkfd_ioctl_t *func;
+        unsigned int cmd_drv;
+        const char *name;
+};
+
 void kfd_process_create_wq(void);
 void kfd_process_destroy_wq(void);
 struct kfd_process *kfd_create_process(const struct task_struct *);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index b11792d7e70e..cca1708fd811 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -921,7 +921,7 @@ static int kfd_build_sysfs_node_tree(void)
         uint32_t i = 0;
 
         list_for_each_entry(dev, &topology_device_list, list) {
-                ret = kfd_build_sysfs_node_entry(dev, 0);
+                ret = kfd_build_sysfs_node_entry(dev, i);
                 if (ret < 0)
                         return ret;
                 i++;
diff --git a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
index 47b551970a14..96a512208fad 100644
--- a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
+++ b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
@@ -183,7 +183,7 @@ struct kfd2kgd_calls {
         int (*hqd_load)(struct kgd_dev *kgd, void *mqd, uint32_t pipe_id,
                         uint32_t queue_id, uint32_t __user *wptr);
 
-        bool (*hqd_is_occupies)(struct kgd_dev *kgd, uint64_t queue_address,
+        bool (*hqd_is_occupied)(struct kgd_dev *kgd, uint64_t queue_address,
                                 uint32_t pipe_id, uint32_t queue_id);
 
         int (*hqd_destroy)(struct kgd_dev *kgd, uint32_t reset_type,
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 70d0f0f06f1a..e9f891c432f8 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1756,8 +1756,6 @@ struct drm_i915_private {
          */
         struct workqueue_struct *dp_wq;
 
-        uint32_t bios_vgacntr;
-
         /* Abstract the submission mechanism (legacy ringbuffer or execlists) away */
         struct {
                 int (*do_execbuf)(struct drm_device *dev, struct drm_file *file,
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 52adcb680be3..c11603b4cf1d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1048,6 +1048,7 @@ int
 i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                       struct drm_file *file)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_i915_gem_pwrite *args = data;
         struct drm_i915_gem_object *obj;
         int ret;
@@ -1067,9 +1068,11 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                         return -EFAULT;
         }
 
+        intel_runtime_pm_get(dev_priv);
+
         ret = i915_mutex_lock_interruptible(dev);
         if (ret)
-                return ret;
+                goto put_rpm;
 
         obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
         if (&obj->base == NULL) {
@@ -1121,6 +1124,9 @@ out:
         drm_gem_object_unreference(&obj->base);
 unlock:
         mutex_unlock(&dev->struct_mutex);
+put_rpm:
+        intel_runtime_pm_put(dev_priv);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 996c2931c499..d0d3dfbe6d2a 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -3725,8 +3725,6 @@ static bool i8xx_handle_vblank(struct drm_device *dev,
         if ((iir & flip_pending) == 0)
                 goto check_page_flip;
 
-        intel_prepare_page_flip(dev, plane);
-
         /* We detect FlipDone by looking for the change in PendingFlip from '1'
          * to '0' on the following vblank, i.e. IIR has the Pendingflip
          * asserted following the MI_DISPLAY_FLIP, but ISR is deasserted, hence
@@ -3736,6 +3734,7 @@ static bool i8xx_handle_vblank(struct drm_device *dev,
         if (I915_READ16(ISR) & flip_pending)
                 goto check_page_flip;
 
+        intel_prepare_page_flip(dev, plane);
         intel_finish_page_flip(dev, pipe);
         return true;
 
@@ -3907,8 +3906,6 @@ static bool i915_handle_vblank(struct drm_device *dev,
         if ((iir & flip_pending) == 0)
                 goto check_page_flip;
 
-        intel_prepare_page_flip(dev, plane);
-
         /* We detect FlipDone by looking for the change in PendingFlip from '1'
          * to '0' on the following vblank, i.e. IIR has the Pendingflip
          * asserted following the MI_DISPLAY_FLIP, but ISR is deasserted, hence
@@ -3918,6 +3915,7 @@ static bool i915_handle_vblank(struct drm_device *dev,
         if (I915_READ(ISR) & flip_pending)
                 goto check_page_flip;
 
+        intel_prepare_page_flip(dev, plane);
         intel_finish_page_flip(dev, pipe);
         return true;
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index fb3e3d429191..e2af1383b179 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -13057,11 +13057,7 @@ static void i915_disable_vga(struct drm_device *dev)
         vga_put(dev->pdev, VGA_RSRC_LEGACY_IO);
         udelay(300);
 
-        /*
-         * Fujitsu-Siemens Lifebook S6010 (830) has problems resuming
-         * from S3 without preserving (some of?) the other bits.
-         */
-        I915_WRITE(vga_reg, dev_priv->bios_vgacntr | VGA_DISP_DISABLE);
+        I915_WRITE(vga_reg, VGA_DISP_DISABLE);
         POSTING_READ(vga_reg);
 }
 
@@ -13146,8 +13142,6 @@ void intel_modeset_init(struct drm_device *dev)
 
         intel_shared_dpll_init(dev);
 
-        /* save the BIOS value before clobbering it */
-        dev_priv->bios_vgacntr = I915_READ(i915_vgacntrl_reg(dev));
         /* Just disable it once at startup */
         i915_disable_vga(dev);
         intel_setup_outputs(dev);
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index f5a78d53e297..ac6da7102fbb 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -615,29 +615,6 @@ static void chv_pipe_power_well_disable(struct drm_i915_private *dev_priv,
                 vlv_power_sequencer_reset(dev_priv);
 }
 
-static void check_power_well_state(struct drm_i915_private *dev_priv,
-                                   struct i915_power_well *power_well)
-{
-        bool enabled = power_well->ops->is_enabled(dev_priv, power_well);
-
-        if (power_well->always_on || !i915.disable_power_well) {
-                if (!enabled)
-                        goto mismatch;
-
-                return;
-        }
-
-        if (enabled != (power_well->count > 0))
-                goto mismatch;
-
-        return;
-
-mismatch:
-        WARN(1, "state mismatch for '%s' (always_on %d hw state %d use-count %d disable_power_well %d\n",
-                  power_well->name, power_well->always_on, enabled,
-                  power_well->count, i915.disable_power_well);
-}
-
 /**
  * intel_display_power_get - grab a power domain reference
  * @dev_priv: i915 device instance
@@ -669,8 +646,6 @@ void intel_display_power_get(struct drm_i915_private *dev_priv,
                         power_well->ops->enable(dev_priv, power_well);
                         power_well->hw_enabled = true;
                 }
-
-                check_power_well_state(dev_priv, power_well);
         }
 
         power_domains->domain_use_count[domain]++;
@@ -709,8 +684,6 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
                         power_well->hw_enabled = false;
                         power_well->ops->disable(dev_priv, power_well);
                 }
-
-                check_power_well_state(dev_priv, power_well);
         }
 
         mutex_unlock(&power_domains->lock);
diff --git a/drivers/gpu/drm/nouveau/core/core/event.c b/drivers/gpu/drm/nouveau/core/core/event.c
index ff2b434b3db4..760947e380c9 100644
--- a/drivers/gpu/drm/nouveau/core/core/event.c
+++ b/drivers/gpu/drm/nouveau/core/core/event.c
@@ -26,7 +26,7 @@
 void
 nvkm_event_put(struct nvkm_event *event, u32 types, int index)
 {
-        BUG_ON(!spin_is_locked(&event->refs_lock));
+        assert_spin_locked(&event->refs_lock);
         while (types) {
                 int type = __ffs(types); types &= ~(1 << type);
                 if (--event->refs[index * event->types_nr + type] == 0) {
@@ -39,7 +39,7 @@ nvkm_event_put(struct nvkm_event *event, u32 types, int index)
 void
 nvkm_event_get(struct nvkm_event *event, u32 types, int index)
 {
-        BUG_ON(!spin_is_locked(&event->refs_lock));
+        assert_spin_locked(&event->refs_lock);
         while (types) {
                 int type = __ffs(types); types &= ~(1 << type);
                 if (++event->refs[index * event->types_nr + type] == 1) {
diff --git a/drivers/gpu/drm/nouveau/core/core/notify.c b/drivers/gpu/drm/nouveau/core/core/notify.c
index d1bcde55e9d7..839a32577680 100644
--- a/drivers/gpu/drm/nouveau/core/core/notify.c
+++ b/drivers/gpu/drm/nouveau/core/core/notify.c
@@ -98,7 +98,7 @@ nvkm_notify_send(struct nvkm_notify *notify, void *data, u32 size)
         struct nvkm_event *event = notify->event;
         unsigned long flags;
 
-        BUG_ON(!spin_is_locked(&event->list_lock));
+        assert_spin_locked(&event->list_lock);
         BUG_ON(size != notify->size);
 
         spin_lock_irqsave(&event->refs_lock, flags);
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nve0.c b/drivers/gpu/drm/nouveau/core/engine/device/nve0.c
index 674da1f095b2..732922690653 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nve0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nve0.c
@@ -249,6 +249,39 @@ nve0_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_ENGINE_PPP    ] = &nvc0_ppp_oclass;
                 device->oclass[NVDEV_ENGINE_PERFMON] = &nvf0_perfmon_oclass;
                 break;
+        case 0x106:
+                device->cname = "GK208B";
+                device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
+                device->oclass[NVDEV_SUBDEV_GPIO   ] =  nve0_gpio_oclass;
+                device->oclass[NVDEV_SUBDEV_I2C    ] =  nve0_i2c_oclass;
+                device->oclass[NVDEV_SUBDEV_FUSE   ] = &gf100_fuse_oclass;
+                device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nve0_clock_oclass;
+                device->oclass[NVDEV_SUBDEV_THERM  ] = &nvd0_therm_oclass;
+                device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
+                device->oclass[NVDEV_SUBDEV_DEVINIT] =  nvc0_devinit_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  gk20a_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_BUS    ] =  nvc0_bus_oclass;
+                device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
+                device->oclass[NVDEV_SUBDEV_FB     ] =  nve0_fb_oclass;
+                device->oclass[NVDEV_SUBDEV_LTC    ] =  gk104_ltc_oclass;
+                device->oclass[NVDEV_SUBDEV_IBUS   ] = &nve0_ibus_oclass;
+                device->oclass[NVDEV_SUBDEV_INSTMEM] =  nv50_instmem_oclass;
+                device->oclass[NVDEV_SUBDEV_VM     ] = &nvc0_vmmgr_oclass;
+                device->oclass[NVDEV_SUBDEV_BAR    ] = &nvc0_bar_oclass;
+                device->oclass[NVDEV_SUBDEV_PWR    ] =  nv108_pwr_oclass;
+                device->oclass[NVDEV_SUBDEV_VOLT   ] = &nv40_volt_oclass;
+                device->oclass[NVDEV_ENGINE_DMAOBJ ] =  nvd0_dmaeng_oclass;
+                device->oclass[NVDEV_ENGINE_FIFO   ] =  nv108_fifo_oclass;
+                device->oclass[NVDEV_ENGINE_SW     ] =  nvc0_software_oclass;
+                device->oclass[NVDEV_ENGINE_GR     ] =  nv108_graph_oclass;
+                device->oclass[NVDEV_ENGINE_DISP   ] =  nvf0_disp_oclass;
+                device->oclass[NVDEV_ENGINE_COPY0  ] = &nve0_copy0_oclass;
+                device->oclass[NVDEV_ENGINE_COPY1  ] = &nve0_copy1_oclass;
+                device->oclass[NVDEV_ENGINE_COPY2  ] = &nve0_copy2_oclass;
+                device->oclass[NVDEV_ENGINE_BSP    ] = &nve0_bsp_oclass;
+                device->oclass[NVDEV_ENGINE_VP     ] = &nve0_vp_oclass;
+                device->oclass[NVDEV_ENGINE_PPP    ] = &nvc0_ppp_oclass;
+                break;
         case 0x108:
                 device->cname = "GK208";
                 device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/shadowramin.c b/drivers/gpu/drm/nouveau/core/subdev/bios/shadowramin.c
index 5e58bba0dd5c..a7a890fad1e5 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/shadowramin.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/shadowramin.c
@@ -44,8 +44,10 @@ static void
 pramin_fini(void *data)
 {
         struct priv *priv = data;
-        nv_wr32(priv->bios, 0x001700, priv->bar0);
-        kfree(priv);
+        if (priv) {
+                nv_wr32(priv->bios, 0x001700, priv->bar0);
+                kfree(priv);
+        }
 }
 
 static void *
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvaa.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvaa.c
index 00f2ca7e44a5..033a8e999497 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvaa.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvaa.c
@@ -24,34 +24,71 @@
 
 #include "nv50.h"
 
+struct nvaa_ram_priv {
+        struct nouveau_ram base;
+        u64 poller_base;
+};
+
 static int
 nvaa_ram_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
               struct nouveau_oclass *oclass, void *data, u32 datasize,
               struct nouveau_object **pobject)
 {
-        const u32 rsvd_head = ( 256 * 1024) >> 12; /* vga memory */
-        const u32 rsvd_tail = (1024 * 1024) >> 12; /* vbios etc */
+        u32 rsvd_head = ( 256 * 1024); /* vga memory */
+        u32 rsvd_tail = (1024 * 1024); /* vbios etc */
         struct nouveau_fb *pfb = nouveau_fb(parent);
-        struct nouveau_ram *ram;
+        struct nvaa_ram_priv *priv;
         int ret;
 
-        ret = nouveau_ram_create(parent, engine, oclass, &ram);
-        *pobject = nv_object(ram);
+        ret = nouveau_ram_create(parent, engine, oclass, &priv);
+        *pobject = nv_object(priv);
         if (ret)
                 return ret;
 
-        ram->size = nv_rd32(pfb, 0x10020c);
-        ram->size = (ram->size & 0xffffff00) | ((ram->size & 0x000000ff) << 32);
+        priv->base.type   = NV_MEM_TYPE_STOLEN;
+        priv->base.stolen = (u64)nv_rd32(pfb, 0x100e10) << 12;
+        priv->base.size   = (u64)nv_rd32(pfb, 0x100e14) << 12;
 
-        ret = nouveau_mm_init(&pfb->vram, rsvd_head, (ram->size >> 12) -
-                              (rsvd_head + rsvd_tail), 1);
+        rsvd_tail += 0x1000;
+        priv->poller_base = priv->base.size - rsvd_tail;
+
+        ret = nouveau_mm_init(&pfb->vram, rsvd_head >> 12,
+                              (priv->base.size  - (rsvd_head + rsvd_tail)) >> 12,
+                              1);
         if (ret)
                 return ret;
 
-        ram->type   = NV_MEM_TYPE_STOLEN;
-        ram->stolen = (u64)nv_rd32(pfb, 0x100e10) << 12;
-        ram->get = nv50_ram_get;
-        ram->put = nv50_ram_put;
+        priv->base.get = nv50_ram_get;
+        priv->base.put = nv50_ram_put;
+        return 0;
+}
+
+static int
+nvaa_ram_init(struct nouveau_object *object)
+{
+        struct nouveau_fb *pfb = nouveau_fb(object);
+        struct nvaa_ram_priv *priv = (void *)object;
+        int ret;
+        u64 dniso, hostnb, flush;
+
+        ret = nouveau_ram_init(&priv->base);
+        if (ret)
+                return ret;
+
+        dniso  = ((priv->base.size - (priv->poller_base + 0x00)) >> 5) - 1;
+        hostnb = ((priv->base.size - (priv->poller_base + 0x20)) >> 5) - 1;
+        flush  = ((priv->base.size - (priv->poller_base + 0x40)) >> 5) - 1;
+
+        /* Enable NISO poller for various clients and set their associated
+         * read address, only for MCP77/78 and MCP79/7A. (fd#25701)
+         */
+        nv_wr32(pfb, 0x100c18, dniso);
+        nv_mask(pfb, 0x100c14, 0x00000000, 0x00000001);
+        nv_wr32(pfb, 0x100c1c, hostnb);
+        nv_mask(pfb, 0x100c14, 0x00000000, 0x00000002);
+        nv_wr32(pfb, 0x100c24, flush);
+        nv_mask(pfb, 0x100c14, 0x00000000, 0x00010000);
+
         return 0;
 }
 
@@ -60,7 +97,7 @@ nvaa_ram_oclass = {
         .ofuncs = &(struct nouveau_ofuncs) {
                 .ctor = nvaa_ram_ctor,
                 .dtor = _nouveau_ram_dtor,
-                .init = _nouveau_ram_init,
+                .init = nvaa_ram_init,
                 .fini = _nouveau_ram_fini,
         },
 };
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
index a75c35ccf25c..165401c4045c 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
@@ -24,13 +24,6 @@
 
 #include "nv04.h"
 
-static void
-nv4c_mc_msi_rearm(struct nouveau_mc *pmc)
-{
-        struct nv04_mc_priv *priv = (void *)pmc;
-        nv_wr08(priv, 0x088050, 0xff);
-}
-
 struct nouveau_oclass *
 nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
         .base.handle = NV_SUBDEV(MC, 0x4c),
@@ -41,5 +34,4 @@ nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
                 .fini = _nouveau_mc_fini,
         },
         .intr = nv04_mc_intr,
-        .msi_rearm = nv4c_mc_msi_rearm,
 }.base;
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 21ec561edc99..bba2960d3dfb 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -1572,8 +1572,10 @@ nouveau_ttm_tt_unpopulate(struct ttm_tt *ttm)
          * so use the DMA API for them.
          */
         if (!nv_device_is_cpu_coherent(device) &&
-            ttm->caching_state == tt_uncached)
+            ttm->caching_state == tt_uncached) {
                 ttm_dma_unpopulate(ttm_dma, dev->dev);
+                return;
+        }
 
 #if __OS_HAS_AGP
         if (drm->agp.stat == ENABLED) {
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 42c34babc2e5..bf0f9e21d714 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -36,7 +36,14 @@ void
 nouveau_gem_object_del(struct drm_gem_object *gem)
 {
         struct nouveau_bo *nvbo = nouveau_gem_object(gem);
+        struct nouveau_drm *drm = nouveau_bdev(nvbo->bo.bdev);
         struct ttm_buffer_object *bo = &nvbo->bo;
+        struct device *dev = drm->dev->dev;
+        int ret;
+
+        ret = pm_runtime_get_sync(dev);
+        if (WARN_ON(ret < 0 && ret != -EACCES))
+                return;
 
         if (gem->import_attach)
                 drm_prime_gem_destroy(gem, nvbo->bo.sg);
@@ -46,6 +53,9 @@ nouveau_gem_object_del(struct drm_gem_object *gem)
         /* reset filp so nouveau_bo_del_ttm() can test for it */
         gem->filp = NULL;
         ttm_bo_unref(&bo);
+
+        pm_runtime_mark_last_busy(dev);
+        pm_runtime_put_autosuspend(dev);
 }
 
 int
@@ -53,7 +63,9 @@ nouveau_gem_object_open(struct drm_gem_object *gem, struct drm_file *file_priv)
 {
         struct nouveau_cli *cli = nouveau_cli(file_priv);
         struct nouveau_bo *nvbo = nouveau_gem_object(gem);
+        struct nouveau_drm *drm = nouveau_bdev(nvbo->bo.bdev);
         struct nouveau_vma *vma;
+        struct device *dev = drm->dev->dev;
         int ret;
 
         if (!cli->vm)
@@ -71,11 +83,16 @@ nouveau_gem_object_open(struct drm_gem_object *gem, struct drm_file *file_priv)
                         goto out;
                 }
 
+                ret = pm_runtime_get_sync(dev);
+                if (ret < 0 && ret != -EACCES)
+                        goto out;
+
                 ret = nouveau_bo_vma_add(nvbo, cli->vm, vma);
-                if (ret) {
+                if (ret)
                         kfree(vma);
-                        goto out;
-                }
+
+                pm_runtime_mark_last_busy(dev);
+                pm_runtime_put_autosuspend(dev);
         } else {
                 vma->refcount++;
         }
@@ -129,6 +146,8 @@ nouveau_gem_object_close(struct drm_gem_object *gem, struct drm_file *file_priv)
 {
         struct nouveau_cli *cli = nouveau_cli(file_priv);
         struct nouveau_bo *nvbo = nouveau_gem_object(gem);
+        struct nouveau_drm *drm = nouveau_bdev(nvbo->bo.bdev);
+        struct device *dev = drm->dev->dev;
         struct nouveau_vma *vma;
         int ret;
 
@@ -141,8 +160,14 @@ nouveau_gem_object_close(struct drm_gem_object *gem, struct drm_file *file_priv)
 
         vma = nouveau_bo_vma_find(nvbo, cli->vm);
         if (vma) {
-                if (--vma->refcount == 0)
-                        nouveau_gem_object_unmap(nvbo, vma);
+                if (--vma->refcount == 0) {
+                        ret = pm_runtime_get_sync(dev);
+                        if (!WARN_ON(ret < 0 && ret != -EACCES)) {
+                                nouveau_gem_object_unmap(nvbo, vma);
+                                pm_runtime_mark_last_busy(dev);
+                                pm_runtime_put_autosuspend(dev);
+                        }
+                }
         }
         ttm_bo_unreserve(&nvbo->bo);
 }
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index d59ec491dbb9..ed644a4f6f57 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1851,10 +1851,9 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                                 return pll;
                 }
                 /* otherwise, pick one of the plls */
-                if ((rdev->family == CHIP_KAVERI) ||
-                    (rdev->family == CHIP_KABINI) ||
+                if ((rdev->family == CHIP_KABINI) ||
                     (rdev->family == CHIP_MULLINS)) {
-                        /* KB/KV/ML has PPLL1 and PPLL2 */
+                        /* KB/ML has PPLL1 and PPLL2 */
                         pll_in_use = radeon_get_pll_use_mask(crtc);
                         if (!(pll_in_use & (1 << ATOM_PPLL2)))
                                 return ATOM_PPLL2;
@@ -1863,7 +1862,7 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                         DRM_ERROR("unable to allocate a PPLL\n");
                         return ATOM_PPLL_INVALID;
                 } else {
-                        /* CI has PPLL0, PPLL1, and PPLL2 */
+                        /* CI/KV has PPLL0, PPLL1, and PPLL2 */
                         pll_in_use = radeon_get_pll_use_mask(crtc);
                         if (!(pll_in_use & (1 << ATOM_PPLL2)))
                                 return ATOM_PPLL2;
@@ -2155,6 +2154,7 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
         case ATOM_PPLL0:
                 /* disable the ppll */
                 if ((rdev->family == CHIP_ARUBA) ||
+                    (rdev->family == CHIP_KAVERI) ||
                     (rdev->family == CHIP_BONAIRE) ||
                     (rdev->family == CHIP_HAWAII))
                         atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id,
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 11ba9d21b89b..db42a670f995 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -492,6 +492,10 @@ int radeon_dp_mode_valid_helper(struct drm_connector *connector,
         struct radeon_connector_atom_dig *dig_connector;
         int dp_clock;
 
+        if ((mode->clock > 340000) &&
+            (!radeon_connector_is_dp12_capable(connector)))
+                return MODE_CLOCK_HIGH;
+
         if (!radeon_connector->con_priv)
                 return MODE_CLOCK_HIGH;
         dig_connector = radeon_connector->con_priv;
diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
index ba85986febea..03003f8a6de6 100644
--- a/drivers/gpu/drm/radeon/cikd.h
+++ b/drivers/gpu/drm/radeon/cikd.h
@@ -2156,4 +2156,6 @@
 #define ATC_VM_APERTURE1_HIGH_ADDR                              0x330Cu
 #define ATC_VM_APERTURE1_LOW_ADDR                               0x3304u
 
+#define IH_VMID_0_LUT                                           0x3D40u
+
 #endif
diff --git a/drivers/gpu/drm/radeon/dce3_1_afmt.c b/drivers/gpu/drm/radeon/dce3_1_afmt.c
index 2fe8cfc966d9..bafdf92a5732 100644
--- a/drivers/gpu/drm/radeon/dce3_1_afmt.c
+++ b/drivers/gpu/drm/radeon/dce3_1_afmt.c
@@ -103,7 +103,7 @@ static void dce3_2_afmt_write_sad_regs(struct drm_encoder *encoder)
         }
 
         sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                 DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
                 return;
         }
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 9b42001295ba..e3e9c10cfba9 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2745,13 +2745,11 @@ int kv_dpm_init(struct radeon_device *rdev)
         pi->enable_auto_thermal_throttling = true;
         pi->disable_nb_ps3_in_battery = false;
         if (radeon_bapm == -1) {
-                /* There are stability issues reported on with
-                 * bapm enabled on an asrock system.
-                 */
-                if (rdev->pdev->subsystem_vendor == 0x1849)
-                        pi->bapm_enable = false;
-                else
+                /* only enable bapm on KB, ML by default */
+                if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
                         pi->bapm_enable = true;
+                else
+                        pi->bapm_enable = false;
         } else if (radeon_bapm == 0) {
                 pi->bapm_enable = false;
         } else {
diff --git a/drivers/gpu/drm/radeon/radeon_kfd.c b/drivers/gpu/drm/radeon/radeon_kfd.c
index 242fd8b1b221..8bf87f1203cc 100644
--- a/drivers/gpu/drm/radeon/radeon_kfd.c
+++ b/drivers/gpu/drm/radeon/radeon_kfd.c
@@ -72,7 +72,7 @@ static int kgd_init_pipeline(struct kgd_dev *kgd, uint32_t pipe_id,
 static int kgd_hqd_load(struct kgd_dev *kgd, void *mqd, uint32_t pipe_id,
                         uint32_t queue_id, uint32_t __user *wptr);
 
-static bool kgd_hqd_is_occupies(struct kgd_dev *kgd, uint64_t queue_address,
+static bool kgd_hqd_is_occupied(struct kgd_dev *kgd, uint64_t queue_address,
                                 uint32_t pipe_id, uint32_t queue_id);
 
 static int kgd_hqd_destroy(struct kgd_dev *kgd, uint32_t reset_type,
@@ -92,7 +92,7 @@ static const struct kfd2kgd_calls kfd2kgd = {
         .init_memory = kgd_init_memory,
         .init_pipeline = kgd_init_pipeline,
         .hqd_load = kgd_hqd_load,
-        .hqd_is_occupies = kgd_hqd_is_occupies,
+        .hqd_is_occupied = kgd_hqd_is_occupied,
         .hqd_destroy = kgd_hqd_destroy,
         .get_fw_version = get_fw_version
 };
@@ -101,6 +101,7 @@ static const struct kgd2kfd_calls *kgd2kfd;
 
 bool radeon_kfd_init(void)
 {
+#if defined(CONFIG_HSA_AMD_MODULE)
         bool (*kgd2kfd_init_p)(unsigned, const struct kfd2kgd_calls*,
                                 const struct kgd2kfd_calls**);
 
@@ -117,6 +118,17 @@ bool radeon_kfd_init(void)
         }
 
         return true;
+#elif defined(CONFIG_HSA_AMD)
+        if (!kgd2kfd_init(KFD_INTERFACE_VERSION, &kfd2kgd, &kgd2kfd)) {
+                kgd2kfd = NULL;
+
+                return false;
+        }
+
+        return true;
+#else
+        return false;
+#endif
 }
 
 void radeon_kfd_fini(void)
@@ -378,6 +390,10 @@ static int kgd_set_pasid_vmid_mapping(struct kgd_dev *kgd, unsigned int pasid,
                 cpu_relax();
         write_register(kgd, ATC_VMID_PASID_MAPPING_UPDATE_STATUS, 1U << vmid);
 
+        /* Mapping vmid to pasid also for IH block */
+        write_register(kgd, IH_VMID_0_LUT + vmid * sizeof(uint32_t),
+                        pasid_mapping);
+
         return 0;
 }
 
@@ -517,7 +533,7 @@ static int kgd_hqd_load(struct kgd_dev *kgd, void *mqd, uint32_t pipe_id,
         return 0;
 }
 
-static bool kgd_hqd_is_occupies(struct kgd_dev *kgd, uint64_t queue_address,
+static bool kgd_hqd_is_occupied(struct kgd_dev *kgd, uint64_t queue_address,
                                 uint32_t pipe_id, uint32_t queue_id)
 {
         uint32_t act;
@@ -556,6 +572,7 @@ static int kgd_hqd_destroy(struct kgd_dev *kgd, uint32_t reset_type,
                 if (timeout == 0) {
                         pr_err("kfd: cp queue preemption time out (%dms)\n",
                                 temp);
+                        release_queue(kgd);
                         return -ETIME;
                 }
                 msleep(20);
diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
index 535403e0c8a2..15aee723db77 100644
--- a/drivers/gpu/drm/radeon/radeon_state.c
+++ b/drivers/gpu/drm/radeon/radeon_state.c
@@ -1703,7 +1703,7 @@ static int radeon_cp_dispatch_texture(struct drm_device * dev,
         u32 format;
         u32 *buffer;
         const u8 __user *data;
-        int size, dwords, tex_width, blit_width, spitch;
+        unsigned int size, dwords, tex_width, blit_width, spitch;
         u32 height;
         int i;
         u32 texpitch, microtile;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 230b6f887cd8..dfdc26970022 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -27,7 +27,8 @@ if HID
 
 config HID_BATTERY_STRENGTH
         bool "Battery level reporting for HID devices"
-        depends on HID && POWER_SUPPLY && HID = POWER_SUPPLY
+        depends on HID
+        select POWER_SUPPLY
         default n
         ---help---
         This option adds support of reporting battery strength (for HID devices
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index c3d0ac1a0988..8b638792cb43 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1805,6 +1805,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LCPOWER, USB_DEVICE_ID_LCPOWER_LC1000 ) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 7460f3402298..9243359c1821 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -526,6 +526,7 @@
 #define USB_DEVICE_ID_KYE_GPEN_560      0x5003
 #define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010
 #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X        0x5011
+#define USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2      0x501a
 #define USB_DEVICE_ID_KYE_EASYPEN_M610X 0x5013
 
 #define USB_VENDOR_ID_LABTEC            0x1020
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index e0a0f06ac5ef..9505605b6e22 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -312,6 +312,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
                                USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI),
           HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
+                               USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO),
+          HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
                 USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI),
           HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
         {}
diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
index b92bf01a1ae8..158fcf577fae 100644
--- a/drivers/hid/hid-kye.c
+++ b/drivers/hid/hid-kye.c
@@ -323,6 +323,7 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 }
                 break;
         case USB_DEVICE_ID_KYE_MOUSEPEN_I608X:
+        case USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2:
                 if (*rsize == MOUSEPEN_I608X_RDESC_ORIG_SIZE) {
                         rdesc = mousepen_i608x_rdesc_fixed;
                         *rsize = sizeof(mousepen_i608x_rdesc_fixed);
@@ -415,6 +416,7 @@ static int kye_probe(struct hid_device *hdev, const struct hid_device_id *id)
         switch (id->product) {
         case USB_DEVICE_ID_KYE_EASYPEN_I405X:
         case USB_DEVICE_ID_KYE_MOUSEPEN_I608X:
+        case USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2:
         case USB_DEVICE_ID_KYE_EASYPEN_M610X:
                 ret = kye_tablet_enable(hdev);
                 if (ret) {
@@ -446,6 +448,8 @@ static const struct hid_device_id kye_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
                                 USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+                                USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
                                 USB_DEVICE_ID_KYE_EASYPEN_M610X) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
                                 USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index c917ab61aafa..5bc6d80d5be7 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -962,10 +962,24 @@ static int logi_dj_raw_event(struct hid_device *hdev,
 
         switch (data[0]) {
         case REPORT_ID_DJ_SHORT:
+                if (size != DJREPORT_SHORT_LENGTH) {
+                        dev_err(&hdev->dev, "DJ report of bad size (%d)", size);
+                        return false;
+                }
                 return logi_dj_dj_event(hdev, report, data, size);
         case REPORT_ID_HIDPP_SHORT:
-                /* intentional fallthrough */
+                if (size != HIDPP_REPORT_SHORT_LENGTH) {
+                        dev_err(&hdev->dev,
+                                "Short HID++ report of bad size (%d)", size);
+                        return false;
+                }
+                return logi_dj_hidpp_event(hdev, report, data, size);
         case REPORT_ID_HIDPP_LONG:
+                if (size != HIDPP_REPORT_LONG_LENGTH) {
+                        dev_err(&hdev->dev,
+                                "Long HID++ report of bad size (%d)", size);
+                        return false;
+                }
                 return logi_dj_hidpp_event(hdev, report, data, size);
         }
 
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 2f420c0b6609..a93cefe0e522 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -282,6 +282,33 @@ static inline bool hidpp_report_is_connect_event(struct hidpp_report *report)
                 (report->rap.sub_id == 0x41);
 }
 
+/**
+ * hidpp_prefix_name() prefixes the current given name with "Logitech ".
+ */
+static void hidpp_prefix_name(char **name, int name_length)
+{
+#define PREFIX_LENGTH 9 /* "Logitech " */
+
+        int new_length;
+        char *new_name;
+
+        if (name_length > PREFIX_LENGTH &&
+            strncmp(*name, "Logitech ", PREFIX_LENGTH) == 0)
+                /* The prefix has is already in the name */
+                return;
+
+        new_length = PREFIX_LENGTH + name_length;
+        new_name = kzalloc(new_length, GFP_KERNEL);
+        if (!new_name)
+                return;
+
+        snprintf(new_name, new_length, "Logitech %s", *name);
+
+        kfree(*name);
+
+        *name = new_name;
+}
+
 /* -------------------------------------------------------------------------- */
 /* HIDP++ 1.0 commands                                                        */
 /* -------------------------------------------------------------------------- */
@@ -321,6 +348,10 @@ static char *hidpp_get_unifying_name(struct hidpp_device *hidpp_dev)
                 return NULL;
 
         memcpy(name, &response.rap.params[2], len);
+
+        /* include the terminating '\0' */
+        hidpp_prefix_name(&name, len + 1);
+
         return name;
 }
 
@@ -498,6 +529,9 @@ static char *hidpp_get_device_name(struct hidpp_device *hidpp)
                 index += ret;
         }
 
+        /* include the terminating '\0' */
+        hidpp_prefix_name(&name, __name_length + 1);
+
         return name;
 }
 
@@ -794,18 +828,25 @@ static int wtp_raw_event(struct hid_device *hdev, u8 *data, int size)
 
         switch (data[0]) {
         case 0x02:
+                if (size < 2) {
+                        hid_err(hdev, "Received HID report of bad size (%d)",
+                                size);
+                        return 1;
+                }
                 if (hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS) {
                         input_event(wd->input, EV_KEY, BTN_LEFT,
                                         !!(data[1] & 0x01));
                         input_event(wd->input, EV_KEY, BTN_RIGHT,
                                         !!(data[1] & 0x02));
                         input_sync(wd->input);
+                        return 0;
                 } else {
                         if (size < 21)
                                 return 1;
                         return wtp_mouse_raw_xy_event(hidpp, &data[7]);
                 }
         case REPORT_ID_HIDPP_LONG:
+                /* size is already checked in hidpp_raw_event. */
                 if ((report->fap.feature_index != wd->mt_feature_index) ||
                     (report->fap.funcindex_clientid != EVENT_TOUCHPAD_RAW_XY))
                         return 1;
diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
index 1a07e07d99a0..47d7e74231e5 100644
--- a/drivers/hid/hid-roccat-pyra.c
+++ b/drivers/hid/hid-roccat-pyra.c
@@ -35,6 +35,8 @@ static struct class *pyra_class;
 static void profile_activated(struct pyra_device *pyra,
                 unsigned int new_profile)
 {
+        if (new_profile >= ARRAY_SIZE(pyra->profile_settings))
+                return;
         pyra->actual_profile = new_profile;
         pyra->actual_cpi = pyra->profile_settings[pyra->actual_profile].y_cpi;
 }
@@ -257,9 +259,11 @@ static ssize_t pyra_sysfs_write_settings(struct file *fp,
         if (off != 0 || count != PYRA_SIZE_SETTINGS)
                 return -EINVAL;
 
-        mutex_lock(&pyra->pyra_lock);
-
         settings = (struct pyra_settings const *)buf;
+        if (settings->startup_profile >= ARRAY_SIZE(pyra->profile_settings))
+                return -EINVAL;
+
+        mutex_lock(&pyra->pyra_lock);
 
         retval = pyra_set_settings(usb_dev, settings);
         if (retval) {
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index d32037cbf9db..d43e967e7533 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -706,12 +706,7 @@ static int i2c_hid_start(struct hid_device *hid)
 
 static void i2c_hid_stop(struct hid_device *hid)
 {
-        struct i2c_client *client = hid->driver_data;
-        struct i2c_hid *ihid = i2c_get_clientdata(client);
-
         hid->claimed = 0;
-
-        i2c_hid_free_buffers(ihid);
 }
 
 static int i2c_hid_open(struct hid_device *hid)
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index dc89be90b35e..b27b3d33ebab 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -124,6 +124,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 1232336b960e..40dfbc0444c0 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4029,14 +4029,6 @@ static int device_notifier(struct notifier_block *nb,
         if (action != BUS_NOTIFY_REMOVED_DEVICE)
                 return 0;
 
-        /*
-         * If the device is still attached to a device driver we can't
-         * tear down the domain yet as DMA mappings may still be in use.
-         * Wait for the BUS_NOTIFY_UNBOUND_DRIVER event to do that.
-         */
-        if (action == BUS_NOTIFY_DEL_DEVICE && dev->driver != NULL)
-                return 0;
-
         domain = find_domain(dev);
         if (!domain)
                 return 0;
@@ -4428,6 +4420,10 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
                                 domain_remove_one_dev_info(old_domain, dev);
                         else
                                 domain_remove_dev_info(old_domain);
+
+                        if (!domain_type_is_vm_or_si(old_domain) &&
+                             list_empty(&old_domain->devices))
+                                domain_exit(old_domain);
                 }
         }
 
diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
index 68dfb0fd5ee9..748693192c20 100644
--- a/drivers/iommu/ipmmu-vmsa.c
+++ b/drivers/iommu/ipmmu-vmsa.c
@@ -558,7 +558,7 @@ static pmd_t *ipmmu_alloc_pmd(struct ipmmu_vmsa_device *mmu, pgd_t *pgd,
 
 static u64 ipmmu_page_prot(unsigned int prot, u64 type)
 {
-        u64 pgprot = ARM_VMSA_PTE_XN | ARM_VMSA_PTE_nG | ARM_VMSA_PTE_AF
+        u64 pgprot = ARM_VMSA_PTE_nG | ARM_VMSA_PTE_AF
                    | ARM_VMSA_PTE_SH_IS | ARM_VMSA_PTE_AP_UNPRIV
                    | ARM_VMSA_PTE_NS | type;
 
@@ -568,8 +568,8 @@ static u64 ipmmu_page_prot(unsigned int prot, u64 type)
         if (prot & IOMMU_CACHE)
                 pgprot |= IMMAIR_ATTR_IDX_WBRWA << ARM_VMSA_PTE_ATTRINDX_SHIFT;
 
-        if (prot & IOMMU_EXEC)
-                pgprot &= ~ARM_VMSA_PTE_XN;
+        if (prot & IOMMU_NOEXEC)
+                pgprot |= ARM_VMSA_PTE_XN;
         else if (!(prot & (IOMMU_READ | IOMMU_WRITE)))
                 /* If no access create a faulting entry to avoid TLB fills. */
                 pgprot &= ~ARM_VMSA_PTE_PAGE;
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index b2023af384b9..6a8b1ec4a48a 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1009,7 +1009,6 @@ static struct platform_driver rk_iommu_driver = {
         .remove = rk_iommu_remove,
         .driver = {
                    .name = "rk_iommu",
-                   .owner = THIS_MODULE,
                    .of_match_table = of_match_ptr(rk_iommu_dt_ids),
         },
 };
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 1fcd5568a352..f3470d96837a 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -850,8 +850,10 @@ static int emac_probe(struct platform_device *pdev)
         }
 
         db->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(db->clk))
+        if (IS_ERR(db->clk)) {
+                ret = PTR_ERR(db->clk);
                 goto out;
+        }
 
         clk_prepare_enable(db->clk);
 
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index 3498760dc22a..760c72c6e2ac 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -1170,10 +1170,6 @@ tx_request_irq_error:
 init_error:
         free_skbufs(dev);
 alloc_skbuf_error:
-        if (priv->phydev) {
-                phy_disconnect(priv->phydev);
-                priv->phydev = NULL;
-        }
 phy_error:
         return ret;
 }
@@ -1186,12 +1182,9 @@ static int tse_shutdown(struct net_device *dev)
         int ret;
         unsigned long int flags;
 
-        /* Stop and disconnect the PHY */
-        if (priv->phydev) {
+        /* Stop the PHY */
+        if (priv->phydev)
                 phy_stop(priv->phydev);
-                phy_disconnect(priv->phydev);
-                priv->phydev = NULL;
-        }
 
         netif_stop_queue(dev);
         napi_disable(&priv->napi);
@@ -1525,6 +1518,10 @@ err_free_netdev:
 static int altera_tse_remove(struct platform_device *pdev)
 {
         struct net_device *ndev = platform_get_drvdata(pdev);
+        struct altera_tse_private *priv = netdev_priv(ndev);
+
+        if (priv->phydev)
+                phy_disconnect(priv->phydev);
 
         platform_set_drvdata(pdev, NULL);
         altera_tse_mdio_destroy(ndev);
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 705f334ebb85..b29e027c476e 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1616,7 +1616,7 @@ static int enic_open(struct net_device *netdev)
                 if (vnic_rq_desc_used(&enic->rq[i]) == 0) {
                         netdev_err(netdev, "Unable to alloc receive buffers\n");
                         err = -ENOMEM;
-                        goto err_out_notify_unset;
+                        goto err_out_free_rq;
                 }
         }
 
@@ -1649,7 +1649,9 @@ static int enic_open(struct net_device *netdev)
 
         return 0;
 
-err_out_notify_unset:
+err_out_free_rq:
+        for (i = 0; i < enic->rq_count; i++)
+                vnic_rq_clean(&enic->rq[i], enic_free_rq_buf);
         enic_dev_notify_unset(enic);
 err_out_free_intr:
         enic_free_intr(enic);
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index 781065eb5431..e9c3a87e5b11 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -1543,7 +1543,7 @@ static int e100_phy_init(struct nic *nic)
                 mdio_write(netdev, nic->mii.phy_id, MII_BMCR, bmcr);
         } else if ((nic->mac >= mac_82550_D102) || ((nic->flags & ich) &&
            (mdio_read(netdev, nic->mii.phy_id, MII_TPISTATUS) & 0x8000) &&
-                !(nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) {
+                (nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) {
                 /* enable/disable MDI/MDI-X auto-switching. */
                 mdio_write(netdev, nic->mii.phy_id, MII_NCONFIG,
                                 nic->mii.force_media ? 0 : NCONFIG_AUTO_SWITCH);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
index 433a55886ad2..cb0de455683e 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
@@ -829,7 +829,7 @@ static void i40e_dbg_dump_desc(int cnt, int vsi_seid, int ring_id, int desc_n,
                 if (desc_n >= ring->count || desc_n < 0) {
                         dev_info(&pf->pdev->dev,
                                  "descriptor %d not found\n", desc_n);
-                        return;
+                        goto out;
                 }
                 if (!is_rx_ring) {
                         txd = I40E_TX_DESC(ring, desc_n);
@@ -855,6 +855,8 @@ static void i40e_dbg_dump_desc(int cnt, int vsi_seid, int ring_id, int desc_n,
         } else {
                 dev_info(&pf->pdev->dev, "dump desc rx/tx <vsi_seid> <ring_id> [<desc_n>]\n");
         }
+
+out:
         kfree(ring);
 }
 
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index 051ea94bdcd3..0f69ef81751a 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -1125,7 +1125,7 @@ static s32 igb_acquire_swfw_sync_82575(struct e1000_hw *hw, u16 mask)
         u32 swmask = mask;
         u32 fwmask = mask << 16;
         s32 ret_val = 0;
-        s32 i = 0, timeout = 200; /* FIXME: find real value to use here */
+        s32 i = 0, timeout = 200;
 
         while (i < timeout) {
                 if (igb_get_hw_semaphore(hw)) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 943cbd47d832..03e9eb0dc761 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1829,7 +1829,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                 err = mlx4_dev_cap(dev, &dev_cap);
                 if (err) {
                         mlx4_err(dev, "QUERY_DEV_CAP command failed, aborting\n");
-                        goto err_stop_fw;
+                        return err;
                 }
 
                 choose_steering_mode(dev, &dev_cap);
@@ -1860,7 +1860,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                                              &init_hca);
                 if ((long long) icm_size < 0) {
                         err = icm_size;
-                        goto err_stop_fw;
+                        return err;
                 }
 
                 dev->caps.max_fmr_maps = (1 << (32 - ilog2(dev->caps.num_mpts))) - 1;
@@ -1874,7 +1874,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
 
                 err = mlx4_init_icm(dev, &dev_cap, &init_hca, icm_size);
                 if (err)
-                        goto err_stop_fw;
+                        return err;
 
                 err = mlx4_INIT_HCA(dev, &init_hca);
                 if (err) {
@@ -1886,7 +1886,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                         err = mlx4_query_func(dev, &dev_cap);
                         if (err < 0) {
                                 mlx4_err(dev, "QUERY_FUNC command failed, aborting.\n");
-                                goto err_stop_fw;
+                                goto err_close;
                         } else if (err & MLX4_QUERY_FUNC_NUM_SYS_EQS) {
                                 dev->caps.num_eqs = dev_cap.max_eqs;
                                 dev->caps.reserved_eqs = dev_cap.reserved_eqs;
@@ -2006,11 +2006,6 @@ err_free_icm:
         if (!mlx4_is_slave(dev))
                 mlx4_free_icms(dev);
 
-err_stop_fw:
-        if (!mlx4_is_slave(dev)) {
-                mlx4_UNMAP_FA(dev);
-                mlx4_free_icm(dev, priv->fw.fw_icm, 0);
-        }
         return err;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index d6f549685c0f..7094a9c70fd5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -584,6 +584,7 @@ EXPORT_SYMBOL_GPL(mlx4_mr_free);
 void mlx4_mr_rereg_mem_cleanup(struct mlx4_dev *dev, struct mlx4_mr *mr)
 {
         mlx4_mtt_cleanup(dev, &mr->mtt);
+        mr->mtt.order = -1;
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_rereg_mem_cleanup);
 
@@ -593,14 +594,14 @@ int mlx4_mr_rereg_mem_write(struct mlx4_dev *dev, struct mlx4_mr *mr,
 {
         int err;
 
-        mpt_entry->start       = cpu_to_be64(iova);
-        mpt_entry->length      = cpu_to_be64(size);
-        mpt_entry->entity_size = cpu_to_be32(page_shift);
-
         err = mlx4_mtt_init(dev, npages, page_shift, &mr->mtt);
         if (err)
                 return err;
 
+        mpt_entry->start       = cpu_to_be64(mr->iova);
+        mpt_entry->length      = cpu_to_be64(mr->size);
+        mpt_entry->entity_size = cpu_to_be32(mr->mtt.page_shift);
+
         mpt_entry->pd_flags &= cpu_to_be32(MLX4_MPT_PD_MASK |
                                            MLX4_MPT_PD_FLAG_EN_INV);
         mpt_entry->flags    &= cpu_to_be32(MLX4_MPT_FLAG_FREE |
diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
index af099057f0e9..71af98bb72cb 100644
--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
@@ -4033,8 +4033,10 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         (void)pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
         mgp->cmd = dma_alloc_coherent(&pdev->dev, sizeof(*mgp->cmd),
                                       &mgp->cmd_bus, GFP_KERNEL);
-        if (mgp->cmd == NULL)
+        if (!mgp->cmd) {
+                status = -ENOMEM;
                 goto abort_with_enabled;
+        }
 
         mgp->board_span = pci_resource_len(pdev, 0);
         mgp->iomem_base = pci_resource_start(pdev, 0);
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index c2f09af5c25b..4847713211ca 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -146,10 +146,7 @@ static int ql_wait_for_drvr_lock(struct ql3_adapter *qdev)
 {
         int i = 0;
 
-        while (i < 10) {
-                if (i)
-                        ssleep(1);
-
+        do {
                 if (ql_sem_lock(qdev,
                                 QL_DRVR_SEM_MASK,
                                 (QL_RESOURCE_BITS_BASE_CODE | (qdev->mac_index)
@@ -158,7 +155,8 @@ static int ql_wait_for_drvr_lock(struct ql3_adapter *qdev)
                                       "driver lock acquired\n");
                         return 1;
                 }
-        }
+                ssleep(1);
+        } while (++i < 10);
 
         netdev_err(qdev->ndev, "Timed out waiting for driver lock...\n");
         return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 9929b97cfb36..2528c3fb6b90 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -2605,6 +2605,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         } else {
                 dev_err(&pdev->dev,
                         "%s: failed. Please Reboot\n", __func__);
+                err = -ENODEV;
                 goto err_out_free_hw;
         }
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index c560f9aeb55d..e61ee8351272 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -757,6 +757,14 @@ requeue:
 static irqreturn_t cpsw_interrupt(int irq, void *dev_id)
 {
         struct cpsw_priv *priv = dev_id;
+        int value = irq - priv->irqs_table[0];
+
+        /* NOTICE: Ending IRQ here. The trick with the 'value' variable above
+         * is to make sure we will always write the correct value to the EOI
+         * register. Namely 0 for RX_THRESH Interrupt, 1 for RX Interrupt, 2
+         * for TX Interrupt and 3 for MISC Interrupt.
+         */
+        cpdma_ctlr_eoi(priv->dma, value);
 
         cpsw_intr_disable(priv);
         if (priv->irq_enabled == true) {
@@ -786,8 +794,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
         int                     num_tx, num_rx;
 
         num_tx = cpdma_chan_process(priv->txch, 128);
-        if (num_tx)
-                cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
 
         num_rx = cpdma_chan_process(priv->rxch, budget);
         if (num_rx < budget) {
@@ -795,7 +801,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
 
                 napi_complete(napi);
                 cpsw_intr_enable(priv);
-                cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
                 prim_cpsw = cpsw_get_slave_priv(priv, 0);
                 if (prim_cpsw->irq_enabled == false) {
                         prim_cpsw->irq_enabled = true;
@@ -1310,8 +1315,6 @@ static int cpsw_ndo_open(struct net_device *ndev)
         napi_enable(&priv->napi);
         cpdma_ctlr_start(priv->dma);
         cpsw_intr_enable(priv);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
 
         prim_cpsw = cpsw_get_slave_priv(priv, 0);
         if (prim_cpsw->irq_enabled == false) {
@@ -1578,9 +1581,6 @@ static void cpsw_ndo_tx_timeout(struct net_device *ndev)
         cpdma_chan_start(priv->txch);
         cpdma_ctlr_int_ctrl(priv->dma, true);
         cpsw_intr_enable(priv);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
-
 }
 
 static int cpsw_ndo_set_mac_address(struct net_device *ndev, void *p)
@@ -1620,9 +1620,6 @@ static void cpsw_ndo_poll_controller(struct net_device *ndev)
         cpsw_interrupt(ndev->irq, priv);
         cpdma_ctlr_int_ctrl(priv->dma, true);
         cpsw_intr_enable(priv);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
-
 }
 #endif
 
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 9c2d91ea0af4..dbcbf0c5bcfa 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -1043,6 +1043,7 @@ static int temac_of_probe(struct platform_device *op)
         lp->regs = of_iomap(op->dev.of_node, 0);
         if (!lp->regs) {
                 dev_err(&op->dev, "could not map temac regs.\n");
+                rc = -ENOMEM;
                 goto nodev;
         }
 
@@ -1062,6 +1063,7 @@ static int temac_of_probe(struct platform_device *op)
         np = of_parse_phandle(op->dev.of_node, "llink-connected", 0);
         if (!np) {
                 dev_err(&op->dev, "could not find DMA node\n");
+                rc = -ENODEV;
                 goto err_iounmap;
         }
 
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index c18a0c637c44..a6d2860b712c 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1501,6 +1501,7 @@ static int axienet_of_probe(struct platform_device *op)
         lp->regs = of_iomap(op->dev.of_node, 0);
         if (!lp->regs) {
                 dev_err(&op->dev, "could not map Axi Ethernet regs.\n");
+                ret = -ENOMEM;
                 goto nodev;
         }
         /* Setup checksum offload, but default to off if not specified */
@@ -1563,6 +1564,7 @@ static int axienet_of_probe(struct platform_device *op)
         np = of_parse_phandle(op->dev.of_node, "axistream-connected", 0);
         if (!np) {
                 dev_err(&op->dev, "could not find DMA node\n");
+                ret = -ENODEV;
                 goto err_iounmap;
         }
         lp->dma_regs = of_iomap(np, 0);
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 24858799c204..9d4ce388510a 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -1109,6 +1109,7 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
         res = platform_get_resource(ofdev, IORESOURCE_IRQ, 0);
         if (!res) {
                 dev_err(dev, "no IRQ found\n");
+                rc = -ENXIO;
                 goto error;
         }
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index b8a82b86f909..602dc6668c3a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -56,6 +56,8 @@ struct qmi_wwan_state {
 /* default ethernet address used by the modem */
 static const u8 default_modem_addr[ETH_ALEN] = {0x02, 0x50, 0xf3};
 
+static const u8 buggy_fw_addr[ETH_ALEN] = {0x00, 0xa0, 0xc6, 0x00, 0x00, 0x00};
+
 /* Make up an ethernet header if the packet doesn't have one.
  *
  * A firmware bug common among several devices cause them to send raw
@@ -332,10 +334,12 @@ next_desc:
                 usb_driver_release_interface(driver, info->data);
         }
 
-        /* Never use the same address on both ends of the link, even
-         * if the buggy firmware told us to.
+        /* Never use the same address on both ends of the link, even if the
+         * buggy firmware told us to. Or, if device is assigned the well-known
+         * buggy firmware MAC address, replace it with a random address,
          */
-        if (ether_addr_equal(dev->net->dev_addr, default_modem_addr))
+        if (ether_addr_equal(dev->net->dev_addr, default_modem_addr) ||
+            ether_addr_equal(dev->net->dev_addr, buggy_fw_addr))
                 eth_hw_addr_random(dev->net);
 
         /* make MAC addr easily distinguishable from an IP header */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 2d1c77e81836..57ec23e8ccfa 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1897,6 +1897,22 @@ static void _rtl8152_set_rx_mode(struct net_device *netdev)
         netif_wake_queue(netdev);
 }
 
+static netdev_features_t
+rtl8152_features_check(struct sk_buff *skb, struct net_device *dev,
+                       netdev_features_t features)
+{
+        u32 mss = skb_shinfo(skb)->gso_size;
+        int max_offset = mss ? GTTCPHO_MAX : TCPHO_MAX;
+        int offset = skb_transport_offset(skb);
+
+        if ((mss || skb->ip_summed == CHECKSUM_PARTIAL) && offset > max_offset)
+                features &= ~(NETIF_F_ALL_CSUM | NETIF_F_GSO_MASK);
+        else if ((skb->len + sizeof(struct tx_desc)) > agg_buf_sz)
+                features &= ~NETIF_F_GSO_MASK;
+
+        return features;
+}
+
 static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb,
                                       struct net_device *netdev)
 {
@@ -3706,6 +3722,7 @@ static const struct net_device_ops rtl8152_netdev_ops = {
         .ndo_set_mac_address    = rtl8152_set_mac_address,
         .ndo_change_mtu         = rtl8152_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
+        .ndo_features_check     = rtl8152_features_check,
 };
 
 static void r8152b_get_version(struct r8152 *tp)
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index efbaf2ae1999..794204e34fba 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -737,6 +737,7 @@ static void connect(struct backend_info *be)
                 }
 
                 queue->remaining_credit = credit_bytes;
+                queue->credit_usec = credit_usec;
 
                 err = connect_rings(be, queue);
                 if (err) {
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index ba74f0aa60c7..3c22dbebc80f 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -89,6 +89,7 @@ struct rockchip_iomux {
  * @reg_pull: optional separate register for additional pull settings
  * @clk: clock of the gpio bank
  * @irq: interrupt of the gpio bank
+ * @saved_enables: Saved content of GPIO_INTEN at suspend time.
  * @pin_base: first pin number
  * @nr_pins: number of pins in this bank
  * @name: name of the bank
@@ -107,6 +108,7 @@ struct rockchip_pin_bank {
         struct regmap                   *regmap_pull;
         struct clk                      *clk;
         int                             irq;
+        u32                             saved_enables;
         u32                             pin_base;
         u8                              nr_pins;
         char                            *name;
@@ -1543,6 +1545,51 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type)
         return 0;
 }
 
+static void rockchip_irq_suspend(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        struct rockchip_pin_bank *bank = gc->private;
+
+        bank->saved_enables = irq_reg_readl(gc, GPIO_INTEN);
+        irq_reg_writel(gc, gc->wake_active, GPIO_INTEN);
+}
+
+static void rockchip_irq_resume(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        struct rockchip_pin_bank *bank = gc->private;
+
+        irq_reg_writel(gc, bank->saved_enables, GPIO_INTEN);
+}
+
+static void rockchip_irq_disable(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        u32 val;
+
+        irq_gc_lock(gc);
+
+        val = irq_reg_readl(gc, GPIO_INTEN);
+        val &= ~d->mask;
+        irq_reg_writel(gc, val, GPIO_INTEN);
+
+        irq_gc_unlock(gc);
+}
+
+static void rockchip_irq_enable(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        u32 val;
+
+        irq_gc_lock(gc);
+
+        val = irq_reg_readl(gc, GPIO_INTEN);
+        val |= d->mask;
+        irq_reg_writel(gc, val, GPIO_INTEN);
+
+        irq_gc_unlock(gc);
+}
+
 static int rockchip_interrupts_register(struct platform_device *pdev,
                                                 struct rockchip_pinctrl *info)
 {
@@ -1581,12 +1628,16 @@ static int rockchip_interrupts_register(struct platform_device *pdev,
                 gc = irq_get_domain_generic_chip(bank->domain, 0);
                 gc->reg_base = bank->reg_base;
                 gc->private = bank;
-                gc->chip_types[0].regs.mask = GPIO_INTEN;
+                gc->chip_types[0].regs.mask = GPIO_INTMASK;
                 gc->chip_types[0].regs.ack = GPIO_PORTS_EOI;
                 gc->chip_types[0].chip.irq_ack = irq_gc_ack_set_bit;
-                gc->chip_types[0].chip.irq_mask = irq_gc_mask_clr_bit;
-                gc->chip_types[0].chip.irq_unmask = irq_gc_mask_set_bit;
+                gc->chip_types[0].chip.irq_mask = irq_gc_mask_set_bit;
+                gc->chip_types[0].chip.irq_unmask = irq_gc_mask_clr_bit;
+                gc->chip_types[0].chip.irq_enable = rockchip_irq_enable;
+                gc->chip_types[0].chip.irq_disable = rockchip_irq_disable;
                 gc->chip_types[0].chip.irq_set_wake = irq_gc_set_wake;
+                gc->chip_types[0].chip.irq_suspend = rockchip_irq_suspend;
+                gc->chip_types[0].chip.irq_resume = rockchip_irq_resume;
                 gc->chip_types[0].chip.irq_set_type = rockchip_irq_set_type;
                 gc->wake_enabled = IRQ_MSK(bank->nr_pins);
 
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index 7c9d51382248..9e5ec00084bb 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -1012,8 +1012,10 @@ static void st_pinconf_dbg_show(struct pinctrl_dev *pctldev,
                                    struct seq_file *s, unsigned pin_id)
 {
         unsigned long config;
-        st_pinconf_get(pctldev, pin_id, &config);
 
+        mutex_unlock(&pctldev->mutex);
+        st_pinconf_get(pctldev, pin_id, &config);
+        mutex_lock(&pctldev->mutex);
         seq_printf(s, "[OE:%ld,PU:%ld,OD:%ld]\n"
                 "\t\t[retime:%ld,invclk:%ld,clknotdat:%ld,"
                 "de:%ld,rt-clk:%ld,rt-delay:%ld]",
@@ -1443,6 +1445,7 @@ static struct gpio_chip st_gpio_template = {
 
 static struct irq_chip st_gpio_irqchip = {
         .name           = "GPIO",
+        .irq_disable    = st_gpio_irq_mask,
         .irq_mask       = st_gpio_irq_mask,
         .irq_unmask     = st_gpio_irq_unmask,
         .irq_set_type   = st_gpio_irq_set_type,
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 12ca291c1380..cce1cbc1a927 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -734,7 +734,9 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
          * Return target busy if we've received a non-zero retry_delay_timer
          * in a FCP_RSP.
          */
-        if (time_after(jiffies, fcport->retry_delay_timestamp))
+        if (fcport->retry_delay_timestamp == 0) {
+                /* retry delay not set */
+        } else if (time_after(jiffies, fcport->retry_delay_timestamp))
                 fcport->retry_delay_timestamp = 0;
         else
                 goto qc24_target_busy;
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index 815de379a130..9049dd91b569 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -46,8 +46,6 @@ source "drivers/staging/rtl8723au/Kconfig"
 
 source "drivers/staging/rts5208/Kconfig"
 
-source "drivers/staging/line6/Kconfig"
-
 source "drivers/staging/octeon/Kconfig"
 
 source "drivers/staging/octeon-usb/Kconfig"
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index 33c640b49566..fe26ff162b42 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -15,7 +15,6 @@ obj-$(CONFIG_R8712U)		+= rtl8712/
 obj-$(CONFIG_R8188EU)           += rtl8188eu/
 obj-$(CONFIG_R8723AU)           += rtl8723au/
 obj-$(CONFIG_RTS5208)           += rts5208/
-obj-$(CONFIG_LINE6_USB)         += line6/
 obj-$(CONFIG_NETLOGIC_XLR_NET)  += netlogic/
 obj-$(CONFIG_OCTEON_ETHERNET)   += octeon/
 obj-$(CONFIG_OCTEON_USB)        += octeon-usb/
diff --git a/drivers/staging/line6/usbdefs.h b/drivers/staging/line6/usbdefs.h
deleted file mode 100644
index 2d1cc472bead..000000000000
--- a/drivers/staging/line6/usbdefs.h
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Line6 Linux USB driver - 0.9.1beta
- *
- * Copyright (C) 2005-2008 Markus Grabner (grabner@icg.tugraz.at)
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License as
- *      published by the Free Software Foundation, version 2.
- *
- */
-
-#ifndef USBDEFS_H
-#define USBDEFS_H
-
-#define LINE6_VENDOR_ID  0x0e41
-
-#define USB_INTERVALS_PER_SECOND 1000
-
-/*
-        Device ids.
-*/
-#define LINE6_DEVID_BASSPODXT     0x4250
-#define LINE6_DEVID_BASSPODXTLIVE 0x4642
-#define LINE6_DEVID_BASSPODXTPRO  0x4252
-#define LINE6_DEVID_GUITARPORT    0x4750
-#define LINE6_DEVID_POCKETPOD     0x5051
-#define LINE6_DEVID_PODHD300      0x5057
-#define LINE6_DEVID_PODHD400      0x5058
-#define LINE6_DEVID_PODHD500      0x414D
-#define LINE6_DEVID_PODSTUDIO_GX  0x4153
-#define LINE6_DEVID_PODSTUDIO_UX1 0x4150
-#define LINE6_DEVID_PODSTUDIO_UX2 0x4151
-#define LINE6_DEVID_PODX3         0x414a
-#define LINE6_DEVID_PODX3LIVE     0x414b
-#define LINE6_DEVID_PODXT         0x5044
-#define LINE6_DEVID_PODXTLIVE     0x4650
-#define LINE6_DEVID_PODXTPRO      0x5050
-#define LINE6_DEVID_TONEPORT_GX   0x4147
-#define LINE6_DEVID_TONEPORT_UX1  0x4141
-#define LINE6_DEVID_TONEPORT_UX2  0x4142
-#define LINE6_DEVID_VARIAX        0x534d
-
-#define LINE6_BIT(x) LINE6_BIT_ ## x = 1 << LINE6_INDEX_ ## x
-
-enum {
-        LINE6_INDEX_BASSPODXT,
-        LINE6_INDEX_BASSPODXTLIVE,
-        LINE6_INDEX_BASSPODXTPRO,
-        LINE6_INDEX_GUITARPORT,
-        LINE6_INDEX_POCKETPOD,
-        LINE6_INDEX_PODHD300,
-        LINE6_INDEX_PODHD400,
-        LINE6_INDEX_PODHD500,
-        LINE6_INDEX_PODSTUDIO_GX,
-        LINE6_INDEX_PODSTUDIO_UX1,
-        LINE6_INDEX_PODSTUDIO_UX2,
-        LINE6_INDEX_PODX3,
-        LINE6_INDEX_PODX3LIVE,
-        LINE6_INDEX_PODXT,
-        LINE6_INDEX_PODXTLIVE,
-        LINE6_INDEX_PODXTPRO,
-        LINE6_INDEX_TONEPORT_GX,
-        LINE6_INDEX_TONEPORT_UX1,
-        LINE6_INDEX_TONEPORT_UX2,
-        LINE6_INDEX_VARIAX,
-
-        LINE6_BIT(BASSPODXT),
-        LINE6_BIT(BASSPODXTLIVE),
-        LINE6_BIT(BASSPODXTPRO),
-        LINE6_BIT(GUITARPORT),
-        LINE6_BIT(POCKETPOD),
-        LINE6_BIT(PODHD300),
-        LINE6_BIT(PODHD400),
-        LINE6_BIT(PODHD500),
-        LINE6_BIT(PODSTUDIO_GX),
-        LINE6_BIT(PODSTUDIO_UX1),
-        LINE6_BIT(PODSTUDIO_UX2),
-        LINE6_BIT(PODX3),
-        LINE6_BIT(PODX3LIVE),
-        LINE6_BIT(PODXT),
-        LINE6_BIT(PODXTLIVE),
-        LINE6_BIT(PODXTPRO),
-        LINE6_BIT(TONEPORT_GX),
-        LINE6_BIT(TONEPORT_UX1),
-        LINE6_BIT(TONEPORT_UX2),
-        LINE6_BIT(VARIAX),
-
-        LINE6_BITS_PRO = LINE6_BIT_BASSPODXTPRO | LINE6_BIT_PODXTPRO,
-        LINE6_BITS_LIVE = LINE6_BIT_BASSPODXTLIVE | LINE6_BIT_PODXTLIVE |
-                          LINE6_BIT_PODX3LIVE,
-        LINE6_BITS_PODXTALL = LINE6_BIT_PODXT | LINE6_BIT_PODXTLIVE |
-                              LINE6_BIT_PODXTPRO,
-        LINE6_BITS_PODX3ALL = LINE6_BIT_PODX3 | LINE6_BIT_PODX3LIVE,
-        LINE6_BITS_PODHDALL = LINE6_BIT_PODHD300 |
-                              LINE6_BIT_PODHD400 |
-                              LINE6_BIT_PODHD500,
-        LINE6_BITS_BASSPODXTALL = LINE6_BIT_BASSPODXT |
-                                  LINE6_BIT_BASSPODXTLIVE |
-                                  LINE6_BIT_BASSPODXTPRO
-};
-
-/* device supports settings parameter via USB */
-#define LINE6_BIT_CONTROL (1 << 0)
-/* device supports PCM input/output via USB */
-#define LINE6_BIT_PCM (1 << 1)
-/* device support hardware monitoring */
-#define LINE6_BIT_HWMON (1 << 2)
-
-#define LINE6_BIT_CTRL_PCM_HW   (LINE6_BIT_CONTROL |    \
-                                         LINE6_BIT_PCM |        \
-                                         LINE6_BIT_HWMON)
-
-#define LINE6_FALLBACK_INTERVAL 10
-#define LINE6_FALLBACK_MAXPACKETSIZE 16
-
-#endif
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 255201f22126..7cc0122a18ce 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -840,13 +840,11 @@ static const struct vfio_device_ops vfio_pci_ops = {
 
 static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
-        u8 type;
         struct vfio_pci_device *vdev;
         struct iommu_group *group;
         int ret;
 
-        pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type);
-        if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL)
+        if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
                 return -EINVAL;
 
         group = iommu_group_get(&pdev->dev);
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 14419a8ccbb6..d415d69dc237 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -538,7 +538,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
                 ++headcount;
                 seg += in;
         }
-        heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen);
+        heads[headcount - 1].len = cpu_to_vhost32(vq, len + datalen);
         *iovcount = seg;
         if (unlikely(log))
                 *log_num = nlogs;
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 2ef9529809d8..9756f21b809e 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -282,6 +282,7 @@ void vp_del_vqs(struct virtio_device *vdev)
 
         vp_free_vectors(vdev);
         kfree(vp_dev->vqs);
+        vp_dev->vqs = NULL;
 }
 
 static int vp_try_to_find_vqs(struct virtio_device *vdev, unsigned nvqs,
@@ -421,15 +422,6 @@ int vp_set_vq_affinity(struct virtqueue *vq, int cpu)
         return 0;
 }
 
-void virtio_pci_release_dev(struct device *_d)
-{
-        /*
-         * No need for a release method as we allocate/free
-         * all devices together with the pci devices.
-         * Provide an empty one to avoid getting a warning from core.
-         */
-}
-
 #ifdef CONFIG_PM_SLEEP
 static int virtio_pci_freeze(struct device *dev)
 {
diff --git a/drivers/virtio/virtio_pci_common.h b/drivers/virtio/virtio_pci_common.h
index adddb647b21d..5a497289b7e9 100644
--- a/drivers/virtio/virtio_pci_common.h
+++ b/drivers/virtio/virtio_pci_common.h
@@ -126,7 +126,6 @@ const char *vp_bus_name(struct virtio_device *vdev);
  * - ignore the affinity request if we're using INTX
  */
 int vp_set_vq_affinity(struct virtqueue *vq, int cpu);
-void virtio_pci_release_dev(struct device *);
 
 int virtio_pci_legacy_probe(struct pci_dev *pci_dev,
                             const struct pci_device_id *id);
diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
index 6c76f0f5658c..a5486e65e04b 100644
--- a/drivers/virtio/virtio_pci_legacy.c
+++ b/drivers/virtio/virtio_pci_legacy.c
@@ -211,6 +211,17 @@ static const struct virtio_config_ops virtio_pci_config_ops = {
         .set_vq_affinity = vp_set_vq_affinity,
 };
 
+static void virtio_pci_release_dev(struct device *_d)
+{
+        struct virtio_device *vdev = dev_to_virtio(_d);
+        struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+
+        /* As struct device is a kobject, it's not safe to
+         * free the memory (including the reference counter itself)
+         * until it's release callback. */
+        kfree(vp_dev);
+}
+
 /* the PCI probing function */
 int virtio_pci_legacy_probe(struct pci_dev *pci_dev,
                             const struct pci_device_id *id)
@@ -302,5 +313,4 @@ void virtio_pci_legacy_remove(struct pci_dev *pci_dev)
         pci_iounmap(pci_dev, vp_dev->ioaddr);
         pci_release_regions(pci_dev);
         pci_disable_device(pci_dev);
-        kfree(vp_dev);
 }
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 2d3e32ebfd15..8729cf68d2fe 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1552,7 +1552,6 @@ int tree_backref_for_extent(unsigned long *ptr, struct extent_buffer *eb,
 {
         int ret;
         int type;
-        struct btrfs_tree_block_info *info;
         struct btrfs_extent_inline_ref *eiref;
 
         if (*ptr == (unsigned long)-1)
@@ -1573,9 +1572,17 @@ int tree_backref_for_extent(unsigned long *ptr, struct extent_buffer *eb,
         }
 
         /* we can treat both ref types equally here */
-        info = (struct btrfs_tree_block_info *)(ei + 1);
         *out_root = btrfs_extent_inline_ref_offset(eb, eiref);
-        *out_level = btrfs_tree_block_level(eb, info);
+
+        if (key->type == BTRFS_EXTENT_ITEM_KEY) {
+                struct btrfs_tree_block_info *info;
+
+                info = (struct btrfs_tree_block_info *)(ei + 1);
+                *out_level = btrfs_tree_block_level(eb, info);
+        } else {
+                ASSERT(key->type == BTRFS_METADATA_ITEM_KEY);
+                *out_level = (u8)key->offset;
+        }
 
         if (ret == 1)
                 *ptr = (unsigned long)-1;
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 054577bddaf2..de4e70fb3cbb 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -1857,6 +1857,14 @@ int btrfs_delayed_delete_inode_ref(struct inode *inode)
 {
         struct btrfs_delayed_node *delayed_node;
 
+        /*
+         * we don't do delayed inode updates during log recovery because it
+         * leads to enospc problems.  This means we also can't do
+         * delayed inode refs
+         */
+        if (BTRFS_I(inode)->root->fs_info->log_root_recovering)
+                return -EAGAIN;
+
         delayed_node = btrfs_get_or_create_delayed_node(inode);
         if (IS_ERR(delayed_node))
                 return PTR_ERR(delayed_node);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index a80b97100d90..15116585e714 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3139,9 +3139,11 @@ static int write_one_cache_group(struct btrfs_trans_handle *trans,
         struct extent_buffer *leaf;
 
         ret = btrfs_search_slot(trans, extent_root, &cache->key, path, 0, 1);
-        if (ret < 0)
+        if (ret) {
+                if (ret > 0)
+                        ret = -ENOENT;
                 goto fail;
-        BUG_ON(ret); /* Corruption */
+        }
 
         leaf = path->nodes[0];
         bi = btrfs_item_ptr_offset(leaf, path->slots[0]);
@@ -3149,11 +3151,9 @@ static int write_one_cache_group(struct btrfs_trans_handle *trans,
         btrfs_mark_buffer_dirty(leaf);
         btrfs_release_path(path);
 fail:
-        if (ret) {
+        if (ret)
                 btrfs_abort_transaction(trans, root, ret);
-                return ret;
-        }
-        return 0;
+        return ret;
 
 }
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index e687bb0dc73a..8bf326affb94 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6255,8 +6255,10 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
 
 out_fail:
         btrfs_end_transaction(trans, root);
-        if (drop_on_err)
+        if (drop_on_err) {
+                inode_dec_link_count(inode);
                 iput(inode);
+        }
         btrfs_balance_delayed_items(root);
         btrfs_btree_balance_dirty(root);
         return err;
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index f2bb13a23f86..9e1569ffbf6e 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -2607,9 +2607,9 @@ static int scrub_extent_for_parity(struct scrub_parity *sparity,
                 ret = scrub_pages_for_parity(sparity, logical, l, physical, dev,
                                              flags, gen, mirror_num,
                                              have_csum ? csum : NULL);
-skip:
                 if (ret)
                         return ret;
+skip:
                 len -= l;
                 logical += l;
                 physical += l;
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index f5013d92a7e6..c81c0e004588 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -1416,7 +1416,7 @@ void ceph_fill_inline_data(struct inode *inode, struct page *locked_page,
                 }
         }
 
-        dout("fill_inline_data %p %llx.%llx len %lu locked_page %p\n",
+        dout("fill_inline_data %p %llx.%llx len %zu locked_page %p\n",
              inode, ceph_vinop(inode), len, locked_page);
 
         if (len > 0) {
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index e5d3eadf47b1..bed43081720f 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -5166,8 +5166,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 
         /* fallback to generic here if not in extents fmt */
         if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
-                return __generic_block_fiemap(inode, fieinfo, start, len,
-                                              ext4_get_block);
+                return generic_block_fiemap(inode, fieinfo, start, len,
+                        ext4_get_block);
 
         if (fiemap_check_flags(fieinfo, EXT4_FIEMAP_FLAGS))
                 return -EBADR;
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 513c12cf444c..8131be8c0af3 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -273,19 +273,24 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
  * we determine this extent as a data or a hole according to whether the
  * page cache has data or not.
  */
-static int ext4_find_unwritten_pgoff(struct inode *inode, int whence,
-                                     loff_t endoff, loff_t *offset)
+static int ext4_find_unwritten_pgoff(struct inode *inode,
+                                     int whence,
+                                     struct ext4_map_blocks *map,
+                                     loff_t *offset)
 {
         struct pagevec pvec;
+        unsigned int blkbits;
         pgoff_t index;
         pgoff_t end;
+        loff_t endoff;
         loff_t startoff;
         loff_t lastoff;
         int found = 0;
 
+        blkbits = inode->i_sb->s_blocksize_bits;
         startoff = *offset;
         lastoff = startoff;
-
+        endoff = (loff_t)(map->m_lblk + map->m_len) << blkbits;
 
         index = startoff >> PAGE_CACHE_SHIFT;
         end = endoff >> PAGE_CACHE_SHIFT;
@@ -403,144 +408,147 @@ out:
 static loff_t ext4_seek_data(struct file *file, loff_t offset, loff_t maxsize)
 {
         struct inode *inode = file->f_mapping->host;
-        struct fiemap_extent_info fie;
-        struct fiemap_extent ext[2];
-        loff_t next;
-        int i, ret = 0;
+        struct ext4_map_blocks map;
+        struct extent_status es;
+        ext4_lblk_t start, last, end;
+        loff_t dataoff, isize;
+        int blkbits;
+        int ret = 0;
 
         mutex_lock(&inode->i_mutex);
-        if (offset >= inode->i_size) {
+
+        isize = i_size_read(inode);
+        if (offset >= isize) {
                 mutex_unlock(&inode->i_mutex);
                 return -ENXIO;
         }
-        fie.fi_flags = 0;
-        fie.fi_extents_max = 2;
-        fie.fi_extents_start = (struct fiemap_extent __user *) &ext;
-        while (1) {
-                mm_segment_t old_fs = get_fs();
-
-                fie.fi_extents_mapped = 0;
-                memset(ext, 0, sizeof(*ext) * fie.fi_extents_max);
-
-                set_fs(get_ds());
-                ret = ext4_fiemap(inode, &fie, offset, maxsize - offset);
-                set_fs(old_fs);
-                if (ret)
+
+        blkbits = inode->i_sb->s_blocksize_bits;
+        start = offset >> blkbits;
+        last = start;
+        end = isize >> blkbits;
+        dataoff = offset;
+
+        do {
+                map.m_lblk = last;
+                map.m_len = end - last + 1;
+                ret = ext4_map_blocks(NULL, inode, &map, 0);
+                if (ret > 0 && !(map.m_flags & EXT4_MAP_UNWRITTEN)) {
+                        if (last != start)
+                                dataoff = (loff_t)last << blkbits;
                         break;
+                }
 
-                /* No extents found, EOF */
-                if (!fie.fi_extents_mapped) {
-                        ret = -ENXIO;
+                /*
+                 * If there is a delay extent at this offset,
+                 * it will be as a data.
+                 */
+                ext4_es_find_delayed_extent_range(inode, last, last, &es);
+                if (es.es_len != 0 && in_range(last, es.es_lblk, es.es_len)) {
+                        if (last != start)
+                                dataoff = (loff_t)last << blkbits;
                         break;
                 }
-                for (i = 0; i < fie.fi_extents_mapped; i++) {
-                        next = (loff_t)(ext[i].fe_length + ext[i].fe_logical);
 
-                        if (offset < (loff_t)ext[i].fe_logical)
-                                offset = (loff_t)ext[i].fe_logical;
-                        /*
-                         * If extent is not unwritten, then it contains valid
-                         * data, mapped or delayed.
-                         */
-                        if (!(ext[i].fe_flags & FIEMAP_EXTENT_UNWRITTEN))
-                                goto out;
+                /*
+                 * If there is a unwritten extent at this offset,
+                 * it will be as a data or a hole according to page
+                 * cache that has data or not.
+                 */
+                if (map.m_flags & EXT4_MAP_UNWRITTEN) {
+                        int unwritten;
+                        unwritten = ext4_find_unwritten_pgoff(inode, SEEK_DATA,
+                                                              &map, &dataoff);
+                        if (unwritten)
+                                break;
+                }
 
-                        /*
-                         * If there is a unwritten extent at this offset,
-                         * it will be as a data or a hole according to page
-                         * cache that has data or not.
-                         */
-                        if (ext4_find_unwritten_pgoff(inode, SEEK_DATA,
-                                                      next, &offset))
-                                goto out;
+                last++;
+                dataoff = (loff_t)last << blkbits;
+        } while (last <= end);
 
-                        if (ext[i].fe_flags & FIEMAP_EXTENT_LAST) {
-                                ret = -ENXIO;
-                                goto out;
-                        }
-                        offset = next;
-                }
-        }
-        if (offset > inode->i_size)
-                offset = inode->i_size;
-out:
         mutex_unlock(&inode->i_mutex);
-        if (ret)
-                return ret;
 
-        return vfs_setpos(file, offset, maxsize);
+        if (dataoff > isize)
+                return -ENXIO;
+
+        return vfs_setpos(file, dataoff, maxsize);
 }
 
 /*
- * ext4_seek_hole() retrieves the offset for SEEK_HOLE
+ * ext4_seek_hole() retrieves the offset for SEEK_HOLE.
  */
 static loff_t ext4_seek_hole(struct file *file, loff_t offset, loff_t maxsize)
 {
         struct inode *inode = file->f_mapping->host;
-        struct fiemap_extent_info fie;
-        struct fiemap_extent ext[2];
-        loff_t next;
-        int i, ret = 0;
+        struct ext4_map_blocks map;
+        struct extent_status es;
+        ext4_lblk_t start, last, end;
+        loff_t holeoff, isize;
+        int blkbits;
+        int ret = 0;
 
         mutex_lock(&inode->i_mutex);
-        if (offset >= inode->i_size) {
+
+        isize = i_size_read(inode);
+        if (offset >= isize) {
                 mutex_unlock(&inode->i_mutex);
                 return -ENXIO;
         }
 
-        fie.fi_flags = 0;
-        fie.fi_extents_max = 2;
-        fie.fi_extents_start = (struct fiemap_extent __user *)&ext;
-        while (1) {
-                mm_segment_t old_fs = get_fs();
-
-                fie.fi_extents_mapped = 0;
-                memset(ext, 0, sizeof(*ext));
+        blkbits = inode->i_sb->s_blocksize_bits;
+        start = offset >> blkbits;
+        last = start;
+        end = isize >> blkbits;
+        holeoff = offset;
 
-                set_fs(get_ds());
-                ret = ext4_fiemap(inode, &fie, offset, maxsize - offset);
-                set_fs(old_fs);
-                if (ret)
-                        break;
+        do {
+                map.m_lblk = last;
+                map.m_len = end - last + 1;
+                ret = ext4_map_blocks(NULL, inode, &map, 0);
+                if (ret > 0 && !(map.m_flags & EXT4_MAP_UNWRITTEN)) {
+                        last += ret;
+                        holeoff = (loff_t)last << blkbits;
+                        continue;
+                }
 
-                /* No extents found */
-                if (!fie.fi_extents_mapped)
-                        break;
+                /*
+                 * If there is a delay extent at this offset,
+                 * we will skip this extent.
+                 */
+                ext4_es_find_delayed_extent_range(inode, last, last, &es);
+                if (es.es_len != 0 && in_range(last, es.es_lblk, es.es_len)) {
+                        last = es.es_lblk + es.es_len;
+                        holeoff = (loff_t)last << blkbits;
+                        continue;
+                }
 
-                for (i = 0; i < fie.fi_extents_mapped; i++) {
-                        next = (loff_t)(ext[i].fe_logical + ext[i].fe_length);
-                        /*
-                         * If extent is not unwritten, then it contains valid
-                         * data, mapped or delayed.
-                         */
-                        if (!(ext[i].fe_flags & FIEMAP_EXTENT_UNWRITTEN)) {
-                                if (offset < (loff_t)ext[i].fe_logical)
-                                        goto out;
-                                offset = next;
+                /*
+                 * If there is a unwritten extent at this offset,
+                 * it will be as a data or a hole according to page
+                 * cache that has data or not.
+                 */
+                if (map.m_flags & EXT4_MAP_UNWRITTEN) {
+                        int unwritten;
+                        unwritten = ext4_find_unwritten_pgoff(inode, SEEK_HOLE,
+                                                              &map, &holeoff);
+                        if (!unwritten) {
+                                last += ret;
+                                holeoff = (loff_t)last << blkbits;
                                 continue;
                         }
-                        /*
-                         * If there is a unwritten extent at this offset,
-                         * it will be as a data or a hole according to page
-                         * cache that has data or not.
-                         */
-                        if (ext4_find_unwritten_pgoff(inode, SEEK_HOLE,
-                                                      next, &offset))
-                                goto out;
-
-                        offset = next;
-                        if (ext[i].fe_flags & FIEMAP_EXTENT_LAST)
-                                goto out;
                 }
-        }
-        if (offset > inode->i_size)
-                offset = inode->i_size;
-out:
+
+                /* find a hole */
+                break;
+        } while (last <= end);
+
         mutex_unlock(&inode->i_mutex);
-        if (ret)
-                return ret;
 
-        return vfs_setpos(file, offset, maxsize);
+        if (holeoff > isize)
+                holeoff = isize;
+
+        return vfs_setpos(file, holeoff, maxsize);
 }
 
 /*
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index bf76f405a5f9..8a8ec6293b19 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -24,6 +24,18 @@ int ext4_resize_begin(struct super_block *sb)
                 return -EPERM;
 
         /*
+         * If we are not using the primary superblock/GDT copy don't resize,
+         * because the user tools have no way of handling this.  Probably a
+         * bad time to do it anyways.
+         */
+        if (EXT4_SB(sb)->s_sbh->b_blocknr !=
+            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
+                ext4_warning(sb, "won't resize using backup superblock at %llu",
+                        (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
+                return -EPERM;
+        }
+
+        /*
          * We are not allowed to do online-resizing on a filesystem mounted
          * with error, because it can destroy the filesystem easily.
          */
@@ -758,18 +770,6 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
                        "EXT4-fs: ext4_add_new_gdb: adding group block %lu\n",
                        gdb_num);
 
-        /*
-         * If we are not using the primary superblock/GDT copy don't resize,
-         * because the user tools have no way of handling this.  Probably a
-         * bad time to do it anyways.
-         */
-        if (EXT4_SB(sb)->s_sbh->b_blocknr !=
-            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
-                ext4_warning(sb, "won't resize using backup superblock at %llu",
-                        (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
-                return -EPERM;
-        }
-
         gdb_bh = sb_bread(sb, gdblock);
         if (!gdb_bh)
                 return -EIO;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 43c92b1685cb..74c5f53595fb 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3482,7 +3482,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
                                        EXT4_FEATURE_RO_COMPAT_METADATA_CSUM) &&
             EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_GDT_CSUM))
-                ext4_warning(sb, KERN_INFO "metadata_csum and uninit_bg are "
+                ext4_warning(sb, "metadata_csum and uninit_bg are "
                              "redundant flags; please run fsck.");
 
         /* Check for a known checksum algorithm */
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 99d440a4a6ba..ee85cd4e136a 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -740,14 +740,15 @@ static int __init fcntl_init(void)
          * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
          * is defined as O_NONBLOCK on some platforms and not on others.
          */
-        BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
+        BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
                 O_RDONLY        | O_WRONLY      | O_RDWR        |
                 O_CREAT         | O_EXCL        | O_NOCTTY      |
                 O_TRUNC         | O_APPEND      | /* O_NONBLOCK | */
                 __O_SYNC        | O_DSYNC       | FASYNC        |
                 O_DIRECT        | O_LARGEFILE   | O_DIRECTORY   |
                 O_NOFOLLOW      | O_NOATIME     | O_CLOEXEC     |
-                __FMODE_EXEC    | O_PATH        | __O_TMPFILE
+                __FMODE_EXEC    | O_PATH        | __O_TMPFILE   |
+                __FMODE_NONOTIFY
                 ));
 
         fasync_cache = kmem_cache_create("fasync_cache",
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 3550a9c87616..c06a1ba80d73 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3897,11 +3897,11 @@ nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
                 status = nfs4_setlease(dp);
                 goto out;
         }
-        atomic_inc(&fp->fi_delegees);
         if (fp->fi_had_conflict) {
                 status = -EAGAIN;
                 goto out_unlock;
         }
+        atomic_inc(&fp->fi_delegees);
         hash_delegation_locked(dp, fp);
         status = 0;
 out_unlock:
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index c991616acca9..bff8567aa42d 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -259,16 +259,15 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,
         struct fsnotify_event *kevent;
         char __user *start;
         int ret;
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
         start = buf;
         group = file->private_data;
 
         pr_debug("%s: group=%p\n", __func__, group);
 
+        add_wait_queue(&group->notification_waitq, &wait);
         while (1) {
-                prepare_to_wait(&group->notification_waitq, &wait, TASK_INTERRUPTIBLE);
-
                 mutex_lock(&group->notification_mutex);
                 kevent = get_one_event(group, count);
                 mutex_unlock(&group->notification_mutex);
@@ -289,7 +288,8 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,
 
                         if (start != buf)
                                 break;
-                        schedule();
+
+                        wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
                         continue;
                 }
 
@@ -318,8 +318,8 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,
                 buf += ret;
                 count -= ret;
         }
+        remove_wait_queue(&group->notification_waitq, &wait);
 
-        finish_wait(&group->notification_waitq, &wait);
         if (start != buf && ret != -EFAULT)
                 ret = buf - start;
         return ret;
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 79b5af5e6a7b..cecd875653e4 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -2023,11 +2023,8 @@ leave:
         dlm_lockres_drop_inflight_ref(dlm, res);
         spin_unlock(&res->spinlock);
 
-        if (ret < 0) {
+        if (ret < 0)
                 mlog_errno(ret);
-                if (newlock)
-                        dlm_lock_put(newlock);
-        }
 
         return ret;
 }
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index b931e04e3388..914c121ec890 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -94,6 +94,14 @@ static int ocfs2_create_symlink_data(struct ocfs2_super *osb,
                                      struct inode *inode,
                                      const char *symname);
 
+static int ocfs2_double_lock(struct ocfs2_super *osb,
+                             struct buffer_head **bh1,
+                             struct inode *inode1,
+                             struct buffer_head **bh2,
+                             struct inode *inode2,
+                             int rename);
+
+static void ocfs2_double_unlock(struct inode *inode1, struct inode *inode2);
 /* An orphan dir name is an 8 byte value, printed as a hex string */
 #define OCFS2_ORPHAN_NAMELEN ((int)(2 * sizeof(u64)))
 
@@ -678,8 +686,10 @@ static int ocfs2_link(struct dentry *old_dentry,
 {
         handle_t *handle;
         struct inode *inode = old_dentry->d_inode;
+        struct inode *old_dir = old_dentry->d_parent->d_inode;
         int err;
         struct buffer_head *fe_bh = NULL;
+        struct buffer_head *old_dir_bh = NULL;
         struct buffer_head *parent_fe_bh = NULL;
         struct ocfs2_dinode *fe = NULL;
         struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
@@ -696,19 +706,33 @@ static int ocfs2_link(struct dentry *old_dentry,
 
         dquot_initialize(dir);
 
-        err = ocfs2_inode_lock_nested(dir, &parent_fe_bh, 1, OI_LS_PARENT);
+        err = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
+                        &parent_fe_bh, dir, 0);
         if (err < 0) {
                 if (err != -ENOENT)
                         mlog_errno(err);
                 return err;
         }
 
+        /* make sure both dirs have bhs
+         * get an extra ref on old_dir_bh if old==new */
+        if (!parent_fe_bh) {
+                if (old_dir_bh) {
+                        parent_fe_bh = old_dir_bh;
+                        get_bh(parent_fe_bh);
+                } else {
+                        mlog(ML_ERROR, "%s: no old_dir_bh!\n", osb->uuid_str);
+                        err = -EIO;
+                        goto out;
+                }
+        }
+
         if (!dir->i_nlink) {
                 err = -ENOENT;
                 goto out;
         }
 
-        err = ocfs2_lookup_ino_from_name(dir, old_dentry->d_name.name,
+        err = ocfs2_lookup_ino_from_name(old_dir, old_dentry->d_name.name,
                         old_dentry->d_name.len, &old_de_ino);
         if (err) {
                 err = -ENOENT;
@@ -801,10 +825,11 @@ out_unlock_inode:
         ocfs2_inode_unlock(inode, 1);
 
 out:
-        ocfs2_inode_unlock(dir, 1);
+        ocfs2_double_unlock(old_dir, dir);
 
         brelse(fe_bh);
         brelse(parent_fe_bh);
+        brelse(old_dir_bh);
 
         ocfs2_free_dir_lookup_result(&lookup);
 
@@ -1072,14 +1097,15 @@ static int ocfs2_check_if_ancestor(struct ocfs2_super *osb,
 }
 
 /*
- * The only place this should be used is rename!
+ * The only place this should be used is rename and link!
  * if they have the same id, then the 1st one is the only one locked.
  */
 static int ocfs2_double_lock(struct ocfs2_super *osb,
                              struct buffer_head **bh1,
                              struct inode *inode1,
                              struct buffer_head **bh2,
-                             struct inode *inode2)
+                             struct inode *inode2,
+                             int rename)
 {
         int status;
         int inode1_is_ancestor, inode2_is_ancestor;
@@ -1127,7 +1153,7 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
                 }
                 /* lock id2 */
                 status = ocfs2_inode_lock_nested(inode2, bh2, 1,
-                                                 OI_LS_RENAME1);
+                                rename == 1 ? OI_LS_RENAME1 : OI_LS_PARENT);
                 if (status < 0) {
                         if (status != -ENOENT)
                                 mlog_errno(status);
@@ -1136,7 +1162,8 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
         }
 
         /* lock id1 */
-        status = ocfs2_inode_lock_nested(inode1, bh1, 1, OI_LS_RENAME2);
+        status = ocfs2_inode_lock_nested(inode1, bh1, 1,
+                        rename == 1 ?  OI_LS_RENAME2 : OI_LS_PARENT);
         if (status < 0) {
                 /*
                  * An error return must mean that no cluster locks
@@ -1252,7 +1279,7 @@ static int ocfs2_rename(struct inode *old_dir,
 
         /* if old and new are the same, this'll just do one lock. */
         status = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
-                                   &new_dir_bh, new_dir);
+                                   &new_dir_bh, new_dir, 1);
         if (status < 0) {
                 mlog_errno(status);
                 goto bail;
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index 3ca9b751f122..b95dc32a6e6b 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -196,8 +196,8 @@ struct acpi_processor_flags {
 struct acpi_processor {
         acpi_handle handle;
         u32 acpi_id;
-        u32 apic_id;
-        u32 id;
+        u32 phys_id;    /* CPU hardware ID such as APIC ID for x86 */
+        u32 id;         /* CPU logical ID allocated by OS */
         u32 pblk;
         int performance_platform_limit;
         int throttling_platform_limit;
@@ -310,8 +310,8 @@ static inline int acpi_processor_get_bios_limit(int cpu, unsigned int *limit)
 #endif                          /* CONFIG_CPU_FREQ */
 
 /* in processor_core.c */
-int acpi_get_apicid(acpi_handle, int type, u32 acpi_id);
-int acpi_map_cpuid(int apic_id, u32 acpi_id);
+int acpi_get_phys_id(acpi_handle, int type, u32 acpi_id);
+int acpi_map_cpuid(int phys_id, u32 acpi_id);
 int acpi_get_cpuid(acpi_handle, int type, u32 acpi_id);
 
 /* in processor_pdc.c */
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 856d381b1d5b..d459cd17b477 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -147,8 +147,8 @@ void acpi_numa_arch_fixup(void);
 
 #ifdef CONFIG_ACPI_HOTPLUG_CPU
 /* Arch dependent functions for cpu hotplug support */
-int acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu);
-int acpi_unmap_lsapic(int cpu);
+int acpi_map_cpu(acpi_handle handle, int physid, int *pcpu);
+int acpi_unmap_cpu(int cpu);
 #endif /* CONFIG_ACPI_HOTPLUG_CPU */
 
 int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base);
diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h
index 5d86416d35f2..61b19c46bdb3 100644
--- a/include/linux/ceph/osd_client.h
+++ b/include/linux/ceph/osd_client.h
@@ -87,8 +87,8 @@ struct ceph_osd_req_op {
                         struct ceph_osd_data osd_data;
                 } extent;
                 struct {
-                        __le32 name_len;
-                        __le32 value_len;
+                        u32 name_len;
+                        u32 value_len;
                         __u8 cmp_op;       /* CEPH_OSD_CMPXATTR_OP_* */
                         __u8 cmp_mode;     /* CEPH_OSD_CMPXATTR_MODE_* */
                         struct ceph_osd_data osd_data;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index f90c0282c114..42efe13077b6 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -135,7 +135,7 @@ typedef void (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
 #define FMODE_CAN_WRITE         ((__force fmode_t)0x40000)
 
 /* File was opened by fanotify and shouldn't generate fanotify events */
-#define FMODE_NONOTIFY          ((__force fmode_t)0x1000000)
+#define FMODE_NONOTIFY          ((__force fmode_t)0x4000000)
 
 /*
  * Flag for rw_copy_check_uvector and compat_rw_copy_check_uvector
diff --git a/include/linux/kdb.h b/include/linux/kdb.h
index 290db1269c4c..75ae2e2631fc 100644
--- a/include/linux/kdb.h
+++ b/include/linux/kdb.h
@@ -13,11 +13,54 @@
  * Copyright (C) 2009 Jason Wessel <jason.wessel@windriver.com>
  */
 
+/* Shifted versions of the command enable bits are be used if the command
+ * has no arguments (see kdb_check_flags). This allows commands, such as
+ * go, to have different permissions depending upon whether it is called
+ * with an argument.
+ */
+#define KDB_ENABLE_NO_ARGS_SHIFT 10
+
 typedef enum {
-        KDB_REPEAT_NONE = 0,    /* Do not repeat this command */
-        KDB_REPEAT_NO_ARGS,     /* Repeat the command without arguments */
-        KDB_REPEAT_WITH_ARGS,   /* Repeat the command including its arguments */
-} kdb_repeat_t;
+        KDB_ENABLE_ALL = (1 << 0), /* Enable everything */
+        KDB_ENABLE_MEM_READ = (1 << 1),
+        KDB_ENABLE_MEM_WRITE = (1 << 2),
+        KDB_ENABLE_REG_READ = (1 << 3),
+        KDB_ENABLE_REG_WRITE = (1 << 4),
+        KDB_ENABLE_INSPECT = (1 << 5),
+        KDB_ENABLE_FLOW_CTRL = (1 << 6),
+        KDB_ENABLE_SIGNAL = (1 << 7),
+        KDB_ENABLE_REBOOT = (1 << 8),
+        /* User exposed values stop here, all remaining flags are
+         * exclusively used to describe a commands behaviour.
+         */
+
+        KDB_ENABLE_ALWAYS_SAFE = (1 << 9),
+        KDB_ENABLE_MASK = (1 << KDB_ENABLE_NO_ARGS_SHIFT) - 1,
+
+        KDB_ENABLE_ALL_NO_ARGS = KDB_ENABLE_ALL << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_MEM_READ_NO_ARGS = KDB_ENABLE_MEM_READ
+                                      << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_MEM_WRITE_NO_ARGS = KDB_ENABLE_MEM_WRITE
+                                       << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_REG_READ_NO_ARGS = KDB_ENABLE_REG_READ
+                                      << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_REG_WRITE_NO_ARGS = KDB_ENABLE_REG_WRITE
+                                       << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_INSPECT_NO_ARGS = KDB_ENABLE_INSPECT
+                                     << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_FLOW_CTRL_NO_ARGS = KDB_ENABLE_FLOW_CTRL
+                                       << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_SIGNAL_NO_ARGS = KDB_ENABLE_SIGNAL
+                                    << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_REBOOT_NO_ARGS = KDB_ENABLE_REBOOT
+                                    << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_ALWAYS_SAFE_NO_ARGS = KDB_ENABLE_ALWAYS_SAFE
+                                         << KDB_ENABLE_NO_ARGS_SHIFT,
+        KDB_ENABLE_MASK_NO_ARGS = KDB_ENABLE_MASK << KDB_ENABLE_NO_ARGS_SHIFT,
+
+        KDB_REPEAT_NO_ARGS = 0x40000000, /* Repeat the command w/o arguments */
+        KDB_REPEAT_WITH_ARGS = 0x80000000, /* Repeat the command with args */
+} kdb_cmdflags_t;
 
 typedef int (*kdb_func_t)(int, const char **);
 
@@ -62,6 +105,7 @@ extern atomic_t kdb_event;
 #define KDB_BADLENGTH   (-19)
 #define KDB_NOBP        (-20)
 #define KDB_BADADDR     (-21)
+#define KDB_NOPERM      (-22)
 
 /*
  * kdb_diemsg
@@ -146,17 +190,17 @@ static inline const char *kdb_walk_kallsyms(loff_t *pos)
 
 /* Dynamic kdb shell command registration */
 extern int kdb_register(char *, kdb_func_t, char *, char *, short);
-extern int kdb_register_repeat(char *, kdb_func_t, char *, char *,
-                               short, kdb_repeat_t);
+extern int kdb_register_flags(char *, kdb_func_t, char *, char *,
+                              short, kdb_cmdflags_t);
 extern int kdb_unregister(char *);
 #else /* ! CONFIG_KGDB_KDB */
 static inline __printf(1, 2) int kdb_printf(const char *fmt, ...) { return 0; }
 static inline void kdb_init(int level) {}
 static inline int kdb_register(char *cmd, kdb_func_t func, char *usage,
                                char *help, short minlen) { return 0; }
-static inline int kdb_register_repeat(char *cmd, kdb_func_t func, char *usage,
-                                      char *help, short minlen,
-                                      kdb_repeat_t repeat) { return 0; }
+static inline int kdb_register_flags(char *cmd, kdb_func_t func, char *usage,
+                                     char *help, short minlen,
+                                     kdb_cmdflags_t flags) { return 0; }
 static inline int kdb_unregister(char *cmd) { return 0; }
 #endif  /* CONFIG_KGDB_KDB */
 enum {
diff --git a/include/linux/mm.h b/include/linux/mm.h
index f80d0194c9bc..80fc92a49649 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1952,7 +1952,7 @@ extern int expand_downwards(struct vm_area_struct *vma,
 #if VM_GROWSUP
 extern int expand_upwards(struct vm_area_struct *vma, unsigned long address);
 #else
-  #define expand_upwards(vma, address) do { } while (0)
+  #define expand_upwards(vma, address) (0)
 #endif
 
 /* Look up the first VMA which satisfies  addr < vm_end,  NULL if none. */
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 486e84ccb1f9..4f7a61ca4b39 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -79,11 +79,6 @@ struct perf_branch_stack {
         struct perf_branch_entry        entries[0];
 };
 
-struct perf_regs {
-        __u64           abi;
-        struct pt_regs  *regs;
-};
-
 struct task_struct;
 
 /*
@@ -610,7 +605,14 @@ struct perf_sample_data {
                 u32     reserved;
         }                               cpu_entry;
         struct perf_callchain_entry     *callchain;
+
+        /*
+         * regs_user may point to task_pt_regs or to regs_user_copy, depending
+         * on arch details.
+         */
         struct perf_regs                regs_user;
+        struct pt_regs                  regs_user_copy;
+
         struct perf_regs                regs_intr;
         u64                             stack_user_size;
 } ____cacheline_aligned;
diff --git a/include/linux/perf_regs.h b/include/linux/perf_regs.h
index 3c73d5fe18be..a5f98d53d732 100644
--- a/include/linux/perf_regs.h
+++ b/include/linux/perf_regs.h
@@ -1,11 +1,19 @@
 #ifndef _LINUX_PERF_REGS_H
 #define _LINUX_PERF_REGS_H
 
+struct perf_regs {
+        __u64           abi;
+        struct pt_regs  *regs;
+};
+
 #ifdef CONFIG_HAVE_PERF_REGS
 #include <asm/perf_regs.h>
 u64 perf_reg_value(struct pt_regs *regs, int idx);
 int perf_reg_validate(u64 mask);
 u64 perf_reg_abi(struct task_struct *task);
+void perf_get_regs_user(struct perf_regs *regs_user,
+                        struct pt_regs *regs,
+                        struct pt_regs *regs_user_copy);
 #else
 static inline u64 perf_reg_value(struct pt_regs *regs, int idx)
 {
@@ -21,5 +29,13 @@ static inline u64 perf_reg_abi(struct task_struct *task)
 {
         return PERF_SAMPLE_REGS_ABI_NONE;
 }
+
+static inline void perf_get_regs_user(struct perf_regs *regs_user,
+                                      struct pt_regs *regs,
+                                      struct pt_regs *regs_user_copy)
+{
+        regs_user->regs = task_pt_regs(current);
+        regs_user->abi = perf_reg_abi(current);
+}
 #endif /* CONFIG_HAVE_PERF_REGS */
 #endif /* _LINUX_PERF_REGS_H */
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index c0c2bce6b0b7..d9d7e7e56352 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -37,6 +37,16 @@ struct anon_vma {
         atomic_t refcount;
 
         /*
+         * Count of child anon_vmas and VMAs which points to this anon_vma.
+         *
+         * This counter is used for making decision about reusing anon_vma
+         * instead of forking new one. See comments in function anon_vma_clone.
+         */
+        unsigned degree;
+
+        struct anon_vma *parent;        /* Parent of this anon_vma */
+
+        /*
          * NOTE: the LSB of the rb_root.rb_node is set by
          * mm_take_all_locks() _after_ taking the above lock. So the
          * rb_root must only be read/written after taking the above lock
diff --git a/include/linux/writeback.h b/include/linux/writeback.h
index a219be961c0a..00048339c23e 100644
--- a/include/linux/writeback.h
+++ b/include/linux/writeback.h
@@ -177,7 +177,6 @@ int write_cache_pages(struct address_space *mapping,
                       struct writeback_control *wbc, writepage_t writepage,
                       void *data);
 int do_writepages(struct address_space *mapping, struct writeback_control *wbc);
-void set_page_dirty_balance(struct page *page);
 void writeback_set_ratelimit(void);
 void tag_pages_for_writeback(struct address_space *mapping,
                              pgoff_t start, pgoff_t end);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 58d719ddaa60..29c7be8808d5 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1270,8 +1270,7 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
  *
  * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
  *      driver to indicate that it requires IV generation for this
- *      particular key. Setting this flag does not necessarily mean that SKBs
- *      will have sufficient tailroom for ICV or MIC.
+ *      particular key.
  * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by
  *      the driver for a TKIP key if it requires Michael MIC
  *      generation in software.
@@ -1283,9 +1282,7 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
  * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
  *      if space should be prepared for the IV, but the IV
  *      itself should not be generated. Do not set together with
- *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key. Setting this flag does
- *      not necessarily mean that SKBs will have sufficient tailroom for ICV or
- *      MIC.
+ *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
  * @IEEE80211_KEY_FLAG_RX_MGMT: This key will be used to decrypt received
  *      management frames. The flag can help drivers that have a hardware
  *      crypto implementation that doesn't deal with management frames
diff --git a/include/uapi/asm-generic/fcntl.h b/include/uapi/asm-generic/fcntl.h
index 7543b3e51331..e063effe0cc1 100644
--- a/include/uapi/asm-generic/fcntl.h
+++ b/include/uapi/asm-generic/fcntl.h
@@ -5,7 +5,7 @@
 
 /*
  * FMODE_EXEC is 0x20
- * FMODE_NONOTIFY is 0x1000000
+ * FMODE_NONOTIFY is 0x4000000
  * These cannot be used by userspace O_* until internal and external open
  * flags are split.
  * -Eric Paris
diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h
index 7acef41fc209..af94f31e33ac 100644
--- a/include/uapi/linux/kfd_ioctl.h
+++ b/include/uapi/linux/kfd_ioctl.h
@@ -128,27 +128,34 @@ struct kfd_ioctl_get_process_apertures_args {
         uint32_t pad;
 };
 
-#define KFD_IOC_MAGIC 'K'
+#define AMDKFD_IOCTL_BASE 'K'
+#define AMDKFD_IO(nr)                   _IO(AMDKFD_IOCTL_BASE, nr)
+#define AMDKFD_IOR(nr, type)            _IOR(AMDKFD_IOCTL_BASE, nr, type)
+#define AMDKFD_IOW(nr, type)            _IOW(AMDKFD_IOCTL_BASE, nr, type)
+#define AMDKFD_IOWR(nr, type)           _IOWR(AMDKFD_IOCTL_BASE, nr, type)
 
-#define KFD_IOC_GET_VERSION \
-                _IOR(KFD_IOC_MAGIC, 1, struct kfd_ioctl_get_version_args)
+#define AMDKFD_IOC_GET_VERSION                  \
+                AMDKFD_IOR(0x01, struct kfd_ioctl_get_version_args)
 
-#define KFD_IOC_CREATE_QUEUE \
-                _IOWR(KFD_IOC_MAGIC, 2, struct kfd_ioctl_create_queue_args)
+#define AMDKFD_IOC_CREATE_QUEUE                 \
+                AMDKFD_IOWR(0x02, struct kfd_ioctl_create_queue_args)
 
-#define KFD_IOC_DESTROY_QUEUE \
-        _IOWR(KFD_IOC_MAGIC, 3, struct kfd_ioctl_destroy_queue_args)
+#define AMDKFD_IOC_DESTROY_QUEUE                \
+                AMDKFD_IOWR(0x03, struct kfd_ioctl_destroy_queue_args)
 
-#define KFD_IOC_SET_MEMORY_POLICY \
-        _IOW(KFD_IOC_MAGIC, 4, struct kfd_ioctl_set_memory_policy_args)
+#define AMDKFD_IOC_SET_MEMORY_POLICY            \
+                AMDKFD_IOW(0x04, struct kfd_ioctl_set_memory_policy_args)
 
-#define KFD_IOC_GET_CLOCK_COUNTERS \
-        _IOWR(KFD_IOC_MAGIC, 5, struct kfd_ioctl_get_clock_counters_args)
+#define AMDKFD_IOC_GET_CLOCK_COUNTERS           \
+                AMDKFD_IOWR(0x05, struct kfd_ioctl_get_clock_counters_args)
 
-#define KFD_IOC_GET_PROCESS_APERTURES \
-        _IOR(KFD_IOC_MAGIC, 6, struct kfd_ioctl_get_process_apertures_args)
+#define AMDKFD_IOC_GET_PROCESS_APERTURES        \
+                AMDKFD_IOR(0x06, struct kfd_ioctl_get_process_apertures_args)
 
-#define KFD_IOC_UPDATE_QUEUE \
-        _IOW(KFD_IOC_MAGIC, 7, struct kfd_ioctl_update_queue_args)
+#define AMDKFD_IOC_UPDATE_QUEUE                 \
+                AMDKFD_IOW(0x07, struct kfd_ioctl_update_queue_args)
+
+#define AMDKFD_COMMAND_START            0x01
+#define AMDKFD_COMMAND_END              0x08
 
 #endif
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 1adf62b39b96..07ce18ca71e0 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -27,6 +27,9 @@
  * version 2. This program is licensed "as is" without any warranty of any
  * kind, whether express or implied.
  */
+
+#define pr_fmt(fmt) "KGDB: " fmt
+
 #include <linux/pid_namespace.h>
 #include <linux/clocksource.h>
 #include <linux/serial_core.h>
@@ -196,8 +199,8 @@ int __weak kgdb_validate_break_address(unsigned long addr)
                 return err;
         err = kgdb_arch_remove_breakpoint(&tmp);
         if (err)
-                printk(KERN_ERR "KGDB: Critical breakpoint error, kernel "
-                   "memory destroyed at: %lx", addr);
+                pr_err("Critical breakpoint error, kernel memory destroyed at: %lx\n",
+                       addr);
         return err;
 }
 
@@ -256,8 +259,8 @@ int dbg_activate_sw_breakpoints(void)
                 error = kgdb_arch_set_breakpoint(&kgdb_break[i]);
                 if (error) {
                         ret = error;
-                        printk(KERN_INFO "KGDB: BP install failed: %lx",
-                               kgdb_break[i].bpt_addr);
+                        pr_info("BP install failed: %lx\n",
+                                kgdb_break[i].bpt_addr);
                         continue;
                 }
 
@@ -319,8 +322,8 @@ int dbg_deactivate_sw_breakpoints(void)
                         continue;
                 error = kgdb_arch_remove_breakpoint(&kgdb_break[i]);
                 if (error) {
-                        printk(KERN_INFO "KGDB: BP remove failed: %lx\n",
-                               kgdb_break[i].bpt_addr);
+                        pr_info("BP remove failed: %lx\n",
+                                kgdb_break[i].bpt_addr);
                         ret = error;
                 }
 
@@ -367,7 +370,7 @@ int dbg_remove_all_break(void)
                         goto setundefined;
                 error = kgdb_arch_remove_breakpoint(&kgdb_break[i]);
                 if (error)
-                        printk(KERN_ERR "KGDB: breakpoint remove failed: %lx\n",
+                        pr_err("breakpoint remove failed: %lx\n",
                                kgdb_break[i].bpt_addr);
 setundefined:
                 kgdb_break[i].state = BP_UNDEFINED;
@@ -400,9 +403,9 @@ static int kgdb_io_ready(int print_wait)
         if (print_wait) {
 #ifdef CONFIG_KGDB_KDB
                 if (!dbg_kdb_mode)
-                        printk(KERN_CRIT "KGDB: waiting... or $3#33 for KDB\n");
+                        pr_crit("waiting... or $3#33 for KDB\n");
 #else
-                printk(KERN_CRIT "KGDB: Waiting for remote debugger\n");
+                pr_crit("Waiting for remote debugger\n");
 #endif
         }
         return 1;
@@ -430,8 +433,7 @@ static int kgdb_reenter_check(struct kgdb_state *ks)
                 exception_level = 0;
                 kgdb_skipexception(ks->ex_vector, ks->linux_regs);
                 dbg_activate_sw_breakpoints();
-                printk(KERN_CRIT "KGDB: re-enter error: breakpoint removed %lx\n",
-                        addr);
+                pr_crit("re-enter error: breakpoint removed %lx\n", addr);
                 WARN_ON_ONCE(1);
 
                 return 1;
@@ -444,7 +446,7 @@ static int kgdb_reenter_check(struct kgdb_state *ks)
                 panic("Recursive entry to debugger");
         }
 
-        printk(KERN_CRIT "KGDB: re-enter exception: ALL breakpoints killed\n");
+        pr_crit("re-enter exception: ALL breakpoints killed\n");
 #ifdef CONFIG_KGDB_KDB
         /* Allow kdb to debug itself one level */
         return 0;
@@ -471,6 +473,7 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs,
         int cpu;
         int trace_on = 0;
         int online_cpus = num_online_cpus();
+        u64 time_left;
 
         kgdb_info[ks->cpu].enter_kgdb++;
         kgdb_info[ks->cpu].exception_state |= exception_state;
@@ -595,9 +598,13 @@ return_normal:
         /*
          * Wait for the other CPUs to be notified and be waiting for us:
          */
-        while (kgdb_do_roundup && (atomic_read(&masters_in_kgdb) +
-                                atomic_read(&slaves_in_kgdb)) != online_cpus)
+        time_left = loops_per_jiffy * HZ;
+        while (kgdb_do_roundup && --time_left &&
+               (atomic_read(&masters_in_kgdb) + atomic_read(&slaves_in_kgdb)) !=
+                   online_cpus)
                 cpu_relax();
+        if (!time_left)
+                pr_crit("KGDB: Timed out waiting for secondary CPUs.\n");
 
         /*
          * At this point the primary processor is completely
@@ -795,15 +802,15 @@ static struct console kgdbcons = {
 static void sysrq_handle_dbg(int key)
 {
         if (!dbg_io_ops) {
-                printk(KERN_CRIT "ERROR: No KGDB I/O module available\n");
+                pr_crit("ERROR: No KGDB I/O module available\n");
                 return;
         }
         if (!kgdb_connected) {
 #ifdef CONFIG_KGDB_KDB
                 if (!dbg_kdb_mode)
-                        printk(KERN_CRIT "KGDB or $3#33 for KDB\n");
+                        pr_crit("KGDB or $3#33 for KDB\n");
 #else
-                printk(KERN_CRIT "Entering KGDB\n");
+                pr_crit("Entering KGDB\n");
 #endif
         }
 
@@ -945,7 +952,7 @@ static void kgdb_initial_breakpoint(void)
 {
         kgdb_break_asap = 0;
 
-        printk(KERN_CRIT "kgdb: Waiting for connection from remote gdb...\n");
+        pr_crit("Waiting for connection from remote gdb...\n");
         kgdb_breakpoint();
 }
 
@@ -964,8 +971,7 @@ int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
         if (dbg_io_ops) {
                 spin_unlock(&kgdb_registration_lock);
 
-                printk(KERN_ERR "kgdb: Another I/O driver is already "
-                                "registered with KGDB.\n");
+                pr_err("Another I/O driver is already registered with KGDB\n");
                 return -EBUSY;
         }
 
@@ -981,8 +987,7 @@ int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
 
         spin_unlock(&kgdb_registration_lock);
 
-        printk(KERN_INFO "kgdb: Registered I/O driver %s.\n",
-               new_dbg_io_ops->name);
+        pr_info("Registered I/O driver %s\n", new_dbg_io_ops->name);
 
         /* Arm KGDB now. */
         kgdb_register_callbacks();
@@ -1017,8 +1022,7 @@ void kgdb_unregister_io_module(struct kgdb_io *old_dbg_io_ops)
 
         spin_unlock(&kgdb_registration_lock);
 
-        printk(KERN_INFO
-                "kgdb: Unregistered I/O driver %s, debugger disabled.\n",
+        pr_info("Unregistered I/O driver %s, debugger disabled\n",
                 old_dbg_io_ops->name);
 }
 EXPORT_SYMBOL_GPL(kgdb_unregister_io_module);
diff --git a/kernel/debug/kdb/kdb_bp.c b/kernel/debug/kdb/kdb_bp.c
index b20d544f20c2..e1dbf4a2c69e 100644
--- a/kernel/debug/kdb/kdb_bp.c
+++ b/kernel/debug/kdb/kdb_bp.c
@@ -531,22 +531,29 @@ void __init kdb_initbptab(void)
         for (i = 0, bp = kdb_breakpoints; i < KDB_MAXBPT; i++, bp++)
                 bp->bp_free = 1;
 
-        kdb_register_repeat("bp", kdb_bp, "[<vaddr>]",
-                "Set/Display breakpoints", 0, KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("bl", kdb_bp, "[<vaddr>]",
-                "Display breakpoints", 0, KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("bp", kdb_bp, "[<vaddr>]",
+                "Set/Display breakpoints", 0,
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("bl", kdb_bp, "[<vaddr>]",
+                "Display breakpoints", 0,
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
         if (arch_kgdb_ops.flags & KGDB_HW_BREAKPOINT)
-                kdb_register_repeat("bph", kdb_bp, "[<vaddr>]",
-                "[datar [length]|dataw [length]]   Set hw brk", 0, KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("bc", kdb_bc, "<bpnum>",
-                "Clear Breakpoint", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("be", kdb_bc, "<bpnum>",
-                "Enable Breakpoint", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("bd", kdb_bc, "<bpnum>",
-                "Disable Breakpoint", 0, KDB_REPEAT_NONE);
-
-        kdb_register_repeat("ss", kdb_ss, "",
-                "Single Step", 1, KDB_REPEAT_NO_ARGS);
+                kdb_register_flags("bph", kdb_bp, "[<vaddr>]",
+                "[datar [length]|dataw [length]]   Set hw brk", 0,
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("bc", kdb_bc, "<bpnum>",
+                "Clear Breakpoint", 0,
+                KDB_ENABLE_FLOW_CTRL);
+        kdb_register_flags("be", kdb_bc, "<bpnum>",
+                "Enable Breakpoint", 0,
+                KDB_ENABLE_FLOW_CTRL);
+        kdb_register_flags("bd", kdb_bc, "<bpnum>",
+                "Disable Breakpoint", 0,
+                KDB_ENABLE_FLOW_CTRL);
+
+        kdb_register_flags("ss", kdb_ss, "",
+                "Single Step", 1,
+                KDB_ENABLE_FLOW_CTRL | KDB_REPEAT_NO_ARGS);
         /*
          * Architecture dependent initialization.
          */
diff --git a/kernel/debug/kdb/kdb_debugger.c b/kernel/debug/kdb/kdb_debugger.c
index 8859ca34dcfe..15e1a7af5dd0 100644
--- a/kernel/debug/kdb/kdb_debugger.c
+++ b/kernel/debug/kdb/kdb_debugger.c
@@ -129,6 +129,10 @@ int kdb_stub(struct kgdb_state *ks)
                 ks->pass_exception = 1;
                 KDB_FLAG_SET(CATASTROPHIC);
         }
+        /* set CATASTROPHIC if the system contains unresponsive processors */
+        for_each_online_cpu(i)
+                if (!kgdb_info[i].enter_kgdb)
+                        KDB_FLAG_SET(CATASTROPHIC);
         if (KDB_STATE(SSBPT) && reason == KDB_REASON_SSTEP) {
                 KDB_STATE_CLEAR(SSBPT);
                 KDB_STATE_CLEAR(DOING_SS);
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 379650b984f8..f191bddf64b8 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -12,6 +12,7 @@
  */
 
 #include <linux/ctype.h>
+#include <linux/types.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/kmsg_dump.h>
@@ -23,6 +24,7 @@
 #include <linux/vmalloc.h>
 #include <linux/atomic.h>
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/kallsyms.h>
@@ -42,6 +44,12 @@
 #include <linux/slab.h>
 #include "kdb_private.h"
 
+#undef  MODULE_PARAM_PREFIX
+#define MODULE_PARAM_PREFIX "kdb."
+
+static int kdb_cmd_enabled = CONFIG_KDB_DEFAULT_ENABLE;
+module_param_named(cmd_enable, kdb_cmd_enabled, int, 0600);
+
 #define GREP_LEN 256
 char kdb_grep_string[GREP_LEN];
 int kdb_grepping_flag;
@@ -121,6 +129,7 @@ static kdbmsg_t kdbmsgs[] = {
         KDBMSG(BADLENGTH, "Invalid length field"),
         KDBMSG(NOBP, "No Breakpoint exists"),
         KDBMSG(BADADDR, "Invalid address"),
+        KDBMSG(NOPERM, "Permission denied"),
 };
 #undef KDBMSG
 
@@ -188,6 +197,26 @@ struct task_struct *kdb_curr_task(int cpu)
 }
 
 /*
+ * Check whether the flags of the current command and the permissions
+ * of the kdb console has allow a command to be run.
+ */
+static inline bool kdb_check_flags(kdb_cmdflags_t flags, int permissions,
+                                   bool no_args)
+{
+        /* permissions comes from userspace so needs massaging slightly */
+        permissions &= KDB_ENABLE_MASK;
+        permissions |= KDB_ENABLE_ALWAYS_SAFE;
+
+        /* some commands change group when launched with no arguments */
+        if (no_args)
+                permissions |= permissions << KDB_ENABLE_NO_ARGS_SHIFT;
+
+        flags |= KDB_ENABLE_ALL;
+
+        return permissions & flags;
+}
+
+/*
  * kdbgetenv - This function will return the character string value of
  *      an environment variable.
  * Parameters:
@@ -476,6 +505,15 @@ int kdbgetaddrarg(int argc, const char **argv, int *nextarg,
         kdb_symtab_t symtab;
 
         /*
+         * If the enable flags prohibit both arbitrary memory access
+         * and flow control then there are no reasonable grounds to
+         * provide symbol lookup.
+         */
+        if (!kdb_check_flags(KDB_ENABLE_MEM_READ | KDB_ENABLE_FLOW_CTRL,
+                             kdb_cmd_enabled, false))
+                return KDB_NOPERM;
+
+        /*
          * Process arguments which follow the following syntax:
          *
          *  symbol | numeric-address [+/- numeric-offset]
@@ -641,8 +679,13 @@ static int kdb_defcmd2(const char *cmdstr, const char *argv0)
                 if (!s->count)
                         s->usable = 0;
                 if (s->usable)
-                        kdb_register(s->name, kdb_exec_defcmd,
-                                     s->usage, s->help, 0);
+                        /* macros are always safe because when executed each
+                         * internal command re-enters kdb_parse() and is
+                         * safety checked individually.
+                         */
+                        kdb_register_flags(s->name, kdb_exec_defcmd, s->usage,
+                                           s->help, 0,
+                                           KDB_ENABLE_ALWAYS_SAFE);
                 return 0;
         }
         if (!s->usable)
@@ -1003,25 +1046,22 @@ int kdb_parse(const char *cmdstr)
 
         if (i < kdb_max_commands) {
                 int result;
+
+                if (!kdb_check_flags(tp->cmd_flags, kdb_cmd_enabled, argc <= 1))
+                        return KDB_NOPERM;
+
                 KDB_STATE_SET(CMD);
                 result = (*tp->cmd_func)(argc-1, (const char **)argv);
                 if (result && ignore_errors && result > KDB_CMD_GO)
                         result = 0;
                 KDB_STATE_CLEAR(CMD);
-                switch (tp->cmd_repeat) {
-                case KDB_REPEAT_NONE:
-                        argc = 0;
-                        if (argv[0])
-                                *(argv[0]) = '\0';
-                        break;
-                case KDB_REPEAT_NO_ARGS:
-                        argc = 1;
-                        if (argv[1])
-                                *(argv[1]) = '\0';
-                        break;
-                case KDB_REPEAT_WITH_ARGS:
-                        break;
-                }
+
+                if (tp->cmd_flags & KDB_REPEAT_WITH_ARGS)
+                        return result;
+
+                argc = tp->cmd_flags & KDB_REPEAT_NO_ARGS ? 1 : 0;
+                if (argv[argc])
+                        *(argv[argc]) = '\0';
                 return result;
         }
 
@@ -1921,10 +1961,14 @@ static int kdb_rm(int argc, const char **argv)
  */
 static int kdb_sr(int argc, const char **argv)
 {
+        bool check_mask =
+            !kdb_check_flags(KDB_ENABLE_ALL, kdb_cmd_enabled, false);
+
         if (argc != 1)
                 return KDB_ARGCOUNT;
+
         kdb_trap_printk++;
-        __handle_sysrq(*argv[1], false);
+        __handle_sysrq(*argv[1], check_mask);
         kdb_trap_printk--;
 
         return 0;
@@ -2157,6 +2201,8 @@ static void kdb_cpu_status(void)
         for (start_cpu = -1, i = 0; i < NR_CPUS; i++) {
                 if (!cpu_online(i)) {
                         state = 'F';    /* cpu is offline */
+                } else if (!kgdb_info[i].enter_kgdb) {
+                        state = 'D';    /* cpu is online but unresponsive */
                 } else {
                         state = ' ';    /* cpu is responding to kdb */
                         if (kdb_task_state_char(KDB_TSK(i)) == 'I')
@@ -2210,7 +2256,7 @@ static int kdb_cpu(int argc, const char **argv)
         /*
          * Validate cpunum
          */
-        if ((cpunum > NR_CPUS) || !cpu_online(cpunum))
+        if ((cpunum > NR_CPUS) || !kgdb_info[cpunum].enter_kgdb)
                 return KDB_BADCPUNUM;
 
         dbg_switch_cpu = cpunum;
@@ -2375,6 +2421,8 @@ static int kdb_help(int argc, const char **argv)
                         return 0;
                 if (!kt->cmd_name)
                         continue;
+                if (!kdb_check_flags(kt->cmd_flags, kdb_cmd_enabled, true))
+                        continue;
                 if (strlen(kt->cmd_usage) > 20)
                         space = "\n                                    ";
                 kdb_printf("%-15.15s %-20s%s%s\n", kt->cmd_name,
@@ -2629,7 +2677,7 @@ static int kdb_grep_help(int argc, const char **argv)
 }
 
 /*
- * kdb_register_repeat - This function is used to register a kernel
+ * kdb_register_flags - This function is used to register a kernel
  *      debugger command.
  * Inputs:
  *      cmd     Command name
@@ -2641,12 +2689,12 @@ static int kdb_grep_help(int argc, const char **argv)
  *      zero for success, one if a duplicate command.
  */
 #define kdb_command_extend 50   /* arbitrary */
-int kdb_register_repeat(char *cmd,
-                        kdb_func_t func,
-                        char *usage,
-                        char *help,
-                        short minlen,
-                        kdb_repeat_t repeat)
+int kdb_register_flags(char *cmd,
+                       kdb_func_t func,
+                       char *usage,
+                       char *help,
+                       short minlen,
+                       kdb_cmdflags_t flags)
 {
         int i;
         kdbtab_t *kp;
@@ -2694,19 +2742,18 @@ int kdb_register_repeat(char *cmd,
         kp->cmd_func   = func;
         kp->cmd_usage  = usage;
         kp->cmd_help   = help;
-        kp->cmd_flags  = 0;
         kp->cmd_minlen = minlen;
-        kp->cmd_repeat = repeat;
+        kp->cmd_flags  = flags;
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(kdb_register_repeat);
+EXPORT_SYMBOL_GPL(kdb_register_flags);
 
 
 /*
  * kdb_register - Compatibility register function for commands that do
  *      not need to specify a repeat state.  Equivalent to
- *      kdb_register_repeat with KDB_REPEAT_NONE.
+ *      kdb_register_flags with flags set to 0.
  * Inputs:
  *      cmd     Command name
  *      func    Function to execute the command
@@ -2721,8 +2768,7 @@ int kdb_register(char *cmd,
              char *help,
              short minlen)
 {
-        return kdb_register_repeat(cmd, func, usage, help, minlen,
-                                   KDB_REPEAT_NONE);
+        return kdb_register_flags(cmd, func, usage, help, minlen, 0);
 }
 EXPORT_SYMBOL_GPL(kdb_register);
 
@@ -2764,80 +2810,109 @@ static void __init kdb_inittab(void)
         for_each_kdbcmd(kp, i)
                 kp->cmd_name = NULL;
 
-        kdb_register_repeat("md", kdb_md, "<vaddr>",
+        kdb_register_flags("md", kdb_md, "<vaddr>",
           "Display Memory Contents, also mdWcN, e.g. md8c1", 1,
-                            KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("mdr", kdb_md, "<vaddr> <bytes>",
-          "Display Raw Memory", 0, KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("mdp", kdb_md, "<paddr> <bytes>",
-          "Display Physical Memory", 0, KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("mds", kdb_md, "<vaddr>",
-          "Display Memory Symbolically", 0, KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("mm", kdb_mm, "<vaddr> <contents>",
-          "Modify Memory Contents", 0, KDB_REPEAT_NO_ARGS);
-        kdb_register_repeat("go", kdb_go, "[<vaddr>]",
-          "Continue Execution", 1, KDB_REPEAT_NONE);
-        kdb_register_repeat("rd", kdb_rd, "",
-          "Display Registers", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("rm", kdb_rm, "<reg> <contents>",
-          "Modify Registers", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("ef", kdb_ef, "<vaddr>",
-          "Display exception frame", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("bt", kdb_bt, "[<vaddr>]",
-          "Stack traceback", 1, KDB_REPEAT_NONE);
-        kdb_register_repeat("btp", kdb_bt, "<pid>",
-          "Display stack for process <pid>", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("bta", kdb_bt, "[D|R|S|T|C|Z|E|U|I|M|A]",
-          "Backtrace all processes matching state flag", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("btc", kdb_bt, "",
-          "Backtrace current process on each cpu", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("btt", kdb_bt, "<vaddr>",
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("mdr", kdb_md, "<vaddr> <bytes>",
+          "Display Raw Memory", 0,
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("mdp", kdb_md, "<paddr> <bytes>",
+          "Display Physical Memory", 0,
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("mds", kdb_md, "<vaddr>",
+          "Display Memory Symbolically", 0,
+          KDB_ENABLE_MEM_READ | KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("mm", kdb_mm, "<vaddr> <contents>",
+          "Modify Memory Contents", 0,
+          KDB_ENABLE_MEM_WRITE | KDB_REPEAT_NO_ARGS);
+        kdb_register_flags("go", kdb_go, "[<vaddr>]",
+          "Continue Execution", 1,
+          KDB_ENABLE_REG_WRITE | KDB_ENABLE_ALWAYS_SAFE_NO_ARGS);
+        kdb_register_flags("rd", kdb_rd, "",
+          "Display Registers", 0,
+          KDB_ENABLE_REG_READ);
+        kdb_register_flags("rm", kdb_rm, "<reg> <contents>",
+          "Modify Registers", 0,
+          KDB_ENABLE_REG_WRITE);
+        kdb_register_flags("ef", kdb_ef, "<vaddr>",
+          "Display exception frame", 0,
+          KDB_ENABLE_MEM_READ);
+        kdb_register_flags("bt", kdb_bt, "[<vaddr>]",
+          "Stack traceback", 1,
+          KDB_ENABLE_MEM_READ | KDB_ENABLE_INSPECT_NO_ARGS);
+        kdb_register_flags("btp", kdb_bt, "<pid>",
+          "Display stack for process <pid>", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("bta", kdb_bt, "[D|R|S|T|C|Z|E|U|I|M|A]",
+          "Backtrace all processes matching state flag", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("btc", kdb_bt, "",
+          "Backtrace current process on each cpu", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("btt", kdb_bt, "<vaddr>",
           "Backtrace process given its struct task address", 0,
-                            KDB_REPEAT_NONE);
-        kdb_register_repeat("env", kdb_env, "",
-          "Show environment variables", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("set", kdb_set, "",
-          "Set environment variables", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("help", kdb_help, "",
-          "Display Help Message", 1, KDB_REPEAT_NONE);
-        kdb_register_repeat("?", kdb_help, "",
-          "Display Help Message", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("cpu", kdb_cpu, "<cpunum>",
-          "Switch to new cpu", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("kgdb", kdb_kgdb, "",
-          "Enter kgdb mode", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("ps", kdb_ps, "[<flags>|A]",
-          "Display active task list", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("pid", kdb_pid, "<pidnum>",
-          "Switch to another task", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("reboot", kdb_reboot, "",
-          "Reboot the machine immediately", 0, KDB_REPEAT_NONE);
+          KDB_ENABLE_MEM_READ | KDB_ENABLE_INSPECT_NO_ARGS);
+        kdb_register_flags("env", kdb_env, "",
+          "Show environment variables", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
+        kdb_register_flags("set", kdb_set, "",
+          "Set environment variables", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
+        kdb_register_flags("help", kdb_help, "",
+          "Display Help Message", 1,
+          KDB_ENABLE_ALWAYS_SAFE);
+        kdb_register_flags("?", kdb_help, "",
+          "Display Help Message", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
+        kdb_register_flags("cpu", kdb_cpu, "<cpunum>",
+          "Switch to new cpu", 0,
+          KDB_ENABLE_ALWAYS_SAFE_NO_ARGS);
+        kdb_register_flags("kgdb", kdb_kgdb, "",
+          "Enter kgdb mode", 0, 0);
+        kdb_register_flags("ps", kdb_ps, "[<flags>|A]",
+          "Display active task list", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("pid", kdb_pid, "<pidnum>",
+          "Switch to another task", 0,
+          KDB_ENABLE_INSPECT);
+        kdb_register_flags("reboot", kdb_reboot, "",
+          "Reboot the machine immediately", 0,
+          KDB_ENABLE_REBOOT);
 #if defined(CONFIG_MODULES)
-        kdb_register_repeat("lsmod", kdb_lsmod, "",
-          "List loaded kernel modules", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("lsmod", kdb_lsmod, "",
+          "List loaded kernel modules", 0,
+          KDB_ENABLE_INSPECT);
 #endif
 #if defined(CONFIG_MAGIC_SYSRQ)
-        kdb_register_repeat("sr", kdb_sr, "<key>",
-          "Magic SysRq key", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("sr", kdb_sr, "<key>",
+          "Magic SysRq key", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
 #endif
 #if defined(CONFIG_PRINTK)
-        kdb_register_repeat("dmesg", kdb_dmesg, "[lines]",
-          "Display syslog buffer", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("dmesg", kdb_dmesg, "[lines]",
+          "Display syslog buffer", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
 #endif
         if (arch_kgdb_ops.enable_nmi) {
-                kdb_register_repeat("disable_nmi", kdb_disable_nmi, "",
-                  "Disable NMI entry to KDB", 0, KDB_REPEAT_NONE);
-        }
-        kdb_register_repeat("defcmd", kdb_defcmd, "name \"usage\" \"help\"",
-          "Define a set of commands, down to endefcmd", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("kill", kdb_kill, "<-signal> <pid>",
-          "Send a signal to a process", 0, KDB_REPEAT_NONE);
-        kdb_register_repeat("summary", kdb_summary, "",
-          "Summarize the system", 4, KDB_REPEAT_NONE);
-        kdb_register_repeat("per_cpu", kdb_per_cpu, "<sym> [<bytes>] [<cpu>]",
-          "Display per_cpu variables", 3, KDB_REPEAT_NONE);
-        kdb_register_repeat("grephelp", kdb_grep_help, "",
-          "Display help on | grep", 0, KDB_REPEAT_NONE);
+                kdb_register_flags("disable_nmi", kdb_disable_nmi, "",
+                  "Disable NMI entry to KDB", 0,
+                  KDB_ENABLE_ALWAYS_SAFE);
+        }
+        kdb_register_flags("defcmd", kdb_defcmd, "name \"usage\" \"help\"",
+          "Define a set of commands, down to endefcmd", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
+        kdb_register_flags("kill", kdb_kill, "<-signal> <pid>",
+          "Send a signal to a process", 0,
+          KDB_ENABLE_SIGNAL);
+        kdb_register_flags("summary", kdb_summary, "",
+          "Summarize the system", 4,
+          KDB_ENABLE_ALWAYS_SAFE);
+        kdb_register_flags("per_cpu", kdb_per_cpu, "<sym> [<bytes>] [<cpu>]",
+          "Display per_cpu variables", 3,
+          KDB_ENABLE_MEM_READ);
+        kdb_register_flags("grephelp", kdb_grep_help, "",
+          "Display help on | grep", 0,
+          KDB_ENABLE_ALWAYS_SAFE);
 }
 
 /* Execute any commands defined in kdb_cmds.  */
diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
index 7afd3c8c41d5..eaacd1693954 100644
--- a/kernel/debug/kdb/kdb_private.h
+++ b/kernel/debug/kdb/kdb_private.h
@@ -172,10 +172,9 @@ typedef struct _kdbtab {
         kdb_func_t cmd_func;            /* Function to execute command */
         char    *cmd_usage;             /* Usage String for this command */
         char    *cmd_help;              /* Help message for this command */
-        short    cmd_flags;             /* Parsing flags */
         short    cmd_minlen;            /* Minimum legal # command
                                          * chars required */
-        kdb_repeat_t cmd_repeat;        /* Does command auto repeat on enter? */
+        kdb_cmdflags_t cmd_flags;       /* Command behaviour flags */
 } kdbtab_t;
 
 extern int kdb_bt(int, const char **);  /* KDB display back trace */
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 4c1ee7f2bebc..882f835a0d85 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4461,18 +4461,14 @@ perf_output_sample_regs(struct perf_output_handle *handle,
 }
 
 static void perf_sample_regs_user(struct perf_regs *regs_user,
-                                  struct pt_regs *regs)
+                                  struct pt_regs *regs,
+                                  struct pt_regs *regs_user_copy)
 {
-        if (!user_mode(regs)) {
-                if (current->mm)
-                        regs = task_pt_regs(current);
-                else
-                        regs = NULL;
-        }
-
-        if (regs) {
-                regs_user->abi  = perf_reg_abi(current);
+        if (user_mode(regs)) {
+                regs_user->abi = perf_reg_abi(current);
                 regs_user->regs = regs;
+        } else if (current->mm) {
+                perf_get_regs_user(regs_user, regs, regs_user_copy);
         } else {
                 regs_user->abi = PERF_SAMPLE_REGS_ABI_NONE;
                 regs_user->regs = NULL;
@@ -4951,7 +4947,8 @@ void perf_prepare_sample(struct perf_event_header *header,
         }
 
         if (sample_type & (PERF_SAMPLE_REGS_USER | PERF_SAMPLE_STACK_USER))
-                perf_sample_regs_user(&data->regs_user, regs);
+                perf_sample_regs_user(&data->regs_user, regs,
+                                      &data->regs_user_copy);
 
         if (sample_type & PERF_SAMPLE_REGS_USER) {
                 /* regs dump ABI info */
diff --git a/kernel/exit.c b/kernel/exit.c
index 1ea4369890a3..6806c55475ee 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1287,9 +1287,15 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
 static int wait_consider_task(struct wait_opts *wo, int ptrace,
                                 struct task_struct *p)
 {
+        /*
+         * We can race with wait_task_zombie() from another thread.
+         * Ensure that EXIT_ZOMBIE -> EXIT_DEAD/EXIT_TRACE transition
+         * can't confuse the checks below.
+         */
+        int exit_state = ACCESS_ONCE(p->exit_state);
         int ret;
 
-        if (unlikely(p->exit_state == EXIT_DEAD))
+        if (unlikely(exit_state == EXIT_DEAD))
                 return 0;
 
         ret = eligible_child(wo, p);
@@ -1310,7 +1316,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
                 return 0;
         }
 
-        if (unlikely(p->exit_state == EXIT_TRACE)) {
+        if (unlikely(exit_state == EXIT_TRACE)) {
                 /*
                  * ptrace == 0 means we are the natural parent. In this case
                  * we should clear notask_error, debugger will notify us.
@@ -1337,7 +1343,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
         }
 
         /* slay zombie? */
-        if (p->exit_state == EXIT_ZOMBIE) {
+        if (exit_state == EXIT_ZOMBIE) {
                 /* we don't reap group leaders with subthreads */
                 if (!delay_group_leader(p)) {
                         /*
diff --git a/kernel/locking/mutex-debug.c b/kernel/locking/mutex-debug.c
index 5cf6731b98e9..3ef3736002d8 100644
--- a/kernel/locking/mutex-debug.c
+++ b/kernel/locking/mutex-debug.c
@@ -80,13 +80,13 @@ void debug_mutex_unlock(struct mutex *lock)
                         DEBUG_LOCKS_WARN_ON(lock->owner != current);
 
                 DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
-                mutex_clear_owner(lock);
         }
 
         /*
          * __mutex_slowpath_needs_to_unlock() is explicitly 0 for debug
          * mutexes so that we can do it here after we've verified state.
          */
+        mutex_clear_owner(lock);
         atomic_set(&lock->count, 1);
 }
 
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index b5797b78add6..c0accc00566e 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -7113,9 +7113,6 @@ void __init sched_init(void)
 #ifdef CONFIG_RT_GROUP_SCHED
         alloc_size += 2 * nr_cpu_ids * sizeof(void **);
 #endif
-#ifdef CONFIG_CPUMASK_OFFSTACK
-        alloc_size += num_possible_cpus() * cpumask_size();
-#endif
         if (alloc_size) {
                 ptr = (unsigned long)kzalloc(alloc_size, GFP_NOWAIT);
 
@@ -7135,13 +7132,13 @@ void __init sched_init(void)
                 ptr += nr_cpu_ids * sizeof(void **);
 
 #endif /* CONFIG_RT_GROUP_SCHED */
+        }
 #ifdef CONFIG_CPUMASK_OFFSTACK
-                for_each_possible_cpu(i) {
-                        per_cpu(load_balance_mask, i) = (void *)ptr;
-                        ptr += cpumask_size();
-                }
-#endif /* CONFIG_CPUMASK_OFFSTACK */
+        for_each_possible_cpu(i) {
+                per_cpu(load_balance_mask, i) = (cpumask_var_t)kzalloc_node(
+                        cpumask_size(), GFP_KERNEL, cpu_to_node(i));
         }
+#endif /* CONFIG_CPUMASK_OFFSTACK */
 
         init_rt_bandwidth(&def_rt_bandwidth,
                         global_rt_period(), global_rt_runtime());
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index e5db8c6feebd..b52092f2636d 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -570,24 +570,7 @@ void init_dl_task_timer(struct sched_dl_entity *dl_se)
 static
 int dl_runtime_exceeded(struct rq *rq, struct sched_dl_entity *dl_se)
 {
-        int dmiss = dl_time_before(dl_se->deadline, rq_clock(rq));
-        int rorun = dl_se->runtime <= 0;
-
-        if (!rorun && !dmiss)
-                return 0;
-
-        /*
-         * If we are beyond our current deadline and we are still
-         * executing, then we have already used some of the runtime of
-         * the next instance. Thus, if we do not account that, we are
-         * stealing bandwidth from the system at each deadline miss!
-         */
-        if (dmiss) {
-                dl_se->runtime = rorun ? dl_se->runtime : 0;
-                dl_se->runtime -= rq_clock(rq) - dl_se->deadline;
-        }
-
-        return 1;
+        return (dl_se->runtime <= 0);
 }
 
 extern bool sched_rt_bandwidth_account(struct rt_rq *rt_rq);
@@ -826,10 +809,10 @@ enqueue_dl_entity(struct sched_dl_entity *dl_se,
          * parameters of the task might need updating. Otherwise,
          * we want a replenishment of its runtime.
          */
-        if (!dl_se->dl_new && flags & ENQUEUE_REPLENISH)
-                replenish_dl_entity(dl_se, pi_se);
-        else
+        if (dl_se->dl_new || flags & ENQUEUE_WAKEUP)
                 update_dl_entity(dl_se, pi_se);
+        else if (flags & ENQUEUE_REPLENISH)
+                replenish_dl_entity(dl_se, pi_se);
 
         __enqueue_dl_entity(dl_se);
 }
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index df2cdf77f899..40667cbf371b 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4005,6 +4005,10 @@ void __start_cfs_bandwidth(struct cfs_bandwidth *cfs_b, bool force)
 
 static void destroy_cfs_bandwidth(struct cfs_bandwidth *cfs_b)
 {
+        /* init_cfs_bandwidth() was not called */
+        if (!cfs_b->throttled_cfs_rq.next)
+                return;
+
         hrtimer_cancel(&cfs_b->period_timer);
         hrtimer_cancel(&cfs_b->slack_timer);
 }
@@ -4424,7 +4428,7 @@ static long effective_load(struct task_group *tg, int cpu, long wl, long wg)
                  * wl = S * s'_i; see (2)
                  */
                 if (W > 0 && w < W)
-                        wl = (w * tg->shares) / W;
+                        wl = (w * (long)tg->shares) / W;
                 else
                         wl = tg->shares;
 
diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c
index b0b1c44e923a..3ccf5c2c1320 100644
--- a/kernel/trace/trace_kdb.c
+++ b/kernel/trace/trace_kdb.c
@@ -132,8 +132,8 @@ static int kdb_ftdump(int argc, const char **argv)
 
 static __init int kdb_ftrace_register(void)
 {
-        kdb_register_repeat("ftdump", kdb_ftdump, "[skip_#lines] [cpu]",
-                            "Dump ftrace log", 0, KDB_REPEAT_NONE);
+        kdb_register_flags("ftdump", kdb_ftdump, "[skip_#lines] [cpu]",
+                            "Dump ftrace log", 0, KDB_ENABLE_ALWAYS_SAFE);
         return 0;
 }
 
diff --git a/lib/Kconfig.kgdb b/lib/Kconfig.kgdb
index 358eb81fa28d..c635a107a7de 100644
--- a/lib/Kconfig.kgdb
+++ b/lib/Kconfig.kgdb
@@ -73,6 +73,31 @@ config KGDB_KDB
         help
           KDB frontend for kernel
 
+config KDB_DEFAULT_ENABLE
+        hex "KDB: Select kdb command functions to be enabled by default"
+        depends on KGDB_KDB
+        default 0x1
+        help
+          Specifiers which kdb commands are enabled by default. This may
+          be set to 1 or 0 to enable all commands or disable almost all
+          commands.
+
+          Alternatively the following bitmask applies:
+
+            0x0002 - allow arbitrary reads from memory and symbol lookup
+            0x0004 - allow arbitrary writes to memory
+            0x0008 - allow current register state to be inspected
+            0x0010 - allow current register state to be modified
+            0x0020 - allow passive inspection (backtrace, process list, lsmod)
+            0x0040 - allow flow control management (breakpoint, single step)
+            0x0080 - enable signalling of processes
+            0x0100 - allow machine to be rebooted
+
+          The config option merely sets the default at boot time. Both
+          issuing 'echo X > /sys/module/kdb/parameters/cmd_enable' or
+          setting with kdb.cmd_enable=X kernel command line option will
+          override the default settings.
+
 config KDB_KEYBOARD
         bool "KGDB_KDB: keyboard as input device"
         depends on VT && KGDB_KDB
diff --git a/lib/assoc_array.c b/lib/assoc_array.c
index 2404d03e251a..03dd576e6773 100644
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -11,6 +11,7 @@
  * 2 of the Licence, or (at your option) any later version.
  */
 //#define DEBUG
+#include <linux/rcupdate.h>
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/assoc_array_priv.h>
diff --git a/mm/Kconfig.debug b/mm/Kconfig.debug
index 56badfc4810a..957d3da53ddd 100644
--- a/mm/Kconfig.debug
+++ b/mm/Kconfig.debug
@@ -14,7 +14,6 @@ config DEBUG_PAGEALLOC
         depends on !KMEMCHECK
         select PAGE_EXTENSION
         select PAGE_POISONING if !ARCH_SUPPORTS_DEBUG_PAGEALLOC
-        select PAGE_GUARD if ARCH_SUPPORTS_DEBUG_PAGEALLOC
         ---help---
           Unmap pages from the kernel linear mapping after free_pages().
           This results in a large slowdown, but helps to find certain types
@@ -27,13 +26,5 @@ config DEBUG_PAGEALLOC
           that would result in incorrect warnings of memory corruption after
           a resume because free pages are not saved to the suspend image.
 
-config WANT_PAGE_DEBUG_FLAGS
-        bool
-
 config PAGE_POISONING
         bool
-        select WANT_PAGE_DEBUG_FLAGS
-
-config PAGE_GUARD
-        bool
-        select WANT_PAGE_DEBUG_FLAGS
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index ef91e856c7e4..851924fa5170 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3043,18 +3043,6 @@ static int mem_cgroup_move_swap_account(swp_entry_t entry,
         if (swap_cgroup_cmpxchg(entry, old_id, new_id) == old_id) {
                 mem_cgroup_swap_statistics(from, false);
                 mem_cgroup_swap_statistics(to, true);
-                /*
-                 * This function is only called from task migration context now.
-                 * It postpones page_counter and refcount handling till the end
-                 * of task migration(mem_cgroup_clear_mc()) for performance
-                 * improvement. But we cannot postpone css_get(to)  because if
-                 * the process that has been moved to @to does swap-in, the
-                 * refcount of @to might be decreased to 0.
-                 *
-                 * We are in attach() phase, so the cgroup is guaranteed to be
-                 * alive, so we can just call css_get().
-                 */
-                css_get(&to->css);
                 return 0;
         }
         return -EINVAL;
@@ -4679,6 +4667,7 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
         if (parent_css == NULL) {
                 root_mem_cgroup = memcg;
                 page_counter_init(&memcg->memory, NULL);
+                memcg->soft_limit = PAGE_COUNTER_MAX;
                 page_counter_init(&memcg->memsw, NULL);
                 page_counter_init(&memcg->kmem, NULL);
         }
@@ -4724,6 +4713,7 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css)
 
         if (parent->use_hierarchy) {
                 page_counter_init(&memcg->memory, &parent->memory);
+                memcg->soft_limit = PAGE_COUNTER_MAX;
                 page_counter_init(&memcg->memsw, &parent->memsw);
                 page_counter_init(&memcg->kmem, &parent->kmem);
 
@@ -4733,6 +4723,7 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css)
                  */
         } else {
                 page_counter_init(&memcg->memory, NULL);
+                memcg->soft_limit = PAGE_COUNTER_MAX;
                 page_counter_init(&memcg->memsw, NULL);
                 page_counter_init(&memcg->kmem, NULL);
                 /*
@@ -4807,7 +4798,7 @@ static void mem_cgroup_css_reset(struct cgroup_subsys_state *css)
         mem_cgroup_resize_limit(memcg, PAGE_COUNTER_MAX);
         mem_cgroup_resize_memsw_limit(memcg, PAGE_COUNTER_MAX);
         memcg_update_kmem_limit(memcg, PAGE_COUNTER_MAX);
-        memcg->soft_limit = 0;
+        memcg->soft_limit = PAGE_COUNTER_MAX;
 }
 
 #ifdef CONFIG_MMU
diff --git a/mm/memory.c b/mm/memory.c
index ca920d1fd314..c6565f00fb38 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2137,17 +2137,24 @@ reuse:
                 if (!dirty_page)
                         return ret;
 
-                /*
-                 * Yes, Virginia, this is actually required to prevent a race
-                 * with clear_page_dirty_for_io() from clearing the page dirty
-                 * bit after it clear all dirty ptes, but before a racing
-                 * do_wp_page installs a dirty pte.
-                 *
-                 * do_shared_fault is protected similarly.
-                 */
                 if (!page_mkwrite) {
-                        wait_on_page_locked(dirty_page);
-                        set_page_dirty_balance(dirty_page);
+                        struct address_space *mapping;
+                        int dirtied;
+
+                        lock_page(dirty_page);
+                        dirtied = set_page_dirty(dirty_page);
+                        VM_BUG_ON_PAGE(PageAnon(dirty_page), dirty_page);
+                        mapping = dirty_page->mapping;
+                        unlock_page(dirty_page);
+
+                        if (dirtied && mapping) {
+                                /*
+                                 * Some device drivers do not set page.mapping
+                                 * but still dirty their pages
+                                 */
+                                balance_dirty_pages_ratelimited(mapping);
+                        }
+
                         /* file_update_time outside page_lock */
                         if (vma->vm_file)
                                 file_update_time(vma->vm_file);
@@ -2593,7 +2600,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
                 if (prev && prev->vm_end == address)
                         return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
 
-                expand_downwards(vma, address - PAGE_SIZE);
+                return expand_downwards(vma, address - PAGE_SIZE);
         }
         if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
                 struct vm_area_struct *next = vma->vm_next;
@@ -2602,7 +2609,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
                 if (next && next->vm_start == address + PAGE_SIZE)
                         return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
 
-                expand_upwards(vma, address + PAGE_SIZE);
+                return expand_upwards(vma, address + PAGE_SIZE);
         }
         return 0;
 }
diff --git a/mm/mmap.c b/mm/mmap.c
index 7b36aa7cc89a..7f684d5a8087 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -778,10 +778,12 @@ again:			remove_next = 1 + (end > next->vm_end);
                 if (exporter && exporter->anon_vma && !importer->anon_vma) {
                         int error;
 
+                        importer->anon_vma = exporter->anon_vma;
                         error = anon_vma_clone(importer, exporter);
-                        if (error)
+                        if (error) {
+                                importer->anon_vma = NULL;
                                 return error;
-                        importer->anon_vma = exporter->anon_vma;
+                        }
                 }
         }
 
@@ -2099,14 +2101,17 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
 {
         struct mm_struct *mm = vma->vm_mm;
         struct rlimit *rlim = current->signal->rlim;
-        unsigned long new_start;
+        unsigned long new_start, actual_size;
 
         /* address space limit tests */
         if (!may_expand_vm(mm, grow))
                 return -ENOMEM;
 
         /* Stack limit test */
-        if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+        actual_size = size;
+        if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
+                actual_size -= PAGE_SIZE;
+        if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
                 return -ENOMEM;
 
         /* mlock limit tests */
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index d5d81f5384d1..6f4335238e33 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1541,16 +1541,6 @@ pause:
                 bdi_start_background_writeback(bdi);
 }
 
-void set_page_dirty_balance(struct page *page)
-{
-        if (set_page_dirty(page)) {
-                struct address_space *mapping = page_mapping(page);
-
-                if (mapping)
-                        balance_dirty_pages_ratelimited(mapping);
-        }
-}
-
 static DEFINE_PER_CPU(int, bdp_ratelimits);
 
 /*
@@ -2123,32 +2113,25 @@ EXPORT_SYMBOL(account_page_dirtied);
  * page dirty in that case, but not all the buffers.  This is a "bottom-up"
  * dirtying, whereas __set_page_dirty_buffers() is a "top-down" dirtying.
  *
- * Most callers have locked the page, which pins the address_space in memory.
- * But zap_pte_range() does not lock the page, however in that case the
- * mapping is pinned by the vma's ->vm_file reference.
- *
- * We take care to handle the case where the page was truncated from the
- * mapping by re-checking page_mapping() inside tree_lock.
+ * The caller must ensure this doesn't race with truncation.  Most will simply
+ * hold the page lock, but e.g. zap_pte_range() calls with the page mapped and
+ * the pte lock held, which also locks out truncation.
  */
 int __set_page_dirty_nobuffers(struct page *page)
 {
         if (!TestSetPageDirty(page)) {
                 struct address_space *mapping = page_mapping(page);
-                struct address_space *mapping2;
                 unsigned long flags;
 
                 if (!mapping)
                         return 1;
 
                 spin_lock_irqsave(&mapping->tree_lock, flags);
-                mapping2 = page_mapping(page);
-                if (mapping2) { /* Race with truncate? */
-                        BUG_ON(mapping2 != mapping);
-                        WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
-                        account_page_dirtied(page, mapping);
-                        radix_tree_tag_set(&mapping->page_tree,
-                                page_index(page), PAGECACHE_TAG_DIRTY);
-                }
+                BUG_ON(page_mapping(page) != mapping);
+                WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
+                account_page_dirtied(page, mapping);
+                radix_tree_tag_set(&mapping->page_tree, page_index(page),
+                                   PAGECACHE_TAG_DIRTY);
                 spin_unlock_irqrestore(&mapping->tree_lock, flags);
                 if (mapping->host) {
                         /* !PageAnon && !swapper_space */
@@ -2305,12 +2288,10 @@ int clear_page_dirty_for_io(struct page *page)
                 /*
                  * We carefully synchronise fault handlers against
                  * installing a dirty pte and marking the page dirty
-                 * at this point. We do this by having them hold the
-                 * page lock at some point after installing their
-                 * pte, but before marking the page dirty.
-                 * Pages are always locked coming in here, so we get
-                 * the desired exclusion. See mm/memory.c:do_wp_page()
-                 * for more comments.
+                 * at this point.  We do this by having them hold the
+                 * page lock while dirtying the page, and pages are
+                 * always locked coming in here, so we get the desired
+                 * exclusion.
                  */
                 if (TestClearPageDirty(page)) {
                         dec_zone_page_state(page, NR_FILE_DIRTY);
diff --git a/mm/rmap.c b/mm/rmap.c
index c5bc241127b2..71cd5bd0c17d 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -72,6 +72,8 @@ static inline struct anon_vma *anon_vma_alloc(void)
         anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
         if (anon_vma) {
                 atomic_set(&anon_vma->refcount, 1);
+                anon_vma->degree = 1;   /* Reference for first vma */
+                anon_vma->parent = anon_vma;
                 /*
                  * Initialise the anon_vma root to point to itself. If called
                  * from fork, the root will be reset to the parents anon_vma.
@@ -188,6 +190,8 @@ int anon_vma_prepare(struct vm_area_struct *vma)
                 if (likely(!vma->anon_vma)) {
                         vma->anon_vma = anon_vma;
                         anon_vma_chain_link(vma, avc, anon_vma);
+                        /* vma reference or self-parent link for new root */
+                        anon_vma->degree++;
                         allocated = NULL;
                         avc = NULL;
                 }
@@ -236,6 +240,14 @@ static inline void unlock_anon_vma_root(struct anon_vma *root)
 /*
  * Attach the anon_vmas from src to dst.
  * Returns 0 on success, -ENOMEM on failure.
+ *
+ * If dst->anon_vma is NULL this function tries to find and reuse existing
+ * anon_vma which has no vmas and only one child anon_vma. This prevents
+ * degradation of anon_vma hierarchy to endless linear chain in case of
+ * constantly forking task. On the other hand, an anon_vma with more than one
+ * child isn't reused even if there was no alive vma, thus rmap walker has a
+ * good chance of avoiding scanning the whole hierarchy when it searches where
+ * page is mapped.
  */
 int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
 {
@@ -256,7 +268,21 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
                 anon_vma = pavc->anon_vma;
                 root = lock_anon_vma_root(root, anon_vma);
                 anon_vma_chain_link(dst, avc, anon_vma);
+
+                /*
+                 * Reuse existing anon_vma if its degree lower than two,
+                 * that means it has no vma and only one anon_vma child.
+                 *
+                 * Do not chose parent anon_vma, otherwise first child
+                 * will always reuse it. Root anon_vma is never reused:
+                 * it has self-parent reference and at least one child.
+                 */
+                if (!dst->anon_vma && anon_vma != src->anon_vma &&
+                                anon_vma->degree < 2)
+                        dst->anon_vma = anon_vma;
         }
+        if (dst->anon_vma)
+                dst->anon_vma->degree++;
         unlock_anon_vma_root(root);
         return 0;
 
@@ -280,6 +306,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
         if (!pvma->anon_vma)
                 return 0;
 
+        /* Drop inherited anon_vma, we'll reuse existing or allocate new. */
+        vma->anon_vma = NULL;
+
         /*
          * First, attach the new VMA to the parent VMA's anon_vmas,
          * so rmap can find non-COWed pages in child processes.
@@ -288,6 +317,10 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
         if (error)
                 return error;
 
+        /* An existing anon_vma has been reused, all done then. */
+        if (vma->anon_vma)
+                return 0;
+
         /* Then add our own anon_vma. */
         anon_vma = anon_vma_alloc();
         if (!anon_vma)
@@ -301,6 +334,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
          * lock any of the anon_vmas in this anon_vma tree.
          */
         anon_vma->root = pvma->anon_vma->root;
+        anon_vma->parent = pvma->anon_vma;
         /*
          * With refcounts, an anon_vma can stay around longer than the
          * process it belongs to. The root anon_vma needs to be pinned until
@@ -311,6 +345,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
         vma->anon_vma = anon_vma;
         anon_vma_lock_write(anon_vma);
         anon_vma_chain_link(vma, avc, anon_vma);
+        anon_vma->parent->degree++;
         anon_vma_unlock_write(anon_vma);
 
         return 0;
@@ -341,12 +376,16 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
                  * Leave empty anon_vmas on the list - we'll need
                  * to free them outside the lock.
                  */
-                if (RB_EMPTY_ROOT(&anon_vma->rb_root))
+                if (RB_EMPTY_ROOT(&anon_vma->rb_root)) {
+                        anon_vma->parent->degree--;
                         continue;
+                }
 
                 list_del(&avc->same_vma);
                 anon_vma_chain_free(avc);
         }
+        if (vma->anon_vma)
+                vma->anon_vma->degree--;
         unlock_anon_vma_root(root);
 
         /*
@@ -357,6 +396,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
         list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
                 struct anon_vma *anon_vma = avc->anon_vma;
 
+                BUG_ON(anon_vma->degree);
                 put_anon_vma(anon_vma);
 
                 list_del(&avc->same_vma);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index bd9a72bc4a1b..ab2505c3ef54 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2921,18 +2921,20 @@ static bool prepare_kswapd_sleep(pg_data_t *pgdat, int order, long remaining,
                 return false;
 
         /*
-         * There is a potential race between when kswapd checks its watermarks
-         * and a process gets throttled. There is also a potential race if
-         * processes get throttled, kswapd wakes, a large process exits therby
-         * balancing the zones that causes kswapd to miss a wakeup. If kswapd
-         * is going to sleep, no process should be sleeping on pfmemalloc_wait
-         * so wake them now if necessary. If necessary, processes will wake
-         * kswapd and get throttled again
+         * The throttled processes are normally woken up in balance_pgdat() as
+         * soon as pfmemalloc_watermark_ok() is true. But there is a potential
+         * race between when kswapd checks the watermarks and a process gets
+         * throttled. There is also a potential race if processes get
+         * throttled, kswapd wakes, a large process exits thereby balancing the
+         * zones, which causes kswapd to exit balance_pgdat() before reaching
+         * the wake up checks. If kswapd is going to sleep, no process should
+         * be sleeping on pfmemalloc_wait, so wake them now if necessary. If
+         * the wake up is premature, processes will wake kswapd and get
+         * throttled again. The difference from wake ups in balance_pgdat() is
+         * that here we are under prepare_to_wait().
          */
-        if (waitqueue_active(&pgdat->pfmemalloc_wait)) {
-                wake_up(&pgdat->pfmemalloc_wait);
-                return false;
-        }
+        if (waitqueue_active(&pgdat->pfmemalloc_wait))
+                wake_up_all(&pgdat->pfmemalloc_wait);
 
         return pgdat_balanced(pgdat, order, classzone_idx);
 }
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index ab6bb2af1d45..b24e4bb64fb5 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -685,11 +685,13 @@ static void batadv_mcast_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
                 if (orig_initialized)
                         atomic_dec(&bat_priv->mcast.num_disabled);
                 orig->capabilities |= BATADV_ORIG_CAPA_HAS_MCAST;
-        /* If mcast support is being switched off increase the disabled
-         * mcast node counter.
+        /* If mcast support is being switched off or if this is an initial
+         * OGM without mcast support then increase the disabled mcast
+         * node counter.
          */
         } else if (!orig_mcast_enabled &&
-                   orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) {
+                   (orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST ||
+                    !orig_initialized)) {
                 atomic_inc(&bat_priv->mcast.num_disabled);
                 orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_MCAST;
         }
@@ -738,7 +740,8 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig)
 {
         struct batadv_priv *bat_priv = orig->bat_priv;
 
-        if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST))
+        if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) &&
+            orig->capa_initialized & BATADV_ORIG_CAPA_HAS_MCAST)
                 atomic_dec(&bat_priv->mcast.num_disabled);
 
         batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index 8d04d174669e..fab47f1f3ef9 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -133,7 +133,7 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
         if (!bat_priv->nc.decoding_hash)
                 goto err;
 
-        batadv_hash_set_lock_class(bat_priv->nc.coding_hash,
+        batadv_hash_set_lock_class(bat_priv->nc.decoding_hash,
                                    &batadv_nc_decoding_hash_lock_class_key);
 
         INIT_DELAYED_WORK(&bat_priv->nc.work, batadv_nc_worker);
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 6a484514cd3e..bea8198d0198 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -570,9 +570,6 @@ static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
 
         batadv_frag_purge_orig(orig_node, NULL);
 
-        batadv_tt_global_del_orig(orig_node->bat_priv, orig_node, -1,
-                                  "originator timed out");
-
         if (orig_node->bat_priv->bat_algo_ops->bat_orig_free)
                 orig_node->bat_priv->bat_algo_ops->bat_orig_free(orig_node);
 
@@ -678,6 +675,7 @@ struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
         atomic_set(&orig_node->last_ttvn, 0);
         orig_node->tt_buff = NULL;
         orig_node->tt_buff_len = 0;
+        orig_node->last_seen = jiffies;
         reset_time = jiffies - 1 - msecs_to_jiffies(BATADV_RESET_PROTECTION_MS);
         orig_node->bcast_seqno_reset = reset_time;
 #ifdef CONFIG_BATMAN_ADV_MCAST
@@ -977,6 +975,9 @@ static void _batadv_purge_orig(struct batadv_priv *bat_priv)
                         if (batadv_purge_orig_node(bat_priv, orig_node)) {
                                 batadv_gw_node_delete(bat_priv, orig_node);
                                 hlist_del_rcu(&orig_node->hash_entry);
+                                batadv_tt_global_del_orig(orig_node->bat_priv,
+                                                          orig_node, -1,
+                                                          "originator timed out");
                                 batadv_orig_node_free_ref(orig_node);
                                 continue;
                         }
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 35f76f2f7824..6648f321864d 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -443,11 +443,13 @@ batadv_find_router(struct batadv_priv *bat_priv,
 
         router = batadv_orig_router_get(orig_node, recv_if);
 
+        if (!router)
+                return router;
+
         /* only consider bonding for recv_if == BATADV_IF_DEFAULT (first hop)
          * and if activated.
          */
-        if (recv_if == BATADV_IF_DEFAULT || !atomic_read(&bat_priv->bonding) ||
-            !router)
+        if (!(recv_if == BATADV_IF_DEFAULT && atomic_read(&bat_priv->bonding)))
                 return router;
 
         /* bonding: loop through the list of possible routers found
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 15845814a0f2..ba6eb17226da 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -676,7 +676,7 @@ static int calcu_signature(struct ceph_x_authorizer *au,
         int ret;
         char tmp_enc[40];
         __le32 tmp[5] = {
-                16u, msg->hdr.crc, msg->footer.front_crc,
+                cpu_to_le32(16), msg->hdr.crc, msg->footer.front_crc,
                 msg->footer.middle_crc, msg->footer.data_crc,
         };
         ret = ceph_x_encrypt(&au->session_key, &tmp, sizeof(tmp),
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index a83062ceeec9..f2148e22b148 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -717,7 +717,7 @@ static int get_poolop_reply_buf(const char *src, size_t src_len,
         if (src_len != sizeof(u32) + dst_len)
                 return -EINVAL;
 
-        buf_len = le32_to_cpu(*(u32 *)src);
+        buf_len = le32_to_cpu(*(__le32 *)src);
         if (buf_len != dst_len)
                 return -EINVAL;
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7f18262e2326..65caf8b95e17 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2019,7 +2019,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
                         break;
 
-                if (tso_segs == 1) {
+                if (tso_segs == 1 || !max_segs) {
                         if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
                                                      (tcp_skb_is_last(sk, skb) ?
                                                       nonagle : TCP_NAGLE_PUSH))))
@@ -2032,7 +2032,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 }
 
                 limit = mss_now;
-                if (tso_segs > 1 && !tcp_urg_mode(tp))
+                if (tso_segs > 1 && max_segs && !tcp_urg_mode(tp))
                         limit = tcp_mss_split_point(sk, skb, mss_now,
                                                     min_t(unsigned int,
                                                           cwnd_quota,
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 0bb7038121ac..bd4e46ec32bd 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -140,7 +140,9 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
         if (!ret) {
                 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
 
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                         sdata->crypto_tx_tailroom_needed_cnt--;
 
                 WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
@@ -188,7 +190,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
         sta = key->sta;
         sdata = key->sdata;
 
-        if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+        if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+              (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+              (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                 increment_tailroom_need_count(sdata);
 
         ret = drv_set_key(key->local, DISABLE_KEY, sdata,
@@ -884,7 +888,9 @@ void ieee80211_remove_key(struct ieee80211_key_conf *keyconf)
         if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                 key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
 
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                         increment_tailroom_need_count(key->sdata);
         }
 
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 70bef2ab7f2b..da2fae0873a5 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -70,6 +70,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
 {
         struct flow_stats *stats;
         int node = numa_node_id();
+        int len = skb->len + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
 
         stats = rcu_dereference(flow->stats[node]);
 
@@ -105,7 +106,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
                                 if (likely(new_stats)) {
                                         new_stats->used = jiffies;
                                         new_stats->packet_count = 1;
-                                        new_stats->byte_count = skb->len;
+                                        new_stats->byte_count = len;
                                         new_stats->tcp_flags = tcp_flags;
                                         spin_lock_init(&new_stats->lock);
 
@@ -120,7 +121,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
 
         stats->used = jiffies;
         stats->packet_count++;
-        stats->byte_count += skb->len;
+        stats->byte_count += len;
         stats->tcp_flags |= tcp_flags;
 unlock:
         spin_unlock(&stats->lock);
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 53f3ebbfceab..2034c6d9cb5a 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -480,7 +480,7 @@ void ovs_vport_receive(struct vport *vport, struct sk_buff *skb,
         stats = this_cpu_ptr(vport->percpu_stats);
         u64_stats_update_begin(&stats->syncp);
         stats->rx_packets++;
-        stats->rx_bytes += skb->len;
+        stats->rx_bytes += skb->len + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
         u64_stats_update_end(&stats->syncp);
 
         OVS_CB(skb)->input_vport = vport;
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 1cb61242e55e..4439ac4c1b53 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -606,7 +606,7 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
         struct kvec *head = buf->head;
         struct kvec *tail = buf->tail;
         int fraglen;
-        int new, old;
+        int new;
 
         if (len > buf->len) {
                 WARN_ON_ONCE(1);
@@ -629,8 +629,8 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
         buf->len -= fraglen;
 
         new = buf->page_base + buf->page_len;
-        old = new + fraglen;
-        xdr->page_ptr -= (old >> PAGE_SHIFT) - (new >> PAGE_SHIFT);
+
+        xdr->page_ptr = buf->pages + (new >> PAGE_SHIFT);
 
         if (buf->page_len) {
                 xdr->p = page_address(*xdr->page_ptr);
diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
index 1bca180db8ad..627f8cbbedb8 100644
--- a/scripts/Makefile.clean
+++ b/scripts/Makefile.clean
@@ -42,19 +42,19 @@ __clean-files	:= $(extra-y) $(extra-m) $(extra-)       \
 
 __clean-files   := $(filter-out $(no-clean-files), $(__clean-files))
 
-# as clean-files is given relative to the current directory, this adds
-# a $(obj) prefix, except for absolute paths
+# clean-files is given relative to the current directory, unless it
+# starts with $(objtree)/ (which means "./", so do not add "./" unless
+# you want to delete a file from the toplevel object directory).
 
 __clean-files   := $(wildcard                                               \
-                   $(addprefix $(obj)/, $(filter-out /%, $(__clean-files))) \
-                   $(filter /%, $(__clean-files)))
+                   $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(__clean-files))) \
+                   $(filter $(objtree)/%, $(__clean-files)))
 
-# as clean-dirs is given relative to the current directory, this adds
-# a $(obj) prefix, except for absolute paths
+# same as clean-files
 
 __clean-dirs    := $(wildcard                                               \
-                   $(addprefix $(obj)/, $(filter-out /%, $(clean-dirs)))    \
-                   $(filter /%, $(clean-dirs)))
+                   $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(clean-dirs)))    \
+                   $(filter $(objtree)/%, $(clean-dirs)))
 
 # ==========================================================================
 
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 9609a7f0faea..c7952375ac53 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -148,12 +148,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
                 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
                         atomic_dec(&key->user->nikeys);
 
-                key_user_put(key->user);
-
                 /* now throw away the key memory */
                 if (key->type->destroy)
                         key->type->destroy(key);
 
+                key_user_put(key->user);
+
                 kfree(key->description);
 
 #ifdef KEY_DEBUGGING
diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c
index 255dabc6fc33..2a85e4209f0b 100644
--- a/sound/firewire/fireworks/fireworks_transaction.c
+++ b/sound/firewire/fireworks/fireworks_transaction.c
@@ -124,7 +124,7 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
         spin_lock_irq(&efw->lock);
 
         t = (struct snd_efw_transaction *)data;
-        length = min_t(size_t, t->length * sizeof(t->length), length);
+        length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
 
         if (efw->push_ptr < efw->pull_ptr)
                 capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 5f13d2d18079..b422e406a9cb 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -3353,6 +3353,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
 { .id = 0x10de0067, .name = "MCP67 HDMI",       .patch = patch_nvhdmi_2ch },
 { .id = 0x10de0070, .name = "GPU 70 HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de0071, .name = "GPU 71 HDMI/DP",   .patch = patch_nvhdmi },
+{ .id = 0x10de0072, .name = "GPU 72 HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de8001, .name = "MCP73 HDMI",       .patch = patch_nvhdmi_2ch },
 { .id = 0x11069f80, .name = "VX900 HDMI/DP",    .patch = patch_via_hdmi },
 { .id = 0x11069f81, .name = "VX900 HDMI/DP",    .patch = patch_via_hdmi },
@@ -3413,6 +3414,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0060");
 MODULE_ALIAS("snd-hda-codec-id:10de0067");
 MODULE_ALIAS("snd-hda-codec-id:10de0070");
 MODULE_ALIAS("snd-hda-codec-id:10de0071");
+MODULE_ALIAS("snd-hda-codec-id:10de0072");
 MODULE_ALIAS("snd-hda-codec-id:10de8001");
 MODULE_ALIAS("snd-hda-codec-id:11069f80");
 MODULE_ALIAS("snd-hda-codec-id:11069f81");
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 4f6413e01c13..605d14003d25 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -568,9 +568,9 @@ static void stac_store_hints(struct hda_codec *codec)
                         spec->gpio_mask;
         }
         if (get_int_hint(codec, "gpio_dir", &spec->gpio_dir))
-                spec->gpio_mask &= spec->gpio_mask;
-        if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
                 spec->gpio_dir &= spec->gpio_mask;
+        if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
+                spec->gpio_data &= spec->gpio_mask;
         if (get_int_hint(codec, "eapd_mask", &spec->eapd_mask))
                 spec->eapd_mask &= spec->gpio_mask;
         if (get_int_hint(codec, "gpio_mute", &spec->gpio_mute))
diff --git a/sound/usb/Kconfig b/sound/usb/Kconfig
index d393153c474f..a452ad7cec40 100644
--- a/sound/usb/Kconfig
+++ b/sound/usb/Kconfig
@@ -160,5 +160,7 @@ config SND_BCD2000
           To compile this driver as a module, choose M here: the module
           will be called snd-bcd2000.
 
+source "sound/usb/line6/Kconfig"
+
 endif   # SND_USB
 
diff --git a/sound/usb/Makefile b/sound/usb/Makefile
index bcee4060fd18..54045b745d11 100644
--- a/sound/usb/Makefile
+++ b/sound/usb/Makefile
@@ -25,3 +25,4 @@ obj-$(CONFIG_SND_USB_USX2Y) += snd-usbmidi-lib.o
 obj-$(CONFIG_SND_USB_US122L) += snd-usbmidi-lib.o
 
 obj-$(CONFIG_SND) += misc/ usx2y/ caiaq/ 6fire/ hiface/ bcd2000/
+obj-$(CONFIG_LINE6_USB)         += line6/
diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
index 272844746135..327f8642ca80 100644
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -816,7 +816,7 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev)
                 return -EINVAL;
         }
 
-        if (cdev->n_streams < 2) {
+        if (cdev->n_streams < 1) {
                 dev_err(dev, "bogus number of streams: %d\n", cdev->n_streams);
                 return -EINVAL;
         }
diff --git a/drivers/staging/line6/Kconfig b/sound/usb/line6/Kconfig
index 4f1219b4c692..4f1219b4c692 100644
--- a/drivers/staging/line6/Kconfig
+++ b/sound/usb/line6/Kconfig
diff --git a/drivers/staging/line6/Makefile b/sound/usb/line6/Makefile
index ae5c374b0f87..ae5c374b0f87 100644
--- a/drivers/staging/line6/Makefile
+++ b/sound/usb/line6/Makefile
diff --git a/drivers/staging/line6/audio.c b/sound/usb/line6/audio.c
index 171d80c1b020..171d80c1b020 100644
--- a/drivers/staging/line6/audio.c
+++ b/sound/usb/line6/audio.c
diff --git a/drivers/staging/line6/audio.h b/sound/usb/line6/audio.h
index 5f8a09a0fa95..5f8a09a0fa95 100644
--- a/drivers/staging/line6/audio.h
+++ b/sound/usb/line6/audio.h
diff --git a/drivers/staging/line6/capture.c b/sound/usb/line6/capture.c
index e6ca631e3f79..f24c7c5e0a3e 100644
--- a/drivers/staging/line6/capture.c
+++ b/sound/usb/line6/capture.c
@@ -400,6 +400,7 @@ struct snd_pcm_ops snd_line6_capture_ops = {
 
 int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm)
 {
+        struct usb_line6 *line6 = line6pcm->line6;
         int i;
 
         /* create audio URBs and fill in constant values: */
@@ -411,14 +412,14 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm)
                     usb_alloc_urb(LINE6_ISO_PACKETS, GFP_KERNEL);
 
                 if (urb == NULL) {
-                        dev_err(line6pcm->line6->ifcdev, "Out of memory\n");
+                        dev_err(line6->ifcdev, "Out of memory\n");
                         return -ENOMEM;
                 }
 
-                urb->dev = line6pcm->line6->usbdev;
+                urb->dev = line6->usbdev;
                 urb->pipe =
-                    usb_rcvisocpipe(line6pcm->line6->usbdev,
-                                    line6pcm->ep_audio_read &
+                    usb_rcvisocpipe(line6->usbdev,
+                                    line6->properties->ep_audio_r &
                                     USB_ENDPOINT_NUMBER_MASK);
                 urb->transfer_flags = URB_ISO_ASAP;
                 urb->start_frame = -1;
diff --git a/drivers/staging/line6/capture.h b/sound/usb/line6/capture.h
index 4157bcb598a9..4157bcb598a9 100644
--- a/drivers/staging/line6/capture.h
+++ b/sound/usb/line6/capture.h
diff --git a/drivers/staging/line6/driver.c b/sound/usb/line6/driver.c
index 503b2d763595..fc852f6ab8bc 100644
--- a/drivers/staging/line6/driver.c
+++ b/sound/usb/line6/driver.c
@@ -30,61 +30,251 @@
 #define DRIVER_DESC    "Line6 USB Driver"
 #define DRIVER_VERSION "0.9.1beta" DRIVER_REVISION
 
+#define LINE6_DEVICE(prod) USB_DEVICE(0x0e41, prod)
+#define LINE6_IF_NUM(prod, n) USB_DEVICE_INTERFACE_NUMBER(0x0e41, prod, n)
+
 /* table of devices that work with this driver */
 static const struct usb_device_id line6_id_table[] = {
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_BASSPODXT)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_BASSPODXTLIVE)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_BASSPODXTPRO)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_GUITARPORT)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_POCKETPOD)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_PODHD300)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_PODHD400)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_PODHD500)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_PODSTUDIO_GX)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_PODSTUDIO_UX1)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_PODSTUDIO_UX2)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_PODX3)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_PODX3LIVE)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_PODXT)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_PODXTLIVE)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_PODXTPRO)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_TONEPORT_GX)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_TONEPORT_UX1)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_TONEPORT_UX2)},
-        {USB_DEVICE(LINE6_VENDOR_ID, LINE6_DEVID_VARIAX)},
-        {},
+        { LINE6_DEVICE(0x4250),    .driver_info = LINE6_BASSPODXT },
+        { LINE6_DEVICE(0x4642),    .driver_info = LINE6_BASSPODXTLIVE },
+        { LINE6_DEVICE(0x4252),    .driver_info = LINE6_BASSPODXTPRO },
+        { LINE6_DEVICE(0x4750),    .driver_info = LINE6_GUITARPORT },
+        { LINE6_IF_NUM(0x5051, 1), .driver_info = LINE6_POCKETPOD },
+        { LINE6_DEVICE(0x5057),    .driver_info = LINE6_PODHD300 },
+        { LINE6_DEVICE(0x5058),    .driver_info = LINE6_PODHD400 },
+        { LINE6_IF_NUM(0x414D, 0), .driver_info = LINE6_PODHD500_0 },
+        { LINE6_IF_NUM(0x414D, 1), .driver_info = LINE6_PODHD500_1 },
+        { LINE6_DEVICE(0x4153),    .driver_info = LINE6_PODSTUDIO_GX },
+        { LINE6_DEVICE(0x4150),    .driver_info = LINE6_PODSTUDIO_UX1 },
+        { LINE6_IF_NUM(0x4151, 0), .driver_info = LINE6_PODSTUDIO_UX2 },
+        { LINE6_DEVICE(0x5044),    .driver_info = LINE6_PODXT },
+        { LINE6_IF_NUM(0x4650, 0), .driver_info = LINE6_PODXTLIVE_POD },
+        { LINE6_IF_NUM(0x4650, 1), .driver_info = LINE6_PODXTLIVE_VARIAX },
+        { LINE6_DEVICE(0x5050),    .driver_info = LINE6_PODXTPRO },
+        { LINE6_DEVICE(0x4147),    .driver_info = LINE6_TONEPORT_GX },
+        { LINE6_DEVICE(0x4141),    .driver_info = LINE6_TONEPORT_UX1 },
+        { LINE6_IF_NUM(0x4142, 0), .driver_info = LINE6_TONEPORT_UX2 },
+        { LINE6_DEVICE(0x534d),    .driver_info = LINE6_VARIAX },
+        {}
 };
 
 MODULE_DEVICE_TABLE(usb, line6_id_table);
 
-#define L6PROP(dev_bit, dev_id, dev_name, dev_cap)\
-        {.device_bit = LINE6_BIT_##dev_bit, .id = dev_id,\
-         .name = dev_name, .capabilities = LINE6_BIT_##dev_cap}
-
-/* *INDENT-OFF* */
 static const struct line6_properties line6_properties_table[] = {
-        L6PROP(BASSPODXT,     "BassPODxt",     "BassPODxt",        CTRL_PCM_HW),
-        L6PROP(BASSPODXTLIVE, "BassPODxtLive", "BassPODxt Live",   CTRL_PCM_HW),
-        L6PROP(BASSPODXTPRO,  "BassPODxtPro",  "BassPODxt Pro",    CTRL_PCM_HW),
-        L6PROP(GUITARPORT,    "GuitarPort",    "GuitarPort",       PCM),
-        L6PROP(POCKETPOD,     "PocketPOD",     "Pocket POD",       CONTROL),
-        L6PROP(PODHD300,      "PODHD300",      "POD HD300",        CTRL_PCM_HW),
-        L6PROP(PODHD400,      "PODHD400",      "POD HD400",        CTRL_PCM_HW),
-        L6PROP(PODHD500,      "PODHD500",      "POD HD500",        CTRL_PCM_HW),
-        L6PROP(PODSTUDIO_GX,  "PODStudioGX",   "POD Studio GX",    PCM),
-        L6PROP(PODSTUDIO_UX1, "PODStudioUX1",  "POD Studio UX1",   PCM),
-        L6PROP(PODSTUDIO_UX2, "PODStudioUX2",  "POD Studio UX2",   PCM),
-        L6PROP(PODX3,         "PODX3",         "POD X3",           PCM),
-        L6PROP(PODX3LIVE,     "PODX3Live",     "POD X3 Live",      PCM),
-        L6PROP(PODXT,         "PODxt",         "PODxt",            CTRL_PCM_HW),
-        L6PROP(PODXTLIVE,     "PODxtLive",     "PODxt Live",       CTRL_PCM_HW),
-        L6PROP(PODXTPRO,      "PODxtPro",      "PODxt Pro",        CTRL_PCM_HW),
-        L6PROP(TONEPORT_GX,   "TonePortGX",    "TonePort GX",      PCM),
-        L6PROP(TONEPORT_UX1,  "TonePortUX1",   "TonePort UX1",     PCM),
-        L6PROP(TONEPORT_UX2,  "TonePortUX2",   "TonePort UX2",     PCM),
-        L6PROP(VARIAX,        "Variax",        "Variax Workbench", CONTROL),
+        [LINE6_BASSPODXT] = {
+                .id = "BassPODxt",
+                .name = "BassPODxt",
+                .capabilities   = LINE6_CAP_CONTROL
+                                | LINE6_CAP_PCM
+                                | LINE6_CAP_HWMON,
+                .altsetting = 5,
+                .ep_ctrl_r = 0x84,
+                .ep_ctrl_w = 0x03,
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_BASSPODXTLIVE] = {
+                .id = "BassPODxtLive",
+                .name = "BassPODxt Live",
+                .capabilities   = LINE6_CAP_CONTROL
+                                | LINE6_CAP_PCM
+                                | LINE6_CAP_HWMON,
+                .altsetting = 1,
+                .ep_ctrl_r = 0x84,
+                .ep_ctrl_w = 0x03,
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_BASSPODXTPRO] = {
+                .id = "BassPODxtPro",
+                .name = "BassPODxt Pro",
+                .capabilities   = LINE6_CAP_CONTROL
+                                | LINE6_CAP_PCM
+                                | LINE6_CAP_HWMON,
+                .altsetting = 5,
+                .ep_ctrl_r = 0x84,
+                .ep_ctrl_w = 0x03,
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_GUITARPORT] = {
+                .id = "GuitarPort",
+                .name = "GuitarPort",
+                .capabilities   = LINE6_CAP_PCM,
+                .altsetting = 2,  /* 1..4 seem to be ok */
+                /* no control channel */
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_POCKETPOD] = {
+                .id = "PocketPOD",
+                .name = "Pocket POD",
+                .capabilities   = LINE6_CAP_CONTROL,
+                .altsetting = 0,
+                .ep_ctrl_r = 0x82,
+                .ep_ctrl_w = 0x02,
+                /* no audio channel */
+        },
+        [LINE6_PODHD300] = {
+                .id = "PODHD300",
+                .name = "POD HD300",
+                .capabilities   = LINE6_CAP_CONTROL
+                                | LINE6_CAP_PCM
+                                | LINE6_CAP_HWMON,
+                .altsetting = 5,
+                .ep_ctrl_r = 0x84,
+                .ep_ctrl_w = 0x03,
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_PODHD400] = {
+                .id = "PODHD400",
+                .name = "POD HD400",
+                .capabilities   = LINE6_CAP_CONTROL
+                                | LINE6_CAP_PCM
+                                | LINE6_CAP_HWMON,
+                .altsetting = 5,
+                .ep_ctrl_r = 0x84,
+                .ep_ctrl_w = 0x03,
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_PODHD500_0] = {
+                .id = "PODHD500",
+                .name = "POD HD500",
+                .capabilities   = LINE6_CAP_CONTROL
+                                | LINE6_CAP_PCM
+                                | LINE6_CAP_HWMON,
+                .altsetting = 1,
+                .ep_ctrl_r = 0x81,
+                .ep_ctrl_w = 0x01,
+                .ep_audio_r = 0x86,
+                .ep_audio_w = 0x02,
+        },
+        [LINE6_PODHD500_1] = {
+                .id = "PODHD500",
+                .name = "POD HD500",
+                .capabilities   = LINE6_CAP_CONTROL
+                                | LINE6_CAP_PCM
+                                | LINE6_CAP_HWMON,
+                .altsetting = 1,
+                .ep_ctrl_r = 0x81,
+                .ep_ctrl_w = 0x01,
+                .ep_audio_r = 0x86,
+                .ep_audio_w = 0x02,
+        },
+        [LINE6_PODSTUDIO_GX] = {
+                .id = "PODStudioGX",
+                .name = "POD Studio GX",
+                .capabilities   = LINE6_CAP_PCM,
+                .altsetting = 2,  /* 1..4 seem to be ok */
+                /* no control channel */
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_PODSTUDIO_UX1] = {
+                .id = "PODStudioUX1",
+                .name = "POD Studio UX1",
+                .capabilities   = LINE6_CAP_PCM,
+                .altsetting = 2,  /* 1..4 seem to be ok */
+                /* no control channel */
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_PODSTUDIO_UX2] = {
+                .id = "PODStudioUX2",
+                .name = "POD Studio UX2",
+                .capabilities   = LINE6_CAP_PCM,
+                .altsetting = 2,  /* defaults to 44.1kHz, 16-bit */
+                /* no control channel */
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_PODXT] = {
+                .id = "PODxt",
+                .name = "PODxt",
+                .capabilities   = LINE6_CAP_CONTROL
+                                | LINE6_CAP_PCM
+                                | LINE6_CAP_HWMON,
+                .altsetting = 5,
+                .ep_ctrl_r = 0x84,
+                .ep_ctrl_w = 0x03,
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_PODXTLIVE_POD] = {
+                .id = "PODxtLive",
+                .name = "PODxt Live",
+                .capabilities   = LINE6_CAP_CONTROL
+                                | LINE6_CAP_PCM
+                                | LINE6_CAP_HWMON,
+                .altsetting = 1,
+                .ep_ctrl_r = 0x84,
+                .ep_ctrl_w = 0x03,
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_PODXTLIVE_VARIAX] = {
+                .id = "PODxtLive",
+                .name = "PODxt Live",
+                .capabilities   = LINE6_CAP_CONTROL
+                                | LINE6_CAP_PCM
+                                | LINE6_CAP_HWMON,
+                .altsetting = 1,
+                .ep_ctrl_r = 0x86,
+                .ep_ctrl_w = 0x05,
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_PODXTPRO] = {
+                .id = "PODxtPro",
+                .name = "PODxt Pro",
+                .capabilities   = LINE6_CAP_CONTROL
+                                | LINE6_CAP_PCM
+                                | LINE6_CAP_HWMON,
+                .altsetting = 5,
+                .ep_ctrl_r = 0x84,
+                .ep_ctrl_w = 0x03,
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_TONEPORT_GX] = {
+                .id = "TonePortGX",
+                .name = "TonePort GX",
+                .capabilities   = LINE6_CAP_PCM,
+                .altsetting = 2,  /* 1..4 seem to be ok */
+                /* no control channel */
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_TONEPORT_UX1] = {
+                .id = "TonePortUX1",
+                .name = "TonePort UX1",
+                .capabilities   = LINE6_CAP_PCM,
+                .altsetting = 2,  /* 1..4 seem to be ok */
+                /* no control channel */
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_TONEPORT_UX2] = {
+                .id = "TonePortUX2",
+                .name = "TonePort UX2",
+                .capabilities   = LINE6_CAP_PCM,
+                .altsetting = 2,  /* defaults to 44.1kHz, 16-bit */
+                /* no control channel */
+                .ep_audio_r = 0x82,
+                .ep_audio_w = 0x01,
+        },
+        [LINE6_VARIAX] = {
+                .id = "Variax",
+                .name = "Variax Workbench",
+                .capabilities   = LINE6_CAP_CONTROL,
+                .altsetting = 1,
+                .ep_ctrl_r = 0x82,
+                .ep_ctrl_w = 0x01,
+                /* no audio channel */
+        }
 };
-/* *INDENT-ON* */
 
 /*
         This is Line6's MIDI manufacturer ID.
@@ -126,9 +316,9 @@ static int line6_start_listen(struct usb_line6 *line6)
         int err;
 
         usb_fill_int_urb(line6->urb_listen, line6->usbdev,
-                         usb_rcvintpipe(line6->usbdev, line6->ep_control_read),
-                         line6->buffer_listen, LINE6_BUFSIZE_LISTEN,
-                         line6_data_received, line6, line6->interval);
+                usb_rcvintpipe(line6->usbdev, line6->properties->ep_ctrl_r),
+                line6->buffer_listen, LINE6_BUFSIZE_LISTEN,
+                line6_data_received, line6, line6->interval);
         line6->urb_listen->actual_length = 0;
         err = usb_submit_urb(line6->urb_listen, GFP_ATOMIC);
         return err;
@@ -158,7 +348,7 @@ int line6_send_raw_message(struct usb_line6 *line6, const char *buffer,
 
                 retval = usb_interrupt_msg(line6->usbdev,
                                         usb_sndintpipe(line6->usbdev,
-                                                line6->ep_control_write),
+                                                line6->properties->ep_ctrl_w),
                                         (char *)frag_buf, frag_size,
                                         &partial, LINE6_TIMEOUT * HZ);
 
@@ -200,9 +390,9 @@ static int line6_send_raw_message_async_part(struct message *msg,
         int bytes = min(msg->size - done, line6->max_packet_size);
 
         usb_fill_int_urb(urb, line6->usbdev,
-                         usb_sndintpipe(line6->usbdev, line6->ep_control_write),
-                         (char *)msg->buffer + done, bytes,
-                         line6_async_request_sent, msg, line6->interval);
+                usb_sndintpipe(line6->usbdev, line6->properties->ep_ctrl_w),
+                (char *)msg->buffer + done, bytes,
+                line6_async_request_sent, msg, line6->interval);
 
         msg->done += bytes;
         retval = usb_submit_urb(urb, GFP_ATOMIC);
@@ -347,50 +537,8 @@ static void line6_data_received(struct urb *urb)
                 line6->message_length = done;
                 line6_midi_receive(line6, line6->buffer_message, done);
 
-                switch (le16_to_cpu(line6->usbdev->descriptor.idProduct)) {
-                case LINE6_DEVID_BASSPODXT:
-                case LINE6_DEVID_BASSPODXTLIVE:
-                case LINE6_DEVID_BASSPODXTPRO:
-                case LINE6_DEVID_PODXT:
-                case LINE6_DEVID_PODXTPRO:
-                case LINE6_DEVID_POCKETPOD:
-                        line6_pod_process_message((struct usb_line6_pod *)
-                                                  line6);
-                        break;
-
-                case LINE6_DEVID_PODHD300:
-                case LINE6_DEVID_PODHD400:
-                case LINE6_DEVID_PODHD500:
-                        break; /* let userspace handle MIDI */
-
-                case LINE6_DEVID_PODXTLIVE:
-                        switch (line6->interface_number) {
-                        case PODXTLIVE_INTERFACE_POD:
-                                line6_pod_process_message((struct usb_line6_pod
-                                                           *)line6);
-                                break;
-
-                        case PODXTLIVE_INTERFACE_VARIAX:
-                                line6_variax_process_message((struct
-                                                              usb_line6_variax
-                                                              *)line6);
-                                break;
-
-                        default:
-                                dev_err(line6->ifcdev,
-                                        "PODxt Live interface %d not supported\n",
-                                        line6->interface_number);
-                        }
-                        break;
-
-                case LINE6_DEVID_VARIAX:
-                        line6_variax_process_message((struct usb_line6_variax *)
-                                                     line6);
-                        break;
-
-                default:
-                        MISSING_CASE;
-                }
+                if (line6->process_message)
+                        line6->process_message(line6);
         }
 
         line6_start_listen(line6);
@@ -414,7 +562,7 @@ int line6_send_program(struct usb_line6 *line6, u8 value)
 
         retval = usb_interrupt_msg(line6->usbdev,
                                    usb_sndintpipe(line6->usbdev,
-                                                  line6->ep_control_write),
+                                                  line6->properties->ep_ctrl_w),
                                    buffer, 2, &partial, LINE6_TIMEOUT * HZ);
 
         if (retval)
@@ -444,7 +592,7 @@ int line6_transmit_parameter(struct usb_line6 *line6, int param, u8 value)
 
         retval = usb_interrupt_msg(line6->usbdev,
                                    usb_sndintpipe(line6->usbdev,
-                                                  line6->ep_control_write),
+                                                  line6->properties->ep_ctrl_w),
                                    buffer, 3, &partial, LINE6_TIMEOUT * HZ);
 
         if (retval)
@@ -608,14 +756,12 @@ static void line6_destruct(struct usb_interface *interface)
 static int line6_probe(struct usb_interface *interface,
                        const struct usb_device_id *id)
 {
-        int devtype;
+        enum line6_device_type devtype;
         struct usb_device *usbdev;
         struct usb_line6 *line6;
         const struct line6_properties *properties;
-        int interface_number, alternate = 0;
-        int product;
+        int interface_number;
         int size = 0;
-        int ep_read = 0, ep_write = 0;
         int ret;
 
         if (interface == NULL)
@@ -630,184 +776,66 @@ static int line6_probe(struct usb_interface *interface,
                 goto err_put;
         }
 
-        /* check vendor and product id */
-        for (devtype = ARRAY_SIZE(line6_id_table) - 1; devtype--;) {
-                u16 idVendor = le16_to_cpu(usbdev->descriptor.idVendor);
-                u16 idProduct = le16_to_cpu(usbdev->descriptor.idProduct);
-
-                if (idVendor == line6_id_table[devtype].idVendor &&
-                    idProduct == line6_id_table[devtype].idProduct)
-                        break;
-        }
-
-        if (devtype < 0) {
-                ret = -ENODEV;
-                goto err_put;
-        }
+        devtype = id->driver_info;
 
         /* initialize device info: */
         properties = &line6_properties_table[devtype];
         dev_info(&interface->dev, "Line6 %s found\n", properties->name);
-        product = le16_to_cpu(usbdev->descriptor.idProduct);
 
         /* query interface number */
         interface_number = interface->cur_altsetting->desc.bInterfaceNumber;
 
-        switch (product) {
-        case LINE6_DEVID_BASSPODXTLIVE:
-        case LINE6_DEVID_PODXTLIVE:
-        case LINE6_DEVID_VARIAX:
-                alternate = 1;
-                break;
-
-        case LINE6_DEVID_POCKETPOD:
-                switch (interface_number) {
-                case 0:
-                        return -ENODEV; /* this interface has no endpoints */
-                case 1:
-                        alternate = 0;
-                        break;
-                default:
-                        MISSING_CASE;
-                }
-                break;
-
-        case LINE6_DEVID_PODHD500:
-        case LINE6_DEVID_PODX3:
-        case LINE6_DEVID_PODX3LIVE:
-                switch (interface_number) {
-                case 0:
-                        alternate = 1;
-                        break;
-                case 1:
-                        alternate = 0;
-                        break;
-                default:
-                        MISSING_CASE;
-                }
-                break;
-
-        case LINE6_DEVID_BASSPODXT:
-        case LINE6_DEVID_BASSPODXTPRO:
-        case LINE6_DEVID_PODXT:
-        case LINE6_DEVID_PODXTPRO:
-        case LINE6_DEVID_PODHD300:
-        case LINE6_DEVID_PODHD400:
-                alternate = 5;
-                break;
-
-        case LINE6_DEVID_GUITARPORT:
-        case LINE6_DEVID_PODSTUDIO_GX:
-        case LINE6_DEVID_PODSTUDIO_UX1:
-        case LINE6_DEVID_TONEPORT_GX:
-        case LINE6_DEVID_TONEPORT_UX1:
-                alternate = 2;  /* 1..4 seem to be ok */
-                break;
-
-        case LINE6_DEVID_TONEPORT_UX2:
-        case LINE6_DEVID_PODSTUDIO_UX2:
-                switch (interface_number) {
-                case 0:
-                        /* defaults to 44.1kHz, 16-bit */
-                        alternate = 2;
-                        break;
-                case 1:
-                        /* don't know yet what this is ...
-                           alternate = 1;
-                           break;
-                         */
-                        return -ENODEV;
-                default:
-                        MISSING_CASE;
-                }
-                break;
-
-        default:
-                MISSING_CASE;
-                ret = -ENODEV;
-                goto err_put;
-        }
-
-        ret = usb_set_interface(usbdev, interface_number, alternate);
+        ret = usb_set_interface(usbdev, interface_number,
+                        properties->altsetting);
         if (ret < 0) {
                 dev_err(&interface->dev, "set_interface failed\n");
                 goto err_put;
         }
 
-        /* initialize device data based on product id: */
-        switch (product) {
-        case LINE6_DEVID_BASSPODXT:
-        case LINE6_DEVID_BASSPODXTLIVE:
-        case LINE6_DEVID_BASSPODXTPRO:
-        case LINE6_DEVID_PODXT:
-        case LINE6_DEVID_PODXTPRO:
+        /* initialize device data based on device: */
+        switch (devtype) {
+        case LINE6_BASSPODXT:
+        case LINE6_BASSPODXTLIVE:
+        case LINE6_BASSPODXTPRO:
+        case LINE6_PODXT:
+        case LINE6_PODXTPRO:
                 size = sizeof(struct usb_line6_pod);
-                ep_read = 0x84;
-                ep_write = 0x03;
                 break;
 
-        case LINE6_DEVID_PODHD300:
-        case LINE6_DEVID_PODHD400:
+        case LINE6_PODHD300:
+        case LINE6_PODHD400:
                 size = sizeof(struct usb_line6_podhd);
-                ep_read = 0x84;
-                ep_write = 0x03;
                 break;
 
-        case LINE6_DEVID_PODHD500:
+        case LINE6_PODHD500_0:
+        case LINE6_PODHD500_1:
                 size = sizeof(struct usb_line6_podhd);
-                ep_read = 0x81;
-                ep_write = 0x01;
-                break;
-
-        case LINE6_DEVID_POCKETPOD:
-                size = sizeof(struct usb_line6_pod);
-                ep_read = 0x82;
-                ep_write = 0x02;
                 break;
 
-        case LINE6_DEVID_PODX3:
-        case LINE6_DEVID_PODX3LIVE:
-                /* currently unused! */
+        case LINE6_POCKETPOD:
                 size = sizeof(struct usb_line6_pod);
-                ep_read = 0x81;
-                ep_write = 0x01;
                 break;
 
-        case LINE6_DEVID_PODSTUDIO_GX:
-        case LINE6_DEVID_PODSTUDIO_UX1:
-        case LINE6_DEVID_PODSTUDIO_UX2:
-        case LINE6_DEVID_TONEPORT_GX:
-        case LINE6_DEVID_TONEPORT_UX1:
-        case LINE6_DEVID_TONEPORT_UX2:
-        case LINE6_DEVID_GUITARPORT:
+        case LINE6_PODSTUDIO_GX:
+        case LINE6_PODSTUDIO_UX1:
+        case LINE6_PODSTUDIO_UX2:
+        case LINE6_TONEPORT_GX:
+        case LINE6_TONEPORT_UX1:
+        case LINE6_TONEPORT_UX2:
+        case LINE6_GUITARPORT:
                 size = sizeof(struct usb_line6_toneport);
-                /* these don't have a control channel */
                 break;
 
-        case LINE6_DEVID_PODXTLIVE:
-                switch (interface_number) {
-                case PODXTLIVE_INTERFACE_POD:
-                        size = sizeof(struct usb_line6_pod);
-                        ep_read = 0x84;
-                        ep_write = 0x03;
-                        break;
-
-                case PODXTLIVE_INTERFACE_VARIAX:
-                        size = sizeof(struct usb_line6_variax);
-                        ep_read = 0x86;
-                        ep_write = 0x05;
-                        break;
+        case LINE6_PODXTLIVE_POD:
+                size = sizeof(struct usb_line6_pod);
+                break;
 
-                default:
-                        ret = -ENODEV;
-                        goto err_put;
-                }
+        case LINE6_PODXTLIVE_VARIAX:
+                size = sizeof(struct usb_line6_variax);
                 break;
 
-        case LINE6_DEVID_VARIAX:
+        case LINE6_VARIAX:
                 size = sizeof(struct usb_line6_variax);
-                ep_read = 0x82;
-                ep_write = 0x01;
                 break;
 
         default:
@@ -830,19 +858,16 @@ static int line6_probe(struct usb_interface *interface,
         }
 
         /* store basic data: */
-        line6->interface_number = interface_number;
         line6->properties = properties;
         line6->usbdev = usbdev;
         line6->ifcdev = &interface->dev;
-        line6->ep_control_read = ep_read;
-        line6->ep_control_write = ep_write;
-        line6->product = product;
+        line6->type = devtype;
 
         /* get data from endpoint descriptor (see usb_maxpacket): */
         {
                 struct usb_host_endpoint *ep;
-                unsigned epnum =
-                    usb_pipeendpoint(usb_rcvintpipe(usbdev, ep_read));
+                unsigned pipe = usb_rcvintpipe(usbdev, properties->ep_ctrl_r);
+                unsigned epnum = usb_pipeendpoint(pipe);
                 ep = usbdev->ep_in[epnum];
 
                 if (ep != NULL) {
@@ -859,7 +884,7 @@ static int line6_probe(struct usb_interface *interface,
 
         usb_set_intfdata(interface, line6);
 
-        if (properties->capabilities & LINE6_BIT_CONTROL) {
+        if (properties->capabilities & LINE6_CAP_CONTROL) {
                 /* initialize USB buffers: */
                 line6->buffer_listen =
                     kmalloc(LINE6_BUFSIZE_LISTEN, GFP_KERNEL);
@@ -892,65 +917,44 @@ static int line6_probe(struct usb_interface *interface,
                 }
         }
 
-        /* initialize device data based on product id: */
-        switch (product) {
-        case LINE6_DEVID_BASSPODXT:
-        case LINE6_DEVID_BASSPODXTLIVE:
-        case LINE6_DEVID_BASSPODXTPRO:
-        case LINE6_DEVID_POCKETPOD:
-        case LINE6_DEVID_PODX3:
-        case LINE6_DEVID_PODX3LIVE:
-        case LINE6_DEVID_PODXT:
-        case LINE6_DEVID_PODXTPRO:
-                ret = line6_pod_init(interface, (struct usb_line6_pod *)line6);
+        /* initialize device data based on device: */
+        switch (devtype) {
+        case LINE6_BASSPODXT:
+        case LINE6_BASSPODXTLIVE:
+        case LINE6_BASSPODXTPRO:
+        case LINE6_POCKETPOD:
+        case LINE6_PODXT:
+        case LINE6_PODXTPRO:
+                ret = line6_pod_init(interface, line6);
                 break;
 
-        case LINE6_DEVID_PODHD300:
-        case LINE6_DEVID_PODHD400:
-        case LINE6_DEVID_PODHD500:
-                ret = line6_podhd_init(interface,
-                                       (struct usb_line6_podhd *)line6);
+        case LINE6_PODHD300:
+        case LINE6_PODHD400:
+        case LINE6_PODHD500_0:
+        case LINE6_PODHD500_1:
+                ret = line6_podhd_init(interface, line6);
                 break;
 
-        case LINE6_DEVID_PODXTLIVE:
-                switch (interface_number) {
-                case PODXTLIVE_INTERFACE_POD:
-                        ret =
-                            line6_pod_init(interface,
-                                           (struct usb_line6_pod *)line6);
-                        break;
-
-                case PODXTLIVE_INTERFACE_VARIAX:
-                        ret =
-                            line6_variax_init(interface,
-                                              (struct usb_line6_variax *)line6);
-                        break;
-
-                default:
-                        dev_err(&interface->dev,
-                                "PODxt Live interface %d not supported\n",
-                                interface_number);
-                        ret = -ENODEV;
-                }
+        case LINE6_PODXTLIVE_POD:
+                ret = line6_pod_init(interface, line6);
+                break;
 
+        case LINE6_PODXTLIVE_VARIAX:
+                ret = line6_variax_init(interface, line6);
                 break;
 
-        case LINE6_DEVID_VARIAX:
-                ret =
-                    line6_variax_init(interface,
-                                      (struct usb_line6_variax *)line6);
+        case LINE6_VARIAX:
+                ret = line6_variax_init(interface, line6);
                 break;
 
-        case LINE6_DEVID_PODSTUDIO_GX:
-        case LINE6_DEVID_PODSTUDIO_UX1:
-        case LINE6_DEVID_PODSTUDIO_UX2:
-        case LINE6_DEVID_TONEPORT_GX:
-        case LINE6_DEVID_TONEPORT_UX1:
-        case LINE6_DEVID_TONEPORT_UX2:
-        case LINE6_DEVID_GUITARPORT:
-                ret =
-                    line6_toneport_init(interface,
-                                        (struct usb_line6_toneport *)line6);
+        case LINE6_PODSTUDIO_GX:
+        case LINE6_PODSTUDIO_UX1:
+        case LINE6_PODSTUDIO_UX2:
+        case LINE6_TONEPORT_GX:
+        case LINE6_TONEPORT_UX1:
+        case LINE6_TONEPORT_UX2:
+        case LINE6_GUITARPORT:
+                ret = line6_toneport_init(interface, line6);
                 break;
 
         default:
@@ -971,14 +975,6 @@ static int line6_probe(struct usb_interface *interface,
         dev_info(&interface->dev, "Line6 %s now attached\n",
                  line6->properties->name);
 
-        switch (product) {
-        case LINE6_DEVID_PODX3:
-        case LINE6_DEVID_PODX3LIVE:
-                dev_info(&interface->dev,
-                         "NOTE: the Line6 %s is detected, but not yet supported\n",
-                         line6->properties->name);
-        }
-
         /* increment reference counters: */
         usb_get_intf(interface);
         usb_get_dev(usbdev);
@@ -1021,54 +1017,7 @@ static void line6_disconnect(struct usb_interface *interface)
                         dev_err(line6->ifcdev,
                                 "driver bug: inconsistent usb device\n");
 
-                switch (le16_to_cpu(line6->usbdev->descriptor.idProduct)) {
-                case LINE6_DEVID_BASSPODXT:
-                case LINE6_DEVID_BASSPODXTLIVE:
-                case LINE6_DEVID_BASSPODXTPRO:
-                case LINE6_DEVID_POCKETPOD:
-                case LINE6_DEVID_PODX3:
-                case LINE6_DEVID_PODX3LIVE:
-                case LINE6_DEVID_PODXT:
-                case LINE6_DEVID_PODXTPRO:
-                        line6_pod_disconnect(interface);
-                        break;
-
-                case LINE6_DEVID_PODHD300:
-                case LINE6_DEVID_PODHD400:
-                case LINE6_DEVID_PODHD500:
-                        line6_podhd_disconnect(interface);
-                        break;
-
-                case LINE6_DEVID_PODXTLIVE:
-                        switch (interface_number) {
-                        case PODXTLIVE_INTERFACE_POD:
-                                line6_pod_disconnect(interface);
-                                break;
-
-                        case PODXTLIVE_INTERFACE_VARIAX:
-                                line6_variax_disconnect(interface);
-                                break;
-                        }
-
-                        break;
-
-                case LINE6_DEVID_VARIAX:
-                        line6_variax_disconnect(interface);
-                        break;
-
-                case LINE6_DEVID_PODSTUDIO_GX:
-                case LINE6_DEVID_PODSTUDIO_UX1:
-                case LINE6_DEVID_PODSTUDIO_UX2:
-                case LINE6_DEVID_TONEPORT_GX:
-                case LINE6_DEVID_TONEPORT_UX1:
-                case LINE6_DEVID_TONEPORT_UX2:
-                case LINE6_DEVID_GUITARPORT:
-                        line6_toneport_disconnect(interface);
-                        break;
-
-                default:
-                        MISSING_CASE;
-                }
+                line6->disconnect(interface);
 
                 dev_info(&interface->dev, "Line6 %s now disconnected\n",
                          line6->properties->name);
@@ -1093,7 +1042,7 @@ static int line6_suspend(struct usb_interface *interface, pm_message_t message)
 
         snd_power_change_state(line6->card, SNDRV_CTL_POWER_D3hot);
 
-        if (line6->properties->capabilities & LINE6_BIT_CONTROL)
+        if (line6->properties->capabilities & LINE6_CAP_CONTROL)
                 line6_stop_listen(line6);
 
         if (line6pcm != NULL) {
@@ -1112,7 +1061,7 @@ static int line6_resume(struct usb_interface *interface)
 {
         struct usb_line6 *line6 = usb_get_intfdata(interface);
 
-        if (line6->properties->capabilities & LINE6_BIT_CONTROL)
+        if (line6->properties->capabilities & LINE6_CAP_CONTROL)
                 line6_start_listen(line6);
 
         snd_power_change_state(line6->card, SNDRV_CTL_POWER_D0);
@@ -1126,15 +1075,18 @@ static int line6_reset_resume(struct usb_interface *interface)
 {
         struct usb_line6 *line6 = usb_get_intfdata(interface);
 
-        switch (le16_to_cpu(line6->usbdev->descriptor.idProduct)) {
-        case LINE6_DEVID_PODSTUDIO_GX:
-        case LINE6_DEVID_PODSTUDIO_UX1:
-        case LINE6_DEVID_PODSTUDIO_UX2:
-        case LINE6_DEVID_TONEPORT_GX:
-        case LINE6_DEVID_TONEPORT_UX1:
-        case LINE6_DEVID_TONEPORT_UX2:
-        case LINE6_DEVID_GUITARPORT:
+        switch (line6->type) {
+        case LINE6_PODSTUDIO_GX:
+        case LINE6_PODSTUDIO_UX1:
+        case LINE6_PODSTUDIO_UX2:
+        case LINE6_TONEPORT_GX:
+        case LINE6_TONEPORT_UX1:
+        case LINE6_TONEPORT_UX2:
+        case LINE6_GUITARPORT:
                 line6_toneport_reset_resume((struct usb_line6_toneport *)line6);
+
+        default:
+                break;
         }
 
         return line6_resume(interface);
diff --git a/drivers/staging/line6/driver.h b/sound/usb/line6/driver.h
index 16e3fc2f1f15..ad203f197e80 100644
--- a/drivers/staging/line6/driver.h
+++ b/sound/usb/line6/driver.h
@@ -20,6 +20,29 @@
 
 #define DRIVER_NAME "line6usb"
 
+enum line6_device_type {
+        LINE6_BASSPODXT,
+        LINE6_BASSPODXTLIVE,
+        LINE6_BASSPODXTPRO,
+        LINE6_GUITARPORT,
+        LINE6_POCKETPOD,
+        LINE6_PODHD300,
+        LINE6_PODHD400,
+        LINE6_PODHD500_0,
+        LINE6_PODHD500_1,
+        LINE6_PODSTUDIO_GX,
+        LINE6_PODSTUDIO_UX1,
+        LINE6_PODSTUDIO_UX2,
+        LINE6_PODXT,
+        LINE6_PODXTLIVE_POD,
+        LINE6_PODXTLIVE_VARIAX,
+        LINE6_PODXTPRO,
+        LINE6_TONEPORT_GX,
+        LINE6_TONEPORT_UX1,
+        LINE6_TONEPORT_UX2,
+        LINE6_VARIAX
+};
+
 #define LINE6_TIMEOUT 1
 #define LINE6_BUFSIZE_LISTEN 32
 #define LINE6_MESSAGE_MAXLEN 256
@@ -76,11 +99,6 @@ static const int SYSEX_EXTRA_SIZE = sizeof(line6_midi_id) + 4;
 */
 struct line6_properties {
         /**
-                 Bit identifying this device in the line6usb driver.
-        */
-        int device_bit;
-
-        /**
                  Card id string (maximum 16 characters).
                  This can be used to address the device in ALSA programs as
                  "default:CARD=<id>"
@@ -97,6 +115,13 @@ struct line6_properties {
                  line6usb driver.
         */
         int capabilities;
+
+        int altsetting;
+
+        unsigned ep_ctrl_r;
+        unsigned ep_ctrl_w;
+        unsigned ep_audio_r;
+        unsigned ep_audio_w;
 };
 
 /**
@@ -110,9 +135,9 @@ struct usb_line6 {
         struct usb_device *usbdev;
 
         /**
-                 Product id.
+                 Device type.
         */
-        int product;
+        enum line6_device_type type;
 
         /**
                  Properties.
@@ -120,11 +145,6 @@ struct usb_line6 {
         const struct line6_properties *properties;
 
         /**
-                 Interface number.
-        */
-        int interface_number;
-
-        /**
                  Interval (ms).
         */
         int interval;
@@ -156,16 +176,6 @@ struct usb_line6 {
         struct snd_line6_midi *line6midi;
 
         /**
-                 USB endpoint for listening to control commands.
-        */
-        int ep_control_read;
-
-        /**
-                 USB endpoint for writing control commands.
-        */
-        int ep_control_write;
-
-        /**
                  URB for listening to PODxt Pro control endpoint.
         */
         struct urb *urb_listen;
@@ -184,6 +194,9 @@ struct usb_line6 {
                  Length of message to be processed.
         */
         int message_length;
+
+        void (*process_message)(struct usb_line6 *);
+        void (*disconnect)(struct usb_interface *);
 };
 
 extern char *line6_alloc_sysex_buffer(struct usb_line6 *line6, int code1,
diff --git a/drivers/staging/line6/midi.c b/sound/usb/line6/midi.c
index 1ac343b649c1..c9d725ae85a0 100644
--- a/drivers/staging/line6/midi.c
+++ b/sound/usb/line6/midi.c
@@ -136,7 +136,7 @@ static int send_midi_async(struct usb_line6 *line6, unsigned char *data,
 
         usb_fill_int_urb(urb, line6->usbdev,
                          usb_sndbulkpipe(line6->usbdev,
-                                         line6->ep_control_write),
+                                         line6->properties->ep_ctrl_w),
                          transfer_buffer, length, midi_sent, line6,
                          line6->interval);
         urb->actual_length = 0;
@@ -279,7 +279,7 @@ int line6_init_midi(struct usb_line6 *line6)
         int err;
         struct snd_line6_midi *line6midi;
 
-        if (!(line6->properties->capabilities & LINE6_BIT_CONTROL)) {
+        if (!(line6->properties->capabilities & LINE6_CAP_CONTROL)) {
                 /* skip MIDI initialization and report success */
                 return 0;
         }
diff --git a/drivers/staging/line6/midi.h b/sound/usb/line6/midi.h
index 78f903fb4d41..78f903fb4d41 100644
--- a/drivers/staging/line6/midi.h
+++ b/sound/usb/line6/midi.h
diff --git a/drivers/staging/line6/midibuf.c b/sound/usb/line6/midibuf.c
index 1ff856989fd6..1ff856989fd6 100644
--- a/drivers/staging/line6/midibuf.c
+++ b/sound/usb/line6/midibuf.c
diff --git a/drivers/staging/line6/midibuf.h b/sound/usb/line6/midibuf.h
index 707482b940e4..707482b940e4 100644
--- a/drivers/staging/line6/midibuf.h
+++ b/sound/usb/line6/midibuf.h
diff --git a/drivers/staging/line6/pcm.c b/sound/usb/line6/pcm.c
index a3136b189ee5..6d4e5cd0482c 100644
--- a/drivers/staging/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -421,60 +421,13 @@ int line6_init_pcm(struct usb_line6 *line6,
         };
 
         int err;
-        int ep_read = 0, ep_write = 0;
+        unsigned ep_read = line6->properties->ep_audio_r;
+        unsigned ep_write = line6->properties->ep_audio_w;
         struct snd_line6_pcm *line6pcm;
 
-        if (!(line6->properties->capabilities & LINE6_BIT_PCM))
+        if (!(line6->properties->capabilities & LINE6_CAP_PCM))
                 return 0;       /* skip PCM initialization and report success */
 
-        /* initialize PCM subsystem based on product id: */
-        switch (line6->product) {
-        case LINE6_DEVID_BASSPODXT:
-        case LINE6_DEVID_BASSPODXTLIVE:
-        case LINE6_DEVID_BASSPODXTPRO:
-        case LINE6_DEVID_PODXT:
-        case LINE6_DEVID_PODXTLIVE:
-        case LINE6_DEVID_PODXTPRO:
-        case LINE6_DEVID_PODHD300:
-        case LINE6_DEVID_PODHD400:
-                ep_read = 0x82;
-                ep_write = 0x01;
-                break;
-
-        case LINE6_DEVID_PODHD500:
-        case LINE6_DEVID_PODX3:
-        case LINE6_DEVID_PODX3LIVE:
-                ep_read = 0x86;
-                ep_write = 0x02;
-                break;
-
-        case LINE6_DEVID_POCKETPOD:
-                ep_read = 0x82;
-                ep_write = 0x02;
-                break;
-
-        case LINE6_DEVID_GUITARPORT:
-        case LINE6_DEVID_PODSTUDIO_GX:
-        case LINE6_DEVID_PODSTUDIO_UX1:
-        case LINE6_DEVID_PODSTUDIO_UX2:
-        case LINE6_DEVID_TONEPORT_GX:
-        case LINE6_DEVID_TONEPORT_UX1:
-        case LINE6_DEVID_TONEPORT_UX2:
-                ep_read = 0x82;
-                ep_write = 0x01;
-                break;
-
-        /* this is for interface_number == 1:
-        case LINE6_DEVID_TONEPORT_UX2:
-        case LINE6_DEVID_PODSTUDIO_UX2:
-                ep_read  = 0x87;
-                ep_write = 0x00;
-                break; */
-
-        default:
-                MISSING_CASE;
-        }
-
         line6pcm = kzalloc(sizeof(*line6pcm), GFP_KERNEL);
 
         if (line6pcm == NULL)
@@ -483,8 +436,6 @@ int line6_init_pcm(struct usb_line6 *line6,
         line6pcm->volume_playback[0] = line6pcm->volume_playback[1] = 255;
         line6pcm->volume_monitor = 255;
         line6pcm->line6 = line6;
-        line6pcm->ep_audio_read = ep_read;
-        line6pcm->ep_audio_write = ep_write;
 
         /* Read and write buffers are sized identically, so choose minimum */
         line6pcm->max_packet_size = min(
diff --git a/drivers/staging/line6/pcm.h b/sound/usb/line6/pcm.h
index 6aa0d46a2890..7315e8131184 100644
--- a/drivers/staging/line6/pcm.h
+++ b/sound/usb/line6/pcm.h
@@ -98,6 +98,8 @@ enum {
         LINE6_INDEX_PAUSE_PLAYBACK,
         LINE6_INDEX_PREPARED,
 
+#define LINE6_BIT(x) LINE6_BIT_ ## x = 1 << LINE6_INDEX_ ## x
+
         /* individual bit masks: */
         LINE6_BIT(PCM_ALSA_PLAYBACK_BUFFER),
         LINE6_BIT(PCM_ALSA_PLAYBACK_STREAM),
@@ -145,21 +147,21 @@ enum {
             LINE6_BIT_PCM_IMPULSE_PLAYBACK_BUFFER |
 #endif
             LINE6_BIT_PCM_ALSA_PLAYBACK_BUFFER |
-            LINE6_BIT_PCM_MONITOR_PLAYBACK_BUFFER ,
+            LINE6_BIT_PCM_MONITOR_PLAYBACK_BUFFER,
 
         LINE6_BITS_PLAYBACK_STREAM =
 #ifdef CONFIG_LINE6_USB_IMPULSE_RESPONSE
             LINE6_BIT_PCM_IMPULSE_PLAYBACK_STREAM |
 #endif
             LINE6_BIT_PCM_ALSA_PLAYBACK_STREAM |
-            LINE6_BIT_PCM_MONITOR_PLAYBACK_STREAM ,
+            LINE6_BIT_PCM_MONITOR_PLAYBACK_STREAM,
 
         LINE6_BITS_CAPTURE_BUFFER =
 #ifdef CONFIG_LINE6_USB_IMPULSE_RESPONSE
             LINE6_BIT_PCM_IMPULSE_CAPTURE_BUFFER |
 #endif
             LINE6_BIT_PCM_ALSA_CAPTURE_BUFFER |
-            LINE6_BIT_PCM_MONITOR_CAPTURE_BUFFER ,
+            LINE6_BIT_PCM_MONITOR_CAPTURE_BUFFER,
 
         LINE6_BITS_CAPTURE_STREAM =
 #ifdef CONFIG_LINE6_USB_IMPULSE_RESPONSE
@@ -295,16 +297,6 @@ struct snd_line6_pcm {
         int max_packet_size;
 
         /**
-                 USB endpoint for listening to audio data.
-        */
-        int ep_audio_read;
-
-        /**
-                 USB endpoint for writing audio data.
-        */
-        int ep_audio_write;
-
-        /**
                  Bit mask of active capture URBs.
         */
         unsigned long active_urb_in;
diff --git a/drivers/staging/line6/playback.c b/sound/usb/line6/playback.c
index 2ca8900e68c3..da2e3b8876b8 100644
--- a/drivers/staging/line6/playback.c
+++ b/sound/usb/line6/playback.c
@@ -261,7 +261,7 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
 #endif
                         if (!
                             (line6pcm->line6->
-                             properties->capabilities & LINE6_BIT_HWMON)
+                             properties->capabilities & LINE6_CAP_HWMON)
                             && (line6pcm->flags & LINE6_BITS_PLAYBACK_STREAM)
                             && (line6pcm->flags & LINE6_BITS_CAPTURE_STREAM))
                                 add_monitor_signal(urb_out, line6pcm->prev_fbuf,
@@ -560,6 +560,7 @@ struct snd_pcm_ops snd_line6_playback_ops = {
 
 int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm)
 {
+        struct usb_line6 *line6 = line6pcm->line6;
         int i;
 
         /* create audio URBs and fill in constant values: */
@@ -571,14 +572,14 @@ int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm)
                     usb_alloc_urb(LINE6_ISO_PACKETS, GFP_KERNEL);
 
                 if (urb == NULL) {
-                        dev_err(line6pcm->line6->ifcdev, "Out of memory\n");
+                        dev_err(line6->ifcdev, "Out of memory\n");
                         return -ENOMEM;
                 }
 
-                urb->dev = line6pcm->line6->usbdev;
+                urb->dev = line6->usbdev;
                 urb->pipe =
-                    usb_sndisocpipe(line6pcm->line6->usbdev,
-                                    line6pcm->ep_audio_write &
+                    usb_sndisocpipe(line6->usbdev,
+                                    line6->properties->ep_audio_w &
                                     USB_ENDPOINT_NUMBER_MASK);
                 urb->transfer_flags = URB_ISO_ASAP;
                 urb->start_frame = -1;
diff --git a/drivers/staging/line6/playback.h b/sound/usb/line6/playback.h
index 743bd6f74c57..743bd6f74c57 100644
--- a/drivers/staging/line6/playback.h
+++ b/sound/usb/line6/playback.h
diff --git a/drivers/staging/line6/pod.c b/sound/usb/line6/pod.c
index 44f4b2f98570..85a43631996e 100644
--- a/drivers/staging/line6/pod.c
+++ b/sound/usb/line6/pod.c
@@ -131,8 +131,9 @@ static char *pod_alloc_sysex_buffer(struct usb_line6_pod *pod, int code,
 /*
         Process a completely received message.
 */
-void line6_pod_process_message(struct usb_line6_pod *pod)
+static void line6_pod_process_message(struct usb_line6 *line6)
 {
+        struct usb_line6_pod *pod = (struct usb_line6_pod *) line6;
         const unsigned char *buf = pod->line6.buffer_message;
 
         if (memcmp(buf, pod_version_header, sizeof(pod_version_header)) == 0) {
@@ -159,15 +160,6 @@ void line6_pod_process_message(struct usb_line6_pod *pod)
 }
 
 /*
-        Transmit PODxt Pro control parameter.
-*/
-void line6_pod_transmit_parameter(struct usb_line6_pod *pod, int param,
-                                  u8 value)
-{
-        line6_transmit_parameter(&pod->line6, param, value);
-}
-
-/*
         Send system parameter (from integer).
 */
 static int pod_set_system_param_int(struct usb_line6_pod *pod, int value,
@@ -346,6 +338,35 @@ static void pod_destruct(struct usb_interface *interface)
 }
 
 /*
+        POD device disconnected.
+*/
+static void line6_pod_disconnect(struct usb_interface *interface)
+{
+        struct usb_line6_pod *pod;
+
+        if (interface == NULL)
+                return;
+        pod = usb_get_intfdata(interface);
+
+        if (pod != NULL) {
+                struct snd_line6_pcm *line6pcm = pod->line6.line6pcm;
+                struct device *dev = &interface->dev;
+
+                if (line6pcm != NULL)
+                        line6_pcm_disconnect(line6pcm);
+
+                if (dev != NULL) {
+                        /* remove sysfs entries: */
+                        device_remove_file(dev, &dev_attr_device_id);
+                        device_remove_file(dev, &dev_attr_firmware_version);
+                        device_remove_file(dev, &dev_attr_serial_number);
+                }
+        }
+
+        pod_destruct(interface);
+}
+
+/*
         Create sysfs entries.
 */
 static int pod_create_files2(struct device *dev)
@@ -362,10 +383,13 @@ static int pod_create_files2(struct device *dev)
          Try to init POD device.
 */
 static int pod_try_init(struct usb_interface *interface,
-                        struct usb_line6_pod *pod)
+                        struct usb_line6 *line6)
 {
         int err;
-        struct usb_line6 *line6 = &pod->line6;
+        struct usb_line6_pod *pod = (struct usb_line6_pod *) line6;
+
+        line6->process_message = line6_pod_process_message;
+        line6->disconnect = line6_pod_disconnect;
 
         init_timer(&pod->startup_timer);
         INIT_WORK(&pod->startup_work, pod_startup4);
@@ -405,7 +429,7 @@ static int pod_try_init(struct usb_interface *interface,
            handler.
          */
 
-        if (pod->line6.properties->capabilities & LINE6_BIT_CONTROL) {
+        if (pod->line6.properties->capabilities & LINE6_CAP_CONTROL) {
                 pod->monitor_level = POD_SYSTEM_INVALID;
 
                 /* initiate startup procedure: */
@@ -418,41 +442,12 @@ static int pod_try_init(struct usb_interface *interface,
 /*
          Init POD device (and clean up in case of failure).
 */
-int line6_pod_init(struct usb_interface *interface, struct usb_line6_pod *pod)
+int line6_pod_init(struct usb_interface *interface, struct usb_line6 *line6)
 {
-        int err = pod_try_init(interface, pod);
+        int err = pod_try_init(interface, line6);
 
         if (err < 0)
                 pod_destruct(interface);
 
         return err;
 }
-
-/*
-        POD device disconnected.
-*/
-void line6_pod_disconnect(struct usb_interface *interface)
-{
-        struct usb_line6_pod *pod;
-
-        if (interface == NULL)
-                return;
-        pod = usb_get_intfdata(interface);
-
-        if (pod != NULL) {
-                struct snd_line6_pcm *line6pcm = pod->line6.line6pcm;
-                struct device *dev = &interface->dev;
-
-                if (line6pcm != NULL)
-                        line6_pcm_disconnect(line6pcm);
-
-                if (dev != NULL) {
-                        /* remove sysfs entries: */
-                        device_remove_file(dev, &dev_attr_device_id);
-                        device_remove_file(dev, &dev_attr_firmware_version);
-                        device_remove_file(dev, &dev_attr_serial_number);
-                }
-        }
-
-        pod_destruct(interface);
-}
diff --git a/drivers/staging/line6/pod.h b/sound/usb/line6/pod.h
index 3e3f1671337a..87a8f0fa9cba 100644
--- a/drivers/staging/line6/pod.h
+++ b/sound/usb/line6/pod.h
@@ -21,12 +21,6 @@
 #include "driver.h"
 
 /*
-        PODxt Live interfaces
-*/
-#define PODXTLIVE_INTERFACE_POD    0
-#define PODXTLIVE_INTERFACE_VARIAX 1
-
-/*
         Locate name in binary program dump
 */
 #define POD_NAME_OFFSET 0
@@ -92,11 +86,7 @@ struct usb_line6_pod {
         int device_id;
 };
 
-extern void line6_pod_disconnect(struct usb_interface *interface);
 extern int line6_pod_init(struct usb_interface *interface,
-                          struct usb_line6_pod *pod);
-extern void line6_pod_process_message(struct usb_line6_pod *pod);
-extern void line6_pod_transmit_parameter(struct usb_line6_pod *pod, int param,
-                                         u8 value);
+                          struct usb_line6 *line6);
 
 #endif
diff --git a/drivers/staging/line6/podhd.c b/sound/usb/line6/podhd.c
index 7ef45437b4f2..27c5402cece8 100644
--- a/drivers/staging/line6/podhd.c
+++ b/sound/usb/line6/podhd.c
@@ -87,6 +87,27 @@ static void podhd_destruct(struct usb_interface *interface)
 }
 
 /*
+        POD HD device disconnected.
+*/
+static void line6_podhd_disconnect(struct usb_interface *interface)
+{
+        struct usb_line6_podhd *podhd;
+
+        if (interface == NULL)
+                return;
+        podhd = usb_get_intfdata(interface);
+
+        if (podhd != NULL) {
+                struct snd_line6_pcm *line6pcm = podhd->line6.line6pcm;
+
+                if (line6pcm != NULL)
+                        line6_pcm_disconnect(line6pcm);
+        }
+
+        podhd_destruct(interface);
+}
+
+/*
         Try to init POD HD device.
 */
 static int podhd_try_init(struct usb_interface *interface,
@@ -98,6 +119,8 @@ static int podhd_try_init(struct usb_interface *interface,
         if ((interface == NULL) || (podhd == NULL))
                 return -ENODEV;
 
+        line6->disconnect = line6_podhd_disconnect;
+
         /* initialize audio system: */
         err = line6_init_audio(line6);
         if (err < 0)
@@ -121,9 +144,9 @@ static int podhd_try_init(struct usb_interface *interface,
 /*
         Init POD HD device (and clean up in case of failure).
 */
-int line6_podhd_init(struct usb_interface *interface,
-                     struct usb_line6_podhd *podhd)
+int line6_podhd_init(struct usb_interface *interface, struct usb_line6 *line6)
 {
+        struct usb_line6_podhd *podhd = (struct usb_line6_podhd *) line6;
         int err = podhd_try_init(interface, podhd);
 
         if (err < 0)
@@ -131,24 +154,3 @@ int line6_podhd_init(struct usb_interface *interface,
 
         return err;
 }
-
-/*
-        POD HD device disconnected.
-*/
-void line6_podhd_disconnect(struct usb_interface *interface)
-{
-        struct usb_line6_podhd *podhd;
-
-        if (interface == NULL)
-                return;
-        podhd = usb_get_intfdata(interface);
-
-        if (podhd != NULL) {
-                struct snd_line6_pcm *line6pcm = podhd->line6.line6pcm;
-
-                if (line6pcm != NULL)
-                        line6_pcm_disconnect(line6pcm);
-        }
-
-        podhd_destruct(interface);
-}
diff --git a/drivers/staging/line6/podhd.h b/sound/usb/line6/podhd.h
index 652f74056bb9..a14f711f9725 100644
--- a/drivers/staging/line6/podhd.h
+++ b/sound/usb/line6/podhd.h
@@ -23,8 +23,7 @@ struct usb_line6_podhd {
         struct usb_line6 line6;
 };
 
-extern void line6_podhd_disconnect(struct usb_interface *interface);
 extern int line6_podhd_init(struct usb_interface *interface,
-                            struct usb_line6_podhd *podhd);
+                            struct usb_line6 *line6);
 
 #endif /* PODHD_H */
diff --git a/drivers/staging/line6/revision.h b/sound/usb/line6/revision.h
index b4eee2b73831..b4eee2b73831 100644
--- a/drivers/staging/line6/revision.h
+++ b/sound/usb/line6/revision.h
diff --git a/drivers/staging/line6/toneport.c b/sound/usb/line6/toneport.c
index 69437158d383..aae78d8a82d9 100644
--- a/drivers/staging/line6/toneport.c
+++ b/sound/usb/line6/toneport.c
@@ -97,11 +97,11 @@ static const struct {
         {"Inst & Mic", 0x0901}
 };
 
-static bool toneport_has_led(short product)
+static bool toneport_has_led(enum line6_device_type type)
 {
         return
-            (product == LINE6_DEVID_GUITARPORT) ||
-            (product == LINE6_DEVID_TONEPORT_GX);
+            (type == LINE6_GUITARPORT) ||
+            (type == LINE6_TONEPORT_GX);
         /* add your device here if you are missing support for the LEDs */
 }
 
@@ -310,7 +310,6 @@ static void toneport_setup(struct usb_line6_toneport *toneport)
         int ticks;
         struct usb_line6 *line6 = &toneport->line6;
         struct usb_device *usbdev = line6->usbdev;
-        u16 idProduct = le16_to_cpu(usbdev->descriptor.idProduct);
 
         /* sync time on device with host: */
         ticks = (int)get_seconds();
@@ -320,34 +319,69 @@ static void toneport_setup(struct usb_line6_toneport *toneport)
         toneport_send_cmd(usbdev, 0x0301, 0x0000);
 
         /* initialize source select: */
-        switch (le16_to_cpu(usbdev->descriptor.idProduct)) {
-        case LINE6_DEVID_TONEPORT_UX1:
-        case LINE6_DEVID_TONEPORT_UX2:
-        case LINE6_DEVID_PODSTUDIO_UX1:
-        case LINE6_DEVID_PODSTUDIO_UX2:
+        switch (line6->type) {
+        case LINE6_TONEPORT_UX1:
+        case LINE6_TONEPORT_UX2:
+        case LINE6_PODSTUDIO_UX1:
+        case LINE6_PODSTUDIO_UX2:
                 toneport_send_cmd(usbdev,
                                   toneport_source_info[toneport->source].code,
                                   0x0000);
+        default:
+                break;
         }
 
-        if (toneport_has_led(idProduct))
+        if (toneport_has_led(line6->type))
                 toneport_update_led(&usbdev->dev);
 }
 
 /*
+        Toneport device disconnected.
+*/
+static void line6_toneport_disconnect(struct usb_interface *interface)
+{
+        struct usb_line6_toneport *toneport;
+        u16 idProduct;
+
+        if (interface == NULL)
+                return;
+
+        toneport = usb_get_intfdata(interface);
+        del_timer_sync(&toneport->timer);
+        idProduct = le16_to_cpu(toneport->line6.usbdev->descriptor.idProduct);
+
+        if (toneport_has_led(idProduct)) {
+                device_remove_file(&interface->dev, &dev_attr_led_red);
+                device_remove_file(&interface->dev, &dev_attr_led_green);
+        }
+
+        if (toneport != NULL) {
+                struct snd_line6_pcm *line6pcm = toneport->line6.line6pcm;
+
+                if (line6pcm != NULL) {
+                        line6_pcm_release(line6pcm, LINE6_BITS_PCM_MONITOR);
+                        line6_pcm_disconnect(line6pcm);
+                }
+        }
+
+        toneport_destruct(interface);
+}
+
+
+/*
          Try to init Toneport device.
 */
 static int toneport_try_init(struct usb_interface *interface,
-                             struct usb_line6_toneport *toneport)
+                             struct usb_line6 *line6)
 {
         int err;
-        struct usb_line6 *line6 = &toneport->line6;
-        struct usb_device *usbdev = line6->usbdev;
-        u16 idProduct = le16_to_cpu(usbdev->descriptor.idProduct);
+        struct usb_line6_toneport *toneport =  (struct usb_line6_toneport *) line6;
 
         if ((interface == NULL) || (toneport == NULL))
                 return -ENODEV;
 
+        line6->disconnect = line6_toneport_disconnect;
+
         /* initialize audio system: */
         err = line6_init_audio(line6);
         if (err < 0)
@@ -366,17 +400,20 @@ static int toneport_try_init(struct usb_interface *interface,
                 return err;
 
         /* register source select control: */
-        switch (le16_to_cpu(usbdev->descriptor.idProduct)) {
-        case LINE6_DEVID_TONEPORT_UX1:
-        case LINE6_DEVID_TONEPORT_UX2:
-        case LINE6_DEVID_PODSTUDIO_UX1:
-        case LINE6_DEVID_PODSTUDIO_UX2:
+        switch (line6->type) {
+        case LINE6_TONEPORT_UX1:
+        case LINE6_TONEPORT_UX2:
+        case LINE6_PODSTUDIO_UX1:
+        case LINE6_PODSTUDIO_UX2:
                 err =
                     snd_ctl_add(line6->card,
                                 snd_ctl_new1(&toneport_control_source,
                                              line6->line6pcm));
                 if (err < 0)
                         return err;
+
+        default:
+                break;
         }
 
         /* register audio system: */
@@ -387,7 +424,7 @@ static int toneport_try_init(struct usb_interface *interface,
         line6_read_serial_number(line6, &toneport->serial_number);
         line6_read_data(line6, 0x80c2, &toneport->firmware_version, 1);
 
-        if (toneport_has_led(idProduct)) {
+        if (toneport_has_led(line6->type)) {
                 CHECK_RETURN(device_create_file
                              (&interface->dev, &dev_attr_led_red));
                 CHECK_RETURN(device_create_file
@@ -409,9 +446,9 @@ static int toneport_try_init(struct usb_interface *interface,
          Init Toneport device (and clean up in case of failure).
 */
 int line6_toneport_init(struct usb_interface *interface,
-                        struct usb_line6_toneport *toneport)
+                        struct usb_line6 *line6)
 {
-        int err = toneport_try_init(interface, toneport);
+        int err = toneport_try_init(interface, line6);
 
         if (err < 0)
                 toneport_destruct(interface);
@@ -426,35 +463,3 @@ void line6_toneport_reset_resume(struct usb_line6_toneport *toneport)
 {
         toneport_setup(toneport);
 }
-
-/*
-        Toneport device disconnected.
-*/
-void line6_toneport_disconnect(struct usb_interface *interface)
-{
-        struct usb_line6_toneport *toneport;
-        u16 idProduct;
-
-        if (interface == NULL)
-                return;
-
-        toneport = usb_get_intfdata(interface);
-        del_timer_sync(&toneport->timer);
-        idProduct = le16_to_cpu(toneport->line6.usbdev->descriptor.idProduct);
-
-        if (toneport_has_led(idProduct)) {
-                device_remove_file(&interface->dev, &dev_attr_led_red);
-                device_remove_file(&interface->dev, &dev_attr_led_green);
-        }
-
-        if (toneport != NULL) {
-                struct snd_line6_pcm *line6pcm = toneport->line6.line6pcm;
-
-                if (line6pcm != NULL) {
-                        line6_pcm_release(line6pcm, LINE6_BITS_PCM_MONITOR);
-                        line6_pcm_disconnect(line6pcm);
-                }
-        }
-
-        toneport_destruct(interface);
-}
diff --git a/drivers/staging/line6/toneport.h b/sound/usb/line6/toneport.h
index 8576b7263648..8cb14426f6ae 100644
--- a/drivers/staging/line6/toneport.h
+++ b/sound/usb/line6/toneport.h
@@ -44,9 +44,8 @@ struct usb_line6_toneport {
         struct timer_list timer;
 };
 
-extern void line6_toneport_disconnect(struct usb_interface *interface);
 extern int line6_toneport_init(struct usb_interface *interface,
-                               struct usb_line6_toneport *toneport);
+                               struct usb_line6 *line6);
 extern void line6_toneport_reset_resume(struct usb_line6_toneport *toneport);
 
 #endif
diff --git a/sound/usb/line6/usbdefs.h b/sound/usb/line6/usbdefs.h
new file mode 100644
index 000000000000..f4d080e69abc
--- /dev/null
+++ b/sound/usb/line6/usbdefs.h
@@ -0,0 +1,27 @@
+/*
+ * Line6 Linux USB driver - 0.9.1beta
+ *
+ * Copyright (C) 2005-2008 Markus Grabner (grabner@icg.tugraz.at)
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation, version 2.
+ *
+ */
+
+#ifndef USBDEFS_H
+#define USBDEFS_H
+
+#define USB_INTERVALS_PER_SECOND 1000
+
+/* device supports settings parameter via USB */
+#define LINE6_CAP_CONTROL (1 << 0)
+/* device supports PCM input/output via USB */
+#define LINE6_CAP_PCM (1 << 1)
+/* device support hardware monitoring */
+#define LINE6_CAP_HWMON (1 << 2)
+
+#define LINE6_FALLBACK_INTERVAL 10
+#define LINE6_FALLBACK_MAXPACKETSIZE 16
+
+#endif
diff --git a/drivers/staging/line6/variax.c b/sound/usb/line6/variax.c
index ae2be99f9a92..b4a41b0ad0ea 100644
--- a/drivers/staging/line6/variax.c
+++ b/sound/usb/line6/variax.c
@@ -130,8 +130,9 @@ static void variax_startup6(struct work_struct *work)
 /*
         Process a completely received message.
 */
-void line6_variax_process_message(struct usb_line6_variax *variax)
+static void line6_variax_process_message(struct usb_line6 *line6)
 {
+        struct usb_line6_variax *variax = (struct usb_line6_variax *) line6;
         const unsigned char *buf = variax->line6.buffer_message;
 
         switch (buf[0]) {
@@ -171,13 +172,28 @@ static void variax_destruct(struct usb_interface *interface)
 }
 
 /*
+        Workbench device disconnected.
+*/
+static void line6_variax_disconnect(struct usb_interface *interface)
+{
+        if (interface == NULL)
+                return;
+
+        variax_destruct(interface);
+}
+
+/*
          Try to init workbench device.
 */
 static int variax_try_init(struct usb_interface *interface,
-                           struct usb_line6_variax *variax)
+                           struct usb_line6 *line6)
 {
+        struct usb_line6_variax *variax = (struct usb_line6_variax *) line6;
         int err;
 
+        line6->process_message = line6_variax_process_message;
+        line6->disconnect = line6_variax_disconnect;
+
         init_timer(&variax->startup_timer1);
         init_timer(&variax->startup_timer2);
         INIT_WORK(&variax->startup_work, variax_startup6);
@@ -212,24 +228,12 @@ static int variax_try_init(struct usb_interface *interface,
 /*
          Init workbench device (and clean up in case of failure).
 */
-int line6_variax_init(struct usb_interface *interface,
-                      struct usb_line6_variax *variax)
+int line6_variax_init(struct usb_interface *interface, struct usb_line6 *line6)
 {
-        int err = variax_try_init(interface, variax);
+        int err = variax_try_init(interface, line6);
 
         if (err < 0)
                 variax_destruct(interface);
 
         return err;
 }
-
-/*
-        Workbench device disconnected.
-*/
-void line6_variax_disconnect(struct usb_interface *interface)
-{
-        if (interface == NULL)
-                return;
-
-        variax_destruct(interface);
-}
diff --git a/drivers/staging/line6/variax.h b/sound/usb/line6/variax.h
index 24de79620d89..dfb94e574cc4 100644
--- a/drivers/staging/line6/variax.h
+++ b/sound/usb/line6/variax.h
@@ -64,9 +64,7 @@ struct usb_line6_variax {
         int startup_progress;
 };
 
-extern void line6_variax_disconnect(struct usb_interface *interface);
 extern int line6_variax_init(struct usb_interface *interface,
-                             struct usb_line6_variax *variax);
-extern void line6_variax_process_message(struct usb_line6_variax *variax);
+                             struct usb_line6 *line6);
 
 #endif
diff --git a/tools/lib/lockdep/preload.c b/tools/lib/lockdep/preload.c
index 6f803609e498..0b0112c80f22 100644
--- a/tools/lib/lockdep/preload.c
+++ b/tools/lib/lockdep/preload.c
@@ -317,7 +317,7 @@ int pthread_mutex_destroy(pthread_mutex_t *mutex)
          *
          * TODO: Hook into free() and add that check there as well.
          */
-        debug_check_no_locks_freed(mutex, mutex + sizeof(*mutex));
+        debug_check_no_locks_freed(mutex, sizeof(*mutex));
         __del_lock(__get_lock(mutex));
         return ll_pthread_mutex_destroy(mutex);
 }
@@ -341,7 +341,7 @@ int pthread_rwlock_destroy(pthread_rwlock_t *rwlock)
 {
         try_init_preload();
 
-        debug_check_no_locks_freed(rwlock, rwlock + sizeof(*rwlock));
+        debug_check_no_locks_freed(rwlock, sizeof(*rwlock));
         __del_lock(__get_lock(rwlock));
         return ll_pthread_rwlock_destroy(rwlock);
 }
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index e7417fe97a97..747f86103599 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -232,7 +232,7 @@ static int __cmd_annotate(struct perf_annotate *ann)
                 if (nr_samples > 0) {
                         total_nr_samples += nr_samples;
                         hists__collapse_resort(hists, NULL);
-                        hists__output_resort(hists);
+                        hists__output_resort(hists, NULL);
 
                         if (symbol_conf.event_group &&
                             !perf_evsel__is_group_leader(pos))
diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c
index 1ce425d101a9..1fd96c13f199 100644
--- a/tools/perf/builtin-diff.c
+++ b/tools/perf/builtin-diff.c
@@ -545,6 +545,42 @@ hist_entry__cmp_compute(struct hist_entry *left, struct hist_entry *right,
         return __hist_entry__cmp_compute(p_left, p_right, c);
 }
 
+static int64_t
+hist_entry__cmp_nop(struct hist_entry *left __maybe_unused,
+                    struct hist_entry *right __maybe_unused)
+{
+        return 0;
+}
+
+static int64_t
+hist_entry__cmp_baseline(struct hist_entry *left, struct hist_entry *right)
+{
+        if (sort_compute)
+                return 0;
+
+        if (left->stat.period == right->stat.period)
+                return 0;
+        return left->stat.period > right->stat.period ? 1 : -1;
+}
+
+static int64_t
+hist_entry__cmp_delta(struct hist_entry *left, struct hist_entry *right)
+{
+        return hist_entry__cmp_compute(right, left, COMPUTE_DELTA);
+}
+
+static int64_t
+hist_entry__cmp_ratio(struct hist_entry *left, struct hist_entry *right)
+{
+        return hist_entry__cmp_compute(right, left, COMPUTE_RATIO);
+}
+
+static int64_t
+hist_entry__cmp_wdiff(struct hist_entry *left, struct hist_entry *right)
+{
+        return hist_entry__cmp_compute(right, left, COMPUTE_WEIGHTED_DIFF);
+}
+
 static void insert_hist_entry_by_compute(struct rb_root *root,
                                          struct hist_entry *he,
                                          int c)
@@ -605,7 +641,7 @@ static void hists__process(struct hists *hists)
                 hists__precompute(hists);
                 hists__compute_resort(hists);
         } else {
-                hists__output_resort(hists);
+                hists__output_resort(hists, NULL);
         }
 
         hists__fprintf(hists, true, 0, 0, 0, stdout);
@@ -1038,27 +1074,35 @@ static void data__hpp_register(struct data__file *d, int idx)
         fmt->header = hpp__header;
         fmt->width  = hpp__width;
         fmt->entry  = hpp__entry_global;
+        fmt->cmp    = hist_entry__cmp_nop;
+        fmt->collapse = hist_entry__cmp_nop;
 
         /* TODO more colors */
         switch (idx) {
         case PERF_HPP_DIFF__BASELINE:
                 fmt->color = hpp__color_baseline;
+                fmt->sort  = hist_entry__cmp_baseline;
                 break;
         case PERF_HPP_DIFF__DELTA:
                 fmt->color = hpp__color_delta;
+                fmt->sort  = hist_entry__cmp_delta;
                 break;
         case PERF_HPP_DIFF__RATIO:
                 fmt->color = hpp__color_ratio;
+                fmt->sort  = hist_entry__cmp_ratio;
                 break;
         case PERF_HPP_DIFF__WEIGHTED_DIFF:
                 fmt->color = hpp__color_wdiff;
+                fmt->sort  = hist_entry__cmp_wdiff;
                 break;
         default:
+                fmt->sort  = hist_entry__cmp_nop;
                 break;
         }
 
         init_header(d, dfmt);
         perf_hpp__column_register(fmt);
+        perf_hpp__register_sort_field(fmt);
 }
 
 static void ui_init(void)
diff --git a/tools/perf/builtin-list.c b/tools/perf/builtin-list.c
index 011195e38f21..198f3c3aff95 100644
--- a/tools/perf/builtin-list.c
+++ b/tools/perf/builtin-list.c
@@ -19,7 +19,9 @@
 int cmd_list(int argc, const char **argv, const char *prefix __maybe_unused)
 {
         int i;
-        const struct option list_options[] = {
+        bool raw_dump = false;
+        struct option list_options[] = {
+                OPT_BOOLEAN(0, "raw-dump", &raw_dump, "Dump raw events"),
                 OPT_END()
         };
         const char * const list_usage[] = {
@@ -27,11 +29,18 @@ int cmd_list(int argc, const char **argv, const char *prefix __maybe_unused)
                 NULL
         };
 
+        set_option_flag(list_options, 0, "raw-dump", PARSE_OPT_HIDDEN);
+
         argc = parse_options(argc, argv, list_options, list_usage,
                              PARSE_OPT_STOP_AT_NON_OPTION);
 
         setup_pager();
 
+        if (raw_dump) {
+                print_events(NULL, true);
+                return 0;
+        }
+
         if (argc == 0) {
                 print_events(NULL, false);
                 return 0;
@@ -53,8 +62,6 @@ int cmd_list(int argc, const char **argv, const char *prefix __maybe_unused)
                         print_hwcache_events(NULL, false);
                 else if (strcmp(argv[i], "pmu") == 0)
                         print_pmu_events(NULL, false);
-                else if (strcmp(argv[i], "--raw-dump") == 0)
-                        print_events(NULL, true);
                 else {
                         char *sep = strchr(argv[i], ':'), *s;
                         int sep_idx;
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 39367609c707..072ae8ad67fc 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -457,6 +457,19 @@ static void report__collapse_hists(struct report *rep)
         ui_progress__finish();
 }
 
+static void report__output_resort(struct report *rep)
+{
+        struct ui_progress prog;
+        struct perf_evsel *pos;
+
+        ui_progress__init(&prog, rep->nr_entries, "Sorting events for output...");
+
+        evlist__for_each(rep->session->evlist, pos)
+                hists__output_resort(evsel__hists(pos), &prog);
+
+        ui_progress__finish();
+}
+
 static int __cmd_report(struct report *rep)
 {
         int ret;
@@ -505,13 +518,20 @@ static int __cmd_report(struct report *rep)
         if (session_done())
                 return 0;
 
+        /*
+         * recalculate number of entries after collapsing since it
+         * might be changed during the collapse phase.
+         */
+        rep->nr_entries = 0;
+        evlist__for_each(session->evlist, pos)
+                rep->nr_entries += evsel__hists(pos)->nr_entries;
+
         if (rep->nr_entries == 0) {
                 ui__error("The %s file has no samples!\n", file->path);
                 return 0;
         }
 
-        evlist__for_each(session->evlist, pos)
-                hists__output_resort(evsel__hists(pos));
+        report__output_resort(rep);
 
         return report__browse_hists(rep);
 }
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 0aa7747ff139..961cea183a83 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -285,7 +285,7 @@ static void perf_top__print_sym_table(struct perf_top *top)
         }
 
         hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
 
         hists__output_recalc_col_len(hists, top->print_entries - printed);
         putchar('\n');
@@ -554,7 +554,7 @@ static void perf_top__sort_new_samples(void *arg)
         }
 
         hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
 }
 
 static void *display_thread_tui(void *arg)
diff --git a/tools/perf/tests/hists_cumulate.c b/tools/perf/tests/hists_cumulate.c
index 614d5c4978ab..8d110dec393e 100644
--- a/tools/perf/tests/hists_cumulate.c
+++ b/tools/perf/tests/hists_cumulate.c
@@ -187,7 +187,7 @@ static int do_test(struct hists *hists, struct result *expected, size_t nr_expec
          * function since TEST_ASSERT_VAL() returns in case of failure.
          */
         hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
 
         if (verbose > 2) {
                 pr_info("use callchain: %d, cumulate callchain: %d\n",
@@ -454,12 +454,12 @@ static int test3(struct perf_evsel *evsel, struct machine *machine)
          *   30.00%    10.00%     perf  perf           [.] cmd_record
          *   20.00%     0.00%     bash  libc           [.] malloc
          *   10.00%    10.00%     bash  [kernel]       [k] page_fault
-         *   10.00%    10.00%     perf  [kernel]       [k] schedule
-         *   10.00%     0.00%     perf  [kernel]       [k] sys_perf_event_open
+         *   10.00%    10.00%     bash  bash           [.] xmalloc
          *   10.00%    10.00%     perf  [kernel]       [k] page_fault
-         *   10.00%    10.00%     perf  libc           [.] free
          *   10.00%    10.00%     perf  libc           [.] malloc
-         *   10.00%    10.00%     bash  bash           [.] xmalloc
+         *   10.00%    10.00%     perf  [kernel]       [k] schedule
+         *   10.00%    10.00%     perf  libc           [.] free
+         *   10.00%     0.00%     perf  [kernel]       [k] sys_perf_event_open
          */
         struct result expected[] = {
                 { 7000, 2000, "perf", "perf",     "main" },
@@ -468,12 +468,12 @@ static int test3(struct perf_evsel *evsel, struct machine *machine)
                 { 3000, 1000, "perf", "perf",     "cmd_record" },
                 { 2000,    0, "bash", "libc",     "malloc" },
                 { 1000, 1000, "bash", "[kernel]", "page_fault" },
-                { 1000, 1000, "perf", "[kernel]", "schedule" },
-                { 1000,    0, "perf", "[kernel]", "sys_perf_event_open" },
+                { 1000, 1000, "bash", "bash",     "xmalloc" },
                 { 1000, 1000, "perf", "[kernel]", "page_fault" },
+                { 1000, 1000, "perf", "[kernel]", "schedule" },
                 { 1000, 1000, "perf", "libc",     "free" },
                 { 1000, 1000, "perf", "libc",     "malloc" },
-                { 1000, 1000, "bash", "bash",     "xmalloc" },
+                { 1000,    0, "perf", "[kernel]", "sys_perf_event_open" },
         };
 
         symbol_conf.use_callchain = false;
@@ -537,10 +537,13 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
          *                  malloc
          *                  main
          *
-         *   10.00%    10.00%     perf  [kernel]       [k] schedule
+         *   10.00%    10.00%     bash  bash           [.] xmalloc
          *              |
-         *              --- schedule
-         *                  run_command
+         *              --- xmalloc
+         *                  malloc
+         *                  xmalloc     <--- NOTE: there's a cycle
+         *                  malloc
+         *                  xmalloc
          *                  main
          *
          *   10.00%     0.00%     perf  [kernel]       [k] sys_perf_event_open
@@ -556,6 +559,12 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
          *                  run_command
          *                  main
          *
+         *   10.00%    10.00%     perf  [kernel]       [k] schedule
+         *              |
+         *              --- schedule
+         *                  run_command
+         *                  main
+         *
          *   10.00%    10.00%     perf  libc           [.] free
          *              |
          *              --- free
@@ -570,15 +579,6 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
          *                  run_command
          *                  main
          *
-         *   10.00%    10.00%     bash  bash           [.] xmalloc
-         *              |
-         *              --- xmalloc
-         *                  malloc
-         *                  xmalloc     <--- NOTE: there's a cycle
-         *                  malloc
-         *                  xmalloc
-         *                  main
-         *
          */
         struct result expected[] = {
                 { 7000, 2000, "perf", "perf",     "main" },
@@ -587,12 +587,12 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
                 { 3000, 1000, "perf", "perf",     "cmd_record" },
                 { 2000,    0, "bash", "libc",     "malloc" },
                 { 1000, 1000, "bash", "[kernel]", "page_fault" },
-                { 1000, 1000, "perf", "[kernel]", "schedule" },
+                { 1000, 1000, "bash", "bash",     "xmalloc" },
                 { 1000,    0, "perf", "[kernel]", "sys_perf_event_open" },
                 { 1000, 1000, "perf", "[kernel]", "page_fault" },
+                { 1000, 1000, "perf", "[kernel]", "schedule" },
                 { 1000, 1000, "perf", "libc",     "free" },
                 { 1000, 1000, "perf", "libc",     "malloc" },
-                { 1000, 1000, "bash", "bash",     "xmalloc" },
         };
         struct callchain_result expected_callchain[] = {
                 {
@@ -622,9 +622,12 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
                                 { "bash",     "main" }, },
                 },
                 {
-                        3, {    { "[kernel]", "schedule" },
-                                { "perf",     "run_command" },
-                                { "perf",     "main" }, },
+                        6, {    { "bash",     "xmalloc" },
+                                { "libc",     "malloc" },
+                                { "bash",     "xmalloc" },
+                                { "libc",     "malloc" },
+                                { "bash",     "xmalloc" },
+                                { "bash",     "main" }, },
                 },
                 {
                         3, {    { "[kernel]", "sys_perf_event_open" },
@@ -638,6 +641,11 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
                                 { "perf",     "main" }, },
                 },
                 {
+                        3, {    { "[kernel]", "schedule" },
+                                { "perf",     "run_command" },
+                                { "perf",     "main" }, },
+                },
+                {
                         4, {    { "libc",     "free" },
                                 { "perf",     "cmd_record" },
                                 { "perf",     "run_command" },
@@ -649,14 +657,6 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
                                 { "perf",     "run_command" },
                                 { "perf",     "main" }, },
                 },
-                {
-                        6, {    { "bash",     "xmalloc" },
-                                { "libc",     "malloc" },
-                                { "bash",     "xmalloc" },
-                                { "libc",     "malloc" },
-                                { "bash",     "xmalloc" },
-                                { "bash",     "main" }, },
-                },
         };
 
         symbol_conf.use_callchain = true;
diff --git a/tools/perf/tests/hists_filter.c b/tools/perf/tests/hists_filter.c
index 74f257a81265..59e53db7914c 100644
--- a/tools/perf/tests/hists_filter.c
+++ b/tools/perf/tests/hists_filter.c
@@ -138,7 +138,7 @@ int test__hists_filter(void)
                 struct hists *hists = evsel__hists(evsel);
 
                 hists__collapse_resort(hists, NULL);
-                hists__output_resort(hists);
+                hists__output_resort(hists, NULL);
 
                 if (verbose > 2) {
                         pr_info("Normal histogram\n");
diff --git a/tools/perf/tests/hists_output.c b/tools/perf/tests/hists_output.c
index a748f2be1222..f5547610da02 100644
--- a/tools/perf/tests/hists_output.c
+++ b/tools/perf/tests/hists_output.c
@@ -152,7 +152,7 @@ static int test1(struct perf_evsel *evsel, struct machine *machine)
                 goto out;
 
         hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
 
         if (verbose > 2) {
                 pr_info("[fields = %s, sort = %s]\n", field_order, sort_order);
@@ -252,7 +252,7 @@ static int test2(struct perf_evsel *evsel, struct machine *machine)
                 goto out;
 
         hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
 
         if (verbose > 2) {
                 pr_info("[fields = %s, sort = %s]\n", field_order, sort_order);
@@ -306,7 +306,7 @@ static int test3(struct perf_evsel *evsel, struct machine *machine)
                 goto out;
 
         hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
 
         if (verbose > 2) {
                 pr_info("[fields = %s, sort = %s]\n", field_order, sort_order);
@@ -384,7 +384,7 @@ static int test4(struct perf_evsel *evsel, struct machine *machine)
                 goto out;
 
         hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
 
         if (verbose > 2) {
                 pr_info("[fields = %s, sort = %s]\n", field_order, sort_order);
@@ -487,7 +487,7 @@ static int test5(struct perf_evsel *evsel, struct machine *machine)
                 goto out;
 
         hists__collapse_resort(hists, NULL);
-        hists__output_resort(hists);
+        hists__output_resort(hists, NULL);
 
         if (verbose > 2) {
                 pr_info("[fields = %s, sort = %s]\n", field_order, sort_order);
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index e6bb04b5b09b..788506eef567 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -550,7 +550,7 @@ static int hist_browser__show_callchain(struct hist_browser *browser,
         bool need_percent;
 
         node = rb_first(root);
-        need_percent = !!rb_next(node);
+        need_percent = node && rb_next(node);
 
         while (node) {
                 struct callchain_node *child = rb_entry(node, struct callchain_node, rb_node);
diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index dc0d095f318c..482adae3cc44 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -204,6 +204,9 @@ static int __hpp__sort_acc(struct hist_entry *a, struct hist_entry *b,
                 if (ret)
                         return ret;
 
+                if (a->thread != b->thread || !symbol_conf.use_callchain)
+                        return 0;
+
                 ret = b->callchain->max_depth - a->callchain->max_depth;
         }
         return ret;
diff --git a/tools/perf/ui/tui/setup.c b/tools/perf/ui/tui/setup.c
index 2f612562978c..3c38f25b1695 100644
--- a/tools/perf/ui/tui/setup.c
+++ b/tools/perf/ui/tui/setup.c
@@ -1,5 +1,8 @@
 #include <signal.h>
 #include <stdbool.h>
+#ifdef HAVE_BACKTRACE_SUPPORT
+#include <execinfo.h>
+#endif
 
 #include "../../util/cache.h"
 #include "../../util/debug.h"
@@ -88,6 +91,25 @@ int ui__getch(int delay_secs)
         return SLkp_getkey();
 }
 
+#ifdef HAVE_BACKTRACE_SUPPORT
+static void ui__signal_backtrace(int sig)
+{
+        void *stackdump[32];
+        size_t size;
+
+        ui__exit(false);
+        psignal(sig, "perf");
+
+        printf("-------- backtrace --------\n");
+        size = backtrace(stackdump, ARRAY_SIZE(stackdump));
+        backtrace_symbols_fd(stackdump, size, STDOUT_FILENO);
+
+        exit(0);
+}
+#else
+# define ui__signal_backtrace  ui__signal
+#endif
+
 static void ui__signal(int sig)
 {
         ui__exit(false);
@@ -122,8 +144,8 @@ int ui__init(void)
         ui_browser__init();
         tui_progress__init();
 
-        signal(SIGSEGV, ui__signal);
-        signal(SIGFPE, ui__signal);
+        signal(SIGSEGV, ui__signal_backtrace);
+        signal(SIGFPE, ui__signal_backtrace);
         signal(SIGINT, ui__signal);
         signal(SIGQUIT, ui__signal);
         signal(SIGTERM, ui__signal);
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 64b377e591e4..14e7a123d43b 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -841,3 +841,33 @@ char *callchain_list__sym_name(struct callchain_list *cl,
 
         return bf;
 }
+
+static void free_callchain_node(struct callchain_node *node)
+{
+        struct callchain_list *list, *tmp;
+        struct callchain_node *child;
+        struct rb_node *n;
+
+        list_for_each_entry_safe(list, tmp, &node->val, list) {
+                list_del(&list->list);
+                free(list);
+        }
+
+        n = rb_first(&node->rb_root_in);
+        while (n) {
+                child = container_of(n, struct callchain_node, rb_node_in);
+                n = rb_next(n);
+                rb_erase(&child->rb_node_in, &node->rb_root_in);
+
+                free_callchain_node(child);
+                free(child);
+        }
+}
+
+void free_callchain(struct callchain_root *root)
+{
+        if (!symbol_conf.use_callchain)
+                return;
+
+        free_callchain_node(&root->node);
+}
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index dbc08cf5f970..c0ec1acc38e4 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -198,4 +198,6 @@ static inline int arch_skip_callchain_idx(struct thread *thread __maybe_unused,
 char *callchain_list__sym_name(struct callchain_list *cl,
                                char *bf, size_t bfsize, bool show_dso);
 
+void free_callchain(struct callchain_root *root);
+
 #endif  /* __PERF_CALLCHAIN_H */
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 6e88b9e395df..182395546ddc 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -6,6 +6,7 @@
 #include "evlist.h"
 #include "evsel.h"
 #include "annotate.h"
+#include "ui/progress.h"
 #include <math.h>
 
 static bool hists__filter_entry_by_dso(struct hists *hists,
@@ -303,7 +304,7 @@ static struct hist_entry *hist_entry__new(struct hist_entry *template,
         size_t callchain_size = 0;
         struct hist_entry *he;
 
-        if (symbol_conf.use_callchain || symbol_conf.cumulate_callchain)
+        if (symbol_conf.use_callchain)
                 callchain_size = sizeof(struct callchain_root);
 
         he = zalloc(sizeof(*he) + callchain_size);
@@ -736,7 +737,7 @@ iter_add_single_cumulative_entry(struct hist_entry_iter *iter,
         iter->he = he;
         he_cache[iter->curr++] = he;
 
-        callchain_append(he->callchain, &callchain_cursor, sample->period);
+        hist_entry__append_callchain(he, sample);
 
         /*
          * We need to re-initialize the cursor since callchain_append()
@@ -809,7 +810,8 @@ iter_add_next_cumulative_entry(struct hist_entry_iter *iter,
         iter->he = he;
         he_cache[iter->curr++] = he;
 
-        callchain_append(he->callchain, &cursor, sample->period);
+        if (symbol_conf.use_callchain)
+                callchain_append(he->callchain, &cursor, sample->period);
         return 0;
 }
 
@@ -945,6 +947,7 @@ void hist_entry__free(struct hist_entry *he)
         zfree(&he->mem_info);
         zfree(&he->stat_acc);
         free_srcline(he->srcline);
+        free_callchain(he->callchain);
         free(he);
 }
 
@@ -987,6 +990,7 @@ static bool hists__collapse_insert_entry(struct hists *hists __maybe_unused,
                 else
                         p = &(*p)->rb_right;
         }
+        hists->nr_entries++;
 
         rb_link_node(&he->rb_node_in, parent, p);
         rb_insert_color(&he->rb_node_in, root);
@@ -1024,7 +1028,10 @@ void hists__collapse_resort(struct hists *hists, struct ui_progress *prog)
         if (!sort__need_collapse)
                 return;
 
+        hists->nr_entries = 0;
+
         root = hists__get_rotate_entries_in(hists);
+
         next = rb_first(root);
 
         while (next) {
@@ -1119,7 +1126,7 @@ static void __hists__insert_output_entry(struct rb_root *entries,
         rb_insert_color(&he->rb_node, entries);
 }
 
-void hists__output_resort(struct hists *hists)
+void hists__output_resort(struct hists *hists, struct ui_progress *prog)
 {
         struct rb_root *root;
         struct rb_node *next;
@@ -1148,6 +1155,9 @@ void hists__output_resort(struct hists *hists)
 
                 if (!n->filtered)
                         hists__calc_col_len(hists, n);
+
+                if (prog)
+                        ui_progress__update(prog, 1);
         }
 }
 
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index d0ef9a19a744..46bd50344f85 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -121,7 +121,7 @@ int hist_entry__sort_snprintf(struct hist_entry *he, char *bf, size_t size,
                               struct hists *hists);
 void hist_entry__free(struct hist_entry *);
 
-void hists__output_resort(struct hists *hists);
+void hists__output_resort(struct hists *hists, struct ui_progress *prog);
 void hists__collapse_resort(struct hists *hists, struct ui_progress *prog);
 
 void hists__decay_entries(struct hists *hists, bool zap_user, bool zap_kernel);
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 28eb1417cb2a..7f9b8632e433 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -495,9 +495,11 @@ static int try_to_find_probe_trace_events(struct perf_probe_event *pev,
         }
 
         if (ntevs == 0) {       /* No error but failed to find probe point. */
-                pr_warning("Probe point '%s' not found.\n",
+                pr_warning("Probe point '%s' not found in debuginfo.\n",
                            synthesize_perf_probe_point(&pev->point));
-                return -ENOENT;
+                if (need_dwarf)
+                        return -ENOENT;
+                return 0;
         }
         /* Error path : ntevs < 0 */
         pr_debug("An error occurred in debuginfo analysis (%d).\n", ntevs);
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index c7918f83b300..b5247d777f0e 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -989,8 +989,24 @@ static int debuginfo__find_probes(struct debuginfo *dbg,
         int ret = 0;
 
 #if _ELFUTILS_PREREQ(0, 142)
+        Elf *elf;
+        GElf_Ehdr ehdr;
+        GElf_Shdr shdr;
+
         /* Get the call frame information from this dwarf */
-        pf->cfi = dwarf_getcfi_elf(dwarf_getelf(dbg->dbg));
+        elf = dwarf_getelf(dbg->dbg);
+        if (elf == NULL)
+                return -EINVAL;
+
+        if (gelf_getehdr(elf, &ehdr) == NULL)
+                return -EINVAL;
+
+        if (elf_section_by_name(elf, &ehdr, &shdr, ".eh_frame", NULL) &&
+            shdr.sh_type == SHT_PROGBITS) {
+                pf->cfi = dwarf_getcfi_elf(elf);
+        } else {
+                pf->cfi = dwarf_getcfi(dbg->dbg);
+        }
 #endif
 
         off = 0;